Merge remote-tracking branch 'origin/main' into fix/realtime-debug-log-hardening

# Conflicts:
#	CHANGELOG.md

server/providers/common/http.js

@@ -1,74 +1,9 @@
-/**
- * Read a fetch() Response body as text with a hard byte cap. Rejects early on an
- * oversized Content-Length, then streams with a running cap so a chunked or
- * length-omitted response cannot blow past the limit. Throws { code:'RESPONSE_TOO_LARGE' }.
- */
-export async function readResponseTextCapped(response, maxBytes, signal) {
-  const tooLarge = () =>
-    Object.assign(new Error('Upstream response too large'), {
-      code: 'RESPONSE_TOO_LARGE',
-    });
-  const declared = Number(response.headers.get('content-length'));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    void response.body?.cancel().catch(() => {});
-    throw tooLarge();
-  }
-  signal?.throwIfAborted();
-  const reader = response.body?.getReader?.();
-  if (!reader) {
-    const text = await response.text();
-    signal?.throwIfAborted();
-    if (Buffer.byteLength(text) > maxBytes) throw tooLarge();
-    return text;
-  }
-  const cancel = () => {
-    void reader.cancel().catch(() => {});
-  };
-  signal?.addEventListener('abort', cancel, { once: true });
-  const decoder = new TextDecoder();
-  let out = '';
-  let total = 0;
-  try {
-    for (;;) {
-      signal?.throwIfAborted();
-      const { done, value } = await reader.read();
-      signal?.throwIfAborted();
-      if (done) break;
-      total += value.byteLength;
-      if (total > maxBytes) throw tooLarge();
-      out += decoder.decode(value, { stream: true });
-    }
-    return out + decoder.decode();
-  } catch (error) {
-    cancel();
-    throw error;
-  } finally {
-    signal?.removeEventListener('abort', cancel);
-    reader.releaseLock();
-  }
-}
-
-/** Parse a fetch() JSON response only after enforcing a hard byte cap. */
-export async function readResponseJsonCapped(response, maxBytes) {
-  return JSON.parse(await readResponseTextCapped(response, maxBytes));
-}
-
-/**
- * Return the existing promise for a cache key, or create one and remove it
- * only when that exact promise settles.
- */
-export function coalesceProxyRequest(inFlight, key, create) {
-  const existing = inFlight.get(key);
-  if (existing) return { promise: existing, shared: true };
-  let promise;
-  promise = Promise.resolve()
-    .then(create)
-    .finally(() => {
-      if (inFlight.get(key) === promise) inFlight.delete(key);
-    });
-  inFlight.set(key, promise);
-  return { promise, shared: false };
-}
+export {
+  readResponseTextCapped,
+  readResponseJsonCapped,
+  readResponseBytesCapped,
+  coalesceProxyRequest,
+} from '../../../src/sources/httpBody.js';
 
 /**
  * Read a fetch Response body as text while enforcing a hard byte cap during

server/providers/common/rate-limit.js

@@ -1,38 +1,5 @@
-/**
- * Minimal fixed-window per-key rate limiter for the dev proxies. Not a hard
- * security boundary (dev-only), just a backstop so a runaway client can't hammer
- * the public Overpass / OSRM mirrors or exhaust this process.
- */
-const RATE_LIMITER_MAX_KEYS = 2000;
-
-export function makeRateLimiter({ windowMs, max, globalMax }) {
-  const hits = new Map(); // key -> number[] (timestamps within window)
-  let globalTimes = []; // all hits in window, for the global backstop
-  return function allow(key) {
-    const now = Date.now();
-    globalTimes = globalTimes.filter((t) => now - t < windowMs);
-    if (globalMax && globalTimes.length >= globalMax) return false; // global backstop
-    const recent = (hits.get(key) || []).filter((t) => now - t < windowMs);
-    if (recent.length >= max) {
-      hits.set(key, recent);
-      return false;
-    }
-    recent.push(now);
-    hits.set(key, recent);
-    globalTimes.push(now);
-    // Hard key cap so a key-rotating caller can't grow the map without bound.
-    if (hits.size > RATE_LIMITER_MAX_KEYS) {
-      const oldest = hits.keys().next().value;
-      if (oldest !== undefined) hits.delete(oldest);
-    }
-    if (hits.size > 256) {
-      for (const [k, v] of hits) {
-        if (!v.length || now - v[v.length - 1] > windowMs) hits.delete(k);
-      }
-    }
-    return true;
-  };
-}
+import { makeRateLimiter } from '../../../src/sources/rateLimit.js';
+export { makeRateLimiter } from '../../../src/sources/rateLimit.js';
 
 /**
  * Opt-in per-IP rate limiter for the cost-bearing API proxies (OpenAI / Google).