pool-anything 0.1.0

package/dist/media/capabilities.js

@@ -0,0 +1,103 @@
+// Multimodal capability map + provider-specific message builders.
+//
+// Single source of truth for which providers/models accept media in/out.
+// The Playground mirrors this table client-side (see playgroundPage); keep the
+// two in sync when adding providers. Model-name heuristics refine the
+// provider baseline (e.g. tts/whisper/embed models never take image input).
+export const MAX_MEDIA_FILE_BYTES = 8_000_000; // ~8MB per attachment (abuse cap)
+export const MAX_PROXY_BODY_BYTES = 12_000_000; // proxy JSON cap incl. base64 media
+// Upstream->caller relay cap (raised from 4000 for Studio media). Large!
+// One media proxy transiently holds raw bytes + base64 (~2x); keep conservative.
+export const MAX_RELAY_CHARS = 8_000_000;
+export const MAX_UPSTREAM_MEDIA_BYTES = 12_000_000;
+export const ALLOWED_IMAGE_MIMES = ["image/png", "image/jpeg", "image/webp"];
+export const ALLOWED_AUDIO_MIMES = ["audio/mpeg", "audio/wav", "audio/webm", "audio/ogg", "audio/mp4"];
+export const ALLOWED_VIDEO_MIMES = ["video/mp4", "video/webm"];
+const BASE_CAPS = {
+    openai: { vision: true, audioIn: true, videoIn: false, imageOut: true, audioOut: true, videoOut: false },
+    anthropic: { vision: true, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    gemini: { vision: true, audioIn: true, videoIn: true, imageOut: true, audioOut: true, videoOut: true },
+    groq: { vision: true, audioIn: true, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    openrouter: { vision: true, audioIn: false, videoIn: false, imageOut: true, audioOut: false, videoOut: false },
+    mistral: { vision: true, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    fireworks: { vision: true, audioIn: false, videoIn: false, imageOut: true, audioOut: false, videoOut: false },
+    together: { vision: true, audioIn: false, videoIn: false, imageOut: true, audioOut: false, videoOut: false },
+    huggingface: { vision: true, audioIn: false, videoIn: false, imageOut: true, audioOut: false, videoOut: false },
+    replicate: { vision: true, audioIn: false, videoIn: false, imageOut: true, audioOut: false, videoOut: true },
+    perplexity: { vision: true, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    cohere: { vision: true, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    anyscale: { vision: false, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false },
+    elevenlabs: { vision: false, audioIn: false, videoIn: false, imageOut: false, audioOut: true, videoOut: false },
+    deepgram: { vision: false, audioIn: true, videoIn: false, imageOut: false, audioOut: true, videoOut: false },
+    cartesia: { vision: false, audioIn: false, videoIn: false, imageOut: false, audioOut: true, videoOut: false },
+};
+const NONE = { vision: false, audioIn: false, videoIn: false, imageOut: false, audioOut: false, videoOut: false };
+const NO_VISION_MODEL = /tts|whisper|transcri|embed|image|flux|diffusion|imagen|dall|sonic|nova|stt|audit/i;
+const IMAGE_GEN_MODEL = /image|flux|diffusion|imagen|dall|stable|midjourney/i;
+const VIDEO_GEN_MODEL = /video|veo|pika|runway|sora/i;
+/** Provider baseline refined by model-name heuristics. Pure + tested. */
+export function capabilityFor(providerId, model = "") {
+    const base = BASE_CAPS[providerId] ?? NONE;
+    if (!model)
+        return { ...base };
+    const m = model.toLowerCase();
+    const noVision = NO_VISION_MODEL.test(m);
+    if (/embed/.test(m))
+        return { ...NONE };
+    if (IMAGE_GEN_MODEL.test(m))
+        return { ...base, vision: false, audioIn: false, videoIn: false };
+    if (VIDEO_GEN_MODEL.test(m))
+        return { ...base, vision: false, audioIn: false, videoIn: false };
+    if (/tts|sonic|eleven/.test(m))
+        return { ...base, vision: false, audioIn: false, videoIn: false };
+    if (/whisper|transcri|^nova|stt/.test(m))
+        return { ...base, vision: false, videoIn: false };
+    if (noVision)
+        return { ...base, vision: false };
+    return { ...base };
+}
+export function supports(providerId, model, cap) {
+    return capabilityFor(providerId, model ?? "")[cap];
+}
+/** OpenAI-compatible vision content parts (groq/openrouter/mistral/etc.). */
+export function openAiVisionParts(text, images) {
+    const parts = [{ type: "text", text }];
+    for (const img of images) {
+        parts.push({ type: "image_url", image_url: { url: `data:${img.mime};base64,${img.b64}` } });
+    }
+    return parts;
+}
+/** Anthropic native vision content blocks (image source.type base64). */
+export function anthropicVisionBlocks(text, images) {
+    const blocks = [{ type: "text", text }];
+    for (const img of images) {
+        blocks.push({ type: "image", source: { type: "base64", media_type: img.mime, data: img.b64 } });
+    }
+    return blocks;
+}
+/**
+ * Build chat messages for a provider given text + image attachments.
+ * Anthropic uses native image blocks; everyone else uses the
+ * OpenAI-compatible image_url data-URI shape (which groq, mistral,
+ * together, fireworks, openrouter, gemini-compat, etc. all accept).
+ */
+export function buildVisionMessages(providerId, text, images) {
+    if (images.length === 0)
+        return [{ role: "user", content: text }];
+    if (providerId === "anthropic") {
+        return [{ role: "user", content: anthropicVisionBlocks(text, images) }];
+    }
+    return [{ role: "user", content: openAiVisionParts(text, images) }];
+}
+/** Human-readable gate note when a model lacks a capability. */
+export function gateNote(cap, providerId, model) {
+    const label = cap === "vision" ? "image input" : cap === "audioIn" ? "audio input" : cap === "videoIn" ? "video input" : cap === "imageOut" ? "image output" : cap === "audioOut" ? "audio output" : "video output";
+    return `this model doesn't support ${label} (${providerId} ${model || "default model"})`;
+}
+export function isAllowedMime(kind, mime) {
+    if (kind === "image")
+        return ALLOWED_IMAGE_MIMES.includes(mime);
+    if (kind === "audio")
+        return ALLOWED_AUDIO_MIMES.includes(mime);
+    return ALLOWED_VIDEO_MIMES.includes(mime);
+}

package/dist/middleware/auth.js

@@ -0,0 +1,37 @@
+import { apiToken, authEnabled } from "../config/env.js";
+/** True when the request carries the configured bearer token (or auth is disabled). */
+export function isAuthorized(req) {
+    if (!authEnabled())
+        return true;
+    const h = req.headers["authorization"];
+    if (typeof h !== "string")
+        return false;
+    // Constant-time-ish compare without leaking length via early exit timing is
+    // overkill here, but avoid `startsWith` prefix-oracle confusion: exact match only.
+    const want = `Bearer ${apiToken()}`;
+    if (h.length !== want.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < h.length; i++)
+        diff |= h.charCodeAt(i) ^ want.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * Routes that disclose raw keys, mutate state, spend quota, or advance the
+ * rotation cursor require auth when POOL_API_TOKEN is set. Masked read-only
+ * summaries stay public so the dashboard works without a token.
+ */
+export function requiresAuth(method, pathname) {
+    // Raw key disclosure.
+    if (/^\/api\/pools\/\d+\/keys\/\d+$/.test(pathname))
+        return true;
+    // Writes.
+    if (method === "POST" || method === "PATCH" || method === "DELETE") {
+        if (pathname.startsWith("/api/"))
+            return true;
+    }
+    // Rotation cursor advances (state change) even though the key is masked.
+    if (method === "GET" && /^\/api\/pools\/\d+\/next$/.test(pathname))
+        return true;
+    return false;
+}

package/dist/observability/health.js

@@ -0,0 +1,31 @@
+import { dbPing } from "../db/index.js";
+import { getAnalytics } from "../pool/index.js";
+/** Liveness: never touches the DB. */
+export function health() {
+    return { status: 200, body: "ok\n", contentType: "text/plain" };
+}
+/** Readiness: SQLite reachable and writable enough to SELECT. Never throws. */
+export function readiness() {
+    try {
+        return { status: 200, body: dbPing() };
+    }
+    catch {
+        return { status: 500, body: { ok: false } };
+    }
+}
+/** Analytics snapshot for the dashboard. Never throws (empty on failure). */
+export function analyticsSnapshot() {
+    try {
+        return { status: 200, body: getAnalytics() };
+    }
+    catch {
+        return {
+            status: 500,
+            body: {
+                requests: 0, tokens: 0, pools: 0, keys: 0, cooling: 0, avgTokens: 0,
+                series: [], keysSeries: [], poolsSeries: [],
+                deltaRequestsPct: 0, deltaTokensPct: 0,
+            },
+        };
+    }
+}

package/dist/pool/index.js

@@ -0,0 +1,407 @@
+import { DatabaseSync } from "node:sqlite";
+import fs from "node:fs";
+import path from "node:path";
+import { DB_PATH } from "../config/env.js";
+import { providersJsonPath } from "../config/paths.js";
+export { DB_PATH };
+fs.mkdirSync(path.dirname(DB_PATH), { recursive: true });
+export const sdb = new DatabaseSync(DB_PATH);
+sdb.exec(`PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 5000; PRAGMA foreign_keys = ON;`);
+sdb.exec(`
+  CREATE TABLE IF NOT EXISTS pools (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    provider TEXT NOT NULL,
+    name TEXT NOT NULL,
+    cursor INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE TABLE IF NOT EXISTS pool_keys (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    pool_id INTEGER NOT NULL REFERENCES pools(id) ON DELETE CASCADE,
+    label TEXT NOT NULL,
+    api_key TEXT NOT NULL,
+    info TEXT NOT NULL DEFAULT '',
+    cooldown_until INTEGER NOT NULL DEFAULT 0,
+    latency_ms REAL,
+    consec_fail INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE TABLE IF NOT EXISTS usage (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    pool_id INTEGER NOT NULL REFERENCES pools(id) ON DELETE CASCADE,
+    key_id INTEGER NOT NULL REFERENCES pool_keys(id) ON DELETE CASCADE,
+    tokens INTEGER NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_pool_keys_pool ON pool_keys(pool_id);
+  CREATE INDEX IF NOT EXISTS idx_usage_pool_created ON usage(pool_id, created_at);
+  CREATE INDEX IF NOT EXISTS idx_usage_key_created ON usage(key_id, created_at);
+  CREATE INDEX IF NOT EXISTS idx_pools_provider ON pools(provider);
+`);
+const FALLBACK_PROVIDERS = [
+    {
+        id: "cartesia",
+        name: "Cartesia",
+        quota: "20,000 free tokens",
+        keyFields: ["api_key"],
+        hint: "Paste a Cartesia API key. Add key 1, key 2… to pool them.",
+        baseUrl: "https://api.cartesia.ai",
+        keyHeader: "X-API-Key",
+        keyPrefix: "",
+        extraHeaders: { "Cartesia-Version": "2024-06-10" },
+    },
+    {
+        id: "groq",
+        name: "Groq",
+        quota: "free tier",
+        keyFields: ["api_key"],
+        hint: "Paste a Groq API key (gsk_…). Add key 1, key 2… to pool them.",
+        baseUrl: "https://api.groq.com/openai/v1",
+        keyHeader: "Authorization",
+        keyPrefix: "Bearer ",
+        extraHeaders: {},
+    },
+    {
+        id: "custom",
+        name: "Custom",
+        quota: "bring your own",
+        keyFields: ["api_key"],
+        hint: "Anything we don't provide: name it, add keys + info.",
+        baseUrl: "",
+        keyHeader: "X-API-Key",
+        keyPrefix: "",
+        extraHeaders: {},
+    },
+];
+function loadProviders() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(providersJsonPath(), "utf8"));
+        if (!Array.isArray(raw))
+            throw new Error("not an array");
+        return raw
+            .filter((p) => typeof p.id === "string" && typeof p.name === "string" && typeof p.baseUrl === "string")
+            .map((p) => ({
+            id: p.id,
+            name: p.name,
+            quota: String(p.quota ?? ""),
+            keyFields: Array.isArray(p.keyFields) && p.keyFields.every((k) => typeof k === "string") ? p.keyFields : ["api_key"],
+            hint: String(p.hint ?? ""),
+            baseUrl: p.baseUrl,
+            keyHeader: String(p.keyHeader ?? "X-API-Key"),
+            keyPrefix: String(p.keyPrefix ?? ""),
+            extraHeaders: p.extraHeaders !== null && typeof p.extraHeaders === "object" && !Array.isArray(p.extraHeaders)
+                ? Object.fromEntries(Object.entries(p.extraHeaders).filter(([, v]) => typeof v === "string"))
+                : {},
+            docsUrl: typeof p.docsUrl === "string" ? p.docsUrl : undefined,
+            logoFile: typeof p.logo === "string" && p.logo ? path.basename(p.logo) : undefined,
+            poolable: (p.poolable ?? true),
+        }));
+    }
+    catch (e) {
+        console.warn(`[warn] failed to load data/providers.json, using fallback providers: ${e.message}`);
+        return FALLBACK_PROVIDERS;
+    }
+}
+export const PROVIDERS = loadProviders();
+export function mask(key) {
+    if (typeof key !== "string" || key.length <= 8)
+        return "****";
+    return `${key.slice(0, 4)}…${key.slice(-2)}`;
+}
+export function providerKeyFields(provider) {
+    return PROVIDERS.find((x) => x.id === provider)?.keyFields ?? ["api_key"];
+}
+export function isMultiFieldProvider(provider) {
+    const f = providerKeyFields(provider);
+    return !(f.length === 1 && (f[0] === "api_key" || f[0] === "apiToken"));
+}
+function cleanFieldValue(v) {
+    if (typeof v !== "string")
+        return null;
+    const t = v.trim();
+    if (!t || t.length > 4096 || /[\r\n\0]/.test(t))
+        return null;
+    return t;
+}
+/** Validate + normalize a credentials object for a provider. Returns normalized or error. */
+export function normalizeCredentials(provider, input) {
+    const fields = providerKeyFields(provider);
+    if (input === undefined || input === null)
+        return { ok: false, error: `missing credentials: ${fields.join(", ")} required` };
+    if (typeof input !== "object" || Array.isArray(input))
+        return { ok: false, error: "credentials must be an object" };
+    const out = {};
+    for (const f of fields) {
+        const v = cleanFieldValue(input[f]);
+        if (v === null)
+            return { ok: false, error: `field ${f} required (non-empty, <=4096 chars, no CR/LF)` };
+        out[f] = v;
+    }
+    return { ok: true, value: out };
+}
+export function parseCredentials(raw) {
+    if (typeof raw !== "string" || !raw || raw === "{}")
+        return {};
+    try {
+        const o = JSON.parse(raw);
+        if (o !== null && typeof o === "object" && !Array.isArray(o)) {
+            const out = {};
+            for (const [k, v] of Object.entries(o)) {
+                if (typeof v === "string" && /^[A-Za-z0-9_-]+$/.test(k))
+                    out[k] = v;
+            }
+            return out;
+        }
+    }
+    catch { /* fall through */ }
+    return {};
+}
+export function maskCredentials(creds) {
+    const out = {};
+    for (const [k, v] of Object.entries(creds))
+        out[k] = mask(v);
+    return out;
+}
+export const QUOTA = {
+    cartesia: 20000, // "20,000 free tokens" — countable tokens
+    elevenlabs: 10000, // "10k credits/mo free" — countable credits
+    tavily: 1000, // "1,000 credits/mo free" — countable credits
+    "brave-search": 2000, // "2,000 queries/mo free" — countable queries
+    serper: 2500, // "2,500 queries one-time" — countable queries
+    scrapingbee: 1000, // "1,000 free credits" — countable credits
+    resend: 3000, // "3,000/mo ... free" — countable emails/mo
+    mailgun: 5000, // "5k/3mo trial" — countable emails per trial
+    postmark: 100, // "100/mo trial" — countable emails/mo
+    upstash: 500000, // "500k cmds/mo free" — countable commands/mo
+    custom: null,
+    // Null with reason — rate-limits belong to cooldown, not QUOTA:
+    groq: null, // "30 req/min, 14.4k req/day" — rate-limit only
+    openrouter: null, // "~20 RPM / 200 RPD" — rate-limit only
+    gemini: null, // "15 RPM / 1500 RPD" — rate-limit only
+    finnhub: null, // "60/min free" — rate-limit only
+    openweather: null, // "1,000/day, 60/min" — daily/minute rate, belongs to cooldown
+    sendgrid: null, // "100/day free (60-day trial)" — daily rate + time-boxed trial
+    cloudflare: null, // "100k req/day" — daily rate, belongs to cooldown
+    huggingface: null, // "hourly limits" — rate-limit, no countable total
+    cohere: null, // "trial key, rate-limited" — no numeric total
+    // Null with reason — dollar-denominated, not comparable to token/credit/request counts:
+    fireworks: null, // "$1 credit" — dollars, not countable units
+    together: null, // "$1 credit" — dollars
+    replicate: null, // "~$5 trial, per-second GPU" — dollars + usage-based
+    openai: null, // "PAYG, $5 min prepay" — PAYG dollars
+    anthropic: null, // "$5 credit" — dollars
+    perplexity: null, // "$5 credit" — dollars
+    deepgram: null, // "$200 credit" — dollars
+    twilio: null, // "$15 credit trial" — dollars
+    // Null with reason — non-countable, vague, or mixed units:
+    mistral: null, // "trial credits, then PAYG" — no numeric total
+    anyscale: null, // "legacy, deprecated" — no quota
+    supabase: null, // "500MB DB, 5GB egress, 50k MAU" — storage/bandwidth/users, not tokens/credits/emails/queries
+    neon: null, // "0.5GB, 100 CU-hrs/mo" — storage/compute, not comparable units
+    turso: null, // "5-9GB, 500M reads/mo" — mixed storage range + reads, no single quota
+    appwrite: null, // "75k MAU, 2 projects" — users/projects, not countable consumption units
+    mapbox: null, // "100k geocode/mo, 50k loads/mo" — mixed units, no single quota
+    googlemaps: null, // "~10k/SKU/mo under $200 credit" — approximate, SKU-varying, dollar-backed
+};
+export const QUOTA_WINDOW = {
+    cartesia: "all", // token grant per key, no monthly reset documented
+    elevenlabs: "month",
+    tavily: "month",
+    "brave-search": "month",
+    serper: "all", // one-time grant
+    scrapingbee: "all", // one-time credits
+    resend: "month",
+    mailgun: "all", // trial grant
+    postmark: "month",
+    upstash: "month",
+    custom: "all",
+    // Null-quota providers: window is irrelevant (no limit enforced), recorded as "all".
+    groq: "all",
+    openrouter: "all",
+    gemini: "all",
+    finnhub: "all",
+    openweather: "all",
+    sendgrid: "all",
+    cloudflare: "all",
+    huggingface: "all",
+    cohere: "all",
+    fireworks: "all",
+    together: "all",
+    replicate: "all",
+    openai: "all",
+    anthropic: "all",
+    perplexity: "all",
+    deepgram: "all",
+    twilio: "all",
+    mistral: "all",
+    anyscale: "all",
+    supabase: "all",
+    neon: "all",
+    turso: "all",
+    appwrite: "all",
+    mapbox: "all",
+    googlemaps: "all",
+};
+export function quotaForProvider(provider) {
+    return { limit: QUOTA[provider] ?? null, window: QUOTA_WINDOW[provider] ?? "all" };
+}
+/**
+ * Daily caps enforced in addition to the primary quota. A key is eligible
+ * only when it is under *every* applicable limit (e.g. resend: 3000/mo AND
+ * 100/day). Primary `QUOTA` stays the legacy single-limit view; this table
+ * adds the second dimension without breaking `quotaForProvider` callers.
+ */
+export const QUOTA_DAILY = {
+    groq: 14400, // "14.4k req/day"
+    openrouter: 200, // "~200 RPD"
+    gemini: 1500, // "1500 RPD"
+    openweather: 1000, // "1,000/day"
+    sendgrid: 100, // "100/day"
+    cloudflare: 100000, // "100k req/day"
+    resend: 100, // "100/day" in addition to 3000/mo
+};
+/** All enforceable limits for a provider (primary + daily). Empty = unlimited. */
+export function quotaLimitsForProvider(provider) {
+    const out = [];
+    const primary = quotaForProvider(provider);
+    if (primary.limit !== null)
+        out.push({ limit: primary.limit, window: primary.window });
+    const daily = QUOTA_DAILY[provider];
+    if (typeof daily === "number" && daily > 0) {
+        // Avoid duplicating when the primary limit already is the daily one.
+        if (!(primary.limit === daily && primary.window === "day"))
+            out.push({ limit: daily, window: "day" });
+    }
+    return out;
+}
+/** SQL fragment restricting joined usage rows to the quota window (UTC, matches datetime('now')). */
+export function quotaWindowFilter(window, column = "u.created_at") {
+    if (column !== "u.created_at" && column !== "created_at")
+        throw new Error("invalid quota column");
+    if (window === "month")
+        return ` AND ${column} >= date('now','start of month')`;
+    if (window === "day")
+        return ` AND ${column} >= date('now')`;
+    return "";
+}
+export function getPool(poolId) {
+    return sdb.prepare("SELECT * FROM pools WHERE id = ?").get(poolId);
+}
+export function keyCount(poolId) {
+    return sdb.prepare("SELECT COUNT(*) AS n FROM pool_keys WHERE pool_id = ?").get(poolId).n;
+}
+try {
+    sdb.exec(`ALTER TABLE pools ADD COLUMN base_url TEXT NOT NULL DEFAULT ''`);
+}
+catch (e) {
+    if (!/duplicate column/i.test(e.message))
+        throw e;
+}
+try {
+    sdb.exec(`ALTER TABLE pools ADD COLUMN key_header TEXT NOT NULL DEFAULT 'X-API-Key'`);
+}
+catch (e) {
+    if (!/duplicate column/i.test(e.message))
+        throw e;
+}
+try {
+    sdb.exec(`ALTER TABLE pools ADD COLUMN key_prefix TEXT NOT NULL DEFAULT ''`);
+}
+catch (e) {
+    if (!/duplicate column/i.test(e.message))
+        throw e;
+}
+for (const col of ["cooldown_until INTEGER NOT NULL DEFAULT 0", "latency_ms REAL", "consec_fail INTEGER NOT NULL DEFAULT 0"]) {
+    try {
+        sdb.exec(`ALTER TABLE pool_keys ADD COLUMN ${col}`);
+    }
+    catch (e) {
+        if (!/duplicate column/i.test(e.message))
+            throw e;
+    }
+}
+try {
+    sdb.exec(`ALTER TABLE pool_keys ADD COLUMN credentials TEXT NOT NULL DEFAULT '{}'`);
+}
+catch (e) {
+    if (!/duplicate column/i.test(e.message))
+        throw e;
+}
+export function firstPoolWithKeys(provider) {
+    const pools = sdb.prepare("SELECT * FROM pools WHERE provider = ? ORDER BY id").all(provider);
+    for (const p of pools) {
+        if (keyCount(p.id) > 0)
+            return p;
+    }
+    return null;
+}
+export function poolSummary(poolId) {
+    const pool = getPool(poolId);
+    if (!pool)
+        return null;
+    const keys = keyCount(poolId);
+    const used = sdb.prepare("SELECT COALESCE(SUM(tokens),0) AS t FROM usage WHERE pool_id = ?").get(poolId).t;
+    const { limit: quota, window } = quotaForProvider(pool.provider);
+    const windowed = sdb.prepare(`SELECT COALESCE(SUM(tokens),0) AS t FROM usage WHERE pool_id = ?${quotaWindowFilter(window, "created_at")}`).get(poolId).t;
+    const perKey = sdb
+        .prepare(`SELECT k.id, k.label, COALESCE(SUM(u.tokens),0) AS used
+       FROM pool_keys k LEFT JOIN usage u ON u.key_id = k.id${quotaWindowFilter(window)}
+       WHERE k.pool_id = ? GROUP BY k.id ORDER BY k.id`)
+        .all(poolId);
+    // All enforceable limits (primary + daily) with pool-level windowed totals.
+    const limits = quotaLimitsForProvider(pool.provider).map(({ limit, window: w }) => {
+        const wUsed = sdb.prepare(`SELECT COALESCE(SUM(tokens),0) AS t FROM usage WHERE pool_id = ?${quotaWindowFilter(w, "created_at")}`).get(poolId).t;
+        return { limit, window: w, usedInWindow: wUsed, remaining: Math.max(0, limit * keys - wUsed) };
+    });
+    return { ...pool, keys, used, usedInWindow: windowed, quota, quotaWindow: window, remaining: quota === null ? null : Math.max(0, quota * keys - windowed), perKey, limits };
+}
+/** Home-page analytics: totals + last-14-day daily series + 7d/7d deltas. */
+export function getAnalytics() {
+    const requests = sdb.prepare("SELECT COUNT(*) AS n FROM usage").get().n;
+    const tokens = sdb.prepare("SELECT COALESCE(SUM(tokens),0) AS t FROM usage").get().t;
+    // Empty pools (no keys) don't count as pools — same rule as the /pools page.
+    const pools = sdb.prepare("SELECT COUNT(*) AS n FROM pools p WHERE EXISTS (SELECT 1 FROM pool_keys k WHERE k.pool_id = p.id)").get().n;
+    const keys = sdb.prepare("SELECT COUNT(*) AS n FROM pool_keys").get().n;
+    const cooling = sdb.prepare("SELECT COUNT(*) AS n FROM pool_keys WHERE cooldown_until > ?").get(Date.now()).n;
+    const rows = sdb
+        .prepare(`SELECT date(created_at) AS day, COUNT(*) AS requests, COALESCE(SUM(tokens),0) AS tokens
+       FROM usage WHERE created_at >= date('now','-13 days') GROUP BY day`)
+        .all();
+    const keyRows = sdb
+        .prepare(`SELECT date(created_at) AS day, COUNT(*) AS n
+       FROM pool_keys WHERE created_at >= date('now','-13 days') GROUP BY day`)
+        .all();
+    const poolRows = sdb
+        .prepare(`SELECT date(p.created_at) AS day, COUNT(*) AS n
+       FROM pools p WHERE p.created_at >= date('now','-13 days')
+       AND EXISTS (SELECT 1 FROM pool_keys k WHERE k.pool_id = p.id)
+       GROUP BY day`)
+        .all();
+    const byDay = new Map(rows.map((r) => [r.day, r]));
+    const byKeyDay = new Map(keyRows.map((r) => [r.day, r.n]));
+    const byPoolDay = new Map(poolRows.map((r) => [r.day, r.n]));
+    const series = [];
+    const keysSeries = [];
+    const poolsSeries = [];
+    const today = new Date();
+    for (let i = 13; i >= 0; i--) {
+        const d = new Date(Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate() - i));
+        const day = d.toISOString().slice(0, 10);
+        const hit = byDay.get(day);
+        series.push({ day, requests: hit?.requests ?? 0, tokens: hit?.tokens ?? 0 });
+        keysSeries.push({ day, count: byKeyDay.get(day) ?? 0 });
+        poolsSeries.push({ day, count: byPoolDay.get(day) ?? 0 });
+    }
+    const prevReq = series.slice(0, 7).reduce((a, p) => a + p.requests, 0);
+    const lastReq = series.slice(7).reduce((a, p) => a + p.requests, 0);
+    const deltaRequestsPct = prevReq === 0 ? (lastReq === 0 ? 0 : null) : ((lastReq - prevReq) / prevReq) * 100;
+    const prevTok = series.slice(0, 7).reduce((a, p) => a + p.tokens, 0);
+    const lastTok = series.slice(7).reduce((a, p) => a + p.tokens, 0);
+    const deltaTokensPct = prevTok === 0 ? (lastTok === 0 ? 0 : null) : ((lastTok - prevTok) / prevTok) * 100;
+    return {
+        requests, tokens, pools, keys, cooling,
+        avgTokens: requests === 0 ? 0 : Math.round((tokens / requests) * 10) / 10,
+        series, keysSeries, poolsSeries,
+        deltaRequestsPct, deltaTokensPct,
+    };
+}