auto-model-router 0.31.0 → 0.33.0

package/src/upstream/ollama-usage.ts

@@ -24,7 +24,7 @@
  * percents) rather than 100%, which errs toward keeping the bias on.
  */
 
-import type { Database } from "bun:sqlite";
+import { num, type SqlDb } from "../util/sql.ts";
 import type { Logger } from "../util/log.ts";
 
 export interface OllamaUsage {
@@ -158,9 +158,9 @@ export const NO_USAGE: OllamaUsageSource = { get: async () => null, peek: () =>
 
 /** Where calibration samples come from and go: the ledger's Ollama total and the plan's credits. */
 export interface CalibrationDeps {
-	db: Database;
+	db: SqlDb;
 	/** The ledger's all-time Ollama spend, read at sampling time. */
-	ledgerUsd(): number;
+	ledgerUsd(): Promise<number>;
 	/** Configured credit override (0 = detect from the plan). */
 	planCreditsOverrideUsd: number;
 }
@@ -172,17 +172,25 @@ export function createOllamaUsageSource(
 	// the dashboard later, so the reader stays live and simply idles until it is.
 	if (opts.pollMs <= 0) return NO_USAGE;
 	const cal = opts.calibration;
-	const insertSample = cal === undefined ? null : cal.db.query("INSERT OR REPLACE INTO ollama_meter_samples (at_ms, meter_usd, ledger_usd) VALUES (?, ?, ?)");
-	const readSamples = cal === undefined ? null : cal.db.query("SELECT at_ms, meter_usd, ledger_usd FROM ollama_meter_samples WHERE at_ms >= ? ORDER BY at_ms ASC");
 	let calibrationMemo: OllamaCalibration | null = null;
-	function sample(usage: OllamaUsage): void {
-		if (cal === null || cal === undefined || insertSample === null || readSamples === null) return;
+	async function sample(usage: OllamaUsage): Promise<void> {
+		if (cal === null || cal === undefined) return;
 		const credits = ollamaPlanCredits(usage, cal.planCreditsOverrideUsd);
 		if (credits === null || usage.monthlyUsedFraction === null) return;
 		try {
-			insertSample.run(usage.fetchedAtMs, usage.monthlyUsedFraction * credits, cal.ledgerUsd());
-			const rows = readSamples.all(usage.fetchedAtMs - 30 * 86_400_000) as { at_ms: number; meter_usd: number; ledger_usd: number }[];
-			calibrationMemo = calibrationFrom(rows.map((r) => ({ atMs: r.at_ms, meterUsd: r.meter_usd, ledgerUsd: r.ledger_usd })));
+			const db = cal.db;
+			// `INSERT OR REPLACE` is SQLite-only; `ON CONFLICT` says the same thing
+			// on both engines, and the key is the sample instant.
+			await db.sql`INSERT INTO ollama_meter_samples (at_ms, meter_usd, ledger_usd)
+				VALUES (${usage.fetchedAtMs}, ${usage.monthlyUsedFraction * credits}, ${await cal.ledgerUsd()})
+				ON CONFLICT (at_ms) DO UPDATE SET meter_usd = excluded.meter_usd, ledger_usd = excluded.ledger_usd`;
+			const rows = await db.query<{ at_ms: unknown; meter_usd: unknown; ledger_usd: unknown }>(
+				"SELECT at_ms, meter_usd, ledger_usd FROM ollama_meter_samples WHERE at_ms >= $since ORDER BY at_ms ASC",
+				{ since: usage.fetchedAtMs - 30 * 86_400_000 },
+			);
+			calibrationMemo = calibrationFrom(
+				rows.map((r) => ({ atMs: num(r.at_ms), meterUsd: num(r.meter_usd), ledgerUsd: num(r.ledger_usd) })),
+			);
 		} catch (err) {
 			opts.log.debug("ollama calibration sample failed", { error: err instanceof Error ? err.message : String(err) });
 		}
@@ -232,7 +240,9 @@ export function createOllamaUsageSource(
 				if (parsed !== null) {
 					current = { ...parsed, plan };
 					warned = false;
-					sample(current);
+					// Awaited: the next poll's calibration reads what this one wrote,
+					// and a shared store makes that a round trip rather than a call.
+					await sample(current);
 				} else if (!warned) {
 					warned = true;
 					opts.log.warn("ollama usage payload had no recognisable fields; credit-aware bias stays on its last reading");

package/src/upstream/ollama.ts

@@ -146,9 +146,9 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 		log.warn("ollama cloud unavailable; routing around it", { kind: err.kind, cooldownMs: ms, message: err.message });
 	};
 
-	function headers(extra: Record<string, string> = {}): Record<string, string> {
+	function headers(extra: Record<string, string> = {}, apiKey: string = o.apiKey): Record<string, string> {
 		const h: Record<string, string> = { "content-type": "application/json", ...extra };
-		if (o.apiKey !== "") h.authorization = `Bearer ${o.apiKey}`;
+		if (apiKey !== "") h.authorization = `Bearer ${apiKey}`;
 		return h;
 	}
 
@@ -195,7 +195,8 @@ export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fet
 			try {
 				res = await fetchImpl(`${baseUrl()}/chat/completions`, {
 					method: "POST",
-					headers: headers(),
+					// A per-turn credential wins for this dispatch only; cfg is never written to.
+					headers: headers({}, opts.upstreamKeys?.ollama ?? o.apiKey),
 					body: JSON.stringify(body),
 					signal: composeSignal(opts.signal),
 				});

package/src/upstream/openrouter.ts

@@ -114,14 +114,14 @@ export function createOpenRouterClient(cfg: RouterConfig): UpstreamClient {
 		return caller ?? timeout;
 	}
 
-	function headers(extra: Record<string, string>): Record<string, string> {
+	function headers(extra: Record<string, string>, apiKey: string = cfg.openrouter.apiKey): Record<string, string> {
 		const h: Record<string, string> = {
 			"content-type": "application/json",
 			"x-title": cfg.openrouter.title,
 			...extra,
 		};
 		// /models is public; an empty key must not produce a broken Bearer header.
-		if (cfg.openrouter.apiKey !== "") h.authorization = `Bearer ${cfg.openrouter.apiKey}`;
+		if (apiKey !== "") h.authorization = `Bearer ${apiKey}`;
 		if (cfg.openrouter.referer) h["http-referer"] = cfg.openrouter.referer;
 		return h;
 	}
@@ -139,7 +139,8 @@ export function createOpenRouterClient(cfg: RouterConfig): UpstreamClient {
 			try {
 				res = await fetch(`${baseUrl}/chat/completions`, {
 					method: "POST",
-					headers: headers({ "x-session-id": opts.sessionId }),
+					// A per-turn credential wins for this dispatch only; cfg is never written to.
+					headers: headers({ "x-session-id": opts.sessionId }, opts.upstreamKeys?.openrouter ?? cfg.openrouter.apiKey),
 					body: JSON.stringify(body),
 					signal,
 				});

package/src/upstream/types.ts

@@ -43,6 +43,13 @@ export interface DispatchOptions {
 	body: Record<string, unknown>;
 	/** Forwarded as the `x-session-id` header, mirroring body `session_id`. */
 	sessionId: string;
+	/**
+	 * Per-turn credentials by upstream id (`NormRequest.upstreamKeys`). The
+	 * client dispatching this body prefers its own entry over the configured
+	 * `apiKey`, without ever writing to the shared config: concurrent turns
+	 * carry different tenants' keys over the same `UpstreamEntry`.
+	 */
+	upstreamKeys?: Readonly<Record<string, string>>;
 	signal: AbortSignal;
 }
 

package/src/util/schema.ts

@@ -0,0 +1,201 @@
+/**
+ * The store's schema, for either engine.
+ *
+ * `util/sqlite.ts` remains the migration path for a SQLite FILE that already
+ * exists: nineteen versions have shipped, and an old file still needs its
+ * `ALTER TABLE`s applied in order. This module declares the FINAL shape of
+ * every table instead, which is what a fresh store needs — a Postgres database
+ * has no history to migrate, and on an already-migrated file every statement
+ * here is a no-op.
+ *
+ * The two must agree, so the definitions below are transcribed from
+ * `util/sqlite.ts` with its incremental columns folded in, and
+ * `test/schema.test.ts` compares the two engine-by-engine rather than trusting
+ * that they were copied correctly.
+ */
+
+import type { SqlDb } from "./sql.ts";
+
+/**
+ * Creates every table and index the router uses. Idempotent, so boot order
+ * never matters — the property the SQLite bootstrap has always had.
+ */
+export async function migrateStore(db: SqlDb): Promise<void> {
+	const json = db.type("json");
+	const float = db.type("float");
+	const big = db.type("bigint");
+	// A single-row cache keyed on a constant: `CHECK (id = 1)` is portable, and
+	// it is what keeps a second payload from ever accumulating.
+	const singleton = (name: string, extra = ""): string =>
+		`CREATE TABLE IF NOT EXISTS ${name} (
+			id INTEGER PRIMARY KEY CHECK (id = 1),
+			payload ${json} NOT NULL,
+			fetched_at_ms ${big} NOT NULL${extra}
+		)`;
+
+	const statements: string[] = [
+		singleton("catalog_cache", `,\n\t\t\tetag TEXT,\n\t\t\tkey_scoped INTEGER NOT NULL DEFAULT 0`),
+		singleton("ollama_catalog_cache"),
+		singleton("benchmark_cache"),
+		singleton("local_scores"),
+
+		// One row per dispatched upstream generation. The columns nineteen
+		// migrations added are declared here as they finally stand.
+		`CREATE TABLE IF NOT EXISTS ledger (
+			id TEXT PRIMARY KEY,
+			created_at_ms ${big} NOT NULL,
+			conversation_key TEXT NOT NULL,
+			session_id TEXT NOT NULL,
+			turn INTEGER NOT NULL,
+			requested_model TEXT NOT NULL,
+			harness_id TEXT NOT NULL DEFAULT '',
+			omp_session_id TEXT NOT NULL DEFAULT '',
+			slug TEXT NOT NULL,
+			served_slug TEXT,
+			tier TEXT NOT NULL,
+			classification_source TEXT NOT NULL,
+			reasons ${json} NOT NULL,
+			predicted_usd ${float} NOT NULL,
+			reported_usd ${float},
+			usage ${json} NOT NULL,
+			cost_breakdown ${json},
+			attempt INTEGER NOT NULL,
+			escalation_signal TEXT,
+			latency_ms INTEGER NOT NULL,
+			ttft_ms INTEGER,
+			finish_reason TEXT,
+			wasted INTEGER NOT NULL DEFAULT 0,
+			upstream_generation_id TEXT,
+			error TEXT,
+			error_kind TEXT,
+			features ${json},
+			score ${float},
+			confidence ${float},
+			task TEXT,
+			classifier_reasons ${json},
+			explored_from TEXT,
+			hold_arm INTEGER,
+			prompt_tokens_saved INTEGER,
+			scope TEXT,
+			redactions INTEGER
+		)`,
+		"CREATE INDEX IF NOT EXISTS idx_ledger_conversation ON ledger (conversation_key)",
+		"CREATE INDEX IF NOT EXISTS idx_ledger_created ON ledger (created_at_ms)",
+		"CREATE INDEX IF NOT EXISTS idx_ledger_slug ON ledger (slug)",
+		// Per-slug newest-first reads (the latency window, any windowed trust).
+		// Without this they sorted every row the slug ever had: measured on a
+		// real ledger, 5-10ms and RISING with history against a flat 0.04-0.08ms.
+		"CREATE INDEX IF NOT EXISTS idx_ledger_slug_created ON ledger (slug, created_at_ms DESC)",
+		"CREATE INDEX IF NOT EXISTS idx_ledger_harness_created ON ledger (harness_id, created_at_ms DESC)",
+		"CREATE INDEX IF NOT EXISTS idx_ledger_slug_harness_created ON ledger (slug, harness_id, created_at_ms DESC)",
+		"CREATE INDEX IF NOT EXISTS idx_ledger_session ON ledger (omp_session_id, created_at_ms DESC)",
+
+		`CREATE TABLE IF NOT EXISTS token_calibration (
+			tokenizer TEXT PRIMARY KEY,
+			est_bytes ${big} NOT NULL,
+			actual_tokens ${big} NOT NULL,
+			samples ${big} NOT NULL
+		)`,
+
+		// Per-conversation routing memory: the sticky window, which model's
+		// prompt cache is warm, and the accumulated spend the budget guard reads.
+		`CREATE TABLE IF NOT EXISTS conversations (
+			key TEXT PRIMARY KEY,
+			session_id TEXT NOT NULL,
+			turn INTEGER NOT NULL DEFAULT 0,
+			current_slug TEXT,
+			current_tier TEXT,
+			sticky_until_turn INTEGER NOT NULL DEFAULT 0,
+			escalations INTEGER NOT NULL DEFAULT 0,
+			spent_usd ${float} NOT NULL DEFAULT 0,
+			last_prompt_tokens INTEGER NOT NULL DEFAULT 0,
+			cache_warm_slug TEXT,
+			cache_warm_at_ms ${big} NOT NULL DEFAULT 0,
+			context_version TEXT,
+			context_fetched_at_ms ${big} NOT NULL DEFAULT 0,
+			compaction_plan ${json},
+			compaction_plan_tokens INTEGER NOT NULL DEFAULT 0,
+			upgrade_deferred_tier TEXT,
+			updated_at_ms ${big} NOT NULL DEFAULT 0
+		)`,
+
+		// agentdox bridge. Blocks are content-addressed so many conversations on
+		// one project share a copy, and so a restart can re-inject the SAME bytes
+		// a conversation was already using (the upstream cache outlives us).
+		`CREATE TABLE IF NOT EXISTS context_blocks (
+			version TEXT PRIMARY KEY,
+			scope TEXT NOT NULL,
+			block TEXT NOT NULL,
+			fetched_at_ms ${big} NOT NULL
+		)`,
+
+		// Plan-meter readings beside the ledger's own Ollama total at the same
+		// instant, so the estimate can be calibrated against the bill.
+		`CREATE TABLE IF NOT EXISTS ollama_meter_samples (
+			at_ms ${big} PRIMARY KEY,
+			meter_usd ${float} NOT NULL,
+			ledger_usd ${float} NOT NULL
+		)`,
+
+		// User verdicts on routed turns, tied to the ledger row judged.
+		`CREATE TABLE IF NOT EXISTS feedback (
+			id TEXT PRIMARY KEY,
+			ledger_id TEXT NOT NULL,
+			omp_session_id TEXT NOT NULL DEFAULT '',
+			slug TEXT NOT NULL,
+			tier TEXT NOT NULL,
+			verdict TEXT NOT NULL,
+			note TEXT NOT NULL DEFAULT '',
+			created_at_ms ${big} NOT NULL
+		)`,
+		"CREATE INDEX IF NOT EXISTS idx_feedback_created ON feedback (created_at_ms)",
+		"CREATE INDEX IF NOT EXISTS idx_feedback_ledger ON feedback (ledger_id)",
+
+		// Small durable markers (when the daily summary was last posted, per harness).
+		`CREATE TABLE IF NOT EXISTS router_kv (
+			key TEXT PRIMARY KEY,
+			value TEXT NOT NULL,
+			updated_at_ms ${big} NOT NULL
+		)`,
+
+		`CREATE TABLE IF NOT EXISTS agentdox_sessions (
+			conversation_key TEXT PRIMARY KEY,
+			scope TEXT NOT NULL,
+			session_id TEXT NOT NULL,
+			created_at_ms ${big} NOT NULL
+		)`,
+	];
+
+	// `IF NOT EXISTS` is not atomic on Postgres: two replicas booting against a
+	// fresh database both pass the existence check and the loser fails on the
+	// unique index over pg_type (23505), or on the table name itself (42P07 /
+	// 42710). Measured: one of two replicas started together died with
+	// "duplicate key value violates unique constraint pg_type_typname_nsp_index".
+	// The condition those errors report is the condition the statement asked to
+	// tolerate, so they are the success case arriving from the other replica.
+	const RACED = new Set(["23505", "42P07", "42710"]);
+	for (const statement of statements) {
+		try {
+			await db.sql.unsafe(statement);
+		} catch (err) {
+			const code = (err as { errno?: unknown }).errno;
+			if (!RACED.has(String(code))) throw err;
+		}
+	}
+}
+
+/** Every table `migrateStore` creates, for tests and for teardown. */
+export const STORE_TABLES = [
+	"catalog_cache",
+	"ollama_catalog_cache",
+	"benchmark_cache",
+	"local_scores",
+	"ledger",
+	"token_calibration",
+	"conversations",
+	"context_blocks",
+	"ollama_meter_samples",
+	"feedback",
+	"router_kv",
+	"agentdox_sessions",
+] as const;

package/src/util/sql.ts

@@ -0,0 +1,246 @@
+/**
+ * One SQL handle for both engines.
+ *
+ * The ledger has to live in the same database as the rest of a deployment's
+ * state when that state is shared (spend read from a file that lags the
+ * database it must agree with is a cap that silently over-admits), and in a
+ * local file when it is not. `Bun.SQL` speaks both, so the ledger is written
+ * once against this shim rather than twice.
+ *
+ * Only three things actually differ, and they are the three things here:
+ *
+ *  1. **JSON access.** `json_extract(usage, '$.promptTokens')` against
+ *     `(usage->>'promptTokens')::numeric`.
+ *  2. **Numeric results.** Postgres returns `COUNT(*)` and `SUM(BIGINT)` as
+ *     STRINGS. Arithmetic on those silently produces wrong answers rather than
+ *     throwing — a measured trust score came out 0.9756 instead of 0.9726 this
+ *     way — so every numeric read goes through `num`.
+ *  3. **Column types.** `JSONB`/`DOUBLE PRECISION` against `TEXT`/`REAL`.
+ *
+ * Everything else — parameters, `IN ${sql(array)}`, window functions,
+ * `ON CONFLICT`, `DELETE ... RETURNING`, bulk insert, transactions — is
+ * identical on both, verified by `tools/dialect-probe.ts`.
+ */
+
+import { SQL } from "bun";
+
+export type Dialect = "sqlite" | "postgres";
+
+export interface SqlDb {
+	readonly sql: SQL;
+	readonly dialect: Dialect;
+	/** A JSON member as a NUMBER-typed SQL expression, for aggregates and comparisons. */
+	jsonNum(column: string, key: string): string;
+	/** A JSON member as TEXT, for equality against string values. */
+	jsonText(column: string, key: string): string;
+	/**
+	 * A NESTED JSON member as a number, e.g. `features.anatomy.messages`.
+	 *
+	 * `jsonNum` cannot express this: SQLite takes a whole path in one string
+	 * (`'$.anatomy.messages'`), while Postgres' `->>` reads a SINGLE key, so a
+	 * dotted key silently reads NULL there — a whole report section came back
+	 * null rather than failing.
+	 */
+	jsonPathNum(column: string, path: readonly string[]): string;
+	/**
+	 * A JSON member that holds a BOOLEAN, as 1/0.
+	 *
+	 * The engines disagree twice over: SQLite's `json_extract` yields the
+	 * INTEGER 1 for JSON `true`, Postgres' `->>` yields the TEXT 'true', and
+	 * SQLite's `IN` does not coerce between them. Comparing the wrong way round
+	 * silently misclassifies every row — it counted router-ESTIMATED cache hits
+	 * as measured ones and inflated cache reliability samples by 2%.
+	 */
+	jsonBool(column: string, key: string): string;
+	/**
+	 * Substring test as a boolean expression. SQLite has `instr(haystack,
+	 * needle) > 0`; Postgres spells it `position(needle in haystack) > 0`.
+	 */
+	contains(haystack: string, needle: string): string;
+	/**
+	 * An epoch-millisecond column as a `YYYY-MM-DD` UTC day. SQLite has
+	 * `strftime(..., 'unixepoch')`; Postgres needs `to_timestamp` plus an
+	 * explicit UTC conversion, or the server's timezone silently decides which
+	 * day a turn was billed on.
+	 */
+	utcDay(msColumn: string): string;
+	/** Whether a table exists, without reading engine-specific catalog tables. */
+	tableExists(name: string): Promise<boolean>;
+	/**
+	 * Runs SQL written with `$name` placeholders, whichever way the engine
+	 * wants them numbered.
+	 *
+	 * The reporting queries are assembled from optional filters (a harness
+	 * scope, an upper time bound), which a tagged template cannot express — the
+	 * shape of the statement is decided at runtime. Rewriting them as string
+	 * concatenation with positional parameters would renumber every bind by
+	 * hand, which is how a filter ends up reading the wrong column.
+	 */
+	query<T>(text: string, binds?: Record<string, unknown>): Promise<T[]>;
+	/** `query`, for a statement that yields at most one row. */
+	one<T>(text: string, binds?: Record<string, unknown>): Promise<T | null>;
+	/** A column type that differs between engines. */
+	type(kind: "json" | "float" | "bigint"): string;
+	/**
+	 * Cast suffix for a parameter that may be NULL. Postgres refuses to infer a
+	 * type for a bare NULL placeholder ("could not determine data type of
+	 * parameter $2"), which the `(${x} IS NULL OR col = ${x})` idiom for an
+	 * optional filter relies on; SQLite has no cast syntax to add. Empty there.
+	 */
+	readonly nullableText: string;
+	/**
+	 * Two-argument scalar minimum. SQLite spells it `MIN(a, b)`; Postgres
+	 * reserves `MIN` for the aggregate and needs `LEAST(a, b)`.
+	 */
+	least(a: string, b: string): string;
+	close(): Promise<void>;
+}
+
+/**
+ * `sqlite://` (or a bare path) and `postgres://`/`postgresql://` URLs. A bare
+ * path is accepted because the router's config has always taken
+ * `ledger.path`, and a deployment that never opts into Postgres should not
+ * have to learn a URL scheme.
+ */
+export function dialectOf(url: string): Dialect {
+	return url.startsWith("postgres://") || url.startsWith("postgresql://") ? "postgres" : "sqlite";
+}
+
+export function openSqlDb(url: string): SqlDb {
+	const dialect = dialectOf(url);
+	const target = dialect === "sqlite" && !url.startsWith("sqlite:") ? `sqlite://${url}` : url;
+	const sql = new SQL(target);
+	const pg = dialect === "postgres";
+	return {
+		sql,
+		dialect,
+		jsonNum: (column, key) => (pg ? `(${column}->>'${key}')::numeric` : `json_extract(${column}, '$.${key}')`),
+		jsonText: (column, key) => (pg ? `(${column}->>'${key}')` : `json_extract(${column}, '$.${key}')`),
+		jsonPathNum: (column, path) =>
+			pg
+				? `(${column}#>>'{${path.join(",")}}')::numeric`
+				: `json_extract(${column}, '$.${path.join(".")}')`,
+		jsonBool: (column, key) =>
+			pg
+				? `CASE WHEN (${column}->>'${key}') IN ('true', '1') THEN 1 ELSE 0 END`
+				: `CASE WHEN json_extract(${column}, '$.${key}') IN (1, 'true', '1') THEN 1 ELSE 0 END`,
+		type: (kind) => {
+			if (kind === "json") return pg ? "JSONB" : "TEXT";
+			if (kind === "float") return pg ? "DOUBLE PRECISION" : "REAL";
+			return pg ? "BIGINT" : "INTEGER";
+		},
+		nullableText: pg ? "::text" : "",
+		least: (a, b) => (pg ? `LEAST(${a}, ${b})` : `MIN(${a}, ${b})`),
+		// The haystack is cast to text: a JSON column is `jsonb` on Postgres and
+		// `position()` refuses it, while sqlite stores the same column as TEXT.
+		contains: (haystack, needle) => (pg ? `position(${needle} in (${haystack})::text) > 0` : `instr(${haystack}, ${needle}) > 0`),
+		utcDay: (msColumn) =>
+			pg
+				? `to_char(to_timestamp(${msColumn} / 1000) AT TIME ZONE 'UTC', 'YYYY-MM-DD')`
+				: `strftime('%Y-%m-%d', ${msColumn} / 1000, 'unixepoch')`,
+		tableExists: async (name) => {
+			// Cheaper and more portable than either catalog table: ask for nothing
+			// from it and see whether the statement plans.
+			try {
+				await sql.unsafe(`SELECT 1 FROM ${name} WHERE 1 = 0`);
+				return true;
+			} catch {
+				return false;
+			}
+		},
+		query: async <T>(text: string, binds: Record<string, unknown> = {}): Promise<T[]> => {
+			const { text: prepared, values } = bindNamed(text, binds, pg);
+			return (await sql.unsafe(prepared, values)) as T[];
+		},
+		one: async <T>(text: string, binds: Record<string, unknown> = {}): Promise<T | null> => {
+			const { text: prepared, values } = bindNamed(text, binds, pg);
+			const rows = (await sql.unsafe(prepared, values)) as T[];
+			return rows[0] ?? null;
+		},
+		close: async () => {
+			await sql.end();
+		},
+	};
+}
+
+
+/**
+ * Rewrites `$name` placeholders to the engine's positional form, in order of
+ * first appearance, and returns the matching value array.
+ *
+ * A name may repeat — `created_at_ms >= $since` and a `CASE` on `$since` in
+ * the same statement is normal — and repeats must reuse one parameter slot on
+ * Postgres. JSON paths (`'$.isSubagent'`) are not placeholders: the pattern
+ * requires a letter or underscore after the `$`, which `$.` fails.
+ */
+export function bindNamed(text: string, binds: Record<string, unknown>, pg: boolean): { text: string; values: unknown[] } {
+	// Callers that were written against bun:sqlite pass their binds keyed WITH
+	// the sigil (`{ $since: 0 }`), which is how every reporting query in this
+	// repo already builds them; both forms resolve.
+	const valueOf = (name: string): unknown => {
+		if (name in binds) return binds[name];
+		const sigil = `$${name}`;
+		if (sigil in binds) return binds[sigil];
+		throw new Error(`sql: no value bound for $${name}`);
+	};
+	const order: string[] = [];
+	const prepared = text.replace(/\$([a-zA-Z_][a-zA-Z0-9_]*)/g, (_match, name: string) => {
+		valueOf(name);
+		let index = order.indexOf(name);
+		if (index === -1) {
+			order.push(name);
+			index = order.length - 1;
+		}
+		return pg ? `$${index + 1}` : "?";
+	});
+	if (!pg) {
+		// SQLite's positional `?` cannot reuse a slot, so a repeated name is
+		// bound once per occurrence rather than once per name.
+		const values: unknown[] = [];
+		text.replace(/\$([a-zA-Z_][a-zA-Z0-9_]*)/g, (_match, name: string) => {
+			values.push(valueOf(name));
+			return "";
+		});
+		return { text: prepared, values };
+	}
+	return { text: prepared, values: order.map(valueOf) };
+}
+
+/**
+ * Coerces a value Postgres may have returned as a string. Applied at every
+ * numeric read: `Number(null)` is 0, which is wrong for a nullable aggregate,
+ * so null and undefined are preserved.
+ */
+export function num(value: unknown): number {
+	return typeof value === "number" ? value : Number(value ?? 0);
+}
+
+/** `num`, but a missing value stays missing rather than becoming 0. */
+export function numOrNull(value: unknown): number | null {
+	if (value === null || value === undefined) return null;
+	return typeof value === "number" ? value : Number(value);
+}
+
+/**
+ * JSON for a `json` column. Postgres' driver encodes a JS string destined for
+ * `JSONB` as a JSON *string* — `jsonb_typeof` reads `'string'` and every
+ * `->>` on it returns NULL — so an object must be passed through unstringified
+ * there, while SQLite's TEXT column needs the serialised form.
+ */
+export function jsonParam(db: SqlDb, value: unknown): unknown {
+	if (value === null || value === undefined) return null;
+	return db.dialect === "postgres" ? value : JSON.stringify(value);
+}
+
+/** Reads a `json` column back, whichever way it was stored. */
+export function jsonValue<T>(value: unknown): T | null {
+	if (value === null || value === undefined) return null;
+	if (typeof value === "string") {
+		try {
+			return JSON.parse(value) as T;
+		} catch {
+			return null;
+		}
+	}
+	return value as T;
+}

package/src/wire/anthropic/messages.ts

@@ -25,8 +25,7 @@
  */
 
 import { encoder, sseDataFrame } from "../../util/sse.ts";
-import type { Ledger } from "../../cost/types.ts";
-import { estimateTokens } from "../../tokens/estimate.ts";
+import { estimateTokens, type TokenRatio } from "../../tokens/estimate.ts";
 import type { NormRequest, ResponseSink, TurnSummary, UpstreamChunk, WireError } from "../types.ts";
 import { invalidRequest, WireErrorException } from "../openai/errors.ts";
 import { parseChatRequest } from "../openai/request.ts";
@@ -217,9 +216,9 @@ export function parseMessagesRequest(body: unknown, headers: Headers, models: Re
 }
 
 /** `POST /v1/messages/count_tokens`: the router's own estimate over the prompt bytes. */
-export function countAnthropicTokens(body: unknown, models: Record<string, string>, ledger: Ledger | null): number {
+export function countAnthropicTokens(body: unknown, models: Record<string, string>, ratio: TokenRatio): number {
 	const norm = parseChatRequest(messagesToChatBody({ ...(isRec(body) ? body : {}), stream: false }, models), new Headers());
-	return estimateTokens(norm.promptBytes, "anthropic", ledger);
+	return estimateTokens(norm.promptBytes, "anthropic", ratio);
 }
 
 // ---------------------------------------------------------------------------

package/src/wire/openai/request.ts

@@ -315,6 +315,31 @@ export function parsePolicyHeader(raw: string | null): RequestPolicy | undefined
 	return Object.keys(out).length === 0 ? undefined : out;
 }
 
+/**
+ * Parses the X-Omp-Upstream-Keys header: `{ "<upstream id>": "<credential>" }`.
+ * Malformed, not an object, or empty ⇒ no overrides, exactly like a malformed
+ * X-Omp-Policy (never a rejected turn — the configured keys still serve).
+ * Non-string values are dropped; `""` is KEPT, meaning "this turn has no
+ * credential for that upstream", which excludes it from selection.
+ */
+export function parseUpstreamKeysHeader(raw: string | null): Record<string, string> | undefined {
+	if (raw === null || raw.trim() === "") return undefined;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return undefined;
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+	const out: Record<string, string> = {};
+	for (const [id, value] of Object.entries(parsed as Record<string, unknown>)) {
+		// The id is config-shaped, so trim it; the credential is copied verbatim.
+		const key = id.trim();
+		if (key !== "" && typeof value === "string") out[key] = value;
+	}
+	return Object.keys(out).length === 0 ? undefined : out;
+}
+
 export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	if (typeof body !== "object" || body === null || Array.isArray(body)) {
 		throw invalidRequest("Request body must be a JSON object");
@@ -352,6 +377,9 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 	// Per-request routing policy (team edition): JSON in X-Omp-Policy.
 	const policy = parsePolicyHeader(headers.get("x-omp-policy"));
 
+	// Per-turn upstream credentials (team edition): JSON in X-Omp-Upstream-Keys.
+	const upstreamKeys = parseUpstreamKeysHeader(headers.get("x-omp-upstream-keys"));
+
 	if (typeof b.model !== "string" || b.model.length === 0) {
 		throw invalidRequest("model must be a non-empty string");
 	}
@@ -417,7 +445,9 @@ export function parseChatRequest(body: unknown, headers: Headers): NormRequest {
 		agentdoxOrigin,
 		isSubagent,
 		...(policy === undefined ? {} : { policy }),
+		...(upstreamKeys === undefined ? {} : { upstreamKeys }),
 		requestedModel,
+		requestedModelFull: b.model,
 		messages,
 		tools,
 		forcedToolChoice,