@neutrome/open-ai-router 0.1.18 → 0.3.0

package/src/router/index.ts

@@ -1,3 +1,6 @@
+export { createAuditEvent, createInMemoryAuditSink } from "./audit.ts";
+export { ExecutionError, isExecutionError } from "./errors.ts";
+export { createExecutionRuntime } from "./execution-runtime.ts";
 export { createRouterRuntime } from "./runtime.ts";
 export {
   createFetchProviderInvoker,
@@ -5,12 +8,14 @@ export {
   handleAnthropicMessages,
   handleChatCompletions,
   handleGoogleGenAI,
+  parseRequestProgram,
   handleResponses,
+  ProviderHttpError,
   resolveRequestTarget,
   RouterError,
-  ProviderHttpError,
 } from "./execute.ts";
 export { listConfiguredModels, resolveInvocationTarget, resolveInvocationTargets } from "./resolve.ts";
+export { executionTargetAuditRef, executionTargetId } from "./targets.ts";
 export {
   createRemoteMcpToolSet,
   createStreamableHttpMcpClient,
@@ -18,23 +23,40 @@ export {
   wireToolName,
 } from "./mcp.ts";
 export type {
-  AuthConfig,
-  ExecutorNamespaceConfig,
-  ExecutorRouteConfig,
+  ModelNamespaceConfig,
+  ModelRouteConfig,
   ProviderApiStyle,
   ProviderTargetConfig,
   RemoteMcpServerConfig,
   RemoteMcpToolConfig,
   RouterConfig,
+  UpstreamAuthConfig,
 } from "./config.ts";
 export type {
   CreateRouterOptions,
-  ExecutorRouteRuntime,
-  ExecutorRuntime,
+  ModelNamespaceRuntime,
+  ModelRouteRuntime,
   ProviderRuntime,
   RemoteMcpServerRuntime,
   RouterRuntime,
 } from "./runtime.ts";
+export type {
+  AuditEvent,
+  AuditEventInput,
+  ExecutionErrorDetails,
+  ExecutionErrorKind,
+  ExecutionErrorStage,
+  ExecutionRuntime,
+  ExecutionRuntimeOptions,
+  ExecutionTarget,
+  Executor,
+  InvokeOptions,
+  ProgramTransform,
+  ProviderInvocationContext,
+  ProviderInvoker,
+  ResolveExecutor,
+  ResolveTarget,
+} from "./execution-types.ts";
 export type {
   HandleAnthropicMessagesOptions,
   HandleChatCompletionsOptions,

package/src/router/mcp.ts

@@ -1,7 +1,7 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-import type { ExecutionContext, Tool } from "@neutrome/lil-engine";
+import type { ExecutorContext, Tool } from "@neutrome/lilsdk-ts";
 import type { RemoteMcpServerRuntime, RouterRuntime } from "./runtime.ts";
 
 export type RemoteMcpToolCallClient = {
@@ -44,7 +44,7 @@ export function createRemoteMcpToolSet(
         name,
         description: snapshot.description || `Remote MCP tool ${server.name}/${snapshot.name}`,
         schema: normalizeSchema(snapshot.inputSchema),
-        async execute(args: Record<string, unknown>, ctx: ExecutionContext) {
+        async execute(args: Record<string, unknown>, ctx: ExecutorContext) {
           const client = await pool.get(server, ctx.signal);
           const result = await client.callTool(snapshot.name, args);
           return stringifyMcpToolResult(result);

package/src/router/resolve.test.ts

@@ -13,12 +13,12 @@ describe("router resolution", () => {
             exports: ["*"],
           },
         },
-        executors: {
+        modelNamespaces: {
           enei: {
             exports: ["enei-*"],
             models: {
-              "enei-1": { executor: "enei-1" },
-              "enei-1-pro": { executor: "enei-1-pro", transforms: ["reasoning:high"] },
+              "enei-1": { executorId: "enei-1" },
+              "enei-1-pro": { executorId: "enei-1-pro", transforms: ["reasoning:high"] },
             },
           },
         },
@@ -30,7 +30,7 @@ describe("router resolution", () => {
     expect(resolved.namespace).toBe("enei");
     expect(resolved.target).toEqual({
       kind: "executor",
-      executor: "enei-1",
+      executorId: "enei-1",
       alias: "enei-1",
       transforms: ["slwin:8"],
     });
@@ -46,7 +46,7 @@ describe("router resolution", () => {
             exports: ["google/*"],
           },
         },
-        executors: {},
+        modelNamespaces: {},
       },
       knownSuffixes: ["slwin", "kvtools"],
     });
@@ -71,7 +71,7 @@ describe("router resolution", () => {
             exports: ["openai/gpt-4.1-mini"],
           },
         },
-        executors: {
+        modelNamespaces: {
           semantyka: {
             exports: ["enei-*"],
             models: {
@@ -103,12 +103,12 @@ describe("router resolution", () => {
             exports: ["*"],
           },
         },
-        executors: {
+        modelNamespaces: {
           enei: {
             exports: ["enei-*"],
             models: {
-              "enei-1": { executor: "enei-1" },
-              "enei-1-pro": { executor: "enei-1-pro" },
+              "enei-1": { executorId: "enei-1" },
+              "enei-1-pro": { executorId: "enei-1-pro" },
             },
           },
         },
@@ -131,7 +131,7 @@ describe("router resolution", () => {
             exports: ["*"],
           },
         },
-        executors: {
+        modelNamespaces: {
           default: {
             exports: ["*"],
             models: {

package/src/router/resolve.ts

@@ -1,4 +1,4 @@
-import type { ExecutionTarget } from "@neutrome/lil-engine";
+import type { ExecutionTarget } from "@neutrome/lilsdk-ts";
 import { parseModelSyntax, type ModelSuffixSpec } from "../util/model-syntax.ts";
 import type { RouterRuntime } from "./runtime.ts";
 
@@ -35,10 +35,10 @@ export function resolveInvocationTargets(
   }
 
   const matches: ResolvedTarget[] = [];
-  for (const namespace of runtime.executorOrder) {
-    const executor = runtime.executors.get(namespace)!;
-    const route = executor.routes.get(parsed.baseModel);
-    if (route && executor.exportsMatcher(parsed.baseModel)) {
+  for (const namespace of runtime.modelNamespaceOrder) {
+    const modelNamespace = runtime.modelNamespaces.get(namespace)!;
+    const route = modelNamespace.routes.get(parsed.baseModel);
+    if (route && modelNamespace.exportsMatcher(parsed.baseModel)) {
       matches.push({
         requestedModel,
         namespace,
@@ -56,10 +56,10 @@ export function resolveInvocationTargets(
 export function listConfiguredModels(runtime: RouterRuntime): string[] {
   const models: string[] = [];
 
-  for (const namespace of runtime.executorOrder) {
-    const executor = runtime.executors.get(namespace)!;
-    for (const alias of executor.routes.keys()) {
-      if (executor.exportsMatcher(alias)) {
+  for (const namespace of runtime.modelNamespaceOrder) {
+    const modelNamespace = runtime.modelNamespaces.get(namespace)!;
+    for (const alias of modelNamespace.routes.keys()) {
+      if (modelNamespace.exportsMatcher(alias)) {
         models.push(`${namespace}/${alias}`);
       }
     }
@@ -76,15 +76,15 @@ function resolveQualified(
   suffixes: ModelSuffixSpec[],
 ): ResolvedTarget[] {
   const provider = runtime.providers.get(namespace);
-  const executor = runtime.executors.get(namespace);
+  const modelNamespace = runtime.modelNamespaces.get(namespace);
 
-  if (provider && executor) {
-    throw new Error(`Ambiguous namespace \`${namespace}\`: both provider and executor are registered`);
+  if (provider && modelNamespace) {
+    throw new Error(`Ambiguous namespace \`${namespace}\`: both provider and model namespace are registered`);
   }
 
-  if (executor) {
-    const route = executor.routes.get(model);
-    if (!route || !executor.exportsMatcher(model)) {
+  if (modelNamespace) {
+    const route = modelNamespace.routes.get(model);
+    if (!route || !modelNamespace.exportsMatcher(model)) {
       return [];
     }
     return [{

package/src/router/runtime.ts

@@ -1,10 +1,10 @@
-import type { ExecutionTarget } from "@neutrome/lil-engine";
-import type { AuthDriver } from "../auth/types.ts";
-import { buildAuthChain } from "../auth/registry.ts";
+import type { ExecutionTarget } from "@neutrome/lilsdk-ts";
+import type { UpstreamAuthDriver } from "../upstream-auth/types.ts";
+import { buildUpstreamAuthChain } from "../upstream-auth/registry.ts";
 import { createExportsMatcher } from "../util/glob.ts";
 import type {
-  ExecutorNamespaceConfig,
-  ExecutorRouteConfig,
+  ModelNamespaceConfig,
+  ModelRouteConfig,
   ProviderTargetConfig,
   RemoteMcpServerConfig,
   RouterConfig,
@@ -19,27 +19,27 @@ export type ProviderRuntime = {
   exportsMatcher: (model: string) => boolean;
 };
 
-export type ExecutorRouteRuntime = {
+export type ModelRouteRuntime = {
   requestedAlias: string;
   target: ExecutionTarget;
   transforms: readonly string[];
   mcps: readonly string[];
 };
 
-export type ExecutorRuntime = {
+export type ModelNamespaceRuntime = {
   name: string;
   exportsMatcher: (model: string) => boolean;
-  routes: ReadonlyMap<string, ExecutorRouteRuntime>;
+  routes: ReadonlyMap<string, ModelRouteRuntime>;
 };
 
 export type RouterRuntime = {
   config: RouterConfig;
   providers: ReadonlyMap<string, ProviderRuntime>;
   providerOrder: readonly string[];
-  executors: ReadonlyMap<string, ExecutorRuntime>;
-  executorOrder: readonly string[];
+  modelNamespaces: ReadonlyMap<string, ModelNamespaceRuntime>;
+  modelNamespaceOrder: readonly string[];
   mcps: ReadonlyMap<string, RemoteMcpServerRuntime>;
-  authChain: readonly AuthDriver[];
+  upstreamAuthChain: readonly UpstreamAuthDriver[];
   knownSuffixes: ReadonlySet<string>;
   fetchImpl: typeof fetch;
 };
@@ -52,24 +52,24 @@ export type CreateRouterOptions = {
   config: RouterConfig;
   fetchImpl?: typeof fetch;
   knownSuffixes?: string[];
-  authDrivers?: readonly AuthDriver[];
+  upstreamAuthDrivers?: readonly UpstreamAuthDriver[];
 };
 
 export function createRouterRuntime(options: CreateRouterOptions): RouterRuntime {
   const providers = new Map<string, ProviderRuntime>();
-  const executors = new Map<string, ExecutorRuntime>();
+  const modelNamespaces = new Map<string, ModelNamespaceRuntime>();
   const mcps = new Map<string, RemoteMcpServerRuntime>();
   const providerOrder: string[] = [];
-  const executorOrder: string[] = [];
+  const modelNamespaceOrder: string[] = [];
 
   for (const [name, config] of Object.entries(options.config.providers)) {
     providerOrder.push(name);
     providers.set(name, buildProviderRuntime(name, config));
   }
 
-  for (const [name, config] of Object.entries(options.config.executors)) {
-    executorOrder.push(name);
-    executors.set(name, buildExecutorRuntime(name, config));
+  for (const [name, config] of Object.entries(options.config.modelNamespaces)) {
+    modelNamespaceOrder.push(name);
+    modelNamespaces.set(name, buildModelNamespaceRuntime(name, config));
   }
   for (const [name, config] of Object.entries(options.config.mcps ?? {})) {
     mcps.set(name, { name, ...config });
@@ -79,10 +79,10 @@ export function createRouterRuntime(options: CreateRouterOptions): RouterRuntime
     config: options.config,
     providers,
     providerOrder,
-    executors,
-    executorOrder,
+    modelNamespaces,
+    modelNamespaceOrder,
     mcps,
-    authChain: options.authDrivers ?? buildAuthChain(options.config.auth),
+    upstreamAuthChain: options.upstreamAuthDrivers ?? buildUpstreamAuthChain(options.config.upstreamAuth),
     knownSuffixes: new Set(options.knownSuffixes ?? ["slwin", "kvtools"]),
     fetchImpl: options.fetchImpl ?? globalThis.fetch.bind(globalThis),
   };
@@ -99,10 +99,10 @@ function buildProviderRuntime(name: string, config: ProviderTargetConfig): Provi
   };
 }
 
-function buildExecutorRuntime(name: string, config: ExecutorNamespaceConfig): ExecutorRuntime {
-  const routes = new Map<string, ExecutorRouteRuntime>();
+function buildModelNamespaceRuntime(name: string, config: ModelNamespaceConfig): ModelNamespaceRuntime {
+  const routes = new Map<string, ModelRouteRuntime>();
   for (const [alias, route] of Object.entries(config.models)) {
-    routes.set(alias, buildExecutorRoute(alias, route));
+    routes.set(alias, buildModelRoute(alias, route));
   }
 
   return {
@@ -112,7 +112,7 @@ function buildExecutorRuntime(name: string, config: ExecutorNamespaceConfig): Ex
   };
 }
 
-function buildExecutorRoute(alias: string, route: ExecutorRouteConfig): ExecutorRouteRuntime {
+function buildModelRoute(alias: string, route: ModelRouteConfig): ModelRouteRuntime {
   if ("provider" in route) {
     return {
       requestedAlias: alias,
@@ -128,12 +128,12 @@ function buildExecutorRoute(alias: string, route: ExecutorRouteConfig): Executor
   }
 
   return {
-      requestedAlias: alias,
-      transforms: route.transforms ?? [],
-      mcps: route.mcps ?? [],
-      target: {
+    requestedAlias: alias,
+    transforms: route.transforms ?? [],
+    mcps: route.mcps ?? [],
+    target: {
       kind: "executor",
-      executor: route.executor,
+      executorId: route.executorId,
       alias: route.alias ?? alias,
       transforms: route.transforms ?? [],
     },

package/src/router/targets.ts

@@ -0,0 +1,17 @@
+import type { ExecutionTarget } from "./execution-types.ts";
+
+export function executionTargetId(target: ExecutionTarget): string {
+  return target.kind === "provider"
+    ? target.provider ? `${target.provider}/${target.model}` : target.model
+    : `${target.executorId}/${target.alias}`;
+}
+
+export function executionTargetAuditRef(target: ExecutionTarget): {
+  kind: "provider" | "executor";
+  id: string;
+} {
+  return {
+    kind: target.kind,
+    id: executionTargetId(target),
+  };
+}

package/src/{auth → upstream-auth}/config.ts

@@ -1,4 +1,4 @@
-export type AuthConfigShape = {
+export type UpstreamAuthConfigShape = {
   order?: string[];
   proxy?: {
     headers?: string[];

package/src/{auth → upstream-auth}/env.ts

@@ -1,6 +1,6 @@
-import type { AuthDriver, TargetAuthContext, AuthResult } from "./types.ts";
+import type { AuthResult, TargetAuthContext, UpstreamAuthDriver } from "./types.ts";
 
-export function envAuthDriver(suffix = "_API_KEY", prefix = ""): AuthDriver {
+export function envAuthDriver(suffix = "_API_KEY", prefix = ""): UpstreamAuthDriver {
   const counters = new Map<string, number>();
 
   return {

package/src/{auth → upstream-auth}/proxy.ts

@@ -1,6 +1,6 @@
-import type { AuthDriver, RequestContext, TargetAuthContext, AuthResult } from "./types.ts";
+import type { AuthResult, RequestContext, TargetAuthContext, UpstreamAuthDriver } from "./types.ts";
 
-export function proxyAuthDriver(headers: string[]): AuthDriver {
+export function proxyAuthDriver(headers: string[]): UpstreamAuthDriver {
   return {
     name: "proxy",
     collectIncoming(ctx: RequestContext) {

package/src/{auth → upstream-auth}/registry.ts

@@ -1,12 +1,12 @@
-import type { AuthConfigShape } from "./config.ts";
-import type { AuthDriver } from "./types.ts";
+import type { UpstreamAuthConfigShape } from "./config.ts";
+import type { UpstreamAuthDriver } from "./types.ts";
 import { proxyAuthDriver } from "./proxy.ts";
 import { envAuthDriver } from "./env.ts";
 
-export function buildAuthChain(config?: AuthConfigShape): AuthDriver[] {
+export function buildUpstreamAuthChain(config?: UpstreamAuthConfigShape): UpstreamAuthDriver[] {
   if (!config) return [proxyAuthDriver(["authorization"]), envAuthDriver()];
   const order = config.order ?? ["proxy", "env"];
-  const drivers: AuthDriver[] = [];
+  const drivers: UpstreamAuthDriver[] = [];
   for (const name of order) {
     switch (name) {
       case "proxy":

package/src/{auth → upstream-auth}/types.ts

@@ -14,7 +14,7 @@ export type TargetAuthContext = RequestContext & {
   providerName: string;
 };
 
-export interface AuthDriver {
+export interface UpstreamAuthDriver {
   name: string;
   collectIncoming?(ctx: RequestContext): void;
   collectTarget(

package/src/worker.ts

@@ -5,7 +5,7 @@ import { createApp } from "./example.ts";
 
 const config: RouterConfig = {
   trace: true,
-  auth: {
+  upstreamAuth: {
     order: ["proxy", "env"],
     proxy: {
       headers: ["authorization", "x-openairouter-token"],
@@ -18,7 +18,7 @@ const config: RouterConfig = {
       exports: ["*:free"],
     },
   },
-  executors: {},
+  modelNamespaces: {},
 };
 
 let appPromise: Promise<ReturnType<typeof createApp>> | undefined;

package/src/auth/apikey.ts

@@ -1,51 +0,0 @@
-export type ApiKeyEntry = {
-  tokenHash: string;
-  allowedModels: string[] | null;
-  allowedNamespaces: string[] | null;
-};
-
-export type ApiKeyAuth = {
-  authenticate(request: Request): Promise<ApiKeyEntry | null>;
-  canAccess(key: ApiKeyEntry, modelId: string): boolean;
-};
-
-export function createApiKeyAuth(keys: readonly ApiKeyEntry[]): ApiKeyAuth {
-  return {
-    async authenticate(request) {
-      const token = readApiToken(request);
-      if (!token) return null;
-      const hash = await sha256Hex(token);
-      return keys.find((k) => k.tokenHash === hash) ?? null;
-    },
-
-    canAccess(key, modelId) {
-      const hasModelRestriction = key.allowedModels && key.allowedModels.length > 0;
-      const hasNamespaceRestriction = key.allowedNamespaces && key.allowedNamespaces.length > 0;
-      if (!hasModelRestriction && !hasNamespaceRestriction) return true;
-      if (hasModelRestriction && key.allowedModels!.includes(modelId)) return true;
-      const ns = modelId.split("/")[0] ?? "";
-      return !!(hasNamespaceRestriction && key.allowedNamespaces!.includes(ns));
-    },
-  };
-}
-
-function readApiToken(request: Request): string | null {
-  const authHeader = request.headers.get("authorization");
-  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
-  if (bearerMatch?.[1]) return bearerMatch[1];
-
-  const headerToken = request.headers.get("x-api-key")
-    ?? request.headers.get("x-goog-api-key");
-  if (headerToken) return headerToken;
-
-  const url = new URL(request.url);
-  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
-}
-
-async function sha256Hex(value: string): Promise<string> {
-  const bytes = new TextEncoder().encode(value);
-  const digest = await crypto.subtle.digest("SHA-256", bytes);
-  return Array.from(new Uint8Array(digest))
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-}