llmapi-v2 2.1.0

package/src/routes/blog.ts

@@ -0,0 +1,28 @@
+import { Router } from 'express';
+import { getRecentPosts, getPostBySlug, getAllCategories } from '../data/posts';
+
+export const blogRouter = Router();
+
+blogRouter.get('/blog', (req, res) => {
+  const posts = getRecentPosts(20);
+  const categories = getAllCategories();
+  res.render('pages/blog', {
+    viewUser: req.user || null,
+    posts,
+    categories,
+  });
+});
+
+blogRouter.get('/blog/:slug', (req, res) => {
+  const post = getPostBySlug(req.params.slug);
+  if (!post) {
+    res.status(404).render('pages/404', { viewUser: req.user || null });
+    return;
+  }
+  const recentPosts = getRecentPosts(5).filter(p => p.slug !== post.slug).slice(0, 3);
+  res.render('pages/blog-post', {
+    viewUser: req.user || null,
+    post,
+    recentPosts,
+  });
+});

package/src/routes/dashboard.ts

@@ -0,0 +1,208 @@
+import { Router } from 'express';
+import type { Request, Response } from 'express';
+import crypto from 'crypto';
+import { v4 as uuidv4 } from 'uuid';
+import { getPool } from '../services/database';
+import { sessionAuth } from '../middleware/session-auth';
+import { logger } from '../utils/logger';
+
+export const dashboardRouter = Router();
+
+// All routes require session auth
+dashboardRouter.use(sessionAuth);
+
+/**
+ * GET /api/dashboard/stats
+ * User's usage statistics.
+ */
+dashboardRouter.get('/stats', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    const userId = req.userId!;
+
+    // Subscription info
+    const [subs] = await pool.execute(`
+      SELECT s.*, p.name as plan_name, p.display_name, p.token_limit_monthly, p.rate_limit_rpm, p.max_api_keys, p.price_monthly
+      FROM subscriptions s JOIN plans p ON s.plan_id = p.id
+      WHERE s.user_id = ? ORDER BY s.period_start DESC LIMIT 1
+    `, [userId]);
+    const sub = (subs as any[])[0];
+
+    // Token breakdown
+    const [tokens] = await pool.execute(`
+      SELECT
+        COALESCE(SUM(input_tokens), 0) as total_input,
+        COALESCE(SUM(output_tokens), 0) as total_output,
+        COALESCE(SUM(thinking_tokens), 0) as total_thinking,
+        COALESCE(SUM(provider_cost), 0) as total_cost,
+        COUNT(*) as total_requests,
+        COALESCE(AVG(ttft_ms), 0) as avg_ttft,
+        COALESCE(AVG(tokens_per_sec), 0) as avg_tps,
+        COALESCE(AVG(duration_ms), 0) as avg_duration
+      FROM usage_logs WHERE user_id = ?
+    `, [userId]);
+
+    // Today's requests
+    const [today] = await pool.execute(`
+      SELECT COUNT(*) as cnt, COALESCE(SUM(input_tokens + output_tokens), 0) as tokens
+      FROM usage_logs WHERE user_id = ? AND DATE(created_at) = CURRENT_DATE
+    `, [userId]);
+
+    // API key count
+    const [keys] = await pool.execute(
+      'SELECT COUNT(*) as cnt FROM api_keys WHERE user_id = ? AND status = ?',
+      [userId, 'active'],
+    );
+
+    const tokenData = (tokens as any[])[0];
+    const totalUsed = tokenData.total_input + tokenData.total_output;
+    const limit = sub?.token_limit_monthly || 0;
+
+    res.json({
+      success: true,
+      subscription: sub,
+      usage: {
+        totalInput: tokenData.total_input,
+        totalOutput: tokenData.total_output,
+        totalThinking: tokenData.total_thinking,
+        totalCost: parseFloat(tokenData.total_cost),
+        totalRequests: tokenData.total_requests,
+        avgTtft: Math.round(tokenData.avg_ttft),
+        avgTps: Math.round(tokenData.avg_tps * 100) / 100,
+        avgDuration: Math.round(tokenData.avg_duration),
+        totalUsed,
+        percentUsed: limit > 0 ? Math.round((totalUsed / limit) * 10000) / 100 : 0,
+      },
+      today: (today as any[])[0],
+      apiKeyCount: (keys as any[])[0].cnt,
+    });
+  } catch (err) {
+    logger.error({ err }, 'dashboard stats error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});
+
+/**
+ * GET /api/dashboard/usage
+ * Last 30 days daily usage.
+ */
+dashboardRouter.get('/usage', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    const [rows] = await pool.execute(`
+      SELECT
+        DATE(created_at) as date,
+        COALESCE(SUM(input_tokens), 0) as input_tokens,
+        COALESCE(SUM(output_tokens), 0) as output_tokens,
+        COUNT(*) as requests
+      FROM usage_logs
+      WHERE user_id = ? AND created_at >= CURRENT_DATE - INTERVAL '30 days'
+      GROUP BY DATE(created_at)
+      ORDER BY date
+    `, [req.userId!]);
+
+    res.json({ success: true, daily: rows });
+  } catch (err) {
+    logger.error({ err }, 'dashboard usage error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});
+
+/**
+ * GET /api/dashboard/api-keys
+ * List user's active API keys.
+ */
+dashboardRouter.get('/api-keys', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    const [rows] = await pool.execute(
+      'SELECT id, key_prefix, name, status, last_used_at, created_at FROM api_keys WHERE user_id = ? AND status = ? ORDER BY created_at DESC',
+      [req.userId!, 'active'],
+    );
+    res.json({ success: true, keys: rows });
+  } catch (err) {
+    logger.error({ err }, 'list keys error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});
+
+/**
+ * POST /api/dashboard/api-keys
+ * Create a new API key.
+ */
+dashboardRouter.post('/api-keys', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    const { name = 'Default' } = req.body;
+
+    // Check plan limit
+    const [subs] = await pool.execute(`
+      SELECT p.max_api_keys FROM subscriptions s JOIN plans p ON s.plan_id = p.id
+      WHERE s.user_id = ? ORDER BY s.period_start DESC LIMIT 1
+    `, [req.userId!]);
+    const maxKeys = (subs as any[])[0]?.max_api_keys || 1;
+
+    const [existing] = await pool.execute(
+      'SELECT COUNT(*) as cnt FROM api_keys WHERE user_id = ? AND status = ?',
+      [req.userId!, 'active'],
+    );
+    if ((existing as any[])[0].cnt >= maxKeys) {
+      res.status(400).json({ success: false, error: `Maximum ${maxKeys} API keys allowed on your plan` });
+      return;
+    }
+
+    // Generate key: sk-relay-<48 hex chars>
+    const rawKey = `sk-relay-${crypto.randomBytes(24).toString('hex')}`;
+    const keyPrefix = rawKey.substring(0, 12);
+    const keyHash = crypto.createHash('sha256').update(rawKey).digest('hex');
+
+    await pool.execute(
+      'INSERT INTO api_keys (user_id, key_prefix, key_hash, name) VALUES (?, ?, ?, ?)',
+      [req.userId!, keyPrefix, keyHash, name],
+    );
+
+    // Return full key ONCE (never stored in plain text)
+    res.json({ success: true, key: rawKey, prefix: keyPrefix });
+  } catch (err) {
+    logger.error({ err }, 'create key error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});
+
+/**
+ * DELETE /api/dashboard/api-keys/:id
+ * Revoke an API key.
+ */
+dashboardRouter.delete('/api-keys/:id', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    await pool.execute(
+      'UPDATE api_keys SET status = ? WHERE id = ? AND user_id = ?',
+      ['revoked', req.params.id, req.userId!],
+    );
+    res.json({ success: true });
+  } catch (err) {
+    logger.error({ err }, 'revoke key error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});
+
+/**
+ * GET /api/dashboard/recent
+ * Recent API requests (last 10).
+ */
+dashboardRouter.get('/recent', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool();
+    const [rows] = await pool.execute(`
+      SELECT model, provider_name, input_tokens, output_tokens, thinking_tokens,
+             ttft_ms, tokens_per_sec, duration_ms, status, created_at
+      FROM usage_logs WHERE user_id = ?
+      ORDER BY created_at DESC LIMIT 10
+    `, [req.userId!]);
+    res.json({ success: true, recent: rows });
+  } catch (err) {
+    logger.error({ err }, 'recent error');
+    res.status(500).json({ success: false, error: 'Internal error' });
+  }
+});

package/src/routes/messages.ts

@@ -0,0 +1,346 @@
+import { Router } from 'express';
+import type { Request, Response } from 'express';
+import type { IncomingMessage } from 'http';
+import { apiKeyAuth } from '../middleware/api-key-auth';
+import { rateLimiter } from '../middleware/rate-limiter';
+import { quotaGuard } from '../middleware/quota-guard';
+import { smartResolve, resolveWithFailover } from '../providers/registry';
+import { recordUsage } from '../services/usage';
+import { metrics } from '../services/metrics';
+import { OverloadedError } from '../utils/errors';
+import { detectRemoteTrigger, handleRemoteTrigger } from '../services/remote-control';
+import { logger } from '../utils/logger';
+/// <reference path="../types/express.d.ts" />
+
+export const messagesRouter = Router();
+
+/**
+ * POST /v1/messages
+ *
+ * Transparent proxy to provider's native Anthropic endpoint.
+ *
+ * Architecture:
+ *   Claude Code -> this proxy -> provider's Anthropic endpoint -> Claude Code
+ *
+ * We do NOT convert formats. The provider handles all Anthropic protocol
+ * details. We only:
+ *   1. Authenticate the user (API key)
+ *   2. Smart-route to the best provider
+ *   3. Rewrite the model name in the request body
+ *   4. Forward the request transparently
+ *   5. Intercept the response to extract usage for billing
+ *   6. Pipe the response back to the client
+ */
+messagesRouter.post('/messages', apiKeyAuth, rateLimiter, quotaGuard, async (req: Request, res: Response) => {
+  const startTime = Date.now();
+
+  // Parse just the fields we need for routing (don't fully parse the body)
+  const body = req.body;
+
+  // Command interception: remote control trigger
+  if (detectRemoteTrigger(body)) {
+    await handleRemoteTrigger(req, res);
+    return;
+  }
+  const claudeModel = body.model || 'claude-sonnet-4-6';
+  const isStream = !!body.stream;
+  const hasTools = Array.isArray(body.tools) && body.tools.length > 0;
+  const messageCount = Array.isArray(body.messages) ? body.messages.length : 0;
+
+  logger.info({
+    userId: req.userId,
+    model: claudeModel,
+    stream: isStream,
+    tools: hasTools,
+    messages: messageCount,
+  }, 'API request');
+
+  // Smart routing: pick the best provider based on task characteristics
+  let resolved = smartResolve(claudeModel, hasTools, messageCount);
+
+  // Try smart resolution first, then fall back to priority-based routing
+  const providersToTry: Array<{ provider: any; backendModel: string }> = [];
+  if (resolved) {
+    providersToTry.push(resolved);
+  }
+  // Always add fallback providers
+  for await (const route of resolveWithFailover(claudeModel)) {
+    // Skip if already the smart-resolved provider
+    if (resolved && route.provider.name === resolved.provider.name) continue;
+    providersToTry.push(route);
+  }
+
+  if (providersToTry.length === 0) {
+    const err = new OverloadedError('No providers available for this model.');
+    res.status(err.statusCode).json(err.toJSON());
+    return;
+  }
+
+  let lastError: Error | null = null;
+
+  for (const { provider, backendModel } of providersToTry) {
+    try {
+      // Rewrite the model name in the request body
+      const modifiedBody = { ...body, model: backendModel };
+      const normalized = normalizeForCache(modifiedBody);
+      const payload = JSON.stringify(normalized);
+
+      logger.debug({ provider: provider.name, model: backendModel, smart: !!resolved }, 'Routing to provider');
+
+      if (isStream) {
+        metrics.streamStarted();
+      }
+
+      // Forward to provider's native Anthropic endpoint
+      const backendRes = await provider.proxy(
+        '/v1/messages',
+        payload,
+        {
+          'anthropic-version': req.headers['anthropic-version'] as string || '2023-06-01',
+          'anthropic-beta': req.headers['anthropic-beta'] as string || '',
+        },
+        isStream,
+      );
+
+      // Check for error status from provider
+      if (backendRes.statusCode && backendRes.statusCode >= 400) {
+        const errorBody = await bufferResponse(backendRes);
+        const errMsg = extractErrorMessage(errorBody, backendRes.statusCode, provider.name);
+        throw new Error(errMsg);
+      }
+
+      provider.markHealthy();
+
+      if (isStream) {
+        // Streaming: pipe response directly, intercept usage from SSE
+        await pipeStreamingResponse(backendRes, res, {
+          userId: req.userId!,
+          apiKeyId: req.apiKey?.id ?? null,
+          displayModel: claudeModel,
+          providerName: provider.name,
+          backendModel,
+          startTime,
+        });
+      } else {
+        // Non-streaming: buffer, extract usage, forward
+        const responseBody = await bufferResponse(backendRes);
+        const parsed = JSON.parse(responseBody);
+
+        // Record usage from the response
+        const usage = parsed.usage || {};
+        recordUsage(req.userId!, req.apiKey?.id ?? null, claudeModel, provider.name, backendModel, {
+          inputTokens: usage.input_tokens || 0,
+          outputTokens: usage.output_tokens || 0,
+          thinkingTokens: 0,
+          ttftMs: Date.now() - startTime,
+          tokensPerSec: 0,
+          durationMs: Date.now() - startTime,
+        });
+        metrics.recordRequest(true, false);
+        metrics.recordProviderRequest(provider.name, true);
+
+        // Forward response with original headers
+        res.setHeader('Content-Type', 'application/json');
+        res.status(backendRes.statusCode || 200).send(responseBody);
+      }
+
+      return; // Success
+
+    } catch (err) {
+      lastError = err as Error;
+      provider.markUnhealthy(lastError.message);
+      metrics.recordProviderRequest(provider.name, false);
+      if (isStream) metrics.streamEnded();
+      logger.warn({ provider: provider.name, err: lastError.message }, 'Provider failed, trying next');
+    }
+  }
+
+  // All providers failed
+  metrics.recordRequest(false, isStream);
+  logger.error({ model: claudeModel, lastError: lastError?.message }, 'All providers failed');
+  const error = new OverloadedError(lastError?.message || 'All providers unavailable.');
+  res.status(error.statusCode).json(error.toJSON());
+});
+
+/**
+ * Pipe a streaming response from the provider directly to the client.
+ * Intercept SSE events to extract usage data for billing.
+ */
+async function pipeStreamingResponse(
+  backendRes: IncomingMessage,
+  clientRes: Response,
+  meta: {
+    userId: number;
+    apiKeyId: number | null;
+    displayModel: string;
+    providerName: string;
+    backendModel: string;
+    startTime: number;
+  },
+): Promise<void> {
+  return new Promise((resolve) => {
+    // Forward headers
+    clientRes.setHeader('Content-Type', 'text/event-stream');
+    clientRes.setHeader('Cache-Control', 'no-cache');
+    clientRes.setHeader('Connection', 'keep-alive');
+    clientRes.flushHeaders();
+
+    let usage = { inputTokens: 0, outputTokens: 0 };
+    let firstChunkTime = 0;
+    let buffer = '';
+
+    // Handle client disconnect
+    clientRes.on('close', () => {
+      backendRes.destroy();
+    });
+
+    backendRes.setEncoding('utf8');
+
+    backendRes.on('data', (chunk: string) => {
+      if (!firstChunkTime) firstChunkTime = Date.now();
+
+      // Write chunk directly to client (transparent proxy)
+      if (!clientRes.writableEnded) {
+        try { clientRes.write(chunk); } catch {}
+      }
+
+      // Parse SSE to extract usage (for billing)
+      buffer += chunk;
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line.startsWith('data: ')) continue;
+        const payload = line.slice(6).trim();
+        if (payload === '[DONE]' || !payload) continue;
+
+        try {
+          const data = JSON.parse(payload);
+          // Extract usage from message_start or message_delta events
+          if (data.type === 'message_start' && data.message?.usage) {
+            usage.inputTokens = data.message.usage.input_tokens || 0;
+          }
+          if (data.type === 'message_delta' && data.usage) {
+            usage.outputTokens = data.usage.output_tokens || 0;
+          }
+        } catch {}
+      }
+    });
+
+    backendRes.on('end', () => {
+      if (!clientRes.writableEnded) {
+        try { clientRes.end(); } catch {}
+      }
+
+      const duration = Date.now() - meta.startTime;
+      const ttft = firstChunkTime ? firstChunkTime - meta.startTime : duration;
+      const tps = duration > 0 && usage.outputTokens > 0
+        ? Math.round((usage.outputTokens / (duration / 1000)) * 100) / 100
+        : 0;
+
+      // Record usage for billing
+      recordUsage(meta.userId, meta.apiKeyId, meta.displayModel, meta.providerName, meta.backendModel, {
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+        thinkingTokens: 0,
+        ttftMs: ttft,
+        tokensPerSec: tps,
+        durationMs: duration,
+      });
+
+      metrics.recordRequest(true, true);
+      metrics.recordProviderRequest(meta.providerName, true);
+      metrics.recordLatency(duration);
+      if (ttft > 0) metrics.recordTTFT(ttft);
+      metrics.streamEnded();
+
+      logger.info({
+        userId: meta.userId,
+        provider: meta.providerName,
+        model: meta.backendModel,
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+        ttftMs: ttft,
+        durationMs: duration,
+      }, 'Stream completed');
+
+      resolve();
+    });
+
+    backendRes.on('error', (err) => {
+      logger.error({ err }, 'Backend stream error');
+      if (!clientRes.writableEnded) {
+        try { clientRes.end(); } catch {}
+      }
+      metrics.streamEnded();
+      resolve();
+    });
+  });
+}
+
+/**
+ * Optimize request for DashScope's prompt caching:
+ * 1. Inject cache_control on system prompt blocks (explicit caching, 90% cost reduction)
+ * 2. Strip timestamps/session IDs from system prompt (maximize prefix match)
+ *
+ * DashScope explicit cache: add cache_control: {type: "ephemeral"} to cacheable blocks.
+ * When the same prefix is seen again within 5 minutes, cached tokens cost only 10%.
+ */
+function normalizeForCache(body: any): any {
+  const normalized = { ...body };
+
+  if (typeof normalized.system === 'string') {
+    // Convert string system to array format so we can add cache_control
+    const cleanText = normalized.system
+      .replace(/\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?/g, 'DATE_PLACEHOLDER')
+      .replace(/\b\d{10,13}\b/g, 'TIMESTAMP');
+    normalized.system = [
+      { type: 'text', text: cleanText, cache_control: { type: 'ephemeral' } },
+    ];
+  } else if (Array.isArray(normalized.system) && normalized.system.length > 0) {
+    normalized.system = normalized.system.map((block: any, i: number) => {
+      if (block.type === 'text' && typeof block.text === 'string') {
+        const cleanText = block.text
+          .replace(/\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?/g, 'DATE_PLACEHOLDER')
+          .replace(/\b\d{10,13}\b/g, 'TIMESTAMP');
+        return {
+          ...block,
+          text: cleanText,
+          // Add cache_control to the last system block (marks end of cacheable prefix)
+          ...(i === normalized.system.length - 1 ? { cache_control: { type: 'ephemeral' } } : {}),
+        };
+      }
+      return block;
+    });
+  }
+
+  return normalized;
+}
+
+function bufferResponse(res: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    res.on('data', (chunk) => chunks.push(chunk));
+    res.on('end', () => resolve(Buffer.concat(chunks).toString()));
+    res.on('error', reject);
+  });
+}
+
+function extractErrorMessage(body: string, statusCode: number, provider: string): string {
+  try {
+    const parsed = JSON.parse(body);
+    return parsed.error?.message || `Provider ${provider} returned ${statusCode}`;
+  } catch {
+    return `Provider ${provider} returned ${statusCode}`;
+  }
+}
+
+/**
+ * POST /v1/messages/count_tokens
+ */
+messagesRouter.post('/messages/count_tokens', apiKeyAuth, (req: Request, res: Response) => {
+  const { messages, system } = req.body;
+  const text = JSON.stringify(messages || []) + JSON.stringify(system || '');
+  const inputTokens = Math.ceil(text.length / 4);
+  res.json({ input_tokens: inputTokens });
+});

package/src/routes/models.ts

@@ -0,0 +1,37 @@
+import { Router } from 'express';
+
+export const modelsRouter = Router();
+
+/**
+ * GET /v1/models
+ *
+ * Returns the Claude model list that Claude Code expects.
+ * This makes Claude Code believe it's talking to the Anthropic API.
+ */
+modelsRouter.get('/models', (_req, res) => {
+  res.json({
+    data: [
+      {
+        id: 'claude-sonnet-4-6',
+        display_name: 'Claude Sonnet 4.6',
+        type: 'model',
+        created_at: '2025-05-14T00:00:00Z',
+      },
+      {
+        id: 'claude-opus-4-6',
+        display_name: 'Claude Opus 4.6',
+        type: 'model',
+        created_at: '2025-05-14T00:00:00Z',
+      },
+      {
+        id: 'claude-haiku-4-5',
+        display_name: 'Claude Haiku 4.5',
+        type: 'model',
+        created_at: '2025-02-24T00:00:00Z',
+      },
+    ],
+    has_more: false,
+    first_id: 'claude-sonnet-4-6',
+    last_id: 'claude-haiku-4-5',
+  });
+});