myapikey 0.47.1 → 0.48.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myapikey",
-  "version": "0.47.1",
+  "version": "0.48.1",
   "type": "module",
   "description": "Personal LLM API gateway & proxy — one address + one API key for all your models. Forwards OpenAI & Anthropic calls to your backends with failover and a circuit breaker. Pure passthrough, no format translation. Self-hosted (CLI + web UI).",
   "keywords": [

package/packages/core/src/server/admin.ts

@@ -27,7 +27,7 @@ function mask(key: string): string {
 }
 
 /** Order-insensitive signature of a formats list, for change detection. */
-function formatsKey(f: Format[]): string {
+function formatsKey(f: RouteKey[]): string {
   return [...f].sort().join(",");
 }
 
@@ -38,10 +38,10 @@ function coerceRpm(v: unknown): number | undefined {
   return typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
 }
 
-/** Whether a provider is a valid source for a routing slot: openai/anthropic
- *  require that wire format; responses requires supportsResponses. */
+/** Whether a provider is a valid source for a routing slot: it must still offer
+ *  that format (formats and base URLs live and move together). */
 function providerSpeaks(p: Provider, key: RouteKey): boolean {
-  return key === "responses" ? !!p.supportsResponses : p.formats.includes(key);
+  return p.formats.includes(key);
 }
 
 /** The body fields a chain slot's sampling default may set — the wire-agnostic
@@ -96,8 +96,8 @@ function toPublic(p: Provider) {
     name: p.name,
     baseUrlOpenai: p.baseUrlOpenai,
     baseUrlAnthropic: p.baseUrlAnthropic,
+    baseUrlResponses: p.baseUrlResponses,
     formats: p.formats,
-    supportsResponses: p.supportsResponses ?? false,
     apiKey: mask(p.apiKey),
     rpm: p.rpm ?? 0,
     discoveredModels: p.discoveredModels ?? [],
@@ -129,6 +129,10 @@ export async function discoverModels(p: Provider): Promise<string[]> {
   const attempts: { base: string; suffix: string; headers: Record<string, string> }[] = [];
   if (p.formats.includes("openai"))
     attempts.push({ base: p.baseUrlOpenai, suffix: "models", headers: { authorization: `Bearer ${p.apiKey}` } });
+  // Responses usually shares the chat list, so it's tried after openai — only
+  // reached when the chat base is unset (responses-only source) or empty-handed.
+  if (p.formats.includes("responses") && p.baseUrlResponses)
+    attempts.push({ base: p.baseUrlResponses, suffix: "models", headers: { authorization: `Bearer ${p.apiKey}` } });
   if (p.formats.includes("anthropic"))
     attempts.push({ base: p.baseUrlAnthropic, suffix: "v1/models", headers: anthropicAuthHeaders(p.apiKey, "2023-06-01") });
   if (!attempts.length)
@@ -246,19 +250,18 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
   app.get("/providers", (c) => c.json({ providers: store.get().providers.map(toPublic) }));
 
   app.post("/providers", async (c) => {
-    const body = await readJson<{ name?: string; baseUrlOpenai?: string; baseUrlAnthropic?: string; apiKey?: string; formats?: Format[]; supportsResponses?: boolean; rpm?: number }>(c.req.raw);
+    const body = await readJson<{ name?: string; baseUrlOpenai?: string; baseUrlAnthropic?: string; baseUrlResponses?: string; apiKey?: string; formats?: RouteKey[]; rpm?: number }>(c.req.raw);
     const formats = body?.formats ?? [];
-    const needOpenai = formats.includes("openai");
-    const needAnthropic = formats.includes("anthropic");
     if (!body?.name || !body?.apiKey || !formats.length) {
       return c.json({ error: { message: "name, apiKey, formats are required" } }, 400);
     }
-    if ((needOpenai && !body.baseUrlOpenai) || (needAnthropic && !body.baseUrlAnthropic)) {
+    if ((formats.includes("openai") && !body.baseUrlOpenai) || (formats.includes("anthropic") && !body.baseUrlAnthropic) || (formats.includes("responses") && !body.baseUrlResponses)) {
       return c.json({ error: { message: "a base URL is required for each selected format" } }, 400);
     }
     const id = newProviderId();
     const baseUrlOpenai = trimBase(body.baseUrlOpenai ?? "");
     const baseUrlAnthropic = trimBase(body.baseUrlAnthropic ?? "");
+    const baseUrlResponses = trimBase(body.baseUrlResponses ?? "");
     const rpm = coerceRpm(body!.rpm);
     await store.update((d) => {
       d.providers.push({
@@ -266,9 +269,9 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
         name: body.name!,
         baseUrlOpenai,
         baseUrlAnthropic,
+        baseUrlResponses,
         apiKey: body.apiKey!,
         formats,
-        supportsResponses: body.supportsResponses === true,
         ...(rpm ? { rpm } : {}),
         createdAt: Date.now(),
       });
@@ -281,18 +284,17 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
 
   app.put("/providers/:id", async (c) => {
     const id = c.req.param("id");
-    const body = await readJson<{ name?: string; baseUrlOpenai?: string; baseUrlAnthropic?: string; apiKey?: string; formats?: Format[]; supportsResponses?: boolean; rpm?: number }>(c.req.raw);
+    const body = await readJson<{ name?: string; baseUrlOpenai?: string; baseUrlAnthropic?: string; baseUrlResponses?: string; apiKey?: string; formats?: RouteKey[]; rpm?: number }>(c.req.raw);
     const formats = body?.formats ?? [];
-    const needOpenai = formats.includes("openai");
-    const needAnthropic = formats.includes("anthropic");
     if (!body?.name || !formats.length) {
       return c.json({ error: { message: "name, formats are required" } }, 400);
     }
-    if ((needOpenai && !body.baseUrlOpenai) || (needAnthropic && !body.baseUrlAnthropic)) {
+    if ((formats.includes("openai") && !body.baseUrlOpenai) || (formats.includes("anthropic") && !body.baseUrlAnthropic) || (formats.includes("responses") && !body.baseUrlResponses)) {
       return c.json({ error: { message: "a base URL is required for each selected format" } }, 400);
     }
     const baseUrlOpenai = trimBase(body.baseUrlOpenai ?? "");
     const baseUrlAnthropic = trimBase(body.baseUrlAnthropic ?? "");
+    const baseUrlResponses = trimBase(body.baseUrlResponses ?? "");
     let rediscover = false;
     await store.update((d) => {
       const p = d.providers.find((x) => x.id === id);
@@ -303,14 +305,15 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
       rediscover =
         p.baseUrlOpenai !== baseUrlOpenai ||
         p.baseUrlAnthropic !== baseUrlAnthropic ||
+        p.baseUrlResponses !== baseUrlResponses ||
         (!!body.apiKey && p.apiKey !== body.apiKey) ||
         formatsKey(p.formats) !== formatsKey(formats);
       p.name = body.name!;
       p.baseUrlOpenai = baseUrlOpenai;
       p.baseUrlAnthropic = baseUrlAnthropic;
+      p.baseUrlResponses = baseUrlResponses;
       p.apiKey = newKey;
       p.formats = formats;
-      if (body.supportsResponses !== undefined) p.supportsResponses = body.supportsResponses;
       // rpm: present in the body → set (0/invalid clears to unlimited); absent → keep.
       if (body!.rpm !== undefined) {
         const rpm = coerceRpm(body!.rpm);
@@ -385,7 +388,7 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
   // unrouted source can be checked too — and it takes no routing side-effects
   // (no logs, no circuit, no pacing). ?model= is the upstream name sent
   // verbatim; ?format= (repeatable) narrows the protocols, defaulting to every
-  // one the source supports (responses only when supportsResponses).
+  // one the source supports.
   app.post("/providers/:id/test", async (c) => {
     const p = store.get().providers.find((x) => x.id === c.req.param("id"));
     if (!p) return c.json({ error: { message: "provider not found" } }, 404);
@@ -394,12 +397,10 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
     const wanted = (c.req.queries("format") ?? []).filter(
       (f): f is RouteKey => f === "openai" || f === "anthropic" || f === "responses",
     );
-    const formats: RouteKey[] = wanted.length
-      ? wanted
-      : [...p.formats, ...(p.supportsResponses ? ["responses" as const] : [])];
+    const formats: RouteKey[] = wanted.length ? wanted : [...p.formats];
     const results = await Promise.all(
       formats.map(async (format) => {
-        if (format === "responses" ? !p.supportsResponses : !p.formats.includes(format as Format)) {
+        if (!p.formats.includes(format)) {
           return { format, ok: false, status: 0, ms: 0, error: "source does not speak this format" };
         }
         const start = Date.now();
@@ -513,8 +514,8 @@ export function adminApi(store: Store, auth: MiddlewareHandler, chat: Hono, resp
   // chains, save once" flow the web editor is built around. Each format key
   // present in the body REPLACES that FormatEntry wholesale; keys absent from
   // the body are left untouched (a fresh entry seeds them disabled + empty).
-  // Every slot's provider must exist and speak that slot's format (responses
-  // additionally requires supportsResponses), mirroring the granular endpoints.
+  // Every slot's provider must exist and speak that slot's format, mirroring
+  // the granular endpoints.
   // The response carries the projected model (GET /models shape) so clients can
   // update in place without a refetch.
   app.put("/models/:name", async (c) => {

package/packages/core/src/server/proxy.ts

@@ -1,6 +1,6 @@
 import { Hono, type Context, type MiddlewareHandler } from "hono";
 import { trimBase } from "../shared/config";
-import type { DebugCapture, Format, FormatEntry, Provider, RouteKey, Usage } from "../shared/types";
+import type { DebugCapture, Format, Provider, RouteKey, Usage } from "../shared/types";
 import { CAPTURE_BODY_MAX, type Store } from "./store";
 import { UsageCollector } from "./tokens";
 
@@ -108,6 +108,14 @@ interface CandidateSlot {
   sampling?: Record<string, unknown>;
 }
 
+/** Which Provider base URL serves each routing format (all non-empty for a
+ *  format the source actually offers — admin validation enforces it). */
+const FORMAT_BASE: Record<RouteKey, "baseUrlOpenai" | "baseUrlAnthropic" | "baseUrlResponses"> = {
+  openai: "baseUrlOpenai",
+  anthropic: "baseUrlAnthropic",
+  responses: "baseUrlResponses",
+};
+
 /** Resolve the ordered, compatible provider slots for a model on a routing slot. */
 function candidates(store: Store, model: string, key: RouteKey): CandidateSlot[] {
   const d = store.get();
@@ -115,9 +123,9 @@ function candidates(store: Store, model: string, key: RouteKey): CandidateSlot[]
   const fe = entry?.[key];
   if (!fe?.enabled) return [];
   const byId = new Map(d.providers.map((p) => [p.id, p]));
-  // Defense-in-depth: openai/anthropic require that wire format; responses
-  // requires supportsResponses. (Admin keeps chains pure, but a provider's
-  // formats/flag can be edited afterwards.)
+  // Defense-in-depth: a slot's source must still carry that format AND a base
+  // URL for it. (Admin keeps chains pure, but a provider's formats/URLs can be
+  // edited afterwards — a source that dropped responses must stop serving it.)
   return fe.providers
     .map((s): CandidateSlot | null => {
       const p = byId.get(s.id);
@@ -125,7 +133,7 @@ function candidates(store: Store, model: string, key: RouteKey): CandidateSlot[]
     })
     .filter((slot): slot is CandidateSlot => {
       if (!slot) return false;
-      return key === "responses" ? !!slot.provider.supportsResponses : slot.provider.formats.includes(key);
+      return slot.provider.formats.includes(key) && !!slot.provider[FORMAT_BASE[key]];
     });
 }
 
@@ -311,16 +319,17 @@ export function upstreamHeaders(provider: Provider, format: Format, clientVersio
   return h;
 }
 
-/** Resolve the upstream URL + wire format for a routing slot. The OpenAI base
- *  includes the version segment (we append the bare resource); the Anthropic
- *  base excludes /v1 (we append v1/messages). /responses reuses the OpenAI base.
- *  Exported for the admin source-test (direct upstream ping, no routing). */
+/** Resolve the upstream URL + wire format for a routing slot. Each format has
+ *  its own base URL: the OpenAI and Responses bases include the version segment
+ *  (we append the bare resource); the Anthropic base excludes /v1 (we append
+ *  v1/messages). Exported for the admin source-test (direct upstream ping). */
 export function upstreamTarget(p: Provider, key: RouteKey): { url: string; wire: Format } {
   if (key === "anthropic") {
     return { url: `${trimBase(p.baseUrlAnthropic)}/v1/messages`, wire: "anthropic" };
   }
+  const base = key === "responses" ? p.baseUrlResponses : p.baseUrlOpenai;
   const path = key === "responses" ? "responses" : "chat/completions";
-  return { url: `${trimBase(p.baseUrlOpenai)}/${path}`, wire: "openai" };
+  return { url: `${trimBase(base)}/${path}`, wire: "openai" };
 }
 
 /** HTTP header values are ByteStrings (Latin-1, code points ≤ 255) — a value
@@ -499,8 +508,7 @@ function observedBody(
  *  first_id, last_id, has_more}`. We can't know real created_at / capabilities,
  *  so the anthropic shape carries only the honest minimal fields rather than
  *  fabricating them. Each surface lists exactly what dispatch would route on
- *  it: the entry's chain for that RouteKey must be enabled (and, for
- *  responses, keep at least one slot on a supportsResponses source). */
+ *  it: the entry's chain for that RouteKey must be enabled. */
 function modelsList(c: Context, store: Store, key: RouteKey) {
   const d = store.get();
   const byId = new Map(d.providers.map((p) => [p.id, p]));
@@ -509,19 +517,12 @@ function modelsList(c: Context, store: Store, key: RouteKey) {
     const data = enabled.map(([id]) => ({ id, display_name: id, created_at: "1970-01-01T00:00:00Z", type: "model" }));
     return c.json({ data, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null, has_more: false });
   }
-  const routable = (e: FormatEntry) =>
-    key === "responses" ? e.providers.some((s) => byId.get(s.id)?.supportsResponses) : true;
-  // owned_by follows the first slot dispatch would actually use on this surface.
-  const firstSlot = (e: FormatEntry) =>
-    key === "responses" ? e.providers.find((s) => byId.get(s.id)?.supportsResponses) : e.providers[0];
-  const data = enabled
-    .filter(([, e]) => e[key] && routable(e[key]))
-    .map(([id, e]) => ({
-      id,
-      object: "model",
-      created: 0,
-      owned_by: byId.get(firstSlot(e[key])?.id ?? "")?.name || "MyAPIKey",
-    }));
+  const data = enabled.map(([id, e]) => ({
+    id,
+    object: "model",
+    created: 0,
+    owned_by: byId.get(e[key].providers[0]?.id ?? "")?.name || "MyAPIKey",
+  }));
   return c.json({ object: "list", data });
 }
 
@@ -583,7 +584,7 @@ export function proxyApi(
     // (429/500/…), not a collapsed 502, so the badge shows what really happened.
     const pinIndexRaw = c.req.header("x-myapikey-probe-slot");
     const pinIndex = pinIndexRaw !== "" && Number.isInteger(Number(pinIndexRaw)) ? Number(pinIndexRaw) : null;
-    // candidates() already restricts the responses chain to supportsResponses sources.
+    // candidates() already restricts each chain to sources still offering that format.
     let list = candidates(store, model, key);
     if (pinIndex != null) {
       // An out-of-range index → empty list → 404, so a bad probe is reported as
@@ -882,7 +883,7 @@ export function proxyApi(
   // One call endpoint per surface (/models is registered above, before the
   // auth middleware, so it stays public).
   chat.post("/chat/completions", (c) => dispatch(c, "openai"));
-  // OpenAI Responses API — its own routing slot (sources must be supportsResponses).
+  // OpenAI Responses API — its own routing slot (sources must offer responses).
   responses.post("/responses", (c) => dispatch(c, "responses"));
 
   // Anthropic surface: messages.

package/packages/core/src/server/store.ts

@@ -305,7 +305,8 @@ export class Store {
     const m1 = migrateModels(raw);
     const m2 = migrateProviders(raw);
     const m3 = migrateFormatEntries(raw);
-    if (m1 || m2 || m3 || !raw.version || raw.version < CONFIG_VERSION) {
+    const m4 = migrateProviderFormats(raw);
+    if (m1 || m2 || m3 || m4 || !raw.version || raw.version < CONFIG_VERSION) {
       raw.version = CONFIG_VERSION;
       this.persist(raw);
     } else if (raw.version > CONFIG_VERSION) {
@@ -835,7 +836,7 @@ function hitRate(cacheRead: number, input: number, cacheCreation: number): numbe
 function migrateModels(raw: GateConfig): boolean {
   const models = raw.models as Record<string, unknown>;
   if (!models || typeof models !== "object") return false;
-  const byId = new Map(raw.providers.map((p) => [p.id, p]));
+  const byId = new Map(raw.providers.map((p) => [p.id, p as Provider & { supportsResponses?: boolean }]));
   let changed = false;
   for (const [name, entry] of Object.entries(models)) {
     if (!entry || typeof entry !== "object") continue;
@@ -927,3 +928,28 @@ function migrateFormatEntries(raw: GateConfig): boolean {
   }
   return changed;
 }
+
+/**
+ * Provider migration to three parallel formats (v5 → v6).
+ *  - v5 expressed Responses support as `supportsResponses: boolean` on top of
+ *    `formats: ("openai"|"anthropic")[]`, with /responses reusing the OpenAI
+ *    base URL.
+ *  - v6 makes responses a third peer format with its OWN base URL:
+ *    `formats` gains "responses" when the flag was set, `baseUrlResponses`
+ *    starts as a COPY of baseUrlOpenai (preserves existing routing exactly —
+ *    the user can point it elsewhere afterwards), and the flag is deleted.
+ *    A responses-only backend is now expressible (empty openai base).
+ * Idempotent: v6 providers (string `baseUrlResponses`) are skipped. Runs LAST
+ * so the older migrations can still read `supportsResponses`/`formats`.
+ */
+function migrateProviderFormats(raw: GateConfig): boolean {
+  let changed = false;
+  for (const p of raw.providers as (Provider & { supportsResponses?: boolean })[]) {
+    if (typeof p.baseUrlResponses === "string") continue; // already v6
+    p.baseUrlResponses = p.supportsResponses ? p.baseUrlOpenai : "";
+    if (p.supportsResponses && !p.formats.includes("responses")) p.formats.push("responses");
+    delete p.supportsResponses;
+    changed = true;
+  }
+  return changed;
+}

package/packages/core/src/shared/config.ts

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import type { GateConfig } from "./types";
 
-export const CONFIG_VERSION = 5;
+export const CONFIG_VERSION = 6;
 export const DEFAULT_PORT = 7800;
 /** Default on-disk home for the gateway's data: data.json + logs.jsonl live here. */
 export const DEFAULT_DATA_DIR = join(homedir(), ".myapikey");

package/packages/core/src/shared/types.ts

@@ -11,14 +11,19 @@ export interface Provider {
   id: string; // prv_<rand>
   name: string; // human label, also used as CLI handle
   /** OpenAI-family base INCLUDING the version segment, e.g. https://api.openai.com/v1
-   *  or Ark's /api/v3. Used for /chat/completions, /responses, /models. */
+   *  or Ark's /api/v3. Used for /chat/completions (and /models discovery). */
   baseUrlOpenai: string;
   /** Anthropic base EXCLUDING /v1, e.g. https://api.anthropic.com or Ark's /api/coding.
    *  The gateway appends /v1/messages (and /v1/models for discovery). */
   baseUrlAnthropic: string;
+  /** OpenAI-family base for the Responses API, INCLUDING the version segment.
+   *  Independent of baseUrlOpenai — a backend may serve /responses at a
+   *  different address (or serve ONLY responses). The gateway appends
+   *  /responses (and /models for discovery). Empty = responses not served. */
+  baseUrlResponses: string;
   apiKey: string;
-  /** Which wire formats this backend responds to. */
-  formats: Format[];
+  /** Which routing formats this backend responds to (one per agent surface). */
+  formats: RouteKey[];
   /** Optional request-per-minute cap (RPM pacing). When set, dispatch skips this
    *  source once it has forwarded `rpm` calls in the trailing 60s window — the
    *  request fails over to the next source instead of racing the upstream's own
@@ -26,9 +31,6 @@ export interface Provider {
    *  The limit is on the key, so it's per-source and shared across every model
    *  routed through it. Tracked in-memory only (see Store.rpmUsed). */
   rpm?: number;
-  /** Whether this backend also implements the OpenAI Responses API (/responses).
-   *  NOT implied by `formats` — many openai-compatible backends lack it. Opt-in. */
-  supportsResponses?: boolean;
   /** Model ids this provider offered at last discovery (cached, may be stale). */
   discoveredModels?: string[];
   /** Manually supplemented upstream model ids — names a backend's /models list
@@ -44,9 +46,8 @@ export interface Provider {
 /** One routing slot: an independent enable flag + a priority-ordered chain of
  *  (provider, optional upstream model) pairs. Invariant (enforced by admin
  *  mutations, defended by proxy candidates()): every id in `providers` exists in
- *  `GateConfig.providers` and is compatible with the slot — openai/anthropic ids
- *  must carry that wire format; responses ids must additionally be
- *  supportsResponses sources (still OpenAI-format).
+ *  `GateConfig.providers` and is compatible with the slot — it must carry that
+ *  format in `formats` (with the matching base URL filled in).
  *
  *  A provider id may appear MORE THAN ONCE — each occurrence is an independent
  *  failover slot that can carry its own upstream model name. When forwarding to
@@ -92,10 +93,10 @@ export interface ChainSlot {
   sampling?: Record<string, unknown>;
 }
 
-/** A model's routing dimensions — one per forwarding endpoint. /chat/completions
- *  (openai) and /responses are separate OpenAI-family endpoints with different
- *  URLs, so they route independently: each has its own enable + chain. A
- *  supportsResponses source can sit in BOTH the openai and the responses chains. */
+/** A model's routing dimensions — one per forwarding endpoint. The three are
+ *  fully independent surfaces with independent per-source base URLs: a source
+ *  can serve any subset (responses-only and chat-only are both legal), and the
+ *  same source can sit in several chains at once. */
 export type RouteKey = "openai" | "anthropic" | "responses";
 
 /** Per-model routing entry, keyed by model name (e.g. "gpt-4o"). */