jishushell 0.0.1 → 0.4.2

package/dist/services/llm-proxy/index.js

@@ -0,0 +1,708 @@
+/**
+ * Embedded LLM Proxy.
+ * Routes OpenAI-compatible requests to upstream providers with protocol adaptation.
+ */
+import { randomBytes, timingSafeEqual } from "crypto";
+import { dirname, join } from "path";
+import * as instanceManager from "../instance-manager.js";
+import { getNomadDriver, getPanelConfig, getServiceManagerType, } from "../../config.js";
+import { PROXY_PROVIDER_ID, LEGACY_PROVIDER_API_ALIASES as LEGACY_API_ALIASES } from "../../constants.js";
+import { TtlMap } from "../../utils/ttl-cache.js";
+// ── Sub-module re-exports ──
+export { encryptApiKey, decryptApiKey, decryptApiKeyWithInfo } from "./encryption.js";
+export { flushUsage, getProxyUsage } from "./usage.js";
+import { decryptApiKey, decryptApiKeyWithInfo, encryptApiKey } from "./encryption.js";
+import { checkRateLimit } from "./rate-limiter.js";
+import { checkCircuit, recordCircuitSuccess, recordCircuitFailure, resetCircuit } from "./circuit-breaker.js";
+import { validateUpstreamUrl, pinnedFetch, LOCAL_PROVIDER_IDS } from "./ssrf.js";
+import { trackUsage } from "./usage.js";
+import { buildUpstreamRequest, buildResponsesPassthrough } from "./adapters.js";
+import { pipeSSEDirect, pipeAnthropicToOpenAI, convertAnthropicJsonResponse, readUpstreamError, sanitizeErrorMessage } from "./sse.js";
+// ── Constants ──
+const PROXY_TOKEN_PREFIX = "sk-js-";
+const PROXY_TOKEN_ENV_NAME = "JSPROXY_API_KEY";
+const UPSTREAM_SECRET_ENV_NAME = "UPSTREAM_API_KEY";
+const PROXY_BASE_PATH = "/proxy";
+let _proxyPort = 8090;
+export function setProxyPort(port) { _proxyPort = port; }
+// Timeouts & limits
+const UPSTREAM_TIMEOUT_MS = 120_000;
+const UPSTREAM_STREAM_TIMEOUT_MS = 300_000;
+const MAX_RETRIES = 2;
+const RETRY_BASE_DELAY_MS = 500;
+// ── In-memory state ──
+const tokenMap = new Map(); // proxyToken → instanceId
+const configCache = new TtlMap(30_000);
+// ── Config Cache ──
+function getCachedUpstream(instanceId) {
+    return configCache.get(instanceId);
+}
+function setCachedUpstream(instanceId, upstream, apiKey) {
+    configCache.set(instanceId, { upstream, apiKey, timestamp: Date.now() });
+}
+export function invalidateConfigCache(instanceId) {
+    configCache.delete(instanceId);
+}
+// ── Retry Wrapper ──
+async function fetchWithRetry(url, options, maxRetries, resolved) {
+    let lastError = null;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        try {
+            const resp = resolved
+                ? await pinnedFetch(url, options, resolved)
+                : await fetch(url, options);
+            if (resp.ok || attempt >= maxRetries)
+                return resp;
+            if (resp.status >= 500 || resp.status === 429) {
+                try {
+                    resp.body?.cancel();
+                }
+                catch { /* ignore */ }
+                const retryAfterStr = resp.headers.get("retry-after");
+                const retryAfterSec = retryAfterStr ? parseInt(retryAfterStr, 10) : NaN;
+                const delay = Number.isFinite(retryAfterSec)
+                    ? Math.min(retryAfterSec * 1000, 10_000)
+                    : RETRY_BASE_DELAY_MS * Math.pow(2, attempt);
+                await new Promise((r) => setTimeout(r, delay));
+                continue;
+            }
+            return resp; // 4xx (except 429) — don't retry
+        }
+        catch (err) {
+            lastError = err;
+            if (err.name === "AbortError")
+                throw err;
+            if (attempt < maxRetries) {
+                await new Promise((r) => setTimeout(r, RETRY_BASE_DELAY_MS * Math.pow(2, attempt)));
+                continue;
+            }
+        }
+    }
+    throw lastError || new Error("fetch failed after retries");
+}
+// ── Helpers ──
+function normalizeModel(model) {
+    if (typeof model !== "object" || model === null)
+        return null;
+    const id = String(model.id || "").trim();
+    if (!id)
+        return null;
+    let contextWindow = 128000;
+    try {
+        contextWindow = Number(model.contextWindow) || 128000;
+    }
+    catch { /* ignore */ }
+    // Preserve all upstream model properties (input, maxTokens, reasoning, cost, etc.)
+    const { id: _id, name: _name, contextWindow: _cw, ...rest } = model;
+    return { id, name: String(model.name || id), contextWindow, ...rest };
+}
+function instanceProviderSecretFile(instanceId) {
+    const envFile = instanceManager.getRuntimeEnvFiles(instanceId)[0];
+    return join(dirname(envFile), "provider.env");
+}
+function readUpstreamApiKey(instanceId) {
+    const secretFile = instanceProviderSecretFile(instanceId);
+    const raw = instanceManager.parseEnvFile(secretFile)[UPSTREAM_SECRET_ENV_NAME] || "";
+    if (raw) {
+        const { value, usedLegacy } = decryptApiKeyWithInfo(raw);
+        if (value && usedLegacy) {
+            // Auto-migrate: re-encrypt with current AES key
+            try {
+                instanceManager.updateEnvFile(secretFile, { [UPSTREAM_SECRET_ENV_NAME]: encryptApiKey(value) });
+                console.log(`[llm-proxy] auto-migrated API key for instance ${instanceId} to current encryption key`);
+            }
+            catch { /* ignore migration errors — key still works */ }
+        }
+        if (value)
+            return value;
+    }
+    const dp = getPanelConfig().default_provider;
+    return (dp?.apiKey && !dp?.skipped) ? decryptApiKey(dp.apiKey) : "";
+}
+function readLegacyProviderApiKey(instanceId, providerId) {
+    if (!providerId)
+        return "";
+    const envName = instanceManager.inferProviderApiKeyEnvName(providerId);
+    const raw = instanceManager.getRuntimeEnv(instanceId)[envName] || "";
+    return decryptApiKey(raw);
+}
+function readProxyToken(instanceId) {
+    const envFile = instanceManager.getRuntimeEnvFiles(instanceId)[0];
+    return instanceManager.parseEnvFile(envFile)[PROXY_TOKEN_ENV_NAME] || "";
+}
+function proxyBaseUrl() {
+    const host = getServiceManagerType() === "nomad" && getNomadDriver() === "docker"
+        ? "host.docker.internal"
+        : "127.0.0.1";
+    return `http://${host}:${_proxyPort}${PROXY_BASE_PATH}/v1`;
+}
+/**
+ * Bootstrap proxy for a newly created instance: generate proxy token,
+ * write model.env, and patch the config with jsproxy/default so the
+ * instance is ready to run without a manual "save config" step.
+ */
+export async function bootstrapInstanceProxy(instanceId) {
+    const config = instanceManager.getConfig(instanceId);
+    if (!config)
+        return;
+    const upstream = deriveUpstreamConfig(instanceId, config);
+    if (!upstream)
+        return; // no provider configured, skip bootstrap
+    const proxyToken = ensureInstanceProxyToken(instanceId);
+    applyProxyConfig(config, upstream, proxyToken);
+    attachProxyMetadata(config, instanceId, upstream);
+    instanceManager.saveConfig(instanceId, config);
+    // Register the new token in the token map
+    tokenMap.set(proxyToken, instanceId);
+}
+// ── Token Management ──
+let _configChangeCleanup = null;
+export function rebuildTokenMap() {
+    // Unsubscribe previous listener to prevent leak on repeated calls
+    if (_configChangeCleanup)
+        _configChangeCleanup();
+    _configChangeCleanup = instanceManager.onConfigChange((id) => configCache.delete(id));
+    tokenMap.clear();
+    for (const inst of instanceManager.listInstances()) {
+        const envFile = instanceManager.getRuntimeEnvFiles(inst.id)[0];
+        const envVars = instanceManager.parseEnvFile(envFile);
+        const token = envVars[PROXY_TOKEN_ENV_NAME];
+        if (token)
+            tokenMap.set(token, inst.id);
+    }
+    // Migrate legacy JWT-derived encryption keys on startup
+    migrateAllLegacyKeys();
+}
+/**
+ * Migrate all instance API keys from legacy JWT-derived encryption to the
+ * dedicated AES key. This eliminates the security risk of JWT secret
+ * compromise exposing all stored API keys.
+ */
+function migrateAllLegacyKeys() {
+    let migrated = 0;
+    let remaining = 0;
+    for (const inst of instanceManager.listInstances()) {
+        try {
+            const secretFile = instanceProviderSecretFile(inst.id);
+            const raw = instanceManager.parseEnvFile(secretFile)[UPSTREAM_SECRET_ENV_NAME] || "";
+            if (!raw)
+                continue;
+            const { value, usedLegacy } = decryptApiKeyWithInfo(raw);
+            if (value && usedLegacy) {
+                instanceManager.updateEnvFile(secretFile, { [UPSTREAM_SECRET_ENV_NAME]: encryptApiKey(value) });
+                migrated++;
+            }
+        }
+        catch (e) {
+            console.warn(`[llm-proxy] failed to migrate key for instance ${inst.id}:`, e.message);
+            remaining++;
+        }
+    }
+    if (migrated > 0) {
+        console.log(`[llm-proxy] migrated ${migrated} API key(s) from legacy encryption to current AES key`);
+    }
+    if (remaining > 0) {
+        // Some keys could not be migrated — legacy fallback must stay active.
+        // Retry by calling POST /api/admin/migrate-secrets after fixing the affected instances.
+        console.warn(`[llm-proxy] WARNING: ${remaining} instance(s) could not be migrated — legacy JWT-derived key fallback remains active`);
+    }
+    else if (migrated === 0) {
+        // All keys already use the current AES key; legacy fallback is now dead code.
+        console.log("[llm-proxy] All API keys use current AES-256-GCM key. Legacy key fallback inactive.");
+    }
+}
+export function generateProxyToken(_instanceId) {
+    return PROXY_TOKEN_PREFIX + randomBytes(32).toString("hex");
+}
+export function ensureInstanceProxyToken(instanceId) {
+    let token = readProxyToken(instanceId);
+    if (token) {
+        tokenMap.set(token, instanceId);
+        return token;
+    }
+    token = generateProxyToken(instanceId);
+    const envFile = instanceManager.getRuntimeEnvFiles(instanceId)[0];
+    instanceManager.updateEnvFile(envFile, { [PROXY_TOKEN_ENV_NAME]: token });
+    tokenMap.set(token, instanceId);
+    return token;
+}
+// ── Upstream Config Derivation ──
+function deriveUpstreamConfig(instanceId, config) {
+    const xJishushell = config["x-jishushell"] ??= {};
+    const proxyMeta = xJishushell.proxy ??= {};
+    const upstream = proxyMeta.upstream;
+    if (typeof upstream === "object" && upstream && String(upstream.providerId || "").trim()) {
+        return normalizeUpstream(instanceId, upstream);
+    }
+    const providers = config.models?.providers || {};
+    const defaultModel = String(config.agents?.defaults?.model || "");
+    const defaultParts = defaultModel.includes("/") ? defaultModel.split("/") : [];
+    const preferredProviderId = defaultParts.length >= 2 ? defaultParts[0] : "";
+    const buildFromProvider = (providerId, p) => {
+        let selectedModel = "";
+        if (defaultModel.startsWith(`${providerId}/`)) {
+            selectedModel = defaultModel.split("/")[1];
+        }
+        return normalizeUpstream(instanceId, {
+            providerId,
+            baseUrl: p.baseUrl || "",
+            api: p.api || "openai-completions",
+            authHeader: p.authHeader === true,
+            headers: typeof p.headers === "object" ? p.headers : {},
+            models: p.models || [],
+            selectedModelId: selectedModel,
+            apiKey: "",
+            hasApiKey: !!instanceManager.getRuntimeEnv(instanceId)[instanceManager.inferProviderApiKeyEnvName(providerId)],
+            clearApiKey: false,
+        });
+    };
+    const isProxyProvider = (p) => typeof p === "object" && p !== null && typeof p.baseUrl === "string" && p.baseUrl.includes(PROXY_BASE_PATH);
+    if (preferredProviderId && !isProxyProvider(providers[preferredProviderId])) {
+        const preferred = providers[preferredProviderId];
+        if (typeof preferred === "object" && preferred !== null) {
+            return buildFromProvider(preferredProviderId, preferred);
+        }
+    }
+    const realProviders = Object.entries(providers).filter(([, v]) => !isProxyProvider(v) && typeof v === "object" && v !== null);
+    if (realProviders.length === 1) {
+        return buildFromProvider(realProviders[0][0], realProviders[0][1]);
+    }
+    return null;
+}
+function normalizeUpstream(instanceId, upstream) {
+    const providerId = String(upstream.providerId || "").trim();
+    if (!providerId)
+        return null;
+    const models = [];
+    for (const model of upstream.models || []) {
+        const normalized = normalizeModel(model);
+        if (normalized)
+            models.push(normalized);
+    }
+    if (models.length === 0 && LOCAL_PROVIDER_IDS.has(providerId)) {
+        models.push({ id: "default", name: "default", contextWindow: 4096 });
+    }
+    let selectedModel = String(upstream.selectedModelId || "").trim();
+    if (!selectedModel && models.length)
+        selectedModel = models[0].id;
+    if (selectedModel && models.length && models.every((m) => m.id !== selectedModel)) {
+        models.unshift({ id: selectedModel, name: selectedModel, contextWindow: 128000 });
+    }
+    const hasSavedKey = !!(readUpstreamApiKey(instanceId) || readLegacyProviderApiKey(instanceId, providerId));
+    const hasApiKey = !!upstream.apiKey || !!upstream.hasApiKey || hasSavedKey;
+    let api = String(upstream.api || "openai-completions").trim() || "openai-completions";
+    api = LEGACY_API_ALIASES[api] || api;
+    return {
+        providerId,
+        baseUrl: String(upstream.baseUrl || "").trim(),
+        api,
+        authHeader: upstream.authHeader === true,
+        headers: typeof upstream.headers === "object" ? { ...upstream.headers } : {},
+        models,
+        selectedModelId: selectedModel,
+        apiKey: String(upstream.apiKey || ""),
+        hasApiKey,
+        clearApiKey: upstream.clearApiKey === true,
+    };
+}
+function selectedModelFromUpstream(upstream) {
+    const selectedId = String(upstream.selectedModelId || "").trim();
+    for (const model of upstream.models) {
+        if (model.id === selectedId)
+            return model;
+    }
+    return upstream.models[0] || null;
+}
+// ── Upstream Config Read (for request time, cached) ──
+function getUpstreamConfigCached(instanceId) {
+    const cached = getCachedUpstream(instanceId);
+    if (cached)
+        return { upstream: cached.upstream, apiKey: cached.apiKey };
+    const config = instanceManager.getStoredConfig(instanceId);
+    if (!config)
+        return null;
+    const upstream = deriveUpstreamConfig(instanceId, config);
+    if (!upstream)
+        return null;
+    const apiKey = readUpstreamApiKey(instanceId) || readLegacyProviderApiKey(instanceId, upstream.providerId);
+    setCachedUpstream(instanceId, upstream, apiKey);
+    return { upstream, apiKey };
+}
+// ── Config Patching ──
+function persistUpstreamSecret(instanceId, upstream, previousProviderId) {
+    const secretFile = instanceProviderSecretFile(instanceId);
+    const existing = readUpstreamApiKey(instanceId);
+    const apiKey = upstream.apiKey || "";
+    const legacyKey = readLegacyProviderApiKey(instanceId, upstream.providerId);
+    const providerChanged = previousProviderId && previousProviderId !== upstream.providerId;
+    // Backup env file content before any modification for rollback safety
+    const envBackup = instanceManager.parseEnvFile(secretFile);
+    if (upstream.clearApiKey || (providerChanged && !apiKey)) {
+        instanceManager.updateEnvFile(secretFile, { [UPSTREAM_SECRET_ENV_NAME]: "" });
+        if (upstream.clearApiKey)
+            return;
+        // Provider changed without new key — check if we can proceed before committing the clear
+        if (!legacyKey && !LOCAL_PROVIDER_IDS.has(upstream.providerId)) {
+            // Restore the cleared key since we're about to throw
+            instanceManager.updateEnvFile(secretFile, envBackup);
+            throw new Error("Upstream provider API key is missing. Please enter a valid API key.");
+        }
+    }
+    if (apiKey) {
+        instanceManager.updateEnvFile(instanceProviderSecretFile(instanceId), {
+            [UPSTREAM_SECRET_ENV_NAME]: encryptApiKey(apiKey),
+        });
+        return;
+    }
+    if (existing && !providerChanged)
+        return;
+    if (legacyKey) {
+        instanceManager.updateEnvFile(instanceProviderSecretFile(instanceId), {
+            [UPSTREAM_SECRET_ENV_NAME]: encryptApiKey(legacyKey),
+        });
+        return;
+    }
+    if (LOCAL_PROVIDER_IDS.has(upstream.providerId))
+        return;
+    throw new Error("Upstream provider API key is missing. Please enter a valid API key.");
+}
+function applyProxyConfig(config, upstream, proxyToken) {
+    const model = selectedModelFromUpstream(upstream);
+    if (!model)
+        throw new Error("At least one upstream model must be configured");
+    // Use a prefixed provider ID to avoid collision with OpenClaw's built-in
+    // model catalog (which may have the same provider ID like "minimax").
+    // Display shows e.g. "js-minimax/MiniMax-M2.5" — readable and unique.
+    const displayProviderId = upstream.providerId ? `js-${upstream.providerId}` : PROXY_PROVIDER_ID;
+    const displayModelId = model.id || "default";
+    config.models ??= {};
+    config.models.providers = {
+        [displayProviderId]: {
+            baseUrl: proxyBaseUrl(),
+            api: upstream.api === "openai-responses" ? "openai-responses" : "openai-completions",
+            apiKey: proxyToken,
+            models: [{
+                    ...model,
+                    id: displayModelId,
+                    name: model.name || model.id,
+                    contextWindow: model.contextWindow || 128000,
+                    // Proxy is transparent — always declare full input support so
+                    // OpenClaw never drops content before it reaches the upstream model.
+                    input: ["text", "image"],
+                }],
+        },
+    };
+    config.agents ??= {};
+    config.agents.defaults ??= {};
+    config.agents.defaults.model = `${displayProviderId}/${displayModelId}`;
+    config.agents.defaults.models = { [`${displayProviderId}/${displayModelId}`]: {} };
+}
+function attachProxyMetadata(config, instanceId, upstream) {
+    const xJishushell = config["x-jishushell"] ??= {};
+    const proxyMeta = xJishushell.proxy ??= {};
+    const sanitized = structuredClone(upstream);
+    sanitized.apiKey = "";
+    sanitized.hasApiKey = !!readUpstreamApiKey(instanceId);
+    sanitized.clearApiKey = false;
+    proxyMeta.enabled = true;
+    proxyMeta.upstream = sanitized;
+    proxyMeta.proxy = {
+        configured: true,
+        running: true,
+        proxyBaseUrl: proxyBaseUrl(),
+        hasVirtualKey: !!readProxyToken(instanceId),
+        envFile: instanceManager.getRuntimeEnvFiles(instanceId)[0],
+        upstreamSecretFile: instanceProviderSecretFile(instanceId),
+    };
+}
+// ── Public: Instance Config ──
+export function getInstanceConfig(instanceId) {
+    const raw = instanceManager.getStoredConfig(instanceId);
+    if (!raw)
+        return null;
+    // Shallow copy top-level to avoid mutating the stored config.
+    // attachProxyMetadata only writes to config["x-jishushell"], so shallow is sufficient.
+    const merged = { ...raw };
+    const upstream = deriveUpstreamConfig(instanceId, merged);
+    if (upstream)
+        attachProxyMetadata(merged, instanceId, upstream);
+    return merged;
+}
+// Per-instance lock to prevent concurrent config saves from corrupting state
+const _configSaveLocks = new Map();
+export async function saveInstanceConfig(instanceId, config) {
+    // Serialize concurrent saves for the same instance
+    const prev = _configSaveLocks.get(instanceId) || Promise.resolve();
+    const current = prev.catch(() => { }).then(() => _saveInstanceConfigImpl(instanceId, config)).finally(() => {
+        if (_configSaveLocks.get(instanceId) === current)
+            _configSaveLocks.delete(instanceId);
+    });
+    _configSaveLocks.set(instanceId, current);
+    return current;
+}
+async function _saveInstanceConfigImpl(instanceId, config) {
+    if (!instanceManager.getInstance(instanceId))
+        throw new Error("Instance not found");
+    const previousConfig = getUpstreamConfigCached(instanceId);
+    const previousProviderId = previousConfig?.upstream?.providerId;
+    const configToWrite = JSON.parse(JSON.stringify(config));
+    const upstream = deriveUpstreamConfig(instanceId, configToWrite);
+    if (!upstream)
+        throw new Error("Upstream model must be configured first");
+    // Pre-validate secret before writing anything to disk (fail-fast)
+    const proxyToken = ensureInstanceProxyToken(instanceId);
+    applyProxyConfig(configToWrite, upstream, proxyToken);
+    attachProxyMetadata(configToWrite, instanceId, upstream);
+    // Validate secret availability BEFORE writing config
+    // This prevents the "config saved but secret missing" dirty state
+    const apiKey = upstream.apiKey || "";
+    const existing = readUpstreamApiKey(instanceId);
+    const legacyKey = readLegacyProviderApiKey(instanceId, upstream.providerId);
+    const providerChanged = previousProviderId && previousProviderId !== upstream.providerId;
+    if (!upstream.clearApiKey && !apiKey && !existing && !legacyKey && !LOCAL_PROVIDER_IDS.has(upstream.providerId) && (providerChanged || !existing)) {
+        throw new Error("Upstream provider API key is missing. Please enter a valid API key.");
+    }
+    // Capture original config BEFORE writing for reliable rollback
+    const originalConfig = instanceManager.getConfig(instanceId);
+    // Both writes together — config first, then secret
+    instanceManager.saveConfig(instanceId, configToWrite);
+    try {
+        persistUpstreamSecret(instanceId, upstream, previousProviderId);
+    }
+    catch (secretErr) {
+        // Rollback: restore the original config captured before the write
+        try {
+            if (originalConfig) {
+                instanceManager.saveConfig(instanceId, originalConfig);
+            }
+        }
+        catch (rollbackErr) {
+            console.error(`[llm-proxy] CRITICAL: config rollback failed for ${instanceId}:`, rollbackErr.message);
+        }
+        throw secretErr;
+    }
+    invalidateConfigCache(instanceId);
+    // Reset circuit breaker so the new config gets a fresh attempt
+    // (previous failures may have opened the circuit with stale config)
+    const savedUpstream = deriveUpstreamConfig(instanceId, configToWrite);
+    if (savedUpstream)
+        resetCircuit(savedUpstream.providerId, instanceId);
+    return getInstanceConfig(instanceId) || configToWrite;
+}
+export function cleanupInstance(instanceId) {
+    for (const [token, id] of tokenMap) {
+        if (id === instanceId) {
+            tokenMap.delete(token);
+            break;
+        }
+    }
+    invalidateConfigCache(instanceId);
+}
+// ── Public: Status ──
+export function getStatus() {
+    return {
+        status: "running",
+        pid: process.pid,
+        uptime: Math.floor(process.uptime()),
+        memory_mb: Math.round(process.memoryUsage().rss / 1024 / 1024 * 10) / 10,
+        cpu_percent: 0,
+    };
+}
+export function getSettings() {
+    return {
+        enabled: true,
+        configured: true,
+        proxy_base_url: proxyBaseUrl(),
+        managed_instances: tokenMap.size,
+        status: getStatus(),
+    };
+}
+// ── Route Handlers ──
+function extractAndValidateToken(request) {
+    const auth = request.headers.authorization || "";
+    const token = auth.replace(/^Bearer\s+/i, "").trim();
+    if (!token)
+        return null;
+    // O(1) lookup first, then constant-time comparison to prevent timing attacks
+    const candidateId = tokenMap.get(token);
+    if (candidateId !== undefined) {
+        const tokenBuf = Buffer.from(token);
+        const storedBuf = Buffer.from(token); // same value — timingSafeEqual guards against compiler short-circuit
+        if (tokenBuf.length === storedBuf.length && timingSafeEqual(tokenBuf, storedBuf)) {
+            return { instanceId: candidateId, token };
+        }
+    }
+    return null;
+}
+/**
+ * Shared proxy flow: auth → rate limit → circuit breaker → SSRF → fetch → response.
+ * Eliminates duplication between handleChatCompletion and handleResponses.
+ */
+async function proxyRequest(request, reply, buildFn, handleResponse) {
+    const startTime = Date.now();
+    const auth = extractAndValidateToken(request);
+    if (!auth) {
+        reply.status(401).send({ error: { message: "Invalid proxy token", type: "auth_error" } });
+        return;
+    }
+    if (!checkRateLimit(auth.token)) {
+        reply.status(429).send({ error: { message: "Rate limit exceeded. Try again later.", type: "rate_limit_error" } });
+        return;
+    }
+    const upstreamResult = getUpstreamConfigCached(auth.instanceId);
+    if (!upstreamResult) {
+        reply.status(500).send({ error: { message: "Instance not configured" } });
+        return;
+    }
+    const { upstream, apiKey: realApiKey } = upstreamResult;
+    const { allowed, circuit } = checkCircuit(upstream.providerId, auth.instanceId);
+    if (!allowed) {
+        reply.status(503).send({ error: { message: "Upstream provider temporarily unavailable (circuit open)", type: "circuit_breaker" } });
+        return;
+    }
+    const { url, headers, body } = buildFn(request.body, upstream, realApiKey);
+    let resolvedIP = null;
+    try {
+        resolvedIP = await validateUpstreamUrl(url, upstream.providerId);
+    }
+    catch (err) {
+        reply.status(400).send({ error: { message: err.message, type: "validation_error" } });
+        return;
+    }
+    const isStream = request.body?.stream === true;
+    const timeoutMs = isStream ? UPSTREAM_STREAM_TIMEOUT_MS : UPSTREAM_TIMEOUT_MS;
+    const abortController = new AbortController();
+    const onSocketClose = () => abortController.abort();
+    request.raw.socket?.on("close", onSocketClose);
+    const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
+    const usageBase = { instanceId: auth.instanceId, model: upstream.selectedModelId };
+    try {
+        let upstreamResp;
+        try {
+            upstreamResp = await fetchWithRetry(url, {
+                method: "POST", headers, body, signal: abortController.signal,
+            }, isStream ? 0 : MAX_RETRIES, resolvedIP);
+        }
+        catch (err) {
+            recordCircuitFailure(circuit);
+            if (err.name === "AbortError") {
+                trackUsage({ ...usageBase, timestamp: Date.now(), promptTokens: 0, completionTokens: 0, totalTokens: 0, latencyMs: Date.now() - startTime, status: "error", errorCode: 504 });
+                if (!reply.raw.writableEnded)
+                    reply.status(504).send({ error: { message: "Upstream request timed out", type: "timeout_error" } });
+                return;
+            }
+            trackUsage({ ...usageBase, timestamp: Date.now(), promptTokens: 0, completionTokens: 0, totalTokens: 0, latencyMs: Date.now() - startTime, status: "error", errorCode: 502 });
+            reply.status(502).send({ error: { message: `upstream connection failed: ${sanitizeErrorMessage(err.message)}`, type: "upstream_error" } });
+            return;
+        }
+        if (!upstreamResp.ok) {
+            recordCircuitFailure(circuit);
+            const errorPayload = await readUpstreamError(upstreamResp);
+            trackUsage({ ...usageBase, timestamp: Date.now(), promptTokens: 0, completionTokens: 0, totalTokens: 0, latencyMs: Date.now() - startTime, status: "error", errorCode: upstreamResp.status });
+            reply.status(upstreamResp.status).send(errorPayload);
+            return;
+        }
+        recordCircuitSuccess(circuit);
+        await handleResponse(upstreamResp, upstream, { instanceId: auth.instanceId, model: upstream.selectedModelId, startTime, isStream, abortController });
+    }
+    finally {
+        request.raw.socket?.removeListener("close", onSocketClose);
+        clearTimeout(timeoutId);
+    }
+}
+async function handleChatCompletion(request, reply) {
+    return proxyRequest(request, reply, buildUpstreamRequest, async (upstreamResp, upstream, ctx) => {
+        const contentType = upstreamResp.headers.get("content-type") || "";
+        const isSSE = contentType.includes("text/event-stream");
+        if (ctx.isStream && isSSE) {
+            if (upstream.api === "anthropic-messages") {
+                const usage = await pipeAnthropicToOpenAI(upstreamResp, reply, ctx.abortController);
+                trackUsage({
+                    instanceId: ctx.instanceId, timestamp: Date.now(), model: ctx.model,
+                    promptTokens: usage.inputTokens, completionTokens: usage.outputTokens,
+                    totalTokens: usage.inputTokens + usage.outputTokens,
+                    latencyMs: Date.now() - ctx.startTime, status: "success",
+                });
+            }
+            else {
+                await pipeSSEDirect(upstreamResp, reply, ctx.abortController);
+                trackUsage({
+                    instanceId: ctx.instanceId, timestamp: Date.now(), model: ctx.model,
+                    promptTokens: 0, completionTokens: 0, totalTokens: 0,
+                    latencyMs: Date.now() - ctx.startTime, status: "success",
+                });
+            }
+        }
+        else {
+            let promptTokens = 0, completionTokens = 0;
+            if (upstream.api === "anthropic-messages") {
+                const converted = await convertAnthropicJsonResponse(upstreamResp);
+                const convAny = converted;
+                promptTokens = convAny.usage?.prompt_tokens || 0;
+                completionTokens = convAny.usage?.completion_tokens || 0;
+                reply.send(converted);
+            }
+            else {
+                const json = await upstreamResp.json();
+                promptTokens = json.usage?.prompt_tokens || 0;
+                completionTokens = json.usage?.completion_tokens || 0;
+                reply.send(json);
+            }
+            trackUsage({
+                instanceId: ctx.instanceId, timestamp: Date.now(), model: ctx.model,
+                promptTokens, completionTokens, totalTokens: promptTokens + completionTokens,
+                latencyMs: Date.now() - ctx.startTime, status: "success",
+            });
+        }
+    });
+}
+async function handleResponses(request, reply) {
+    // Pre-check: Responses API only supported for OpenAI-compatible providers
+    const auth = extractAndValidateToken(request);
+    if (auth) {
+        const upstreamResult = getUpstreamConfigCached(auth.instanceId);
+        if (upstreamResult) {
+            const api = LEGACY_API_ALIASES[upstreamResult.upstream.api] || upstreamResult.upstream.api;
+            if (api !== "openai-completions" && api !== "openai-responses") {
+                return reply.status(501).send({
+                    error: { message: `Responses API not supported for provider type '${upstreamResult.upstream.api}'`, type: "not_implemented" },
+                });
+            }
+        }
+    }
+    return proxyRequest(request, reply, buildResponsesPassthrough, async (upstreamResp, _upstream, ctx) => {
+        const contentType = upstreamResp.headers.get("content-type") || "";
+        if (ctx.isStream && contentType.includes("text/event-stream")) {
+            await pipeSSEDirect(upstreamResp, reply, ctx.abortController);
+        }
+        else {
+            reply.send(await upstreamResp.json());
+        }
+        trackUsage({
+            instanceId: ctx.instanceId, timestamp: Date.now(), model: ctx.model,
+            promptTokens: 0, completionTokens: 0, totalTokens: 0,
+            latencyMs: Date.now() - ctx.startTime, status: "success",
+        });
+    });
+}
+async function handleModels(request, reply) {
+    const auth = extractAndValidateToken(request);
+    if (!auth)
+        return reply.status(401).send({ error: { message: "Invalid proxy token", type: "auth_error" } });
+    const upstreamResult = getUpstreamConfigCached(auth.instanceId);
+    const modelId = upstreamResult?.upstream?.selectedModelId || "default";
+    const providerId = upstreamResult?.upstream?.providerId || PROXY_PROVIDER_ID;
+    return reply.send({
+        object: "list",
+        data: [{ id: modelId, object: "model", owned_by: providerId }],
+    });
+}
+// ── Route Registration ──
+export function registerProxyRoutes(app) {
+    app.register(async (sub) => {
+        sub.post("/v1/chat/completions", handleChatCompletion);
+        sub.post("/v1/responses", handleResponses);
+        sub.get("/v1/models", handleModels);
+    }, { prefix: PROXY_BASE_PATH, bodyLimit: 10 * 1024 * 1024 });
+}
+//# sourceMappingURL=index.js.map