@neutrome/open-ai-router 0.1.6 → 0.1.8

package/package.json

@@ -1,26 +1,26 @@
 {
   "name": "@neutrome/open-ai-router",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"
   },
-  "scripts": {
-    "cf-typegen": "wrangler types",
-    "test": "vitest run",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "dev": "wrangler dev",
-    "preview": "wrangler preview",
-    "deploy": "wrangler deploy"
-  },
   "dependencies": {
-    "@neutrome/lil-engine": "0.1.2",
-    "hono": "^4.12.18"
+    "hono": "^4.12.18",
+    "@neutrome/lil-engine": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
     "typescript": "^6.0.3",
     "vitest": "^4.1.6",
     "wrangler": "^4.91.0"
+  },
+  "scripts": {
+    "cf-typegen": "wrangler types",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "dev": "wrangler dev",
+    "preview": "wrangler preview",
+    "deploy": "wrangler deploy"
   }
-}
+}

package/src/app/factory.ts

@@ -0,0 +1,186 @@
+import { Hono, type Context } from "hono";
+import type { Executor, ProgramTransform } from "@neutrome/lil-engine";
+import type { ExecutionRuntimeOptions } from "@neutrome/lil-engine";
+import { cors } from "./cors.ts";
+import { healthHandler } from "./health.ts";
+import {
+  createRouterRuntime,
+  handleAnthropicMessages,
+  handleChatCompletions,
+  handleGoogleGenAI,
+  handleResponses,
+  listConfiguredModels,
+  type RouterRuntime,
+} from "../router/index.ts";
+import type { RequestContext } from "../auth/types.ts";
+import type { RouterConfig } from "../router/config.ts";
+import type { UsageReport } from "../router/execute.ts";
+
+export type RouterAppAuth = {
+  authenticate(request: Request, env: Record<string, unknown>): Promise<object | null>;
+  canAccess(principal: object, modelId: string): boolean;
+};
+
+export type RouterAppHooks = {
+  beforeRequest?(ctx: { request: Request; model: string | null; env: Record<string, unknown> }): Promise<Response | void>;
+  onUsage?(report: UsageReport, env: Record<string, unknown>): void;
+  onToolCall?(report: { toolName: string }, env: Record<string, unknown>): void;
+};
+
+export type RouterAppOptions = {
+  config: RouterConfig;
+  executors: Readonly<Record<string, Executor>>;
+  transforms?: Readonly<Record<string, ProgramTransform>>;
+  auth: RouterAppAuth;
+  hooks?: RouterAppHooks;
+  fetchImpl?: typeof fetch;
+  knownSuffixes?: string[];
+  observe?: ExecutionRuntimeOptions["observe"];
+  requestIdFactory?: ExecutionRuntimeOptions["requestIdFactory"];
+  executionIdFactory?: ExecutionRuntimeOptions["executionIdFactory"];
+  upstreamTimeoutMs?: number;
+};
+
+export function createRouterApp(options: RouterAppOptions) {
+  const runtime = createRouterRuntime({
+    config: options.config,
+    ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+    ...(options.knownSuffixes ? { knownSuffixes: options.knownSuffixes } : {}),
+  });
+
+  const app = new Hono();
+
+  app.use("/v1/*", cors());
+  app.get("/health", healthHandler());
+
+  app.get("/v1/models", async (c) => {
+    const env = honoEnv(c);
+    const principal = await options.auth.authenticate(c.req.raw, env);
+    if (!principal) return unauthorized();
+
+    const models = listConfiguredModels(runtime)
+      .filter((id) => options.auth.canAccess(principal, id))
+      .map((id) => ({
+        id,
+        object: "model" as const,
+        created: 0,
+        owned_by: id.split("/")[0] || "unknown",
+      }));
+    return c.json({ object: "list", data: models });
+  });
+
+  app.post("/v1/chat/completions", (c) => runAuthorized(c, c.req.raw, handleChatCompletions));
+  app.post("/v1/responses", (c) => runAuthorized(c, c.req.raw, handleResponses));
+  app.post("/v1/messages", (c) => runAuthorized(c, c.req.raw, handleAnthropicMessages));
+
+  app.post("/v1/models/*", async (c) => {
+    const route = parseGoogleGenAIRoute(c.req.raw);
+    if (!route) return c.text("Not Found", 404);
+    const request = await rewriteGoogleGenAIRequest(c.req.raw, route);
+    return runAuthorized(c, request, handleGoogleGenAI, route.stream);
+  });
+
+  app.all("*", (c) => c.text("Not Found", 404));
+
+  async function runAuthorized(
+    c: Context,
+    request: Request,
+    handler: (opts: any) => Promise<Response>,
+    forceStreaming?: boolean,
+  ): Promise<Response> {
+    const env = honoEnv(c);
+    const principal = await options.auth.authenticate(request, env);
+    if (!principal) return unauthorized();
+
+    const model = await readModel(request.clone());
+    if (model && !options.auth.canAccess(principal, model)) {
+      return errorResponse(`Model \`${model}\` does not exist or you do not have access.`, 404, "model_not_found");
+    }
+
+    if (options.hooks?.beforeRequest) {
+      const hookResponse = await options.hooks.beforeRequest({ request, model, env });
+      if (hookResponse) return hookResponse;
+    }
+
+    const ctx: RequestContext = {
+      request,
+      incomingAuth: new Map(),
+      env,
+      state: new Map(),
+    };
+    for (const driver of runtime.authChain) {
+      driver.collectIncoming?.(ctx);
+    }
+
+    const onUsage = options.hooks?.onUsage
+      ? (report: UsageReport) => options.hooks!.onUsage!(report, env)
+      : undefined;
+
+    return handler({
+      runtime,
+      ctx,
+      executors: options.executors,
+      ...(options.transforms ? { transforms: options.transforms } : {}),
+      ...(options.observe ? { observe: options.observe } : {}),
+      ...(options.upstreamTimeoutMs !== undefined ? { upstreamTimeoutMs: options.upstreamTimeoutMs } : {}),
+      ...(onUsage ? { onUsage } : {}),
+      ...(forceStreaming ? { forceStreaming: true } : {}),
+    });
+  }
+
+  return app;
+}
+
+function honoEnv(c: Context): Record<string, unknown> {
+  return (c.env ?? {}) as Record<string, unknown>;
+}
+
+function parseGoogleGenAIRoute(request: Request): { model: string; stream: boolean } | null {
+  const pathname = new URL(request.url).pathname;
+  const match = pathname.match(/^\/v1\/models\/(.+):(generateContent|streamGenerateContent)$/);
+  if (!match?.[1] || !match[2]) return null;
+  try {
+    return { model: decodeURIComponent(match[1]), stream: match[2] === "streamGenerateContent" };
+  } catch {
+    return null;
+  }
+}
+
+async function rewriteGoogleGenAIRequest(
+  request: Request,
+  route: { model: string; stream: boolean },
+): Promise<Request> {
+  const bodyText = await request.text();
+  const headers = new Headers(request.headers);
+  try {
+    const raw = JSON.parse(bodyText) as Record<string, unknown>;
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+      return new Request(request.url, {
+        method: request.method,
+        headers,
+        body: JSON.stringify({ ...raw, model: route.model, ...(route.stream ? { stream: true } : {}) }),
+      });
+    }
+  } catch {}
+  return new Request(request.url, { method: request.method, headers, body: bodyText });
+}
+
+async function readModel(request: Request): Promise<string | null> {
+  try {
+    const body = (await request.json()) as { model?: unknown };
+    return typeof body.model === "string" ? body.model : null;
+  } catch {
+    return null;
+  }
+}
+
+function unauthorized(): Response {
+  return errorResponse("Authentication required", 401, "auth_required");
+}
+
+function errorResponse(message: string, status: number, code: string): Response {
+  return new Response(
+    JSON.stringify({ error: { message, type: "invalid_request_error", param: null, code } }),
+    { status, headers: { "content-type": "application/json; charset=utf-8" } },
+  );
+}

package/src/auth/apikey.ts

@@ -0,0 +1,51 @@
+export type ApiKeyEntry = {
+  tokenHash: string;
+  allowedModels: string[] | null;
+  allowedNamespaces: string[] | null;
+};
+
+export type ApiKeyAuth = {
+  authenticate(request: Request): Promise<ApiKeyEntry | null>;
+  canAccess(key: ApiKeyEntry, modelId: string): boolean;
+};
+
+export function createApiKeyAuth(keys: readonly ApiKeyEntry[]): ApiKeyAuth {
+  return {
+    async authenticate(request) {
+      const token = readApiToken(request);
+      if (!token) return null;
+      const hash = await sha256Hex(token);
+      return keys.find((k) => k.tokenHash === hash) ?? null;
+    },
+
+    canAccess(key, modelId) {
+      const hasModelRestriction = key.allowedModels && key.allowedModels.length > 0;
+      const hasNamespaceRestriction = key.allowedNamespaces && key.allowedNamespaces.length > 0;
+      if (!hasModelRestriction && !hasNamespaceRestriction) return true;
+      if (hasModelRestriction && key.allowedModels!.includes(modelId)) return true;
+      const ns = modelId.split("/")[0] ?? "";
+      return !!(hasNamespaceRestriction && key.allowedNamespaces!.includes(ns));
+    },
+  };
+}
+
+function readApiToken(request: Request): string | null {
+  const authHeader = request.headers.get("authorization");
+  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
+  if (bearerMatch?.[1]) return bearerMatch[1];
+
+  const headerToken = request.headers.get("x-api-key")
+    ?? request.headers.get("x-goog-api-key");
+  if (headerToken) return headerToken;
+
+  const url = new URL(request.url);
+  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
+}
+
+async function sha256Hex(value: string): Promise<string> {
+  const bytes = new TextEncoder().encode(value);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}

package/src/index.ts

@@ -1,3 +1,6 @@
+export { createRouterApp } from "./app/factory.ts";
+export type { RouterAppAuth, RouterAppHooks, RouterAppOptions } from "./app/factory.ts";
+
 export { createApp } from "./example.ts";
 export type { CreateAppOptions } from "./example.ts";
 
@@ -47,6 +50,8 @@ export type {
 export { buildAuthChain } from "./auth/registry.ts";
 export { envAuthDriver } from "./auth/env.ts";
 export { proxyAuthDriver } from "./auth/proxy.ts";
+export { createApiKeyAuth } from "./auth/apikey.ts";
+export type { ApiKeyAuth, ApiKeyEntry } from "./auth/apikey.ts";
 
 export { cors } from "./app/cors.ts";
 export { healthHandler } from "./app/health.ts";

package/src/worker.ts

@@ -1,3 +1,5 @@
+type ExecutionContext = { waitUntil(p: Promise<unknown>): void; passThroughOnException(): void };
+
 import type { RouterConfig } from "./router/index.ts";
 import { createApp } from "./example.ts";
 

package/tsconfig.json

@@ -1,9 +1,21 @@
 {
-  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "types": ["node", "./worker-configuration.d.ts", "vitest/globals"],
-    "outDir": "dist"
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM", "DOM.Iterable", "WebWorker"],
+    "strict": true,
+    "allowImportingTsExtensions": true,
+    "allowArbitraryExtensions": true,
+    "rewriteRelativeImportExtensions": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "skipLibCheck": true,
+    "declaration": true,
+    "sourceMap": true,
+    "noEmit": true,
+    "types": ["node", "vitest/globals"]
   },
   "include": ["src/**/*.ts", "src/**/*.d.ts"],
-  "exclude": ["test", "dist", "node_modules"],
+  "exclude": ["test", "dist", "node_modules"]
 }