aisubs 0.2.0 → 0.3.1

package/dist/http.js

@@ -1,39 +1,80 @@
-import { createServer } from "node:http";
-import { pipeline } from "node:stream/promises";
+import cors from "@fastify/cors";
+import websocket from "@fastify/websocket";
+import Fastify from "fastify";
+import { timingSafeEqual } from "node:crypto";
 import { Readable } from "node:stream";
-import { errorMessage, isRecord, stringValue, urlHost } from "./utils.js";
-const MAX_BODY_BYTES = 1024 * 1024;
+import { proxyCompatible } from "./compatibility.js";
+import { registerRealtimeProxy } from "./realtime.js";
+import { errorMessage, isRecord, numberValue, stringValue, urlHost } from "./utils.js";
 const MAX_PROXY_BODY_BYTES = 10 * 1024 * 1024;
-function proxyBodyLimit(value = MAX_PROXY_BODY_BYTES) {
+function bodyLimit(value = MAX_PROXY_BODY_BYTES) {
     if (!Number.isSafeInteger(value) || value <= 0) {
         throw new Error("maxProxyBodyBytes must be a positive safe integer");
     }
     return value;
 }
-async function readBody(request, maxBytes) {
-    const contentLength = Number(request.headers["content-length"]);
-    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
-        throw new Error("Request body is too large");
-    }
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buffer.length;
-        if (size > maxBytes)
-            throw new Error("Request body is too large");
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks);
+function sameSecret(actual, expected) {
+    if (!actual)
+        return false;
+    const left = Buffer.from(actual);
+    const right = Buffer.from(expected);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function requestApiKeys(request) {
+    const authorization = request.headers.authorization;
+    const bearer = authorization?.startsWith("Bearer ") ? authorization.slice(7) : undefined;
+    const header = (name) => {
+        const value = request.headers[name];
+        return Array.isArray(value) ? value[0] : value;
+    };
+    const queryKey = new URL(request.url, "http://aisubs.local").searchParams.get("key") ?? undefined;
+    return [bearer, header("x-api-key"), header("x-goog-api-key"), queryKey].filter((value) => value != null);
+}
+export function routeSegments(pathname) {
+    return pathname.split("/").filter(Boolean).map(decodeURIComponent);
+}
+function bodyBuffer(request) {
+    if (request.body == null)
+        return Buffer.alloc(0);
+    if (Buffer.isBuffer(request.body))
+        return request.body;
+    if (typeof request.body === "string")
+        return Buffer.from(request.body);
+    return Buffer.from(JSON.stringify(request.body));
 }
-export async function readJsonBody(request) {
-    const body = await readBody(request, MAX_BODY_BYTES);
-    if (body.length === 0)
+function jsonBody(request) {
+    const body = bodyBuffer(request);
+    if (!body.length)
         return {};
     return JSON.parse(body.toString("utf8"));
 }
-function upstreamHeaders(upstream) {
-    const headers = { "cache-control": "no-store" };
+function requestHeaders(request) {
+    const headers = new Headers();
+    const privateHeaders = new Set([
+        "authorization",
+        "connection",
+        "content-length",
+        "cookie",
+        "host",
+        "origin",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "referer",
+        "te",
+        "trailer",
+        "upgrade",
+        "x-api-key",
+        "x-goog-api-key",
+    ]);
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value != null && !privateHeaders.has(name)) {
+            headers.set(name, Array.isArray(value) ? value.join(", ") : String(value));
+        }
+    }
+    return headers;
+}
+function responseHeaders(upstream) {
+    const headers = new Headers({ "cache-control": "no-store" });
     upstream.headers.forEach((value, name) => {
         if (![
             "cache-control",
@@ -44,264 +85,268 @@ function upstreamHeaders(upstream) {
             "set-cookie",
             "transfer-encoding",
         ].includes(name)) {
-            headers[name] = value;
+            headers.set(name, value);
         }
     });
     return headers;
 }
-async function sendUpstream(response, upstream) {
-    response.writeHead(upstream.status, upstreamHeaders(upstream));
-    if (upstream.body)
-        await pipeline(Readable.fromWeb(upstream.body), response);
-    else
-        response.end();
-}
-export async function readProxyBody(request, maxBytes = MAX_PROXY_BODY_BYTES) {
-    return readBody(request, proxyBodyLimit(maxBytes));
+export async function sendWebResponse(reply, upstream) {
+    reply.code(upstream.status);
+    responseHeaders(upstream).forEach((value, name) => reply.header(name, value));
+    if (!upstream.body) {
+        await reply.send();
+        return;
+    }
+    await reply.send(Readable.from(upstream.body));
 }
-export function sendJson(response, status, body, headers = {}) {
-    response.writeHead(status, {
-        "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store",
-        ...headers,
+function jsonResponse(body, status = 200, headers = {}) {
+    return Response.json(body, {
+        status,
+        headers: { "cache-control": "no-store", ...Object.fromEntries(new Headers(headers)) },
     });
-    response.end(JSON.stringify(body));
 }
-export function routeSegments(pathname) {
-    return pathname.split("/").filter(Boolean).map(decodeURIComponent);
+function accountPath(parts) {
+    if (parts[0] !== "aisubs" || !parts[1] || !parts[2])
+        return null;
+    const upstream = parts.slice(3);
+    const versioned = upstream[0] === "v1";
+    if (versioned)
+        upstream.shift();
+    return {
+        provider: parts[1],
+        account: parts[2],
+        path: upstream.map(encodeURIComponent).join("/"),
+        versioned,
+    };
 }
-function chatCompletionRequest(body) {
-    const raw = JSON.parse(body.toString("utf8"));
-    if (!isRecord(raw) || !Array.isArray(raw.messages)) {
-        throw new Error("Chat Completions requires a messages array");
-    }
-    const model = stringValue(raw.model);
-    if (!model)
-        throw new Error("Chat Completions requires a model");
-    if (raw.stream === true) {
-        throw new Error("ChatGPT Chat Completions compatibility does not support streaming");
-    }
-    const instructions = [];
-    const input = [];
-    for (const message of raw.messages) {
-        if (!isRecord(message))
-            throw new Error("Chat Completions messages must be objects");
-        const role = stringValue(message.role);
-        const content = stringValue(message.content);
-        if (!role || content == null) {
-            throw new Error("ChatGPT compatibility supports text-only messages");
-        }
-        if (role === "system" || role === "developer")
-            instructions.push(content);
-        else if (role === "user" || role === "assistant") {
-            input.push({
-                role,
-                content: [{ type: role === "assistant" ? "output_text" : "input_text", text: content }],
-            });
-        }
-        else
-            throw new Error(`Unsupported Chat Completions role: ${role}`);
-    }
-    const translated = { model, store: false, stream: true, input };
-    if (instructions.length)
-        translated.instructions = instructions.join("\n\n");
-    const maxOutputTokens = raw.max_completion_tokens ?? raw.max_tokens;
-    if (typeof maxOutputTokens === "number")
-        translated.max_output_tokens = maxOutputTokens;
-    if (isRecord(raw.response_format) &&
-        raw.response_format.type === "json_schema" &&
-        isRecord(raw.response_format.json_schema)) {
-        translated.text = { format: { type: "json_schema", ...raw.response_format.json_schema } };
-    }
-    return { model, body: JSON.stringify(translated) };
+function openAiModel(provider, model) {
+    return {
+        id: model.id,
+        object: "model",
+        owned_by: provider,
+        capabilities: {
+            endpoints: model.endpoints ?? [],
+            input_modalities: model.inputModalities ?? ["text"],
+            reasoning_efforts: model.reasoningEfforts ?? [],
+            tools: model.supportsToolCall ?? false,
+        },
+    };
 }
-function responseText(raw) {
-    if (!isRecord(raw))
-        return undefined;
-    const direct = stringValue(raw.output_text);
-    if (direct != null)
-        return direct;
-    if (!Array.isArray(raw.output))
-        return undefined;
-    const text = raw.output.flatMap((item) => {
-        if (!isRecord(item) || !Array.isArray(item.content))
-            return [];
-        return item.content.flatMap((part) => isRecord(part) && part.type === "output_text" && stringValue(part.text) != null
-            ? [stringValue(part.text)]
-            : []);
+function usableForCodex(model) {
+    return (model.endpoints ?? []).some((endpoint) => {
+        const normalized = endpoint.replace(/^\/?(?:v1\/)?/, "");
+        return (["responses", "chat/completions", "messages"].includes(normalized) ||
+            normalized.startsWith("models/"));
     });
-    return text.length ? text.join("") : undefined;
 }
-async function chatCompletionResponse(upstream, model) {
-    if (!upstream.ok)
-        return upstream;
-    let completed;
-    let content = "";
-    const body = await upstream.text();
-    if (body.startsWith("event:") || body.startsWith("data:")) {
-        for (const line of body.split(/\r?\n/)) {
-            if (!line.startsWith("data:"))
-                continue;
-            const data = line.slice(5).trim();
-            if (!data || data === "[DONE]")
-                continue;
-            const event = JSON.parse(data);
-            if (!isRecord(event))
-                continue;
-            if (event.type === "response.output_text.delta")
-                content += stringValue(event.delta) ?? "";
-            if (event.type === "response.completed")
-                completed = event.response;
-        }
+function codexResponsesBody(input, model) {
+    const body = { ...input, model };
+    if (Array.isArray(body.input)) {
+        body.input = body.input
+            .filter((item) => isRecord(item) &&
+            ["message", "function_call", "function_call_output"].includes(String(item.type)))
+            .map((item) => {
+            if (item.type === "message") {
+                const content = Array.isArray(item.content)
+                    ? item.content
+                        .filter(isRecord)
+                        .map((part) => stringValue(part.text))
+                        .filter((value) => Boolean(value))
+                        .join("")
+                    : item.content;
+                return { type: "message", role: stringValue(item.role) ?? "user", content };
+            }
+            return item;
+        });
     }
-    else
-        completed = JSON.parse(body);
-    content ||= responseText(completed) ?? "";
-    const raw = isRecord(completed) ? completed : {};
-    const usage = isRecord(raw.usage)
-        ? {
-            prompt_tokens: raw.usage.input_tokens,
-            completion_tokens: raw.usage.output_tokens,
-            total_tokens: raw.usage.total_tokens,
-        }
-        : undefined;
-    return Response.json({
-        id: stringValue(raw.id) ?? `chatcmpl_${crypto.randomUUID()}`,
-        object: "chat.completion",
-        created: typeof raw.created_at === "number" ? raw.created_at : Math.floor(Date.now() / 1000),
-        model: stringValue(raw.model) ?? model,
-        choices: [{ index: 0, message: { role: "assistant", content }, finish_reason: "stop" }],
-        ...(usage ? { usage } : {}),
-    });
+    if (isRecord(body.reasoning) && body.reasoning.summary === "all_turns") {
+        // Codex can send `all_turns`, but Copilot's GPT-5 Responses endpoint only
+        // accepts `auto` (some model revisions also accept `current_turn`).
+        // `auto` is the common denominator across the connected model revisions.
+        body.reasoning = { ...body.reasoning, summary: "auto" };
+    }
+    if (!Array.isArray(body.tools) || body.tools.length === 0) {
+        // OpenAI Responses permits a default tool choice, but several upstream
+        // providers reject tool_choice unless an actual tools array is present.
+        delete body.tool_choice;
+    }
+    delete body.prompt_cache_retention;
+    delete body.include;
+    return body;
 }
-export async function handleSubscriptionAuthApi(auth, request, response, url, maxProxyBodyBytes = MAX_PROXY_BODY_BYTES) {
+export async function handleSubscriptionAuthApi(auth, request, signal) {
+    const url = new URL(request.url, "http://aisubs.local");
     const parts = routeSegments(url.pathname);
-    if (parts[0] === "aisubs" && parts[1] && parts[2] && request.method !== "OPTIONS") {
-        const upstreamParts = parts.slice(3);
-        const versioned = upstreamParts[0] === "v1";
-        if (versioned)
-            upstreamParts.shift();
-        if (versioned && upstreamParts[0] === "embeddings") {
-            sendJson(response, 404, { error: "AISubs does not expose an embeddings API" });
-            return true;
+    // Unified Codex-compatible router. Model ids use provider/model, while the
+    // account is selected from the first authenticated account exposing it.
+    if (parts[0] === "aisubs-codex" && parts[1] === "v1") {
+        if (request.method === "GET" && parts[2] === "models") {
+            const models = [];
+            const seen = new Set();
+            for (const provider of auth.listProviders()) {
+                if (provider.id === "chatgpt")
+                    continue;
+                for (const account of await auth.listAccounts(provider.id)) {
+                    const catalog = await auth.getModels(provider.id, account.accountKey).catch(() => null);
+                    for (const model of catalog?.models ?? []) {
+                        if (!usableForCodex(model))
+                            continue;
+                        const id = `${provider.id}/${model.id}`;
+                        if (seen.has(id))
+                            continue;
+                        seen.add(id);
+                        models.push({ ...openAiModel(provider.id, model), id });
+                    }
+                }
+            }
+            return jsonResponse({ object: "list", data: models, models });
+        }
+        if (request.method === "POST" && parts[2] === "responses") {
+            const raw = jsonBody(request);
+            const input = isRecord(raw) ? raw : {};
+            const requested = stringValue(input.model);
+            if (!requested) {
+                return jsonResponse({ error: { message: "model must be provider/model", type: "invalid_request_error" } }, 400);
+            }
+            const slash = requested.indexOf("/");
+            if (slash <= 0 || slash === requested.length - 1) {
+                return jsonResponse({
+                    error: {
+                        message: `Model "${requested}" must include its provider, for example "copilot/${requested}". No provider fallback was performed.`,
+                        type: "invalid_request_error",
+                        code: "invalid_model_id",
+                    },
+                }, 400);
+            }
+            const provider = requested.slice(0, slash);
+            const model = requested.slice(slash + 1);
+            if (!auth.listProviders().some((candidate) => candidate.id === provider)) {
+                return jsonResponse({
+                    error: {
+                        message: `Model not found: ${requested}`,
+                        type: "invalid_request_error",
+                        code: "model_not_found",
+                    },
+                }, 404);
+            }
+            for (const account of await auth.listAccounts(provider)) {
+                const catalog = await auth.getModels(provider, account.accountKey).catch(() => null);
+                if (!catalog?.models.some((candidate) => candidate.id === model && usableForCodex(candidate)))
+                    continue;
+                // Codex sends Responses-only history/metadata that subscription
+                // providers do not all understand. Keep the router's wire contract
+                // stable and pass each provider only portable input items.
+                const translated = codexResponsesBody(input, model);
+                const compatible = await proxyCompatible(auth, provider, account.accountKey, "responses", Buffer.from(JSON.stringify(translated)), requestHeaders(request), signal);
+                if (compatible)
+                    return compatible;
+                return auth.proxy(provider, account.accountKey, "responses", {
+                    method: "POST",
+                    headers: requestHeaders(request),
+                    body: JSON.stringify(translated),
+                    signal,
+                });
+            }
+            return jsonResponse({
+                error: {
+                    message: `Model not found: ${requested}`,
+                    type: "invalid_request_error",
+                    code: "model_not_found",
+                },
+            }, 404);
         }
-        if (versioned && request.method === "GET" && upstreamParts.join("/") === "models") {
-            const catalog = await auth.getModels(parts[1], parts[2]);
-            sendJson(response, 200, {
+    }
+    const account = accountPath(parts);
+    if (account && request.method !== "OPTIONS") {
+        if (account.versioned && request.method === "GET" && account.path === "models") {
+            const catalog = await auth.getModels(account.provider, account.account);
+            const models = (catalog?.models ?? []).map((model) => openAiModel(account.provider, model));
+            return jsonResponse({
                 object: "list",
-                data: (catalog?.models ?? []).map((model) => ({
-                    id: model.id,
-                    object: "model",
-                    owned_by: parts[1],
-                })),
+                data: models,
+                // Codex's custom-provider catalog reader expects `models`, while
+                // OpenAI-compatible clients expect `data`. Keep both shapes.
+                models,
             });
-            return true;
         }
-        const headers = new Headers();
-        const privateHeaders = new Set([
-            "authorization",
-            "connection",
-            "content-length",
-            "cookie",
-            "host",
-            "origin",
-            "proxy-authenticate",
-            "proxy-authorization",
-            "referer",
-            "te",
-            "trailer",
-            "upgrade",
-            "x-api-key",
-        ]);
-        for (const [name, value] of Object.entries(request.headers)) {
-            if (value != null && !privateHeaders.has(name)) {
-                headers.set(name, Array.isArray(value) ? value.join(", ") : value);
-            }
+        if (account.versioned && request.method === "GET" && account.path.startsWith("models/")) {
+            const id = decodeURIComponent(account.path.slice("models/".length));
+            const catalog = await auth.getModels(account.provider, account.account);
+            const model = catalog?.models.find((candidate) => candidate.id === id);
+            return model
+                ? jsonResponse(openAiModel(account.provider, model))
+                : jsonResponse({
+                    error: {
+                        message: `Model not found: ${id}`,
+                        type: "invalid_request_error",
+                        code: "model_not_found",
+                    },
+                }, 404);
         }
-        const body = await readProxyBody(request, maxProxyBodyBytes);
-        let path = upstreamParts.map(encodeURIComponent).join("/") + url.search;
-        let proxyBody = body;
-        let chatCompletionModel;
-        if (parts[1] === "chatgpt" &&
-            versioned &&
-            request.method === "POST" &&
-            upstreamParts.join("/") === "chat/completions") {
-            const translated = chatCompletionRequest(body);
-            path = "responses";
-            proxyBody = Buffer.from(translated.body);
-            chatCompletionModel = translated.model;
-            headers.set("accept", "text/event-stream");
-            headers.set("content-type", "application/json");
+        const headers = requestHeaders(request);
+        const body = bodyBuffer(request);
+        url.searchParams.delete("key");
+        const path = `${account.path}${url.search}`;
+        if (account.versioned && request.method === "POST") {
+            const compatible = await proxyCompatible(auth, account.provider, account.account, path, body, headers, signal);
+            if (compatible)
+                return compatible;
         }
-        const upstream = await auth.proxy(parts[1], parts[2], path, {
+        return auth.proxy(account.provider, account.account, path, {
             method: request.method,
             headers,
-            body: proxyBody.length ? proxyBody : undefined,
+            body: body.length ? new Uint8Array(body) : undefined,
+            signal,
         });
-        await sendUpstream(response, chatCompletionModel ? await chatCompletionResponse(upstream, chatCompletionModel) : upstream);
-        return true;
     }
     if (request.method === "GET" && parts.join("/") === "v1/providers") {
-        sendJson(response, 200, { providers: auth.listProviders() });
-        return true;
+        return jsonResponse({ providers: auth.listProviders() });
     }
     if (request.method === "GET" && parts.join("/") === "v1/auth") {
-        sendJson(response, 200, { sessions: await auth.statuses() });
-        return true;
+        return jsonResponse({ sessions: await auth.statuses() });
     }
     if (parts[0] === "v1" && parts[1] === "auth" && parts[2]) {
         const provider = parts[2];
         if (request.method === "GET" && parts.length === 3) {
-            sendJson(response, 200, await auth.status(provider, {
+            return jsonResponse(await auth.status(provider, {
                 account: url.searchParams.get("account") ?? undefined,
                 validate: url.searchParams.get("validate") === "true",
             }));
-            return true;
         }
         if (request.method === "GET" && parts[3] === "accounts") {
-            sendJson(response, 200, { accounts: await auth.listAccounts(provider) });
-            return true;
+            return jsonResponse({ accounts: await auth.listAccounts(provider) });
         }
         if (request.method === "GET" && parts[3] === "details") {
-            sendJson(response, 200, await auth.credentialSummary(provider, url.searchParams.get("account") ?? undefined));
-            return true;
+            return jsonResponse(await auth.credentialSummary(provider, url.searchParams.get("account") ?? undefined));
         }
         if (request.method === "POST" && parts[3] === "login") {
-            const body = await readJsonBody(request);
+            const body = jsonBody(request);
             const attempt = await auth.signIn(provider, isRecord(body) ? body : undefined);
-            sendJson(response, 202, {
+            return jsonResponse({
                 id: attempt.id,
                 provider: attempt.provider,
                 accountKey: attempt.accountKey,
                 state: attempt.state,
                 prompt: attempt.prompt,
-            });
-            return true;
+            }, 202);
         }
         if (request.method === "DELETE" && parts.length === 3) {
             const accountKey = url.searchParams.get("account") ?? "default";
             await auth.signOut(provider, accountKey);
-            sendJson(response, 200, { provider, accountKey, authenticated: false });
-            return true;
+            return jsonResponse({ provider, accountKey, authenticated: false });
         }
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "logins" && parts[2]) {
         const attempt = auth.getLoginAttempt(parts[2]);
-        if (attempt)
-            sendJson(response, 200, attempt);
-        else
-            sendJson(response, 404, { error: "Login not found" });
-        return true;
+        return attempt ? jsonResponse(attempt) : jsonResponse({ error: "Login not found" }, 404);
     }
     if (request.method === "DELETE" && parts[0] === "v1" && parts[1] === "logins" && parts[2]) {
-        if (auth.cancelLoginAttempt(parts[2]))
-            sendJson(response, 200, { cancelled: true });
-        else
-            sendJson(response, 404, { error: "Pending login not found" });
-        return true;
+        return auth.cancelLoginAttempt(parts[2])
+            ? jsonResponse({ cancelled: true })
+            : jsonResponse({ error: "Pending login not found" }, 404);
     }
     if (request.method === "POST" && parts[0] === "v1" && parts[1] === "fetch" && parts[2]) {
-        const body = await readJsonBody(request);
+        const body = jsonBody(request);
         if (!isRecord(body))
             throw new Error("Fetch body requires an absolute url");
         const targetUrl = stringValue(body.url);
@@ -322,79 +367,130 @@ export async function handleSubscriptionAuthApi(auth, request, response, url, ma
             if (!headers.has("content-type"))
                 headers.set("content-type", "application/json");
         }
-        const upstream = await auth.fetch(parts[2], targetUrl, {
+        return auth.fetch(parts[2], targetUrl, {
             method: stringValue(body.method) ?? (requestBody ? "POST" : "GET"),
             headers,
             body: requestBody,
+            signal,
         }, stringValue(body.account));
-        await sendUpstream(response, upstream);
-        return true;
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "usage" && parts[2]) {
-        const usage = await auth.getUsage(parts[2], url.searchParams.get("account") ?? undefined);
-        if (usage)
-            sendJson(response, 200, usage);
-        else
-            sendJson(response, 404, { error: "Usage is not supported by this provider" });
-        return true;
+        const usage = await auth.getUsage(parts[2], url.searchParams.get("account") ?? undefined, signal);
+        return usage
+            ? jsonResponse(usage)
+            : jsonResponse({ error: "Usage is not supported by this provider" }, 404);
     }
     if (request.method === "GET" && parts[0] === "v1" && parts[1] === "models" && parts[2]) {
-        const models = await auth.getModels(parts[2], url.searchParams.get("account") ?? undefined);
-        if (models)
-            sendJson(response, 200, models);
-        else
-            sendJson(response, 404, { error: "Models are not supported by this provider" });
-        return true;
+        const models = await auth.getModels(parts[2], url.searchParams.get("account") ?? undefined, signal);
+        return models
+            ? jsonResponse(models)
+            : jsonResponse({ error: "Models are not supported by this provider" }, 404);
     }
-    return false;
+    return null;
 }
-export async function createSubscriptionAuthServer(options) {
+/** Abort upstream work only when the client disconnects before the response finishes. */
+export function clientAbortSignal(request, reply) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!reply.raw.writableFinished && !controller.signal.aborted)
+            controller.abort();
+    };
+    const cleanup = () => {
+        request.raw.off("aborted", abort);
+        reply.raw.off("close", abort);
+    };
+    request.raw.once("aborted", abort);
+    reply.raw.once("close", abort);
+    reply.raw.once("finish", cleanup);
+    if (request.raw.aborted || (reply.raw.destroyed && !reply.raw.writableFinished))
+        abort();
+    return controller.signal;
+}
+export function createApiApp(options) {
     if (!options.apiKey)
         throw new Error("A non-empty API key is required");
-    const maxProxyBodyBytes = proxyBodyLimit(options.maxProxyBodyBytes);
-    const host = options.host ?? "127.0.0.1";
-    if (host !== "127.0.0.1" && host !== "::1" && host !== "localhost") {
-        throw new Error("The built-in auth server may only bind to localhost");
-    }
-    const origin = `http://${urlHost(host)}`;
-    const server = createServer(async (request, response) => {
-        try {
-            const url = new URL(request.url ?? "/", origin);
-            if (url.pathname === "/health")
-                return sendJson(response, 200, { ok: true });
-            const headerKey = Array.isArray(request.headers["x-api-key"])
-                ? request.headers["x-api-key"][0]
-                : request.headers["x-api-key"];
-            if (request.headers.authorization !== `Bearer ${options.apiKey}` &&
-                headerKey !== options.apiKey) {
-                return sendJson(response, 401, { error: "Unauthorized" });
-            }
-            if (!(await handleSubscriptionAuthApi(options.auth, request, response, url, maxProxyBodyBytes))) {
-                sendJson(response, 404, { error: "Not found" });
-            }
+    const app = Fastify({
+        bodyLimit: bodyLimit(options.maxProxyBodyBytes),
+        forceCloseConnections: true,
+    });
+    app.removeAllContentTypeParsers();
+    app.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => done(null, body));
+    void app.register(cors, {
+        origin: true,
+        credentials: false,
+        methods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+        allowedHeaders: [
+            "authorization",
+            "content-type",
+            "x-api-key",
+            "x-goog-api-key",
+            "anthropic-version",
+            "anthropic-beta",
+            "openai-beta",
+        ],
+        exposedHeaders: ["x-request-id", "retry-after"],
+    });
+    void app.register(websocket);
+    app.get("/health", async () => ({ ok: true }));
+    app.addHook("onRequest", async (request, reply) => {
+        if (request.url === "/health")
+            return;
+        if (!requestApiKeys(request).some((value) => sameSecret(value, options.apiKey))) {
+            await reply.code(401).send({
+                error: { message: "Unauthorized", type: "authentication_error", code: "invalid_api_key" },
+            });
         }
-        catch (error) {
-            if (response.headersSent)
-                response.destroy();
+    });
+    void app.register(async (scope) => {
+        registerRealtimeProxy(scope, options.auth, (request) => requestApiKeys(request).some((value) => sameSecret(value, options.apiKey)));
+    });
+    app.route({
+        method: ["GET", "POST", "PUT", "PATCH", "DELETE"],
+        url: "/*",
+        async handler(request, reply) {
+            const response = await handleSubscriptionAuthApi(options.auth, request, clientAbortSignal(request, reply));
+            if (response)
+                await sendWebResponse(reply, response);
             else
-                sendJson(response, 400, { error: errorMessage(error) });
-        }
+                await reply.code(404).send({
+                    error: { message: "Not found", type: "invalid_request_error", code: "not_found" },
+                });
+        },
     });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(options.port ?? 0, host, () => {
-            server.off("error", reject);
-            resolve();
-        });
+    app.setErrorHandler(async (error, request, reply) => {
+        const statusCode = isRecord(error) ? numberValue(error.statusCode) : undefined;
+        const status = statusCode && statusCode >= 400 ? statusCode : 400;
+        const code = isRecord(error) ? stringValue(error.code) : undefined;
+        const openAi = request.url.startsWith("/aisubs/") || request.url.startsWith("/aisubs-codex/");
+        await reply.code(status).send(openAi
+            ? {
+                error: {
+                    message: errorMessage(error),
+                    type: "invalid_request_error",
+                    code: code ?? "invalid_request_error",
+                },
+            }
+            : { error: errorMessage(error) });
     });
-    const address = server.address();
+    return app;
+}
+export async function createSubscriptionAuthServer(options) {
+    const host = options.host ?? "127.0.0.1";
+    if (host !== "127.0.0.1" && host !== "::1" && host !== "localhost") {
+        throw new Error("The built-in auth server may only bind to localhost");
+    }
+    const app = createApiApp(options);
+    await app.listen({ port: options.port ?? 0, host });
+    const address = app.server.address();
     if (!address || typeof address === "string") {
+        await app.close();
         throw new Error("Unable to determine auth server port");
     }
     return {
-        server,
+        server: app.server,
+        app,
         apiKey: options.apiKey,
-        url: `${origin}:${address.port}`,
-        close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))),
+        url: `http://${urlHost(host)}:${address.port}`,
+        close: () => app.close(),
     };
 }