wslog-proxy 0.0.0-stage → 0.1.1

package/dist/server/http/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/server/http/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAuC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAqB,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,MAAqB;IAC7C,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB;QAAE,OAAO,MAAM,CAAC;IAC/D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAiB;IACjE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAEjD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,CAAC,IAAI,CACT,cAAc,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,EAAqB,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;QAC1F,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,uDAAuD;QACvD,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CAAC;IAEF,MAAM,CAAC,MAAM,CACX,kBAAkB,EAClB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAEzD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,KAAK;aACT,KAAK,CAAC,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aAC5G,GAAG,CAAC,SAAS,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mEAAmE,CAAC,CAAC;QAC3G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACX,eAAe,EACf,GAAG,EAAE;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB;YACE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,MAAM;YACN,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;YAC3B,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;YAC/B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;SAC9B,EACD,IAAI,EACJ,CAAC,CACF,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,iCAAiC;YACjD,qBAAqB,EAAE,+BAA+B,KAAK,QAAQ;YACnE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YACzC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/H,MAAM,CAAC,IAAI,CACT,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjB,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,GAAW,EAAE,GAAW;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChF,CAAC"}

package/dist/server/http/auth.d.ts

@@ -0,0 +1,26 @@
+import type { IncomingMessage } from 'node:http';
+import type { Role } from '../../shared/protocol.js';
+import { type WslogConfig } from '../config.js';
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * Who is calling?
+ * - the share token        → viewer (read-only)
+ * - the admin token        → admin
+ * - no token, from loopback → admin (the person running wslog), but only
+ *   when the Host header is a local name too. Otherwise a website that
+ *   rebinds its DNS to 127.0.0.1 would be admin when bound to 0.0.0.0.
+ * - anything else          → rejected
+ */
+export declare function resolveRole(req: IncomingMessage, url: URL, config: WslogConfig): Role | null;
+/**
+ * Browser-safety checks for the dashboard and API (not the proxy endpoint):
+ * - Origin must match Host, so other websites cannot read traffic through
+ *   the live WebSocket or call the API (cross-site WebSocket hijacking).
+ *   `Origin: null` (sandboxed iframes, local files) is blocked too: the
+ *   dashboard never sends it.
+ * - When bound to loopback, Host must be a local name (DNS rebinding).
+ */
+export declare function checkBrowserSafety(req: IncomingMessage, config: WslogConfig): void;

package/dist/server/http/auth.js

@@ -0,0 +1,78 @@
+import { timingSafeEqual } from 'node:crypto';
+import { isLoopbackHost } from '../config.js';
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/**
+ * Who is calling?
+ * - the share token        → viewer (read-only)
+ * - the admin token        → admin
+ * - no token, from loopback → admin (the person running wslog), but only
+ *   when the Host header is a local name too. Otherwise a website that
+ *   rebinds its DNS to 127.0.0.1 would be admin when bound to 0.0.0.0.
+ * - anything else          → rejected
+ */
+export function resolveRole(req, url, config) {
+    const token = readToken(req, url);
+    if (token) {
+        if (safeEqual(token, config.adminToken))
+            return 'admin';
+        if (safeEqual(token, config.shareToken))
+            return 'viewer';
+        return null;
+    }
+    const fromLoopback = isLoopbackHost(normalizeAddress(req.socket.remoteAddress ?? ''));
+    return fromLoopback && isLocalHostHeader(req.headers.host ?? '') ? 'admin' : null;
+}
+function readToken(req, url) {
+    const auth = req.headers.authorization;
+    if (auth?.startsWith('Bearer '))
+        return auth.slice(7).trim();
+    const header = req.headers['x-wslog-token'];
+    if (typeof header === 'string' && header)
+        return header;
+    return url.searchParams.get('token') ?? undefined;
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function normalizeAddress(address) {
+    return address.startsWith('::ffff:') ? address.slice(7) : address;
+}
+/**
+ * Browser-safety checks for the dashboard and API (not the proxy endpoint):
+ * - Origin must match Host, so other websites cannot read traffic through
+ *   the live WebSocket or call the API (cross-site WebSocket hijacking).
+ *   `Origin: null` (sandboxed iframes, local files) is blocked too: the
+ *   dashboard never sends it.
+ * - When bound to loopback, Host must be a local name (DNS rebinding).
+ */
+export function checkBrowserSafety(req, config) {
+    const host = req.headers.host ?? '';
+    if (isLoopbackHost(config.host) && !isLocalHostHeader(host)) {
+        throw new HttpError(403, `Host "${host}" is not allowed. wslog only answers to localhost.`);
+    }
+    const origin = req.headers.origin;
+    if (origin !== undefined && originHost(origin) !== host) {
+        throw new HttpError(403, `Cross-origin request from ${origin || '(empty origin)'} blocked`);
+    }
+}
+function originHost(origin) {
+    try {
+        return new URL(origin).host;
+    }
+    catch {
+        return undefined; // includes the opaque origin "null"
+    }
+}
+function isLocalHostHeader(host) {
+    const hostname = host.replace(/:\d+$/, '').replace(/^\[|\]$/g, '').toLowerCase();
+    return hostname === 'localhost' || hostname.endsWith('.localhost') || isLoopbackHost(hostname);
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/http/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAEhE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEvB;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAQ,EAAE,MAAmB;IAC7E,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC;QACxD,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,YAAY,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB,EAAE,GAAQ;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxD,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,MAAmB;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,SAAS,IAAI,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,6BAA6B,MAAM,IAAI,gBAAgB,UAAU,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,oCAAoC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC"}

package/dist/server/http/live.d.ts

@@ -0,0 +1,26 @@
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+import type { Role } from '../../shared/protocol.js';
+import { type WslogContext } from '../context.js';
+/**
+ * Streams wslog events to dashboards over `/api/live`.
+ * Messages and connection updates are batched every 50 ms so a busy
+ * proxy does not flood the browser with tiny frames.
+ */
+export declare class LiveHub {
+    private readonly ctx;
+    private readonly wss;
+    private readonly clients;
+    private pendingMessages;
+    private readonly pendingConnections;
+    private readonly timers;
+    private readonly unsubscribe;
+    constructor(ctx: WslogContext);
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, role: Role): void;
+    close(): void;
+    private sendHello;
+    private flush;
+    private tickRates;
+    private broadcast;
+    private send;
+}

package/dist/server/http/live.js

@@ -0,0 +1,117 @@
+import WebSocket, { WebSocketServer } from 'ws';
+import { appInfo, baseInfo, publicTargets } from '../context.js';
+import { toPartial } from './api.js';
+const FLUSH_MS = 50;
+const RATE_MS = 1000;
+const HELLO_MESSAGES = 1000;
+/** Stop streaming to a dashboard that cannot keep up; resync it once it drains. */
+const MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+/**
+ * Streams wslog events to dashboards over `/api/live`.
+ * Messages and connection updates are batched every 50 ms so a busy
+ * proxy does not flood the browser with tiny frames.
+ */
+export class LiveHub {
+    ctx;
+    wss = new WebSocketServer({ noServer: true, perMessageDeflate: true });
+    clients = new Set();
+    pendingMessages = [];
+    pendingConnections = new Map();
+    timers = [];
+    unsubscribe = [];
+    constructor(ctx) {
+        this.ctx = ctx;
+        const { bus } = ctx;
+        this.unsubscribe.push(bus.on('message', (m) => this.pendingMessages.push(toPartial(m))), bus.on('connection', (c) => this.pendingConnections.set(c.id, { ...c, counts: { ...c.counts } })), bus.on('targets', (targets) => this.broadcast({ type: 'targets', targets: publicTargets(ctx, targets) })), bus.on('cleared', () => {
+            this.pendingMessages = [];
+            this.pendingConnections.clear();
+            this.broadcast({ type: 'cleared', connections: ctx.connections.list() });
+        }), 
+        // Per client: the proxy base URL depends on how each dashboard reached wslog.
+        bus.on('info', () => {
+            for (const client of this.clients)
+                this.send(client, { type: 'info', info: baseInfo(ctx, client.req) });
+        }));
+        this.timers.push(setInterval(() => this.flush(), FLUSH_MS), setInterval(() => this.tickRates(), RATE_MS));
+        for (const t of this.timers)
+            t.unref();
+    }
+    handleUpgrade(req, socket, head, role) {
+        this.wss.handleUpgrade(req, socket, head, (ws) => {
+            // Batched messages are already in the store, so they will be in the hello
+            // snapshot. Send them to existing dashboards now, before this one joins,
+            // or the next flush would deliver them to it a second time.
+            this.flush();
+            const client = { ws, role, req, lagging: false };
+            this.clients.add(client);
+            ws.on('close', () => this.clients.delete(client));
+            ws.on('error', () => ws.terminate());
+            this.sendHello(client);
+        });
+    }
+    close() {
+        for (const t of this.timers)
+            clearInterval(t);
+        for (const off of this.unsubscribe)
+            off();
+        for (const { ws } of this.clients)
+            ws.close(1001, 'wslog shutting down');
+        this.clients.clear();
+    }
+    sendHello(client) {
+        const { ctx } = this;
+        this.send(client, {
+            type: 'hello',
+            info: appInfo(ctx, client.role, client.req),
+            targets: publicTargets(ctx),
+            connections: ctx.connections.list(),
+            messages: ctx.store.query({ limit: HELLO_MESSAGES }).map(toPartial),
+        });
+    }
+    flush() {
+        if (this.pendingConnections.size) {
+            for (const connection of this.pendingConnections.values())
+                this.broadcast({ type: 'connection', connection });
+            this.pendingConnections.clear();
+        }
+        if (this.pendingMessages.length) {
+            const items = this.pendingMessages;
+            this.pendingMessages = [];
+            this.broadcast({ type: 'messages', items });
+        }
+    }
+    tickRates() {
+        const rates = this.ctx.connections.drainRates();
+        // Counters change without events; push fresh totals for active connections.
+        for (const id of Object.keys(rates)) {
+            const connection = this.ctx.connections.get(id);
+            if (connection && rates[id])
+                this.pendingConnections.set(id, { ...connection, counts: { ...connection.counts } });
+        }
+        this.broadcast({ type: 'rates', time: Date.now(), rates });
+    }
+    broadcast(event) {
+        if (!this.clients.size)
+            return;
+        const data = JSON.stringify(event);
+        for (const client of this.clients) {
+            if (client.ws.readyState !== WebSocket.OPEN)
+                continue;
+            if (client.ws.bufferedAmount > MAX_BUFFERED_BYTES) {
+                client.lagging = true;
+                continue;
+            }
+            if (client.lagging) {
+                client.lagging = false;
+                this.sendHello(client);
+                continue;
+            }
+            client.ws.send(data);
+        }
+    }
+    send(client, event) {
+        if (client.ws.readyState === WebSocket.OPEN)
+            client.ws.send(JSON.stringify(event));
+    }
+}
+//# sourceMappingURL=live.js.map

package/dist/server/http/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/server/http/live.ts"],"names":[],"mappings":"AAEA,OAAO,SAAS,EAAE,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAEhD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAS3C;;;;GAIG;AACH,MAAM,OAAO,OAAO;IAQW;IAPZ,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,eAAe,GAAoB,EAAE,CAAC;IAC7B,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,MAAM,GAAqB,EAAE,CAAC;IAC9B,WAAW,GAAsB,EAAE,CAAC;IAErD,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CACnB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EACjE,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EACjG,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EACzG,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;QACF,8EAA8E;QAC9E,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,aAAa,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,IAAU;QAC1E,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC/C,0EAA0E;YAC1E,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,MAAM,GAAW,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,EAAE,CAAC;QAC1C,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;YAC3B,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YACnC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAEO,KAAK;QACX,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;YACjC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9G,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;YACnC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,SAAS;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAChD,4EAA4E;QAC5E,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,UAAU,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,SAAS,CAAC,KAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,SAAS;YACtD,IAAI,MAAM,CAAC,EAAE,CAAC,cAAc,GAAG,kBAAkB,EAAE,CAAC;gBAClD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,MAAc,EAAE,KAAgB;QAC3C,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;CACF"}

package/dist/server/http/router.d.ts

@@ -0,0 +1,31 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Role } from '../../shared/protocol.js';
+export interface RouteContext {
+    req: IncomingMessage;
+    res: ServerResponse;
+    url: URL;
+    params: Record<string, string>;
+    role: Role;
+    body<T>(): Promise<T>;
+}
+export type RouteHandler = (ctx: RouteContext) => unknown;
+export interface RouteOptions {
+    /** Minimum role. Defaults to `viewer` (anyone with access). */
+    role?: Role;
+}
+/**
+ * Tiny method + path router. Handlers return a value to send as JSON,
+ * or write to `res` themselves and return `undefined`.
+ */
+export declare class Router {
+    private readonly routes;
+    get(path: string, handler: RouteHandler, options?: RouteOptions): this;
+    post(path: string, handler: RouteHandler, options?: RouteOptions): this;
+    delete(path: string, handler: RouteHandler, options?: RouteOptions): this;
+    add(method: string, path: string, handler: RouteHandler, options?: RouteOptions): this;
+    /** Returns false when no route matches the path. */
+    handle(req: IncomingMessage, res: ServerResponse, url: URL, role: Role): Promise<boolean>;
+}
+/** `decodeURIComponent` that answers 400 instead of throwing on bad `%` escapes. */
+export declare function decodePathSegment(segment: string): string;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;

package/dist/server/http/router.js

@@ -0,0 +1,89 @@
+import { HttpError } from './auth.js';
+const MAX_BODY_BYTES = 64 * 1024;
+/**
+ * Tiny method + path router. Handlers return a value to send as JSON,
+ * or write to `res` themselves and return `undefined`.
+ */
+export class Router {
+    routes = [];
+    get(path, handler, options) {
+        return this.add('GET', path, handler, options);
+    }
+    post(path, handler, options) {
+        return this.add('POST', path, handler, options);
+    }
+    delete(path, handler, options) {
+        return this.add('DELETE', path, handler, options);
+    }
+    add(method, path, handler, options = {}) {
+        const keys = [];
+        const source = path.replace(/\/:(\w+)/g, (_m, key) => {
+            keys.push(key);
+            return '/([^/]+)';
+        });
+        this.routes.push({ method, pattern: new RegExp(`^${source}/?$`), keys, handler, role: options.role ?? 'viewer' });
+        return this;
+    }
+    /** Returns false when no route matches the path. */
+    async handle(req, res, url, role) {
+        let pathMatched = false;
+        for (const route of this.routes) {
+            const match = route.pattern.exec(url.pathname);
+            if (!match)
+                continue;
+            pathMatched = true;
+            if (route.method !== req.method && !(route.method === 'GET' && req.method === 'HEAD'))
+                continue;
+            if (route.role === 'admin' && role !== 'admin')
+                throw new HttpError(403, 'This link is read-only');
+            const params = Object.fromEntries(route.keys.map((k, i) => [k, decodePathSegment(match[i + 1])]));
+            const result = await route.handler({ req, res, url, params, role, body: () => readJson(req) });
+            if (!res.writableEnded && result !== undefined)
+                sendJson(res, 200, result);
+            else if (!res.writableEnded)
+                res.writeHead(204).end();
+            return true;
+        }
+        if (pathMatched)
+            throw new HttpError(405, 'Method not allowed');
+        return false;
+    }
+}
+/** `decodeURIComponent` that answers 400 instead of throwing on bad `%` escapes. */
+export function decodePathSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        throw new HttpError(400, 'Malformed URL encoding');
+    }
+}
+export function sendJson(res, status, body) {
+    const json = JSON.stringify(body);
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': Buffer.byteLength(json),
+        'Cache-Control': 'no-store',
+    });
+    res.end(json);
+}
+async function readJson(req) {
+    if (!req.headers['content-type']?.includes('application/json')) {
+        throw new HttpError(415, 'Expected Content-Type: application/json');
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            throw new HttpError(413, 'Request body too large');
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new HttpError(400, 'Invalid JSON body');
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/server/http/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/server/http/router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA0BtC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,MAAM,OAAO,MAAM;IACA,MAAM,GAAY,EAAE,CAAC;IAEtC,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsB;QAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsB;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsB;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,OAAqB,EAAE,UAAwB,EAAE;QACjF,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE;YAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,IAAU;QAC1E,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;gBAAE,SAAS;YAChG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YAEnG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;iBACtE,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,WAAW;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAoB;IAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAA4B,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/server/http/server.d.ts

@@ -0,0 +1,17 @@
+import { type Server } from 'node:http';
+import type { WslogContext } from '../context.js';
+import type { WebSocketProxy } from '../proxy/proxy.js';
+import type { LiveHub } from './live.js';
+export interface HttpServerDeps {
+    ctx: WslogContext;
+    proxy: WebSocketProxy;
+    live: LiveHub;
+    webRoot: string;
+}
+/**
+ * One HTTP server, three jobs:
+ *   /p/<target>/...  WebSocket proxy (what your app connects to)
+ *   /api/...         REST API + /api/live stream for the dashboard
+ *   everything else  the dashboard itself
+ */
+export declare function createHttpServer({ ctx, proxy, live, webRoot }: HttpServerDeps): Server;

package/dist/server/http/server.js

@@ -0,0 +1,82 @@
+import { createServer } from 'node:http';
+import { LIVE_PATH, PROXY_PREFIX } from '../../shared/protocol.js';
+import { checkBrowserSafety, HttpError, resolveRole } from './auth.js';
+import { sendJson } from './router.js';
+import { createStaticHandler } from './static.js';
+import { rejectUpgrade } from './upgrade.js';
+/**
+ * One HTTP server, three jobs:
+ *   /p/<target>/...  WebSocket proxy (what your app connects to)
+ *   /api/...         REST API + /api/live stream for the dashboard
+ *   everything else  the dashboard itself
+ */
+export function createHttpServer({ ctx, proxy, live, webRoot }) {
+    const serveStatic = createStaticHandler(webRoot);
+    const server = createServer((req, res) => {
+        handleRequest(req, res).catch((err) => sendError(res, err, ctx));
+    });
+    async function handleRequest(req, res) {
+        const url = parseUrl(req);
+        if (url.pathname.startsWith('/api/')) {
+            checkBrowserSafety(req, ctx.config);
+            const role = resolveRole(req, url, ctx.config);
+            if (!role)
+                throw new HttpError(401, 'Unauthorized. Open the dashboard with the link that includes ?token=…');
+            if (!(await ctx.router.handle(req, res, url, role)))
+                throw new HttpError(404, 'Not found');
+            return;
+        }
+        if (url.pathname.startsWith(PROXY_PREFIX)) {
+            res.writeHead(426, { 'Content-Type': 'text/plain; charset=utf-8', Upgrade: 'websocket' });
+            res.end('This is a wslog WebSocket proxy URL. Connect to it with a WebSocket client (ws://...).\n');
+            return;
+        }
+        serveStatic(req, res, url.pathname);
+    }
+    server.on('upgrade', (req, socket, head) => {
+        socket.on('error', (err) => ctx.logger.debug(`upgrade socket error: ${err.message}`));
+        try {
+            const url = parseUrl(req);
+            if (url.pathname.startsWith(PROXY_PREFIX)) {
+                const id = url.pathname.slice(PROXY_PREFIX.length).split('/')[0] ?? '';
+                const target = ctx.targets.get(id);
+                if (!target)
+                    return proxy.rejectUnknownTarget(req, socket, id);
+                return proxy.handleUpgrade(req, socket, head, target);
+            }
+            if (url.pathname === LIVE_PATH) {
+                checkBrowserSafety(req, ctx.config);
+                const role = resolveRole(req, url, ctx.config);
+                if (!role)
+                    return rejectUpgrade(socket, 401);
+                return live.handleUpgrade(req, socket, head, role);
+            }
+            rejectUpgrade(socket, 404);
+        }
+        catch (err) {
+            rejectUpgrade(socket, err instanceof HttpError ? err.status : 500, err instanceof Error ? err.message : undefined);
+        }
+    });
+    return server;
+}
+function parseUrl(req) {
+    try {
+        return new URL(req.url ?? '/', 'http://wslog.local');
+    }
+    catch {
+        // e.g. an absolute-form target like `GET http://[x/` — must not crash the process.
+        throw new HttpError(400, 'Invalid request URL');
+    }
+}
+function sendError(res, err, ctx) {
+    const status = err instanceof HttpError ? err.status : 500;
+    const message = err instanceof Error ? err.message : 'Internal error';
+    if (status >= 500)
+        ctx.logger.error(message, err);
+    if (res.headersSent) {
+        res.end();
+        return;
+    }
+    sendJson(res, status, { error: status >= 500 ? 'Internal error' : message });
+}
+//# sourceMappingURL=server.js.map

package/dist/server/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/server/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS7C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAkB;IAC5E,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uEAAuE,CAAC,CAAC;YAC7G,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1F,GAAG,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;QAC1E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,CAAC,IAAI;oBAAE,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,MAAM,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;QACnF,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,GAAY,EAAE,GAAiB;IACrE,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACtE,IAAI,MAAM,IAAI,GAAG;QAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/server/http/static.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Serves the built dashboard with an SPA fallback to index.html. */
+export declare function createStaticHandler(root: string): (req: IncomingMessage, res: ServerResponse, pathname: string) => void;

package/dist/server/http/static.js

@@ -0,0 +1,56 @@
+import { createReadStream, existsSync, statSync } from 'node:fs';
+import { extname, join, normalize, sep } from 'node:path';
+import { decodePathSegment } from './router.js';
+const MIME = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.woff2': 'font/woff2',
+    '.map': 'application/json; charset=utf-8',
+};
+const NOT_BUILT = `<!doctype html><meta charset="utf-8"><title>wslog</title>
+<body style="font:15px system-ui;padding:40px;max-width:640px">
+<h1>wslog is running</h1>
+<p>The dashboard has not been built yet. Run <code>npm run build:web</code>,
+or use <code>npm run dev</code> and open the Vite URL.</p>
+<p>The proxy and API work without it.</p></body>`;
+/** Serves the built dashboard with an SPA fallback to index.html. */
+export function createStaticHandler(root) {
+    const index = join(root, 'index.html');
+    return (req, res, pathname) => {
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            res.writeHead(405).end();
+            return;
+        }
+        if (!existsSync(index)) {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }).end(NOT_BUILT);
+            return;
+        }
+        let file = normalize(join(root, decodePathSegment(pathname)));
+        if (!file.startsWith(root + sep) && file !== root) {
+            res.writeHead(403).end();
+            return;
+        }
+        if (!existsSync(file) || statSync(file).isDirectory())
+            file = index;
+        const isAsset = file.includes(`${sep}assets${sep}`);
+        res.writeHead(200, {
+            'Content-Type': MIME[extname(file)] ?? 'application/octet-stream',
+            'Cache-Control': isAsset ? 'public, max-age=31536000, immutable' : 'no-cache',
+            'X-Content-Type-Options': 'nosniff',
+            'Referrer-Policy': 'no-referrer',
+            // Other sites may not frame the dashboard (clickjacking on Clear, Remove, ...).
+            'X-Frame-Options': 'DENY',
+            'Content-Security-Policy': "frame-ancestors 'none'",
+        });
+        if (req.method === 'HEAD')
+            res.end();
+        else
+            createReadStream(file).pipe(res);
+    };
+}
+//# sourceMappingURL=static.js.map

package/dist/server/http/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../../src/server/http/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;iDAK+B,CAAC;AAElD,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAEvC,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB,EAAQ,EAAE;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,GAAG,KAAK,CAAC;QAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B;YACjE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU;YAC7E,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,aAAa;YAChC,gFAAgF;YAChF,iBAAiB,EAAE,MAAM;YACzB,yBAAyB,EAAE,wBAAwB;SACpD,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YAChC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/http/upgrade.d.ts

@@ -0,0 +1,3 @@
+import type { Duplex } from 'node:stream';
+/** Answer a WebSocket upgrade request with a plain HTTP error and close the socket. */
+export declare function rejectUpgrade(socket: Duplex, status: number, message?: string): void;

package/dist/server/http/upgrade.js

@@ -0,0 +1,13 @@
+import { STATUS_CODES } from 'node:http';
+/** Answer a WebSocket upgrade request with a plain HTTP error and close the socket. */
+export function rejectUpgrade(socket, status, message = STATUS_CODES[status] ?? '') {
+    if (socket.destroyed)
+        return;
+    const body = `${message}\n`;
+    socket.end(`HTTP/1.1 ${status} ${STATUS_CODES[status] ?? 'Error'}\r\n` +
+        'Connection: close\r\n' +
+        'Content-Type: text/plain; charset=utf-8\r\n' +
+        `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n` +
+        body);
+}
+//# sourceMappingURL=upgrade.js.map

package/dist/server/http/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../../src/server/http/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc,EAAE,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE;IAChG,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,CACR,YAAY,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM;QACzD,uBAAuB;QACvB,6CAA6C;QAC7C,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU;QACpD,IAAI,CACP,CAAC;AACJ,CAAC"}

package/dist/server/masking.d.ts

@@ -0,0 +1,11 @@
+export declare const MASK = "***";
+export interface Masker {
+    readonly fields: readonly string[];
+    /** Mask a text payload. JSON is masked structurally; other text by `key=value` / `"key": "value"` patterns. */
+    text(input: string): string;
+    /** Mask query parameters in a URL or path. A password in the URL (`ws://user:pw@host`) is always hidden. */
+    url(input: string): string;
+}
+export declare function createMasker(fields: readonly string[]): Masker;
+/** `ws://user:secret@host/x` → `ws://user:***@host/x`. */
+export declare function redactUrlPassword(input: string): string;