proxy.mjs

import { createServer } from "node:http";
import { request as httpRequest } from "node:http";
import { request as httpsRequest } from "node:https";
import { existsSync } from "node:fs";
import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
import path from "node:path";
import { DatabaseSync } from "node:sqlite";
import { fileURLToPath } from "node:url";

const rootDir = path.dirname(fileURLToPath(import.meta.url));

const upstreamOrigin = new URL(process.env.UPSTREAM_ORIGIN ?? "https://api.finalval.com");
const listenHost = process.env.HOST ?? "127.0.0.1";
const listenPort = Number(process.env.PORT ?? 8787);
const maxRequestBytes = Number(process.env.MAX_REQUEST_BYTES ?? 20 * 1024 * 1024);
const maxCapturedRequestBytes = Number(process.env.MAX_CAPTURE_REQUEST_BYTES ?? maxRequestBytes);
const maxCapturedResponseBytes = Number(process.env.MAX_CAPTURE_RESPONSE_BYTES ?? 20 * 1024 * 1024);
const redactHeaders = process.env.REDACT_HEADERS !== "0";
const captureOnlyMode = /^(1|true|yes|on)$/i.test(String(process.env.CAPTURE_ONLY ?? ""));
const rulesPath = process.env.RULES_PATH
  ? path.resolve(process.env.RULES_PATH)
  : path.join(rootDir, "rules.json");
const captureRoot = process.env.CAPTURE_DIR
  ? path.resolve(process.env.CAPTURE_DIR)
  : path.join(rootDir, "captures");
const corsOrigin = process.env.CORS_ORIGIN ?? "*";
const chatCompletionsStreamMode = String(
  process.env.CHAT_COMPLETIONS_STREAM_MODE
  ?? (process.env.FORCE_CHAT_COMPLETIONS_STREAM === "1" ? "always" : "auto")
).toLowerCase();
const chatCompletionsStreamThresholdBytes = Number(process.env.CHAT_COMPLETIONS_STREAM_THRESHOLD_BYTES ?? 48 * 1024);
const chatCompletionsStreamThresholdImages = Number(process.env.CHAT_COMPLETIONS_STREAM_THRESHOLD_IMAGES ?? 1);
const chatCompletionsStreamThresholdMessages = Number(process.env.CHAT_COMPLETIONS_STREAM_THRESHOLD_MESSAGES ?? 12);
const captureRetentionDays = Number(process.env.CAPTURE_RETENTION_DAYS ?? 30);
const captureRetentionMaxFiles = Number(process.env.CAPTURE_RETENTION_MAX_FILES ?? 800);
const captureRetentionMaxTotalBytes = Number(process.env.CAPTURE_RETENTION_MAX_TOTAL_MB ?? 2048) * 1024 * 1024;
const panelCssPath = path.join(rootDir, "panel.css");
const panelJsPath = path.join(rootDir, "panel.js");
const cliRelayUsageDbPath = process.env.CLIRELAY_USAGE_DB_PATH ?? "C:\\Users\\nim6\\.CliRelay\\data\\usage.db";
const cliRelayApiKeyLookupEnabled = process.env.CLIRELAY_API_KEY_LOOKUP !== "0" && existsSync(cliRelayUsageDbPath);
const panelPublicPrefix = normalizePublicPrefix(process.env.PANEL_PUBLIC_PREFIX ?? "");
const panelEmbeddedPrefix = normalizePublicPrefix(process.env.PANEL_EMBEDDED_PREFIX ?? "/_proxy-panel");
const panelEmbeddedAuthMode = String(process.env.PANEL_EMBEDDED_AUTH_MODE ?? "sub2api-admin").toLowerCase();
const panelSessionCookieName = process.env.PANEL_SESSION_COOKIE_NAME ?? "__Secure-proxy_panel_session";
const panelSessionSecret = process.env.PANEL_SESSION_SECRET || randomBytes(32).toString("hex");
const panelSessionTtlMs = Number(process.env.PANEL_SESSION_TTL_SECONDS ?? 6 * 60 * 60) * 1000;
const captureAssetsDirName = "_assets";
const captureIndexDbPath = path.join(captureRoot, ".panel-index.sqlite");
const captureDetailCacheLimit = 24;
const captureIndexSyncIntervalMs = Number(process.env.CAPTURE_INDEX_SYNC_INTERVAL_MS ?? 15000);
const captureSummaryState = {
  loadPromise: null,
  detailCache: new Map(),
  activeCaptures: new Map(),
  db: null,
  prunePromise: Promise.resolve(),
  migrationPromise: Promise.resolve(),
  indexReady: false,
  lastSyncMs: 0
};

const hopByHopHeaders = new Set([
  "connection",
  "keep-alive",
  "proxy-authenticate",
  "proxy-authorization",
  "te",
  "trailer",
  "transfer-encoding",
  "upgrade"
]);

const sensitiveHeaders = new Set([
  "authorization",
  "proxy-authorization",
  "x-api-key",
  "x-goog-api-key",
  "cookie",
  "set-cookie"
]);

function normalizePublicPrefix(value) {
  const raw = String(value ?? "").trim();
  if (!raw || raw === "/") return "";
  return "/" + raw.replace(/^\/+|\/+$/g, "");
}

function prefixedUrl(prefix, pathnameWithSearch) {
  return `${prefix}${String(pathnameWithSearch).startsWith("/") ? "" : "/"}${pathnameWithSearch}`;
}

function requestId() {
  return `${new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}-${randomUUID().slice(0, 8)}`;
}

function stripHopByHop(headers) {
  const result = {};
  for (const [name, value] of Object.entries(headers)) {
    const lowerName = name.toLowerCase();
    if (hopByHopHeaders.has(lowerName)) continue;
    result[name] = value;
  }
  return result;
}

function sanitizeHeaders(headers) {
  const result = {};
  for (const [name, value] of Object.entries(headers ?? {})) {
    if (redactHeaders && sensitiveHeaders.has(name.toLowerCase())) {
      result[name] = "[redacted]";
    } else {
      result[name] = value;
    }
  }
  return result;
}

function headerFirstValue(value) {
  if (Array.isArray(value)) return value[0] ?? "";
  return value ?? "";
}

function maskSecret(value) {
  const secret = String(value ?? "").trim();
  if (!secret) return "";
  if (secret.length <= 10) return secret.slice(0, 2) + "..." + secret.slice(-2);
  return secret.slice(0, 6) + "..." + secret.slice(-4);
}

function lookupCliRelayApiKeyName(secret) {
  const apiKey = String(secret ?? "").trim();
  if (!apiKey || !cliRelayApiKeyLookupEnabled) return "";
  let db;
  try {
    db = new DatabaseSync(cliRelayUsageDbPath, { open: true, readOnly: true });
    const row = db.prepare("select name from api_keys where key = ? and disabled = 0 limit 1").get(apiKey);
    return String(row?.name ?? "").trim();
  } catch {
    return "";
  } finally {
    try {
      db?.close();
    } catch {}
  }
}

function extractRequestKeyPreview(headers) {
  const authorization = String(headerFirstValue(headers?.authorization)).trim();
  if (/^Bearer\s+/i.test(authorization)) {
    const secret = authorization.replace(/^Bearer\s+/i, "");
    const keyName = lookupCliRelayApiKeyName(secret);
    return {
      source: "authorization",
      preview: "Bearer " + maskSecret(secret),
      keyName,
      display: keyName || ("Bearer " + maskSecret(secret))
    };
  }

  const xApiKey = String(headerFirstValue(headers?.["x-api-key"])).trim();
  if (xApiKey) {
    const keyName = lookupCliRelayApiKeyName(xApiKey);
    return {
      source: "x-api-key",
      preview: maskSecret(xApiKey),
      keyName,
      display: keyName || maskSecret(xApiKey)
    };
  }

  const xGoogApiKey = String(headerFirstValue(headers?.["x-goog-api-key"])).trim();
  if (xGoogApiKey) {
    const keyName = lookupCliRelayApiKeyName(xGoogApiKey);
    return {
      source: "x-goog-api-key",
      preview: maskSecret(xGoogApiKey),
      keyName,
      display: keyName || maskSecret(xGoogApiKey)
    };
  }

  return null;
}

function isTextLike(headers) {
  const contentType = String(headers["content-type"] ?? headers["Content-Type"] ?? "").toLowerCase();
  return (
    contentType.startsWith("application/json") ||
    contentType.startsWith("text/") ||
    contentType.includes("javascript") ||
    contentType.includes("xml") ||
    contentType.includes("x-ndjson") ||
    contentType.includes("event-stream")
  );
}

function bodyForCapture(buffer, headers, truncated = false) {
  const textLike = isTextLike(headers);
  return {
    encoding: textLike ? "utf8" : "base64",
    truncated,
    bytes: buffer.length,
    data: textLike ? buffer.toString("utf8") : buffer.toString("base64")
  };
}

function createCaptureBuffer(maxBytes) {
  const chunks = [];
  let bytes = 0;
  let totalBytes = 0;
  let truncated = false;

  return {
    push(chunk) {
      totalBytes += chunk.length;
      if (truncated) return;
      if (bytes + chunk.length <= maxBytes) {
        chunks.push(chunk);
        bytes += chunk.length;
        return;
      }

      const remaining = Math.max(0, maxBytes - bytes);
      if (remaining > 0) {
        chunks.push(chunk.subarray(0, remaining));
        bytes += remaining;
      }
      truncated = true;
    },
    body(headers) {
      const body = bodyForCapture(Buffer.concat(chunks, bytes), headers, truncated);
      body.bytes = totalBytes;
      return body;
    }
  };
}

async function readBody(req) {
  const chunks = [];
  let size = 0;

  for await (const chunk of req) {
    size += chunk.length;
    if (size > maxRequestBytes) {
      const err = new Error(`request body exceeds MAX_REQUEST_BYTES=${maxRequestBytes}`);
      err.statusCode = 413;
      throw err;
    }
    chunks.push(chunk);
  }

  return Buffer.concat(chunks);
}

async function loadRules() {
  try {
    const raw = await readFile(rulesPath, "utf8");
    const parsed = JSON.parse(raw);
    return parsed.enabled === false ? [] : Array.isArray(parsed.rules) ? parsed.rules : [];
  } catch (error) {
    if (error.code === "ENOENT") return [];
    throw new Error(`failed to read rules file ${rulesPath}: ${error.message}`);
  }
}

function matchesRule(rule, method, pathname) {
  if (rule.enabled === false) return false;
  if (Array.isArray(rule.methods) && !rule.methods.map(String).map((x) => x.toUpperCase()).includes(method)) {
    return false;
  }
  if (rule.path && rule.path !== pathname) return false;
  if (rule.pathPrefix && !pathname.startsWith(rule.pathPrefix)) return false;
  return Boolean(rule.path || rule.pathPrefix);
}

function setDeep(target, dottedPath, value) {
  const parts = dottedPath.split(".").filter(Boolean);
  if (parts.length === 0) return;
  let cursor = target;
  for (const part of parts.slice(0, -1)) {
    if (!cursor[part] || typeof cursor[part] !== "object" || Array.isArray(cursor[part])) {
      cursor[part] = {};
    }
    cursor = cursor[part];
  }
  cursor[parts.at(-1)] = value;
}

function deleteDeep(target, dottedPath) {
  const parts = dottedPath.split(".").filter(Boolean);
  if (parts.length === 0) return;
  let cursor = target;
  for (const part of parts.slice(0, -1)) {
    if (!cursor || typeof cursor !== "object") return;
    cursor = cursor[part];
  }
  if (cursor && typeof cursor === "object") {
    delete cursor[parts.at(-1)];
  }
}

function applyJsonRule(json, rule) {
  const changed = [];

  if (rule.modelMap && typeof rule.modelMap === "object" && typeof json.model === "string") {
    const mappedModel = rule.modelMap[json.model];
    if (mappedModel && mappedModel !== json.model) {
      changed.push({ op: "modelMap", path: "model", from: json.model, to: mappedModel });
      json.model = mappedModel;
    }
  }

  if (rule.jsonSet && typeof rule.jsonSet === "object") {
    for (const [key, value] of Object.entries(rule.jsonSet)) {
      setDeep(json, key, value);
      changed.push({ op: "set", path: key, to: value });
    }
  }

  if (Array.isArray(rule.jsonDelete)) {
    for (const key of rule.jsonDelete) {
      deleteDeep(json, String(key));
      changed.push({ op: "delete", path: String(key) });
    }
  }

  return changed;
}

async function mutateRequestBody(req, requestBody, targetUrl) {
  const contentType = String(req.headers["content-type"] ?? "").toLowerCase();
  if (!contentType.includes("application/json") || requestBody.length === 0) {
    return { body: requestBody, mutations: [], streamEnabled: false, requestedStream: false, bridgeEnabled: false };
  }

  const rules = await loadRules();
  const matchedRules = rules.filter((rule) => matchesRule(rule, req.method, targetUrl.pathname));
  const rawText = requestBody.toString("utf8");
  let json;
  try {
    json = JSON.parse(rawText);
  } catch {
    return { body: requestBody, mutations: [], streamEnabled: false, requestedStream: false, bridgeEnabled: false };
  }
  const requestedStream = json.stream === true;

  const mutations = [];
  for (const rule of matchedRules) {
    const changes = applyJsonRule(json, rule);
    if (changes.length > 0) {
      mutations.push({ rule: rule.name ?? "(unnamed)", changes });
    }
  }

  const bridgeEnabled =
    req.method === "POST"
    && targetUrl.pathname.startsWith("/v1/chat/completions")
    && !requestedStream
    && shouldBridgeChatCompletions(json, rawText);

  if (bridgeEnabled && json.stream !== true) {
    json.stream = true;
    mutations.push({
      rule: "auto-stream",
      changes: [{ op: "set", path: "stream", to: true }]
    });
  }

  const streamEnabled = Boolean(json.stream);
  if (mutations.length === 0) {
    return { body: requestBody, mutations: [], streamEnabled, requestedStream, bridgeEnabled };
  }

  return {
    body: Buffer.from(JSON.stringify(json), "utf8"),
    mutations,
    streamEnabled,
    requestedStream,
    bridgeEnabled
  };
}

function safePathSegment(value) {
  const safe = value.replace(/[^a-zA-Z0-9._-]+/g, "_").replace(/^_+|_+$/g, "");
  return safe.slice(0, 80) || "root";
}

async function saveCapture(capture) {
  const date = capture.startedAt.slice(0, 10);
  const dir = path.join(captureRoot, date);
  await mkdir(dir, { recursive: true });
  const rewritten = await rewriteCaptureInlineAssetsForSave(capture);
  const fileName = `${capture.id}_${capture.request.method}_${safePathSegment(capture.request.path)}.json`;
  const filePath = path.join(dir, fileName);
  const fileText = `${JSON.stringify(rewritten.capture, null, 2)}\n`;
  await writeFile(filePath, fileText, "utf8");
  rememberDetailCache(
    path.relative(captureRoot, filePath).replaceAll(path.sep, "/"),
    Buffer.byteLength(fileText),
    Date.now(),
    rewritten.capture,
    rewritten.assets
  );
  await rememberSavedCapture(filePath, rewritten.capture, Buffer.byteLength(fileText));
  await pruneCapturesIfNeeded();
  return filePath;
}

function sendText(res, statusCode, contentType, text, extraHeaders = {}) {
  const body = Buffer.from(String(text ?? ""), "utf8");
  res.writeHead(statusCode, {
    "content-type": contentType,
    "content-length": body.length,
    ...extraHeaders
  });
  res.end(body);
}

function redirect(res, location, extraHeaders = {}) {
  res.writeHead(302, {
    location,
    "cache-control": "no-store",
    ...extraHeaders
  });
  res.end();
}

function sendJson(res, statusCode, payload) {
  sendText(res, statusCode, "application/json; charset=utf-8", JSON.stringify(payload), corsHeaders());
}

function jsonResponseText(payload) {
  return JSON.stringify(payload);
}

function jsonResponseHeaders(requestedHeaders = undefined) {
  return {
    "content-type": "application/json; charset=utf-8",
    ...corsHeaders(requestedHeaders)
  };
}

function sendHtml(res, html, extraHeaders = {}) {
  sendText(res, 200, "text/html; charset=utf-8", html, {
    "cache-control": "no-store",
    "content-security-policy":
      "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data: blob: http: https:; object-src 'none'; base-uri 'none'; form-action 'none'",
    "referrer-policy": "no-referrer",
    "x-content-type-options": "nosniff",
    ...extraHeaders
  });
}

function sendPanelForbidden(res, prefix) {
  sendText(res, 403, "text/plain; charset=utf-8", "Forbidden\n", {
    "cache-control": "no-store",
    "set-cookie": panelSessionClearCookie(prefix),
    "x-content-type-options": "nosniff"
  });
}

function sendBuffer(res, statusCode, contentType, buffer, extraHeaders = {}) {
  res.writeHead(statusCode, {
    "content-type": contentType,
    "content-length": buffer.length,
    ...extraHeaders
  });
  res.end(buffer);
}

async function sendStaticTextFile(res, filePath, contentType, transform = null, extraHeaders = {}) {
  try {
    const raw = await readFile(filePath, "utf8");
    const text = typeof transform === "function" ? transform(raw) : raw;
    sendText(res, 200, contentType, text, {
      "cache-control": "no-store",
      "x-content-type-options": "nosniff",
      ...extraHeaders
    });
  } catch (error) {
    const statusCode = error.code === "ENOENT" ? 404 : 500;
    sendJson(res, statusCode, {
      error: "PANEL_ASSET_READ_FAILED",
      message: error.message
    });
  }
}

function corsHeaders(requestedHeaders = undefined) {
  const headers = {
    "access-control-allow-origin": corsOrigin,
    "access-control-allow-methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
    "access-control-allow-headers":
      requestedHeaders || "authorization,content-type,x-api-key,x-goog-api-key,x-requested-with",
    "access-control-expose-headers": "content-type,x-request-id"
  };

  if (corsOrigin !== "*") {
    headers.vary = "Origin";
  }

  return headers;
}

function parseCookies(header) {
  const cookies = new Map();
  for (const part of String(header ?? "").split(";")) {
    const index = part.indexOf("=");
    if (index <= 0) continue;
    cookies.set(part.slice(0, index).trim(), decodeURIComponent(part.slice(index + 1).trim()));
  }
  return cookies;
}

function signPanelSession(value) {
  return createHash("sha256").update(`${value}.${panelSessionSecret}`).digest("hex");
}

function makePanelSessionCookie(token) {
  const expiresAt = Date.now() + panelSessionTtlMs;
  const value = `${expiresAt}.${createHash("sha256").update(String(token)).digest("hex")}`;
  const signature = signPanelSession(value);
  return `${value}.${signature}`;
}

function validPanelSessionCookie(cookieValue) {
  const parts = String(cookieValue ?? "").split(".");
  if (parts.length !== 3) return false;
  const [expiresAtRaw, tokenHash, signature] = parts;
  const expiresAt = Number(expiresAtRaw);
  if (!Number.isFinite(expiresAt) || expiresAt < Date.now() || !/^[a-f0-9]{64}$/i.test(tokenHash)) {
    return false;
  }
  const expected = signPanelSession(`${expiresAtRaw}.${tokenHash}`);
  const expectedBuffer = Buffer.from(expected);
  const actualBuffer = Buffer.from(signature);
  return expectedBuffer.length === actualBuffer.length && timingSafeEqual(expectedBuffer, actualBuffer);
}

function panelSessionSetCookie(token, prefix) {
  const maxAge = Math.max(1, Math.floor(panelSessionTtlMs / 1000));
  const pathValue = prefix ? `${prefix}/` : "/";
  return `${panelSessionCookieName}=${encodeURIComponent(makePanelSessionCookie(token))}; Path=${pathValue}; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;
}

function panelSessionClearCookie(prefix) {
  const pathValue = prefix ? `${prefix}/` : "/";
  return `${panelSessionCookieName}=; Path=${pathValue}; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
}

function extractPanelToken(localUrl, req) {
  const queryToken = localUrl.searchParams.get("token");
  if (queryToken) return queryToken;
  const authHeader = String(req.headers.authorization ?? "");
  const match = authHeader.match(/^Bearer\s+(.+)$/i);
  return match ? match[1].trim() : "";
}

async function verifySub2ApiAdminToken(token) {
  if (!token || token.length > 8192) return false;
  const authUrl = new URL("/api/v1/auth/me", upstreamOrigin);
  const headers = {
    authorization: `Bearer ${token}`,
    accept: "application/json"
  };

  return await new Promise((resolve) => {
    const transport = authUrl.protocol === "https:" ? httpsRequest : httpRequest;
    const verifyReq = transport(
      {
        protocol: authUrl.protocol,
        hostname: authUrl.hostname,
        port: authUrl.port || undefined,
        method: "GET",
        path: `${authUrl.pathname}${authUrl.search}`,
        headers,
        timeout: 5000
      },
      (verifyRes) => {
        const chunks = [];
        verifyRes.on("data", (chunk) => {
          if (chunks.reduce((sum, item) => sum + item.length, 0) < 1024 * 1024) {
            chunks.push(chunk);
          }
        });
        verifyRes.on("end", () => {
          if ((verifyRes.statusCode ?? 500) >= 400) {
            resolve(false);
            return;
          }
          try {
            const payload = JSON.parse(Buffer.concat(chunks).toString("utf8"));
            const data = payload?.data ?? payload;
            resolve(data?.role === "admin" || data?.user?.role === "admin");
          } catch {
            resolve(false);
          }
        });
      }
    );
    verifyReq.on("timeout", () => verifyReq.destroy(new Error("sub2api auth timeout")));
    verifyReq.on("error", () => resolve(false));
    verifyReq.end();
  });
}

async function authorizeEmbeddedPanel(req, res, localUrl, prefix) {
  if (panelEmbeddedAuthMode === "off") return true;
  const cookies = parseCookies(req.headers.cookie);
  if (validPanelSessionCookie(cookies.get(panelSessionCookieName))) {
    return true;
  }

  const token = extractPanelToken(localUrl, req);
  if (panelEmbeddedAuthMode === "sub2api-admin" && await verifySub2ApiAdminToken(token)) {
    const cleanUrl = new URL(localUrl);
    cleanUrl.searchParams.delete("token");
    redirect(res, `${cleanUrl.pathname}${cleanUrl.search}`, {
      "set-cookie": panelSessionSetCookie(token, prefix)
    });
    return false;
  }

  sendPanelForbidden(res, prefix);
  return false;
}

async function authorizePanelSurface(req, res, localUrl, prefix) {
  if (panelEmbeddedAuthMode === "off") return true;
  const cookies = parseCookies(req.headers.cookie);
  if (validPanelSessionCookie(cookies.get(panelSessionCookieName))) {
    return true;
  }

  const token = extractPanelToken(localUrl, req);
  if (panelEmbeddedAuthMode === "sub2api-admin" && await verifySub2ApiAdminToken(token)) {
    return true;
  }

  sendPanelForbidden(res, prefix);
  return false;
}

function captureBodyText(body) {
  return body?.encoding === "utf8" ? String(body.data ?? "") : "";
}

function safeJsonParse(raw) {
  if (!raw) return null;
  try {
    return JSON.parse(raw);
  } catch {
    return null;
  }
}

function collapseWhitespace(value, maxLength = 160) {
  const text = String(value ?? "").replace(/\s+/g, " ").trim();
  if (text.length <= maxLength) return text;
  return `${text.slice(0, Math.max(0, maxLength - 1)).trimEnd()}…`;
}

function collectPreviewStrings(value, pieces = [], depth = 0) {
  if (value == null || pieces.length >= 8 || depth > 6) return pieces;

  if (typeof value === "string") {
    const text = collapseWhitespace(value, 240);
    if (text) pieces.push(text);
    return pieces;
  }

  if (Array.isArray(value)) {
    for (const item of value) {
      collectPreviewStrings(item, pieces, depth + 1);
      if (pieces.length >= 8) break;
    }
    return pieces;
  }

  if (typeof value !== "object") return pieces;

  for (const key of [
    "text",
    "input_text",
    "output_text",
    "content",
    "parts",
    "prompt",
    "instructions",
    "system",
    "system_instruction",
    "message",
    "messages",
    "input",
    "delta",
    "reasoning_content"
  ]) {
    if (pieces.length >= 8) break;
    if (Object.hasOwn(value, key)) {
      collectPreviewStrings(value[key], pieces, depth + 1);
    }
  }

  if (pieces.length > 0) return pieces;

  for (const [key, nested] of Object.entries(value)) {
    if (pieces.length >= 8) break;
    if (["id", "object", "role", "type", "model", "name", "usage", "created"].includes(key)) continue;
    collectPreviewStrings(nested, pieces, depth + 1);
  }

  return pieces;
}

function previewFromValue(value, maxLength = 160) {
  return collapseWhitespace(collectPreviewStrings(value).join(" "), maxLength);
}

function pickInputLikeValue(payload) {
  if (!payload || typeof payload !== "object") return payload;
  if (Array.isArray(payload.messages)) return payload.messages.map((message) => message?.content ?? message);
  if (Array.isArray(payload.input)) return payload.input;
  if (typeof payload.input === "string") return payload.input;
  if (Array.isArray(payload.contents)) return payload.contents.map((item) => item?.parts ?? item?.content ?? item);
  if (payload.prompt != null) return payload.prompt;
  if (payload.instructions != null) return payload.instructions;
  if (payload.system != null) return payload.system;
  if (payload.system_instruction != null) return payload.system_instruction;
  return payload;
}

function pickOutputLikeValue(payload) {
  if (!payload || typeof payload !== "object") return payload;
  if (typeof payload.output_text === "string") return payload.output_text;
  if (Array.isArray(payload.output) && payload.output.length > 0) {
    return payload.output.map((item) => item?.content ?? item?.text ?? item);
  }
  if (Array.isArray(payload.choices) && payload.choices.length > 0) {
    return payload.choices.map((choice) => choice?.message?.content ?? choice?.text ?? choice?.delta?.content ?? choice);
  }
  if (Array.isArray(payload.content) && payload.content.length > 0) return payload.content;
  if (Array.isArray(payload.candidates) && payload.candidates.length > 0) {
    return payload.candidates.map((candidate) => candidate?.content?.parts ?? candidate?.content ?? candidate);
  }
  if (payload.message) return payload.message.content ?? payload.message;
  if (payload.response) return pickOutputLikeValue(payload.response);
  return payload;
}

function detectRequestKind(payload, requestPath) {
  const pathText = String(requestPath ?? "").toLowerCase();
  if (pathText.includes("/v1/chat/completions")) return "chat";
  if (pathText.includes("/v1/responses")) return "responses";
  if (Array.isArray(payload?.messages)) return "messages";
  if (Array.isArray(payload?.input) || typeof payload?.input === "string") return "input";
  if (Array.isArray(payload?.contents)) return "contents";
  if (payload?.prompt != null) return "prompt";
  return "json";
}

function countConversationItems(payload) {
  if (!payload || typeof payload !== "object") return 0;
  if (Array.isArray(payload.messages)) return payload.messages.length;
  if (Array.isArray(payload.input)) return payload.input.length;
  if (typeof payload.input === "string") return 1;
  if (Array.isArray(payload.contents)) return payload.contents.length;
  if (payload.prompt != null) return 1;
  return 0;
}

function countImageLikeParts(value, depth = 0) {
  if (value == null || depth > 7) return 0;
  if (typeof value === "string") {
    return /^data:image\//i.test(value.trim()) ? 1 : 0;
  }
  if (Array.isArray(value)) {
    return value.reduce((sum, item) => sum + countImageLikeParts(item, depth + 1), 0);
  }
  if (typeof value !== "object") return 0;

  let count = 0;
  const type = String(value.type ?? "").toLowerCase();
  if (type.includes("image")) count += 1;

  const imageUrl = value.image_url;
  if (typeof imageUrl === "string" && /^data:image\//i.test(imageUrl.trim())) {
    count += 1;
  } else if (imageUrl && typeof imageUrl === "object") {
    if (typeof imageUrl.url === "string" && /^data:image\//i.test(imageUrl.url.trim())) count += 1;
    if (typeof imageUrl.data === "string" && /^data:image\//i.test(imageUrl.data.trim())) count += 1;
    if (typeof imageUrl.base64 === "string") count += 1;
  }

  if (typeof value.url === "string" && /^data:image\//i.test(value.url.trim())) count += 1;
  if (typeof value.data === "string" && /^data:image\//i.test(value.data.trim())) count += 1;
  if (typeof value.base64 === "string") count += 1;

  if (value.inline_data && typeof value.inline_data === "object") {
    if (typeof value.inline_data.data === "string" || typeof value.inline_data.base64 === "string") count += 1;
  }

  if (value.source && typeof value.source === "object") {
    const sourceType = String(value.source.type ?? "").toLowerCase();
    if (sourceType.includes("image")) count += 1;
    if (typeof value.source.data === "string" || typeof value.source.base64 === "string") count += 1;
  }

  for (const [key, nested] of Object.entries(value)) {
    if (["image_url", "url", "data", "base64", "inline_data", "source"].includes(key)) continue;
    count += countImageLikeParts(nested, depth + 1);
  }
  return count;
}

function shouldBridgeChatCompletions(payload, rawText) {
  if (chatCompletionsStreamMode === "off") return false;
  if (chatCompletionsStreamMode === "always") return true;

  const bytes = Buffer.byteLength(String(rawText ?? ""), "utf8");
  const imageCount = countImageLikeParts(payload);
  const messageCount = countConversationItems(payload);

  return (
    imageCount >= chatCompletionsStreamThresholdImages
    || bytes >= chatCompletionsStreamThresholdBytes
    || messageCount >= chatCompletionsStreamThresholdMessages
  );
}

function looksLikeSse(headers, rawText) {
  const contentType = String(headers?.["content-type"] ?? headers?.["Content-Type"] ?? "").toLowerCase();
  return contentType.includes("event-stream") || /^\s*(event:|data:)/m.test(String(rawText ?? ""));
}

function previewFromSse(raw) {
  const pieces = [];
  for (const line of String(raw ?? "").replace(/\r\n/g, "\n").split("\n")) {
    if (!line.startsWith("data:")) continue;
    const data = line.slice(5).trim();
    if (!data || data === "[DONE]") continue;
    const parsed = safeJsonParse(data);
    if (parsed) {
      const preview = previewFromValue(pickOutputLikeValue(parsed), 200);
      if (preview) pieces.push(preview);
    } else {
      pieces.push(collapseWhitespace(data, 200));
    }
    if (pieces.length >= 3) break;
  }
  return collapseWhitespace(pieces.join(" "), 160);
}

function parseSseEvents(raw) {
  const events = [];
  let eventName = "";
  let dataLines = [];

  const flush = function () {
    if (!eventName && dataLines.length === 0) return;
    const data = dataLines.join("\n");
    events.push({
      event: eventName,
      data,
      json: data && data !== "[DONE]" ? safeJsonParse(data) : null,
      done: data === "[DONE]"
    });
    eventName = "";
    dataLines = [];
  };

  for (const line of String(raw ?? "").replace(/\r\n/g, "\n").split("\n")) {
    if (line === "") {
      flush();
    } else if (line.startsWith("event:")) {
      eventName = line.slice(6).trim();
    } else if (line.startsWith("data:")) {
      dataLines.push(line.slice(5).replace(/^ /, ""));
    }
  }

  flush();
  return events;
}

function appendDeltaText(target, key, value) {
  if (typeof value !== "string" || !value) return;
  target[key] = typeof target[key] === "string"
    ? target[key] + value
    : value;
}

function mergeToolCallDelta(choice, deltaToolCalls) {
  if (!Array.isArray(deltaToolCalls) || deltaToolCalls.length === 0) return;
  if (!Array.isArray(choice.message.tool_calls)) {
    choice.message.tool_calls = [];
  }

  for (const deltaToolCall of deltaToolCalls) {
    if (!deltaToolCall || typeof deltaToolCall !== "object") continue;
    const rawIndex = deltaToolCall.index;
    const toolIndex = Number.isInteger(rawIndex) && rawIndex >= 0
      ? rawIndex
      : choice.message.tool_calls.length;
    let toolCall = choice.message.tool_calls[toolIndex];
    if (!toolCall) {
      toolCall = {};
      choice.message.tool_calls[toolIndex] = toolCall;
    }

    if (deltaToolCall.id) toolCall.id = deltaToolCall.id;
    if (deltaToolCall.type) toolCall.type = deltaToolCall.type;

    if (deltaToolCall.function && typeof deltaToolCall.function === "object") {
      toolCall.function ??= {};
      if (deltaToolCall.function.name) {
        toolCall.function.name = deltaToolCall.function.name;
      }
      appendDeltaText(toolCall.function, "arguments", deltaToolCall.function.arguments);
    }
  }

  choice.message.tool_calls = choice.message.tool_calls.filter(Boolean);
}

function rebuildChatCompletionFromSse(raw) {
  const events = parseSseEvents(raw);
  const choices = new Map();
  let meta = null;
  let usage = null;
  let hadAnyChunk = false;

  for (const event of events) {
    const payload = event.json;
    if (!payload || typeof payload !== "object") continue;
    if (payload.error) return { error: payload.error };
    if (!meta) {
      meta = {
        id: payload.id,
        object: "chat.completion",
        created: payload.created,
        model: payload.model,
        system_fingerprint: payload.system_fingerprint
      };
    } else {
      if (!meta.id && payload.id) meta.id = payload.id;
      if (!meta.created && payload.created) meta.created = payload.created;
      if (!meta.model && payload.model) meta.model = payload.model;
      if (!meta.system_fingerprint && payload.system_fingerprint) meta.system_fingerprint = payload.system_fingerprint;
    }
    if (payload.usage) usage = payload.usage;

    if (!Array.isArray(payload.choices)) continue;
    hadAnyChunk = true;
    for (const chunkChoice of payload.choices) {
      const index = Number.isFinite(chunkChoice?.index) ? chunkChoice.index : 0;
      let choice = choices.get(index);
      if (!choice) {
        choice = {
          index,
          message: {
            role: "assistant",
            content: ""
          },
          finish_reason: null
        };
        choices.set(index, choice);
      }

      if (chunkChoice?.message && typeof chunkChoice.message === "object") {
        choice.message = {
          ...choice.message,
          ...chunkChoice.message
        };
      }

      if (chunkChoice?.delta && typeof chunkChoice.delta === "object") {
        if (chunkChoice.delta.role) choice.message.role = chunkChoice.delta.role;
        if (typeof chunkChoice.delta.content === "string") {
          choice.message.content = (choice.message.content || "") + chunkChoice.delta.content;
        }
        if (typeof chunkChoice.delta.reasoning_content === "string") {
          choice.message.reasoning_content = (choice.message.reasoning_content || "") + chunkChoice.delta.reasoning_content;
        }
        mergeToolCallDelta(choice, chunkChoice.delta.tool_calls);
      }

      if (chunkChoice?.finish_reason != null) {
        choice.finish_reason = chunkChoice.finish_reason;
      }
      if (chunkChoice?.logprobs != null) {
        choice.logprobs = chunkChoice.logprobs;
      }
    }
  }

  if (!hadAnyChunk || choices.size === 0) return null;
  const response = {
    id: meta?.id || "",
    object: "chat.completion",
    created: meta?.created || Math.floor(Date.now() / 1000),
    model: meta?.model || "unknown",
    choices: [...choices.values()].sort((a, b) => a.index - b.index)
  };
  if (meta?.system_fingerprint) response.system_fingerprint = meta.system_fingerprint;
  if (usage) response.usage = usage;
  return response;
}

function summarizeCapture(capture, fileSize = undefined) {
  const requestRaw = captureBodyText(capture.request?.body);
  const requestPayload = safeJsonParse(requestRaw);
  const responseRaw = captureBodyText(capture.response?.body);
  const responsePayload = safeJsonParse(responseRaw);
  const startedAt = capture.startedAt ? Date.parse(capture.startedAt) : NaN;
  const completedAt = capture.completedAt ? Date.parse(capture.completedAt) : NaN;
  const durationMs = Number.isFinite(startedAt) && Number.isFinite(completedAt) ? Math.max(0, completedAt - startedAt) : null;
  const responsePreview = capture.error?.message
    ?? (looksLikeSse(capture.response?.headers, responseRaw)
      ? previewFromSse(responseRaw)
      : previewFromValue(pickOutputLikeValue(responsePayload), 160));

  return {
    model: typeof requestPayload?.model === "string" ? requestPayload.model : null,
    requestKind: detectRequestKind(requestPayload, capture.request?.path),
    messageCount: countConversationItems(requestPayload),
    preview: requestPayload ? previewFromValue(pickInputLikeValue(requestPayload), 160) : collapseWhitespace(requestRaw, 160),
    responsePreview,
    stream: Boolean(
      requestPayload?.stream
      || looksLikeSse(capture.response?.headers, responseRaw)
    ),
    truncated: Boolean(capture.request?.body?.truncated || capture.response?.body?.truncated),
    requestBytes: capture.request?.body?.bytes ?? 0,
    responseBytes: capture.response?.body?.bytes ?? 0,
    durationMs,
    fileSize: fileSize ?? 0,
    pending: !capture.completedAt
  };
}

function cloneJson(value) {
  return value == null ? value : JSON.parse(JSON.stringify(value));
}

function makeActiveCaptureFile(capture) {
  return `_active/${capture.id}.json`;
}

function updateActiveCapture(capture) {
  const snapshot = cloneJson(capture);
  snapshot.file = makeActiveCaptureFile(capture);
  snapshot.fileSize = capture.fileSize ?? 0;
  snapshot.summary = summarizeCapture(snapshot, snapshot.fileSize);
  captureSummaryState.activeCaptures.set(snapshot.file, snapshot);
  return snapshot;
}

function removeActiveCapture(capture) {
  captureSummaryState.activeCaptures.delete(makeActiveCaptureFile(capture));
}

function parseOptionalTimestamp(value) {
  if (value == null || value === "") return null;
  const ms = Date.parse(String(value));
  return Number.isFinite(ms) ? ms : null;
}

function parseCaptureRange(localUrl) {
  const fromRaw = localUrl.searchParams.get("from");
  const toRaw = localUrl.searchParams.get("to");
  const fromMs = parseOptionalTimestamp(fromRaw);
  const toMs = parseOptionalTimestamp(toRaw);

  if (fromRaw && fromMs == null) {
    const error = new Error(`invalid from timestamp: ${fromRaw}`);
    error.statusCode = 400;
    throw error;
  }

  if (toRaw && toMs == null) {
    const error = new Error(`invalid to timestamp: ${toRaw}`);
    error.statusCode = 400;
    throw error;
  }

  if (fromMs != null && toMs != null && fromMs > toMs) {
    const error = new Error("from timestamp must be <= to timestamp");
    error.statusCode = 400;
    throw error;
  }

  return { fromMs, toMs, fromRaw, toRaw };
}

async function listCaptureFiles() {
  let dateEntries;
  try {
    dateEntries = await readdir(captureRoot, { withFileTypes: true });
  } catch (error) {
    if (error.code === "ENOENT") return [];
    throw error;
  }

  const files = [];
  for (const dateEntry of dateEntries) {
    if (!dateEntry.isDirectory()) continue;
    const dateDir = path.join(captureRoot, dateEntry.name);
    const captureEntries = await readdir(dateDir, { withFileTypes: true });
    for (const captureEntry of captureEntries) {
      if (!captureEntry.isFile() || !captureEntry.name.endsWith(".json")) continue;
      const filePath = path.join(dateDir, captureEntry.name);
      const fileStat = await stat(filePath);
      files.push({
        filePath,
        relPath: path.relative(captureRoot, filePath).replaceAll(path.sep, "/"),
        mtimeMs: fileStat.mtimeMs,
        size: fileStat.size
      });
    }
  }

  files.sort((a, b) => b.mtimeMs - a.mtimeMs);
  return files;
}

function captureMatchesRange(startedAtMs, { fromMs = null, toMs = null } = {}) {
  if (fromMs != null && startedAtMs < fromMs) return false;
  if (toMs != null && startedAtMs > toMs) return false;
  return true;
}

async function loadCaptureEntry(file) {
  try {
    const capture = JSON.parse(await readFile(file.filePath, "utf8"));
    if (capture.request?.path === "/favicon.ico") return null;
    const startedAtMs = Date.parse(capture.startedAt ?? "");
    const effectiveStartedAtMs = Number.isFinite(startedAtMs) ? startedAtMs : file.mtimeMs;
    capture.file = file.relPath;
    capture.fileSize = file.size;
    capture.summary = summarizeCapture(capture, file.size);
    return {
      capture,
      filePath: file.filePath,
      file: file.relPath,
      size: file.size,
      startedAtMs: effectiveStartedAtMs,
      mtimeMs: file.mtimeMs
    };
  } catch (error) {
    return {
      capture: {
        id: path.basename(file.filePath, ".json"),
        file: file.relPath,
        error: {
          message: `failed to read capture: ${error.message}`
        },
        fileSize: file.size,
        summary: {
          requestKind: "json",
          messageCount: 0,
          preview: "",
          responsePreview: `failed to read capture: ${error.message}`,
          stream: false,
          truncated: false,
          requestBytes: 0,
          responseBytes: 0,
          durationMs: null,
          fileSize: file.size
        }
      },
      file: file.relPath,
      size: file.size,
      startedAtMs: file.mtimeMs,
      mtimeMs: file.mtimeMs
    };
  }
}

function toSummaryItem(capture) {
  return {
    id: capture.id,
    file: capture.file,
    startedAt: capture.startedAt,
    completedAt: capture.completedAt,
    method: capture.request?.method,
    path: capture.request?.path,
    targetUrl: capture.targetUrl,
    statusCode: capture.response?.statusCode ?? null,
    error: capture.error?.message ?? null,
    mutationCount: Array.isArray(capture.mutations)
      ? capture.mutations.reduce((count, item) => count + (item.changes?.length ?? 0), 0)
      : 0,
    size: capture.fileSize ?? 0,
    summary: capture.summary ?? summarizeCapture(capture, capture.fileSize ?? 0)
  };
}

function makeSummaryRecord(capture, file, size, mtimeMs, startedAtMs) {
  return {
    file,
    size,
    mtimeMs,
    startedAtMs,
    summaryItem: toSummaryItem(capture)
  };
}

function rememberDetailCache(file, size, mtimeMs, capture, assets = []) {
  captureSummaryState.detailCache.delete(file);
  captureSummaryState.detailCache.set(file, { size, mtimeMs, capture, assets });
  while (captureSummaryState.detailCache.size > captureDetailCacheLimit) {
    const oldestKey = captureSummaryState.detailCache.keys().next().value;
    captureSummaryState.detailCache.delete(oldestKey);
  }
}

function assetExtensionForMimeType(mimeType) {
  const normalized = String(mimeType || "").toLowerCase();
  if (normalized.includes("jpeg")) return "jpg";
  if (normalized.includes("png")) return "png";
  if (normalized.includes("webp")) return "webp";
  if (normalized.includes("gif")) return "gif";
  if (normalized.includes("bmp")) return "bmp";
  if (normalized.includes("svg")) return "svg";
  if (normalized.includes("tiff")) return "tiff";
  return "bin";
}

function mimeTypeFromAssetPath(relAssetPath) {
  const ext = path.extname(String(relAssetPath || "")).toLowerCase();
  return ({
    ".png": "image/png",
    ".jpg": "image/jpeg",
    ".jpeg": "image/jpeg",
    ".webp": "image/webp",
    ".gif": "image/gif",
    ".bmp": "image/bmp",
    ".svg": "image/svg+xml",
    ".tiff": "image/tiff",
    ".bin": "application/octet-stream"
  })[ext] || "application/octet-stream";
}

function captureAssetUrl(relAssetPath, prefix = panelPublicPrefix) {
  return `${prefix}/panel-api/capture-asset?asset=${encodeURIComponent(relAssetPath)}`;
}

function rewritePanelAssetUrlString(value, prefix = panelPublicPrefix) {
  const raw = String(value ?? "");
  const marker = "/panel-api/capture-asset?";
  if (raw.startsWith(marker)) return `${prefix}${raw}`;
  const knownPrefixes = [panelEmbeddedPrefix, panelPublicPrefix].filter(Boolean);
  for (const knownPrefix of knownPrefixes) {
    const knownMarker = `${knownPrefix}${marker}`;
    if (raw.startsWith(knownMarker)) return `${prefix}${raw.slice(knownPrefix.length)}`;
  }
  return value;
}

function rewritePanelAssetUrlsInValue(value, prefix = panelPublicPrefix, depth = 0) {
  if (depth > 8) return value;
  if (typeof value === "string") return rewritePanelAssetUrlString(value, prefix);
  if (Array.isArray(value)) {
    for (let index = 0; index < value.length; index += 1) {
      value[index] = rewritePanelAssetUrlsInValue(value[index], prefix, depth + 1);
    }
    return value;
  }
  if (!value || typeof value !== "object") return value;
  for (const [key, nested] of Object.entries(value)) {
    value[key] = rewritePanelAssetUrlsInValue(nested, prefix, depth + 1);
  }
  return value;
}

function rewritePanelAssetUrlsInCapture(capture, prefix = panelPublicPrefix) {
  for (const body of [
    capture?.request?.body,
    capture?.request?.forwardedBody,
    capture?.response?.body,
    capture?.upstreamResponse?.body
  ]) {
    if (!body || body.encoding !== "utf8" || !body.data) continue;
    const parsed = safeJsonParse(body.data);
    if (!parsed || typeof parsed !== "object") continue;
    rewritePanelAssetUrlsInValue(parsed, prefix);
    body.data = JSON.stringify(parsed);
  }
  return capture;
}

async function persistInlineAssetsInValue(value, assetDirAbs, assetDirRel, captureId, assets, depth = 0) {
  if (depth > 8) return value;
  if (typeof value === "string") {
    const match = value.match(/^data:(image\/[^;,]+);base64,(.+)$/);
    if (!match) return value;
    const slot = assets.length;
    const ext = assetExtensionForMimeType(match[1]);
    const assetName = `${captureId}_${slot}.${ext}`;
    const assetRelPath = path.posix.join(assetDirRel, assetName);
    const assetAbsPath = path.join(assetDirAbs, assetName);
    const buffer = Buffer.from(match[2], "base64");
    await mkdir(assetDirAbs, { recursive: true });
    await writeFile(assetAbsPath, buffer);
    assets.push({
      path: assetRelPath,
      mimeType: match[1],
      bytes: buffer.length
    });
    return captureAssetUrl(assetRelPath);
  }

  if (Array.isArray(value)) {
    for (let index = 0; index < value.length; index += 1) {
      value[index] = await persistInlineAssetsInValue(value[index], assetDirAbs, assetDirRel, captureId, assets, depth + 1);
    }
    return value;
  }

  if (!value || typeof value !== "object") return value;

  for (const [key, nested] of Object.entries(value)) {
    value[key] = await persistInlineAssetsInValue(nested, assetDirAbs, assetDirRel, captureId, assets, depth + 1);
  }
  return value;
}

async function rewriteCaptureInlineAssetsForSave(capture) {
  const date = capture.startedAt.slice(0, 10);
  const assetDirRel = path.posix.join(date, captureAssetsDirName);
  const assetDirAbs = path.join(captureRoot, date, captureAssetsDirName);
  const assets = [];
  for (const body of [
    capture?.request?.body,
    capture?.request?.forwardedBody,
    capture?.response?.body,
    capture?.upstreamResponse?.body
  ]) {
    if (!body || body.encoding !== "utf8" || !body.data) continue;
    const parsed = safeJsonParse(body.data);
    if (!parsed || typeof parsed !== "object") continue;
    await persistInlineAssetsInValue(parsed, assetDirAbs, assetDirRel, capture.id, assets);
    body.data = JSON.stringify(parsed);
  }
  if (assets.length > 0) {
    capture.assets = assets;
  }
  return { capture, assets };
}

function rewriteInlineAssetsInValue(value, relPath, assets, prefix = panelPublicPrefix) {
  if (typeof value === "string") {
    const match = value.match(/^data:(image\/[^;,]+);base64,(.+)$/);
    if (!match) return value;
    const slot = assets.length;
    assets.push({
      mimeType: match[1],
      base64: match[2]
    });
    return `${prefix}/panel-api/capture-asset?file=${encodeURIComponent(relPath)}&slot=${slot}`;
  }

  if (Array.isArray(value)) {
    return value.map((item) => rewriteInlineAssetsInValue(item, relPath, assets, prefix));
  }

  if (!value || typeof value !== "object") return value;

  for (const [key, nested] of Object.entries(value)) {
    value[key] = rewriteInlineAssetsInValue(nested, relPath, assets, prefix);
  }
  return value;
}

function rewriteCaptureInlineAssets(capture, relPath, prefix = panelPublicPrefix) {
  const assets = [];
  for (const body of [
    capture?.request?.body,
    capture?.request?.forwardedBody,
    capture?.response?.body,
    capture?.upstreamResponse?.body
  ]) {
    if (!body || body.encoding !== "utf8" || !body.data) continue;
    const parsed = safeJsonParse(body.data);
    if (!parsed || typeof parsed !== "object") continue;
    rewriteInlineAssetsInValue(parsed, relPath, assets, prefix);
    body.data = JSON.stringify(parsed);
  }
  if (assets.length > 0) {
    capture.assets = assets.map((asset) => ({ mimeType: asset.mimeType }));
  }
  return { capture, assets };
}

function getCaptureIndexDb() {
  if (captureSummaryState.db) return captureSummaryState.db;
  const db = new DatabaseSync(captureIndexDbPath, { open: true });
  db.exec(`
    PRAGMA journal_mode = WAL;
    CREATE TABLE IF NOT EXISTS capture_summaries (
      file TEXT PRIMARY KEY,
      size INTEGER NOT NULL,
      mtime_ms INTEGER NOT NULL,
      started_at_ms INTEGER NOT NULL,
      summary_json TEXT NOT NULL
    );
    CREATE INDEX IF NOT EXISTS idx_capture_summaries_started ON capture_summaries(started_at_ms DESC, mtime_ms DESC);
  `);
  captureSummaryState.db = db;
  return db;
}

function checkpointCaptureIndexDb(mode = "PASSIVE", throttleMs = 60000) {
  const now = Date.now();
  if (throttleMs > 0 && (now - captureSummaryState.lastSyncMs) < throttleMs) return;
  try {
    getCaptureIndexDb().exec(`PRAGMA wal_checkpoint(${mode});`);
    captureSummaryState.lastSyncMs = now;
  } catch {}
}

function summaryRowToRecord(row) {
  return {
    file: row.file,
    size: Number(row.size),
    mtimeMs: Number(row.mtime_ms),
    startedAtMs: Number(row.started_at_ms),
    summaryItem: JSON.parse(row.summary_json)
  };
}

function upsertSummaryRecord(record) {
  const db = getCaptureIndexDb();
  db.prepare(`
    INSERT INTO capture_summaries (file, size, mtime_ms, started_at_ms, summary_json)
    VALUES (?, ?, ?, ?, ?)
    ON CONFLICT(file) DO UPDATE SET
      size = excluded.size,
      mtime_ms = excluded.mtime_ms,
      started_at_ms = excluded.started_at_ms,
      summary_json = excluded.summary_json
  `).run(
    record.file,
    record.size,
    record.mtimeMs,
    record.startedAtMs,
    JSON.stringify(record.summaryItem)
  );
  checkpointCaptureIndexDb("PASSIVE");
}

function deleteSummaryRecord(file) {
  const db = getCaptureIndexDb();
  db.prepare("DELETE FROM capture_summaries WHERE file = ?").run(file);
  captureSummaryState.detailCache.delete(file);
  checkpointCaptureIndexDb("PASSIVE");
}

async function ensureSummaryRecords() {
  if (
    captureSummaryState.indexReady
    && !captureSummaryState.loadPromise
    && (Date.now() - captureSummaryState.lastSyncMs) < captureIndexSyncIntervalMs
  ) {
    return;
  }
  if (captureSummaryState.loadPromise) return captureSummaryState.loadPromise;

  captureSummaryState.loadPromise = (async () => {
    await mkdir(captureRoot, { recursive: true });
    const files = await listCaptureFiles();
    const db = getCaptureIndexDb();
    const storedRecords = db.prepare("SELECT file, size, mtime_ms, started_at_ms, summary_json FROM capture_summaries").all();
    const storedByFile = new Map(storedRecords.map((row) => [row.file, row]));
    const seen = new Set();

    for (const file of files) {
      seen.add(file.relPath);
      const stored = storedByFile.get(file.relPath);
      if (
        stored
        && stored.size === file.size
        && stored.mtime_ms === file.mtimeMs
        && stored.summary_json
      ) {
        continue;
      }

      const entry = await loadCaptureEntry(file);
      if (!entry) {
        if (stored) deleteSummaryRecord(file.relPath);
        continue;
      }
      upsertSummaryRecord(makeSummaryRecord(entry.capture, entry.file, entry.size, entry.mtimeMs, entry.startedAtMs));
    }

    for (const row of storedRecords) {
      if (!seen.has(row.file)) deleteSummaryRecord(row.file);
    }
    captureSummaryState.indexReady = true;
    captureSummaryState.lastSyncMs = Date.now();
  })().finally(() => {
    captureSummaryState.loadPromise = null;
  });

  return captureSummaryState.loadPromise;
}

async function rememberSavedCapture(filePath, capture, size) {
  const relPath = path.relative(captureRoot, filePath).replaceAll(path.sep, "/");
  const startedAtMs = Date.parse(capture.startedAt ?? "");
  const effectiveStartedAtMs = Number.isFinite(startedAtMs) ? startedAtMs : Date.now();
  const mtimeMs = Date.now();
  capture.file = relPath;
  capture.fileSize = size;
  capture.summary = summarizeCapture(capture, size);
  upsertSummaryRecord(makeSummaryRecord(capture, relPath, size, mtimeMs, effectiveStartedAtMs));
  captureSummaryState.indexReady = true;
  captureSummaryState.lastSyncMs = Date.now();
}

async function listCaptureSummaries(limit = 200, range = {}) {
  await ensureSummaryRecords();
  const maxItems = Math.max(1, Math.min(limit, 1000));
  const persisted = await (async () => {
    const db = getCaptureIndexDb();
    const clauses = [];
    const values = [];
    if (range.fromMs != null) {
      clauses.push("started_at_ms >= ?");
      values.push(range.fromMs);
    }
    if (range.toMs != null) {
      clauses.push("started_at_ms <= ?");
      values.push(range.toMs);
    }
    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
    const rows = db.prepare(`
      SELECT file, size, mtime_ms, started_at_ms, summary_json
      FROM capture_summaries
      ${where}
      ORDER BY started_at_ms DESC, mtime_ms DESC
      LIMIT ?
    `).all(...values, maxItems);
    return rows.map((row) => summaryRowToRecord(row).summaryItem);
  })();
  const active = [...captureSummaryState.activeCaptures.values()]
    .filter((capture) => captureMatchesRange(Date.parse(capture.startedAt ?? "") || Date.now(), range))
    .map((capture) => toSummaryItem(capture));
  return [...active, ...persisted]
    .sort((a, b) => Date.parse(b.startedAt ?? "") - Date.parse(a.startedAt ?? ""))
    .slice(0, maxItems);
}

async function listCaptureSummaryFiles(limit = 1000, range = {}, sort = "desc") {
  await ensureSummaryRecords();
  const db = getCaptureIndexDb();
  const maxItems = Math.max(1, Math.min(limit, 2000));
  const clauses = [];
  const values = [];
  if (range.fromMs != null) {
    clauses.push("started_at_ms >= ?");
    values.push(range.fromMs);
  }
  if (range.toMs != null) {
    clauses.push("started_at_ms <= ?");
    values.push(range.toMs);
  }
  const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
  const direction = sort === "asc" ? "ASC" : "DESC";
  return db.prepare(`
    SELECT file
    FROM capture_summaries
    ${where}
    ORDER BY started_at_ms ${direction}, mtime_ms ${direction}
    LIMIT ?
  `).all(...values, maxItems).map((row) => row.file);
}

async function getCaptureSummaryStats() {
  await ensureSummaryRecords();
  const db = getCaptureIndexDb();
  const total = db.prepare("SELECT COUNT(*) AS count FROM capture_summaries").get();
  const latest = db.prepare("SELECT summary_json FROM capture_summaries ORDER BY started_at_ms DESC, mtime_ms DESC LIMIT 1").get();
  const latestItem = latest?.summary_json ? JSON.parse(latest.summary_json) : null;
  const activeItems = [...captureSummaryState.activeCaptures.values()];
  const activeLatestAt = activeItems
    .map((item) => item.startedAt)
    .filter(Boolean)
    .sort()
    .at(-1) ?? "";
  return {
    totalCount: Number(total?.count ?? 0) + activeItems.length,
    latestAt: [activeLatestAt, latestItem?.startedAt ?? ""].filter(Boolean).sort().at(-1) ?? ""
  };
}

async function loadFullCaptures(limit = 1000, range = {}, prefix = panelPublicPrefix) {
  const files = await listCaptureSummaryFiles(limit, range, "desc");
  const captures = [];
  for (const relPath of [...files].reverse()) {
    const filePath = resolveCapturePath(relPath);
    if (!filePath) {
      deleteSummaryRecord(relPath);
      continue;
    }
    try {
      captures.push(await loadCaptureByPath(filePath, prefix));
    } catch (error) {
      if (error.code === "ENOENT") {
        deleteSummaryRecord(relPath);
        continue;
      }
      throw error;
    }
  }
  return captures;
}

function retentionEnabled() {
  return (
    (Number.isFinite(captureRetentionDays) && captureRetentionDays > 0)
    || (Number.isFinite(captureRetentionMaxFiles) && captureRetentionMaxFiles > 0)
    || (Number.isFinite(captureRetentionMaxTotalBytes) && captureRetentionMaxTotalBytes > 0)
  );
}

async function removeCaptureArtifacts(file) {
  try {
    const raw = await readFile(file.filePath, "utf8");
    const capture = JSON.parse(raw);
    if (Array.isArray(capture?.assets)) {
      for (const asset of capture.assets) {
        const assetAbs = resolveCaptureAssetPath(asset?.path);
        if (assetAbs) {
          await rm(assetAbs, { force: true }).catch(() => undefined);
        }
      }
    }
  } catch {}

  await rm(file.filePath, { force: true }).catch(() => undefined);
  deleteSummaryRecord(file.relPath);
}

async function pruneCapturesIfNeeded() {
  if (!retentionEnabled()) return;

  captureSummaryState.prunePromise = captureSummaryState.prunePromise
    .catch(() => undefined)
    .then(async () => {
      const files = await listCaptureFiles();
      const now = Date.now();
      const keep = [];
      const remove = [];
      let keptBytes = 0;

      for (const file of files) {
        const tooOld =
          Number.isFinite(captureRetentionDays)
          && captureRetentionDays > 0
          && (now - file.mtimeMs) > captureRetentionDays * 24 * 60 * 60 * 1000;
        const tooMany =
          Number.isFinite(captureRetentionMaxFiles)
          && captureRetentionMaxFiles > 0
          && keep.length >= captureRetentionMaxFiles;
        const tooLarge =
          Number.isFinite(captureRetentionMaxTotalBytes)
          && captureRetentionMaxTotalBytes > 0
          && keep.length > 0
          && (keptBytes + file.size) > captureRetentionMaxTotalBytes;

        if (tooOld || tooMany || tooLarge) {
          remove.push(file);
          continue;
        }

        keep.push(file);
        keptBytes += file.size;
      }

      for (const file of remove) {
        await removeCaptureArtifacts(file);
      }
    })
    .catch(() => undefined);

  await captureSummaryState.prunePromise;
}

async function migrateLegacyCaptureFile(file) {
  const raw = await readFile(file.filePath, "utf8");
  if (!raw.includes("data:image/")) return false;

  const capture = JSON.parse(raw);
  const rewritten = await rewriteCaptureInlineAssetsForSave(capture);
  const fileText = `${JSON.stringify(rewritten.capture, null, 2)}\n`;
  await writeFile(file.filePath, fileText, "utf8");

  const relPath = path.relative(captureRoot, file.filePath).replaceAll(path.sep, "/");
  const size = Buffer.byteLength(fileText);
  const mtimeMs = Date.now();
  const startedAtMs = Number.isFinite(Date.parse(rewritten.capture.startedAt ?? ""))
    ? Date.parse(rewritten.capture.startedAt)
    : mtimeMs;
  rewritten.capture.file = relPath;
  rewritten.capture.fileSize = size;
  rewritten.capture.summary = summarizeCapture(rewritten.capture, size);
  rememberDetailCache(relPath, size, mtimeMs, rewritten.capture, rewritten.assets);
  upsertSummaryRecord(makeSummaryRecord(rewritten.capture, relPath, size, mtimeMs, startedAtMs));
  return true;
}

async function migrateLegacyCaptures() {
  captureSummaryState.migrationPromise = captureSummaryState.migrationPromise
    .catch(() => undefined)
    .then(async () => {
      const files = await listCaptureFiles();
      let migrated = 0;
      for (const file of files) {
        try {
          if (await migrateLegacyCaptureFile(file)) migrated += 1;
        } catch (error) {
          console.error(`failed to migrate legacy capture ${file.filePath}: ${error.stack ?? error.message}`);
        }
      }
      if (migrated > 0) {
        console.log(`migrated ${migrated} legacy captures to asset-backed format`);
      }
      await pruneCapturesIfNeeded();
      try {
        getCaptureIndexDb().exec("PRAGMA wal_checkpoint(TRUNCATE);");
      } catch {}
    })
    .catch(() => undefined);

  return captureSummaryState.migrationPromise;
}

function resolveCapturePath(relPath) {
  const normalized = String(relPath ?? "").replaceAll("\\", "/");
  if (!normalized || normalized.includes("\0")) return undefined;
  const absolute = path.resolve(captureRoot, normalized);
  const root = path.resolve(captureRoot);
  if (absolute !== root && absolute.startsWith(`${root}${path.sep}`)) {
    return absolute;
  }
  return undefined;
}

function resolveCaptureAssetPath(relPath) {
  const raw = String(relPath ?? "").replaceAll("\\", "/");
  if (!raw || raw.includes("\0")) return undefined;
  const normalized = path.posix.normalize(raw);
  const parts = normalized.split("/");
  if (
    normalized === "."
    || normalized.startsWith("../")
    || path.posix.isAbsolute(normalized)
    || !parts.includes(captureAssetsDirName)
  ) {
    return undefined;
  }
  const absolute = path.resolve(captureRoot, normalized);
  const root = path.resolve(captureRoot);
  if (absolute !== root && absolute.startsWith(`${root}${path.sep}`)) {
    return absolute;
  }
  return undefined;
}

async function loadCaptureByPath(filePath, prefix = panelPublicPrefix) {
  const relPath = path.relative(captureRoot, filePath).replaceAll(path.sep, "/");
  const fileInfo = await stat(filePath);
  const cached = captureSummaryState.detailCache.get(relPath);
  if (cached && cached.size === fileInfo.size && cached.mtimeMs === fileInfo.mtimeMs) {
    return rewritePanelAssetUrlsInCapture(cloneJson(cached.capture), prefix);
  }
  const capture = JSON.parse(await readFile(filePath, "utf8"));
  capture.file = relPath;
  capture.fileSize = fileInfo.size;
  capture.summary = summarizeCapture(capture, fileInfo.size);
  const rewritten = rewriteCaptureInlineAssets(capture, relPath, prefix);
  rewritePanelAssetUrlsInCapture(rewritten.capture, prefix);
  rememberDetailCache(relPath, fileInfo.size, fileInfo.mtimeMs, rewritten.capture, rewritten.assets);
  return rewritten.capture;
}

function loadActiveCaptureByFile(file) {
  const active = captureSummaryState.activeCaptures.get(String(file ?? ""));
  return active ? cloneJson(active) : null;
}

async function handlePanelApi(req, res, localUrl, prefix = panelPublicPrefix) {
  const range = parseCaptureRange(localUrl);

  if (localUrl.pathname === "/panel-api/captures" && req.method === "GET") {
    const limit = Number(localUrl.searchParams.get("limit") ?? 200);
    const stats = await getCaptureSummaryStats();
    sendJson(res, 200, {
      latestAt: stats.latestAt,
      totalCount: stats.totalCount,
      items: await listCaptureSummaries(Number.isFinite(limit) ? limit : 200, range)
    });
    return true;
  }

  if (localUrl.pathname === "/panel-api/export-captures" && req.method === "GET") {
    const limit = Number(localUrl.searchParams.get("limit") ?? 1000);
    sendJson(res, 200, {
      upstream: upstreamOrigin.origin,
      captureRoot,
      from: range.fromRaw,
      to: range.toRaw,
      items: await loadFullCaptures(Number.isFinite(limit) ? limit : 1000, range, prefix)
    });
    return true;
  }

  if (localUrl.pathname === "/panel-api/capture" && req.method === "GET") {
    const requestedFile = localUrl.searchParams.get("file");
    const activeCapture = loadActiveCaptureByFile(requestedFile);
    if (activeCapture) {
      sendJson(res, 200, activeCapture);
      return true;
    }
    const filePath = resolveCapturePath(requestedFile);
    if (!filePath) {
      sendJson(res, 400, { error: "INVALID_CAPTURE_PATH" });
      return true;
    }
    try {
      sendJson(res, 200, await loadCaptureByPath(filePath, prefix));
    } catch (error) {
      const statusCode = error.code === "ENOENT" ? 404 : 500;
      sendJson(res, statusCode, { error: "CAPTURE_READ_FAILED", message: error.message });
    }
    return true;
  }

  if (localUrl.pathname === "/panel-api/capture-asset" && req.method === "GET") {
    const assetPath = resolveCaptureAssetPath(localUrl.searchParams.get("asset"));
    if (assetPath) {
      try {
        const buffer = await readFile(assetPath);
        sendBuffer(res, 200, mimeTypeFromAssetPath(assetPath), buffer, {
          "cache-control": "public, max-age=86400",
          "x-content-type-options": "nosniff"
        });
      } catch (error) {
        const statusCode = error.code === "ENOENT" ? 404 : 500;
        sendJson(res, statusCode, { error: "CAPTURE_ASSET_READ_FAILED", message: error.message });
      }
      return true;
    }

    const filePath = resolveCapturePath(localUrl.searchParams.get("file"));
    const slot = Number(localUrl.searchParams.get("slot"));
    if (!filePath || !Number.isInteger(slot) || slot < 0) {
      sendJson(res, 400, { error: "INVALID_CAPTURE_ASSET" });
      return true;
    }
    try {
      const capture = await loadCaptureByPath(filePath, prefix);
      const relPath = capture.file;
      const cached = captureSummaryState.detailCache.get(relPath);
      const asset = cached?.assets?.[slot];
      if (!asset) {
        sendJson(res, 404, { error: "CAPTURE_ASSET_NOT_FOUND" });
        return true;
      }
      sendBuffer(res, 200, asset.mimeType || "application/octet-stream", Buffer.from(asset.base64, "base64"), {
        "cache-control": "public, max-age=86400",
        "x-content-type-options": "nosniff"
      });
    } catch (error) {
      const statusCode = error.code === "ENOENT" ? 404 : 500;
      sendJson(res, statusCode, { error: "CAPTURE_ASSET_READ_FAILED", message: error.message });
    }
    return true;
  }

  return false;
}

function panelHtml(prefix = panelPublicPrefix) {
  return `<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Transparent Proxy Panel</title>
  <link rel="stylesheet" href="${prefix}/panel.css">
</head>
<body>
  <div id="app">
    <main class="shell">
      <aside class="capture-rail">
        <div class="rail-head">
          <div class="rail-head__top">
            <div class="rail-head__title">
              <div class="section-kicker">Recent Captures</div>
              <p class="section-hint" id="listHint">Loading captures…</p>
            </div>
            <button id="refresh" class="rail-refresh" type="button">Refresh</button>
          </div>
          <label class="search rail-search">
            <span class="sr-only">Search</span>
            <input id="searchInput" type="search" placeholder="Search">
          </label>
        </div>
        <div class="capture-list" id="captureRows"></div>
      </aside>
      <section class="detail" id="detail">
        <div class="detail-scroll">
          <div class="empty-state">
            <div class="empty-state__eyebrow">Ready</div>
            <h2>Select a capture</h2>
            <p>The rail refreshes automatically every five seconds. Search, filter, then open one capture for a readable request and response view.</p>
          </div>
        </div>
      </section>
    </main>
    <div id="imageLightbox" class="image-lightbox" hidden aria-hidden="true" role="dialog" aria-modal="true">
      <div class="image-lightbox__backdrop" data-lightbox-close></div>
      <div class="image-lightbox__panel" role="document">
        <button class="image-lightbox__close" type="button" aria-label="Close image preview" data-lightbox-close>×</button>
        <img id="imageLightboxImg" class="image-lightbox__img" alt="">
        <div id="imageLightboxCaption" class="image-lightbox__caption"></div>
      </div>
    </div>
  </div>
  <script src="${prefix}/panel.js" defer></script>
</body>
</html>`;
}

function rewritePanelJsForPrefix(source, prefix = panelPublicPrefix) {
  if (!prefix) return source;
  return source
    .replaceAll('"/panel-api/', `"${prefix}/panel-api/`)
    .replaceAll('^\\/panel-api\\/', `^\\${prefix}\\/panel-api\\/`);
}

function proxyRequest(req, res, capture, requestBody, upstreamBody, targetUrl, options = {}) {
  const headers = stripHopByHop(req.headers);
  headers.host = upstreamOrigin.host;
  headers["content-length"] = upstreamBody.length;

  if (process.env.FORWARD_ACCEPT_ENCODING !== "1") {
    headers["accept-encoding"] = "identity";
  }

  if (options.streamEnabled) {
    headers.accept = "text/event-stream";
  }
  const bridgeToJson = Boolean(options.bridgeToJson);
  const refreshActive = function () {
    updateActiveCapture(capture);
  };
  refreshActive();

  const transport = targetUrl.protocol === "https:" ? httpsRequest : httpRequest;
  const upstreamReq = transport(
    {
      protocol: targetUrl.protocol,
      hostname: targetUrl.hostname,
      port: targetUrl.port || undefined,
      method: req.method,
      path: `${targetUrl.pathname}${targetUrl.search}`,
      headers
    },
    (upstreamRes) => {
      const responseHeaders = {
        ...stripHopByHop(upstreamRes.headers),
        ...corsHeaders(req.headers["access-control-request-headers"])
      };
      if (!bridgeToJson) {
        res.writeHead(upstreamRes.statusCode ?? 502, responseHeaders);
      }

      const fullChunks = [];
      const capturedChunks = [];
      let capturedBytes = 0;
      let truncated = false;

      upstreamRes.on("data", (chunk) => {
        if (!bridgeToJson) {
          res.write(chunk);
        } else {
          fullChunks.push(chunk);
        }
        if (!truncated) {
          if (capturedBytes + chunk.length <= maxCapturedResponseBytes) {
            capturedChunks.push(chunk);
            capturedBytes += chunk.length;
          } else {
            truncated = true;
          }
        }
        capture.response = {
          statusCode: upstreamRes.statusCode ?? 502,
          headers: sanitizeHeaders(upstreamRes.headers),
          body: bodyForCapture(Buffer.concat(capturedChunks), upstreamRes.headers, truncated)
        };
        if (bridgeToJson) {
          capture.upstreamResponse = {
            statusCode: upstreamRes.statusCode,
            headers: sanitizeHeaders(upstreamRes.headers),
            body: bodyForCapture(Buffer.concat(capturedChunks), upstreamRes.headers, truncated)
          };
        }
        refreshActive();
      });

      upstreamRes.on("end", async () => {
        const fullResponseBuffer = bridgeToJson ? Buffer.concat(fullChunks) : null;
        const responseBuffer = Buffer.concat(capturedChunks);
        let finalStatusCode = upstreamRes.statusCode ?? 502;
        let finalHeaders = sanitizeHeaders(upstreamRes.headers);
        let finalBody = bodyForCapture(responseBuffer, upstreamRes.headers, truncated);

        if (bridgeToJson) {
          capture.upstreamResponse = {
            statusCode: upstreamRes.statusCode,
            headers: sanitizeHeaders(upstreamRes.headers),
            body: bodyForCapture(responseBuffer, upstreamRes.headers, truncated)
          };
        }

        if (bridgeToJson) {
          const rawText = fullResponseBuffer.toString("utf8");
          const rebuilt = (upstreamRes.statusCode ?? 502) < 400 && looksLikeSse(upstreamRes.headers, rawText)
            ? rebuildChatCompletionFromSse(rawText)
            : null;

          if (rebuilt?.error) {
            const payload = { error: rebuilt.error };
            sendJson(res, 502, payload);
            finalStatusCode = 502;
            finalHeaders = jsonResponseHeaders(req.headers["access-control-request-headers"]);
            finalBody = bodyForCapture(Buffer.from(jsonResponseText(payload), "utf8"), finalHeaders, false);
          } else if (rebuilt) {
            sendJson(res, upstreamRes.statusCode ?? 200, rebuilt);
            finalStatusCode = upstreamRes.statusCode ?? 200;
            finalHeaders = jsonResponseHeaders(req.headers["access-control-request-headers"]);
            finalBody = bodyForCapture(Buffer.from(jsonResponseText(rebuilt), "utf8"), finalHeaders, false);
          } else {
            const passthroughHeaders = {
              ...responseHeaders,
              "content-length": fullResponseBuffer.length
            };
            res.writeHead(upstreamRes.statusCode ?? 502, passthroughHeaders);
            res.end(fullResponseBuffer);
          }
        } else {
          res.end();
        }

        capture.completedAt = new Date().toISOString();
        capture.response = {
          statusCode: finalStatusCode,
          headers: finalHeaders,
          body: finalBody
        };
        refreshActive();

        try {
          capture.savedTo = await saveCapture(capture);
          console.log(`${capture.id} ${req.method} ${req.url} -> ${upstreamRes.statusCode} ${capture.savedTo}`);
        } catch (error) {
          console.error(`${capture.id} failed to save capture: ${error.stack ?? error.message}`);
        } finally {
          removeActiveCapture(capture);
        }
      });
    }
  );

  upstreamReq.setTimeout(Number(process.env.UPSTREAM_TIMEOUT_MS ?? 480000), () => {
    upstreamReq.destroy(new Error("upstream request timeout"));
  });

  upstreamReq.on("error", async (error) => {
    if (!res.headersSent) {
      sendJson(res, 502, {
        error: "UPSTREAM_REQUEST_FAILED",
        message: error.message,
        upstream: upstreamOrigin.origin
      });
    } else {
      res.destroy(error);
    }

    capture.completedAt = new Date().toISOString();
    capture.error = {
      message: error.message,
      stack: error.stack
    };
    refreshActive();

    try {
      capture.savedTo = await saveCapture(capture);
    } catch (saveError) {
      console.error(`${capture.id} failed to save error capture: ${saveError.stack ?? saveError.message}`);
    } finally {
      removeActiveCapture(capture);
    }
  });

  upstreamReq.end(upstreamBody);
}

function proxyCaptureOnlyRequest(req, res, capture, targetUrl) {
  const headers = stripHopByHop(req.headers);
  headers.host = upstreamOrigin.host;

  if (process.env.FORWARD_ACCEPT_ENCODING !== "1") {
    headers["accept-encoding"] = "identity";
  }

  const requestCapture = createCaptureBuffer(maxCapturedRequestBytes);
  const responseCapture = createCaptureBuffer(maxCapturedResponseBytes);
  let upstreamStatusCode = 502;
  let upstreamHeaders = {};
  let requestEnded = false;
  let saved = false;

  const refreshActive = function () {
    updateActiveCapture(capture);
  };
  refreshActive();

  const finishCapture = async function (error = null) {
    if (saved) return;
    saved = true;

    capture.completedAt = new Date().toISOString();
    capture.request.body = requestCapture.body(req.headers);

    if (error) {
      capture.error = {
        message: error.message,
        stack: error.stack
      };
    } else {
      capture.response = {
        statusCode: upstreamStatusCode,
        headers: sanitizeHeaders(upstreamHeaders),
        body: responseCapture.body(upstreamHeaders)
      };
    }
    refreshActive();

    try {
      capture.savedTo = await saveCapture(capture);
      console.log(`${capture.id} ${req.method} ${req.url} -> ${upstreamStatusCode} ${capture.savedTo}`);
    } catch (saveError) {
      console.error(`${capture.id} failed to save capture: ${saveError.stack ?? saveError.message}`);
    } finally {
      removeActiveCapture(capture);
    }
  };

  const transport = targetUrl.protocol === "https:" ? httpsRequest : httpRequest;
  const upstreamReq = transport(
    {
      protocol: targetUrl.protocol,
      hostname: targetUrl.hostname,
      port: targetUrl.port || undefined,
      method: req.method,
      path: `${targetUrl.pathname}${targetUrl.search}`,
      headers
    },
    (upstreamRes) => {
      upstreamStatusCode = upstreamRes.statusCode ?? 502;
      upstreamHeaders = upstreamRes.headers;

      res.writeHead(upstreamStatusCode, {
        ...stripHopByHop(upstreamRes.headers),
        ...corsHeaders(req.headers["access-control-request-headers"])
      });

      upstreamRes.on("data", (chunk) => {
        responseCapture.push(chunk);
      });

      upstreamRes.on("end", () => {
        void finishCapture();
      });

      upstreamRes.on("error", (error) => {
        if (!res.destroyed) res.destroy(error);
        void finishCapture(error);
      });

      upstreamRes.pipe(res);
    }
  );

  upstreamReq.setTimeout(Number(process.env.UPSTREAM_TIMEOUT_MS ?? 480000), () => {
    upstreamReq.destroy(new Error("upstream request timeout"));
  });

  req.on("data", (chunk) => {
    requestCapture.push(chunk);
  });

  req.on("end", () => {
    requestEnded = true;
  });

  req.on("aborted", () => {
    upstreamReq.destroy(new Error("client request aborted"));
  });

  req.on("error", (error) => {
    upstreamReq.destroy(error);
  });

  upstreamReq.on("error", (error) => {
    if (!requestEnded && !req.destroyed) {
      req.destroy(error);
    }
    if (!res.headersSent) {
      sendJson(res, 502, {
        error: "UPSTREAM_REQUEST_FAILED",
        message: error.message,
        upstream: upstreamOrigin.origin
      });
    } else if (!res.destroyed) {
      res.destroy(error);
    }
    void finishCapture(error);
  });

  req.pipe(upstreamReq);
}

const server = createServer(async (req, res) => {
  const id = requestId();
  const localUrl = new URL(req.url ?? "/", `http://${req.headers.host ?? `${listenHost}:${listenPort}`}`);
  const embeddedPanelRequest = Boolean(panelEmbeddedPrefix && (
    localUrl.pathname === panelEmbeddedPrefix || localUrl.pathname.startsWith(`${panelEmbeddedPrefix}/`)
  ));
  let panelPrefix = panelPublicPrefix;
  if (embeddedPanelRequest) {
    if (!await authorizeEmbeddedPanel(req, res, localUrl, panelEmbeddedPrefix)) return;
    panelPrefix = panelEmbeddedPrefix;
    const trimmedPath = localUrl.pathname.slice(panelEmbeddedPrefix.length) || "/";
    localUrl.pathname = trimmedPath === "/" ? "/panel" : trimmedPath;
  }
  const targetUrl = new URL(req.url ?? "/", upstreamOrigin);
  targetUrl.protocol = upstreamOrigin.protocol;
  targetUrl.host = upstreamOrigin.host;

  try {
    if (localUrl.pathname === "/panel" || localUrl.pathname === "/panel/") {
      if (!embeddedPanelRequest && !await authorizePanelSurface(req, res, localUrl, panelPrefix)) return;
      sendHtml(res, panelHtml(panelPrefix));
      return;
    }

    if (localUrl.pathname === "/panel.css") {
      if (!embeddedPanelRequest && !await authorizePanelSurface(req, res, localUrl, panelPrefix)) return;
      await sendStaticTextFile(res, panelCssPath, "text/css; charset=utf-8");
      return;
    }

    if (localUrl.pathname === "/panel.js") {
      if (!embeddedPanelRequest && !await authorizePanelSurface(req, res, localUrl, panelPrefix)) return;
      await sendStaticTextFile(
        res,
        panelJsPath,
        "text/javascript; charset=utf-8",
        (source) => rewritePanelJsForPrefix(source, panelPrefix)
      );
      return;
    }

    if (localUrl.pathname === "/favicon.ico") {
      res.writeHead(204, { "cache-control": "public, max-age=86400" });
      res.end();
      return;
    }

    if (localUrl.pathname === "/__proxy_health") {
      sendJson(res, 200, {
        status: "ok",
        mode: captureOnlyMode ? "capture-only" : "standard",
        upstream: upstreamOrigin.origin
      });
      return;
    }

    if (localUrl.pathname.startsWith("/panel-api/")) {
      if (!embeddedPanelRequest && !await authorizePanelSurface(req, res, localUrl, panelPrefix)) return;
      if (await handlePanelApi(req, res, localUrl, panelPrefix)) return;
      sendJson(res, 404, { error: "NOT_FOUND" });
      return;
    }

    if (req.method === "OPTIONS") {
      res.writeHead(204, corsHeaders(req.headers["access-control-request-headers"]));
      res.end();
      return;
    }

    if (captureOnlyMode) {
      const capture = {
        id,
        startedAt: new Date().toISOString(),
        upstream: upstreamOrigin.origin,
        targetUrl: targetUrl.toString(),
        request: {
          method: req.method,
          path: req.url,
          headers: sanitizeHeaders(req.headers),
          auth: extractRequestKeyPreview(req.headers),
          body: bodyForCapture(Buffer.alloc(0), req.headers)
        },
        mutations: [],
        captureOnly: true
      };
      proxyCaptureOnlyRequest(req, res, capture, targetUrl);
      return;
    }

    const requestBody = await readBody(req);
    const { body: upstreamBody, mutations, streamEnabled, requestedStream, bridgeEnabled } = await mutateRequestBody(req, requestBody, targetUrl);

    const capture = {
      id,
      startedAt: new Date().toISOString(),
      upstream: upstreamOrigin.origin,
      targetUrl: targetUrl.toString(),
      request: {
        method: req.method,
        path: req.url,
        headers: sanitizeHeaders(req.headers),
        auth: extractRequestKeyPreview(req.headers),
        body: bodyForCapture(requestBody, req.headers),
        forwardedBody: upstreamBody.equals(requestBody)
          ? undefined
          : bodyForCapture(upstreamBody, { "content-type": "application/json" })
      },
      mutations
    };

    proxyRequest(req, res, capture, requestBody, upstreamBody, targetUrl, {
      streamEnabled,
      bridgeToJson: Boolean(bridgeEnabled)
    });
  } catch (error) {
    const statusCode = error.statusCode ?? 500;
    sendJson(res, statusCode, {
      error: "PROXY_ERROR",
      message: error.message
    });
  }
});

async function startServer() {
  try {
    await ensureSummaryRecords();
    await pruneCapturesIfNeeded();
    await rm(path.join(captureRoot, ".panel-index.json"), { force: true }).catch(() => undefined);
  } catch (error) {
    console.error(`failed to warm capture summaries: ${error.stack ?? error.message}`);
  }

  server.listen(listenPort, listenHost, () => {
    console.log(`transparent-api-proxy listening on http://${listenHost}:${listenPort}`);
    console.log(`upstream: ${upstreamOrigin.origin}`);
    console.log(`rules: ${rulesPath}`);
    console.log(`captures: ${captureRoot}`);
    void migrateLegacyCaptures();
  });
}

void startServer();