llm-simple-router 0.3.7 → 0.4.0

package/dist/proxy/proxy-core.js

@@ -1,21 +1,43 @@
-import { randomUUID } from "crypto";
-import { getProviderById, insertRequestLog, insertMetrics } from "../db/index.js";
-import { decrypt } from "../utils/crypto.js";
-import { getSetting } from "../db/settings.js";
-import { MetricsExtractor } from "../metrics/metrics-extractor.js";
-import { getMappingGroup } from "../db/index.js";
-import { resolveMapping } from "./mapping-resolver.js";
-import { retryableCall, buildRetryConfig } from "./retry.js";
-import { SSEMetricsTransform } from "../metrics/sse-metrics-transform.js";
-import { proxyNonStream as upstreamNonStream, proxyStream as upstreamStream, proxyGetRequest as upstreamGet, } from "./upstream-call.js";
-import { insertSuccessLog, insertRejectedLog } from "./log-helpers.js";
-import { applyEnhancement, buildModelInfoTag } from "./enhancement-handler.js";
-import { SemaphoreQueueFullError, SemaphoreTimeoutError } from "./semaphore.js";
-// ---------- Constants ----------
-const UPSTREAM_SUCCESS = 200;
-const FAILOVER_FAIL_THRESHOLD = 400;
-const STREAM_CONTENT_MAX_RAW = 8192;
-const STREAM_CONTENT_MAX_TEXT = 4096;
+import { callGet as upstreamGet } from "./transport.js";
+// Re-export for external consumers (openai.ts, anthropic.ts, etc.)
+export { UPSTREAM_SUCCESS } from "./types.js";
+/**
+ * 工厂函数，消除 openai/anthropic 错误格式化的重复代码。
+ * statusCode 和 message 两个 provider 完全一致，仅 body 格式不同，
+ * 由 formatBody 回调根据 kind 参数映射各自的 type/code 并组装 body。
+ */
+export function createErrorFormatter(formatBody) {
+    return {
+        modelNotFound: (model) => ({
+            statusCode: 404,
+            body: formatBody("modelNotFound", `Model '${model}' is not configured`),
+        }),
+        modelNotAllowed: (model) => ({
+            statusCode: 403,
+            body: formatBody("modelNotAllowed", `Model '${model}' is not allowed for this API key`),
+        }),
+        providerUnavailable: () => ({
+            statusCode: 503,
+            body: formatBody("providerUnavailable", "Provider unavailable"),
+        }),
+        providerTypeMismatch: () => ({
+            statusCode: 500,
+            body: formatBody("providerTypeMismatch", "Provider type mismatch for this endpoint"),
+        }),
+        upstreamConnectionFailed: () => ({
+            statusCode: 502,
+            body: formatBody("upstreamConnectionFailed", "Failed to connect to upstream service"),
+        }),
+        concurrencyQueueFull: (providerId) => ({
+            statusCode: 503,
+            body: formatBody("concurrencyQueueFull", `Provider '${providerId}' concurrency queue is full`),
+        }),
+        concurrencyTimeout: (providerId, timeoutMs) => ({
+            statusCode: 504,
+            body: formatBody("concurrencyTimeout", `Provider '${providerId}' concurrency wait timeout (${timeoutMs}ms)`),
+        }),
+    };
+}
 // ---------- Header utilities ----------
 export const SKIP_UPSTREAM = new Set([
     "host",
@@ -36,8 +58,6 @@ export function selectHeaders(raw, skip) {
     }
     return out;
 }
-// 当前两个 provider 都使用 Bearer token
-// 如果未来需要支持其他鉴权方式，需要参数化 header 构造
 export function buildUpstreamHeaders(clientHeaders, apiKey, payloadBytes) {
     const headers = selectHeaders(clientHeaders, SKIP_UPSTREAM);
     headers["Authorization"] = `Bearer ${apiKey}`;
@@ -51,320 +71,3 @@ export function buildUpstreamHeaders(clientHeaders, apiKey, payloadBytes) {
 export function proxyGetRequest(backend, apiKey, clientHeaders, upstreamPath) {
     return upstreamGet(backend, apiKey, clientHeaders, upstreamPath, buildUpstreamHeaders);
 }
-// ---------- Helper functions for handleProxyPost ----------
-function handleIntercept(db, apiType, request, reply, interceptResponse, clientModel) {
-    const logId = randomUUID();
-    const isStream = request.body.stream === true;
-    const respBody = JSON.stringify(interceptResponse.body);
-    insertRequestLog(db, {
-        id: logId, api_type: apiType, model: clientModel, provider_id: "router",
-        status_code: interceptResponse.statusCode, latency_ms: 0,
-        is_stream: isStream ? 1 : 0, error_message: null,
-        created_at: new Date().toISOString(),
-        request_body: JSON.stringify(request.body),
-        response_body: respBody,
-        client_request: JSON.stringify({ headers: request.headers, body: request.body }),
-        upstream_request: interceptResponse.meta ? JSON.stringify(interceptResponse.meta) : null,
-        client_response: JSON.stringify({ statusCode: interceptResponse.statusCode, body: respBody }),
-        is_retry: 0, original_request_id: null,
-        router_key_id: request.routerKey?.id ?? null, original_model: null,
-    });
-    return reply.status(interceptResponse.statusCode).send(interceptResponse.body);
-}
-function logRetryAttempts(db, params, attempts, result, startTime) {
-    let lastSuccessLogId = params.logId;
-    for (const attempt of attempts) {
-        const isOriginal = attempt.attemptIndex === 0;
-        const attemptLogId = isOriginal ? params.logId : randomUUID();
-        if (attempt.error) {
-            insertRequestLog(db, {
-                id: attemptLogId, api_type: params.apiType, model: params.model, provider_id: params.providerId,
-                status_code: HTTP_BAD_GATEWAY, latency_ms: attempt.latencyMs,
-                is_stream: params.isStream ? 1 : 0, error_message: attempt.error,
-                created_at: new Date().toISOString(), request_body: params.reqBodyStr,
-                client_request: params.clientReq, upstream_request: params.upstreamReqBase,
-                is_retry: isOriginal ? 0 : 1, original_request_id: isOriginal ? null : params.logId,
-                router_key_id: params.routerKeyId, original_model: params.originalModel,
-            });
-        }
-        else if (attempt.statusCode !== UPSTREAM_SUCCESS) {
-            insertRequestLog(db, {
-                id: attemptLogId, api_type: params.apiType, model: params.model, provider_id: params.providerId,
-                status_code: attempt.statusCode, latency_ms: attempt.latencyMs,
-                is_stream: params.isStream ? 1 : 0, error_message: null,
-                created_at: new Date().toISOString(), request_body: params.reqBodyStr,
-                response_body: attempt.responseBody, client_request: params.clientReq, upstream_request: params.upstreamReqBase,
-                upstream_response: JSON.stringify({ statusCode: attempt.statusCode, body: attempt.responseBody }),
-                client_response: JSON.stringify({ statusCode: attempt.statusCode, body: attempt.responseBody }),
-                is_retry: isOriginal ? 0 : 1, original_request_id: isOriginal ? null : params.logId,
-                router_key_id: params.routerKeyId, original_model: params.originalModel,
-            });
-        }
-        else {
-            const h = params.isStream
-                ? (result.upstreamResponseHeaders ?? {})
-                : (result.headers);
-            insertSuccessLog(db, { apiType: params.apiType, model: params.model, provider: { id: params.providerId }, isStream: params.isStream, startTime,
-                reqBody: params.reqBodyStr, clientReq: params.clientReq, upstreamReq: params.upstreamReqBase, id: attemptLogId,
-                status: result.statusCode, respBody: attempt.responseBody, upHdrs: h, cliHdrs: h,
-                isRetry: !isOriginal, originalRequestId: isOriginal ? null : params.logId,
-                routerKeyId: params.routerKeyId, originalModel: params.originalModel });
-            lastSuccessLogId = attemptLogId;
-        }
-    }
-    return lastSuccessLogId;
-}
-function collectMetrics(db, apiType, result, isStream, lastSuccessLogId, providerId, backendModel, request) {
-    if (isStream) {
-        const streamResult = result;
-        if (streamResult.metricsResult) {
-            try {
-                insertMetrics(db, { ...streamResult.metricsResult, request_log_id: lastSuccessLogId, provider_id: providerId, backend_model: backendModel, api_type: apiType });
-            }
-            catch (err) {
-                request.log.error({ err }, "Failed to insert metrics");
-            }
-        }
-    }
-    else {
-        try {
-            const mr = MetricsExtractor.fromNonStreamResponse(apiType, result.body);
-            if (mr)
-                insertMetrics(db, { ...mr, request_log_id: lastSuccessLogId, provider_id: providerId, backend_model: backendModel, api_type: apiType });
-        }
-        catch (err) {
-            request.log.error({ err }, "Failed to insert metrics");
-        }
-    }
-}
-// ---------- Shared proxy handler ----------
-const HTTP_BAD_GATEWAY = 502;
-const HTTP_BAD_REQUEST = 400;
-/**
- * 共享 POST handler，参数化 apiType/errorFormat/upstreamPath 等差异。
- * 当分组策略为 failover 时，在 while 循环中依次尝试不同 target，
- * 直到成功（或 headers 已发送）才返回。
- */
-export async function handleProxyPost(request, reply, apiType, upstreamPath, errors, deps, options) {
-    const { db, streamTimeoutMs, retryMaxAttempts, retryBaseDelayMs, matcher } = deps;
-    request.raw.socket.on("error", (err) => request.log.debug({ err }, "client socket error"));
-    const clientModel = request.body.model || "unknown";
-    // 代理增强：指令解析 + 模型替换 + 命令拦截
-    const sessionId = request.headers["x-claude-code-session-id"];
-    const { effectiveModel, originalModel, interceptResponse } = applyEnhancement(db, request, clientModel, sessionId);
-    if (interceptResponse)
-        return handleIntercept(db, apiType, request, reply, interceptResponse, clientModel);
-    // 查询分组策略（只查一次）
-    const group = getMappingGroup(db, effectiveModel);
-    const isFailover = group?.strategy === "failover";
-    const excludeTargets = [];
-    while (true) {
-        const startTime = Date.now();
-        const logId = randomUUID();
-        const routerKeyId = request.routerKey?.id ?? null;
-        const body = request.body;
-        const originalBody = JSON.parse(JSON.stringify(body));
-        const isStream = body.stream === true;
-        const cliHdrs = request.headers;
-        const resolved = resolveMapping(db, effectiveModel, { now: new Date(), excludeTargets });
-        if (!resolved) {
-            if (isFailover && excludeTargets.length > 0) {
-                return reply;
-            }
-            const e = errors.modelNotFound(effectiveModel);
-            insertRejectedLog({ db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
-                errorMessage: `No mapping found for model '${effectiveModel}'`, startTime, isStream,
-                routerKeyId, originalBody, clientHeaders: cliHdrs, originalModel });
-            return reply.status(e.statusCode).send(e.body);
-        }
-        // 白名单校验
-        if (excludeTargets.length === 0) {
-            const allowedModels = request.routerKey?.allowed_models;
-            if (allowedModels) {
-                try {
-                    const models = JSON.parse(allowedModels).filter((m) => m.trim() !== "");
-                    if (models.length > 0 && !models.includes(resolved.backend_model)) {
-                        const e = errors.modelNotAllowed(resolved.backend_model);
-                        insertRejectedLog({ db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
-                            errorMessage: `Model '${resolved.backend_model}' not allowed for this API key`,
-                            startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs,
-                            providerId: resolved.provider_id, originalModel });
-                        return reply.status(e.statusCode).send(e.body);
-                    }
-                }
-                catch {
-                    request.log.warn({ allowedModels: allowedModels?.slice(0, 80) }, "Invalid allowed_models JSON, allowing all models");
-                } // eslint-disable-line no-magic-numbers
-            }
-        }
-        const provider = getProviderById(db, resolved.provider_id);
-        if (!provider || !provider.is_active) {
-            const e = errors.providerUnavailable();
-            insertRejectedLog({ db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
-                errorMessage: `Provider '${resolved.provider_id}' unavailable or inactive`,
-                startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs,
-                providerId: resolved.provider_id, originalModel });
-            return reply.status(e.statusCode).send(e.body);
-        }
-        if (provider.api_type !== apiType) {
-            const e = errors.providerTypeMismatch();
-            insertRejectedLog({ db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
-                errorMessage: `Provider API type mismatch: expected '${apiType}', got '${provider.api_type}'`,
-                startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs,
-                providerId: resolved.provider_id, originalModel });
-            return reply.status(e.statusCode).send(e.body);
-        }
-        deps.tracker?.start({
-            id: logId, apiType, model: effectiveModel, providerId: provider.id,
-            providerName: provider.name, isStream, startTime, status: "pending",
-            retryCount: 0, attempts: [], clientIp: request.ip,
-        });
-        body.model = resolved.backend_model;
-        const apiKey = decrypt(provider.api_key, getSetting(db, "encryption_key"));
-        options?.beforeSendProxy?.(body, isStream);
-        const reqBodyStr = JSON.stringify(body);
-        const clientReq = JSON.stringify({ headers: cliHdrs, body: originalBody });
-        const retryConfig = buildRetryConfig(retryMaxAttempts, retryBaseDelayMs, matcher);
-        const upstreamReqBase = JSON.stringify({ url: `${provider.base_url}${upstreamPath}`, headers: buildUpstreamHeaders(cliHdrs, apiKey, Buffer.byteLength(reqBodyStr)), body: reqBodyStr });
-        // === Semaphore acquire ===
-        const semaphoreManager = deps.semaphoreManager;
-        let semaphoreReleased = false;
-        const releaseSemaphore = () => {
-            if (!semaphoreReleased) {
-                semaphoreReleased = true;
-                semaphoreManager?.release(provider.id);
-            }
-        };
-        if (semaphoreManager) {
-            const ac = new AbortController();
-            request.raw.on("close", () => ac.abort());
-            try {
-                await semaphoreManager.acquire(provider.id, ac.signal, () => {
-                    deps.tracker?.update(logId, { queued: true });
-                });
-                deps.tracker?.update(logId, { queued: false });
-            }
-            catch (err) {
-                if (err instanceof DOMException && err.name === "AbortError") {
-                    deps.tracker?.complete(logId, { status: "failed" });
-                    return reply;
-                }
-                if (err instanceof SemaphoreQueueFullError) {
-                    request.log.warn({ providerId: provider.id }, "Concurrency queue full, rejecting request");
-                    const e = errors.concurrencyQueueFull(provider.id);
-                    deps.tracker?.complete(logId, { status: "failed", statusCode: e.statusCode });
-                    return reply.status(e.statusCode).send(e.body);
-                }
-                if (err instanceof SemaphoreTimeoutError) {
-                    request.log.warn({ providerId: provider.id, timeoutMs: err.timeoutMs }, "Concurrency wait timed out");
-                    const e = errors.concurrencyTimeout(provider.id, err.timeoutMs);
-                    deps.tracker?.complete(logId, { status: "failed", statusCode: e.statusCode });
-                    return reply.status(e.statusCode).send(e.body);
-                }
-                throw err;
-            }
-        }
-        try {
-            const { result: r, attempts } = isStream
-                ? await retryableCall(() => {
-                    const metricsTransform = new SSEMetricsTransform(apiType, startTime, {
-                        onMetrics: (m) => {
-                            deps.tracker?.update(logId, {
-                                streamMetrics: {
-                                    inputTokens: m.input_tokens,
-                                    outputTokens: m.output_tokens,
-                                    ttftMs: m.ttft_ms,
-                                    stopReason: m.stop_reason,
-                                    isComplete: m.is_complete === 1,
-                                },
-                            });
-                        },
-                        onChunk: (rawLine) => {
-                            deps.tracker?.appendStreamChunk(logId, rawLine, apiType, STREAM_CONTENT_MAX_RAW, STREAM_CONTENT_MAX_TEXT);
-                        },
-                    });
-                    return upstreamStream(provider, apiKey, body, cliHdrs, reply, streamTimeoutMs, upstreamPath, buildUpstreamHeaders, metricsTransform);
-                }, retryConfig, reply)
-                : await retryableCall(() => upstreamNonStream(provider, apiKey, body, cliHdrs, upstreamPath, buildUpstreamHeaders), retryConfig, reply);
-            const trackerAttempts = attempts.map(a => ({
-                statusCode: a.statusCode ?? null,
-                error: a.error ?? null,
-                latencyMs: a.latencyMs,
-                providerId: provider.id,
-            }));
-            deps.tracker?.update(logId, {
-                retryCount: Math.max(0, attempts.length - 1),
-                attempts: trackerAttempts,
-                providerId: provider.id,
-            });
-            const lastSuccessLogId = logRetryAttempts(db, {
-                apiType, model: effectiveModel, providerId: provider.id, isStream,
-                reqBodyStr, clientReq, upstreamReqBase, logId, routerKeyId, originalModel,
-            }, attempts, r, startTime);
-            // --- Failover 检查 ---
-            if (isFailover && r.statusCode >= FAILOVER_FAIL_THRESHOLD && !reply.raw.headersSent) {
-                deps.tracker?.complete(logId, { status: "failed", statusCode: r.statusCode });
-                releaseSemaphore();
-                excludeTargets.push(resolved);
-                continue;
-            }
-            // 发送响应
-            if (isStream) {
-                if (r.statusCode !== UPSTREAM_SUCCESS) {
-                    for (const [k, v] of Object.entries(r.upstreamResponseHeaders ?? {}))
-                        reply.header(k, v);
-                    reply.status(r.statusCode).send(r.responseBody);
-                }
-            }
-            else {
-                const pr = r;
-                // 非流式响应：模型替换时注入 router-response 标签
-                if (originalModel && pr.statusCode === UPSTREAM_SUCCESS) {
-                    try {
-                        const bodyObj = JSON.parse(pr.body);
-                        if (bodyObj.content?.[0]?.text) {
-                            bodyObj.content[0].text += `\n\n${buildModelInfoTag(effectiveModel)}`;
-                            pr.body = JSON.stringify(bodyObj);
-                        }
-                    }
-                    catch {
-                        request.log.debug("Failed to inject model-info tag into non-JSON response");
-                    }
-                }
-                for (const [k, v] of Object.entries(pr.headers))
-                    reply.header(k, v);
-                reply.status(pr.statusCode).send(pr.body);
-            }
-            if (r.statusCode === UPSTREAM_SUCCESS) {
-                collectMetrics(db, apiType, r, isStream, lastSuccessLogId, provider.id, resolved.backend_model, request);
-            }
-            deps.tracker?.complete(logId, { status: r.statusCode < HTTP_BAD_REQUEST ? "completed" : "failed", statusCode: r.statusCode });
-            releaseSemaphore();
-            return reply;
-        }
-        catch (err) {
-            const errMsg = err instanceof Error ? err.message : String(err);
-            const sentH = buildUpstreamHeaders(cliHdrs, apiKey, Buffer.byteLength(reqBodyStr));
-            const upstreamReq = JSON.stringify({ url: `${provider.base_url}${upstreamPath}`, headers: sentH, body: reqBodyStr });
-            insertRequestLog(db, {
-                id: logId, api_type: apiType, model: effectiveModel, provider_id: provider.id,
-                status_code: HTTP_BAD_GATEWAY, latency_ms: Date.now() - startTime,
-                is_stream: isStream ? 1 : 0, error_message: errMsg || "Upstream connection failed",
-                created_at: new Date().toISOString(), request_body: reqBodyStr,
-                client_request: clientReq, upstream_request: upstreamReq,
-                router_key_id: routerKeyId, original_model: originalModel,
-            });
-            // --- Failover 检查（异常路径）---
-            if (isFailover && !reply.raw.headersSent) {
-                deps.tracker?.complete(logId, { status: "failed" });
-                releaseSemaphore();
-                excludeTargets.push(resolved);
-                continue;
-            }
-            const e = errors.upstreamConnectionFailed();
-            deps.tracker?.complete(logId, { status: "failed", statusCode: HTTP_BAD_GATEWAY });
-            releaseSemaphore();
-            return reply.status(e.statusCode).send(e.body);
-        }
-    }
-}

package/dist/proxy/proxy-handler.d.ts

@@ -0,0 +1,18 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import Database from "better-sqlite3";
+import type { RequestTracker } from "../monitor/request-tracker.js";
+import type { RetryRuleMatcher } from "./retry-rules.js";
+import type { ProxyOrchestrator } from "./orchestrator.js";
+import type { ProxyErrorFormatter } from "./proxy-core.js";
+export interface RouteHandlerDeps {
+    db: Database.Database;
+    streamTimeoutMs: number;
+    retryMaxAttempts: number;
+    retryBaseDelayMs: number;
+    matcher?: RetryRuleMatcher;
+    tracker?: RequestTracker;
+    orchestrator: ProxyOrchestrator;
+}
+export declare function handleProxyRequest(request: FastifyRequest, reply: FastifyReply, apiType: "openai" | "anthropic", upstreamPath: string, errors: ProxyErrorFormatter, deps: RouteHandlerDeps, options?: {
+    beforeSendProxy?: (body: Record<string, unknown>, isStream: boolean) => void;
+}): Promise<FastifyReply>;

package/dist/proxy/proxy-handler.js

@@ -0,0 +1,223 @@
+import { randomUUID } from "crypto";
+import { getMappingGroup, getProviderById, insertRequestLog } from "../db/index.js";
+import { decrypt } from "../utils/crypto.js";
+import { getSetting } from "../db/settings.js";
+import { resolveMapping } from "./mapping-resolver.js";
+import { applyEnhancement, buildModelInfoTag } from "./enhancement-handler.js";
+import { SemaphoreQueueFullError, SemaphoreTimeoutError } from "./semaphore.js";
+import { logResilienceResult, collectTransportMetrics, handleIntercept, sanitizeHeadersForLog, } from "./proxy-logging.js";
+import { buildUpstreamHeaders } from "./proxy-core.js";
+import { UPSTREAM_SUCCESS, ProviderSwitchNeeded } from "./types.js";
+import { SSEMetricsTransform } from "../metrics/sse-metrics-transform.js";
+import { callNonStream, callStream } from "./transport.js";
+import { insertRejectedLog } from "./log-helpers.js";
+const HTTP_ERROR_THRESHOLD = 400;
+const STREAM_CONTENT_MAX_RAW = 8192;
+const STREAM_CONTENT_MAX_TEXT = 4096;
+export async function handleProxyRequest(request, reply, apiType, upstreamPath, errors, deps, options) {
+    request.raw.socket.on("error", (err) => request.log.debug({ err }, "client socket error"));
+    const clientModel = request.body.model || "unknown";
+    const sessionId = request.headers["x-claude-code-session-id"];
+    const { effectiveModel, originalModel, interceptResponse } = applyEnhancement(deps.db, request, clientModel, sessionId);
+    if (interceptResponse)
+        return handleIntercept(deps.db, apiType, request, reply, interceptResponse, clientModel);
+    const group = getMappingGroup(deps.db, effectiveModel);
+    const isFailover = group?.strategy === "failover";
+    const excludeTargets = [];
+    const originalBody = JSON.parse(JSON.stringify(request.body));
+    let rootLogId = null;
+    while (true) {
+        const startTime = Date.now();
+        const logId = randomUUID();
+        if (rootLogId === null)
+            rootLogId = logId;
+        const isFailoverIteration = rootLogId !== logId;
+        const routerKeyId = request.routerKey?.id ?? null;
+        const body = request.body;
+        const isStream = body.stream === true;
+        const cliHdrs = request.headers;
+        const resolved = resolveMapping(deps.db, effectiveModel, { now: new Date(), excludeTargets });
+        request.log.debug({ logId, model: effectiveModel, apiType, isStream, action: "resolve_mapping", resolved: !!resolved });
+        if (!resolved) {
+            if (isFailover && excludeTargets.length > 0) {
+                const e = errors.upstreamConnectionFailed();
+                insertRejectedLog({
+                    db: deps.db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
+                    errorMessage: `All failover targets exhausted (${excludeTargets.length} attempted)`,
+                    startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs, originalModel,
+                    isFailover: true, originalRequestId: rootLogId,
+                });
+                return reply.status(e.statusCode).send(e.body);
+            }
+            const e = errors.modelNotFound(effectiveModel);
+            insertRejectedLog({
+                db: deps.db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
+                errorMessage: `No mapping found for model '${effectiveModel}'`, startTime, isStream,
+                routerKeyId, originalBody, clientHeaders: cliHdrs, originalModel,
+                isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+            });
+            return reply.status(e.statusCode).send(e.body);
+        }
+        if (excludeTargets.length === 0) {
+            const allowedModels = request.routerKey?.allowed_models;
+            if (allowedModels) {
+                try {
+                    const models = JSON.parse(allowedModels).filter((m) => m.trim() !== "");
+                    if (models.length > 0 && !models.includes(resolved.backend_model)) {
+                        const e = errors.modelNotAllowed(resolved.backend_model);
+                        insertRejectedLog({
+                            db: deps.db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
+                            errorMessage: `Model '${resolved.backend_model}' not allowed`, startTime, isStream, routerKeyId,
+                            originalBody, clientHeaders: cliHdrs, providerId: resolved.provider_id, originalModel,
+                            isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+                        });
+                        return reply.status(e.statusCode).send(e.body);
+                    }
+                }
+                catch {
+                    request.log.warn({ allowedModels: allowedModels?.slice(0, 80) }, "Invalid allowed_models JSON, allowing all models");
+                } // eslint-disable-line no-magic-numbers
+            }
+        }
+        const provider = getProviderById(deps.db, resolved.provider_id);
+        if (!provider || !provider.is_active) {
+            const e = errors.providerUnavailable();
+            insertRejectedLog({
+                db: deps.db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
+                errorMessage: `Provider '${resolved.provider_id}' unavailable`, startTime, isStream, routerKeyId,
+                originalBody, clientHeaders: cliHdrs, providerId: resolved.provider_id, originalModel,
+                isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+            });
+            return reply.status(e.statusCode).send(e.body);
+        }
+        if (provider.api_type !== apiType) {
+            const e = errors.providerTypeMismatch();
+            insertRejectedLog({
+                db: deps.db, logId, apiType, model: effectiveModel, statusCode: e.statusCode,
+                errorMessage: `API type mismatch: expected '${apiType}'`, startTime, isStream, routerKeyId,
+                originalBody, clientHeaders: cliHdrs, providerId: resolved.provider_id, originalModel,
+                isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+            });
+            return reply.status(e.statusCode).send(e.body);
+        }
+        body.model = resolved.backend_model;
+        const apiKey = decrypt(provider.api_key, getSetting(deps.db, "encryption_key"));
+        options?.beforeSendProxy?.(body, isStream);
+        const reqBodyStr = JSON.stringify(body);
+        const clientReq = JSON.stringify({ headers: cliHdrs, body: originalBody });
+        const upstreamReqBase = JSON.stringify({
+            url: `${provider.base_url}${upstreamPath}`,
+            headers: sanitizeHeadersForLog(buildUpstreamHeaders(cliHdrs, apiKey, Buffer.byteLength(reqBodyStr))),
+            body: reqBodyStr,
+        });
+        // transportFn 闭包捕获当前迭代的 provider/apiKey/headers/body/reply 上下文
+        // target 由 resilience 层传入但当前架构下 provider 已在闭包中确定
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const transportFn = async (_target) => {
+            if (isStream) {
+                const metricsTransform = new SSEMetricsTransform(apiType, startTime, {
+                    onMetrics: (m) => {
+                        deps.tracker?.update(logId, {
+                            streamMetrics: {
+                                inputTokens: m.input_tokens, outputTokens: m.output_tokens,
+                                ttftMs: m.ttft_ms, stopReason: m.stop_reason, isComplete: m.is_complete === 1,
+                            },
+                        });
+                    },
+                    onChunk: (rawLine) => {
+                        deps.tracker?.appendStreamChunk(logId, rawLine, apiType, STREAM_CONTENT_MAX_RAW, STREAM_CONTENT_MAX_TEXT);
+                    },
+                });
+                const checkEarlyError = deps.matcher
+                    ? (data) => deps.matcher.test(UPSTREAM_SUCCESS, data)
+                    : undefined;
+                return callStream(provider, apiKey, body, cliHdrs, reply, deps.streamTimeoutMs, upstreamPath, buildUpstreamHeaders, metricsTransform, checkEarlyError);
+            }
+            const result = await callNonStream(provider, apiKey, body, cliHdrs, upstreamPath, buildUpstreamHeaders);
+            // 非流式响应注入模型信息标签（模型映射场景）
+            if (originalModel && result.kind === "success" && result.statusCode === UPSTREAM_SUCCESS) {
+                try {
+                    const bodyObj = JSON.parse(result.body);
+                    if (bodyObj.content?.[0]?.text) {
+                        bodyObj.content[0].text += `\n\n${buildModelInfoTag(effectiveModel)}`;
+                        return { ...result, body: JSON.stringify(bodyObj) };
+                    }
+                }
+                catch {
+                    request.log.debug("Failed to inject model-info tag into non-JSON response");
+                }
+            }
+            return result;
+        };
+        try {
+            const resilienceResult = await deps.orchestrator.handle(request, reply, apiType, { resolved, provider, clientModel: effectiveModel, isStream, trackerId: logId }, { retryMaxAttempts: deps.retryMaxAttempts, retryBaseDelayMs: deps.retryBaseDelayMs, isFailover, ruleMatcher: deps.matcher, transportFn });
+            const lastLogId = logResilienceResult(deps.db, {
+                apiType, model: effectiveModel, providerId: provider.id, isStream,
+                reqBodyStr, clientReq, upstreamReqBase, logId, routerKeyId, originalModel,
+                failover: { isFailoverIteration, rootLogId: rootLogId },
+            }, resilienceResult.attempts, resilienceResult.result, startTime);
+            collectTransportMetrics(deps.db, apiType, resilienceResult.result, isStream, lastLogId, provider.id, resolved.backend_model, request);
+            // Failover: 单 provider 内重试已耗尽但仍失败，尝试下一个 target
+            if (isFailover && !reply.raw.headersSent) {
+                const tr = resilienceResult.result;
+                const failed = tr.kind === "throw"
+                    || ("statusCode" in tr && tr.statusCode >= HTTP_ERROR_THRESHOLD);
+                if (failed) {
+                    excludeTargets.push(resolved);
+                    continue;
+                }
+            }
+            // orchestrator.sendResponse 对 throw/stream_success/stream_abort 不发送，
+            // 对非 failover 的 error/throw 需要由外层发送错误响应
+            if (!reply.raw.headersSent) {
+                const tr = resilienceResult.result;
+                if (tr.kind === "throw" || (tr.kind === "error" && tr.statusCode >= HTTP_ERROR_THRESHOLD)) {
+                    const err = errors.upstreamConnectionFailed();
+                    return reply.status(err.statusCode).send(err.body);
+                }
+            }
+            return reply;
+        }
+        catch (e) {
+            if (e instanceof ProviderSwitchNeeded) {
+                request.log.debug({ logId, action: "provider_switch", targetProviderId: e.targetProviderId });
+                excludeTargets.push(resolved);
+                continue;
+            }
+            if (e instanceof SemaphoreQueueFullError) {
+                const err = errors.concurrencyQueueFull(provider.id);
+                insertRejectedLog({
+                    db: deps.db, logId, apiType, model: effectiveModel, statusCode: err.statusCode,
+                    errorMessage: `Concurrency queue full for provider '${provider.id}'`,
+                    startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs,
+                    providerId: provider.id, originalModel,
+                    isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+                });
+                return reply.status(err.statusCode).send(err.body);
+            }
+            if (e instanceof SemaphoreTimeoutError) {
+                const err = errors.concurrencyTimeout(provider.id, e.timeoutMs);
+                insertRejectedLog({
+                    db: deps.db, logId, apiType, model: effectiveModel, statusCode: err.statusCode,
+                    errorMessage: `Concurrency wait timeout for provider '${provider.id}' (${e.timeoutMs}ms)`,
+                    startTime, isStream, routerKeyId, originalBody, clientHeaders: cliHdrs,
+                    providerId: provider.id, originalModel,
+                    isFailover: isFailoverIteration, originalRequestId: isFailoverIteration ? rootLogId : null,
+                });
+                return reply.status(err.statusCode).send(err.body);
+            }
+            const errMsg = e instanceof Error ? e.message : String(e);
+            request.log.debug({ logId, error: errMsg, action: "upstream_error" });
+            insertRequestLog(deps.db, {
+                id: logId, api_type: apiType, model: effectiveModel, provider_id: provider.id,
+                status_code: 502, latency_ms: Date.now() - startTime, is_stream: isStream ? 1 : 0,
+                error_message: errMsg || "Upstream connection failed", created_at: new Date().toISOString(),
+                request_body: reqBodyStr, client_request: clientReq, upstream_request: upstreamReqBase,
+                is_failover: isFailoverIteration ? 1 : 0, original_request_id: isFailoverIteration ? rootLogId : null,
+                router_key_id: routerKeyId, original_model: originalModel,
+            });
+            const err = errors.upstreamConnectionFailed();
+            return reply.status(err.statusCode).send(err.body);
+        }
+    }
+}

package/dist/proxy/proxy-logging.d.ts

@@ -0,0 +1,28 @@
+import Database from "better-sqlite3";
+import { type FailoverContext } from "./log-helpers.js";
+import type { FastifyRequest } from "fastify";
+import type { ResilienceAttempt } from "./resilience.js";
+import type { TransportResult } from "./types.js";
+export { UPSTREAM_SUCCESS } from "./types.js";
+export type { RawHeaders } from "./types.js";
+/** 日志存储前脱敏 Authorization header，避免 API Key 被持久化 */
+export declare function sanitizeHeadersForLog(headers: Record<string, string>): Record<string, string>;
+export declare function handleIntercept(db: Database.Database, apiType: "openai" | "anthropic", request: FastifyRequest, reply: import("fastify").FastifyReply, interceptResponse: {
+    statusCode: number;
+    body: unknown;
+    meta?: unknown;
+}, clientModel: string): import("fastify").FastifyReply;
+export declare function logResilienceResult(db: Database.Database, params: {
+    apiType: "openai" | "anthropic";
+    model: string;
+    providerId: string;
+    isStream: boolean;
+    reqBodyStr: string;
+    clientReq: string;
+    upstreamReqBase: string;
+    logId: string;
+    routerKeyId: string | null;
+    originalModel: string | null;
+    failover?: FailoverContext;
+}, attempts: ResilienceAttempt[], result: TransportResult, startTime: number): string;
+export declare function collectTransportMetrics(db: Database.Database, apiType: "openai" | "anthropic", result: TransportResult, isStream: boolean, lastSuccessLogId: string, providerId: string, backendModel: string, request: FastifyRequest): void;