pool-anything 0.1.0

package/dist/server.js

@@ -0,0 +1,431 @@
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { HOST, PORT, isAllowedOrigin, startupWarnings } from "./config/env.js";
+import { logoPngPath, publicDir } from "./config/paths.js";
+import { readJson, send } from "./common/http.js";
+import { MAX_PROXY_BODY_BYTES } from "./media/capabilities.js";
+import { isAuthorized, requiresAuth } from "./middleware/auth.js";
+import { sdb, PROVIDERS, mask, maskCredentials, normalizeCredentials, parseCredentials, providerKeyFields, getPool, poolSummary } from "./pool/index.js";
+import { nextKey, recordUsage } from "./pool/rotation.js";
+import { forward, MAX_TOKENS_PER_REQUEST, checkTarget } from "./proxy/forward.js";
+import { DOCS_URL } from "./admin/branding.js";
+import { page, keysPage, poolsPage, analyticsPage, playgroundPage, providerPage } from "./admin/pages.js";
+import { MAX_POOLS, MAX_KEYS_PER_POOL, MAX_API_KEY_CHARS, matchPoolRoute, matchKeyRoute } from "./router/api.js";
+import { health, readiness, analyticsSnapshot } from "./observability/health.js";
+const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    // CORS: only the hosted Pages tools UI (plus http loopback dev and
+    // ALLOWED_ORIGINS) may read API responses cross-origin. Arbitrary origins
+    // get no ACAO header so browsers block the read — reflecting any Origin
+    // would let any site the operator visits exfiltrate keys from a
+    // token-less loopback backend.
+    const origin = req.headers.origin;
+    const allowedOrigin = typeof origin === "string" && origin && isAllowedOrigin(origin) ? origin : null;
+    if (allowedOrigin) {
+        res.setHeader("access-control-allow-origin", allowedOrigin);
+        res.setHeader("vary", "Origin");
+    }
+    res.setHeader("access-control-allow-methods", "GET, POST, PATCH, DELETE, OPTIONS");
+    res.setHeader("access-control-allow-headers", "content-type, authorization");
+    if ((req.method ?? "GET") === "OPTIONS") {
+        // Preflight: succeed at the HTTP layer but only advertise CORS to
+        // allowlisted callers; others get no ACAO header and stay blocked.
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    try {
+        if (requiresAuth(req.method ?? "GET", url.pathname) && !isAuthorized(req)) {
+            send(res, 401, { error: "unauthorized: missing or invalid bearer token" });
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(page);
+            return;
+        }
+        if (req.method === "GET" && (url.pathname === "/logo.png" || url.pathname === "/favicon.ico" || url.pathname === "/favicon.png")) {
+            try {
+                const p = logoPngPath();
+                const buf = fs.readFileSync(p);
+                res.writeHead(200, { "content-type": "image/png", "cache-control": "public, max-age=3600" });
+                res.end(buf);
+            }
+            catch {
+                res.writeHead(404, { "content-type": "text/plain" });
+                res.end("not found\n");
+            }
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/api/providers") {
+            send(res, 200, PROVIDERS);
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/api/analytics") {
+            const r = analyticsSnapshot();
+            send(res, r.status, r.body);
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/api/pools") {
+            send(res, 200, sdb.prepare("SELECT * FROM pools ORDER BY id DESC").all());
+            return;
+        }
+        if (req.method === "POST" && url.pathname === "/api/pools") {
+            const b = (await readJson(req));
+            const provider = typeof b.provider === "string" ? b.provider.trim() : "";
+            const name = typeof b.name === "string" ? b.name.trim() : "";
+            if (!provider || !name)
+                return send(res, 400, { error: "provider + name required" });
+            if (provider.length > 80 || name.length > 80)
+                return send(res, 400, { error: "provider + name must be <= 80 characters" });
+            const total = sdb.prepare("SELECT COUNT(*) AS n FROM pools").get().n;
+            if (total >= MAX_POOLS)
+                return send(res, 400, { error: `pool limit reached (${MAX_POOLS})` });
+            // Fail fast on auth config the proxy could never use (forward-time check stays as backstop).
+            const kh = typeof b.key_header === "string" ? b.key_header.trim() : "";
+            if (kh) {
+                const okHeader = /^[A-Za-z0-9-]+$/.test(kh) || (kh.startsWith("query:") && /^[A-Za-z0-9_-]+$/.test(kh.slice("query:".length)));
+                if (!okHeader)
+                    return send(res, 400, { error: "key_header invalid" });
+                if (/[\r\n\x00]/.test(kh))
+                    return send(res, 400, { error: "key_header invalid" });
+            }
+            const baseUrl = typeof b.base_url === "string" ? b.base_url.trim() : "";
+            const keyPrefix = typeof b.key_prefix === "string" ? b.key_prefix : "";
+            if (/[\r\n\x00]/.test(keyPrefix))
+                return send(res, 400, { error: "key_prefix invalid" });
+            if (baseUrl) {
+                const safe = checkTarget(baseUrl, kh || "X-API-Key");
+                if (!safe.ok)
+                    return send(res, 400, safe);
+            }
+            const r = sdb
+                .prepare("INSERT INTO pools (provider, name, base_url, key_header, key_prefix) VALUES (?, ?, ?, ?, ?)")
+                .run(provider, name, baseUrl.slice(0, 500), kh.slice(0, 80), keyPrefix.slice(0, 40));
+            send(res, 200, sdb.prepare("SELECT * FROM pools WHERE id = ?").get(r.lastInsertRowid));
+            return;
+        }
+        const poolR = matchPoolRoute(url.pathname);
+        if (poolR) {
+            const poolId = poolR.poolId;
+            const sub = poolR.sub;
+            if (req.method === "GET" && !sub) {
+                const s = poolSummary(poolId);
+                if (!s)
+                    return send(res, 404, { error: "pool not found" });
+                send(res, 200, s);
+                return;
+            }
+            if (req.method === "DELETE" && !sub) {
+                sdb.exec("BEGIN IMMEDIATE");
+                try {
+                    sdb.prepare("DELETE FROM usage WHERE pool_id = ?").run(poolId);
+                    sdb.prepare("DELETE FROM pool_keys WHERE pool_id = ?").run(poolId);
+                    const r = sdb.prepare("DELETE FROM pools WHERE id = ?").run(poolId);
+                    if (r.changes === 0) {
+                        sdb.exec("ROLLBACK");
+                        return send(res, 404, { error: "pool not found" });
+                    }
+                    sdb.exec("COMMIT");
+                }
+                catch (e) {
+                    try {
+                        sdb.exec("ROLLBACK");
+                    }
+                    catch { /* already rolled back */ }
+                    throw e;
+                }
+                send(res, 200, { ok: true });
+                return;
+            }
+            if (req.method === "GET" && sub === "/next") {
+                const sel = nextKey(poolId);
+                if ("error" in sel)
+                    return send(res, sel.error === "pool not found" ? 404 : 400, sel);
+                send(res, 200, sel);
+                return;
+            }
+            if (req.method === "POST" && sub === "/consume") {
+                const b = (await readJson(req));
+                const tok = b.tokens;
+                if (!Number.isInteger(tok) || tok <= 0 || tok > MAX_TOKENS_PER_REQUEST)
+                    return send(res, 400, { error: `tokens must be a positive integer <= ${MAX_TOKENS_PER_REQUEST}` });
+                if (b.key_id !== undefined && (!Number.isInteger(b.key_id) || b.key_id <= 0))
+                    return send(res, 400, { error: "key_id must be a positive integer" });
+                const sel = recordUsage(poolId, tok, b.key_id);
+                if ("error" in sel) {
+                    const code = sel.error === "pool not found" || sel.error === "key not found" ? 404 : 400;
+                    return send(res, code, sel);
+                }
+                send(res, 200, sel);
+                return;
+            }
+            if (req.method === "GET" && sub === "/usage") {
+                const s = poolSummary(poolId);
+                if (!s)
+                    return send(res, 404, { error: "pool not found" });
+                send(res, 200, { pool_id: s.id, used: s.used, usedInWindow: s.usedInWindow, quota: s.quota, quotaWindow: s.quotaWindow, remaining: s.remaining, perKey: s.perKey });
+                return;
+            }
+            if (req.method === "POST" && sub === "/proxy") {
+                // Media-aware limit: base64 image/audio/video payloads ride inside JSON.
+                const b = (await readJson(req, MAX_PROXY_BODY_BYTES));
+                if (b === null || typeof b !== "object" || Array.isArray(b))
+                    return send(res, 400, { error: "proxy body must be an object" });
+                const r = await forward(poolId, b);
+                if ("error" in r)
+                    return send(res, r.status === 200 ? 400 : r.status, r);
+                send(res, 200, { key_id: r.key_id, label: r.label, masked: r.masked, status: r.upstreamStatus, body: r.body, encoding: r.encoding ?? "text", contentType: r.contentType ?? "", truncated: r.truncated ?? false, tried: r.tried });
+                return;
+            }
+        }
+        const keyR = matchKeyRoute(url.pathname);
+        if (keyR) {
+            const poolId = keyR.poolId;
+            const keyId = keyR.keyId === null ? undefined : String(keyR.keyId);
+            if (req.method === "GET" && keyId === undefined) {
+                const pool = getPool(poolId);
+                if (!pool)
+                    return send(res, 404, { error: "pool not found" });
+                const fields = providerKeyFields(pool.provider);
+                const rows = sdb
+                    .prepare("SELECT id, label, api_key, COALESCE(credentials,'{}') AS credentials, info, created_at FROM pool_keys WHERE pool_id = ? ORDER BY id")
+                    .all(poolId);
+                send(res, 200, rows.map((k) => {
+                    const creds = parseCredentials(k.credentials);
+                    return {
+                        id: k.id, label: k.label, masked: mask(k.api_key), info: k.info, created_at: k.created_at,
+                        keyFields: fields,
+                        credentials: Object.keys(creds).length > 0 ? maskCredentials(creds) : undefined,
+                    };
+                }));
+                return;
+            }
+            if (req.method === "POST" && keyId === undefined) {
+                const pool = getPool(poolId);
+                if (!pool)
+                    return send(res, 404, { error: "pool not found" });
+                const b = (await readJson(req));
+                const label = typeof b.label === "string" ? b.label.trim() : "";
+                if (!label)
+                    return send(res, 400, { error: "label required" });
+                if (label.length > 80)
+                    return send(res, 400, { error: "label must be <= 80 characters" });
+                if (/[\r\n\x00]/.test(label))
+                    return send(res, 400, { error: "label must not contain CR/LF" });
+                if (b.info !== undefined && typeof b.info !== "string")
+                    return send(res, 400, { error: "info must be a string" });
+                const fields = providerKeyFields(pool.provider);
+                const multi = !(fields.length === 1 && (fields[0] === "api_key" || fields[0] === "apiToken"));
+                let apiKey = "";
+                let credJson = "{}";
+                if (multi) {
+                    // Multi-field providers require a credentials object; api_key alone is rejected
+                    // so partial secrets are never stored.
+                    if (b.credentials === undefined)
+                        return send(res, 400, { error: `credentials required: ${fields.join(", ")}` });
+                    const norm = normalizeCredentials(pool.provider, b.credentials);
+                    if (!norm.ok)
+                        return send(res, 400, { error: norm.error });
+                    credJson = JSON.stringify(norm.value);
+                    // api_key stays a non-empty dedup/display handle: prefer a conventional
+                    // single-secret field, else the first field value.
+                    const single = (norm.value["apiKey"] ?? norm.value["api_key"] ?? norm.value["apiToken"] ?? norm.value["platformToken"] ?? norm.value["anonKey"] ?? norm.value["authToken"] ?? fields.map((f) => norm.value[f]).find(Boolean) ?? "");
+                    apiKey = single;
+                    if (/[\r\n\x00]/.test(apiKey))
+                        return send(res, 400, { error: "credentials must not contain CR/LF" });
+                }
+                else {
+                    apiKey = typeof b.api_key === "string" ? b.api_key.trim() : "";
+                    if (b.credentials !== undefined) {
+                        const norm = normalizeCredentials(pool.provider, b.credentials);
+                        if (!norm.ok)
+                            return send(res, 400, { error: norm.error });
+                        credJson = JSON.stringify(norm.value);
+                        const v = norm.value[fields[0]] ?? apiKey;
+                        if (!apiKey)
+                            apiKey = v;
+                    }
+                    if (!apiKey)
+                        return send(res, 400, { error: "label + api_key required" });
+                    if (/[\r\n\x00]/.test(apiKey))
+                        return send(res, 400, { error: "label + api_key must not contain CR/LF" });
+                }
+                if (apiKey.length > MAX_API_KEY_CHARS)
+                    return send(res, 400, { error: `api_key must be <= ${MAX_API_KEY_CHARS} characters` });
+                const kc = sdb.prepare("SELECT COUNT(*) AS n FROM pool_keys WHERE pool_id = ?").get(poolId).n;
+                if (kc >= MAX_KEYS_PER_POOL)
+                    return send(res, 400, { error: `key limit reached (${MAX_KEYS_PER_POOL} per pool)` });
+                const dup = sdb.prepare("SELECT id FROM pool_keys WHERE pool_id = ? AND api_key = ?").get(poolId, apiKey);
+                if (dup)
+                    return send(res, 400, { error: "duplicate api_key in this pool" });
+                const r = sdb
+                    .prepare("INSERT INTO pool_keys (pool_id, label, api_key, credentials, info) VALUES (?, ?, ?, ?, ?)")
+                    .run(poolId, label, apiKey, credJson, (b.info ?? "").slice(0, 200));
+                send(res, 200, { id: r.lastInsertRowid });
+                return;
+            }
+            if (req.method === "GET" && keyId !== undefined) {
+                const row = sdb
+                    .prepare("SELECT id, label, api_key, COALESCE(credentials,'{}') AS credentials, info, created_at FROM pool_keys WHERE id = ? AND pool_id = ?")
+                    .get(Number(keyId), poolId);
+                if (!row)
+                    return send(res, 404, { error: "key not found" });
+                const creds = parseCredentials(row.credentials);
+                send(res, 200, { ...row, credentials: Object.keys(creds).length > 0 ? creds : undefined, masked: mask(row.api_key), maskedCredentials: Object.keys(creds).length > 0 ? maskCredentials(creds) : undefined });
+                return;
+            }
+            if (req.method === "PATCH" && keyId !== undefined) {
+                const b = (await readJson(req));
+                const cur = sdb
+                    .prepare("SELECT id FROM pool_keys WHERE id = ? AND pool_id = ?")
+                    .get(Number(keyId), poolId);
+                if (!cur)
+                    return send(res, 404, { error: "key not found" });
+                if (b.label === undefined && b.api_key === undefined && b.credentials === undefined && b.info === undefined)
+                    return send(res, 400, { error: "nothing to update" });
+                if (b.label !== undefined) {
+                    if (typeof b.label !== "string" || !b.label.trim() || b.label.trim().length > 80)
+                        return send(res, 400, { error: "label must be a non-empty string <= 80 characters" });
+                    if (/[\r\n\x00]/.test(b.label))
+                        return send(res, 400, { error: "label must not contain CR/LF" });
+                    sdb.prepare("UPDATE pool_keys SET label = ? WHERE id = ?").run(b.label.trim(), Number(keyId));
+                }
+                if (b.api_key !== undefined) {
+                    if (typeof b.api_key !== "string" || !b.api_key.trim())
+                        return send(res, 400, { error: "api_key must not be empty" });
+                    if (b.api_key.trim().length > MAX_API_KEY_CHARS)
+                        return send(res, 400, { error: `api_key must be <= ${MAX_API_KEY_CHARS} characters` });
+                    if (/[\r\n\x00]/.test(b.api_key))
+                        return send(res, 400, { error: "api_key must not contain CR/LF" });
+                    sdb.prepare("UPDATE pool_keys SET api_key = ?, consec_fail = 0, cooldown_until = 0 WHERE id = ?").run(b.api_key.trim(), Number(keyId));
+                }
+                if (b.credentials !== undefined) {
+                    const pool = getPool(poolId);
+                    if (!pool)
+                        return send(res, 404, { error: "pool not found" });
+                    const norm = normalizeCredentials(pool.provider, b.credentials);
+                    if (!norm.ok)
+                        return send(res, 400, { error: norm.error });
+                    sdb.prepare("UPDATE pool_keys SET credentials = ?, consec_fail = 0, cooldown_until = 0 WHERE id = ?").run(JSON.stringify(norm.value), Number(keyId));
+                    // Keep api_key in sync when the update carries a conventional single secret.
+                    const single = norm.value["apiKey"] ?? norm.value["api_key"] ?? norm.value["apiToken"] ?? norm.value["platformToken"] ?? norm.value["anonKey"];
+                    if (typeof single === "string" && single)
+                        sdb.prepare("UPDATE pool_keys SET api_key = ? WHERE id = ?").run(single, Number(keyId));
+                }
+                if (b.info !== undefined) {
+                    if (typeof b.info !== "string")
+                        return send(res, 400, { error: "info must be a string" });
+                    sdb.prepare("UPDATE pool_keys SET info = ? WHERE id = ?").run(b.info.slice(0, 200), Number(keyId));
+                }
+                const row = sdb
+                    .prepare("SELECT id, label, api_key, COALESCE(credentials,'{}') AS credentials, info, created_at FROM pool_keys WHERE id = ? AND pool_id = ?")
+                    .get(Number(keyId), poolId);
+                send(res, 200, { id: row.id, label: row.label, masked: mask(row.api_key), maskedCredentials: maskCredentials(parseCredentials(row.credentials)), info: row.info });
+                return;
+            }
+            if (req.method === "DELETE" && keyId !== undefined) {
+                sdb.prepare("DELETE FROM usage WHERE key_id = ?").run(Number(keyId));
+                const r = sdb.prepare("DELETE FROM pool_keys WHERE id = ? AND pool_id = ?").run(Number(keyId), poolId);
+                if (r.changes === 0)
+                    return send(res, 404, { error: "key not found" });
+                send(res, 200, { ok: true });
+                return;
+            }
+        }
+        if (req.method === "GET" && url.pathname.startsWith("/logos/")) {
+            const name = url.pathname.slice("/logos/".length);
+            if (!/^[a-z0-9-]+\.(svg|png)$/.test(name)) {
+                res.writeHead(404, { "content-type": "text/plain" });
+                res.end("not found\n");
+                return;
+            }
+            try {
+                const buf = fs.readFileSync(path.join(publicDir(), "logos", name));
+                res.writeHead(200, {
+                    "content-type": name.endsWith(".png") ? "image/png" : "image/svg+xml",
+                    "cache-control": "public, max-age=3600",
+                });
+                res.end(buf);
+            }
+            catch {
+                res.writeHead(404, { "content-type": "text/plain" });
+                res.end("not found\n");
+            }
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/keys") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(keysPage());
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/pools") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(poolsPage());
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/analytics") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(analyticsPage());
+            return;
+        }
+        if (req.method === "GET" && url.pathname.startsWith("/provider/")) {
+            const pid = url.pathname.slice("/provider/".length);
+            if (!/^[a-z0-9-]+$/.test(pid)) {
+                res.writeHead(404, { "content-type": "text/plain" });
+                res.end("not found\n");
+                return;
+            }
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(providerPage());
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/playground") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(playgroundPage());
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/docs") {
+            res.writeHead(302, { location: DOCS_URL });
+            res.end();
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/api/db/ping") {
+            const r = readiness();
+            send(res, r.status, r.body);
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/health") {
+            const h = health();
+            res.writeHead(h.status, { "content-type": h.contentType });
+            res.end(h.body);
+            return;
+        }
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("not found\n");
+    }
+    catch (e) {
+        console.error(`[error] ${req.method} ${req.url}:`, e);
+        if (res.headersSent) {
+            try {
+                res.end();
+            }
+            catch { /* already closed */ }
+            return;
+        }
+        const msg = e.message;
+        // Validation errors stay 400; infrastructure failures are 500 without leaking internals.
+        if (msg === "bad json" || msg === "too large" || msg === "connection closed") {
+            send(res, 400, { error: msg });
+        }
+        else {
+            send(res, 500, { error: "internal error" });
+        }
+    }
+});
+server.listen(PORT, HOST, () => {
+    console.log(`pool-anything listening on http://${HOST}:${PORT}`);
+    for (const w of startupWarnings())
+        console.warn(`[warn] ${w}`);
+});

package/dist/upstream/index.js

@@ -0,0 +1,137 @@
+import { PROVIDERS, parseCredentials } from "../pool/index.js";
+export function resolveTarget(pool) {
+    const p = PROVIDERS.find((x) => x.id === pool.provider);
+    const baseUrl = (pool.base_url || p?.baseUrl || "").trim();
+    const keyHeader = (pool.key_header || p?.keyHeader || "X-API-Key").trim();
+    const keyPrefix = pool.key_prefix || p?.keyPrefix || "";
+    return {
+        baseUrl,
+        keyHeader: keyHeader || "X-API-Key",
+        keyPrefix,
+        extraHeaders: substitutePlaceholders(p?.extraHeaders ?? {}, {}),
+    };
+}
+/**
+ * Per-key target: multi-field credentials can override baseUrl and
+ * extra headers (supabase url, appwrite endpoint/project). Single-field
+ * keys behave exactly like resolveTarget().
+ */
+export function resolveTargetForKey(pool, key) {
+    const base = resolveTarget(pool);
+    const creds = parseCredentials(typeof key.credentials === "string" ? key.credentials : "{}");
+    if (Object.keys(creds).length === 0)
+        return base;
+    const extra = { ...base.extraHeaders };
+    let baseUrl = base.baseUrl;
+    // Supabase: per-project URL wins over the "<ref>" placeholder.
+    if (creds["url"] && (pool.provider === "supabase" || baseUrl.includes("<ref>") || baseUrl.includes("<"))) {
+        baseUrl = creds["url"].replace(/\/+$/, "");
+    }
+    // Appwrite: endpoint + project id.
+    if (creds["endpoint"])
+        baseUrl = creds["endpoint"].replace(/\/+$/, "");
+    if (creds["projectId"])
+        extra["X-Appwrite-Project"] = creds["projectId"];
+    // Supabase anon key fills the Bearer placeholder.
+    if (creds["anonKey"]) {
+        for (const [k, v] of Object.entries(extra)) {
+            if (v.includes("<anonKey>"))
+                extra[k] = v.replace("<anonKey>", creds["anonKey"]);
+        }
+        if (base.keyHeader.toLowerCase() === "apikey" && !extra["Authorization"]) {
+            extra["Authorization"] = `Bearer ${creds["anonKey"]}`;
+        }
+    }
+    return { ...base, baseUrl, extraHeaders: substitutePlaceholders(extra, creds) };
+}
+/** Effective secret material for a key: synthesized for multi-field providers. */
+export function effectiveApiKey(pool, key) {
+    const creds = parseCredentials(typeof key.credentials === "string" ? key.credentials : "{}");
+    // Mailgun expects Basic base64(api:KEY); keys are stored raw per the hint.
+    if (pool.provider === "mailgun") {
+        const raw = (typeof creds["apiKey"] === "string" && creds["apiKey"]) ||
+            (typeof creds["api_key"] === "string" && creds["api_key"]) ||
+            key.api_key;
+        if (raw)
+            return Buffer.from(`api:${raw}`).toString("base64");
+        return key.api_key;
+    }
+    if (Object.keys(creds).length === 0)
+        return key.api_key;
+    // Twilio: Basic base64(SID:token).
+    if (creds["accountSid"] && creds["authToken"]) {
+        return Buffer.from(`${creds["accountSid"]}:${creds["authToken"]}`).toString("base64");
+    }
+    // Appwrite / Turso / generic: prefer explicit api key fields.
+    for (const f of ["apiKey", "api_key", "apiToken", "platformToken", "anonKey", "token"]) {
+        if (typeof creds[f] === "string" && creds[f])
+            return creds[f];
+    }
+    return key.api_key;
+}
+function substitutePlaceholders(headers, creds) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        let s = v;
+        if (s.includes("<PROJECT_ID>") && creds["projectId"])
+            s = s.replace("<PROJECT_ID>", creds["projectId"]);
+        if (s.includes("<anonKey>") && creds["anonKey"])
+            s = s.replace("<anonKey>", creds["anonKey"]);
+        out[k] = s;
+    }
+    return out;
+}
+const QUERY_KEY_RE = /^[A-Za-z0-9_.~-]+$/;
+export function validateQueryParams(q) {
+    if (q === undefined)
+        return { ok: true, value: {} };
+    if (q === null || typeof q !== "object" || Array.isArray(q))
+        return { ok: false, error: "query must be an object" };
+    const entries = Object.entries(q);
+    if (entries.length > 50)
+        return { ok: false, error: "too many query params" };
+    const out = {};
+    for (const [k, v] of entries) {
+        if (typeof k !== "string" || !QUERY_KEY_RE.test(k) || k.length > 256)
+            return { ok: false, error: `invalid query param: ${k}` };
+        if (typeof v !== "string" || v.length > 2000 || /[\r\n\0]/.test(v))
+            return { ok: false, error: `invalid query value for ${k}` };
+        out[k] = v;
+    }
+    return { ok: true, value: out };
+}
+/** Pure builder: returns exact URL + headers the proxy will send. No network. */
+export function buildUpstreamRequest(target, apiKey, opts) {
+    let p = opts.path || "/";
+    if (!p.startsWith("/"))
+        p = "/" + p;
+    // Provider defaults first, then caller headers — but the auth header is
+    // always re-injected afterwards so a caller cannot override or duplicate it.
+    const headers = { "content-type": "application/json", ...target.extraHeaders, ...(opts.headers ?? {}) };
+    const qv = validateQueryParams(opts.query);
+    if (!qv.ok)
+        throw new Error(qv.error);
+    for (const [k, v] of Object.entries(qv.value)) {
+        p += `${p.includes("?") ? "&" : "?"}${encodeURIComponent(k)}=${encodeURIComponent(v)}`;
+    }
+    if (target.keyHeader.startsWith("query:")) {
+        const name = target.keyHeader.slice("query:".length);
+        if (!/^[A-Za-z0-9_-]+$/.test(name))
+            throw new Error("keyHeader invalid");
+        const sep = p.includes("?") ? "&" : "?";
+        p += `${sep}${name}=${encodeURIComponent(apiKey)}`;
+    }
+    else {
+        // Remove any caller-supplied header that case-insensitively matches the
+        // auth header: HTTP is case-insensitive but JS keys are not, so leaving
+        // both would send two auth headers and the upstream may prefer the attacker's.
+        const want = target.keyHeader.toLowerCase();
+        for (const k of Object.keys(headers)) {
+            if (k.toLowerCase() === want)
+                delete headers[k];
+        }
+        headers[target.keyHeader] = target.keyPrefix + apiKey;
+    }
+    const base = target.baseUrl.endsWith("/") ? target.baseUrl.slice(0, -1) : target.baseUrl;
+    return { url: base + p, headers, body: opts.body === undefined ? undefined : JSON.stringify(opts.body) };
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "pool-anything",
+  "version": "0.1.0",
+  "description": "Gather free-tier API keys from any provider into one pool and rotate through them — round-robin key selection, usage/quota tracking, and a drop-in HTTP proxy with a built-in web UI. Zero dependencies, TypeScript + SQLite.",
+  "keywords": [
+    "api-key-pool",
+    "key-rotation",
+    "api-proxy",
+    "round-robin",
+    "free-tier",
+    "rate-limit",
+    "llm-gateway",
+    "api-gateway",
+    "usage-tracking",
+    "quota",
+    "sqlite",
+    "typescript",
+    "zero-dependency",
+    "groq",
+    "openrouter",
+    "gemini",
+    "anthropic",
+    "openai",
+    "self-hosted"
+  ],
+  "homepage": "https://github.com/Parithosh-Varma/pool-anything#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Parithosh-Varma/pool-anything.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Parithosh-Varma/pool-anything/issues"
+  },
+  "license": "Apache-2.0",
+  "author": "Parithosh Varma",
+  "type": "module",
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "bin": {
+    "pool-anything": "bin/pool-anything.js"
+  },
+  "files": [
+    "dist/",
+    "bin/",
+    "data/providers.json",
+    "public/logos/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "start": "tsx src/server.ts",
+    "build": "tsc && node scripts/copy-assets.mjs",
+    "prepublishOnly": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "db:init": "tsx src/db/init.ts",
+    "export:tools": "tsx scripts/export-tools-ui.ts",
+    "tools:daemon": "tsx scripts/tools-watch.ts",
+    "test": "tsx --test \"tests/**/*.test.ts\"",
+    "start:dist": "node dist/server.js"
+  },
+  "devDependencies": {
+    "@types/node": "^22.7.4",
+    "tsx": "^4.19.1",
+    "typescript": "^5.6.2"
+  }
+}

package/public/logos/anthropic.svg

@@ -0,0 +1 @@
+<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Anthropic</title><path d="M13.827 3.52h3.603L24 20h-3.603l-6.57-16.48zm-7.258 0h3.767L16.906 20h-3.674l-1.343-3.461H5.017l-1.344 3.46H0L6.57 3.522zm4.132 9.959L8.453 7.687 6.205 13.48H10.7z"></path></svg>

package/public/logos/anyscale.svg

@@ -0,0 +1 @@
+<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Anyscale</title><path d="M17.583 12.344L14.606 17.5H20.6c.22 0 .424-.117.535-.308l2.799-4.848h-6.351zM23.934 11.656l-2.799-4.848A.616.616 0 0020.6 6.5h-5.994l2.977 5.156h6.35zM8.653 6.5h5.953l-2.997-5.191A.616.616 0 0011.074 1H5.476l3.176 5.5zM4.881 1.343L2.083 6.191a.618.618 0 000 .617l2.997 5.191 2.976-5.156-3.175-5.5zM8.057 17.155L5.081 12l-2.998 5.192a.618.618 0 000 .617l2.798 4.848 3.175-5.5h.001zM5.476 23h5.598c.22 0 .424-.117.535-.308l2.997-5.192H8.653L5.477 23z"></path></svg>

package/public/logos/appwrite.svg

@@ -0,0 +1 @@
+<svg fill="#FD366E" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Appwrite</title><path d="M24 17.291v5.29H10.557A10.58 10.58 0 0 1 0 12.715v-1.43c.048-.735.174-1.463.374-2.171C1.63 4.673 5.713 1.419 10.557 1.419c4.844 0 8.927 3.254 10.183 7.695h-5.749a5.283 5.283 0 0 0-4.434-2.404 5.282 5.282 0 0 0-4.434 2.404A5.23 5.23 0 0 0 5.267 12a5.27 5.27 0 0 0 1.66 3.848 5.27 5.27 0 0 0 3.63 1.443H24Zm0-6.734v5.291h-9.813A5.276 5.276 0 0 0 15.848 12c0-.5-.07-.984-.199-1.443H24Z"/></svg>

package/public/logos/brave.svg

@@ -0,0 +1 @@
+<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Brave</title><path d="M17.544 2.375c.017-.005 1.844-.5 2.712.361.872.872 1.588 1.642 1.588 1.642l-.565 1.38v-.003.006-.003L22 7.8c-.014.05-2.112 7.983-2.357 8.954-.488 1.924-.819 2.663-2.202 3.638a212.634 212.634 0 01-4.305 2.917c-.41.252-.92.691-1.383.691-.463 0-.974-.439-1.383-.691a213.099 213.099 0 01-4.306-2.917c-1.383-.975-1.72-1.714-2.2-3.632-.246-.977-2.35-8.904-2.364-8.96l.722-2.045-.566-1.383s.722-.764 1.594-1.63c.866-.872 2.712-.36 2.712-.36L8.066 0h7.373l2.105 2.375zm-5.797 12.557c-.138 0-1.04.318-1.762.691l-.457.234c-.487.253-.823.428-.956.506-.168.108-.066.306.09.414.15.103 2.195 1.684 2.394 1.865l.09.078c.186.168.432.391.607.391.174 0 .415-.223.607-.391l.084-.078c.2-.169 2.244-1.756 2.394-1.865.15-.108.258-.3.09-.408-.133-.084-.475-.253-.956-.506h-.006l-.457-.24c-.722-.373-1.623-.691-1.762-.691zm.006-11.276c-.35.02-.694.092-1.023.211l-.378.126c-.493.169-.969.331-1.21.331-.312 0-2.554-.428-2.584-.433 0 0-2.706 3.26-2.706 3.957 0 .577.228.805.504 1.07l.174.175 2.033 2.152.06.067c.204.204.5.498.29.998l-.043.102c-.228.535-.511 1.203-.15 1.876.384.716 1.046 1.19 1.467 1.118.42-.084 1.419-.601 1.78-.841.367-.229 1.52-1.19 1.521-1.551 0-.307-.829-.812-1.238-1.053l-.18-.12-.199-.12c-.367-.229-1.035-.644-1.047-.825-.018-.228-.017-.294.283-.853l.21-.379c.289-.487.602-1.029.536-1.426-.085-.433-.777-.685-1.36-.901l-.21-.078-.613-.229c-.583-.222-1.232-.463-1.34-.511-.145-.073-.11-.132.335-.174l.223-.025c.553-.06 1.582-.168 2.08-.03l.32.09c.564.145 1.25.337 1.316.445l.03.048c.067.09.109.145.037.53l-.121.607c-.15.806-.391 2.069-.421 2.351l-.012.115c-.042.312-.066.529.301.613.438.119.884.206 1.335.259.216 0 .824-.144 1.24-.24l.095-.025c.367-.078.343-.289.3-.602l-.011-.12c-.03-.282-.27-1.54-.42-2.345l-.122-.614c-.072-.384-.024-.439.036-.529l.03-.048c.067-.108.753-.294 1.318-.444l.318-.091c.5-.138 1.528-.03 2.081.03l.216.018c.451.048.493.108.343.18-.11.049-.758.29-1.341.512-.273.108-.547.21-.823.307-.583.216-1.275.468-1.36.907-.066.391.247.939.535 1.42l.21.379c.301.56.308.625.284.854-.012.18-.68.595-1.053.824l-.192.126-.181.108c-.41.247-1.238.758-1.238 1.059 0 .367 1.16 1.316 1.521 1.55.367.235 1.36.758 1.78.836.421.078 1.082-.396 1.467-1.112.36-.673.078-1.335-.15-1.876l-.042-.102c-.21-.5.084-.794.289-1.004l.065-.06 2.02-2.147.181-.181c.271-.265.505-.493.505-1.07 0-.698-2.706-3.957-2.706-3.957-.03.006-2.275.44-2.586.44l.007-.007c-.252 0-.722-.156-1.215-.337l-.379-.12c-.612-.21-1.02-.21-1.022-.21z"></path></svg>