tokmon 0.19.7 → 0.20.0

package/dist/chunk-A6RQRHRO.js

@@ -0,0 +1,1051 @@
+#!/usr/bin/env node
+import {
+  PROVIDERS,
+  TOKMON_WS_METHODS,
+  TOKMON_WS_PATH,
+  TokmonRpcGroup,
+  buildAccounts,
+  detectProviders,
+  fetchPeak,
+  resolveTimezone,
+  toJsonSafe
+} from "./chunk-MB6LRSEZ.js";
+import {
+  cacheDir,
+  expandHome,
+  loadConfig,
+  normalizeConfig,
+  saveConfig
+} from "./chunk-MVMPQJ5S.js";
+
+// src/web/server.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+
+// src/shared/colors.ts
+var FALLBACK_HEX = "#8d9090";
+var NAMED_HEX = {
+  green: "#6caa71",
+  greenBright: "#79be7e",
+  cyan: "#7ccbcd",
+  cyanBright: "#84dde0",
+  blue: "#6d96b4",
+  blueBright: "#67b5ed",
+  magenta: "#bd7bcd",
+  magentaBright: "#d389e5",
+  yellow: "#c4ac62",
+  yellowBright: "#d9c074",
+  red: "#b45648",
+  redBright: "#cf6a5a",
+  white: "#dee5eb",
+  whiteBright: "#f3f5f5",
+  gray: FALLBACK_HEX,
+  grey: FALLBACK_HEX
+};
+var PROVIDER_HEX = {
+  claude: NAMED_HEX.green,
+  codex: NAMED_HEX.cyan,
+  cursor: NAMED_HEX.magenta,
+  copilot: NAMED_HEX.white,
+  pi: NAMED_HEX.blue,
+  opencode: NAMED_HEX.yellow,
+  antigravity: NAMED_HEX.red,
+  gemini: NAMED_HEX.greenBright
+};
+function namedHex(name) {
+  if (!name) return FALLBACK_HEX;
+  if (name.startsWith("#")) return name;
+  return NAMED_HEX[name] ?? FALLBACK_HEX;
+}
+function colorHex(accountColor, providerColorName) {
+  if (accountColor) {
+    if (accountColor.startsWith("#")) return accountColor;
+    const named = NAMED_HEX[accountColor];
+    if (named) return named;
+  }
+  return namedHex(providerColorName);
+}
+var TOKEN_BUCKET = {
+  input: NAMED_HEX.blue,
+  output: NAMED_HEX.green,
+  cacheCreate: NAMED_HEX.yellow,
+  cacheRead: NAMED_HEX.cyan
+};
+
+// src/web/data.ts
+async function resolveAccounts(config) {
+  const detected = await detectProviders();
+  const accounts = buildAccounts(config, detected);
+  return accounts.map((a) => {
+    const p = PROVIDERS[a.providerId];
+    return {
+      account: a,
+      hasUsage: p.hasUsage || !!p.fetchTable,
+      hasBilling: p.hasBilling,
+      color: colorHex(a.color, PROVIDERS[a.providerId].color)
+    };
+  });
+}
+async function fetchAccountSummary(account, tz) {
+  const p = PROVIDERS[account.providerId];
+  if (!p.fetchSummary) return null;
+  return p.fetchSummary(account, tz);
+}
+async function fetchAccountTable(account, tz) {
+  const p = PROVIDERS[account.providerId];
+  if (!p.fetchTable) return null;
+  return p.fetchTable(account, tz);
+}
+async function fetchAccountBilling(account) {
+  const p = PROVIDERS[account.providerId];
+  if (!p.fetchBilling) return null;
+  return p.fetchBilling(account);
+}
+function assembleSnapshot(opts) {
+  const accounts = opts.resolved.map((r) => {
+    const u = opts.usage.get(r.account.id);
+    const billing = opts.billing.get(r.account.id) ?? null;
+    return {
+      id: r.account.id,
+      providerId: r.account.providerId,
+      name: r.account.name,
+      color: r.color,
+      homeDir: r.account.homeDir ?? null,
+      hasUsage: r.hasUsage,
+      hasBilling: r.hasBilling,
+      email: billing?.email ?? null,
+      displayName: billing?.displayName ?? null,
+      plan: billing?.plan ?? null,
+      dashboard: u?.dashboard ?? null,
+      table: u?.table ?? null,
+      billing,
+      summaryState: opts.summaryState?.get(r.account.id) ?? "pending",
+      billingState: opts.billingState?.get(r.account.id) ?? "pending",
+      tableState: opts.tableState?.get(r.account.id) ?? "pending"
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const providers = [];
+  for (const r of opts.resolved) {
+    if (seen.has(r.account.providerId)) continue;
+    seen.add(r.account.providerId);
+    providers.push({
+      id: r.account.providerId,
+      name: PROVIDERS[r.account.providerId].name,
+      color: namedHex(PROVIDERS[r.account.providerId].color)
+    });
+  }
+  return toJsonSafe({
+    version: opts.version,
+    generatedAt: Date.now(),
+    tz: opts.tz,
+    intervalMs: opts.intervalMs,
+    providers,
+    accounts,
+    seeded: opts.seeded ?? false,
+    peak: opts.peak ?? null
+  });
+}
+function tzFor(config) {
+  return resolveTimezone(config.timezone);
+}
+
+// src/web/static.ts
+import { createReadStream, existsSync, readFileSync } from "fs";
+import { stat } from "fs/promises";
+import { fileURLToPath } from "url";
+import { extname, join, normalize, sep } from "path";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".map": "application/json; charset=utf-8",
+  ".webmanifest": "application/manifest+json"
+};
+function findWebRoot() {
+  const candidates = ["./web/", "../web/", "../dist/web/", "../../dist/web/"];
+  for (const rel of candidates) {
+    try {
+      const dir = fileURLToPath(new URL(rel, import.meta.url));
+      if (existsSync(join(dir, "index.html"))) return dir.replace(/[\\/]+$/, "");
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveStaticPath(webRoot, urlPath) {
+  let clean;
+  try {
+    clean = decodeURIComponent(urlPath.split("?")[0]);
+  } catch {
+    return null;
+  }
+  const rel = normalize(clean).replace(/^(\.\.[/\\])+/, "").replace(/^[/\\]+/, "");
+  const full = join(webRoot, rel);
+  if (full !== webRoot && !full.startsWith(webRoot + sep)) return null;
+  return full;
+}
+function send(res, status, type, body) {
+  res.writeHead(status, { "Content-Type": type, "Cache-Control": "no-store" });
+  res.end(body);
+}
+function sendJson(res, status, data) {
+  send(res, status, "application/json; charset=utf-8", JSON.stringify(data));
+}
+function serveStatic(webRoot, urlPath, res) {
+  const path = urlPath.split("?")[0];
+  const filePath = resolveStaticPath(webRoot, path === "/" ? "/index.html" : path);
+  if (!filePath) {
+    send(res, 403, "text/plain", "forbidden");
+    return;
+  }
+  void stat(filePath).then((st) => {
+    if (st.isFile()) {
+      const type = MIME[extname(filePath).toLowerCase()] || "application/octet-stream";
+      const immutable = filePath.includes(`${sep}assets${sep}`);
+      res.writeHead(200, {
+        "Content-Type": type,
+        "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache"
+      });
+      createReadStream(filePath).pipe(res);
+    } else {
+      throw new Error("not a file");
+    }
+  }).catch(() => {
+    if (extname(path)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    const indexPath = join(webRoot, "index.html");
+    if (!existsSync(indexPath)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": MIME[".html"], "Cache-Control": "no-cache" });
+    createReadStream(indexPath).on("error", () => {
+      try {
+        res.destroy();
+      } catch {
+      }
+    }).pipe(res);
+  });
+}
+function appVersion() {
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const p = fileURLToPath(new URL(rel, import.meta.url));
+      const pkg = JSON.parse(readFileSync(p, "utf-8"));
+      if (typeof pkg.version === "string") return pkg.version;
+    } catch {
+    }
+  }
+  return "";
+}
+
+// src/web/vite-dev.ts
+import { existsSync as existsSync2 } from "fs";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+import { createRequire } from "module";
+import { join as join2 } from "path";
+function isDevMode() {
+  const forced = process.env.TOKMON_WEB_MODE;
+  if (forced === "dev") return true;
+  if (forced === "prod") return false;
+  return import.meta.url.includes("/src/");
+}
+function findWebSource() {
+  for (const rel of ["../../web/", "../web/", "./web/"]) {
+    try {
+      const dir = fileURLToPath2(new URL(rel, import.meta.url));
+      if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {
+        return dir.replace(/[\\/]+$/, "");
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function createViteDevServer(httpServer, log) {
+  const root = findWebSource();
+  if (!root) {
+    log("  \u26A0 dev mode: web/ source not found");
+    return null;
+  }
+  try {
+    const req = createRequire(pathToFileURL(join2(root, "package.json")).href);
+    const vitePath = req.resolve("vite");
+    const vite = await import(pathToFileURL(vitePath).href);
+    const dev = await vite.createServer({
+      root,
+      configFile: join2(root, "vite.config.ts"),
+      server: { middlewareMode: true, hmr: { server: httpServer } },
+      appType: "spa",
+      clearScreen: false,
+      logLevel: "warn"
+    });
+    log("  \u25C6 dev mode \u2014 Vite HMR attached (edit web/src and it hot-reloads)");
+    return dev;
+  } catch (e) {
+    log(`  \u26A0 couldn't start Vite dev server: ${e.message}`);
+    log("    run `pnpm --prefix web install` (or `npm run web:install`) for HMR, or `npm run build` for a static bundle");
+    return null;
+  }
+}
+var MISSING_BUILD_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>tokmon web</title>
+<style>body{background:#0a0d0e;color:#cdd6d8;font:14px ui-monospace,Menlo,monospace;padding:3rem;line-height:1.7}
+code{color:#e6b450}</style></head><body>
+<h1 style="color:#00d787">tokmon web</h1>
+<p>The dashboard isn't available.</p>
+<p><b>Prod:</b> run <code>npm run build</code> (builds <code>dist/web</code>), then <code>tokmon serve</code>.</p>
+<p><b>Dev:</b> run <code>pnpm --prefix web install</code> so the Vite dev server (HMR) can start.</p>
+</body></html>`;
+
+// src/web/data-engine.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, renameSync } from "fs";
+import { join as join3 } from "path";
+var TABLE_INTERVAL_MS = 3e5;
+var PEAK_INTERVAL_MS = 3e5;
+var IDLE_PAUSE_MS = 6e4;
+var SNAPSHOT_CACHE_THROTTLE_MS = 2e4;
+var REVEAL_THROTTLE_MS = 500;
+var snapshotCacheFile = () => join3(cacheDir(), "web-snapshot.json");
+function createDataEngine(opts) {
+  const { version } = opts;
+  let tz = opts.tz;
+  let summaryIntervalMs = opts.summaryIntervalMs;
+  let billingIntervalMs = opts.billingIntervalMs;
+  let resolved = opts.resolved;
+  let currentConfig = opts.config;
+  const usage = /* @__PURE__ */ new Map();
+  const billing = /* @__PURE__ */ new Map();
+  const summaryState = /* @__PURE__ */ new Map();
+  const billingState = /* @__PURE__ */ new Map();
+  const tableState = /* @__PURE__ */ new Map();
+  let peak = null;
+  let seeded = false;
+  let current = null;
+  const snapshotSubscribers = /* @__PURE__ */ new Set();
+  const configSubscribers = /* @__PURE__ */ new Set();
+  let lastActivity = Date.now();
+  let stopped = false;
+  let summaryTimer;
+  let tableTimer;
+  let billingTimer;
+  let peakTimer;
+  let lastPersist = 0;
+  let lastReveal = 0;
+  let configEpoch = 0;
+  let hasClaude = resolved.some((r) => r.account.providerId === "claude");
+  const idle = () => snapshotSubscribers.size === 0 && Date.now() - lastActivity > IDLE_PAUSE_MS;
+  const usageEntry = (id) => {
+    let u = usage.get(id);
+    if (!u) {
+      u = { dashboard: null, table: null };
+      usage.set(id, u);
+    }
+    return u;
+  };
+  const buildSnapshot = () => assembleSnapshot({
+    version,
+    tz,
+    intervalMs: summaryIntervalMs,
+    resolved,
+    usage,
+    billing,
+    summaryState,
+    billingState,
+    tableState,
+    seeded,
+    peak
+  });
+  const hydrateFromCache = () => {
+    try {
+      const cached = JSON.parse(readFileSync2(snapshotCacheFile(), "utf-8"));
+      if (!cached || !Array.isArray(cached.accounts)) return;
+      for (const a of cached.accounts) {
+        if (a.dashboard || a.table) {
+          usage.set(a.id, { dashboard: a.dashboard, table: a.table });
+          if (a.dashboard) summaryState.set(a.id, "ready");
+          if (a.table) tableState.set(a.id, "ready");
+        }
+        if (a.billing) {
+          billing.set(a.id, a.billing);
+          billingState.set(a.id, "ready");
+        }
+      }
+      seeded = true;
+      current = buildSnapshot();
+    } catch {
+    }
+  };
+  const persist = () => {
+    if (!current) return;
+    if (!current.accounts.some((a) => a.hasUsage && a.table != null)) return;
+    if (Date.now() - lastPersist < SNAPSHOT_CACHE_THROTTLE_MS) return;
+    lastPersist = Date.now();
+    try {
+      mkdirSync(cacheDir(), { recursive: true, mode: 448 });
+      const tmp = join3(cacheDir(), `web-snapshot.json.${process.pid}.tmp`);
+      writeFileSync(tmp, JSON.stringify(current), { mode: 384 });
+      renameSync(tmp, snapshotCacheFile());
+    } catch {
+    }
+  };
+  const rebuild = () => {
+    if (stopped) return;
+    seeded = false;
+    current = buildSnapshot();
+    persist();
+    for (const onSnapshot of snapshotSubscribers) {
+      try {
+        onSnapshot(current);
+      } catch {
+      }
+    }
+  };
+  const reveal = () => {
+    if (stopped) return;
+    if (Date.now() - lastReveal < REVEAL_THROTTLE_MS) return;
+    lastReveal = Date.now();
+    rebuild();
+  };
+  let usageAccounts = resolved.filter((r) => r.hasUsage);
+  let billingAccounts = resolved.filter((r) => r.hasBilling);
+  let summaryBusy = false;
+  let summaryForcePending = false;
+  const refreshSummary = async (force = false) => {
+    if (stopped) return;
+    if (summaryBusy) {
+      if (force) summaryForcePending = true;
+      return;
+    }
+    if (!force && idle()) return;
+    const epoch = configEpoch;
+    summaryBusy = true;
+    try {
+      for (const r of usageAccounts) {
+        if (stopped) return;
+        let dashboard = null;
+        let ok = true;
+        try {
+          dashboard = await fetchAccountSummary(r.account, tz);
+        } catch {
+          ok = false;
+        }
+        if (stopped || epoch !== configEpoch) return;
+        if (ok) {
+          usageEntry(r.account.id).dashboard = dashboard;
+          summaryState.set(r.account.id, "ready");
+        } else summaryState.set(r.account.id, "error");
+        reveal();
+      }
+      rebuild();
+    } finally {
+      summaryBusy = false;
+      if (summaryForcePending && !stopped) {
+        summaryForcePending = false;
+        void refreshSummary(true);
+      }
+    }
+  };
+  let tableBusy = false;
+  let tableForcePending = false;
+  const refreshTable = async (force = false) => {
+    if (stopped) return;
+    if (tableBusy) {
+      if (force) tableForcePending = true;
+      return;
+    }
+    if (!force && idle()) return;
+    const epoch = configEpoch;
+    tableBusy = true;
+    try {
+      for (const r of usageAccounts) {
+        if (stopped) return;
+        let table = null;
+        let ok = true;
+        try {
+          table = await fetchAccountTable(r.account, tz);
+        } catch {
+          ok = false;
+        }
+        if (stopped || epoch !== configEpoch) return;
+        if (ok) {
+          usageEntry(r.account.id).table = table;
+          tableState.set(r.account.id, "ready");
+        } else tableState.set(r.account.id, "error");
+        reveal();
+      }
+      rebuild();
+    } finally {
+      tableBusy = false;
+      if (tableForcePending && !stopped) {
+        tableForcePending = false;
+        void refreshTable(true);
+      }
+    }
+  };
+  let billingBusy = false;
+  let billingForcePending = false;
+  const refreshBilling = async (force = false) => {
+    if (stopped) return;
+    if (billingBusy) {
+      if (force) billingForcePending = true;
+      return;
+    }
+    if (!force && idle()) return;
+    const epoch = configEpoch;
+    billingBusy = true;
+    try {
+      for (const r of billingAccounts) {
+        if (stopped) return;
+        let result = null;
+        let ok = true;
+        try {
+          result = await fetchAccountBilling(r.account);
+        } catch {
+          ok = false;
+        }
+        if (stopped || epoch !== configEpoch) return;
+        if (ok) {
+          billing.set(r.account.id, result);
+          billingState.set(r.account.id, "ready");
+        } else billingState.set(r.account.id, "error");
+        reveal();
+      }
+      rebuild();
+    } finally {
+      billingBusy = false;
+      if (billingForcePending && !stopped) {
+        billingForcePending = false;
+        void refreshBilling(true);
+      }
+    }
+  };
+  let peakBusy = false;
+  const refreshPeak = async (force = false) => {
+    if (stopped || peakBusy || !hasClaude || !force && idle()) return;
+    peakBusy = true;
+    try {
+      const next = await fetchPeak();
+      if (next) {
+        peak = next;
+        rebuild();
+      }
+    } finally {
+      peakBusy = false;
+    }
+  };
+  const clearTimers = () => {
+    clearInterval(summaryTimer);
+    summaryTimer = void 0;
+    clearInterval(tableTimer);
+    tableTimer = void 0;
+    clearInterval(billingTimer);
+    billingTimer = void 0;
+    clearInterval(peakTimer);
+    peakTimer = void 0;
+  };
+  const startTimers = () => {
+    summaryTimer = setInterval(() => {
+      void refreshSummary();
+    }, summaryIntervalMs);
+    tableTimer = setInterval(() => {
+      void refreshTable();
+    }, TABLE_INTERVAL_MS);
+    billingTimer = setInterval(() => {
+      void refreshBilling();
+    }, billingIntervalMs);
+    summaryTimer.unref?.();
+    tableTimer.unref?.();
+    billingTimer.unref?.();
+    if (hasClaude) {
+      peakTimer = setInterval(() => {
+        void refreshPeak();
+      }, PEAK_INTERVAL_MS);
+      peakTimer.unref?.();
+    }
+  };
+  hydrateFromCache();
+  return {
+    snapshot: () => current,
+    start() {
+      void refreshSummary(true);
+      void refreshTable(true);
+      void refreshBilling(true);
+      if (hasClaude) void refreshPeak(true);
+      startTimers();
+    },
+    touch() {
+      lastActivity = Date.now();
+    },
+    refresh(scope = "all") {
+      if (stopped) return;
+      if (scope === "all" || scope === "summary") void refreshSummary(true);
+      if (scope === "all" || scope === "table") void refreshTable(true);
+      if (scope === "all" || scope === "billing") void refreshBilling(true);
+      if ((scope === "all" || scope === "peak") && hasClaude) void refreshPeak(true);
+    },
+    setConfig(next) {
+      if (stopped) return;
+      clearTimers();
+      configEpoch++;
+      tz = next.tz;
+      summaryIntervalMs = next.summaryIntervalMs;
+      billingIntervalMs = next.billingIntervalMs;
+      resolved = next.resolved;
+      hasClaude = resolved.some((r) => r.account.providerId === "claude");
+      if (!hasClaude) peak = null;
+      usageAccounts = resolved.filter((r) => r.hasUsage);
+      billingAccounts = resolved.filter((r) => r.hasBilling);
+      const survivors = new Set(resolved.map((r) => r.account.id));
+      for (const id of [...usage.keys()]) if (!survivors.has(id)) usage.delete(id);
+      for (const id of [...billing.keys()]) if (!survivors.has(id)) billing.delete(id);
+      for (const map of [summaryState, billingState, tableState]) {
+        for (const id of [...map.keys()]) if (!survivors.has(id)) map.delete(id);
+      }
+      rebuild();
+      void refreshSummary(true);
+      void refreshTable(true);
+      void refreshBilling(true);
+      if (hasClaude) void refreshPeak(true);
+      startTimers();
+    },
+    broadcastConfig(config) {
+      if (stopped) return;
+      currentConfig = config;
+      for (const onConfig of configSubscribers) {
+        try {
+          onConfig(config);
+        } catch {
+        }
+      }
+    },
+    subscribe(onSnapshot) {
+      if (current) {
+        try {
+          onSnapshot(current);
+        } catch {
+        }
+      }
+      snapshotSubscribers.add(onSnapshot);
+      lastActivity = Date.now();
+      if (!current || Date.now() - current.generatedAt > summaryIntervalMs) {
+        void refreshSummary(true);
+        void refreshTable(true);
+      }
+      return () => {
+        snapshotSubscribers.delete(onSnapshot);
+      };
+    },
+    subscribeConfig(onConfig) {
+      try {
+        onConfig(currentConfig);
+      } catch {
+      }
+      configSubscribers.add(onConfig);
+      return () => {
+        configSubscribers.delete(onConfig);
+      };
+    },
+    stop() {
+      stopped = true;
+      clearTimers();
+      snapshotSubscribers.clear();
+      configSubscribers.clear();
+    }
+  };
+}
+
+// src/web/config-control.ts
+var MIN_SUMMARY_INTERVAL_MS = 8e3;
+var BILLING_INTERVAL_FALLBACK_MIN = 5;
+var summaryIntervalFor = (config) => Math.max(MIN_SUMMARY_INTERVAL_MS, (config.interval || 2) * 1e3);
+var billingIntervalFor = (config) => Math.max(1, config.billingInterval || BILLING_INTERVAL_FALLBACK_MIN) * 6e4;
+async function resolveEngineConfig(config) {
+  return {
+    resolved: await resolveAccounts(config),
+    tz: tzFor(config),
+    summaryIntervalMs: summaryIntervalFor(config),
+    billingIntervalMs: billingIntervalFor(config)
+  };
+}
+async function applyConfigUpdate(engine, state, input) {
+  const normalized = normalizeConfig(input);
+  state.config = normalized;
+  await saveConfig(normalized);
+  engine.setConfig(await resolveEngineConfig(normalized));
+  engine.broadcastConfig(normalized);
+  return normalized;
+}
+
+// src/web/ws.ts
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import { NodeWS } from "@effect/platform-node/NodeSocket";
+import { Effect, Exit, Layer, Queue, Scope, Stream } from "effect";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+
+// src/web/fs.ts
+import { readdir, stat as stat2, realpath } from "fs/promises";
+import { homedir } from "os";
+import { join as join4, resolve as resolvePath, isAbsolute, sep as sep2 } from "path";
+function isContained(root, target) {
+  return target === root || target.startsWith(root + sep2);
+}
+async function listHomeDirectory(rawPath) {
+  const root = resolvePath(homedir());
+  const expanded = expandHome(rawPath || "~");
+  const requested = isAbsolute(expanded) ? resolvePath(expanded) : resolvePath(root, expanded);
+  const lexical = isContained(root, requested) ? requested : root;
+  let real;
+  try {
+    real = await realpath(lexical);
+  } catch {
+    real = lexical;
+  }
+  const abs = isContained(root, real) ? real : root;
+  const st = await stat2(abs);
+  if (!st.isDirectory()) throw new Error("not a directory");
+  const dirents = await readdir(abs, { withFileTypes: true });
+  const entries = [];
+  for (const d of dirents) {
+    if (d.name.startsWith(".")) continue;
+    let dir = d.isDirectory();
+    const full = join4(abs, d.name);
+    if (d.isSymbolicLink()) {
+      let real2;
+      try {
+        real2 = await realpath(full);
+      } catch {
+        continue;
+      }
+      if (!isContained(root, real2)) continue;
+      try {
+        dir = (await stat2(full)).isDirectory();
+      } catch {
+        continue;
+      }
+    }
+    entries.push({ name: d.name, path: full, dir });
+  }
+  entries.sort((a, b) => a.dir === b.dir ? a.name.localeCompare(b.name) : a.dir ? -1 : 1);
+  const parentResolved = resolvePath(abs, "..");
+  const parent = abs === root || !isContained(root, parentResolved) ? null : parentResolved;
+  return { path: abs, parent, entries };
+}
+
+// src/web/ws.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+function header(req, name) {
+  const value = req.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function hostOnly(value) {
+  if (!value) return null;
+  let host = value.trim().toLowerCase();
+  if (!host) return null;
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    return end === -1 ? host.slice(1) : host.slice(1, end);
+  }
+  return host.split(":")[0] ?? null;
+}
+function isLoopbackHost(value) {
+  const host = hostOnly(value);
+  return host !== null && LOOPBACK_HOSTS.has(host);
+}
+function originHost(origin) {
+  if (!origin || origin === "null") return null;
+  try {
+    return new URL(origin).host;
+  } catch {
+    return null;
+  }
+}
+function isLoopbackOrigin(origin) {
+  if (!origin || origin === "null") return true;
+  return isLoopbackHost(originHost(origin) ?? void 0);
+}
+function isSameOrigin(req) {
+  const origin = originHost(header(req, "origin"));
+  if (!origin) return false;
+  return origin.toLowerCase() === (header(req, "host") ?? "").toLowerCase();
+}
+function isWsPath(req) {
+  try {
+    return new URL(req.url ?? "/", "http://127.0.0.1").pathname === TOKMON_WS_PATH;
+  } catch {
+    return false;
+  }
+}
+function wsToken(req) {
+  try {
+    return new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("wsToken");
+  } catch {
+    return null;
+  }
+}
+function isAuthorized(req, token) {
+  const host = header(req, "host");
+  const origin = header(req, "origin");
+  if (!isLoopbackHost(host) || !isLoopbackOrigin(origin)) return false;
+  if (wsToken(req) === token) return true;
+  return isSameOrigin(req);
+}
+function rejectUpgrade(socket, status = 403, message = "Forbidden") {
+  try {
+    socket.write(
+      `HTTP/1.1 ${status} ${message}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`
+    );
+  } catch {
+  }
+  try {
+    socket.destroy();
+  } catch {
+  }
+}
+function snapshotStream(engine) {
+  return Stream.callback((queue) => Effect.gen(function* () {
+    const scope = yield* Scope.Scope;
+    const unsubscribe = engine.subscribe((snapshot) => {
+      if (snapshot != null) Queue.offerUnsafe(queue, snapshot);
+    });
+    yield* Scope.addFinalizer(scope, Effect.sync(unsubscribe));
+  }), { bufferSize: 16, strategy: "sliding" });
+}
+function configStream(engine) {
+  return Stream.callback((queue) => Effect.gen(function* () {
+    const scope = yield* Scope.Scope;
+    const unsubscribe = engine.subscribeConfig((config) => {
+      Queue.offerUnsafe(queue, config);
+    });
+    yield* Scope.addFinalizer(scope, Effect.sync(unsubscribe));
+  }), { bufferSize: 16, strategy: "sliding" });
+}
+async function mountWsRpc(server, deps) {
+  const scope = await Effect.runPromise(Scope.make());
+  const wss = new NodeWS.WebSocketServer({ noServer: true });
+  const handlersLayer = TokmonRpcGroup.toLayer(
+    TokmonRpcGroup.of({
+      [TOKMON_WS_METHODS.getConfig]: () => Effect.promise(async () => deps.state.config ?? await loadConfig()),
+      [TOKMON_WS_METHODS.setConfig]: (config) => Effect.promise(() => applyConfigUpdate(deps.engine, deps.state, config)),
+      [TOKMON_WS_METHODS.refresh]: ({ scope: scope2 }) => Effect.sync(() => {
+        deps.engine.refresh(scope2);
+      }),
+      [TOKMON_WS_METHODS.browseFs]: ({ path }) => Effect.promise(() => listHomeDirectory(path)),
+      [TOKMON_WS_METHODS.snapshot]: () => snapshotStream(deps.engine),
+      [TOKMON_WS_METHODS.config]: () => configStream(deps.engine)
+    })
+  );
+  const httpEffect = await Effect.runPromise(
+    RpcServer.toHttpEffectWebsocket(TokmonRpcGroup, {
+      spanPrefix: "tokmon.rpc",
+      spanAttributes: {
+        "rpc.transport": "websocket",
+        "rpc.system": "effect-rpc"
+      }
+    }).pipe(
+      Effect.provide(handlersLayer.pipe(Layer.provideMerge(RpcSerialization.layerJson))),
+      Scope.provide(scope)
+    )
+  );
+  const upgradeHandler = await Effect.runPromise(
+    NodeHttpServer.makeUpgradeHandler(Effect.succeed(wss), httpEffect, { scope }).pipe(
+      Scope.provide(scope)
+    )
+  );
+  const onUpgrade = (req, socket, head) => {
+    if (!isWsPath(req)) return;
+    if (!isAuthorized(req, deps.wsToken)) {
+      rejectUpgrade(socket);
+      return;
+    }
+    upgradeHandler(req, socket, head);
+  };
+  server.on("upgrade", onUpgrade);
+  return async () => {
+    server.off("upgrade", onUpgrade);
+    await new Promise((resolve) => {
+      wss.close(() => resolve());
+    });
+    await Effect.runPromise(Scope.close(scope, Exit.void));
+  };
+}
+
+// src/web/server.ts
+var HOST = "127.0.0.1";
+var DEFAULT_PORT = 4317;
+var MAX_PORT_TRIES = 20;
+function isLoopbackHostHeader(value) {
+  if (!value) return false;
+  let host = value.trim().toLowerCase();
+  if (host.startsWith("[")) host = host.slice(1, host.indexOf("]") === -1 ? host.length : host.indexOf("]"));
+  else host = host.split(":")[0];
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+function isLoopbackOrigin2(origin) {
+  if (!origin || origin === "null") return true;
+  try {
+    const u = new URL(origin);
+    return isLoopbackHostHeader(u.host);
+  } catch {
+    return false;
+  }
+}
+function guardPrivileged(req, res) {
+  const header2 = (n) => {
+    const v = req.headers[n];
+    return Array.isArray(v) ? v[0] : v;
+  };
+  if (req.headers["x-tokmon-client"] !== "1") {
+    sendJson(res, 403, { error: "forbidden" });
+    return false;
+  }
+  if (!isLoopbackHostHeader(header2("host")) || !isLoopbackOrigin2(header2("origin"))) {
+    sendJson(res, 403, { error: "forbidden" });
+    return false;
+  }
+  return true;
+}
+function createRouter(engine, state, vite, webRoot) {
+  return (req, res) => {
+    const url = req.url || "/";
+    const path = url.split("?")[0];
+    const method = req.method || "GET";
+    if (path === "/api/data") {
+      engine.touch();
+      sendJson(res, 200, engine.snapshot() ?? { pending: true });
+      return;
+    }
+    if (path === "/healthz") {
+      sendJson(res, 200, { ok: true, ready: engine.snapshot() !== null });
+      return;
+    }
+    if (path === "/api/config") {
+      if (!guardPrivileged(req, res)) return;
+      if (method === "GET") {
+        sendJson(res, 200, state.config);
+        return;
+      }
+      sendJson(res, 405, { error: "method not allowed" });
+      return;
+    }
+    if (vite) {
+      vite.middlewares(req, res, () => {
+        send(res, 404, "text/plain", "not found");
+      });
+      return;
+    }
+    if (!webRoot) {
+      send(res, 503, "text/html; charset=utf-8", MISSING_BUILD_HTML);
+      return;
+    }
+    serveStatic(webRoot, url, res);
+  };
+}
+async function startWebServer(opts) {
+  const state = { config: opts.config };
+  const tz = tzFor(state.config);
+  const version = appVersion();
+  const summaryIntervalMs = summaryIntervalFor(state.config);
+  const billingIntervalMs = billingIntervalFor(state.config);
+  const wsToken2 = randomBytes(32).toString("base64url");
+  const log = (msg) => {
+    if (opts.log) process.stdout.write(msg + "\n");
+  };
+  const resolved = await resolveAccounts(state.config);
+  const server = createServer();
+  let vite = null;
+  if (isDevMode()) vite = await createViteDevServer(server, log);
+  const webRoot = vite ? null : findWebRoot();
+  if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
+  const engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
+  server.addListener("request", createRouter(engine, state, vite, webRoot));
+  const closeWsRpc = await mountWsRpc(server, { engine, state, wsToken: wsToken2 });
+  const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT);
+  const serverUrl = `http://${HOST}:${port}`;
+  if (vite?.warmupRequest) {
+    try {
+      await Promise.race([vite.warmupRequest("/src/main.tsx"), delay(5e3)]);
+    } catch {
+    }
+  }
+  engine.start();
+  return {
+    url: serverUrl,
+    port,
+    wsToken: wsToken2,
+    snapshot: engine.snapshot,
+    config: () => state.config,
+    stop: async () => {
+      engine.stop();
+      await closeWsRpc().catch(() => {
+      });
+      const closeHttp = () => new Promise((resolve) => {
+        server.close(() => resolve());
+        server.closeAllConnections?.();
+      });
+      if (vite) {
+        try {
+          await vite.close();
+        } catch {
+        }
+      }
+      await closeHttp();
+    }
+  };
+}
+function delay(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    t.unref?.();
+  });
+}
+function listenWithFallback(server, startPort) {
+  return new Promise((resolve, reject) => {
+    if (startPort === 0) {
+      server.once("error", reject);
+      server.listen(0, HOST, () => {
+        const addr = server.address();
+        resolve(typeof addr === "object" && addr ? addr.port : 0);
+      });
+      return;
+    }
+    let port = startPort;
+    let tries = 0;
+    const attempt = () => {
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && tries < MAX_PORT_TRIES) {
+          tries++;
+          port++;
+          setImmediate(attempt);
+        } else {
+          reject(err);
+        }
+      });
+      server.listen(port, HOST, () => resolve(port));
+    };
+    attempt();
+  });
+}
+
+export {
+  appVersion,
+  startWebServer
+};