@copilotkit/aimock 1.35.1 → 1.36.1

package/dist/provider-auth.js

@@ -0,0 +1,168 @@
+//#region src/provider-auth.ts
+/**
+* Default marker prefix identifying a "dummy" credential that a caller sends
+* only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).
+* A caller credential that is absent OR begins with this prefix is treated as a
+* placeholder that aimock is free to override with its own built-in upstream key.
+* A caller credential that does NOT begin with this prefix is treated as a real
+* key and forwarded verbatim (the caller overrides aimock).
+*
+* Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint
+* placeholder keys under a different prefix.
+*/
+const DEFAULT_DUMMY_KEY_MARKER = "sk-aimock-";
+/** Resolve the active dummy-key marker, honoring the env override. */
+function getDummyKeyMarker() {
+	const override = process.env.AIMOCK_DUMMY_KEY_MARKER;
+	return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;
+}
+const PROVIDER_AUTH_SCHEMES = {
+	openai: { kind: "bearer" },
+	openrouter: { kind: "bearer" },
+	cohere: { kind: "bearer" },
+	grok: { kind: "bearer" },
+	ollama: { kind: "bearer" },
+	anthropic: { kind: "x-api-key" },
+	gemini: { kind: "x-goog-api-key" },
+	"gemini-interactions": { kind: "x-goog-api-key" },
+	veo: { kind: "x-goog-api-key" },
+	azure: { kind: "api-key" },
+	elevenlabs: { kind: "xi-api-key" },
+	fal: { kind: "fal-key" }
+};
+/**
+* Case-insensitively delete a header from a forward-header map, returning the
+* value that was present (if any). Header maps preserve the original casing of
+* incoming headers, so we can't assume a canonical key.
+*/
+function takeHeader(headers, name) {
+	const lowerName = name.toLowerCase();
+	let found;
+	for (const key of Object.keys(headers)) if (key.toLowerCase() === lowerName) {
+		found = headers[key];
+		delete headers[key];
+	}
+	return found;
+}
+/**
+* Extract the caller's credential value for a given auth scheme from the
+* forwarded headers, if present. For bearer, strips the `Bearer ` prefix.
+*/
+function readCallerCredential(headers, scheme) {
+	if (scheme.kind === "bearer" || scheme.kind === "fal-key") {
+		const raw = scanHeader(headers, "authorization");
+		if (raw === void 0) return void 0;
+		const prefix = scheme.kind === "fal-key" ? "Key" : "Bearer";
+		const match = new RegExp(`^\\s*${prefix}\\s+(.+)$`, "i").exec(raw);
+		return match ? match[1].trim() : raw.trim();
+	}
+	return scanHeader(headers, authHeaderName(scheme));
+}
+/**
+* The wire header name a non-Authorization scheme carries its credential in.
+* (bearer/fal-key both use `Authorization` and are handled separately.)
+*/
+function authHeaderName(scheme) {
+	switch (scheme.kind) {
+		case "x-api-key": return "x-api-key";
+		case "x-goog-api-key": return "x-goog-api-key";
+		case "api-key": return "api-key";
+		case "xi-api-key": return "xi-api-key";
+		case "bearer":
+		case "fal-key": return "authorization";
+	}
+}
+/** Case-insensitive header lookup that does not mutate the map. */
+function scanHeader(headers, name) {
+	const lowerName = name.toLowerCase();
+	for (const key of Object.keys(headers)) if (key.toLowerCase() === lowerName) return headers[key];
+}
+/**
+* Decide whether aimock should override the caller's credential with its own
+* built-in key. Override when the caller sent no credential OR sent a dummy
+* placeholder (prefixed with the active marker). A real caller key is left
+* untouched so the caller can always override aimock.
+*/
+function shouldOverride(callerCredential, marker) {
+	if (callerCredential === void 0 || callerCredential.length === 0) return true;
+	return callerCredential.startsWith(marker);
+}
+/**
+* Inject aimock's built-in upstream credential into the forwarded headers when
+* appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place
+* and may mutate `target` (query-param schemes; none currently).
+*
+* Precedence:
+*   - No built-in key configured for this provider    → no-op (forward verbatim).
+*   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).
+*   - Caller credential absent or dummy-prefixed      → inject built-in key.
+*   - Caller credential is a real key                 → forward it unchanged.
+*
+* @param forwardHeaders headers already built by buildForwardHeaders(req)
+* @param target upstream URL (reserved for query-param auth schemes)
+* @param providerKey which provider this request is routed to
+* @param builtinKey aimock's configured key for this provider (if any)
+*/
+function applyProviderAuth(forwardHeaders, target, providerKey, builtinKey) {
+	if (!builtinKey) return;
+	const scheme = PROVIDER_AUTH_SCHEMES[providerKey];
+	if (!scheme) return;
+	const marker = getDummyKeyMarker();
+	if (!shouldOverride(readCallerCredential(forwardHeaders, scheme), marker)) return;
+	switch (scheme.kind) {
+		case "bearer":
+			takeHeader(forwardHeaders, "authorization");
+			forwardHeaders["Authorization"] = `Bearer ${builtinKey}`;
+			break;
+		case "fal-key":
+			takeHeader(forwardHeaders, "authorization");
+			forwardHeaders["Authorization"] = `Key ${builtinKey}`;
+			break;
+		case "x-api-key":
+			takeHeader(forwardHeaders, "x-api-key");
+			forwardHeaders["x-api-key"] = builtinKey;
+			break;
+		case "x-goog-api-key":
+			takeHeader(forwardHeaders, "x-goog-api-key");
+			forwardHeaders["x-goog-api-key"] = builtinKey;
+			break;
+		case "api-key":
+			takeHeader(forwardHeaders, "api-key");
+			forwardHeaders["api-key"] = builtinKey;
+			break;
+		case "xi-api-key":
+			takeHeader(forwardHeaders, "xi-api-key");
+			forwardHeaders["xi-api-key"] = builtinKey;
+			break;
+	}
+}
+/**
+* Read per-provider built-in keys from the environment. Returns undefined when
+* no provider key is configured so the feature stays fully inert by default.
+*
+* Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An
+* empty-string value is treated as unset (existing truthiness pattern), keeping
+* the feature inert. `gemini-interactions` is not read here: it reuses the
+* Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth
+* providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites
+* their auth.
+*/
+function readProviderKeysFromEnv(env = process.env) {
+	const keys = {};
+	if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;
+	if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;
+	if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;
+	if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;
+	if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;
+	if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;
+	if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;
+	if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;
+	if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;
+	if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;
+	if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;
+	return Object.keys(keys).length > 0 ? keys : void 0;
+}
+
+//#endregion
+export { applyProviderAuth, readProviderKeysFromEnv };
+//# sourceMappingURL=provider-auth.js.map

package/dist/provider-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth.js","names":[],"sources":["../src/provider-auth.ts"],"sourcesContent":["import type { RecordProviderKey } from \"./types.js\";\n\n/**\n * Default marker prefix identifying a \"dummy\" credential that a caller sends\n * only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).\n * A caller credential that is absent OR begins with this prefix is treated as a\n * placeholder that aimock is free to override with its own built-in upstream key.\n * A caller credential that does NOT begin with this prefix is treated as a real\n * key and forwarded verbatim (the caller overrides aimock).\n *\n * Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint\n * placeholder keys under a different prefix.\n */\nexport const DEFAULT_DUMMY_KEY_MARKER = \"sk-aimock-\";\n\n/** Resolve the active dummy-key marker, honoring the env override. */\nexport function getDummyKeyMarker(): string {\n  const override = process.env.AIMOCK_DUMMY_KEY_MARKER;\n  return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;\n}\n\n/**\n * How a given provider carries its API credential on the wire. aimock injects\n * its built-in key using the provider's native scheme so the upstream accepts\n * it. Providers whose auth is a signed/exchanged credential (Bedrock SigV4,\n * Vertex AI OAuth) are deliberately absent — those are NOT simple static-key\n * schemes, so aimock never rewrites their auth and always forwards the caller's\n * credential unchanged.\n *\n * Scheme kinds (all static long-lived keys):\n *   - bearer          `Authorization: Bearer <key>`  (OpenAI, OpenRouter, Cohere, Grok/xAI, Ollama)\n *   - fal-key         `Authorization: Key <key>`     (fal.ai — note the `Key ` prefix, NOT `Bearer`)\n *   - x-api-key       `x-api-key: <key>`             (Anthropic)\n *   - x-goog-api-key  `x-goog-api-key: <key>`        (Gemini, Gemini Interactions, Veo)\n *   - api-key         `api-key: <key>`               (Azure OpenAI static-key auth)\n *   - xi-api-key      `xi-api-key: <key>`            (ElevenLabs)\n *\n * Note on Azure: Azure OpenAI also supports Microsoft Entra ID `Authorization:\n * Bearer <token>` OAuth. aimock only ever injects the static `api-key` header,\n * and a real Entra bearer token from the caller is never dummy-prefixed, so it\n * is always forwarded verbatim (the caller overrides aimock).\n */\ntype AuthScheme =\n  | { kind: \"bearer\" } // Authorization: Bearer <key>\n  | { kind: \"fal-key\" } // Authorization: Key <key>\n  | { kind: \"x-api-key\" } // x-api-key: <key>\n  | { kind: \"x-goog-api-key\" } // x-goog-api-key: <key>\n  | { kind: \"api-key\" } // api-key: <key>\n  | { kind: \"xi-api-key\" }; // xi-api-key: <key>\n\nconst PROVIDER_AUTH_SCHEMES: Partial<Record<RecordProviderKey, AuthScheme>> = {\n  // Bearer-token providers.\n  openai: { kind: \"bearer\" },\n  openrouter: { kind: \"bearer\" },\n  cohere: { kind: \"bearer\" },\n  grok: { kind: \"bearer\" }, // xAI\n  ollama: { kind: \"bearer\" }, // Ollama Cloud / bearer-gated Ollama servers\n  // Anthropic.\n  anthropic: { kind: \"x-api-key\" },\n  // Google (Gemini + Veo) use the x-goog-api-key header scheme.\n  gemini: { kind: \"x-goog-api-key\" },\n  \"gemini-interactions\": { kind: \"x-goog-api-key\" },\n  veo: { kind: \"x-goog-api-key\" },\n  // Azure OpenAI static-key auth.\n  azure: { kind: \"api-key\" },\n  // ElevenLabs.\n  elevenlabs: { kind: \"xi-api-key\" },\n  // fal.ai — uses the `Key ` prefix on Authorization, NOT `Bearer `.\n  fal: { kind: \"fal-key\" },\n};\n\n/**\n * Case-insensitively delete a header from a forward-header map, returning the\n * value that was present (if any). Header maps preserve the original casing of\n * incoming headers, so we can't assume a canonical key.\n */\nfunction takeHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  let found: string | undefined;\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) {\n      found = headers[key];\n      delete headers[key];\n    }\n  }\n  return found;\n}\n\n/**\n * Extract the caller's credential value for a given auth scheme from the\n * forwarded headers, if present. For bearer, strips the `Bearer ` prefix.\n */\nfunction readCallerCredential(\n  headers: Record<string, string>,\n  scheme: AuthScheme,\n): string | undefined {\n  if (scheme.kind === \"bearer\" || scheme.kind === \"fal-key\") {\n    const raw = scanHeader(headers, \"authorization\");\n    if (raw === undefined) return undefined;\n    // Strip the scheme prefix (`Bearer ` for bearer, `Key ` for fal) if present,\n    // otherwise treat the whole value as the credential.\n    const prefix = scheme.kind === \"fal-key\" ? \"Key\" : \"Bearer\";\n    const match = new RegExp(`^\\\\s*${prefix}\\\\s+(.+)$`, \"i\").exec(raw);\n    return match ? match[1].trim() : raw.trim();\n  }\n  return scanHeader(headers, authHeaderName(scheme));\n}\n\n/**\n * The wire header name a non-Authorization scheme carries its credential in.\n * (bearer/fal-key both use `Authorization` and are handled separately.)\n */\nfunction authHeaderName(scheme: AuthScheme): string {\n  switch (scheme.kind) {\n    case \"x-api-key\":\n      return \"x-api-key\";\n    case \"x-goog-api-key\":\n      return \"x-goog-api-key\";\n    case \"api-key\":\n      return \"api-key\";\n    case \"xi-api-key\":\n      return \"xi-api-key\";\n    case \"bearer\":\n    case \"fal-key\":\n      return \"authorization\";\n  }\n}\n\n/** Case-insensitive header lookup that does not mutate the map. */\nfunction scanHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) return headers[key];\n  }\n  return undefined;\n}\n\n/**\n * Decide whether aimock should override the caller's credential with its own\n * built-in key. Override when the caller sent no credential OR sent a dummy\n * placeholder (prefixed with the active marker). A real caller key is left\n * untouched so the caller can always override aimock.\n */\nfunction shouldOverride(callerCredential: string | undefined, marker: string): boolean {\n  if (callerCredential === undefined || callerCredential.length === 0) return true;\n  return callerCredential.startsWith(marker);\n}\n\n/**\n * Inject aimock's built-in upstream credential into the forwarded headers when\n * appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place\n * and may mutate `target` (query-param schemes; none currently).\n *\n * Precedence:\n *   - No built-in key configured for this provider    → no-op (forward verbatim).\n *   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).\n *   - Caller credential absent or dummy-prefixed      → inject built-in key.\n *   - Caller credential is a real key                 → forward it unchanged.\n *\n * @param forwardHeaders headers already built by buildForwardHeaders(req)\n * @param target upstream URL (reserved for query-param auth schemes)\n * @param providerKey which provider this request is routed to\n * @param builtinKey aimock's configured key for this provider (if any)\n */\nexport function applyProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  builtinKey: string | undefined,\n): void {\n  void target; // reserved for future query-param schemes (e.g. Gemini ?key=)\n  if (!builtinKey) return; // feature inert for this provider\n\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return; // signed/OAuth provider — never rewrite auth\n\n  const marker = getDummyKeyMarker();\n  const callerCredential = readCallerCredential(forwardHeaders, scheme);\n  if (!shouldOverride(callerCredential, marker)) return; // caller sent a real key\n\n  // Strip any existing auth headers for this scheme (across casings) before\n  // setting aimock's key, so a dummy caller key can't linger alongside ours.\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Bearer ${builtinKey}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Key ${builtinKey}`;\n      break;\n    case \"x-api-key\":\n      takeHeader(forwardHeaders, \"x-api-key\");\n      forwardHeaders[\"x-api-key\"] = builtinKey;\n      break;\n    case \"x-goog-api-key\":\n      takeHeader(forwardHeaders, \"x-goog-api-key\");\n      forwardHeaders[\"x-goog-api-key\"] = builtinKey;\n      break;\n    case \"api-key\":\n      takeHeader(forwardHeaders, \"api-key\");\n      forwardHeaders[\"api-key\"] = builtinKey;\n      break;\n    case \"xi-api-key\":\n      takeHeader(forwardHeaders, \"xi-api-key\");\n      forwardHeaders[\"xi-api-key\"] = builtinKey;\n      break;\n  }\n}\n\n/**\n * Read per-provider built-in keys from the environment. Returns undefined when\n * no provider key is configured so the feature stays fully inert by default.\n *\n * Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An\n * empty-string value is treated as unset (existing truthiness pattern), keeping\n * the feature inert. `gemini-interactions` is not read here: it reuses the\n * Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth\n * providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites\n * their auth.\n */\nexport function readProviderKeysFromEnv(\n  env: NodeJS.ProcessEnv = process.env,\n): Partial<Record<RecordProviderKey, string>> | undefined {\n  const keys: Partial<Record<RecordProviderKey, string>> = {};\n  if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;\n  if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;\n  if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;\n  if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;\n  if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;\n  if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;\n  if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;\n  if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;\n  if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;\n  if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;\n  if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;\n  return Object.keys(keys).length > 0 ? keys : undefined;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,2BAA2B;;AAGxC,SAAgB,oBAA4B;CAC1C,MAAM,WAAW,QAAQ,IAAI;AAC7B,QAAO,YAAY,SAAS,SAAS,IAAI,WAAW;;AAgCtD,MAAM,wBAAwE;CAE5E,QAAQ,EAAE,MAAM,UAAU;CAC1B,YAAY,EAAE,MAAM,UAAU;CAC9B,QAAQ,EAAE,MAAM,UAAU;CAC1B,MAAM,EAAE,MAAM,UAAU;CACxB,QAAQ,EAAE,MAAM,UAAU;CAE1B,WAAW,EAAE,MAAM,aAAa;CAEhC,QAAQ,EAAE,MAAM,kBAAkB;CAClC,uBAAuB,EAAE,MAAM,kBAAkB;CACjD,KAAK,EAAE,MAAM,kBAAkB;CAE/B,OAAO,EAAE,MAAM,WAAW;CAE1B,YAAY,EAAE,MAAM,cAAc;CAElC,KAAK,EAAE,MAAM,WAAW;CACzB;;;;;;AAOD,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;CACpC,IAAI;AACJ,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,WAAW;AACnC,UAAQ,QAAQ;AAChB,SAAO,QAAQ;;AAGnB,QAAO;;;;;;AAOT,SAAS,qBACP,SACA,QACoB;AACpB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EACzD,MAAM,MAAM,WAAW,SAAS,gBAAgB;AAChD,MAAI,QAAQ,OAAW,QAAO;EAG9B,MAAM,SAAS,OAAO,SAAS,YAAY,QAAQ;EACnD,MAAM,QAAQ,IAAI,OAAO,QAAQ,OAAO,YAAY,IAAI,CAAC,KAAK,IAAI;AAClE,SAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,IAAI,MAAM;;AAE7C,QAAO,WAAW,SAAS,eAAe,OAAO,CAAC;;;;;;AAOpD,SAAS,eAAe,QAA4B;AAClD,SAAQ,OAAO,MAAf;EACE,KAAK,YACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK;EACL,KAAK,UACH,QAAO;;;;AAKb,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,UAAW,QAAO,QAAQ;;;;;;;;AAWxD,SAAS,eAAe,kBAAsC,QAAyB;AACrF,KAAI,qBAAqB,UAAa,iBAAiB,WAAW,EAAG,QAAO;AAC5E,QAAO,iBAAiB,WAAW,OAAO;;;;;;;;;;;;;;;;;;AAmB5C,SAAgB,kBACd,gBACA,QACA,aACA,YACM;AAEN,KAAI,CAAC,WAAY;CAEjB,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ;CAEb,MAAM,SAAS,mBAAmB;AAElC,KAAI,CAAC,eADoB,qBAAqB,gBAAgB,OAAO,EAC/B,OAAO,CAAE;AAI/C,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,UAAU;AAC5C;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,OAAO;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,YAAY;AACvC,kBAAe,eAAe;AAC9B;EACF,KAAK;AACH,cAAW,gBAAgB,iBAAiB;AAC5C,kBAAe,oBAAoB;AACnC;EACF,KAAK;AACH,cAAW,gBAAgB,UAAU;AACrC,kBAAe,aAAa;AAC5B;EACF,KAAK;AACH,cAAW,gBAAgB,aAAa;AACxC,kBAAe,gBAAgB;AAC/B;;;;;;;;;;;;;;AAeN,SAAgB,wBACd,MAAyB,QAAQ,KACuB;CACxD,MAAM,OAAmD,EAAE;AAC3D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,8BAA+B,MAAK,YAAY,IAAI;AAC5D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,yBAA0B,MAAK,OAAO,IAAI;AAClD,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,KAAI,IAAI,0BAA2B,MAAK,QAAQ,IAAI;AACpD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO"}

package/dist/recorder.cjs

@@ -6,6 +6,7 @@ const require_router = require('./router.cjs');
 const require_sse_writer = require('./sse-writer.cjs');
 const require_stream_collapse = require('./stream-collapse.cjs');
 const require_url = require('./url.cjs');
+const require_provider_auth = require('./provider-auth.cjs');
 let node_http = require("node:http");
 node_http = require_runtime.__toESM(node_http);
 let node_crypto = require("node:crypto");
@@ -207,7 +208,9 @@ function persistFixture(opts) {
 async function proxyAndRecord(req, res, request, providerKey, pathname, fixtures, defaults, rawBody, options) {
 	const record = defaults.record;
 	if (!record) return "not_configured";
-	const upstreamUrl = record.providers[providerKey === "gemini-interactions" ? "gemini" : providerKey];
+	const providers = record.providers;
+	const lookupKey = providerKey === "gemini-interactions" ? "gemini" : providerKey;
+	const upstreamUrl = providers[lookupKey];
 	if (!upstreamUrl) {
 		defaults.logger.warn(`No upstream URL configured for provider "${providerKey}" — cannot proxy`);
 		return "not_configured";
@@ -226,6 +229,7 @@ async function proxyAndRecord(req, res, request, providerKey, pathname, fixtures
 	}
 	defaults.logger.warn(`NO FIXTURE MATCH — proxying to ${upstreamUrl}${pathname}`);
 	const forwardHeaders = buildForwardHeaders(req);
+	require_provider_auth.applyProviderAuth(forwardHeaders, target, providerKey, record.providerKeys?.[lookupKey]);
 	const requestBody = rawBody ?? JSON.stringify(request);
 	let upstreamStatus;
 	let upstreamHeaders;