zevairouter 1.0.154 → 1.0.155

package/src/lib/pxpipe/events.js

@@ -1,125 +0,0 @@
-import fs from "fs";
-import path from "path";
-import { PXPIPE_DIR } from "./install.js";
-
-const EVENTS_FILE = path.join(PXPIPE_DIR, "events.jsonl");
-const ROTATED_FILE = path.join(PXPIPE_DIR, "events.jsonl.1");
-const MAX_FILE_BYTES = 5 * 1024 * 1024;
-const DAY_MS = 24 * 60 * 60 * 1000;
-
-function ensureDir() {
-  if (!fs.existsSync(PXPIPE_DIR)) fs.mkdirSync(PXPIPE_DIR, { recursive: true });
-}
-
-// Fire-and-forget: stats must never break the request path.
-export function appendPxpipeEvent(event) {
-  try {
-    ensureDir();
-    try {
-      const stat = fs.statSync(EVENTS_FILE);
-      if (stat.size > MAX_FILE_BYTES) fs.renameSync(EVENTS_FILE, ROTATED_FILE);
-    } catch { /* no file yet */ }
-    fs.appendFile(EVENTS_FILE, JSON.stringify({ ts: Date.now(), ...event }) + "\n", () => {});
-  } catch { /* ignore */ }
-}
-
-export function readPxpipeEvents({ sinceMs = null, limit = null } = {}) {
-  const events = [];
-  for (const file of [ROTATED_FILE, EVENTS_FILE]) {
-    try {
-      if (!fs.existsSync(file)) continue;
-      for (const line of fs.readFileSync(file, "utf8").split("\n")) {
-        if (!line) continue;
-        try {
-          const ev = JSON.parse(line);
-          if (sinceMs && ev.ts < sinceMs) continue;
-          events.push(ev);
-        } catch { /* skip corrupt line */ }
-      }
-    } catch { /* ignore */ }
-  }
-  events.sort((a, b) => a.ts - b.ts);
-  return limit ? events.slice(-limit) : events;
-}
-
-function emptyTotals() {
-  return {
-    requests: 0, compressed: 0, bypassed: 0, errors: 0,
-    tokensBeforeEst: 0, tokensAfterEst: 0, tokensSavedEst: 0, savedPct: 0,
-    imagesGenerated: 0, compressionTimeMs: 0, avgCompressionMs: 0,
-  };
-}
-
-function accumulate(totals, ev) {
-  totals.requests++;
-  if (ev.applied) {
-    totals.compressed++;
-    totals.tokensBeforeEst += ev.tokensBeforeEst || 0;
-    totals.tokensAfterEst += ev.tokensAfterEst || 0;
-    totals.tokensSavedEst += ev.tokensSavedEst || 0;
-    totals.imagesGenerated += ev.imageCount || 0;
-    totals.compressionTimeMs += ev.durationMs || 0;
-  } else if (ev.reason === "transform_error" || ev.reason === "timeout") {
-    totals.errors++;
-  } else {
-    totals.bypassed++;
-  }
-}
-
-function finalize(totals) {
-  totals.savedPct = totals.tokensBeforeEst > 0
-    ? +((totals.tokensSavedEst / totals.tokensBeforeEst) * 100).toFixed(2)
-    : 0;
-  totals.avgCompressionMs = totals.compressed > 0
-    ? Math.round(totals.compressionTimeMs / totals.compressed)
-    : 0;
-  return totals;
-}
-
-// Aggregated stats for the dashboard: all-time + windowed totals, a daily
-// tokens-saved timeline (last `timelineDays`), and the most recent events.
-export function getPxpipeStats({ timelineDays = 30, recentLimit = 100 } = {}) {
-  const events = readPxpipeEvents();
-  const now = Date.now();
-  const startOfToday = new Date(new Date(now).setHours(0, 0, 0, 0)).getTime();
-
-  const windows = {
-    all: emptyTotals(),
-    today: emptyTotals(),
-    yesterday: emptyTotals(),
-    last7d: emptyTotals(),
-    last30d: emptyTotals(),
-  };
-
-  const timeline = new Map();
-  for (let i = timelineDays - 1; i >= 0; i--) {
-    const day = new Date(startOfToday - i * DAY_MS);
-    timeline.set(day.toISOString().slice(0, 10), { date: day.toISOString().slice(0, 10), tokensSavedEst: 0, compressed: 0, requests: 0 });
-  }
-
-  for (const ev of events) {
-    accumulate(windows.all, ev);
-    if (ev.ts >= startOfToday) accumulate(windows.today, ev);
-    else if (ev.ts >= startOfToday - DAY_MS) accumulate(windows.yesterday, ev);
-    if (ev.ts >= now - 7 * DAY_MS) accumulate(windows.last7d, ev);
-    if (ev.ts >= now - 30 * DAY_MS) accumulate(windows.last30d, ev);
-
-    const key = new Date(ev.ts).toISOString().slice(0, 10);
-    const bucket = timeline.get(key);
-    if (bucket) {
-      bucket.requests++;
-      if (ev.applied) {
-        bucket.compressed++;
-        bucket.tokensSavedEst += ev.tokensSavedEst || 0;
-      }
-    }
-  }
-
-  for (const w of Object.values(windows)) finalize(w);
-
-  return {
-    windows,
-    timeline: [...timeline.values()],
-    recent: events.slice(-recentLimit).reverse(),
-  };
-}

package/src/lib/pxpipe/install.js

@@ -1,123 +0,0 @@
-import fs from "fs";
-import path from "path";
-import { spawn, execSync } from "child_process";
-import { DATA_DIR } from "@/lib/dataDir.js";
-
-export const PXPIPE_DIR = path.join(DATA_DIR, "pxpipe");
-export const PXPIPE_PACKAGE = "pxpipe-proxy";
-const INSTALL_LOG = path.join(PXPIPE_DIR, "install.log");
-const INSTALL_TIMEOUT_MS = 5 * 60 * 1000;
-
-const IS_WIN = process.platform === "win32";
-const NPM_CMD = IS_WIN ? "npm.cmd" : "npm";
-
-// Same PATH extension trick as headroom/detect.js: packaged/launchd environments
-// often miss the Node bin dirs.
-const EXTRA_BINS = IS_WIN
-  ? [`${process.env.ProgramFiles || ""}\\nodejs`, `${process.env.APPDATA || ""}\\npm`]
-  : ["/usr/local/bin", "/opt/homebrew/bin", `${process.env.HOME || ""}/.local/bin`, "/usr/bin", "/bin"];
-const EXTENDED_PATH = [...EXTRA_BINS, process.env.PATH || ""].filter(Boolean).join(path.delimiter);
-
-let installInFlight = null;
-
-function ensureDir() {
-  if (!fs.existsSync(PXPIPE_DIR)) fs.mkdirSync(PXPIPE_DIR, { recursive: true });
-}
-
-export function packageRoot() {
-  return path.join(PXPIPE_DIR, "node_modules", PXPIPE_PACKAGE);
-}
-
-export function libraryEntry() {
-  return path.join(packageRoot(), "dist", "core", "library.js");
-}
-
-export function findNpm() {
-  try {
-    const out = execSync(`${IS_WIN ? "where" : "which"} npm`, {
-      stdio: ["ignore", "pipe", "ignore"],
-      windowsHide: true,
-      env: { ...process.env, PATH: EXTENDED_PATH },
-    }).toString().trim();
-    return out ? out.split(/\r?\n/)[0].trim() : null;
-  } catch {
-    return null;
-  }
-}
-
-// { installed, version, path } — installed means the library entry exists on disk.
-export function getInstallInfo() {
-  try {
-    const pkgJson = path.join(packageRoot(), "package.json");
-    if (!fs.existsSync(pkgJson) || !fs.existsSync(libraryEntry())) {
-      return { installed: false, version: null, path: null };
-    }
-    const pkg = JSON.parse(fs.readFileSync(pkgJson, "utf8"));
-    return { installed: true, version: pkg.version || null, path: packageRoot() };
-  } catch {
-    return { installed: false, version: null, path: null };
-  }
-}
-
-export function isInstalling() {
-  return installInFlight !== null;
-}
-
-// Install (or repair by reinstalling) pxpipe-proxy into DATA_DIR/pxpipe.
-// Serialized: concurrent calls await the same run.
-export function installPxpipe() {
-  if (installInFlight) return installInFlight;
-  installInFlight = runInstall().finally(() => { installInFlight = null; });
-  return installInFlight;
-}
-
-async function runInstall() {
-  const npm = findNpm();
-  if (!npm) {
-    const err = new Error("npm not found on PATH — Node.js/npm is required to install PXPIPE");
-    err.code = "NPM_NOT_FOUND";
-    throw err;
-  }
-
-  ensureDir();
-  const pkgJson = path.join(PXPIPE_DIR, "package.json");
-  if (!fs.existsSync(pkgJson)) {
-    fs.writeFileSync(pkgJson, JSON.stringify({ name: "zevairouter-pxpipe-host", private: true }, null, 2));
-  }
-
-  const outFd = fs.openSync(INSTALL_LOG, "a");
-  fs.writeSync(outFd, `\n[${new Date().toISOString()}] npm install ${PXPIPE_PACKAGE}@latest\n`);
-
-  await new Promise((resolve, reject) => {
-    const child = spawn(npm, ["install", `${PXPIPE_PACKAGE}@latest`, "--no-audit", "--no-fund", "--omit=dev"], {
-      cwd: PXPIPE_DIR,
-      stdio: ["ignore", outFd, outFd],
-      windowsHide: true,
-      env: { ...process.env, PATH: EXTENDED_PATH },
-    });
-    const timer = setTimeout(() => {
-      child.kill("SIGKILL");
-      reject(new Error("npm install timed out after 5 minutes — see install.log"));
-    }, INSTALL_TIMEOUT_MS);
-    child.once("error", (e) => { clearTimeout(timer); reject(e); });
-    child.once("exit", (code) => {
-      clearTimeout(timer);
-      if (code === 0) resolve();
-      else reject(new Error(`npm install exited with code ${code} — see install.log`));
-    });
-  }).finally(() => fs.closeSync(outFd));
-
-  const info = getInstallInfo();
-  if (!info.installed) throw new Error("install finished but package is missing — see install.log");
-  return info;
-}
-
-export function getInstallLogTail(maxLines = 200) {
-  try {
-    if (!fs.existsSync(INSTALL_LOG)) return "";
-    const lines = fs.readFileSync(INSTALL_LOG, "utf8").split(/\r?\n/).filter(Boolean);
-    return lines.slice(-maxLines).join("\n");
-  } catch {
-    return "";
-  }
-}

package/src/lib/pxpipe/loader.js

@@ -1,70 +0,0 @@
-import { pathToFileURL } from "url";
-import { getInstallInfo, libraryEntry } from "./install.js";
-
-// Module cache: pxpipe is loaded once per process ("started") and dropped on
-// "stop". In library mode start/stop govern the in-process module, not a daemon.
-let cached = null; // { module, version, loadedAt }
-let loadPromise = null;
-
-export function getLoadedInfo() {
-  return cached ? { loaded: true, version: cached.version, loadedAt: cached.loadedAt } : { loaded: false };
-}
-
-export async function loadPxpipe() {
-  if (cached) return cached;
-  if (loadPromise) return loadPromise;
-  loadPromise = doLoad().finally(() => { loadPromise = null; });
-  return loadPromise;
-}
-
-async function doLoad() {
-  const info = getInstallInfo();
-  if (!info.installed) {
-    const err = new Error("PXPIPE is not installed");
-    err.code = "NOT_INSTALLED";
-    throw err;
-  }
-  // Cache-bust per version so Repair/upgrade takes effect without a server restart.
-  const url = `${pathToFileURL(libraryEntry()).href}?v=${encodeURIComponent(info.version || "0")}`;
-  const mod = await import(/* webpackIgnore: true */ url);
-  if (typeof mod.transformAnthropicMessages !== "function") {
-    throw new Error("installed pxpipe package does not export transformAnthropicMessages");
-  }
-  cached = { module: mod, version: info.version, loadedAt: Date.now() };
-  return cached;
-}
-
-export function unloadPxpipe() {
-  const wasLoaded = !!cached;
-  cached = null;
-  return wasLoaded;
-}
-
-// Transform function for the request pipeline; null when unavailable (fail-open).
-// autoLoad controls whether a cold cache triggers a load (first request warms it).
-export async function getTransform({ autoLoad = true } = {}) {
-  try {
-    if (!cached && !autoLoad) return null;
-    const { module: mod } = await loadPxpipe();
-    return mod.transformAnthropicMessages;
-  } catch {
-    return null;
-  }
-}
-
-// Health self-test: run a tiny synthetic Claude request through the transformer.
-// A healthy module parses it and answers with a machine-readable reason.
-export async function selfTest() {
-  const startedAt = Date.now();
-  const { module: mod } = await loadPxpipe();
-  const body = new TextEncoder().encode(JSON.stringify({
-    model: "claude-fable-5",
-    max_tokens: 16,
-    messages: [{ role: "user", content: "ping" }],
-  }));
-  const result = await mod.transformAnthropicMessages({ body, model: "claude-fable-5" });
-  if (!result || typeof result.applied !== "boolean" || !(result.body instanceof Uint8Array)) {
-    throw new Error("transform returned an unexpected shape");
-  }
-  return { ok: true, reason: result.reason, durationMs: Date.now() - startedAt };
-}

package/src/lib/pxpipe/service.js

@@ -1,49 +0,0 @@
-import { getInstallInfo, isInstalling, findNpm } from "./install.js";
-import { getLoadedInfo, loadPxpipe, selfTest } from "./loader.js";
-
-// Aggregate status for the Token Saver card and /api/pxpipe/status.
-// "running" in library mode = module loaded into this process.
-export function getPxpipeStatus() {
-  const install = getInstallInfo();
-  const loaded = getLoadedInfo();
-  return {
-    installed: install.installed,
-    installing: isInstalling(),
-    version: install.version,
-    path: install.path,
-    running: loaded.loaded,
-    loadedAt: loaded.loadedAt || null,
-    uptimeMs: loaded.loaded ? Date.now() - loaded.loadedAt : 0,
-    npmAvailable: !!findNpm(),
-    mode: "library", // in-process transform, not an external proxy
-  };
-}
-
-// PRD health checklist, adapted to library mode: installed? → module loads
-// (the "executable found / port listening" equivalent) → test request transforms.
-export async function runHealthCheck() {
-  const checks = [];
-  const fail = (error) => ({ healthy: false, checks, error });
-
-  const install = getInstallInfo();
-  checks.push({ id: "installed", label: "PXPIPE installed", ok: install.installed, detail: install.version ? `v${install.version}` : null });
-  if (!install.installed) return fail("pxpipe not installed");
-
-  try {
-    await loadPxpipe();
-    checks.push({ id: "module", label: "Transform module loads", ok: true, detail: `v${install.version}` });
-  } catch (e) {
-    checks.push({ id: "module", label: "Transform module loads", ok: false, detail: e.message });
-    return fail(`Cannot load module: ${e.message}`);
-  }
-
-  try {
-    const test = await selfTest();
-    checks.push({ id: "transform", label: "Test request transforms", ok: true, detail: `${test.durationMs}ms (${test.reason})` });
-  } catch (e) {
-    checks.push({ id: "transform", label: "Test request transforms", ok: false, detail: e.message });
-    return fail(`Self-test failed: ${e.message}`);
-  }
-
-  return { healthy: true, checks, error: null };
-}

package/src/lib/qoder/constants.js

@@ -1,64 +0,0 @@
-/**
- * Qoder API constants ported from CLIProxyAPIPlus qoder-provider branch.
- *
- * Endpoint set:
- *   openapi.qoder.sh   - device flow + userinfo + quota usage
- *   center.qoder.sh    - token refresh (best-effort, currently 403 for device tokens)
- *   api3.qoder.sh      - inference (chat) + model list, requires COSY signing
- *   qoder.com/device   - browser landing page for device authorization
- */
-
-export const QODER_OPENAPI_BASE = "https://openapi.qoder.sh";
-export const QODER_CENTER_BASE = "https://center.qoder.sh";
-export const QODER_CHAT_BASE = "https://api3.qoder.sh";
-
-export const QODER_LOGIN_URL = "https://qoder.com/device/selectAccounts";
-
-// Device flow endpoints
-export const QODER_DEVICE_TOKEN_URL = `${QODER_OPENAPI_BASE}/api/v1/deviceToken/poll`;
-export const QODER_USERINFO_URL = `${QODER_OPENAPI_BASE}/api/v1/userinfo`;
-export const QODER_QUOTA_USAGE_URL = `${QODER_OPENAPI_BASE}/api/v2/quota/usage`;
-export const QODER_REFRESH_TOKEN_URL = `${QODER_CENTER_BASE}/algo/api/v3/user/refresh_token`;
-
-// Inference endpoints (under /algo on api3.qoder.sh, all COSY-signed)
-export const QODER_CHAT_SIG_PATH = "/api/v2/service/pro/sse/agent_chat_generation";
-export const QODER_CHAT_URL = `${QODER_CHAT_BASE}/algo${QODER_CHAT_SIG_PATH}?FetchKeys=llm_model_result&AgentId=agent_common`;
-export const QODER_CHAT_URL_ENCODED = `${QODER_CHAT_URL}&Encode=1`;
-export const QODER_MODEL_LIST_URL = `${QODER_CHAT_BASE}/algo/api/v2/model/list`;
-
-// COSY header constants. These are not arbitrary — the upstream signature
-// validation matches them against the values used at signing time.
-export const QODER_IDE_VERSION = "1.0.0";
-export const QODER_CLIENT_TYPE = "5";
-export const QODER_DATA_POLICY = "disagree";
-export const QODER_LOGIN_VERSION = "v2";
-export const QODER_MACHINE_OS = "x86_64_windows";
-export const QODER_MACHINE_TYPE = "5";
-
-// Canonical model identifiers. Identity map — keep as a map so callers can
-// cheaply test "is this a known qoder model?" before sending the request.
-export const QODER_MODEL_MAP = {
-  // Tier models
-  auto: "auto",
-  ultimate: "ultimate",
-  performance: "performance",
-  efficient: "efficient",
-  lite: "lite",
-  // Frontier models
-  qmodel: "qmodel",
-  qmodel_latest: "qmodel_latest",
-  dmodel: "dmodel",
-  dfmodel: "dfmodel",
-  gm51model: "gm51model",
-  kmodel: "kmodel",
-  mmodel: "mmodel",
-};
-
-// RSA public key for COSY encryption (extracted from Qoder IDE v0.9).
-// Matches the CLIProxyAPIPlus branch and live qodercli traffic.
-export const QODER_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
-4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
-6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
-XcW+ML9FoCI6AOvOzwIDAQAB
------END PUBLIC KEY-----`;

package/src/lib/qoder/cosy.js

@@ -1,175 +0,0 @@
-/**
- * Qoder COSY (hybrid RSA+AES+MD5) signing, ported from CLIProxyAPIPlus
- * qoder-provider branch (internal/auth/qoder/cosy.go).
- *
- * Every signed request carries:
- *   - an AES-128-CBC payload of the user info, the AES key wrapped in RSA
- *   - an MD5 signature over `payload || cosyKey || timestamp || body || sigPath`
- *   - the body's MD5 hash + length so the server can validate integrity
- *   - 17 Cosy-* / X-* headers fingerprinting the client (machine id, IDE
- *     version, organization id, etc.)
- *
- * The on-the-wire header keys use the same casing as qodercli:
- *   Cosy-Machineid, not Cosy-MachineID.
- */
-
-import crypto from "crypto";
-import { v4 as uuidv4 } from "uuid";
-
-import {
-  QODER_CLIENT_TYPE,
-  QODER_DATA_POLICY,
-  QODER_IDE_VERSION,
-  QODER_LOGIN_VERSION,
-  QODER_MACHINE_OS,
-  QODER_MACHINE_TYPE,
-  QODER_RSA_PUBLIC_KEY,
-} from "./constants.js";
-
-// AES-128 wants a 16-byte key. Match qodercli/Veria: take the first 16 chars
-// of a fresh UUID's canonical string (hyphens included). The key is fresh
-// per request so even though the IV reuses the key bytes, each request still
-// has a unique IV.
-function generateAesKey() {
-  return uuidv4().slice(0, 16);
-}
-
-function pkcs7Pad(data, blockSize) {
-  const padding = blockSize - (data.length % blockSize);
-  const padded = Buffer.alloc(data.length + padding, padding);
-  data.copy(padded, 0);
-  return padded;
-}
-
-function aesEncryptCbcBase64(plaintext, keyStr) {
-  const keyBytes = Buffer.from(keyStr, "utf8");
-  if (keyBytes.length !== 16) {
-    throw new Error(`aes key must be 16 bytes, got ${keyBytes.length}`);
-  }
-  const iv = keyBytes.subarray(0, 16);
-  const cipher = crypto.createCipheriv("aes-128-cbc", keyBytes, iv);
-  cipher.setAutoPadding(false);
-  const padded = pkcs7Pad(Buffer.from(plaintext, "utf8"), 16);
-  const encrypted = Buffer.concat([cipher.update(padded), cipher.final()]);
-  return encrypted.toString("base64");
-}
-
-function rsaEncryptBase64(data) {
-  const encrypted = crypto.publicEncrypt(
-    { key: QODER_RSA_PUBLIC_KEY, padding: crypto.constants.RSA_PKCS1_PADDING },
-    Buffer.from(data, "utf8"),
-  );
-  return encrypted.toString("base64");
-}
-
-function encryptUserInfo(userInfo) {
-  const aesKey = generateAesKey();
-  const plaintext = JSON.stringify(userInfo);
-  const infoB64 = aesEncryptCbcBase64(plaintext, aesKey);
-  const cosyKeyB64 = rsaEncryptBase64(aesKey);
-  return { cosyKey: cosyKeyB64, info: infoB64 };
-}
-
-function md5Hex(input) {
-  return crypto.createHash("md5").update(input).digest("hex");
-}
-
-/**
- * Strip the leading "/algo" prefix from the request path. Matches qodercli
- * convention. Empty input returns "".
- */
-function computeSigPath(requestUrl) {
-  let pathname;
-  try {
-    pathname = new URL(requestUrl).pathname || "";
-  } catch {
-    return "";
-  }
-  if (pathname.startsWith("/algo")) {
-    return pathname.slice("/algo".length);
-  }
-  return pathname;
-}
-
-/**
- * Generate a fresh machine UUID. Persisted on the connection record so
- * every request from the same auth carries the same machineId.
- */
-export function generateMachineId() {
-  return uuidv4();
-}
-
-/**
- * Build the full Cosy-* header set for a single Qoder request.
- *
- * @param {Buffer|Uint8Array|string} body  The exact bytes that will be sent.
- *   For GET requests pass an empty Buffer / "".
- * @param {string} requestUrl              Full request URL (used for sigPath).
- * @param {object} creds
- * @param {string} creds.userId            Stable Qoder user id.
- * @param {string} creds.authToken         Device access token (`dt-...`).
- * @param {string} [creds.name]            Display name (optional).
- * @param {string} [creds.email]           Email (optional, can be empty).
- * @param {string} [creds.machineId]       Persisted machine UUID.
- * @returns {Record<string, string>} Header map ready to merge onto fetch().
- */
-export function buildCosyHeaders(body, requestUrl, creds) {
-  if (!creds?.userId) throw new Error("cosy: user id is empty");
-  if (!creds?.authToken) throw new Error("cosy: auth token is empty");
-
-  const bodyBuf = Buffer.isBuffer(body)
-    ? body
-    : typeof body === "string"
-      ? Buffer.from(body, "latin1")
-      : Buffer.from(body || []);
-
-  const { cosyKey, info } = encryptUserInfo({
-    uid: creds.userId,
-    security_oauth_token: creds.authToken,
-    name: creds.name || "",
-    aid: "",
-    email: creds.email || "",
-  });
-
-  const timestamp = String(Math.floor(Date.now() / 1000));
-  const requestId = uuidv4();
-
-  const payloadJson = JSON.stringify({
-    version: "v1",
-    requestId,
-    info,
-    cosyVersion: QODER_IDE_VERSION,
-    ideVersion: "",
-  });
-  const payloadB64 = Buffer.from(payloadJson, "utf8").toString("base64");
-
-  const sigPath = computeSigPath(requestUrl);
-  const sigInput = `${payloadB64}\n${cosyKey}\n${timestamp}\n${bodyBuf.toString("latin1")}\n${sigPath}`;
-  const sig = md5Hex(Buffer.from(sigInput, "latin1"));
-
-  const machineId = creds.machineId || generateMachineId();
-  const bodyHash = md5Hex(bodyBuf);
-  const bodyLength = String(bodyBuf.length);
-
-  return {
-    Authorization: `Bearer COSY.${payloadB64}.${sig}`,
-    "Cosy-Key": cosyKey,
-    "Cosy-User": creds.userId,
-    "Cosy-Date": timestamp,
-    "Cosy-Version": QODER_IDE_VERSION,
-    "Cosy-Machineid": machineId,
-    "Cosy-Machinetoken": machineId,
-    "Cosy-Machinetype": QODER_MACHINE_TYPE,
-    "Cosy-Machineos": QODER_MACHINE_OS,
-    "Cosy-Clienttype": QODER_CLIENT_TYPE,
-    "Cosy-Clientip": "127.0.0.1",
-    "Cosy-Bodyhash": bodyHash,
-    "Cosy-Bodylength": bodyLength,
-    "Cosy-Sigpath": sigPath,
-    "Cosy-Data-Policy": QODER_DATA_POLICY,
-    "Cosy-Organization-Id": "",
-    "Cosy-Organization-Tags": "",
-    "Login-Version": QODER_LOGIN_VERSION,
-    "X-Request-Id": uuidv4(),
-  };
-}

package/src/lib/qoder/encoding.js

@@ -1,55 +0,0 @@
-/**
- * Qoder body encoding ported from qoder2api's QoderEncoding.java (via the
- * CLIProxyAPIPlus qoder-provider branch).
- *
- * Algorithm:
- *   1. base64-encode the plaintext bytes (standard alphabet).
- *   2. Rearrange: split into thirds, reorder as [tail][mid][head].
- *   3. Substitute each character via a custom alphabet mapping.
- *
- * The encoded body must be sent with `&Encode=1` appended to the URL so the
- * server decodes in reverse. The obfuscation prevents Alibaba Cloud WAF from
- * pattern-matching the plaintext request body.
- */
-
-const QODER_STD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-const QODER_CUSTOM_ALPHABET = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
-
-const QODER_S2C = (() => {
-  const table = new Int16Array(128).fill(-1);
-  for (let i = 0; i < 64; i++) {
-    table[QODER_STD_ALPHABET.charCodeAt(i)] = QODER_CUSTOM_ALPHABET.charCodeAt(i);
-  }
-  table["=".charCodeAt(0)] = "$".charCodeAt(0);
-  return table;
-})();
-
-/**
- * Encode plaintext bytes/string using Qoder's WAF-bypass scheme.
- * @param {Buffer|Uint8Array|string} plaintext
- * @returns {string} encoded string
- */
-export function qoderEncodeBody(plaintext) {
-  const buf = Buffer.isBuffer(plaintext)
-    ? plaintext
-    : typeof plaintext === "string"
-      ? Buffer.from(plaintext, "utf8")
-      : Buffer.from(plaintext);
-
-  const std = buf.toString("base64");
-  const n = std.length;
-  const a = Math.floor(n / 3);
-  // [tail][mid][head]
-  const rearranged = std.slice(n - a) + std.slice(a, n - a) + std.slice(0, a);
-
-  const out = Buffer.alloc(n);
-  for (let i = 0; i < n; i++) {
-    const c = rearranged.charCodeAt(i);
-    if (c < 128 && QODER_S2C[c] >= 0) {
-      out[i] = QODER_S2C[c];
-    } else {
-      out[i] = c;
-    }
-  }
-  return out.toString("latin1");
-}

package/src/lib/requestDetailsDb.js

@@ -1,4 +0,0 @@
-// Shim → re-export from new SQLite-based DB layer (src/lib/db/)
-export {
-  saveRequestDetail, getRequestDetails, getRequestDetailById,
-} from "@/lib/db/index.js";