aisubs 0.1.0 → 0.3.0

package/dist/http.js

@@ -1,39 +1,80 @@
-import { createServer } from "node:http";
-import { pipeline } from "node:stream/promises";
+import cors from "@fastify/cors";
+import websocket from "@fastify/websocket";
+import Fastify from "fastify";
+import { timingSafeEqual } from "node:crypto";
 import { Readable } from "node:stream";
-import { errorMessage, isRecord, stringValue, urlHost } from "./utils.js";
-const MAX_BODY_BYTES = 1024 * 1024;
+import { proxyCompatible } from "./compatibility.js";
+import { registerRealtimeProxy } from "./realtime.js";
+import { errorMessage, isRecord, numberValue, stringValue, urlHost } from "./utils.js";
 const MAX_PROXY_BODY_BYTES = 10 * 1024 * 1024;
-function proxyBodyLimit(value = MAX_PROXY_BODY_BYTES) {
+function bodyLimit(value = MAX_PROXY_BODY_BYTES) {
     if (!Number.isSafeInteger(value) || value <= 0) {
         throw new Error("maxProxyBodyBytes must be a positive safe integer");
     }
     return value;
 }
-async function readBody(request, maxBytes) {
-    const contentLength = Number(request.headers["content-length"]);
-    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
-        throw new Error("Request body is too large");
-    }
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buffer.length;
-        if (size > maxBytes)
-            throw new Error("Request body is too large");
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks);
+function sameSecret(actual, expected) {
+    if (!actual)
+        return false;
+    const left = Buffer.from(actual);
+    const right = Buffer.from(expected);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function requestApiKeys(request) {
+    const authorization = request.headers.authorization;
+    const bearer = authorization?.startsWith("Bearer ") ? authorization.slice(7) : undefined;
+    const header = (name) => {
+        const value = request.headers[name];
+        return Array.isArray(value) ? value[0] : value;
+    };
+    const queryKey = new URL(request.url, "http://aisubs.local").searchParams.get("key") ?? undefined;
+    return [bearer, header("x-api-key"), header("x-goog-api-key"), queryKey].filter((value) => value != null);
+}
+export function routeSegments(pathname) {
+    return pathname.split("/").filter(Boolean).map(decodeURIComponent);
+}
+function bodyBuffer(request) {
+    if (request.body == null)
+        return Buffer.alloc(0);
+    if (Buffer.isBuffer(request.body))
+        return request.body;
+    if (typeof request.body === "string")
+        return Buffer.from(request.body);
+    return Buffer.from(JSON.stringify(request.body));
 }
-export async function readJsonBody(request) {
-    const body = await readBody(request, MAX_BODY_BYTES);
-    if (body.length === 0)
+function jsonBody(request) {
+    const body = bodyBuffer(request);
+    if (!body.length)
         return {};
     return JSON.parse(body.toString("utf8"));
 }
-function upstreamHeaders(upstream) {
-    const headers = { "cache-control": "no-store" };
+function requestHeaders(request) {
+    const headers = new Headers();
+    const privateHeaders = new Set([
+        "authorization",
+        "connection",
+        "content-length",
+        "cookie",
+        "host",
+        "origin",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "referer",
+        "te",
+        "trailer",
+        "upgrade",
+        "x-api-key",
+        "x-goog-api-key",
+    ]);
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value != null && !privateHeaders.has(name)) {
+            headers.set(name, Array.isArray(value) ? value.join(", ") : String(value));
+        }
+    }
+    return headers;
+}
+function responseHeaders(upstream) {
+    const headers = new Headers({ "cache-control": "no-store" });
     upstream.headers.forEach((value, name) => {
         if (![
             "cache-control",
@@ -44,127 +85,143 @@ function upstreamHeaders(upstream) {
             "set-cookie",
             "transfer-encoding",
         ].includes(name)) {
-            headers[name] = value;
+            headers.set(name, value);
         }
     });
     return headers;
 }
-async function sendUpstream(response, upstream) {
-    response.writeHead(upstream.status, upstreamHeaders(upstream));
-    if (upstream.body)
-        await pipeline(Readable.fromWeb(upstream.body), response);
-    else
-        response.end();
-}
-export async function readProxyBody(request, maxBytes = MAX_PROXY_BODY_BYTES) {
-    return readBody(request, proxyBodyLimit(maxBytes));
+export async function sendWebResponse(reply, upstream) {
+    reply.code(upstream.status);
+    responseHeaders(upstream).forEach((value, name) => reply.header(name, value));
+    if (!upstream.body) {
+        await reply.send();
+        return;
+    }
+    await reply.send(Readable.fromWeb(upstream.body));
 }
-export function sendJson(response, status, body, headers = {}) {
-    response.writeHead(status, {
-        "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store",
-        ...headers,
+function jsonResponse(body, status = 200, headers = {}) {
+    return Response.json(body, {
+        status,
+        headers: { "cache-control": "no-store", ...Object.fromEntries(new Headers(headers)) },
     });
-    response.end(JSON.stringify(body));
 }
-export function routeSegments(pathname) {
-    return pathname.split("/").filter(Boolean).map(decodeURIComponent);
+function accountPath(parts) {
+    if (parts[0] !== "aisubs" || !parts[1] || !parts[2])
+        return null;
+    const upstream = parts.slice(3);
+    const versioned = upstream[0] === "v1";
+    if (versioned)
+        upstream.shift();
+    return {
+        provider: parts[1],
+        account: parts[2],
+        path: upstream.map(encodeURIComponent).join("/"),
+        versioned,
+    };
 }
-export async function handleSubscriptionAuthApi(auth, request, response, url, maxProxyBodyBytes = MAX_PROXY_BODY_BYTES) {
+function openAiModel(provider, model) {
+    return {
+        id: model.id,
+        object: "model",
+        owned_by: provider,
+        capabilities: {
+            endpoints: model.endpoints ?? [],
+            input_modalities: model.inputModalities ?? ["text"],
+            reasoning_efforts: model.reasoningEfforts ?? [],
+            tools: model.supportsToolCall ?? false,
+        },
+    };
+}
+export async function handleSubscriptionAuthApi(auth, request, signal) {
+    const url = new URL(request.url, "http://aisubs.local");
     const parts = routeSegments(url.pathname);
-    if (parts[0] === "aisubs" && parts[1] && parts[2] && request.method !== "OPTIONS") {
-        const headers = new Headers();
-        const privateHeaders = new Set([
-            "authorization",
-            "connection",
-            "content-length",
-            "cookie",
-            "host",
-            "origin",
-            "proxy-authenticate",
-            "proxy-authorization",
-            "referer",
-            "te",
-            "trailer",
-            "upgrade",
-            "x-api-key",
-        ]);
-        for (const [name, value] of Object.entries(request.headers)) {
-            if (value != null && !privateHeaders.has(name)) {
-                headers.set(name, Array.isArray(value) ? value.join(", ") : value);
-            }
+    const account = accountPath(parts);
+    if (account && request.method !== "OPTIONS") {
+        if (account.versioned && request.method === "GET" && account.path === "models") {
+            const catalog = await auth.getModels(account.provider, account.account);
+            return jsonResponse({
+                object: "list",
+                data: (catalog?.models ?? []).map((model) => openAiModel(account.provider, model)),
+            });
+        }
+        if (account.versioned && request.method === "GET" && account.path.startsWith("models/")) {
+            const id = decodeURIComponent(account.path.slice("models/".length));
+            const catalog = await auth.getModels(account.provider, account.account);
+            const model = catalog?.models.find((candidate) => candidate.id === id);
+            return model
+                ? jsonResponse(openAiModel(account.provider, model))
+                : jsonResponse({
+                    error: {
+                        message: `Model not found: ${id}`,
+                        type: "invalid_request_error",
+                        code: "model_not_found",
+                    },
+                }, 404);
         }
-        const body = await readProxyBody(request, maxProxyBodyBytes);
-        const path = parts.slice(3).map(encodeURIComponent).join("/") + url.search;
-        const upstream = await auth.proxy(parts[1], parts[2], path, {
+        const headers = requestHeaders(request);
+        const body = bodyBuffer(request);
+        url.searchParams.delete("key");
+        const path = `${account.path}${url.search}`;
+        if (account.versioned && request.method === "POST") {
+            const compatible = await proxyCompatible(auth, account.provider, account.account, path, body, headers, signal);
+            if (compatible)
+                return compatible;
+        }
+        return auth.proxy(account.provider, account.account, path, {
             method: request.method,
             headers,
             body: body.length ? body : undefined,
+            signal,
         });
-        await sendUpstream(response, upstream);
-        return true;
     }
     if (request.method === "GET" && parts.join("/") === "v1/providers") {
-        sendJson(response, 200, { providers: auth.listProviders() });
-        return true;
+        return jsonResponse({ providers: auth.listProviders() });
     }
     if (request.method === "GET" && parts.join("/") === "v1/auth") {
-        sendJson(response, 200, { sessions: await auth.statuses() });
-        return true;
+        return jsonResponse({ sessions: await auth.statuses() });
     }
     if (parts[0] === "v1" && parts[1] === "auth" && parts[2]) {
         const provider = parts[2];
         if (request.method === "GET" && parts.length === 3) {
-            sendJson(response, 200, await auth.status(provider, {
+            return jsonResponse(await auth.status(provider, {
                 account: url.searchParams.get("account") ?? undefined,
                 validate: url.searchParams.get("validate") === "true",
             }));
-            return true;
         }
         if (request.method === "GET" && parts[3] === "accounts") {
-            sendJson(response, 200, { accounts: await auth.listAccounts(provider) });
-            return true;
+            return jsonResponse({ accounts: await auth.listAccounts(provider) });
         }
         if (request.method === "GET" && parts[3] === "details") {
-            sendJson(response, 200, await auth.credentialSummary(provider, url.searchParams.get("account") ?? undefined));
-            return true;
+            return jsonResponse(await auth.credentialSummary(provider, url.searchParams.get("account") ?? undefined));
         }
         if (request.method === "POST" && parts[3] === "login") {
-            const body = await readJsonBody(request);
+            const body = jsonBody(request);
             const attempt = await auth.signIn(provider, isRecord(body) ? body : undefined);
-            sendJson(response, 202, {
+            return jsonResponse({
                 id: attempt.id,
                 provider: attempt.provider,
                 accountKey: attempt.accountKey,
                 state: attempt.state,
                 prompt: attempt.prompt,
-            });
-            return true;
+            }, 202);
         }
         if (request.method === "DELETE" && parts.length === 3) {
             const accountKey = url.searchParams.get("account") ?? "default";
             await auth.signOut(provider, accountKey);
-            sendJson(response, 200, { provider, accountKey, authenticated: false });
-            return true;
+            return jsonResponse({ provider, accountKey, authenticated: false });
         }
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "logins" && parts[2]) {
         const attempt = auth.getLoginAttempt(parts[2]);
-        if (attempt)
-            sendJson(response, 200, attempt);
-        else
-            sendJson(response, 404, { error: "Login not found" });
-        return true;
+        return attempt ? jsonResponse(attempt) : jsonResponse({ error: "Login not found" }, 404);
     }
     if (request.method === "DELETE" && parts[0] === "v1" && parts[1] === "logins" && parts[2]) {
-        if (auth.cancelLoginAttempt(parts[2]))
-            sendJson(response, 200, { cancelled: true });
-        else
-            sendJson(response, 404, { error: "Pending login not found" });
-        return true;
+        return auth.cancelLoginAttempt(parts[2])
+            ? jsonResponse({ cancelled: true })
+            : jsonResponse({ error: "Pending login not found" }, 404);
     }
     if (request.method === "POST" && parts[0] === "v1" && parts[1] === "fetch" && parts[2]) {
-        const body = await readJsonBody(request);
+        const body = jsonBody(request);
         if (!isRecord(body))
             throw new Error("Fetch body requires an absolute url");
         const targetUrl = stringValue(body.url);
@@ -185,79 +242,130 @@ export async function handleSubscriptionAuthApi(auth, request, response, url, ma
             if (!headers.has("content-type"))
                 headers.set("content-type", "application/json");
         }
-        const upstream = await auth.fetch(parts[2], targetUrl, {
+        return auth.fetch(parts[2], targetUrl, {
             method: stringValue(body.method) ?? (requestBody ? "POST" : "GET"),
             headers,
             body: requestBody,
+            signal,
         }, stringValue(body.account));
-        await sendUpstream(response, upstream);
-        return true;
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "usage" && parts[2]) {
-        const usage = await auth.getUsage(parts[2], url.searchParams.get("account") ?? undefined);
-        if (usage)
-            sendJson(response, 200, usage);
-        else
-            sendJson(response, 404, { error: "Usage is not supported by this provider" });
-        return true;
+        const usage = await auth.getUsage(parts[2], url.searchParams.get("account") ?? undefined, signal);
+        return usage
+            ? jsonResponse(usage)
+            : jsonResponse({ error: "Usage is not supported by this provider" }, 404);
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "models" && parts[2]) {
-        const models = await auth.getModels(parts[2], url.searchParams.get("account") ?? undefined);
-        if (models)
-            sendJson(response, 200, models);
-        else
-            sendJson(response, 404, { error: "Models are not supported by this provider" });
-        return true;
+        const models = await auth.getModels(parts[2], url.searchParams.get("account") ?? undefined, signal);
+        return models
+            ? jsonResponse(models)
+            : jsonResponse({ error: "Models are not supported by this provider" }, 404);
     }
-    return false;
+    return null;
 }
-export async function createSubscriptionAuthServer(options) {
+/** Abort upstream work only when the client disconnects before the response finishes. */
+export function clientAbortSignal(request, reply) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!reply.raw.writableFinished && !controller.signal.aborted)
+            controller.abort();
+    };
+    const cleanup = () => {
+        request.raw.off("aborted", abort);
+        reply.raw.off("close", abort);
+    };
+    request.raw.once("aborted", abort);
+    reply.raw.once("close", abort);
+    reply.raw.once("finish", cleanup);
+    if (request.raw.aborted || (reply.raw.destroyed && !reply.raw.writableFinished))
+        abort();
+    return controller.signal;
+}
+export function createApiApp(options) {
     if (!options.apiKey)
         throw new Error("A non-empty API key is required");
-    const maxProxyBodyBytes = proxyBodyLimit(options.maxProxyBodyBytes);
-    const host = options.host ?? "127.0.0.1";
-    if (host !== "127.0.0.1" && host !== "::1" && host !== "localhost") {
-        throw new Error("The built-in auth server may only bind to localhost");
-    }
-    const origin = `http://${urlHost(host)}`;
-    const server = createServer(async (request, response) => {
-        try {
-            const url = new URL(request.url ?? "/", origin);
-            if (url.pathname === "/health")
-                return sendJson(response, 200, { ok: true });
-            const headerKey = Array.isArray(request.headers["x-api-key"])
-                ? request.headers["x-api-key"][0]
-                : request.headers["x-api-key"];
-            if (request.headers.authorization !== `Bearer ${options.apiKey}` &&
-                headerKey !== options.apiKey) {
-                return sendJson(response, 401, { error: "Unauthorized" });
-            }
-            if (!(await handleSubscriptionAuthApi(options.auth, request, response, url, maxProxyBodyBytes))) {
-                sendJson(response, 404, { error: "Not found" });
-            }
+    const app = Fastify({
+        bodyLimit: bodyLimit(options.maxProxyBodyBytes),
+        forceCloseConnections: true,
+    });
+    app.removeAllContentTypeParsers();
+    app.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => done(null, body));
+    void app.register(cors, {
+        origin: true,
+        credentials: false,
+        methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+        allowedHeaders: [
+            "authorization",
+            "content-type",
+            "x-api-key",
+            "x-goog-api-key",
+            "anthropic-version",
+            "anthropic-beta",
+            "openai-beta",
+        ],
+        exposedHeaders: ["x-request-id", "retry-after"],
+    });
+    void app.register(websocket);
+    app.get("/health", async () => ({ ok: true }));
+    app.addHook("onRequest", async (request, reply) => {
+        if (request.url === "/health")
+            return;
+        if (!requestApiKeys(request).some((value) => sameSecret(value, options.apiKey))) {
+            await reply.code(401).send({
+                error: { message: "Unauthorized", type: "authentication_error", code: "invalid_api_key" },
+            });
         }
-        catch (error) {
-            if (response.headersSent)
-                response.destroy();
+    });
+    void app.register(async (scope) => {
+        registerRealtimeProxy(scope, options.auth, (request) => requestApiKeys(request).some((value) => sameSecret(value, options.apiKey)));
+    });
+    app.route({
+        method: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+        url: "/*",
+        async handler(request, reply) {
+            const response = await handleSubscriptionAuthApi(options.auth, request, clientAbortSignal(request, reply));
+            if (response)
+                await sendWebResponse(reply, response);
             else
-                sendJson(response, 400, { error: errorMessage(error) });
-        }
+                await reply.code(404).send({
+                    error: { message: "Not found", type: "invalid_request_error", code: "not_found" },
+                });
+        },
     });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(options.port ?? 0, host, () => {
-            server.off("error", reject);
-            resolve();
-        });
+    app.setErrorHandler(async (error, request, reply) => {
+        const statusCode = isRecord(error) ? numberValue(error.statusCode) : undefined;
+        const status = statusCode && statusCode >= 400 ? statusCode : 400;
+        const code = isRecord(error) ? stringValue(error.code) : undefined;
+        const openAi = request.url.startsWith("/aisubs/");
+        await reply.code(status).send(openAi
+            ? {
+                error: {
+                    message: errorMessage(error),
+                    type: "invalid_request_error",
+                    code: code ?? "invalid_request_error",
+                },
+            }
+            : { error: errorMessage(error) });
     });
-    const address = server.address();
+    return app;
+}
+export async function createSubscriptionAuthServer(options) {
+    const host = options.host ?? "127.0.0.1";
+    if (host !== "127.0.0.1" && host !== "::1" && host !== "localhost") {
+        throw new Error("The built-in auth server may only bind to localhost");
+    }
+    const app = createApiApp(options);
+    await app.listen({ port: options.port ?? 0, host });
+    const address = app.server.address();
     if (!address || typeof address === "string") {
+        await app.close();
         throw new Error("Unable to determine auth server port");
     }
     return {
-        server,
+        server: app.server,
+        app,
         apiKey: options.apiKey,
-        url: `${origin}:${address.port}`,
-        close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))),
+        url: `http://${urlHost(host)}:${address.port}`,
+        close: () => app.close(),
     };
 }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { createSubscriptionAuth, DEFAULT_ACCOUNT, SubscriptionAuth, type SubscriptionAccount, type SubscriptionAuthOptions, } from "./auth.js";
-export { defaultAiSubsDataDir, FileCredentialStore, MemoryCredentialStore } from "./store.js";
+export { defaultAiSubsDataDir, FileApiKeyStore, FileCredentialStore, MemoryCredentialStore, } from "./store.js";
 export { chatGptProvider, type ChatGptProviderOptions } from "./providers/chatgpt.js";
 export { claudeProvider, type ClaudeProviderOptions } from "./providers/claude.js";
 export { copilotProvider, type CopilotProviderOptions } from "./providers/copilot.js";

package/dist/index.js

@@ -1,5 +1,5 @@
 export { createSubscriptionAuth, DEFAULT_ACCOUNT, SubscriptionAuth, } from "./auth.js";
-export { defaultAiSubsDataDir, FileCredentialStore, MemoryCredentialStore } from "./store.js";
+export { defaultAiSubsDataDir, FileApiKeyStore, FileCredentialStore, MemoryCredentialStore, } from "./store.js";
 export { chatGptProvider } from "./providers/chatgpt.js";
 export { claudeProvider } from "./providers/claude.js";
 export { copilotProvider } from "./providers/copilot.js";

package/dist/providers/chatgpt.js

@@ -92,6 +92,8 @@ function normalizeModel(value) {
         maxOutputTokens: numberValue(value.max_output_tokens),
         reasoningEfforts: levels.length ? levels : stringArray(value.supported_reasoning_efforts),
         inputModalities: stringArray(value.input_modalities),
+        endpoints: ["responses"],
+        supportsToolCall: value.supports_tool_calls === false || value.supports_tools === false ? false : true,
         available: visibility !== "hide" && value.supported_in_api !== false,
         priority: numberValue(value.priority) ?? Number.MAX_SAFE_INTEGER,
     };

package/dist/providers/claude.js

@@ -273,7 +273,9 @@ export function claudeProvider(options = {}) {
                             description: stringValue(value.description),
                             contextWindow: numberValue(value.context_window),
                             maxOutputTokens: numberValue(value.max_output_tokens),
+                            inputModalities: ["text", "image", "document"],
                             endpoints: ["messages"],
+                            supportsToolCall: true,
                             available: true,
                             selectable: true,
                         },

package/dist/providers/copilot.js

@@ -122,8 +122,6 @@ function normalizeModel(value) {
     const capabilities = isRecord(value.capabilities) ? value.capabilities : {};
     const limits = isRecord(capabilities.limits) ? capabilities.limits : {};
     const supports = isRecord(capabilities.supports) ? capabilities.supports : {};
-    if (supports.tool_calls === false)
-        return null;
     const modalities = ["text"];
     if (supports.vision === true || isRecord(limits.vision))
         modalities.push("image");

package/dist/realtime.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyInstance, FastifyRequest } from "fastify";
+import type { SubscriptionAuth } from "./auth.js";
+type RealtimeAuth = (request: FastifyRequest) => boolean | Promise<boolean>;
+/** Register a native Realtime WebSocket tunnel for providers that expose one. */
+export declare function registerRealtimeProxy(app: FastifyInstance, auth: SubscriptionAuth, authenticate: RealtimeAuth): void;
+export {};