pkg

type App struct {
	Listen     string `arg:"listen"      default:"127.0.0.1:8788" env:"LISTEN"      required:"true"  usage:"address to listen to"`
	ConfigPath string `` /* 267-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AuthConfig struct {
	// Key is the legacy shared secret field. Kept solely so a legacy `auth:`
	// block still parses and is rejected at load; a non-nil AuthConfig makes
	// Config.Validate fail the config (fail-closed migration guard).
	Key string `yaml:"key" display:"length"`
}

type Config struct {
	Router    Router              `yaml:"router"`
	Providers map[string]Provider `yaml:"providers"`
	// DefaultToken is the optional top-level shared outbound bearer key
	// (spec 015). Every provider — and every Upstream pool member — that
	// declares no token: of its own resolves its outbound Authorization to
	// Bearer <DefaultToken>; a provider/member token: overrides it; with
	// neither set, the client's Authorization header passes through
	// unchanged. Absent or empty = no global default, today's behavior.
	// The key is operator config read only at wiring — never from client
	// input — and flows only in the outbound Authorization header, never
	// into logs or trace files (redacted like every other token).
	DefaultToken string `yaml:"default_token,omitempty"  display:"length"`
	// Aliases maps a short operator-typed model name to the full
	// model string the upstream expects. Resolved single-hop before
	// glob-routing: a request body `{"model":"qwen"}` becomes
	// `{"model":"qwen3.6:35b-a3b-coding-nvfp4"}` before the router
	// walks providers' models globs. Nil / empty map = no-op.
	Aliases map[string]string `yaml:"aliases,omitempty"`
	// ModelPools maps an invented model name to an ordered list of
	// members (spec 013). A client that sends `model: <poolname>` gets
	// the request body's model field rewritten to one member's concrete
	// model and routed through that member's provider — the router picks
	// the member per session, the client never sees it. Unlike Aliases
	// (one name -> one model), a pool name maps to a choice of models.
	// Nil / empty map = no-op.
	ModelPools map[string][]ModelPoolMember `yaml:"model_pools,omitempty"`
	// Trace, when true, enables per-request trace logging for /v1/*
	// requests: every request writes one JSON file capturing the full
	// request and response to ~/.claude-code-router/trace/. When false
	// (or absent), no trace files are written and no trace middleware
	// is allocated on the request hot path. Read once at Load; a
	// restart applies it.
	Trace bool `yaml:"trace,omitempty"`
	// Auth is the legacy spec-009 auth block. It is retained ONLY as a
	// load-failing detection probe: yaml.Unmarshal populates it from a
	// legacy `auth:` block, and Config.Validate rejects any non-nil value so
	// a config still carrying the removed auth path fails closed instead of
	// silently degrading to unauthenticated. Configure allowedApiKeys
	// instead. Absent and null both leave it nil and pass validation.
	Auth *AuthConfig `yaml:"auth,omitempty"`
	// AllowedApiKeys is the top-level registry of API keys that authenticate
	// non-loopback /v1/* requests. It is also the single rotation point: a
	// key that appears here (or in any provider's list) authenticates the
	// caller, and a per-provider claim pins routing. Absent, null, and empty
	// are equivalent and all mean: no key enforcement and no key routing —
	// the /v1/* path behaves exactly as it does today. Keys are literal
	// strings, like provider token: fields.
	AllowedApiKeys []string `yaml:"allowedApiKeys,omitempty" display:"length"`
	// ProviderOrder records the provider keys in YAML declaration order,
	// captured during unmarshal. Go maps cannot preserve iteration order, but
	// the router's "walk providers in declaration order, first glob match
	// wins" semantics depend on it once two providers share a model glob
	// (e.g. two seibert-vllm entries serving deepseek-* on separate quotas).
	// Populated only when the config was loaded from YAML; programmatically
	// built configs leave it empty and route-building falls back to sorted
	// order.
	ProviderOrder []string `yaml:"-"`
}

type ModelPoolMember struct {
	Provider string `yaml:"provider"`
	Model    string `yaml:"model"`
	Weight   int    `yaml:"weight,omitempty"`
	Overflow bool   `yaml:"overflow,omitempty"`
}

type Provider struct {
	// Upstream is the base URL, e.g. https://api.anthropic.com.
	Upstream string `yaml:"upstream"`
	// Token, if set, replaces the client's Authorization header with
	// "Bearer <Token>". If empty, the client's Authorization is
	// forwarded verbatim — used for the subscription-OAuth case.
	Token string `yaml:"token,omitempty"                    display:"length"`
	// Models is the list of glob patterns (filepath.Match syntax) the
	// router uses to match request body's `model` field. Examples:
	// "claude-opus-*", "MiniMax-*", "qwen*".
	Models []string `yaml:"models"`
	// RequiresLeadingSystem lists glob patterns (same syntax as
	// Models) naming models behind this provider whose chat template
	// rejects a system-role message that is not the first entry of
	// the conversation. When the resolved model name matches one of
	// these patterns, the router lifts every out-of-place system
	// message into the top-level system block before forwarding.
	//
	// Scoped per model, never per provider: ollama's system-position
	// restriction lives in each model's chat template, so qwen3.6 and
	// qwen3.8 behave differently behind one provider (verified
	// 2026-08-15 with identical curl payloads against the same ollama
	// instance: qwen3.6 -> 200, qwen3.8 -> 500).
	//
	// Absent, nil, and empty are equivalent and all mean "never
	// transform anything for this provider".
	RequiresLeadingSystem []string `yaml:"requiresLeadingSystem,omitempty"`
	// AllowedApiKeys is this provider's routing pin: a request whose
	// presented x-api-key is in this list is dispatched to this provider
	// (its outbound token), overriding model-glob selection. A key may
	// appear in both the top-level registry and a provider's list — the
	// registry is the auth superset, the provider claim is the routing pin.
	// A key must NOT be claimed by more than one provider (validation
	// error, see Config.Validate). Absent, null, and empty all mean: this
	// provider claims no keys, so it is only reachable via glob routing.
	AllowedApiKeys []string `yaml:"allowedApiKeys,omitempty"           display:"length"`
	// MaxConcurrentRequests, when > 0, caps how many /v1/* requests this
	// provider forwards upstream at the same time. Requests beyond the cap
	// queue for up to MaxConcurrentWaitSeconds; a request still waiting
	// when the queue wait elapses is answered HTTP 429 with an
	// Anthropic-shaped rate_limit_error body so the client's own backoff
	// retries cleanly. Absent, 0, or negative means unlimited — no
	// queueing, no router-issued 429, byte-for-byte current behavior.
	MaxConcurrentRequests int `yaml:"maxConcurrentRequests,omitempty"`
	// MaxConcurrentWaitSeconds is how long a queued request waits for a
	// free slot before the router answers HTTP 429. Only consulted on a
	// capped provider (MaxConcurrentRequests > 0); absent, 0, or negative
	// resolves to the 30s default at wiring.
	MaxConcurrentWaitSeconds int `yaml:"maxConcurrentWaitSeconds,omitempty"`
	// Upstreams is the pool of servers this provider routes to. When
	// present it wins over the legacy single Upstream field; validation
	// rejects a provider that sets both. Absent, the legacy form is
	// synthesized into a one-entry pool by normalizeUpstreams, so after
	// Load every provider has a non-empty Upstreams (spec 012).
	Upstreams []Upstream `yaml:"upstreams,omitempty"`
	// Window is the legacy single-upstream form's eligibility window
	// (spec 014): when set, normalizeUpstreams copies it onto the
	// synthesized single member (a one-member pool is still a pool).
	// Providers that declare an upstreams: list carry windows per entry —
	// setting a provider-level window AND upstreams: is rejected.
	Window *Window `yaml:"window,omitempty"`
}

type Router struct {
	// DefaultProvider is the provider key used when no model glob matches.
	// Must reference a key in Providers; validated on Load.
	DefaultProvider string `yaml:"default_provider"`
}

type ServerFactory func(ctx context.Context, listen, configPath string) (librun.Func, error)

type Upstream struct {
	Upstream                 string `yaml:"upstream"`
	Token                    string `yaml:"token,omitempty"                    display:"length"`
	Weight                   int    `yaml:"weight,omitempty"`
	MaxConcurrentRequests    int    `yaml:"maxConcurrentRequests,omitempty"`
	MaxConcurrentWaitSeconds int    `yaml:"maxConcurrentWaitSeconds,omitempty"`
	// Window, when set, restricts when this member is eligible: a member
	// whose window does not contain "now" is excluded from session
	// pinning and least-loaded selection (spec 014). Absent = always
	// eligible, today's behavior.
	Window *Window `yaml:"window,omitempty"`
}

type Window struct {
	From  libtime.TimeOfDay `yaml:"from"`
	Until libtime.TimeOfDay `yaml:"until"`
}