@neutrome/open-ai-router 0.5.6 → 0.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neutrome/open-ai-router",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"
@@ -11,8 +11,8 @@
     "hono": "^4.12.18",
     "posthog-node": "^5.41.0",
     "zod": "^4.2.1",
-    "@neutrome/lil-engine": "0.3.1",
-    "@neutrome/lilsdk-ts": "0.3.2"
+    "@neutrome/lil-engine": "0.3.2",
+    "@neutrome/lilsdk-ts": "0.3.3"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/src/app/factory.test.ts

@@ -24,6 +24,79 @@ const config: RouterConfig = {
 };
 
 describe("createRouterApp trace finalization", () => {
+  it("returns routing headers for versioned Google GenAI requests", async () => {
+    const app = createRouterApp({
+      config: {
+        providers: {
+          google: {
+            apiBaseUrl: "https://google.example.test/v1beta/openai",
+            style: "chat-completions",
+            exports: ["*"],
+          },
+        },
+        modelNamespaces: {},
+      },
+      executorImplementations: {},
+      auth: { authenticate: async () => principal() },
+      fetchImpl: vi.fn(async () =>
+        Response.json({
+          id: "chat_1",
+          model: "gemini-2.5-flash-lite",
+          choices: [
+            {
+              index: 0,
+              message: { role: "assistant", content: "hello" },
+              finish_reason: "stop",
+            },
+          ],
+        }),
+      ),
+    });
+
+    const response = await app.fetch(
+      new Request(
+        "http://local/v1beta/models/google%2Fgemini-2.5-flash-lite:generateContent",
+        {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            contents: [{ role: "user", parts: [{ text: "hi" }] }],
+          }),
+        },
+      ),
+      {},
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-openairouter-provider-id")).toBe("google");
+    expect(response.headers.get("x-openairouter-model-id")).toBe(
+      "gemini-2.5-flash-lite",
+    );
+  });
+
+  it("rejects Responses state IDs instead of silently dropping provider state", async () => {
+    const app = createRouterApp({
+      config: { providers: {}, modelNamespaces: {} },
+      executorImplementations: {},
+      auth: { authenticate: async () => principal() },
+    });
+    const response = await app.request("http://local/v1/responses", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        model: "ignored",
+        previous_response_id: "resp_1",
+      }),
+    });
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      error: {
+        code: "unsupported_response_state",
+        type: "invalid_request_error",
+      },
+    });
+  });
+
   it("keeps non-stream trace hooks alive with waitUntil", async () => {
     const waited: Promise<unknown>[] = [];
     const onExecutionSummary = vi.fn(async (_summary: ExecutionSummary) => {});
@@ -148,7 +221,6 @@ describe("createRouterApp trace finalization", () => {
       (span) => span.event,
     );
     expect(events).toContain("admission.authenticate");
-    expect(events).toContain("upstream_auth.collect_incoming");
     expect(events).toContain("upstream_auth.resolve_target");
     expect(events).toContain("provider.stream_first_byte");
     expect(events).toContain("response.stream_first_chunk");

package/src/app/factory.ts

@@ -21,6 +21,8 @@ import type { RequestContext } from "../upstream-auth/types.ts";
 import type { ExecutionRuntimeOptions } from "../router/execution-types.ts";
 import { observeTimedExecution } from "../router/execution-events.ts";
 import { createOpenAiErrorResponse } from "../router/errors.ts";
+import { errorResponse } from "../router/error-codec.ts";
+import { RouterError } from "../router/errors.ts";
 import {
   parseGoogleGenAIRoute,
   rewriteGoogleGenAIRequest,
@@ -67,7 +69,7 @@ export function createRouterApp(options: RouterAppOptions) {
     runAuthorized(c, c.req.raw, "anthropic-messages", handleAnthropicMessages),
   );
 
-  app.post("/v1/models/*", async (c) => {
+  app.post("/:version/models/*", async (c) => {
     const route = parseGoogleGenAIRoute(c.req.raw);
     if (!route) return c.text("Not Found", 404);
     const request = await rewriteGoogleGenAIRequest(c.req.raw, route);
@@ -242,26 +244,20 @@ export function createRouterApp(options: RouterAppOptions) {
       }
     }
 
-    const ctx: RequestContext = {
-      request,
-      incomingAuth: new Map(),
-      env,
-      state: new Map(),
-    };
-    for (const driver of runtime.upstreamAuthChain) {
-      const collectStartedMs = Date.now();
-      driver.collectIncoming?.(ctx);
-      observeTimedExecution({
-        observe,
-        kind: "upstream_auth.collect_incoming",
-        requestId: incomingExecutionId,
-        executionId: incomingExecutionId,
-        startedAtMs: collectStartedMs,
-        finishedAtMs: Date.now(),
-        data: { driver: driver.name },
-      });
+    if (style === "responses" && (await hasPreviousResponseId(request))) {
+      finalizeTrace();
+      return errorResponse(
+        new RouterError(
+          "previous_response_id is not supported because the router does not retain provider response state.",
+          400,
+          "unsupported_response_state",
+        ),
+        style,
+      );
     }
 
+    const ctx: RequestContext = { request, env };
+
     try {
       const handlerStartedMs = Date.now();
       const response = await handler({
@@ -311,3 +307,17 @@ export function createRouterApp(options: RouterAppOptions) {
 
   return app;
 }
+
+async function hasPreviousResponseId(request: Request): Promise<boolean> {
+  try {
+    const body: unknown = await request.clone().json();
+    return !!(
+      body &&
+      typeof body === "object" &&
+      "previous_response_id" in body &&
+      (body as { previous_response_id?: unknown }).previous_response_id
+    );
+  } catch {
+    return false;
+  }
+}

package/src/app/google-genai-route.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { parseGoogleGenAIRoute } from "./google-genai-route.ts";
+
+describe("Google GenAI routes", () => {
+  it("accepts the API version selected by the client SDK", () => {
+    expect(
+      parseGoogleGenAIRoute(
+        new Request(
+          "http://local/v1beta/models/google%2Fgemini-2.5-flash:streamGenerateContent",
+        ),
+      ),
+    ).toEqual({ model: "google/gemini-2.5-flash", stream: true });
+  });
+});

package/src/app/google-genai-route.ts

@@ -5,7 +5,7 @@ export function parseGoogleGenAIRoute(
 ): GoogleGenAIRoute | null {
   const pathname = new URL(request.url).pathname;
   const match = pathname.match(
-    /^\/v1\/models\/(.+):(generateContent|streamGenerateContent)$/,
+    /^\/[^/]+\/models\/(.+):(generateContent|streamGenerateContent)$/,
   );
   if (!match?.[1] || !match[2]) return null;
   try {

package/src/index.ts

@@ -71,7 +71,9 @@ export type {
   RouterConfig,
   RouterExecutionOptions,
   RouterRuntime,
-  UpstreamAuthConfig,
+  ProviderAuthDriverConfig,
+  ProviderEnvAuthDriverConfig,
+  ProviderProxyAuthDriverConfig,
 } from "./router/index.ts";
 export type {
   RemoteMcpClientFactory,
@@ -85,14 +87,5 @@ export {
   wireToolName,
 } from "./router/index.ts";
 
-export type {
-  AuthResult,
-  RequestContext,
-  TargetAuthContext,
-  UpstreamAuthDriver,
-} from "./upstream-auth/types.ts";
-export { buildUpstreamAuthChain } from "./upstream-auth/registry.ts";
-export { envAuthDriver } from "./upstream-auth/env.ts";
-export { proxyAuthDriver } from "./upstream-auth/proxy.ts";
 export { canAccessPrincipalModel } from "./admission/access.ts";
 export type { AuthPrincipal, RuntimeAuthenticator } from "./admission/types.ts";

package/src/router/config.ts

@@ -1,15 +1,31 @@
 import type { ProviderStyle } from "@neutrome/lil-engine";
-import type { UpstreamAuthConfigShape } from "../upstream-auth/config.ts";
-
 export type ProviderApiStyle = ProviderStyle;
 
-export type UpstreamAuthConfig = UpstreamAuthConfigShape;
+export type ProviderEnvAuthDriverConfig = {
+  kind: "env";
+  env: string;
+  header: string;
+  prefix?: string;
+};
+
+export type ProviderProxyAuthDriverConfig = {
+  kind: "proxy";
+  sourceHeader?: string;
+  sourcePrefix?: string;
+  header: string;
+  prefix?: string;
+};
+
+export type ProviderAuthDriverConfig =
+  | ProviderEnvAuthDriverConfig
+  | ProviderProxyAuthDriverConfig;
 
 export type ProviderTargetConfig = {
   apiBaseUrl: string;
   style: ProviderApiStyle;
   exports?: string[];
   headers?: Record<string, string>;
+  auth?: ProviderAuthDriverConfig[];
 };
 
 export type ModelRouteConfig =
@@ -46,7 +62,6 @@ export type RemoteMcpServerConfig = {
 
 export type RouterConfig = {
   modelSuffixes?: string[];
-  upstreamAuth?: UpstreamAuthConfig;
   providers: Record<string, ProviderTargetConfig>;
   modelNamespaces: Record<string, ModelNamespaceConfig>;
   mcps?: Record<string, RemoteMcpServerConfig>;

package/src/router/execute.test.ts

@@ -75,7 +75,7 @@ describe("router execution", () => {
 
     expect(response.status).toBe(200);
     expect(capturedUrl).toBe("https://openrouter.ai/api/v1/chat/completions");
-    expect(capturedAuth).toBe("Bearer incoming");
+    expect(capturedAuth).toBe("");
     expect(capturedBody).toEqual({
       model: "gpt-4o",
       messages: [{ role: "user", content: "hi" }],
@@ -435,8 +435,7 @@ describe("router execution", () => {
       config: {
         providers: {
           google: {
-            apiBaseUrl:
-              "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent",
+            apiBaseUrl: "https://generativelanguage.googleapis.com/v1beta",
             style: "google-genai",
             exports: ["*"],
           },
@@ -772,6 +771,12 @@ describe("router execution", () => {
     });
 
     expect(response.status).toBe(529);
+    expect(response.headers.get("x-openairouter-provider-id")).toBe(
+      "anthropic",
+    );
+    expect(response.headers.get("x-openairouter-model-id")).toBe(
+      "claude-sonnet-4",
+    );
     expect(await response.json()).toEqual({
       error: {
         message: "Provider is overloaded",

package/src/router/execute.ts

@@ -33,6 +33,7 @@ import {
 } from "./upstream-client.ts";
 import { emitProviderUsage, injectStreamUsage } from "./provider-telemetry.ts";
 import {
+  applyRoutingHeaders,
   jsonExecutionResponse,
   streamExecutionResponse,
 } from "./response-delivery.ts";
@@ -195,6 +196,7 @@ async function handleRequestStyle(
   emitResponse: (program: Program) => Uint8Array,
   mutateRequest?: (request: Program) => Program,
 ): Promise<Response> {
+  let resolved: ResolvedTarget | undefined;
   try {
     const baseRequest =
       options.program ??
@@ -202,7 +204,7 @@ async function handleRequestStyle(
     const request = mutateRequest ? mutateRequest(baseRequest) : baseRequest;
     const incomingExecutionId =
       options.incomingExecutionId ?? `incoming_${crypto.randomUUID()}`;
-    const resolved = resolveRequestTarget(options.runtime, request);
+    resolved = resolveRequestTarget(options.runtime, request);
     const remoteMcp = prepareRemoteMcpExecution(
       options.runtime,
       resolved,
@@ -247,7 +249,8 @@ async function handleRequestStyle(
       await remoteMcp.close();
     }
   } catch (error) {
-    return errorResponse(error, style);
+    const response = errorResponse(error, style);
+    return resolved ? applyRoutingHeaders(response, resolved) : response;
   }
 }
 

package/src/router/index.ts

@@ -34,7 +34,9 @@ export type {
   RemoteMcpServerConfig,
   RemoteMcpToolConfig,
   RouterConfig,
-  UpstreamAuthConfig,
+  ProviderAuthDriverConfig,
+  ProviderEnvAuthDriverConfig,
+  ProviderProxyAuthDriverConfig,
 } from "./config.ts";
 export type {
   CreateRouterOptions,

package/src/router/response-delivery.ts

@@ -1,6 +1,7 @@
 import {
   emitProviderError,
   emitProviderStreamChunk,
+  repackStream,
   type Program,
   type ProviderStyle,
 } from "@neutrome/lil-engine";
@@ -20,7 +21,9 @@ export async function streamExecutionResponse(
   input: { requestId: string; executionId: string; startedAtMs: number },
   cleanup?: () => Promise<void>,
 ): Promise<Response> {
-  const iterator = chunks[Symbol.asyncIterator]();
+  const iterator = repackStream(chunks, { target: responseStyle })[
+    Symbol.asyncIterator
+  ]();
 
   const first = await iterator.next();
   observeTimedExecution({
@@ -57,7 +60,7 @@ export async function streamExecutionResponse(
   const stream = new ReadableStream<Uint8Array>({
     start(controller) {
       const bytes = emitProviderStreamChunk(responseStyle, first.value);
-      controller.enqueue(encoder.encode(`data: ${decoder.decode(bytes)}\n\n`));
+      controller.enqueue(encoder.encode(streamEvent(responseStyle, bytes)));
     },
     async pull(controller) {
       if (done) return;
@@ -73,9 +76,7 @@ export async function streamExecutionResponse(
           return;
         }
         const bytes = emitProviderStreamChunk(responseStyle, result.value);
-        controller.enqueue(
-          encoder.encode(`data: ${decoder.decode(bytes)}\n\n`),
-        );
+        controller.enqueue(encoder.encode(streamEvent(responseStyle, bytes)));
       } catch (error) {
         done = true;
         await cleanup?.();
@@ -89,7 +90,7 @@ export async function streamExecutionResponse(
     },
     async cancel() {
       await cleanup?.();
-      await iterator.return?.();
+      await iterator.return?.(undefined);
     },
   });
 
@@ -101,6 +102,14 @@ export async function streamExecutionResponse(
   });
 }
 
+function streamEvent(style: ProviderStyle, bytes: Uint8Array): string {
+  const data = decoder.decode(bytes);
+  if (style !== "anthropic-messages") return `data: ${data}\n\n`;
+  const parsed = JSON.parse(data) as { type?: unknown };
+  if (typeof parsed.type !== "string") return `data: ${data}\n\n`;
+  return `event: ${parsed.type}\ndata: ${data}\n\n`;
+}
+
 export function jsonExecutionResponse(
   body: Uint8Array,
   resolved: ResolvedTarget,
@@ -115,6 +124,16 @@ export function jsonExecutionResponse(
   });
 }
 
+export function applyRoutingHeaders(
+  response: Response,
+  resolved: ResolvedTarget,
+): Response {
+  for (const [name, value] of Object.entries(routingHeaders(resolved))) {
+    response.headers.set(name, value);
+  }
+  return response;
+}
+
 function routingHeaders(resolved: ResolvedTarget): Record<string, string> {
   if (resolved.target.kind === "provider") {
     return {

package/src/router/runtime.ts

@@ -1,6 +1,4 @@
 import type { ExecutionTarget } from "@neutrome/lilsdk-ts";
-import type { UpstreamAuthDriver } from "../upstream-auth/types.ts";
-import { buildUpstreamAuthChain } from "../upstream-auth/registry.ts";
 import { createExportsMatcher } from "../util/glob.ts";
 import type {
   ModelNamespaceConfig,
@@ -16,6 +14,7 @@ export type ProviderRuntime = {
   apiBaseUrl: string;
   endpointPath: string;
   headers: Readonly<Record<string, string>>;
+  auth?: ProviderTargetConfig["auth"];
   exportsMatcher: (model: string) => boolean;
 };
 
@@ -39,7 +38,6 @@ export type RouterRuntime = {
   modelNamespaces: ReadonlyMap<string, ModelNamespaceRuntime>;
   modelNamespaceOrder: readonly string[];
   mcps: ReadonlyMap<string, RemoteMcpServerRuntime>;
-  upstreamAuthChain: readonly UpstreamAuthDriver[];
   modelSuffixes: ReadonlySet<string>;
   fetchImpl: typeof fetch;
 };
@@ -51,7 +49,6 @@ export type RemoteMcpServerRuntime = RemoteMcpServerConfig & {
 export type CreateRouterOptions = {
   config: RouterConfig;
   fetchImpl?: typeof fetch;
-  upstreamAuthDrivers?: readonly UpstreamAuthDriver[];
 };
 
 export function createRouterRuntime(
@@ -84,9 +81,6 @@ export function createRouterRuntime(
     modelNamespaces,
     modelNamespaceOrder,
     mcps,
-    upstreamAuthChain:
-      options.upstreamAuthDrivers ??
-      buildUpstreamAuthChain(options.config.upstreamAuth),
     modelSuffixes: new Set(options.config.modelSuffixes ?? []),
     fetchImpl: options.fetchImpl ?? globalThis.fetch.bind(globalThis),
   };
@@ -159,6 +153,7 @@ function buildProviderRuntime(
     apiBaseUrl: config.apiBaseUrl,
     endpointPath: defaultEndpointPath(config.style),
     headers: config.headers ?? {},
+    auth: config.auth,
     exportsMatcher: createExportsMatcher(config.exports),
   };
 }

package/src/router/upstream-client.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+import { applyProviderAuth, providerUpstreamUrl } from "./upstream-client.ts";
+import type { ProviderRuntime } from "./runtime.ts";
+
+const provider = (
+  overrides: Partial<ProviderRuntime> = {},
+): ProviderRuntime => ({
+  name: "google",
+  style: "google-genai",
+  apiBaseUrl: "https://generativelanguage.googleapis.com/v1beta",
+  endpointPath: "",
+  headers: {},
+  auth: [{ kind: "env", env: "GEMINI_API_KEY", header: "x-goog-api-key" }],
+  exportsMatcher: () => true,
+  ...overrides,
+});
+
+describe("provider upstream configuration", () => {
+  it("uses provider credentials in preference to incoming client credentials", () => {
+    const headers = new Headers({ authorization: "Bearer client" });
+    applyProviderAuth(
+      provider({
+        auth: [
+          {
+            kind: "env",
+            env: "OPENAI_API_KEY",
+            header: "authorization",
+            prefix: "Bearer ",
+          },
+          { kind: "proxy", header: "authorization", sourcePrefix: "Bearer " },
+        ],
+      }),
+      headers,
+      new Headers({ authorization: "Bearer client" }),
+      { OPENAI_API_KEY: "provider" },
+    );
+    expect(headers.get("authorization")).toBe("Bearer provider");
+  });
+
+  it("injects explicitly enabled proxy credentials into the provider header", () => {
+    const headers = new Headers({ authorization: "Bearer test-token" });
+    applyProviderAuth(
+      provider({
+        auth: [
+          {
+            kind: "proxy",
+            sourceHeader: "authorization",
+            sourcePrefix: "Bearer ",
+            header: "x-goog-api-key",
+          },
+        ],
+      }),
+      headers,
+      new Headers({ authorization: "Bearer provider-key" }),
+      {},
+    );
+
+    expect(headers.get("authorization")).toBe("Bearer test-token");
+    expect(headers.get("x-goog-api-key")).toBe("provider-key");
+  });
+
+  it("builds Google generate and SSE stream URLs from the routed model", () => {
+    expect(
+      providerUpstreamUrl(
+        provider(),
+        "gemini-2.5-flash-lite",
+        new TextEncoder().encode('{"stream":false}'),
+      ),
+    ).toBe(
+      "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:generateContent",
+    );
+    expect(
+      providerUpstreamUrl(
+        provider(),
+        "gemini-2.5-flash-lite",
+        new TextEncoder().encode('{"stream":true}'),
+      ),
+    ).toBe(
+      "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-lite:streamGenerateContent?alt=sse",
+    );
+  });
+});

package/src/router/upstream-client.ts

@@ -2,10 +2,7 @@ import type { ProviderInvocationContext } from "./execution-types.ts";
 import { RouterError } from "./errors.ts";
 import { toBody } from "./error-codec.ts";
 import type { ProviderRuntime, RouterRuntime } from "./runtime.ts";
-import type {
-  RequestContext,
-  TargetAuthContext,
-} from "../upstream-auth/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import { cloneForwardHeaders } from "../util/headers.ts";
 import { observeTimedExecution } from "./execution-events.ts";
 
@@ -18,49 +15,90 @@ export async function fetchProvider(
   providerCtx: ProviderInvocationContext,
 ): Promise<Response> {
   const headers = cloneForwardHeaders(ctx.request.headers);
+  headers.delete("authorization");
+  headers.delete("x-api-key");
+  headers.delete("x-goog-api-key");
   headers.set("content-type", "application/json");
   for (const [key, value] of Object.entries(provider.headers)) {
     headers.set(key, value);
   }
 
-  for (const driver of runtime.upstreamAuthChain) {
-    const targetCtx: TargetAuthContext = {
-      ...ctx,
-      providerName: provider.name,
-    };
-    const authStartedMs = Date.now();
-    const auth = await driver.collectTarget(targetCtx);
-    observeTimedExecution({
-      observe: providerCtx.observe,
-      kind: "upstream_auth.resolve_target",
-      requestId: providerCtx.requestId,
-      executionId: providerCtx.executionId,
-      ...(providerCtx.parentExecutionId
-        ? { parentExecutionId: providerCtx.parentExecutionId }
-        : {}),
-      startedAtMs: authStartedMs,
-      finishedAtMs: Date.now(),
-      data: {
-        provider: provider.name,
-        model: providerCtx.target.model,
-        driver: driver.name,
-        source: auth?.source,
-        matched: !!auth,
-      },
-    });
-    if (!auth) {
-      continue;
+  const authStartedMs = Date.now();
+  const authSource = applyProviderAuth(
+    provider,
+    headers,
+    ctx.request.headers,
+    ctx.env,
+  );
+  observeTimedExecution({
+    observe: providerCtx.observe,
+    kind: "upstream_auth.resolve_target",
+    requestId: providerCtx.requestId,
+    executionId: providerCtx.executionId,
+    ...(providerCtx.parentExecutionId
+      ? { parentExecutionId: providerCtx.parentExecutionId }
+      : {}),
+    startedAtMs: authStartedMs,
+    finishedAtMs: Date.now(),
+    data: {
+      provider: provider.name,
+      model: providerCtx.target.model,
+      source: authSource ?? undefined,
+      matched: authSource !== null,
+    },
+  });
+
+  return runtime.fetchImpl(
+    providerUpstreamUrl(provider, providerCtx.target.model, body),
+    {
+      method: "POST",
+      headers,
+      body: toBody(body),
+      signal,
+    },
+  );
+}
+
+export function applyProviderAuth(
+  provider: ProviderRuntime,
+  headers: Headers,
+  incomingHeaders: Headers,
+  env: Record<string, unknown>,
+): "env" | "proxy" | null {
+  for (const driver of provider.auth ?? []) {
+    if (driver.kind === "env") {
+      const value = env[driver.env];
+      if (typeof value !== "string" || !value) continue;
+      headers.set(driver.header, `${driver.prefix ?? ""}${value}`);
+      return "env";
     }
-    new Headers(auth.headers).forEach((value, key) => headers.set(key, value));
-    break;
+
+    const incoming = incomingHeaders.get(
+      driver.sourceHeader ?? "authorization",
+    );
+    if (!incoming) continue;
+    const sourcePrefix = driver.sourcePrefix ?? "";
+    if (sourcePrefix && !incoming.startsWith(sourcePrefix)) continue;
+    headers.set(
+      driver.header,
+      `${driver.prefix ?? ""}${incoming.slice(sourcePrefix.length)}`,
+    );
+    return "proxy";
   }
+  return null;
+}
 
-  return runtime.fetchImpl(`${provider.apiBaseUrl}${provider.endpointPath}`, {
-    method: "POST",
-    headers,
-    body: toBody(body),
-    signal,
-  });
+export function providerUpstreamUrl(
+  provider: ProviderRuntime,
+  model: string,
+  body: Uint8Array,
+): string {
+  if (provider.style !== "google-genai") {
+    return `${provider.apiBaseUrl}${provider.endpointPath}`;
+  }
+  const stream = JSON.parse(new TextDecoder().decode(body)).stream === true;
+  const action = stream ? "streamGenerateContent?alt=sse" : "generateContent";
+  return `${provider.apiBaseUrl}/models/${encodeURIComponent(model)}:${action}`;
 }
 
 export function getProviderOrThrow(

package/src/telemetry/router.ts

@@ -71,12 +71,14 @@ const EventDataSchema = z
   })
   .passthrough();
 
-export function createRouterTelemetry(input: {
-  env?: Record<string, unknown>;
-  distinctId?: string;
-  traceDriver?: TraceTelemetryDriver;
-  errorDriver?: ErrorTelemetryDriver;
-} = {}): RouterTelemetry {
+export function createRouterTelemetry(
+  input: {
+    env?: Record<string, unknown>;
+    distinctId?: string;
+    traceDriver?: TraceTelemetryDriver;
+    errorDriver?: ErrorTelemetryDriver;
+  } = {},
+): RouterTelemetry {
   const drivers = createPosthogTelemetryDrivers({
     apiKey: input.env?.POSTHOG_API_KEY,
     host: input.env?.POSTHOG_HOST,
@@ -97,7 +99,9 @@ export function createRouterTelemetry(input: {
   function observe(event: ExecutionEvent): void {
     const timing = eventTiming(event);
     if (isInvocationStarted(event.kind)) {
-      const active = { summary: createSpan(event, timing.startedAt ?? event.timestamp) };
+      const active = {
+        summary: createSpan(event, timing.startedAt ?? event.timestamp),
+      };
       spans.push(active.summary);
       activeSpans.set(event.executionId, active);
       return;
@@ -107,7 +111,8 @@ export function createRouterTelemetry(input: {
       if (active) {
         active.summary.finishedAt = timing.finishedAt ?? event.timestamp;
         activeSpans.delete(event.executionId);
-        if (active.summary.kind === "provider") providerGenerations.push(active);
+        if (active.summary.kind === "provider")
+          providerGenerations.push(active);
       }
       return;
     }
@@ -138,7 +143,11 @@ export function createRouterTelemetry(input: {
         active.summary.error = message;
         active.summary.finishedAt ??= event.timestamp;
       }
-      recordError({ message, requestId: event.requestId, executionId: event.executionId });
+      recordError({
+        message,
+        requestId: event.requestId,
+        executionId: event.executionId,
+      });
       return;
     }
     if (!timing.startedAt) return;
@@ -163,11 +172,15 @@ export function createRouterTelemetry(input: {
     }
     const generations = [
       ...providerGenerations,
-      ...[...activeSpans.values()].filter(({ summary }) => summary.kind === "provider"),
+      ...[...activeSpans.values()].filter(
+        ({ summary }) => summary.kind === "provider",
+      ),
     ].map(toGeneration);
     activeSpans.clear();
     await reportAll([
-      ...generations.map((generation) => traceDriver?.recordGeneration(generation)),
+      ...generations.map((generation) =>
+        traceDriver?.recordGeneration(generation),
+      ),
       ...[...errors.values()].map((telemetryError) =>
         errorDriver?.recordError(telemetryError),
       ),
@@ -181,8 +194,14 @@ export function createRouterTelemetry(input: {
       startedAt,
       finishedAt,
       spans,
-      totalTokensInput: spans.reduce((total, span) => total + span.tokensInput, 0),
-      totalTokensOutput: spans.reduce((total, span) => total + span.tokensOutput, 0),
+      totalTokensInput: spans.reduce(
+        (total, span) => total + span.tokensInput,
+        0,
+      ),
+      totalTokensOutput: spans.reduce(
+        (total, span) => total + span.tokensOutput,
+        0,
+      ),
       totalCachedTokensInput: spans.reduce(
         (total, span) => total + span.cachedTokensInput,
         0,
@@ -218,13 +237,18 @@ export function createRouterTelemetry(input: {
   }
 }
 
-function createSpan(event: ExecutionEvent, startedAt: string): ExecutionSummarySpan {
+function createSpan(
+  event: ExecutionEvent,
+  startedAt: string,
+): ExecutionSummarySpan {
   return {
     kind: spanKind(event.kind),
     event: event.kind,
     requestId: event.requestId,
     executionId: event.executionId,
-    ...(event.parentExecutionId ? { parentExecutionId: event.parentExecutionId } : {}),
+    ...(event.parentExecutionId
+      ? { parentExecutionId: event.parentExecutionId }
+      : {}),
     ...eventDetails(event),
     startedAt,
     tokensInput: 0,
@@ -271,10 +295,15 @@ function eventDetails(event: ExecutionEvent): Partial<ExecutionSummarySpan> {
     ...optional("model", eventData(event).model),
     ...optional("provider", eventData(event).provider),
     ...optional("toolName", eventData(event).toolName),
-    ...optional("executor", eventData(event).executor ?? eventData(event).executorId),
+    ...optional(
+      "executor",
+      eventData(event).executor ?? eventData(event).executorId,
+    ),
   };
 }
-async function reportAll(reports: Array<Promise<void> | undefined>): Promise<void> {
+async function reportAll(
+  reports: Array<Promise<void> | undefined>,
+): Promise<void> {
   const results = await Promise.allSettled(reports.filter(Boolean));
   for (const result of results) {
     if (result.status === "rejected") {
@@ -286,6 +315,9 @@ function eventData(event: ExecutionEvent): z.infer<typeof EventDataSchema> {
   const parsed = EventDataSchema.safeParse(event.data ?? {});
   return parsed.success ? parsed.data : {};
 }
-function optional<K extends string>(key: K, value: string | undefined): Partial<Record<K, string>> {
+function optional<K extends string>(
+  key: K,
+  value: string | undefined,
+): Partial<Record<K, string>> {
   return value ? ({ [key]: value } as Record<K, string>) : {};
 }

package/src/upstream-auth/types.ts

@@ -5,19 +5,9 @@ export type AuthResult = {
 
 export type RequestContext = {
   request: Request;
-  incomingAuth: Map<string, string>;
   env: Record<string, unknown>;
+  /** @internal Retained only for source compatibility with custom callers. */
+  incomingAuth?: Map<string, string>;
+  /** @internal Retained only for source compatibility with custom callers. */
   state?: Map<string, unknown>;
 };
-
-export type TargetAuthContext = RequestContext & {
-  providerName: string;
-};
-
-export interface UpstreamAuthDriver {
-  name: string;
-  collectIncoming?(ctx: RequestContext): void;
-  collectTarget(
-    ctx: TargetAuthContext,
-  ): Promise<AuthResult | null> | AuthResult | null;
-}

package/src/worker.ts

@@ -7,17 +7,19 @@ import type { RouterConfig } from "./router/index.ts";
 import { createRouterApp } from "./app/factory.ts";
 
 const config: RouterConfig = {
-  upstreamAuth: {
-    order: ["proxy", "env"],
-    proxy: {
-      headers: ["authorization", "x-openairouter-token"],
-    },
-  },
   providers: {
     openrouter: {
       apiBaseUrl: "https://openrouter.ai/api/v1",
       style: "chat-completions",
       exports: ["*:free"],
+      auth: [
+        {
+          kind: "env",
+          env: "OPENROUTER_API_KEY",
+          header: "authorization",
+          prefix: "Bearer ",
+        },
+      ],
     },
   },
   modelNamespaces: {},

package/src/upstream-auth/config.ts

@@ -1,10 +0,0 @@
-export type UpstreamAuthConfigShape = {
-  order?: string[];
-  proxy?: {
-    headers?: string[];
-  };
-  env?: {
-    suffix?: string;
-    prefix?: string;
-  };
-};

package/src/upstream-auth/env.ts

@@ -1,53 +0,0 @@
-import type {
-  AuthResult,
-  TargetAuthContext,
-  UpstreamAuthDriver,
-} from "./types.ts";
-
-export function envAuthDriver(
-  suffix = "_API_KEY",
-  prefix = "",
-): UpstreamAuthDriver {
-  const counters = new Map<string, number>();
-
-  return {
-    name: "env",
-    collectTarget(ctx: TargetAuthContext): AuthResult | null {
-      const base = `${prefix}${ctx.providerName.toUpperCase()}`;
-      const key = resolveKey(ctx.env, base, suffix, counters);
-      if (!key) return null;
-      return {
-        headers: { authorization: `Bearer ${key}` },
-        source: "env",
-      };
-    },
-  };
-}
-
-function resolveKey(
-  env: Record<string, unknown>,
-  base: string,
-  suffix: string,
-  counters: Map<string, number>,
-): string | null {
-  const nValue = env[`${base}${suffix}S_N`];
-  if (nValue) {
-    const n =
-      typeof nValue === "string"
-        ? parseInt(nValue, 10)
-        : typeof nValue === "number"
-          ? nValue
-          : 0;
-    if (n > 0) {
-      const prev = counters.get(base) ?? 0;
-      const index = (prev % n) + 1;
-      counters.set(base, prev + 1);
-      const key = env[`${base}${suffix}_${index}`];
-      if (typeof key === "string" && key) return key;
-    }
-  }
-
-  const single = env[`${base}${suffix}`];
-  if (typeof single === "string" && single) return single;
-  return null;
-}

package/src/upstream-auth/proxy.ts

@@ -1,26 +0,0 @@
-import type {
-  AuthResult,
-  RequestContext,
-  TargetAuthContext,
-  UpstreamAuthDriver,
-} from "./types.ts";
-
-export function proxyAuthDriver(headers: string[]): UpstreamAuthDriver {
-  return {
-    name: "proxy",
-    collectIncoming(ctx: RequestContext) {
-      for (const name of headers) {
-        const value = ctx.request.headers.get(name);
-        if (value) ctx.incomingAuth.set(name.toLowerCase(), value);
-      }
-    },
-    collectTarget(ctx: TargetAuthContext): AuthResult | null {
-      const authHeader = ctx.incomingAuth.get("authorization");
-      if (!authHeader) return null;
-      return {
-        headers: { authorization: authHeader },
-        source: "proxy",
-      };
-    },
-  };
-}

package/src/upstream-auth/registry.ts

@@ -1,27 +0,0 @@
-import type { UpstreamAuthConfigShape } from "./config.ts";
-import type { UpstreamAuthDriver } from "./types.ts";
-import { proxyAuthDriver } from "./proxy.ts";
-import { envAuthDriver } from "./env.ts";
-
-export function buildUpstreamAuthChain(
-  config?: UpstreamAuthConfigShape,
-): UpstreamAuthDriver[] {
-  if (!config) return [proxyAuthDriver(["authorization"]), envAuthDriver()];
-  const order = config.order ?? ["proxy", "env"];
-  const drivers: UpstreamAuthDriver[] = [];
-  for (const name of order) {
-    switch (name) {
-      case "proxy":
-        drivers.push(
-          proxyAuthDriver(config.proxy?.headers ?? ["authorization"]),
-        );
-        break;
-      case "env":
-        drivers.push(
-          envAuthDriver(config.env?.suffix ?? "_API_KEY", config.env?.prefix),
-        );
-        break;
-    }
-  }
-  return drivers;
-}