temp undo other refactor (until merged)

.env.example

@@ -2,23 +2,7 @@
 UPSTREAM_BASE_URL=https://api.openai.com/v1
 UPSTREAM_API_KEY=your-upstream-api-key
 
-# Tinfoil (confidential inference enclaves, EHBP)
-# TINFOIL_API_KEY=your-tinfoil-api-key
-
-# Secret key used to encrypt node secrets at rest (optional). If unset, the node
-# generates one on first start, writes it to routstr_secret.key (override the path
-# with ROUTSTR_SECRET_KEY_FILE), and prints it once — back that file up, because
-# losing the key makes previously encrypted secrets unreadable. Set it explicitly
-# to manage the key yourself (recommended in production). Generate one with:
-#   uv run python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-ROUTSTR_SECRET_KEY=
-
-# The admin password and the Nostr identity (nsec) are NOT set here. The admin
-# password is generated and logged once on first start (read it from the logs to
-# sign in); both are managed afterwards from the admin UI and stored encrypted in
-# the database. ADMIN_PASSWORD / NSEC are still read once as a legacy seed for
-# existing deployments, but new nodes should set them in the UI — a value left in
-# .env is ignored once the node has been configured.
+# ADMIN_PASSWORD=secure-admin-password
 
 # Database
 # DATABASE_URL=sqlite+aiosqlite:///keys.db
@@ -26,10 +10,10 @@ ROUTSTR_SECRET_KEY=
 # Node Information
 # NAME=My Routstr Node
 # DESCRIPTION=Fast AI API access with Bitcoin payments
+# NSEC=nsec1...
 # HTTP_URL=https://api.mynode.com
 # ONION_URL=http://mynode.onion (auto fetched from compose)
 # RELAYS="wss://relay.damus.io,wss://relay.nostr.band,wss://eden.nostr.land,wss://relay.routstr.com"
-# ENABLE_ANALYTICS_SHARING=true
 # CASHU_MINTS="https://mint.minibits.cash/Bitcoin,https://mint.cubabitcoin.org,https://ecashmint.otrta.me"
 # RECEIVE_LN_ADDRESS=
 

.github/workflows/container.yml

@@ -14,14 +14,6 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Resolve git metadata
-        id: gitmeta
-        run: |
-          echo "sha=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"
-          echo "tag=$(git describe --tags --exact-match HEAD 2>/dev/null || true)" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
@@ -37,11 +29,7 @@ jobs:
         uses: docker/build-push-action@v4
         with:
           context: .
-          file: Dockerfile.full
           push: true
-          build-args: |
-            GIT_COMMIT=${{ steps.gitmeta.outputs.sha }}
-            GIT_TAG=${{ steps.gitmeta.outputs.tag }}
           tags: |
             ghcr.io/routstr/proxy:latest
             ghcr.io/routstr/core:latest

.github/workflows/test.yml

@@ -67,7 +67,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "18"
           cache: "pnpm"
           cache-dependency-path: ui/pnpm-lock.yaml
 

.gitignore

@@ -1,7 +1,6 @@
 __pycache__
 .env
 keys.db
-routstr_secret.key
 wallet.sqlite3
 
 # Python build artifacts
@@ -17,9 +16,6 @@ dist/
 *.db-shm
 *.db-wal
 .*wallet.sqlite3
-.wallet/
-AGENTS.md
-TEST_SUITE_OVERVIEW.md
 *models.json
 .cashu
 .relay
@@ -42,4 +38,3 @@ proof_backups
 
 *.todo
 ui_out
-.worktrees

Dockerfile

@@ -1,29 +1,26 @@
-FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
+FROM ghcr.io/astral-sh/uv:python3.11-alpine
 
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-        git \
-        build-essential \
-        pkg-config \
-        libsecp256k1-dev \
-        autoconf \
-        automake \
-        libtool \
-    && rm -rf /var/lib/apt/lists/*
+# Install system dependencies required for secp256k1
+RUN apk add --no-cache \
+    pkgconf \
+    build-base \
+    automake \
+    autoconf \
+    libtool \
+    m4 \
+    perl
+RUN apk add git
 
 COPY uv.lock pyproject.toml ./
 RUN mkdir -p /routstr
 
-RUN uv sync --frozen --no-dev --no-install-project
+RUN uv add git+https://github.com/saschanaz/secp256k1-py.git#branch=upgrade060
+# RUN uv sync
 
 WORKDIR /app
 
 COPY . .
 
-ARG GIT_COMMIT=""
-ARG GIT_TAG=""
-ENV GIT_COMMIT=${GIT_COMMIT}
-ENV GIT_TAG=${GIT_TAG}
 ENV PORT=8000
 ENV PYTHONUNBUFFERED=1
 

Dockerfile.full

@@ -1,53 +0,0 @@
-# Multi-stage Dockerfile for Routstr (includes UI build)
-# Stage 1: Build the UI
-FROM node:23-alpine AS ui-builder
-WORKDIR /app/ui
-
-# Install pnpm
-RUN corepack enable pnpm && corepack prepare pnpm@10.15.0 --activate
-
-# Copy UI source
-COPY ui/package.json ui/pnpm-lock.yaml* ui/pnpm-workspace.yaml* ./
-RUN pnpm install --frozen-lockfile
-
-COPY ui/ ./
-ENV NEXT_TELEMETRY_DISABLED=1
-# Next.js build produces a static export in 'out' directory
-RUN pnpm run build
-
-# Stage 2: Build the Routstr Node
-FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim AS runner
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-        git \
-        build-essential \
-        pkg-config \
-        libsecp256k1-dev \
-        autoconf \
-        automake \
-        libtool \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY uv.lock pyproject.toml ./
-
-RUN uv sync --no-dev --no-install-project
-
-WORKDIR /app
-
-COPY . .
-
-# Copy the built UI from the ui-builder stage
-COPY --from=ui-builder /app/ui/out ./ui_out
-
-ARG GIT_COMMIT=""
-ARG GIT_TAG=""
-ENV GIT_COMMIT=${GIT_COMMIT}
-ENV GIT_TAG=${GIT_TAG}
-ENV PORT=8000
-ENV PYTHONUNBUFFERED=1
-
-EXPOSE 8000
-
-# Run the application
-CMD ["/.venv/bin/fastapi", "run", "routstr", "--host", "0.0.0.0"]

Makefile

@@ -98,7 +98,7 @@ docker-down:
 lint:
 	@echo "🔍 Running linting checks..."
 	$(RUFF) check .
-	$(MYPY) .
+	$(MYPY) routstr/ --ignore-missing-imports
 
 format:
 	@echo "✨ Formatting code..."
@@ -107,7 +107,7 @@ format:
 
 type-check:
 	@echo "🔎 Running type checks..."
-	$(MYPY) .
+	$(MYPY) routstr/ --ignore-missing-imports
 
 # Development setup
 dev-setup:
@@ -234,7 +234,7 @@ ci-test:
 ci-lint:
 	@echo "🤖 Running CI linting..."
 	$(RUFF) check . --exit-non-zero-on-fix
-	$(MYPY) . --no-error-summary
+	$(MYPY) routstr/ --ignore-missing-imports --no-error-summary
 
 # Debug helpers
 test-debug:

README.md

@@ -51,48 +51,14 @@ curl https://api.routstr.com/v1/chat/completions \
 
 ## Quick Start (Docker)
 
-If you are a node runner, start a Routstr Core instance using Docker Compose:
+If you are a node runner, start a Routstr Core instance and configure upstream access in the dashboard.
 
-1. **Prepare your `.env`**:
-   ```bash
-   # Optional: encrypts node secrets at rest. If unset, the node generates a key
-   # on first start, writes it to routstr_secret.key, and prints it once — back
-   # up that file. Set it explicitly to manage the key yourself (recommended in
-   # production).
-   ROUTSTR_SECRET_KEY=<generated-key>
-   NAME="My AI Node"
-   DESCRIPTION="Fast access to models"
-   RECEIVE_LN_ADDRESS=yourname@wallet.com
-   ```
-
-   Your Nostr identity (`nsec`) is not set in `.env` — configure it from the admin
-   UI after first start, where it's stored encrypted in the database. (`NSEC` in
-   `.env` is still read once as a legacy seed for existing deployments.)
-
-   If you don't set one, a key is generated and printed on first start — save it
-   somewhere safe (losing it makes previously encrypted secrets unreadable). To
-   supply your own, generate it once and keep it stable:
-   ```bash
-   uv run python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-   ```
-
-2. **Start the services**:
-   ```bash
-   docker compose up -d
-   ```
-
-3. **Get your admin password**:
-   On first start the node generates an admin password and logs it once with the
-   `/admin` URL. Read it from the logs:
-   ```bash
-   docker compose logs routstr | grep -i admin
-   ```
-   (Lost it? Reset with `docker compose exec routstr /.venv/bin/python scripts/reset_admin_password.py --regenerate`.)
-
-4. **Configure**:
-   Open [http://localhost:8000/admin/](http://localhost:8000/admin/) to connect your AI providers and set pricing.
-
-For full instructions, see the **[Provider Quick Start Guide](https://docs.routstr.com/provider/quickstart/)**.
+```bash
+docker run -d \
+  --name routstr-proxy \
+  -p 8000:8000 \
+  ghcr.io/routstr/proxy:latest
+```
 
 ## Development
 

compose.yml

@@ -6,24 +6,22 @@ services:
       context: ./ui
       dockerfile: Dockerfile.build
       args:
-        # NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://127.0.0.1:8000}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://127.0.0.1:8000}
         NEXT_PUBLIC_ADMIN_API_KEY: ${NEXT_PUBLIC_ADMIN_API_KEY:-}
-    user: root
     volumes:
-      - ./ui_out:/output:z
+      - ./ui_out:/output
     command:
       ["sh", "-c", "mkdir -p /output && cp -r /app/built/. /output/ && echo 'UI build copied to mounted volume' && ls -la /output/ && echo 'UI built and ready' && tail -f /dev/null"]
-    restart: unless-stopped
 
   routstr:
     build: .
     depends_on:
       - ui
     volumes:
-      - .:/app:z
-      - ./logs:/app/logs:z
+      - .:/app
+      - ./logs:/app/logs
       - tor-data:/var/lib/tor:ro
-      - ./ui_out:/app/ui_out:ro,z
+      - ./ui_out:/app/ui_out:ro
     env_file:
       - .env
     environment:
@@ -32,7 +30,6 @@ services:
       - 8000:8000
     extra_hosts: # Needed to access locally running models
       - "host.docker.internal:host-gateway"
-    restart: unless-stopped
 
   tor:
     image: ghcr.io/hundehausen/tor-hidden-service:latest
@@ -43,7 +40,6 @@ services:
       - HS_ROUTER=routstr:8000:80
     depends_on:
       - routstr
-    restart: unless-stopped
 
 volumes:
   tor-data:

docs/api/endpoints.md

@@ -327,62 +327,6 @@ GET /v1/models
 }
 ```
 
-### List Model Paths
-
-Get the selectable upstream routes for each advertised model. This endpoint is
-discovery-only; request-side selection will be added separately.
-
-```http
-GET /v1/models/paths
-```
-
-**Response:**
-
-```json
-{
-  "data": [
-    {
-      "id": "anthropic/claude-sonnet-4",
-      "paths": [
-        {
-          "path": "url=https%3A%2F%2Fapi.anthropic.com%2Fv1&provider-id=12&model-id=anthropic%2Fclaude-sonnet-4",
-          "provider": {"id": 12, "slug": "anthropic-primary", "type": "anthropic"},
-          "endpoint": null
-        },
-        {
-          "path": "url=https%3A%2F%2Fopenrouter.ai%2Fapi%2Fv1&provider-id=42&model-id=anthropic%2Fclaude-sonnet-4&endpoint=google-vertex%2Fus",
-          "provider": {"id": 42, "slug": "openrouter-main", "type": "openrouter"},
-          "endpoint": {"tag": "google-vertex/us", "name": "Google"}
-        }
-      ]
-    }
-  ],
-  "updated_at": 1753500000
-}
-```
-
-`path` is an opaque, percent-encoded selector. Clients must store and return it
-unchanged rather than parsing or reconstructing it. It identifies the exact
-configured route with `url`, `provider-id`, and `model-id`. To avoid exposing
-private network details, a configured private IP address or any URL with an
-explicit port is advertised as `http://localhost`. OpenRouter routes additionally
-preserve the exact machine-readable endpoint `tag`. Provider slugs/types and
-endpoint names remain display data. When request-side selection is implemented,
-an endpoint tag must not silently fall back to another backend.
-
-### List Paths for One Model
-
-Use the exact model ID advertised by `/v1/models`. The query parameter safely
-supports IDs containing `/`.
-
-```http
-GET /v1/models/paths/model?model_id=anthropic/claude-sonnet-4
-```
-
-The response uses the same path objects and `updated_at` field as the collection
-endpoint. An unknown model returns `404 Model not found`. A known model whose
-paths have not been discovered yet returns `200` with an empty `data` array.
-
 ## Wallet Management
 
 ### Create Wallet (Coming Soon)
@@ -416,44 +360,6 @@ POST /v1/wallet/create
 }
 ```
 
-### Get Key Information
-
-Get current balance, consumption data, and child keys for an API key.
-
-```http
-GET /v1/balance/info
-Authorization: Bearer sk-...
-```
-
-**Response:**
-
-```json
-{
-  "api_key": "sk-abc...",
-  "balance": 8500000,
-  "reserved": 0,
-  "is_child": false,
-  "parent_key": null,
-  "total_requests": 42,
-  "total_spent": 1500000,
-  "balance_limit": null,
-  "balance_limit_reset": null,
-  "validity_date": null,
-  "child_keys": [
-    {
-      "api_key": "sk-child1...",
-      "total_requests": 10,
-      "total_spent": 500000,
-      "balance_limit": 1000000,
-      "balance_limit_reset": "daily",
-      "validity_date": 1738000000
-    }
-  ]
-}
-```
-
-`balance` is the spendable balance used by request admission.
-
 ### Check Balance
 
 Get current wallet balance.

docs/api/errors.md

@@ -113,109 +113,42 @@ All errors follow a consistent JSON structure:
 **Status:** 402  
 **Resolution:** Top up API key balance
 
-### Cashu Token Redemption Errors
-
-These errors are returned when a Cashu token you pay with cannot be redeemed.
-They apply to every endpoint that accepts a token:
-
-- **Per-request payment** via the `X-Cashu` header (chat completions + Responses API).
-- **API key top-up** via `POST /v1/wallet/topup`.
-- **Minting an API key** from a token sent in `Authorization: Bearer <cashu-token>`.
-
-All three share one classifier, so the same failure yields the same HTTP status
-and sanitized message everywhere. Structured error envelopes (`X-Cashu` and
-`Authorization: Bearer <cashu-token>`) also expose the same `type` and `code` —
-branch on `type` (or `code` for finer granularity). `POST /v1/wallet/topup`
-keeps its existing plain-string `detail` envelope, so branch on status there.
-
-| `type` | Status | `code` | Retryable | Meaning |
-|--------|--------|--------|-----------|---------|
-| `token_already_spent` | 400 | `cashu_token_already_spent` | No | The token was already redeemed. |
-| `invalid_token` | 400 | `invalid_cashu_token` | No | The token is malformed or cannot be decoded. |
-| `mint_error` | 422 | `cashu_token_swap_fees_exceed_amount` | No | Token value is too small to cover the mint's swap/melt fees. |
-| `mint_error` | 422 | `cashu_foreign_mint_swap_failed` | No | Swapping the token from a foreign mint to the primary mint failed. |
-| `mint_unreachable` | 503 | `cashu_mint_unreachable` | **Yes** | The mint could not be reached (DNS failure, refused/reset connection, timeout). The token is fine — retry once the mint recovers. |
-| `cashu_error` | 400 | `cashu_token_redemption_failed` | No | The token could not be redeemed for another expected reason. |
-| `cashu_error` | 400 | `cashu_token_zero_value` | No | The token redeemed to zero (empty/dust token, or value fully consumed by fees). |
-| `token_consumed` | 500 | `cashu_token_consumed` | No | The token was **spent** (melted/redeemed) but crediting it then failed. Do not retry — the token is gone; contact support to reconcile. |
-| `api_error` | 500 | `internal_error` | Maybe | Unexpected server-side fault during redemption. |
-
-!!! important "Retry only `mint_unreachable`"
-    Only `mint_unreachable` (503) means the same token will work again later —
-    everything else is a permanent property of the token and must not be
-    blindly retried. Use exponential backoff for the 503. In particular, a
-    `token_consumed` 500 means the mint already spent the token, so a retry
-    would fail as `token_already_spent`.
-
-#### Mint Unreachable (retryable)
+#### Invalid Token
 
 ```json
 {
   "error": {
-    "type": "mint_unreachable",
-    "message": "Cashu mint is unreachable",
-    "code": "cashu_mint_unreachable"
+    "type": "payment_error",
+    "message": "Invalid Cashu token",
+    "code": "invalid_token",
+    "details": {
+      "reason": "Token already spent"
+    }
   }
 }
 ```
 
-**Status:** 503
+**Status:** 400  
+**Resolution:** Use a valid, unspent token
 
-**Resolution:** The token is valid — the mint is temporarily down. Retry with
-backoff, or pay with a token from a different mint.
-
-#### Token Already Spent
+#### Mint Unavailable
 
 ```json
 {
   "error": {
-    "type": "token_already_spent",
-    "message": "Cashu token already spent",
-    "code": "cashu_token_already_spent"
+    "type": "payment_error",
+    "message": "Cannot connect to Cashu mint",
+    "code": "mint_unavailable",
+    "details": {
+      "mint_url": "https://mint.example.com",
+      "retry_after": 60
+    }
   }
 }
 ```
 
-**Status:** 400
-
-**Resolution:** Use a fresh, unspent token. Do not retry with the same token.
-
-#### Response envelope differs by endpoint
-
-The `error` object above is identical everywhere, but the surrounding envelope
-depends on how you paid:
-
-- **`X-Cashu` header payments** (chat + Responses API) return the object at the
-  top level, alongside a `request_id`:
-
-  ```json
-  {
-    "error": { "type": "mint_unreachable", "message": "Cashu mint is unreachable", "code": "cashu_mint_unreachable" },
-    "request_id": "req-abc123"
-  }
-  ```
-
-  The original token is echoed back in the `X-Cashu` **response header only when
-  it is still spendable** (e.g. `mint_unreachable`, `invalid_cashu_token`, fee
-  errors) so you can recover/retry it. It is **not** echoed for spent/consumed
-  tokens (`cashu_token_already_spent`, `cashu_token_consumed`,
-  `cashu_token_zero_value`, `internal_error`) — retrying those can never succeed.
-
-- **`Authorization: Bearer <cashu-token>`** (API key minting) wraps it in
-  FastAPI's `detail` field:
-
-  ```json
-  { "detail": { "error": { "type": "mint_unreachable", "message": "Cashu mint is unreachable", "code": "cashu_mint_unreachable" } } }
-  ```
-
-- **`POST /v1/wallet/topup`** returns a plain string message under `detail` —
-  it carries the shared HTTP **status** and **message** (e.g. `503` for an
-  unreachable mint) but not the structured `type`/`code`, so branch on the
-  status code here:
-
-  ```json
-  { "detail": "Cashu mint is unreachable" }
-  ```
+**Status:** 503  
+**Resolution:** Try again later or use different mint
 
 ### Validation Errors
 
@@ -414,7 +347,7 @@ class ErrorHandler:
         'rate_limit',
         'upstream_timeout',
         'model_overloaded',
-        'cashu_mint_unreachable'
+        'mint_unavailable'
     }
     
     # Errors requiring user action

docs/api/overview.md

@@ -100,7 +100,6 @@ All errors follow a consistent format:
 Standard OpenAI-compatible endpoints:
 
 - **Models**: `/v1/models`
-- **Model paths**: `/v1/models/paths`, `/v1/models/paths/model?model_id=...`
 - **Responses**: `/v1/responses`
 - **Chat Completions**: `/v1/chat/completions`
 - **Embeddings**: `/v1/embeddings`
@@ -156,7 +155,7 @@ The response includes your change in the same header:
 X-Cashu: cashuA7k2mNp4...
 ```
 
-This is fully stateless—no session, no `/v1/balance/refund` call needed. However, **streaming does not work with `X-Cashu`** because the refund can only be calculated after the full response is generated. If you lose the `X-Cashu` response header before claiming your change, you can reclaim the refund via `POST /v1/wallet/refund` by supplying the original payment token in the `x-cashu` header.
+This is fully stateless—no session, no `/v1/balance/refund` call needed. However, **streaming does not work with `X-Cashu`** because the refund can only be calculated after the full response is generated.
 
 ## Response Headers
 
@@ -303,7 +302,7 @@ Get node metadata:
 GET /v1/info
 ```
 
-Supported models and pricing are available at `/v1/models`. Upstream provider path discovery is available at `/v1/models/paths` and `/v1/models/paths/model?model_id=...`.
+Supported models and pricing are available at `/v1/models`.
 
 ## Next Steps
 

docs/client/payments.md

@@ -53,11 +53,9 @@ If your balance runs low, you don't need a new key. You can top up the existing
 
 ### Via Lightning
 
-`POST /lightning/invoice` with `Authorization: Bearer sk-...` header and body `{"amount_sats": 1000, "purpose": "topup"}`.
+`POST /lightning/invoice` with `{"amount_sats": 1000, "purpose": "topup", "api_key": "sk-..."}`.
 *Once paid, the funds are added to your existing key.*
 
-> Legacy: the endpoint is also exposed at `/v1/balance/lightning/invoice`, and accepts an `api_key` field in the body as a fallback for older clients. New integrations should use the RIP-08 path with the `Authorization` header.
-
 ### Via Cashu
 
 `POST /v1/balance/topup` with `{"cashu_token": "..."}` and `Authorization: Bearer sk-...`.

docs/ehbp-proxy-support.md

@@ -1,150 +0,0 @@
-# EHBP Proxy Support for Tinfoil Models
-
-## Problem
-
-The SDK's `SecureClient.fetch` encrypts request bodies with HPKE (EHBP protocol)
-and sends them to the Routstr provider. The Routstr proxy had no EHBP handling:
-
-1. It tried to `json.loads()` the binary HPKE-sealed body → failed with a 400
-2. The upstream PPQ.AI public endpoint (`/v1/chat/completions`) doesn't speak
-   EHBP, so the response had no `Ehbp-Response-Nonce` header
-3. `SecureClient` threw `Missing Ehbp-Response-Nonce header` because it expects
-   every response from an EHBP-configured `baseURL` to carry that header
-
-## Root cause
-
-PPQ.AI exposes EHBP-aware inference at `/private/`, separate from the public
-`/v1/` endpoint. The Routstr proxy was forwarding to `/v1/` (the public
-endpoint) instead of `/private/` (the enclave endpoint). The public endpoint
-can't decrypt the body, returns a normal HTTP response, and the SDK can't
-decrypt it because there's no nonce header.
-
-The PPQ private-mode proxy (`ppq-private-mode-proxy/lib/proxy.ts`) shows the
-correct pattern: `SecureClient` talks to `api.ppq.ai/private/v1/chat/completions`,
-which decrypts inside the attested enclave and returns an EHBP-encrypted
-response with the `Ehbp-Response-Nonce` header.
-
-## What was changed
-
-### `routstr/proxy.py`
-
-Detects EHBP requests by checking for the `Ehbp-Encapsulated-Key` header (set
-by the EHBP transport on every encrypted request). For EHBP requests:
-
-- Skips JSON body parsing (the body is binary ciphertext, not JSON)
-- Reads the model ID from the `X-Routstr-Model` header (set by the SDK) instead
-  of from `body.model`
-- Routes through new `forward_ehbp_request` (bearer auth) and
-  `forward_ehbp_x_cashu_request` (x-cashu auth) methods
-- Skips reactive 400 param correction (can't parse encrypted response body)
-- Still charges the user via `pay_for_request` (uses `max_cost_for_model` from
-  the model registry, not the body)
-
-### `routstr/upstream/base.py`
-
-Keeps EHBP as an explicit opt-in provider capability instead of making every
-upstream provider appear EHBP-capable:
-
-- `supports_ehbp = False` by default
-- `get_ehbp_forwarding_target(path, model_obj)` raises `NotImplementedError`
-  unless a provider opts in and returns a provider-specific EHBP target
-
-The actual EHBP forwarding logic does **not** live in `base.py`.
-
-### `routstr/upstream/ehbp.py`
-
-Contains the shared opaque EHBP transport and billing helpers:
-
-- `EHBPForwardingTarget` — provider-specific target URL plus extra headers
-- `forward_ehbp_request()` — forwards the encrypted body, captures Tinfoil
-  usage from a response header or streaming HTTP trailer, and finalizes bearer
-  billing at actual cost (falling back to max cost when usage is unavailable)
-- `forward_ehbp_x_cashu_request()` — redeems the Cashu token, refunds the full
-  token on upstream failure, and refunds the difference between the redeemed
-  amount and actual cost (or max cost when usage is unavailable)
-
-### Provider support
-
-EHBP is currently enabled only for `TinfoilUpstreamProvider`. It forwards to
-Tinfoil's attested enclave and requests `X-Tinfoil-Usage-Metrics` for billing.
-PPQ.AI retains its private-target implementation, but `supports_ehbp = False`
-until it has a provider-specific trusted usage/model-binding strategy.
-
-## Why it's done this way
-
-The proxy is a **blind relay** for EHBP requests. It cannot decrypt the body
-(only the attested enclave can), so it must:
-
-1. Get the model ID from a header, not the body
-2. Forward the raw bytes without parsing or transformation
-3. Stream the response back without SSE/cost parsing
-4. Pass through EHBP protocol headers (`Ehbp-Encapsulated-Key` on request,
-   `Ehbp-Response-Nonce` on response)
-
-Cost tracking happens at the proxy level. Routstr reserves or redeems up to
-`max_cost_for_model`, then Tinfoil's out-of-band usage header/trailer allows it
-to finalize at actual token cost. If trusted usage is missing or invalid, the
-proxy safely falls back to max-cost billing.
-
-## End-to-end flow
-
-```
-SDK                                  Routstr Proxy                    PPQ.AI /private/
-  │                                       │                                │
-  │── X-Routstr-Model: tinfoil-kimi-k2-6 ─│                                │
-  │── Ehbp-Encapsulated-Key: <hex> ───────│                                │
-  │── Authorization: Bearer <cashu> ──────│                                │
-  │── body = HPKE-encrypted(kimi-k2-6) ───│                                │
-  │                                       │                                │
-  │                                  detects Ehbp-Encapsulated-Key         │
-  │                                  reads model from X-Routstr-Model      │
-  │                                  does billing/routing                  │
-  │                                       │                                │
-  │                                  adds X-Private-Model: private/kimi-k2-6
-  │                                  forwards raw body to /private/v1/...  │
-  │                                       │──────────────────────────────▶│
-  │                                       │                          enclave decrypts
-  │                                       │                          runs inference
-  │                                       │◀── Ehbp-Response-Nonce ──────│
-  │                                       │◀── encrypted response ────────│
-  │                                       │                                │
-  │                                  streams response back untouched       │
-  │◀── encrypted response ────────────────│                                │
-  │                                        │                                │
-  SecureClient reads nonce, decrypts       │                                │
-  SDK SSE processing sees plaintext        │                                │
-```
-
-## Model ID mapping
-
-Three parties see three different model IDs:
-
-| Party | Header/Body | Value | Source |
-|---|---|---|---|
-| Routstr proxy | `X-Routstr-Model` header | `tinfoil-kimi-k2-6` | SDK sends full caller-facing id |
-| Tinfoil usage metrics | `model` field | `kimi-k2-6` | Enclave reports the model actually served |
-| Tinfoil enclave | `body.model` (encrypted) | `kimi-k2-6` | SDK strips `tinfoil-` prefix before encryption |
-
-## Implementation status
-
-A dedicated `TinfoilUpstreamProvider` (`routstr/upstream/tinfoil.py`) now
-implements the direct blind-upstream pattern described above. The shared EHBP
-helpers in `routstr/upstream/ehbp.py` were extended to:
-
-- Request usage metrics via `X-Tinfoil-Request-Usage-Metrics: true`.
-- Parse `X-Tinfoil-Usage-Metrics` from the response header (non-streaming) or
-  HTTP trailer (streaming).
-- Override the forwarding URL with a validated `X-Tinfoil-Enclave-Url` when the
-  SDK sends it.
-- Finalize bearer billing with the dedicated EHBP actual-cost finalizer.
-- Compute X-Cashu refunds from actual cost instead of max cost.
-
-See `docs/tinfoil-direct-integration.md` for the full implementation notes.
-
-## Verification status
-
-Unit coverage includes usage parsing, target validation, HTTP trailer capture,
-response-size limits, and bearer payment finalization. End-to-end requests have
-verified both non-streaming usage headers and streaming usage trailers against
-Tinfoil. SDK behavior on proxy-generated non-2xx responses without an
-`Ehbp-Response-Nonce` still merits explicit end-to-end coverage.

docs/provider/configuration.md

@@ -6,35 +6,6 @@ For automated deployments, you can optionally pre-configure settings via environ
 
 ---
 
-## Initial Setup (.env file)
-
-Before running your node, you should create a `.env` file in the project root. This file is used to bootstrap the initial configuration and store sensitive secrets.
-
-### Example .env
-
-```bash
-# Encrypts node secrets at rest. Optional — if unset, the node generates a key on
-# first start and prints it once (back it up). Set it to manage the key yourself
-# (recommended in production). See "Secrets at Rest" below.
-ROUTSTR_SECRET_KEY=
-
-# Node Identity
-NAME="My AI Node"
-DESCRIPTION="Fast access to models"
-
-# Lightning Payouts
-RECEIVE_LN_ADDRESS=yourname@wallet.com
-```
-
-### Setting the UI Password
-
-On first start the node generates an admin password and logs it once — read it from the container logs to sign in. You can then change it two ways:
-
-1.  **Via Dashboard**: Once logged in, go to **Settings** → **Security** to update your password.
-2.  **Via Environment Variable (legacy seed)**: Setting `ADMIN_PASSWORD` in `.env` before the first start seeds the initial password instead of generating one. It's read only once, for existing deployments; a value left in `.env` is ignored after the node has been configured.
-
----
-
 ## Admin Dashboard (Primary)
 
 Access the dashboard at `/admin/` on your node.
@@ -43,29 +14,29 @@ Access the dashboard at `/admin/` on your node.
 
 Connect to your AI provider(s):
 
-| Setting          | Description                                      |
-| ---------------- | ------------------------------------------------ |
+| Setting | Description |
+|---------|-------------|
 | **Upstream URL** | API endpoint (e.g., `https://api.openai.com/v1`) |
-| **API Key**      | Your provider's API key                          |
+| **API Key** | Your provider's API key |
 
 ### Node Identity
 
 How your node appears to clients:
 
-| Setting         | Description                            |
-| --------------- | -------------------------------------- |
-| **Name**        | Display name (e.g., "Fast GPT-4 Node") |
-| **Description** | Brief description of your service      |
+| Setting | Description |
+|---------|-------------|
+| **Name** | Display name (e.g., "Fast GPT-4 Node") |
+| **Description** | Brief description of your service |
 
 ### Pricing
 
 Control your profit margins:
 
-| Setting           | Description                                | Default      |
-| ----------------- | ------------------------------------------ | ------------ |
-| **Fixed Pricing** | Charge flat rate per request vs. per-token | Off          |
-| **Exchange Fee**  | Buffer for BTC volatility                  | 1.005 (0.5%) |
-| **Upstream Fee**  | Your profit markup                         | 1.10 (10%)   |
+| Setting | Description | Default |
+|---------|-------------|---------|
+| **Fixed Pricing** | Charge flat rate per request vs. per-token | Off |
+| **Exchange Fee** | Buffer for BTC volatility | 1.005 (0.5%) |
+| **Upstream Fee** | Your profit markup | 1.10 (10%) |
 
 See [Pricing](pricing.md) for detailed strategies.
 
@@ -73,40 +44,33 @@ See [Pricing](pricing.md) for detailed strategies.
 
 Which mints to accept payments from:
 
-| Setting   | Description                     |
-| --------- | ------------------------------- |
+| Setting | Description |
+|---------|-------------|
 | **Mints** | List of trusted Cashu mint URLs |
 
 ### Lightning Withdrawals
 
 Automatic profit withdrawal:
 
-| Setting                              | Description                                                                                                | Default |
-| ------------------------------------ | ---------------------------------------------------------------------------------------------------------- | ------- |
-| **Lightning Address**                | Your LN address for withdrawals                                                                            | —       |
-| **Minimum Payout (sat)**             | Min available balance (in sats) before profit is paid out. Applies to both `sat` and `msat` mints (auto-converted). | `210`   |
-| **Payout Interval (seconds)**        | How often the payout loop wakes up and checks balances                                                     | `900`   |
-
-All payout amounts must be positive. Set the minimums above your wallet's
-minimum-invoice constraint (typically 1 sat) and high enough to amortise
-routing fees.
+| Setting | Description |
+|---------|-------------|
+| **Lightning Address** | Your LN address for withdrawals |
 
 ### Security
 
-| Setting            | Description                   |
-| ------------------ | ----------------------------- |
+| Setting | Description |
+|---------|-------------|
 | **Admin Password** | Password for dashboard access |
 
 ### Nostr Discovery
 
 Announce your node on the network:
 
-| Setting    | Description                          |
-| ---------- | ------------------------------------ |
-| **Npub**   | Your Nostr public key                |
-| **Nsec**   | Your Nostr private key (for signing) |
-| **Relays** | Relays to publish announcements      |
-| **Share Analytics** | Publish aggregate usage stats to Nostr |
+| Setting | Description |
+|---------|-------------|
+| **Npub** | Your Nostr public key |
+| **Nsec** | Your Nostr private key (for signing) |
+| **Relays** | Relays to publish announcements |
 
 See [Discovery](discovery.md) for details.
 
@@ -122,47 +86,26 @@ Use environment variables for:
 
 ### All Variables
 
-| Variable             | Description                       | Default                              |
-| -------------------- | --------------------------------- | ------------------------------------ |
-| `UPSTREAM_BASE_URL`  | Upstream API endpoint             | —                                    |
-| `UPSTREAM_API_KEY`   | Upstream API key                  | —                                    |
-| `ADMIN_PASSWORD`     | Legacy seed for the dashboard password (otherwise generated + logged on first start) | (auto-generated) |
-| `ROUTSTR_SECRET_KEY` | Master key encrypting node secrets at rest. Auto-generated to a key file if unset | (auto-generated) |
-| `ROUTSTR_SECRET_KEY_FILE` | Path to the generated key file (used when `ROUTSTR_SECRET_KEY` is unset) | `routstr_secret.key` beside the database |
-| `DATABASE_URL`       | Database connection string        | `sqlite+aiosqlite:///keys.db`        |
-| `NAME`               | Node display name                 | `ARoutstrNode`                       |
-| `DESCRIPTION`        | Node description                  | `A Routstr Node`                     |
-| `NPUB`               | Nostr public key (bech32)         | —                                    |
-| `NSEC`               | Legacy seed for the Nostr private key (otherwise set from the admin UI) | —                |
-| `ENABLE_ANALYTICS_SHARING` | Enable usage analytics sharing to Nostr | `true`                         |
-| `CASHU_MINTS`        | Comma-separated mint URLs         | `https://mint.minibits.cash/Bitcoin` |
-| `RECEIVE_LN_ADDRESS` | Lightning address for withdrawals | —                                    |
-| `MIN_PAYOUT_SAT`     | Min payout balance in sats (applies to all mints) | `210`                |
-| `PAYOUT_INTERVAL_SECONDS` | Payout loop interval (seconds) | `900`                            |
-| `TOR_PROXY_URL`      | SOCKS5 proxy for Tor              | `socks5://127.0.0.1:9050`            |
-| `CORS_ORIGINS`       | Allowed CORS origins              | `*`                                  |
-| `RELAYS`             | Nostr relays (comma-separated)    | (default set)                        |
-| `MODEL_PATHS_REFRESH_INTERVAL_SECONDS` | How often to refresh `/v1/models/paths` discovery data; set `0` to pause the refresh (previously discovered paths keep being served) | `600` |
-| `ENABLE_MODEL_PATHS_REFRESH` | Kill switch for the background model-path refresh (OpenRouter endpoint fan-out) | `true` |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `UPSTREAM_BASE_URL` | Upstream API endpoint | — |
+| `UPSTREAM_API_KEY` | Upstream API key | — |
+| `ADMIN_PASSWORD` | Dashboard password | (none) |
+| `DATABASE_URL` | Database connection string | `sqlite+aiosqlite:///keys.db` |
+| `NAME` | Node display name | `ARoutstrNode` |
+| `DESCRIPTION` | Node description | `A Routstr Node` |
+| `NPUB` | Nostr public key (bech32) | — |
+| `NSEC` | Nostr private key | — |
+| `CASHU_MINTS` | Comma-separated mint URLs | `https://mint.minibits.cash/Bitcoin` |
+| `RECEIVE_LN_ADDRESS` | Lightning address for withdrawals | — |
+| `TOR_PROXY_URL` | SOCKS5 proxy for Tor | `socks5://127.0.0.1:9050` |
+| `CORS_ORIGINS` | Allowed CORS origins | `*` |
+| `RELAYS` | Nostr relays (comma-separated) | (default set) |
 
 ### Priority
 
 Environment variables are read on startup. Dashboard settings override them and persist in the database. Once you change a setting in the dashboard, the env var is ignored for that setting.
 
-### Secrets at Rest
-
-The node's Nostr private key (`nsec`) is encrypted in the database using
-`ROUTSTR_SECRET_KEY`. You don't have to set it: if it's unset, the node generates a
-key on first start, writes it **beside the database** (the file named by
-`ROUTSTR_SECRET_KEY_FILE`, default `routstr_secret.key`) so it persists on the same
-volume as your data, and prints it once.
-
-**Back up that key** — it lives on the same volume as your database, so include it
-in your backups. If it is lost or changed, previously encrypted secrets can't be
-decrypted and must be re-entered — there is no rotation. To keep the key off the
-data volume, set `ROUTSTR_SECRET_KEY` explicitly (an env value always takes
-precedence over the file). See also [Deployment](deployment.md).
-
 ---
 
 ## Models
@@ -177,8 +120,3 @@ Manage which AI models you offer:
    - **Create aliases** — friendly names for models
 
 See [Pricing](pricing.md) for per-model pricing strategies.
-
-Model path discovery is refreshed in the background and exposed through
-`/v1/models/paths`. The response groups each client-visible model ID with the
-provider paths that may appear in chat-completion response metadata. Tune the
-refresh cadence with `MODEL_PATHS_REFRESH_INTERVAL_SECONDS`.

docs/provider/dashboard.md

@@ -152,7 +152,6 @@ Manage which mints you accept payments from:
 |-------|-------------|
 | **Nsec** | Private key for signing announcements |
 | **Relays** | Where to publish your node advertisement |
-| **Share Analytics** | Toggle publishing aggregate usage stats to Nostr |
 
 ### Security
 

docs/provider/deployment.md

@@ -2,70 +2,34 @@
 
 Production deployment guide for Routstr Provider nodes.
 
-## All-in-One Docker Image (Preferred)
-
-The easiest way to deploy Routstr is using the all-in-one Docker image from Docker Hub, which includes both the FastAPI backend and the Next.js admin dashboard in a single container.
-
-### Quick Start
-
-```bash
-docker run -d \
-  --name routstr \
-  -p 8000:8000 \
-  -v routstr-data:/app/data \
-  -e DATABASE_URL="sqlite:////app/data/routstr.db" \
-  9qeklajc/routstr:latest
-```
-
-Access your node:
-- **API & Admin Dashboard**: http://localhost:8000
-
-### Docker Compose Setup
-
-Create `docker-compose.yml`:
-
-```yaml
-version: '3.8'
-
-services:
-  routstr:
-    image: 9qeklajc/routstr:latest
-    container_name: routstr
-    restart: unless-stopped
-    ports:
-      - "8000:8000"
-    volumes:
-      - routstr-data:/app/data
-    environment:
-      DATABASE_URL: "sqlite:////app/data/routstr.db"
-      LOG_LEVEL: "info"
-
-volumes:
-  routstr-data:
-```
-
-Start it:
-
-```bash
-docker compose up -d
-```
-
----
-
 ## Docker Compose (Recommended)
 
 For production, use Docker Compose with persistent storage and optional Tor support.
 
-Use the included `compose.yml` for a flexible setup that handles both the UI and the node execution. This is useful for development or when you want to manage Tor as a separate service.
+### Basic Setup
+
+Create a `compose.yml`:
+
+```yaml
+services:
+  routstr:
+    image: ghcr.io/routstr/proxy:latest
+    container_name: routstr
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+    volumes:
+      - ./data:/app/data
+      - ./logs:/app/logs
+```
+
+Start the node:
 
 ```bash
 docker compose up -d
 ```
 
-This will:
-1.  **Build the UI**: Compiles the frontend and copies it to a shared volume.
-2.  **Start Routstr**: Runs the Python node, mounting the built UI.
-3.  **Start Tor**: Provides anonymous access via a `.onion` address.
+Then configure everything via the [Admin Dashboard](http://localhost:8000/admin/).
 
 ---
 
@@ -86,8 +50,6 @@ services:
       - ./logs:/app/logs
     environment:
       - TOR_PROXY_URL=socks5://tor:9050
-      # Keep the database (and the key file generated beside it) on the volume.
-      - DATABASE_URL=sqlite:////app/data/routstr.db
     depends_on:
       - tor
 
@@ -126,8 +88,8 @@ services:
       - UPSTREAM_BASE_URL=https://api.openai.com/v1
       - UPSTREAM_API_KEY=sk-proj-...
       
-      # The admin password is generated and logged once on first start; set
-      # ADMIN_PASSWORD here only as a legacy seed for an existing deployment.
+      # Secure the dashboard (recommended)
+      - ADMIN_PASSWORD=your-secure-password
       
       # Node identity
       - NAME=My Provider Node
@@ -135,9 +97,6 @@ services:
       
       # Lightning withdrawals
       - RECEIVE_LN_ADDRESS=me@walletofsatoshi.com
-
-      # Keep the database (and the key file generated beside it) on the volume.
-      - DATABASE_URL=sqlite:////app/data/routstr.db
     volumes:
       - ./data:/app/data
 ```
@@ -159,36 +118,22 @@ Example `.env`:
 ```bash
 UPSTREAM_BASE_URL=https://api.openai.com/v1
 UPSTREAM_API_KEY=sk-proj-...
-# Keep the database (and the key file generated beside it) on the mounted volume.
-DATABASE_URL=sqlite:////app/data/routstr.db
-# Encrypts node secrets at rest. Optional — if unset, a key is generated next to
-# your database (on the same volume) and its file is named once for backup. Set
-# it explicitly to manage the key yourself.
-ROUTSTR_SECRET_KEY=
+ADMIN_PASSWORD=change-me
 NAME=My Provider Node
 RECEIVE_LN_ADDRESS=me@walletofsatoshi.com
 ```
 
-!!! note "Secret key persistence"
-    If you leave `ROUTSTR_SECRET_KEY` unset, the node generates one and stores it
-    as `routstr_secret.key` **next to your database**, so it persists on the same
-    volume as your data — just include that volume in your backups. For stronger
-    isolation (keeping the key off the data volume), set `ROUTSTR_SECRET_KEY` from
-    a secrets manager instead.
-
 See [Configuration](configuration.md) for all available options.
 
 ---
 
 ## Persistence
 
-Point `DATABASE_URL` inside `/app/data` (as the examples above do) so everything
-Routstr persists lands on the mounted volume:
+Routstr stores all data in `/app/data`:
 
 | Path | Contents |
 |------|----------|
-| `routstr.db` | SQLite database (settings, API keys, sessions) |
-| `routstr_secret.key` | Auto-generated master key, written beside the database when `ROUTSTR_SECRET_KEY` is unset |
+| `keys.db` | SQLite database (settings, API keys, sessions) |
 | `.wallet/` | Cashu wallet data (your Bitcoin!) |
 
 !!! warning "Back Up Your Data"
@@ -244,16 +189,8 @@ docker compose up -d
 
 ## Building from Source
 
-### Using Docker Compose
-The easiest way to build everything from source:
-
 ```bash
-docker compose build
-```
-
-### Individual Components
-If you prefer building the node only (requires manual UI build first):
-
-```bash
-docker build -t routstr-node .
+git clone https://github.com/routstr/routstr-core.git
+cd routstr-core
+docker build -t routstr-local .
 ```

docs/provider/quickstart.md

@@ -13,7 +13,7 @@ A **Routstr Provider Node** acts as a gateway that:
 You bring the API keys, Routstr handles the billing, payments, and client management.
 
 !!! tip "Future: Node-to-Node Routing"
-In future versions, you'll be able to run a node that connects to other Routstr nodes—eliminating the need to configure upstream providers yourself. For now, you'll need your own API credentials.
+    In future versions, you'll be able to run a node that connects to other Routstr nodes—eliminating the need to configure upstream providers yourself. For now, you'll need your own API credentials.
 
 ---
 
@@ -24,36 +24,14 @@ In future versions, you'll be able to run a node that connects to other Routstr
 
 ---
 
-## 1. Prepare Configuration
-
-Create a `.env` file in the root of the project to store your secrets:
+## 1. Start the Node
 
 ```bash
-# Encrypts node secrets at rest. Optional — if unset, the node generates a key on
-# first start and prints it once (back it up).
-ROUTSTR_SECRET_KEY=
-
-# Node Identity
-NAME="My AI Node"
-DESCRIPTION="Fast access to models"
-
-# Lightning Payouts
-RECEIVE_LN_ADDRESS=yourname@wallet.com
-
-```
-
-The admin password is generated and logged once on first start (read it from the
-logs to sign in), and your Nostr identity (`nsec`) is configured afterwards from
-the admin UI — both are stored encrypted in the database, not in `.env`.
-(`ADMIN_PASSWORD` / `NSEC` are still read once as a legacy seed for existing
-deployments.)
-
-## 2. Start the Node
-
-The recommended way to run Routstr is using Docker Compose, which handles the node, the UI, and optional services like Tor.
-
-```bash
-docker compose up -d
+docker run -d \
+  --name routstr \
+  -p 8000:8000 \
+  -v routstr-data:/app/data \
+  ghcr.io/routstr/proxy:latest
 ```
 
 Verify it's running:
@@ -62,23 +40,14 @@ Verify it's running:
 curl http://localhost:8000/v1/info
 ```
 
-### Build from Source (Optional)
-
-If you've cloned the repository and want to build the images yourself:
-
-```bash
-docker compose build
-docker compose up -d
-```
-
 ---
 
-## 3. Configure via Dashboard
+## 2. Configure via Dashboard
 
 Open the **Admin Dashboard** at [http://localhost:8000/admin/](http://localhost:8000/admin/).
 
-!!! note "Login"
-On first start the node generates an admin password and logs it once — read it from the container logs to sign in. You can change it afterwards from **Settings** → **Security**.
+!!! note "Default Access"
+    The dashboard has no password by default. Set one immediately in Settings for production use.
 
 ### Connect Your AI Providers
 

docs/tinfoil-direct-integration.md

@@ -1,493 +0,0 @@
-# Tinfoil / PPQ Private-Mode Integration Notes
-
-This document summarizes the current options for integrating Tinfoil/PPQ private models with Routstr, based on the EHBP work in this branch and local testing against `ppq-private-mode-proxy`.
-
-## Background
-
-PPQ private models run behind a Tinfoil/EHBP flow:
-
-- Request bodies are HPKE-encrypted by a Tinfoil client.
-- The PPQ `/private/` endpoint routes ciphertext to the attested enclave.
-- The enclave decrypts, runs inference, and returns an encrypted response.
-- The caller's Tinfoil client decrypts the response locally.
-
-The PPQ private-mode proxy (`~/projects/ppq-private-mode-proxy`) uses this pattern with the JavaScript `tinfoil` SDK:
-
-```ts
-import { SecureClient } from "tinfoil";
-
-const apiBase = "https://api.ppq.ai";
-
-const client = new SecureClient({
-  baseURL: `${apiBase}/private/`,
-  attestationBundleURL: `${apiBase}/private`,
-  transport: "ehbp",
-});
-
-await client.ready();
-
-const response = await client.fetch(`${apiBase}/private/v1/chat/completions`, {
-  method: "POST",
-  headers: {
-    "Content-Type": "application/json",
-    Authorization: `Bearer ${process.env.PPQ_API_KEY}`,
-    "X-Private-Model": "private/gpt-oss-120b",
-    "x-query-source": "api",
-  },
-  body: JSON.stringify({
-    model: "gpt-oss-120b", // enclave-internal model id
-    messages: [{ role: "user", content: "Hello" }],
-  }),
-});
-
-const json = await response.json();
-console.log(json.usage);
-```
-
-`X-Private-Model` carries the PPQ-facing private model id, while the encrypted JSON body uses the enclave-internal model id without the `private/` prefix.
-
-## PPQ private model pricing
-
-PPQ exposes private model pricing through:
-
-```text
-GET https://api.ppq.ai/v1/models?type=all
-```
-
-Filter models whose IDs start with `private/`.
-
-Example private pricing observed:
-
-| Model | Input USD / 1M tokens | Output USD / 1M tokens |
-|---|---:|---:|
-| `private/gpt-oss-120b` | `0.79125` | `1.31875` |
-| `private/llama3-3-70b` | `1.84625` | `2.90125` |
-| `private/qwen3-vl-30b` | `1.31875` | `4.22` |
-| `private/glm-5-2` | `1.5825` | `5.53875` |
-| `private/gemma4-31b` | `0.47475` | `1.055` |
-| `private/kimi-k2-6` | `1.5825` | `5.53875` |
-
-The `ppq-private-mode-proxy` commit `ba984214793d3bca0f7d046b6955d42abc1c6843` changed OpenClaw display metadata to align with a 5% API margin. The live PPQ model endpoint returns the more precise rates above, which already include that margin.
-
-Actual PPQ private billing is:
-
-```text
-price_usd =
-  input_tokens  * input_per_1M_tokens  / 1_000_000
-+ output_tokens * output_per_1M_tokens / 1_000_000
-```
-
-A test request to `private/gpt-oss-120b` produced:
-
-```json
-{
-  "input_count": 74,
-  "output_count": 3,
-  "price_in_usd": 0.00006250875
-}
-```
-
-which exactly matches:
-
-```text
-74 * 0.79125 / 1_000_000 + 3 * 1.31875 / 1_000_000
-= 0.00006250875 USD
-```
-
-## Integration architectures
-
-There are three materially different ways Routstr could integrate Tinfoil/PPQ private inference.
-
-## Option A: User integrates Tinfoil directly
-
-```text
-User app / SDK
-  -> Tinfoil SecureClient / TinfoilAI
-    -> EHBP-encrypted request
-      -> Tinfoil/PPQ private enclave
-```
-
-Properties:
-
-- Best privacy for the user.
-- Routstr is not in the request path.
-- User's client encrypts requests and decrypts responses.
-- Usage is visible to the user's app after decryption.
-- Billing is handled directly by Tinfoil/PPQ.
-
-Example with Tinfoil's OpenAI-compatible client:
-
-```ts
-import { TinfoilAI } from "tinfoil";
-
-const client = new TinfoilAI({
-  apiKey: process.env.TINFOIL_API_KEY,
-  transport: "ehbp",
-});
-
-const res = await client.chat.completions.create({
-  model: "llama3-3-70b",
-  messages: [{ role: "user", content: "Hello" }],
-});
-
-console.log(res.choices[0].message.content);
-console.log(res.usage);
-```
-
-This is not a Routstr marketplace flow unless Routstr only acts as discovery/UI around direct Tinfoil/PPQ usage.
-
-## Option B: Routstr integrates Tinfoil as an upstream client
-
-```text
-User -> Routstr plaintext request
-  -> Routstr Tinfoil SecureClient encrypts to PPQ/Tinfoil
-    -> PPQ private enclave
-  -> Routstr receives decrypted response
-  -> Routstr bills from decrypted usage
-  -> Routstr returns plaintext response to user
-```
-
-Properties:
-
-- Easier exact billing.
-- Routstr can read the decrypted OpenAI response and `usage` object.
-- Routstr can charge exact PPQ token pricing.
-- Privacy is different: the user sends plaintext to Routstr, and Routstr sees prompts/responses.
-- End-to-end encryption is only Routstr-to-enclave, not user-to-enclave.
-
-This should be considered a separate product/provider mode, not the same as an end-to-end private relay.
-
-Practical implementation options:
-
-1. Run a Node sidecar that uses the `tinfoil` npm package and expose it as a local HTTP upstream to Routstr.
-2. Port EHBP client behavior to Python.
-3. Reuse or adapt `ppq-private-mode-proxy` as a local upstream.
-
-A Node sidecar is probably the quickest implementation path because `ppq-private-mode-proxy` already demonstrates the full flow.
-
-## Option C: Routstr uses Tinfoil as a direct blind upstream
-
-This is the current branch's design intent and is likely the best fit if Tinfoil/PPQ exposes usage metadata headers:
-
-```text
-User Tinfoil SecureClient
-  -> encrypted request body
-    -> Routstr proxy
-      -> Tinfoil/PPQ private API
-         with X-Tinfoil-Request-Usage-Metrics: true
-        -> PPQ private enclave
-      <- encrypted response
-         plus X-Tinfoil-Usage-Metrics / cost headers
-    <- Routstr proxy
-  -> user decrypts response
-```
-
-In this mode Routstr is still a normal upstream proxy from the user's point of view, but the upstream is Tinfoil/PPQ private inference and the body remains opaque to Routstr.
-
-Properties:
-
-- Strongest privacy with Routstr in the path.
-- Routstr never sees plaintext prompt or plaintext response.
-- Routstr can authenticate and route based on plaintext headers.
-- Routstr should request Tinfoil usage metadata by adding `X-Tinfoil-Request-Usage-Metrics: true` to the upstream request.
-- Tinfoil documents `X-Tinfoil-Usage-Metrics` as an upstream response header for non-streaming requests.
-- For streaming requests, Tinfoil documents `X-Tinfoil-Usage-Metrics` as an HTTP trailer available only after the response body completes.
-- If Tinfoil/PPQ returns `X-Tinfoil-Usage-Metrics` or a cost header on the encrypted response, Routstr can bill exactly without decrypting the body.
-- If usage is only present inside the encrypted response body, Routstr still cannot read it and exact billing is not possible without a separate metadata path.
-
-This is the only architecture that preserves end-to-end encryption from the user to the PPQ/Tinfoil enclave while still letting Routstr mediate payment. The key requirement is that usage/cost metadata must be returned outside the encrypted body, ideally as a response header available before body streaming begins.
-
-## Current Routstr problem
-
-The current EHBP implementation charges successful EHBP requests at `max_cost_for_model` because Routstr cannot decrypt the response body:
-
-```text
-successful EHBP request -> charge full reserved max cost
-```
-
-That is incorrect for PPQ private models. Max cost should be only a reservation/solvency ceiling. Final charge should use actual PPQ private token pricing.
-
-Desired behavior:
-
-```text
-reserve max cost
-forward encrypted request
-obtain actual usage/cost metadata
-finalize actual cost
-refund/release the difference
-```
-
-## Usage/cost metadata requirement
-
-For blind-relay exact billing, PPQ should return one of the following outside the encrypted response body:
-
-```http
-X-PPQ-Cost-USD: 0.00006250875
-```
-
-or:
-
-```http
-X-Private-Usage-Metrics: input=74,output=3
-```
-
-or:
-
-```http
-X-Tinfoil-Usage-Metrics: prompt=74,completion=3,total=77
-```
-
-Tinfoil proxy documentation references a usage-metrics flow where a proxy can request usage via:
-
-```http
-X-Tinfoil-Request-Usage-Metrics: true
-```
-
-and read usage from:
-
-```http
-X-Tinfoil-Usage-Metrics
-```
-
-Docs/example references:
-
-- https://docs.tinfoil.sh/guides/proxy-server
-- https://github.com/tinfoilsh/encrypted-request-proxy-example
-
-During local PPQ testing, PPQ responses included this CORS exposure header:
-
-```http
-Access-Control-Expose-Headers: Ehbp-Response-Nonce, X-Private-Usage-Metrics, X-Encrypted-Usage-Metrics, X-Tinfoil-Usage-Metrics
-```
-
-However, the actual tested non-streaming response did not include any of these usage headers, even when `X-Tinfoil-Request-Usage-Metrics: true` was sent.
-
-The decrypted body did include normal OpenAI usage, but only the decrypting Tinfoil client can see that body.
-
-## Query-history fallback
-
-PPQ's query history endpoint exposes actual usage and cost:
-
-```text
-GET https://api.ppq.ai/queries/history?page=1&page_count=...
-```
-
-A record includes:
-
-```json
-{
-  "timestamp": "...",
-  "model": "private/gpt-oss-120b",
-  "input_count": 74,
-  "output_count": 3,
-  "price_in_usd": 0.00006250875,
-  "query_type": "chat_completion",
-  "query_source": "api"
-}
-```
-
-This could be used as a fallback, but it is less robust than response headers/trailers because matching a request to a history row can be race-prone under concurrency. It would need a reliable request identifier or metadata field that PPQ stores in history.
-
-## Recommended Routstr direction
-
-Use Tinfoil/PPQ as a direct blind upstream and have Routstr explicitly request usage metadata:
-
-```text
-User encrypts body
-Routstr reserves max cost
-Routstr forwards encrypted body to Tinfoil/PPQ /private/
-Routstr includes X-Tinfoil-Request-Usage-Metrics: true
-Tinfoil/PPQ returns X-Tinfoil-Usage-Metrics as a response header for non-streaming,
-or as an HTTP trailer after the body completes for streaming
-Routstr finalizes exact charge
-User decrypts encrypted response
-```
-
-This preserves both:
-
-- privacy: Routstr cannot read prompts/responses;
-- exact billing: Routstr can charge actual PPQ private model cost, assuming Tinfoil/PPQ returns usage/cost metadata outside the encrypted body.
-
-Implementation steps:
-
-1. Update PPQ model fetching to include private models:
-
-   ```text
-   GET https://api.ppq.ai/v1/models?type=all
-   ```
-
-2. Register `private/*` models and any Routstr-facing aliases with correct `forwarded_model_id`.
-
-3. Keep max-cost reservation for bearer keys and X-Cashu solvency checks.
-
-4. Add parsing support for possible usage/cost headers:
-
-   ```http
-   X-PPQ-Cost-USD
-   X-Private-Usage-Metrics
-   X-Tinfoil-Usage-Metrics
-   X-Encrypted-Usage-Metrics
-   ```
-
-5. Finalize by actual cost instead of max cost:
-
-   ```text
-   actual_msats = ceil((actual_usd / sats_usd_price()) * 1000)
-   actual_msats = max(actual_msats, settings.min_request_msat)
-   actual_msats = min(actual_msats, reserved_msats)
-   ```
-
-   or, if only token counts are available:
-
-   ```text
-   actual_usd =
-     input_tokens  * input_per_1M_tokens  / 1_000_000
-   + output_tokens * output_per_1M_tokens / 1_000_000
-   ```
-
-6. If usage/cost metadata is missing, choose an explicit policy:
-
-   - fail closed and refund/revert;
-   - query PPQ history as a fallback;
-   - fallback to max-cost billing only if explicitly configured and clearly disclosed.
-
-Silent max-cost billing should not be the default for PPQ private requests.
-
-## X-Cashu consideration
-
-For bearer-auth requests, finalization can happen after the response stream completes if usage is delivered as a trailer.
-
-For `X-Cashu`, Routstr needs to return the refund token in the response headers. If usage/cost is only available after consuming the encrypted response stream, Routstr may need to buffer EHBP responses before sending them to the client so it can compute the refund amount first.
-
-Possible approaches:
-
-1. Prefer a non-trailer response header with actual cost, available before streaming body starts.
-2. Buffer EHBP X-Cashu responses and then return `X-Cashu` refund.
-3. Introduce a later/refund-claim mechanism, which would be a larger protocol change.
-
-## Summary
-
-- PPQ private models are billed per actual input/output tokens.
-- Private model rates are available from `GET /v1/models?type=all`.
-- Current Routstr EHBP billing at max cost is wrong for PPQ private models.
-- Direct Tinfoil integration inside Routstr would enable exact usage billing but would make Routstr see plaintext.
-- A blind EHBP relay preserves privacy but requires PPQ/Tinfoil to expose usage/cost in plaintext headers/trailers.
-- The preferred solution is to keep Routstr blind and have PPQ return billing metadata outside the encrypted body.
-
-## Implementation status
-
-Direct Tinfoil upstream integration is implemented in `routstr/upstream/tinfoil.py`
-and `routstr/upstream/ehbp.py`.
-
-### What was built
-
-- `TinfoilUpstreamProvider` (`provider_type = "tinfoil"`):
-  - Base URL: `https://inference.tinfoil.sh`
-  - Fetches models from the public `GET /v1/models` endpoint (no auth needed).
-  - Parses Tinfoil's pricing (`inputTokenPricePer1M`, `outputTokenPricePer1M`,
-    `requestPrice`) into the standard `Model`/`Pricing` schema.
-  - `supports_ehbp = True` — acts as a blind EHBP relay.
-  - `get_ehbp_forwarding_target()` returns a target that includes
-    `X-Tinfoil-Request-Usage-Metrics: true`.
-  - `forward_get_request()` proxies `/attestation` to `https://atc.tinfoil.sh/attestation`
-    so the SDK can fetch attestation bundles through Routstr.
-  - Registered in `routstr/upstream/__init__.py` and seeded from
-    `TINFOIL_API_KEY` env var.
-
-- `routstr/upstream/ehbp.py`:
-  - `parse_tinfoil_usage_metrics()` parses
-    `prompt=N,completion=N[,total=N][,model=<name>]` into an OpenAI-style
-    usage dict. The `model` field (added in tinfoilsh/confidential-model-router
-    PR #385) is extracted as a string.
-  - `_resolve_ehbp_target_url()` overrides the forwarding URL with
-    `X-Tinfoil-Enclave-Url` when the SDK sends it.
-  - `_strip_proxy_headers()` removes `X-Routstr-Model`,
-    `X-Tinfoil-Enclave-Url`, and `X-Tinfoil-Request-Usage-Metrics` before
-    forwarding to the enclave.
-  - `_compute_ehbp_actual_cost()` converts the usage header into msats via
-    `calculate_cost()`, clamped to `[min_request_msat, max_cost_for_model]`.
-    When the header's `model=<name>` differs from the requested model, the
-    actual served model's pricing is used for cost calculation.
-  - `forward_ehbp_request()` (bearer auth): if `X-Tinfoil-Usage-Metrics` is
-    present in the response header, finalizes with `adjust_payment_for_tokens()`
-    for exact billing; otherwise falls back to max-cost. Billing uses the
-    actual served model when it differs from the requested one.
-  - `forward_ehbp_x_cashu_request()`: if usage is available, computes the
-    refund from actual cost instead of max cost, using the actual served
-    model's pricing when applicable.
-
-- `routstr/proxy.py`: `/attestation` and `/tee/attestation` paths are forwarded
-  to Tinfoil upstreams without model/cost/auth lookups.
-
-### Billing behavior
-
-| Request shape | Usage source | Billing |
-|---|---|---|
-| Bearer, non-streaming | `X-Tinfoil-Usage-Metrics` response header | Exact token cost via `adjust_payment_for_tokens` |
-| Bearer, streaming | `X-Tinfoil-Usage-Metrics` HTTP trailer | Exact token cost (h11 captures trailers) |
-| Bearer, no usage header/trailer | N/A | Max-cost fallback |
-| X-Cashu, non-streaming | `X-Tinfoil-Usage-Metrics` response header | Refund = `redeemed - actual_cost` |
-| X-Cashu, streaming | `X-Tinfoil-Usage-Metrics` HTTP trailer | Refund = `redeemed - actual_cost` (h11 captures trailers) |
-| X-Cashu, no usage header/trailer | N/A | Refund = `redeemed - max_cost` |
-
-### Cost response headers
-
-Since EHBP response bodies are opaque encrypted blobs, per-request cost cannot
-be injected into the JSON body (as done in the normal proxy flow). Instead,
-Routstr returns cost info as response headers:
-
-| Header | Auth | Description |
-|---|---|---|
-| `X-Routstr-Cost-Msats` | Bearer, X-Cashu | Total msats charged for this request |
-| `X-Routstr-Cost-Usd` | Bearer | USD equivalent of the charge |
-| `X-Routstr-Input-Cost-Msats` | Bearer, X-Cashu | msats attributed to input tokens |
-| `X-Routstr-Output-Cost-Msats` | Bearer, X-Cashu | msats attributed to output tokens |
-
-The client/Tinfoil SDK can read these headers from the HTTP response without
-needing to decrypt the body.
-
-### Setup
-
-```bash
-TINFOIL_API_KEY=your-tinfoil-api-key
-```
-
-The provider is auto-seeded on first startup.
-
-### Usage metrics header format
-
-Tinfoil returns usage metrics in the `X-Tinfoil-Usage-Metrics` response header
-(non-streaming) or HTTP trailer (streaming) when `X-Tinfoil-Request-Usage-Metrics:
-true` is sent. As of tinfoilsh/confidential-model-router PR #385, the format is:
-
-```
-prompt=<prompt_tokens>,completion=<completion_tokens>,total=<total_tokens>,model=<served_model>
-```
-
-The `model` field carries the actual model name served by the enclave.
-Routstr uses this to:
-
-- Verify the served model matches the expected upstream model. The comparison
-  uses ``model_obj.forwarded_model_id`` (the actual upstream ID, e.g.
-  ``glm-5-2``) rather than ``model_obj.id`` (the client-facing alias, e.g.
-  ``tinfoil-glm-5-2``), so aliased models don't trigger a spurious mismatch.
-- When they genuinely differ (Tinfoil served a different upstream model than
-  expected), look up the actual served model's pricing and use it for billing.
-  The reverse lookup uses ``get_model_instance``, which resolves
-  ``forwarded_model_id`` values registered as routable aliases.
-- Log the discrepancy for observability.
-
-If the actual model is not found in Routstr's model registry, billing falls
-back to the requested model's pricing.
-
-### What still needs verification
-
-- ~~End-to-end test with a real Tinfoil SDK client against a Routstr node with
-  `TINFOIL_API_KEY` set.~~ Verified: both non-streaming (header) and streaming
-  (trailer) responses include `model=<name>`.
-- Streaming trailer capture is implemented by buffering the encrypted response
-  in `forward_with_trailer()` and then using the dedicated EHBP payment
-  finalizers for bearer and X-Cashu requests. This provides actual-cost billing
-  today, at the cost of full time-to-last-byte latency for streaming responses.
-- Whether Tinfoil's `/v1/responses` endpoint also returns usage metrics
-  headers or trailers.

logs/.gitkeep

@@ -1 +0,0 @@
-

migrations/versions/02650cd6f028_add_routstr_fees_table.py

@@ -1,32 +0,0 @@
-"""add routstr_fees table
-
-Revision ID: 02650cd6f028
-Revises: c3d4e5f6a7b8
-Create Date: 2026-04-24 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "02650cd6f028"
-down_revision = "c3d4e5f6a7b8"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "routstr_fees",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column("accumulated_msats", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("total_paid_msats", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("last_paid_at", sa.Integer(), nullable=True),
-        sa.PrimaryKeyConstraint("id"),
-    )
-    # Seed with a single row
-    op.execute("INSERT INTO routstr_fees (id, accumulated_msats, total_paid_msats) VALUES (1, 0, 0)")
-
-
-def downgrade() -> None:
-    op.drop_table("routstr_fees")

migrations/versions/06f81c0fc88d_add_key_management_and_reset_fields_to_.py

@@ -1,37 +0,0 @@
-"""add key management and reset fields to api_keys
-
-Revision ID: 06f81c0fc88d
-Revises: c2d3e4f5a6b7
-Create Date: 2026-02-04 22:44:03.311983
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "06f81c0fc88d"
-down_revision = "c2d3e4f5a6b7"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("api_keys", sa.Column("balance_limit", sa.Integer(), nullable=True))
-    op.add_column(
-        "api_keys",
-        sa.Column(
-            "balance_limit_reset", sqlmodel.sql.sqltypes.AutoString(), nullable=True
-        ),
-    )
-    op.add_column(
-        "api_keys", sa.Column("balance_limit_reset_date", sa.Integer(), nullable=True)
-    )
-    op.add_column("api_keys", sa.Column("validity_date", sa.Integer(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("api_keys", "validity_date")
-    op.drop_column("api_keys", "balance_limit_reset_date")
-    op.drop_column("api_keys", "balance_limit_reset")
-    op.drop_column("api_keys", "balance_limit")

migrations/versions/4e0c3d195a49_add_model_paths_table.py

@@ -1,54 +0,0 @@
-"""add model paths table
-
-Revision ID: 4e0c3d195a49
-Revises: 9c4d8e2f1a6b
-Create Date: 2026-07-24 21:14:39.062179
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "4e0c3d195a49"
-down_revision = "9c4d8e2f1a6b"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "model_paths",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column("model_id", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("path", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("provider_slug", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("provider_type", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("endpoint_tag", sqlmodel.sql.sqltypes.AutoString(), nullable=True),
-        sa.Column("endpoint_name", sqlmodel.sql.sqltypes.AutoString(), nullable=True),
-        sa.Column("upstream_provider_id", sa.Integer(), nullable=False),
-        sa.Column("updated_at", sa.Integer(), nullable=False, server_default="0"),
-        sa.ForeignKeyConstraint(
-            ["upstream_provider_id"], ["upstream_providers.id"], ondelete="CASCADE"
-        ),
-        sa.PrimaryKeyConstraint("id"),
-        sa.UniqueConstraint(
-            "model_id",
-            "path",
-            "upstream_provider_id",
-            name="uq_model_paths_model_path_provider",
-        ),
-    )
-    # No standalone index on model_id: the unique constraint's autoindex already
-    # leads on model_id.
-    op.create_index(
-        op.f("ix_model_paths_upstream_provider_id"),
-        "model_paths",
-        ["upstream_provider_id"],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(op.f("ix_model_paths_upstream_provider_id"), table_name="model_paths")
-    op.drop_table("model_paths")

migrations/versions/614c0a740e68_add_provider_settings_to_upstream_.py

@@ -1,32 +0,0 @@
-"""add provider_settings to upstream_providers
-
-Revision ID: 614c0a740e68
-Revises: 06f81c0fc88d
-Create Date: 2026-02-13 22:36:53.608737
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "614c0a740e68"
-down_revision = "06f81c0fc88d"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Check if column exists before adding it
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    columns = [c["name"] for c in inspector.get_columns("upstream_providers")]
-
-    if "provider_settings" not in columns:
-        op.add_column(
-            "upstream_providers",
-            sa.Column("provider_settings", sa.Text(), nullable=True),
-        )
-
-
-def downgrade() -> None:
-    op.drop_column("upstream_providers", "provider_settings")

migrations/versions/7f2843d3f4e4_add_reservation_release_idempotency_.py

@@ -1,62 +0,0 @@
-"""add reservation release idempotency records
-
-Revision ID: 7f2843d3f4e4
-Revises: fc4fa29630d2
-Create Date: 2026-07-24 02:06:06.066726
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "7f2843d3f4e4"
-down_revision = "fc4fa29630d2"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "reservation_releases",
-        sa.Column("id", sa.String(), nullable=False),
-        sa.Column("key_hash", sa.String(), nullable=False),
-        sa.Column("billing_key_hash", sa.String(), nullable=False),
-        sa.Column("reserved_msats", sa.Integer(), nullable=False),
-        sa.Column(
-            "status", sa.String(), nullable=False, server_default="active"
-        ),
-        sa.Column("created_at", sa.Integer(), nullable=False),
-        sa.PrimaryKeyConstraint("id"),
-    )
-    op.create_index(
-        "ix_reservation_releases_key_hash",
-        "reservation_releases",
-        ["key_hash"],
-    )
-    op.create_index(
-        "ix_reservation_releases_billing_key_hash",
-        "reservation_releases",
-        ["billing_key_hash"],
-    )
-    op.create_index(
-        "ix_reservation_releases_status_created_at",
-        "reservation_releases",
-        ["status", "created_at"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(
-        "ix_reservation_releases_status_created_at",
-        table_name="reservation_releases",
-    )
-    op.drop_index(
-        "ix_reservation_releases_billing_key_hash",
-        table_name="reservation_releases",
-    )
-    op.drop_index(
-        "ix_reservation_releases_key_hash",
-        table_name="reservation_releases",
-    )
-    op.drop_table("reservation_releases")

migrations/versions/9c4d8e2f1a6b_repair_fee_payout_checkpoint_columns.py

@@ -1,47 +0,0 @@
-"""repair missing fee payout checkpoint columns
-
-Revision ID: 9c4d8e2f1a6b
-Revises: 7f2843d3f4e4
-Create Date: 2026-07-25 00:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "9c4d8e2f1a6b"
-down_revision = "7f2843d3f4e4"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    """Repair databases stamped past the original checkpoint migration."""
-    conn = op.get_bind()
-    columns = {
-        column["name"] for column in sa.inspect(conn).get_columns("routstr_fees")
-    }
-
-    if "payout_in_progress_msats" not in columns:
-        op.add_column(
-            "routstr_fees",
-            sa.Column(
-                "payout_in_progress_msats",
-                sa.Integer(),
-                nullable=False,
-                server_default="0",
-            ),
-        )
-
-    if "payout_started_at" not in columns:
-        op.add_column(
-            "routstr_fees",
-            sa.Column("payout_started_at", sa.Integer(), nullable=True),
-        )
-
-
-def downgrade() -> None:
-    # The preceding revision already expects both columns. This migration only
-    # repairs schema drift, so downgrading it must preserve the expected schema.
-    pass

migrations/versions/a2b3c4d5e6f7_add_constraints_to_lightning_invoices.py

@@ -1,26 +0,0 @@
-"""Add balance_limit, balance_limit_reset, validity_date to lightning_invoices
-
-Revision ID: a2b3c4d5e6f7
-Revises: f1a2b3c4d5e6
-Create Date: 2026-06-03 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "a2b3c4d5e6f7"
-down_revision = "f1a2b3c4d5e6"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("lightning_invoices", sa.Column("balance_limit", sa.Integer(), nullable=True))
-    op.add_column("lightning_invoices", sa.Column("balance_limit_reset", sa.String(), nullable=True))
-    op.add_column("lightning_invoices", sa.Column("validity_date", sa.Integer(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("lightning_invoices", "validity_date")
-    op.drop_column("lightning_invoices", "balance_limit_reset")
-    op.drop_column("lightning_invoices", "balance_limit")

migrations/versions/a776ca70e5fe_add_cashu_refunds_table.py

@@ -1,42 +0,0 @@
-"""add cashu_transactions table
-
-Revision ID: a776ca70e5fe
-Revises: 614c0a740e68
-Create Date: 2026-03-11 22:00:01.554762
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "a776ca70e5fe"
-down_revision = "614c0a740e68"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "cashu_transactions",
-        sa.Column("id", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("token", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("amount", sa.Integer(), nullable=False),
-        sa.Column("unit", sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-        sa.Column("mint_url", sqlmodel.sql.sqltypes.AutoString(), nullable=True),
-        sa.Column(
-            "type",
-            sqlmodel.sql.sqltypes.AutoString(),
-            nullable=False,
-            server_default="out",
-        ),
-        sa.Column("request_id", sqlmodel.sql.sqltypes.AutoString(), nullable=True),
-        sa.Column("created_at", sa.Integer(), nullable=False),
-        sa.Column("collected", sa.Boolean(), nullable=False),
-        sa.Column("swept", sa.Boolean(), nullable=False),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("cashu_transactions")

migrations/versions/b1c2d3e4f5a6_add_upstream_model_id_to_models.py

@@ -1,33 +0,0 @@
-"""add forwarded_model_id to models
-
-Revision ID: b1c2d3e4f5a6
-Revises: a776ca70e5fe
-Create Date: 2026-04-05 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "b1c2d3e4f5a6"
-down_revision = "a776ca70e5fe"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "models",
-        sa.Column(
-            "forwarded_model_id",
-            sqlmodel.sql.sqltypes.AutoString(),
-            nullable=True,
-        ),
-    )
-    # Backfill: set forwarded_model_id = id for all existing rows
-    op.execute("UPDATE models SET forwarded_model_id = id WHERE forwarded_model_id IS NULL")
-
-
-def downgrade() -> None:
-    op.drop_column("models", "forwarded_model_id")

migrations/versions/b5e7c9d1f3a2_add_reserved_at_to_api_keys.py

@@ -1,25 +0,0 @@
-"""add reserved_at to api_keys
-
-Revision ID: b5e7c9d1f3a2
-Revises: a2b3c4d5e6f7
-Create Date: 2026-06-12 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "b5e7c9d1f3a2"
-down_revision = "a2b3c4d5e6f7"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # existing keys keep NULL
-    # New reservations populate it via pay_for_request.
-    op.add_column("api_keys", sa.Column("reserved_at", sa.Integer(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("api_keys", "reserved_at")

migrations/versions/c3d4e5f6a7b8_add_source_to_cashu_transactions.py

@@ -1,36 +0,0 @@
-"""add source to cashu_transactions
-
-Revision ID: c3d4e5f6a7b8
-Revises: b1c2d3e4f5a6
-Create Date: 2026-04-10 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "c3d4e5f6a7b8"
-down_revision = "b1c2d3e4f5a6"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    columns = [col["name"] for col in inspector.get_columns("cashu_transactions")]
-    if "source" not in columns:
-        op.add_column(
-            "cashu_transactions",
-            sa.Column(
-                "source",
-                sqlmodel.sql.sqltypes.AutoString(),
-                nullable=False,
-                server_default="x-cashu",
-            ),
-        )
-
-
-def downgrade() -> None:
-    op.drop_column("cashu_transactions", "source")

migrations/versions/c6d7e8f9a0b1_add_slug_to_upstream_providers.py

@@ -1,88 +0,0 @@
-"""add slug to upstream_providers
-
-Revision ID: c6d7e8f9a0b1
-Revises: b5e7c9d1f3a2
-Create Date: 2026-06-29 00:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-from routstr.core.provider_slugs import provider_slug_base, provider_slug_candidate
-
-revision = "c6d7e8f9a0b1"
-down_revision = "b5e7c9d1f3a2"
-branch_labels = None
-depends_on = None
-
-
-def _allocate_backfill_slug(provider_type: str, reserved_slugs: set[str]) -> str:
-    base = provider_slug_base(provider_type)
-    suffix_number = 1
-    while True:
-        candidate = provider_slug_candidate(base, suffix_number)
-        if candidate not in reserved_slugs:
-            reserved_slugs.add(candidate)
-            return candidate
-        suffix_number += 1
-
-
-def _backfill_provider_slugs(conn: sa.Connection) -> None:
-    existing_rows = conn.execute(
-        sa.text(
-            "SELECT slug FROM upstream_providers "
-            "WHERE slug IS NOT NULL AND slug != ''"
-        )
-    )
-    reserved_slugs = {str(row.slug).lower() for row in existing_rows}
-
-    rows_to_backfill = conn.execute(
-        sa.text(
-            "SELECT id, provider_type FROM upstream_providers "
-            "WHERE slug IS NULL OR slug = '' "
-            "ORDER BY id"
-        )
-    )
-    for row in rows_to_backfill:
-        slug = _allocate_backfill_slug(str(row.provider_type), reserved_slugs)
-        conn.execute(
-            sa.text("UPDATE upstream_providers SET slug = :slug WHERE id = :id"),
-            {"slug": slug, "id": row.id},
-        )
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    columns = {c["name"] for c in inspector.get_columns("upstream_providers")}
-
-    if "slug" not in columns:
-        op.add_column(
-            "upstream_providers",
-            sa.Column("slug", sa.String(), nullable=True),
-        )
-
-    _backfill_provider_slugs(conn)
-
-    existing_indexes = {idx["name"] for idx in inspector.get_indexes("upstream_providers")}
-    if "ix_upstream_providers_slug" not in existing_indexes:
-        op.create_index(
-            "ix_upstream_providers_slug",
-            "upstream_providers",
-            ["slug"],
-            unique=True,
-        )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    existing_indexes = {idx["name"] for idx in inspector.get_indexes("upstream_providers")}
-    if "ix_upstream_providers_slug" in existing_indexes:
-        op.drop_index("ix_upstream_providers_slug", table_name="upstream_providers")
-
-    columns = {c["name"] for c in inspector.get_columns("upstream_providers")}
-    if "slug" in columns:
-        op.drop_column("upstream_providers", "slug")

migrations/versions/cli_tokens_table.py

@@ -1,34 +0,0 @@
-"""add cli_tokens table
-
-Revision ID: cli_tokens_001
-Revises: e8f9a0b1c2d3
-Create Date: 2026-04-25 00:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "cli_tokens_001"
-down_revision = "e8f9a0b1c2d3"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "cli_tokens",
-        sa.Column("id", sa.String(), primary_key=True, nullable=False),
-        sa.Column("token", sa.String(), nullable=False, unique=True),
-        sa.Column("name", sa.String(), nullable=False),
-        sa.Column("created_at", sa.Integer(), nullable=False),
-        sa.Column("last_used_at", sa.Integer(), nullable=True),
-        sa.Column("expires_at", sa.Integer(), nullable=True),
-    )
-    op.create_index("ix_cli_tokens_token", "cli_tokens", ["token"], unique=True)
-
-
-def downgrade() -> None:
-    op.drop_index("ix_cli_tokens_token", table_name="cli_tokens")
-    op.drop_table("cli_tokens")

migrations/versions/d4e5f6a7b8c9_add_api_key_to_cashu_transactions.py

@@ -1,46 +0,0 @@
-"""add api key link to cashu_transactions
-
-Revision ID: d4e5f6a7b8c9
-Revises: c3d4e5f6a7b8
-Create Date: 2026-04-20 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "d4e5f6a7b8c9"
-down_revision = "c3d4e5f6a7b8"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    columns = [col["name"] for col in inspector.get_columns("cashu_transactions")]
-    indexes = {index["name"] for index in inspector.get_indexes("cashu_transactions")}
-
-    if "api_key_hashed_key" not in columns:
-        op.add_column(
-            "cashu_transactions",
-            sa.Column(
-                "api_key_hashed_key",
-                sqlmodel.sql.sqltypes.AutoString(),
-                nullable=True,
-            ),
-        )
-
-    if "ix_cashu_transactions_api_key_hashed_key" not in indexes:
-        op.create_index(
-            "ix_cashu_transactions_api_key_hashed_key",
-            "cashu_transactions",
-            ["api_key_hashed_key"],
-            unique=False,
-        )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_cashu_transactions_api_key_hashed_key", table_name="cashu_transactions")
-    op.drop_column("cashu_transactions", "api_key_hashed_key")

migrations/versions/d7e8f9a0b1c2_add_fee_payout_checkpoint.py

@@ -1,37 +0,0 @@
-"""add fee payout checkpoint
-
-Revision ID: d7e8f9a0b1c2
-Revises: c6d7e8f9a0b1
-Create Date: 2026-07-18 00:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "d7e8f9a0b1c2"
-down_revision = "c6d7e8f9a0b1"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "routstr_fees",
-        sa.Column(
-            "payout_in_progress_msats",
-            sa.Integer(),
-            nullable=False,
-            server_default="0",
-        ),
-    )
-    op.add_column(
-        "routstr_fees",
-        sa.Column("payout_started_at", sa.Integer(), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("routstr_fees", "payout_started_at")
-    op.drop_column("routstr_fees", "payout_in_progress_msats")

migrations/versions/e8f9a0b1c2d3_merge_heads.py

@@ -1,20 +0,0 @@
-"""merge heads: routstr_fees + api_key_to_cashu_transactions
-
-Revision ID: e8f9a0b1c2d3
-Revises: 02650cd6f028, d4e5f6a7b8c9
-Create Date: 2026-04-24 00:00:00.000000
-"""
-
-# revision identifiers, used by Alembic.
-revision = "e8f9a0b1c2d3"
-down_revision = ("02650cd6f028", "d4e5f6a7b8c9")
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    pass
-
-
-def downgrade() -> None:
-    pass

migrations/versions/f1a2b3c4d5e6_add_created_at_to_api_keys.py

@@ -1,25 +0,0 @@
-"""add created_at to api_keys
-
-Revision ID: f1a2b3c4d5e6
-Revises: cli_tokens_001
-Create Date: 2026-06-01 00:00:00.000000
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "f1a2b3c4d5e6"
-down_revision = "cli_tokens_001"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # Nullable on purpose: existing keys keep NULL (unknown creation time) and
-    # sort last; new keys get populated by the model's default_factory.
-    op.add_column("api_keys", sa.Column("created_at", sa.Integer(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("api_keys", "created_at")

migrations/versions/fc4fa29630d2_add_secrets_table.py

@@ -1,51 +0,0 @@
-"""add secrets table
-
-Revision ID: fc4fa29630d2
-Revises: d7e8f9a0b1c2
-Create Date: 2026-07-23 00:00:00.000000
-
-Creates the node-level singleton secret store (issue #553). Schema only; moving
-any legacy plaintext into the encrypted/hashed columns happens at bootstrap,
-where the live ROUTSTR_SECRET_KEY is available. ``nsec_state`` records the vault's
-ownership of the nsec (legacy | encrypted | cleared), so a cleared identity is
-never resurrected from a stale legacy ``NSEC`` env var / settings blob on the next
-boot.
-"""
-
-import sqlalchemy as sa
-import sqlmodel
-from alembic import op
-
-revision = "fc4fa29630d2"
-down_revision = "d7e8f9a0b1c2"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "secrets",
-        sa.Column("id", sa.Integer(), nullable=False),
-        sa.Column(
-            "admin_password_hash",
-            sqlmodel.sql.sqltypes.AutoString(),
-            nullable=True,
-        ),
-        sa.Column(
-            "encrypted_nsec",
-            sqlmodel.sql.sqltypes.AutoString(),
-            nullable=True,
-        ),
-        sa.Column(
-            "nsec_state",
-            sqlmodel.sql.sqltypes.AutoString(),
-            nullable=False,
-            server_default="legacy",
-        ),
-        sa.Column("updated_at", sa.Integer(), nullable=True),
-        sa.PrimaryKeyConstraint("id"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("secrets")

plans/other-mints-balance-tracking-plan.md

@@ -1,355 +0,0 @@
-# Plan: Track unsupported incoming mints in `other_mints` and include them in balances
-
-## Goal
-
-When a Cashu token arrives from a mint that is **not** in `settings.cashu_mints`, we currently create/use a wallet for that mint and swap value into the primary mint. Any change/surplus left behind after `melt()` remains in the foreign `token_wallet`, but that balance is not surfaced by `fetch_all_balances()` because it only iterates over configured mints.
-
-This plan adds persistent tracking for those foreign mints in a new database table called `other_mints`, and updates balance reporting to include them.
-
----
-
-## Current behavior
-
-### Incoming unsupported mint flow
-
-In `routstr/wallet.py`:
-
-- `recieve_token()` deserializes the token
-- if `token_obj.mint not in settings.cashu_mints`, it calls `swap_to_primary_mint(token_obj, wallet)`
-- `swap_to_primary_mint()` calls `token_wallet.melt(...)` to pay the primary mint invoice
-
-### Important detail: change is retained, not discarded
-
-The underlying Cashu wallet library keeps any melt change:
-
-- `Wallet.melt()` constructs blank outputs for change
-- when the melt succeeds, returned change is reconstructed into proofs
-- those proofs are appended to `self.proofs` and stored in the wallet DB
-
-So surplus from unsupported mints is **not discarded**, but it may become invisible operationally.
-
-### Visibility problem
-
-`fetch_all_balances()` currently only loops over:
-
-- `settings.cashu_mints`
-- units `sat` and `msat`
-
-This means balances left on unsupported mints are not shown in admin balance reporting.
-
----
-
-## Proposed design
-
-## 1. Add a new DB table: `other_mints`
-
-Add a small table in `routstr/core/db.py` to persist unsupported mints we have seen in incoming tokens.
-
-Suggested schema:
-
-- `mint_url: str` primary key
-- `created_at: int`
-- `last_seen_at: int`
-
-Minimal model:
-
-```python
-class OtherMint(SQLModel, table=True):
-    __tablename__ = "other_mints"
-
-    mint_url: str = Field(primary_key=True)
-    created_at: int = Field(default_factory=lambda: int(time.time()))
-    last_seen_at: int = Field(default_factory=lambda: int(time.time()))
-```
-
-Why minimal:
-
-- the only required function is mint discovery/tracking
-- unit handling can remain dynamic via existing balance queries over `sat` and `msat`
-
----
-
-## 2. Add DB helpers for `other_mints`
-
-In `routstr/core/db.py`, add helper functions:
-
-### `register_other_mint(mint_url: str) -> None`
-
-Behavior:
-
-- if the mint is not present, insert it
-- if it already exists, update `last_seen_at`
-
-### `list_other_mints(session) -> list[str]`
-
-Behavior:
-
-- return all tracked unsupported mint URLs
-
-Optional later:
-
-- `delete_other_mint(...)`
-- admin cleanup helpers
-
----
-
-## 3. Register unsupported mints during token receipt
-
-Update `recieve_token()` in `routstr/wallet.py`.
-
-Current logic:
-
-```python
-if token_obj.mint not in settings.cashu_mints:
-    return await swap_to_primary_mint(token_obj, wallet)
-```
-
-Planned logic:
-
-```python
-if token_obj.mint not in settings.cashu_mints:
-    await db.register_other_mint(token_obj.mint)
-    return await swap_to_primary_mint(token_obj, wallet)
-```
-
-Why here:
-
-- this is the earliest reliable point where we know the mint came in via an actual token
-- this is exactly the path that can leave foreign-mint change behind
-- it avoids needing to infer unsupported mints later from wallet internals
-
----
-
-## 4. Update `fetch_all_balances()` to include `other_mints`
-
-Current behavior only includes configured mints.
-
-Planned behavior:
-
-- load tracked unsupported mints from DB
-- combine them with `settings.cashu_mints`
-- dedupe while preserving order
-- fetch balances for all tracked mints across requested units
-
-Conceptual flow:
-
-```python
-tracked_mints = dedupe(settings.cashu_mints + other_mints_from_db)
-```
-
-Then existing per-mint/per-unit balance logic can remain mostly unchanged.
-
-This ensures that retained change on unsupported mints becomes visible in admin balance reporting.
-
----
-
-## 5. Add a balance source marker
-
-Extend `BalanceDetail` in `routstr/wallet.py` to identify whether a balance row comes from a configured mint or an `other_mints` entry.
-
-Suggested field:
-
-- `source: str` with values:
-  - `"configured"`
-  - `"other"`
-
-Updated shape:
-
-```python
-class BalanceDetail(TypedDict, total=False):
-    mint_url: str
-    unit: str
-    source: str
-    wallet_balance: int
-    user_balance: int
-    owner_balance: int
-    error: str
-```
-
-Why this helps:
-
-- admin can distinguish normal configured wallet balances from foreign/unsupported balances
-- avoids confusion if unexpected mint URLs show up in the balances API/UI
-
----
-
-## 6. Admin/API impact
-
-Backend impact is minimal because `/admin/api/balances` already returns `fetch_all_balances()` output.
-
-Effects:
-
-- supported mints continue to show as before
-- tracked unsupported mints will also appear
-- UI can optionally display the new `source` field
-
-No API contract break is expected if the frontend ignores unknown fields.
-
----
-
-## 7. Payout behavior: do not change in phase 1
-
-`periodic_payout()` currently only iterates over `settings.cashu_mints`.
-
-Recommendation for this change:
-
-- **do not** expand `periodic_payout()` to include `other_mints` yet
-- only improve visibility through balance reporting
-
-Reason:
-
-- automatic payout from unsupported/foreign mints may be operationally undesirable
-- visibility should come first, automation second
-
-Possible future phase:
-
-- add optional sweeping/payout support for `other_mints`
-- or provide an admin-triggered withdrawal/sweep flow
-
----
-
-## 8. Logging improvements (optional)
-
-Optional follow-up improvement in `swap_to_primary_mint()`:
-
-- capture the return value from `token_wallet.melt(...)`
-- if feasible, log any reported change amount
-- otherwise, rely on wallet balance reporting to surface residual amounts
-
-This is useful but not required for the first implementation.
-
----
-
-## Files to change
-
-### `routstr/core/db.py`
-
-Add:
-
-- `OtherMint` SQLModel
-- `register_other_mint()`
-- `list_other_mints()`
-
-### `migrations/versions/<new_revision>_add_other_mints_table.py`
-
-Create migration to add the `other_mints` table.
-
-### `routstr/wallet.py`
-
-Update:
-
-- `recieve_token()` to register unsupported mints
-- `BalanceDetail` to include `source`
-- `fetch_all_balances()` to include both configured and tracked unsupported mints
-
-### `routstr/core/admin.py`
-
-Likely no backend changes required unless a dedicated `other_mints` API is desired.
-
----
-
-## Behavior rules
-
-### Register a mint when
-
-- an incoming token is processed
-- the token mint is not in `settings.cashu_mints`
-
-### Do not remove automatically when
-
-- balance reaches zero
-
-Reason:
-
-- historical visibility is useful
-- avoids flapping entries in the admin balance list
-- mint may receive additional unsupported tokens later
-
-Potential future enhancement:
-
-- admin endpoint to prune zero-balance `other_mints`
-
----
-
-## Edge cases
-
-### A mint later becomes configured
-
-If a mint in `other_mints` is later added to `settings.cashu_mints`:
-
-- deduplication prevents duplicate balance rows
-- `source` should resolve to `configured`
-
-### Unsupported mint with zero balance
-
-A tracked unsupported mint may show zero balances.
-
-Initial recommendation:
-
-- allow it to appear
-- consider later filtering zero-balance `other` rows if the UI becomes noisy
-
-### Units
-
-Balance fetching can continue to query both `sat` and `msat` for each tracked mint.
-
-If a mint has no proofs in one unit, current error/zero handling can continue to apply.
-
----
-
-## Test plan
-
-### DB tests
-
-- registering a new unsupported mint inserts a row
-- registering the same mint again updates `last_seen_at` without duplication
-- listing other mints returns expected mint URLs
-
-### Wallet tests
-
-#### `recieve_token()`
-
-- when mint is unsupported, `db.register_other_mint()` is called before swap
-- when mint is configured, `db.register_other_mint()` is not called
-
-#### `fetch_all_balances()`
-
-- includes configured mints
-- includes `other_mints` from DB
-- dedupes if a mint exists in both configured and other lists
-- sets `source` correctly
-
-### Regression tests
-
-- existing trusted mint balance reporting remains unchanged
-- `/admin/api/balances` continues to work
-
----
-
-## Recommended implementation order
-
-1. Add `OtherMint` model to `routstr/core/db.py`
-2. Add Alembic migration for `other_mints`
-3. Add `register_other_mint()` and `list_other_mints()` helpers
-4. Update `recieve_token()` to register unsupported mints
-5. Update `fetch_all_balances()` to union configured + tracked other mints
-6. Add `source` to `BalanceDetail`
-7. Add/adjust tests
-
----
-
-## Summary
-
-This change solves an operational visibility problem:
-
-- unsupported incoming mints can leave retained change in foreign wallets
-- those funds are currently preserved but not surfaced in balance reporting
-- introducing `other_mints` makes those mints discoverable and auditable
-- expanding `fetch_all_balances()` ensures their balances are visible in admin tooling
-
-Recommended scope for the first pass:
-
-- track unsupported mints in DB
-- include them in balance reporting
-- mark them as `source="other"`
-- do not yet change payout/sweeping behavior

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "routstr"
-version = "0.4.4"
+version = "0.3.0"
 description = "Payment proxy for your LLM endpoint using cashu and nostr."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -10,18 +10,17 @@ dependencies = [
     "aiosqlite>=0.20",
     "sqlmodel>=0.0.24",
     "httpx[socks]>=0.25.2",
-    "h11>=0.14",
     "greenlet>=3.2.1",
     "alembic>=1.13",
     "python-json-logger>=2.0.0",
-    "cashu>=0.20",
+    "cashu",
+    "secp256k1",
     "marshmallow>=3.13,<4.0",
     "websockets>=12.0",
     "nostr>=0.0.2",
     "mdurl==0.1.2",
     "pillow>=10",
     "openai>=1.98.0",
-    "litellm>=1.55.0",
 ]
 
 [dependency-groups]
@@ -87,3 +86,4 @@ disallow_untyped_decorators = true
 
 [tool.uv.sources]
 routstr = { workspace = true }
+secp256k1 = { git = "https://github.com/saschanaz/secp256k1-py", branch = "upgrade060" }

routstr/algorithm.py

@@ -86,12 +86,10 @@ def get_provider_penalty(provider: "BaseUpstreamProvider") -> float:
 
 def create_model_mappings(
     upstreams: list["BaseUpstreamProvider"],
-    overrides_by_key: dict[tuple[str, int], tuple],
-    disabled_model_keys: set[tuple[str, int]],
+    overrides_by_id: dict[str, tuple],
+    disabled_model_ids: set[str],
 ) -> tuple[
-    dict[str, "Model"],
-    dict[str, list[tuple["Model", "BaseUpstreamProvider"]]],
-    dict[str, "Model"],
+    dict[str, "Model"], dict[str, list["BaseUpstreamProvider"]], dict[str, "Model"]
 ]:
     """Create optimal model mappings based on cost and provider preferences.
 
@@ -99,9 +97,7 @@ def create_model_mappings(
     and creates three mappings based on cost optimization:
 
     1. model_instances: alias -> Model (all model aliases mapped to their Model objects)
-    2. provider_map: alias -> List[(Model, UpstreamProvider)] (sorted candidate
-       list for each alias; each provider is paired with ITS OWN model so
-       failover can forward and bill the candidate that actually serves)
+    2. provider_map: alias -> List[UpstreamProvider] (sorted list of providers for each alias)
     3. unique_models: base_id -> Model (unique models without provider prefixes)
 
     The algorithm:
@@ -111,9 +107,8 @@ def create_model_mappings(
 
     Args:
         upstreams: List of all upstream provider instances
-        overrides_by_key: Dict of model overrides from database
-            {(model_id_lower, upstream_provider_id): (ModelRow, fee)}
-        disabled_model_keys: Set of provider-scoped model keys that should be excluded
+        overrides_by_id: Dict of model overrides from database {model_id: (ModelRow, fee)}
+        disabled_model_ids: Set of model IDs that should be excluded
 
     Returns:
         Tuple of (model_instances, provider_map, unique_models)
@@ -123,32 +118,12 @@ def create_model_mappings(
 
     candidates: dict[str, list[tuple["Model", "BaseUpstreamProvider"]]] = {}
     unique_models: dict[str, "Model"] = {}
-    seen_model_provider: set[tuple[str, str]] = set()
-
-    providers_by_db_id: dict[int, "BaseUpstreamProvider"] = {}
-    for upstream in upstreams:
-        db_id = getattr(upstream, "db_id", None)
-        if isinstance(db_id, int):
-            providers_by_db_id[db_id] = upstream
-
-    # Group upstreams by URL and keep only the one with the lowest fee for each URL
-    upstreams_by_url: dict[str, list["BaseUpstreamProvider"]] = {}
-    for upstream in upstreams:
-        url = getattr(upstream, "base_url", "")
-        if url not in upstreams_by_url:
-            upstreams_by_url[url] = []
-        upstreams_by_url[url].append(upstream)
-
-    filtered_upstreams: list["BaseUpstreamProvider"] = []
-    for providers in upstreams_by_url.values():
-        best_provider = min(providers, key=lambda p: p.provider_fee)
-        filtered_upstreams.append(best_provider)
 
     # Separate OpenRouter from other providers
     openrouter: "BaseUpstreamProvider" | None = None
     other_upstreams: list["BaseUpstreamProvider"] = []
 
-    for upstream in filtered_upstreams:
+    for upstream in upstreams:
         base_url = getattr(upstream, "base_url", "")
         if base_url == "https://openrouter.ai/api/v1":
             openrouter = upstream
@@ -159,16 +134,6 @@ def create_model_mappings(
         """Get base model ID by removing provider prefix."""
         return model_id.split("/", 1)[1] if "/" in model_id else model_id
 
-    def get_provider_identity(upstream: "BaseUpstreamProvider") -> str:
-        """Get a stable provider identity used for deduplication."""
-        db_id = getattr(upstream, "db_id", None)
-        if isinstance(db_id, int):
-            return f"db:{db_id}"
-
-        provider_type = str(getattr(upstream, "provider_type", "") or "").lower()
-        base_url = str(getattr(upstream, "base_url", "") or "").lower()
-        return f"{provider_type}|{base_url}"
-
     def _add_candidate(
         alias: str, model: "Model", provider: "BaseUpstreamProvider"
     ) -> None:
@@ -183,23 +148,14 @@ def create_model_mappings(
     ) -> None:
         """Process all models from a given provider."""
         upstream_prefix = getattr(upstream, "upstream_name", None)
-        provider_key = get_provider_identity(upstream)
-        upstream_db_id = getattr(upstream, "db_id", None)
 
         for model in upstream.get_cached_models():
-            model_key = (
-                (model.id.lower(), upstream_db_id)
-                if isinstance(upstream_db_id, int)
-                else None
-            )
-            if not model.enabled or (
-                model_key is not None and model_key in disabled_model_keys
-            ):
+            if not model.enabled or model.id in disabled_model_ids:
                 continue
 
-            # Apply overrides only for this provider's model row.
-            if model_key is not None and model_key in overrides_by_key:
-                override_row, provider_fee = overrides_by_key[model_key]
+            # Apply overrides if present
+            if model.id in overrides_by_id:
+                override_row, provider_fee = overrides_by_id[model.id]
                 model_to_use = _row_to_model(
                     override_row, apply_provider_fee=True, provider_fee=provider_fee
                 )
@@ -208,15 +164,14 @@ def create_model_mappings(
 
             # Add to unique models
             base_id = get_base_model_id(model_to_use.id)
-            unique_key = model_to_use.forwarded_model_id or base_id
-            if not is_openrouter or unique_key not in unique_models:
+            if not is_openrouter or base_id not in unique_models:
                 unique_model = model_to_use.copy(
                     update={
                         "id": base_id,
                         "upstream_provider_id": upstream.provider_type,
                     }
                 )
-                unique_models[unique_key] = unique_model
+                unique_models[base_id] = unique_model
 
             # Get all aliases for this model
             aliases = resolve_model_alias(
@@ -231,14 +186,9 @@ def create_model_mappings(
                 if prefixed_id not in aliases:
                     aliases.append(prefixed_id)
 
-            # Register forwarded_model_id as a routable alias
-            if model_to_use.forwarded_model_id and model_to_use.forwarded_model_id not in aliases:
-                aliases.append(model_to_use.forwarded_model_id)
-
             # Try to set each alias
             for alias in aliases:
                 _add_candidate(alias, model_to_use, upstream)
-            seen_model_provider.add((model_to_use.id.lower(), provider_key))
 
     # Process non-OpenRouter providers first
     for upstream in other_upstreams:
@@ -248,112 +198,12 @@ def create_model_mappings(
     if openrouter:
         process_provider_models(openrouter, is_openrouter=True)
 
-    # Include enabled DB overrides even when provider discovery misses models.
-    # This is important for deployment-based providers like Azure.
-    for (model_id, upstream_provider_id), override_data in overrides_by_key.items():
-        if (model_id, upstream_provider_id) in disabled_model_keys:
-            continue
-        override_row, provider_fee = override_data
-
-        upstream_for_override = providers_by_db_id.get(upstream_provider_id)
-        if upstream_for_override is None:
-            continue
-
-        provider_key = get_provider_identity(upstream_for_override)
-        dedupe_key = (model_id.lower(), provider_key)
-        if dedupe_key in seen_model_provider:
-            continue
-
-        try:
-            model_to_use = _row_to_model(
-                override_row, apply_provider_fee=True, provider_fee=provider_fee
-            )
-        except Exception as exc:
-            logger.warning(
-                "Skipping invalid model override while building model mappings",
-                extra={
-                    "model_id": model_id,
-                    "upstream_provider_id": upstream_provider_id,
-                    "error": str(exc),
-                    "error_type": type(exc).__name__,
-                },
-            )
-            continue
-        if not model_to_use.enabled:
-            continue
-
-        base_id = get_base_model_id(model_to_use.id)
-        unique_key = model_to_use.forwarded_model_id or base_id
-        is_openrouter = (
-            getattr(upstream_for_override, "base_url", "")
-            == "https://openrouter.ai/api/v1"
-        )
-        if not is_openrouter or unique_key not in unique_models:
-            unique_model = model_to_use.copy(
-                update={
-                    "id": base_id,
-                    "upstream_provider_id": upstream_for_override.provider_type,
-                }
-            )
-            unique_models[unique_key] = unique_model
-
-        try:
-            aliases = resolve_model_alias(
-                model_to_use.id,
-                model_to_use.canonical_slug,
-                alias_ids=model_to_use.alias_ids,
-            )
-        except Exception as exc:
-            logger.warning(
-                "Skipping model aliases for invalid override model",
-                extra={
-                    "model_id": model_id,
-                    "upstream_provider_id": upstream_provider_id,
-                    "error": str(exc),
-                    "error_type": type(exc).__name__,
-                },
-            )
-            continue
-
-        upstream_prefix = getattr(upstream_for_override, "upstream_name", None)
-        if upstream_prefix and "/" not in model_to_use.id:
-            prefixed_id = f"{upstream_prefix}/{model_to_use.id}"
-            if prefixed_id not in aliases:
-                aliases.append(prefixed_id)
-
-        # Register forwarded_model_id as a routable alias
-        if model_to_use.forwarded_model_id and model_to_use.forwarded_model_id not in aliases:
-            aliases.append(model_to_use.forwarded_model_id)
-
-        for alias in aliases:
-            _add_candidate(alias, model_to_use, upstream_for_override)
-        seen_model_provider.add(dedupe_key)
-
     # Sort candidates and build final maps
     model_instances: dict[str, "Model"] = {}
-    provider_map: dict[str, list[tuple["Model", "BaseUpstreamProvider"]]] = {}
+    provider_map: dict[str, list["BaseUpstreamProvider"]] = {}
 
     def alias_priority(model: "Model", alias: str) -> int:
-        """Rank how strong the mapping of alias->model is.
-
-        forwarded_model_id is the most specific identifier (set per-provider
-        instance), so a match there should beat a model_id match. This way,
-        when multiple providers have the same model_id but different
-        forwarded_model_ids, the one whose forwarded_model_id equals the
-        requested alias wins.
-        """
-        if (
-            model.forwarded_model_id
-            and model.forwarded_model_id.lower() == alias
-        ):
-            return 5
-
-        if (
-            model.id
-            and model.id.lower() == alias
-        ):
-            return 4
-
+        """Rank how strong the mapping of alias->model is."""
         model_base = get_base_model_id(model.id)
         if model_base == alias:
             return 3
@@ -378,13 +228,13 @@ def create_model_mappings(
 
         best_model, best_provider = items[0]
         model_instances[alias] = best_model
-        provider_map[alias] = list(items)
+        provider_map[alias] = [p for _, p in items]
 
     # Log provider distribution (using top provider for stats)
     provider_counts: dict[str, int] = {}
-    for candidate_list in provider_map.values():
-        if candidate_list:
-            provider = candidate_list[0][1]
+    for providers in provider_map.values():
+        if providers:
+            provider = providers[0]
             provider_name = getattr(provider, "upstream_name", "unknown")
             provider_counts[provider_name] = provider_counts.get(provider_name, 0) + 1
 

routstr/balance.py

@@ -1,36 +1,17 @@
 import asyncio
 import hashlib
-import time
 from time import monotonic
 from typing import Annotated, NoReturn
 
 from fastapi import APIRouter, Depends, Header, HTTPException
-from fastapi.responses import JSONResponse
 from pydantic import BaseModel
-from sqlmodel import col, select, update
 
-from .auth import get_billing_key, validate_bearer_key
-from .core.db import (
-    ApiKey,
-    AsyncSession,
-    CashuTransaction,
-    get_session,
-    release_stale_reservations,
-)
-from .core.db import (
-    store_cashu_transaction_with_retry as store_cashu_transaction,
-)
+from .auth import validate_bearer_key
+from .core.db import ApiKey, AsyncSession, get_session
 from .core.logging import get_logger
 from .core.settings import settings
 from .lightning import lightning_router
-from .wallet import (
-    classify_redemption_error,
-    credit_balance,
-    is_mint_connection_error,
-    recieve_token,
-    send_to_lnurl,
-    send_token,
-)
+from .wallet import credit_balance, recieve_token, send_to_lnurl, send_token
 
 router = APIRouter()
 balance_router = APIRouter(prefix="/v1/balance")
@@ -52,41 +33,19 @@ async def get_key_from_header(
 
 
 async def get_balance_info(key: ApiKey, session: AsyncSession) -> dict:
+    from .auth import get_billing_key
+
     billing_key = await get_billing_key(key, session)
-    info = {
+    return {
         "api_key": "sk-" + key.hashed_key,
-        "balance": billing_key.total_balance,
+        "balance": billing_key.balance,
         "reserved": billing_key.reserved_balance,
         "is_child": key.parent_key_hash is not None,
+        "parent_key": "sk-" + key.parent_key_hash if key.parent_key_hash else None,
         "total_requests": key.total_requests,
         "total_spent": key.total_spent,
-        "balance_limit": key.balance_limit,
-        "balance_limit_reset": key.balance_limit_reset,
-        "validity_date": key.validity_date,
     }
 
-    if key.parent_key_hash:
-        info["parent_key_preview"] = key.parent_key_hash[:8] + "..."
-    else:
-        # Fetch child keys if this is a parent key
-        statement = select(ApiKey).where(ApiKey.parent_key_hash == key.hashed_key)
-        results = await session.exec(statement)
-        child_keys = results.all()
-        if child_keys:
-            info["child_keys"] = [
-                {
-                    "api_key": "sk-" + ck.hashed_key,
-                    "total_requests": ck.total_requests,
-                    "total_spent": ck.total_spent,
-                    "balance_limit": ck.balance_limit,
-                    "balance_limit_reset": ck.balance_limit_reset,
-                    "validity_date": ck.validity_date,
-                }
-                for ck in child_keys
-            ]
-
-    return info
-
 
 # TODO: remove this endpoint when frontend is updated
 @router.get("/", include_in_schema=False)
@@ -109,69 +68,17 @@ async def account_info(
 # Note: validate_bearer_key already supports refund_address and key_expiry_time params
 
 
-class BalanceCreateRequest(BaseModel):
-    initial_balance_token: str
-    balance_limit: int | None = None
-    balance_limit_reset: str | None = None
-    validity_date: int | None = None
-
-
-async def _create_balance(
-    initial_balance_token: str,
-    balance_limit: int | None,
-    balance_limit_reset: str | None,
-    validity_date: int | None,
-    session: AsyncSession,
+@router.get("/create")
+async def create_balance(
+    initial_balance_token: str, session: AsyncSession = Depends(get_session)
 ) -> dict:
     key = await validate_bearer_key(initial_balance_token, session)
-
-    if balance_limit is not None or balance_limit_reset or validity_date:
-        key.balance_limit = balance_limit
-        key.balance_limit_reset = balance_limit_reset
-        key.validity_date = validity_date
-        if balance_limit_reset:
-            key.balance_limit_reset_date = int(time.time())
-        session.add(key)
-        await session.commit()
-        await session.refresh(key)
-
     return {
         "api_key": "sk-" + key.hashed_key,
         "balance": key.balance,
     }
 
 
-@router.post("/create")
-async def create_balance_from_body(
-    payload: BalanceCreateRequest,
-    session: AsyncSession = Depends(get_session),
-) -> dict:
-    return await _create_balance(
-        payload.initial_balance_token,
-        payload.balance_limit,
-        payload.balance_limit_reset,
-        payload.validity_date,
-        session,
-    )
-
-
-@router.get("/create")
-async def create_balance(
-    initial_balance_token: str,
-    balance_limit: int | None = None,
-    balance_limit_reset: str | None = None,
-    validity_date: int | None = None,
-    session: AsyncSession = Depends(get_session),
-) -> dict:
-    return await _create_balance(
-        initial_balance_token,
-        balance_limit,
-        balance_limit_reset,
-        validity_date,
-        session,
-    )
-
-
 @router.get("/info")
 async def wallet_info(
     key: ApiKey = Depends(get_key_from_header),
@@ -191,6 +98,8 @@ async def topup_wallet_endpoint(
     key: ApiKey = Depends(get_key_from_header),
     session: AsyncSession = Depends(get_session),
 ) -> dict[str, int]:
+    from .auth import get_billing_key
+
     billing_key = await get_billing_key(key, session)
 
     if topup_request is not None:
@@ -203,18 +112,16 @@ async def topup_wallet_endpoint(
         raise HTTPException(status_code=400, detail="Invalid token format")
     try:
         amount_msats = await credit_balance(cashu_token, billing_key, session)
-    except Exception as e:
-        # Shared taxonomy so top-up matches the bearer/X-Cashu paths (503 for an
-        # unreachable mint, 422 for fee/swap failures, 400 for token faults).
-        classified = classify_redemption_error(e)
-        if classified is None:
-            logger.error(
-                "topup_wallet_endpoint: unhandled error",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-            raise HTTPException(status_code=500, detail="Internal server error")
-        _type, status_code, message, _code = classified
-        raise HTTPException(status_code=status_code, detail=message)
+    except ValueError as e:
+        error_msg = str(e)
+        if "already spent" in error_msg.lower():
+            raise HTTPException(status_code=400, detail="Token already spent")
+        elif "invalid" in error_msg.lower() or "decode" in error_msg.lower():
+            raise HTTPException(status_code=400, detail="Invalid token format")
+        else:
+            raise HTTPException(status_code=400, detail="Failed to redeem token")
+    except Exception:
+        raise HTTPException(status_code=500, detail="Internal server error")
     return {"msats": amount_msats}
 
 
@@ -247,112 +154,23 @@ async def _refund_cache_set(authorization: str, value: dict[str, str]) -> None:
         _refund_cache[key] = (expiry, value)
 
 
-async def _lookup_key_no_create(
-    bearer_value: str, session: AsyncSession
-) -> ApiKey | None:
-    """Look up an existing API key without creating one Used by the refund endpoint"""
-    if bearer_value.startswith("sk-"):
-        return await session.get(ApiKey, bearer_value[3:])
-    if bearer_value.startswith("cashu"):
-        hashed = hashlib.sha256(bearer_value.encode()).hexdigest()
-        return await session.get(ApiKey, hashed)
-    return None
-
-
-async def _restore_balance(
-    session: AsyncSession, hashed_key: str, balance: int, reserved_balance: int, mint_url: str
-) -> None:
-    """Restore balance after a failed refund mint attempt."""
-    restore_stmt = (
-        update(ApiKey)
-        .where(col(ApiKey.hashed_key) == hashed_key)
-        .values(
-            balance=col(ApiKey.balance) + balance,
-            reserved_balance=col(ApiKey.reserved_balance) + reserved_balance,
-        )
-    )
-    await session.exec(restore_stmt)  # type: ignore[call-overload]
-    await session.commit()
-    logger.info(
-        "refund_wallet_endpoint: balance restored after mint failure",
-        extra={"hashed_key": hashed_key, "restored_balance": balance, "mint_url": mint_url},
-    )
-
-
-@router.post("/refund", response_model=None)
+@router.post("/refund")
 async def refund_wallet_endpoint(
-    authorization: Annotated[str | None, Header()] = None,
-    x_cashu: Annotated[str | None, Header()] = None,
+    authorization: Annotated[str, Header(...)],
     session: AsyncSession = Depends(get_session),
-) -> JSONResponse | dict[str, str]:
-    if x_cashu:
-        # Find the "in" transaction by the original payment token
-        in_tx_result = await session.exec(
-            select(CashuTransaction).where(
-                CashuTransaction.token == x_cashu,
-                CashuTransaction.type == "in",
-            )
-        )
-        in_tx = in_tx_result.first()
-        if in_tx is None:
-            raise HTTPException(status_code=404, detail="Refund not found")
-
-        # Use the request_id to find the associated "out" (refund) transaction
-        if in_tx.request_id is None:
-            raise HTTPException(status_code=404, detail="Refund not found")
-
-        out_tx_result = await session.exec(
-            select(CashuTransaction).where(
-                CashuTransaction.request_id == in_tx.request_id,
-                CashuTransaction.type == "out",
-            )
-        )
-        out_tx = out_tx_result.first()
-        if out_tx is None:
-            # The "in" row exists with a request_id, but the "out" (refund)
-            # row hasn't been written yet — the upstream request is still in
-            # flight and the refund will be minted once it completes. Tell the
-            # client to retry instead of 404ing permanently (race condition
-            # where /v1/wallet/refund is polled before the refund exists).
-            logger.debug(
-                "refund_wallet_endpoint: refund pending (in row exists, out row not yet created)",
-                extra={"request_id": in_tx.request_id},
-            )
-            raise HTTPException(
-                status_code=425,
-                detail="Refund is pending; retry shortly.",
-                headers={"Retry-After": "2"},
-            )
-        if out_tx.swept:
-            raise HTTPException(status_code=410, detail="Refund has been swept")
-
-        out_tx.collected = True
-        session.add(out_tx)
-        await session.commit()
-        body: dict[str, str] = {"token": out_tx.token}
-        if out_tx.unit == "sat":
-            body["sats"] = str(out_tx.amount)
-        else:
-            body["msats"] = str(out_tx.amount)
-        return JSONResponse(content=body, headers={"X-Cashu": out_tx.token})
-
-    if authorization is None or not authorization.startswith("Bearer "):
+) -> dict[str, str]:
+    if not authorization.startswith("Bearer "):
         raise HTTPException(
             status_code=401,
             detail="Invalid authorization. Use 'Bearer <cashu-token>' or 'Bearer <api-key>'",
         )
 
     bearer_value: str = authorization[7:]
-    key: ApiKey | None = await _lookup_key_no_create(bearer_value, session)
-    if key is None:
-        raise HTTPException(
-            status_code=401,
-            detail="Key not found. Deposit first via /v1/wallet/create before requesting a refund.",
-        )
 
-    if key.total_balance <= 0:
-        if cached := await _refund_cache_get(bearer_value):
-            return cached
+    if cached := await _refund_cache_get(bearer_value):
+        return cached
+
+    key: ApiKey = await validate_bearer_key(bearer_value, session)
 
     if key.parent_key_hash:
         raise HTTPException(
@@ -360,28 +178,6 @@ async def refund_wallet_endpoint(
             detail="Cannot refund child key. Please refund the parent key instead.",
         )
 
-    if key.reserved_balance > 0:
-        # Release only durable reservations old enough to be stale. A newer
-        # request on the same aggregate balance must remain reserved.
-        await release_stale_reservations(
-            session,
-            settings.stale_reservation_timeout_seconds,
-            key_hash=key.hashed_key,
-        )
-        await session.refresh(key)
-        if key.reserved_balance > 0:
-            raise HTTPException(
-                status_code=400,
-                detail="Cannot refund key. There are ongoing requests for this api key.",
-            )
-        logger.warning(
-            "refund_wallet_endpoint: released stale reservation before refund",
-            extra={
-                "hashed_key": key.hashed_key,
-                "stale_timeout_seconds": settings.stale_reservation_timeout_seconds,
-            },
-        )
-
     remaining_balance_msats: int = key.total_balance
 
     if key.refund_currency == "sat":
@@ -394,51 +190,22 @@ async def refund_wallet_endpoint(
     elif remaining_balance <= 0:
         raise HTTPException(status_code=400, detail="No balance to refund")
 
-    # Capture values before debit — the session may refresh key after commit
-    pre_debit_balance = key.balance
-    pre_debit_reserved = key.reserved_balance
-
-    # --- DEBIT FIRST: atomically zero the balance before minting tokens ---
-    # This prevents the race where a concurrent topup/spend happens between
-    # reading the balance and minting the refund token (double-spend).
-    debit_stmt = (
-        update(ApiKey)
-        .where(col(ApiKey.hashed_key) == key.hashed_key)
-        .where(col(ApiKey.balance) == pre_debit_balance)
-        .where(col(ApiKey.reserved_balance) == pre_debit_reserved)
-        .values(balance=0, reserved_balance=0, reserved_at=None)
-    )
-    debit_result = await session.exec(debit_stmt)  # type: ignore[call-overload]
-    await session.commit()
-
-    if debit_result.rowcount == 0:
-        # Balance changed between read and debit — another request is active
-        raise HTTPException(
-            status_code=409,
-            detail="Balance changed concurrently. Please retry the refund.",
-        )
-
-    # --- MINT: balance is locked at zero, safe to create the refund token ---
-    # Proofs from untrusted mints are swapped to primary_mint on receive.
-    # Use primary_mint unless key.refund_mint_url is an explicitly trusted mint.
-    effective_refund_mint = (
-        key.refund_mint_url
-        if key.refund_mint_url and key.refund_mint_url in settings.cashu_mints
-        else settings.primary_mint
-    )
+    # Perform refund operation first, before modifying balance
     try:
         if key.refund_address:
+            from .core.settings import settings as global_settings
+
             await send_to_lnurl(
                 remaining_balance,
                 key.refund_currency or "sat",
-                effective_refund_mint,
+                key.refund_mint_url or global_settings.primary_mint,
                 key.refund_address,
             )
             result = {"recipient": key.refund_address}
         else:
             refund_currency = key.refund_currency or "sat"
             token = await send_token(
-                remaining_balance, refund_currency, effective_refund_mint
+                remaining_balance, refund_currency, key.refund_mint_url
             )
             result = {"token": token}
 
@@ -447,105 +214,30 @@ async def refund_wallet_endpoint(
         else:
             result["msats"] = str(remaining_balance_msats)
 
-        if "token" in result:
-            logger.info(
-                "refund_wallet_endpoint: cashu token issued",
-                extra={
-                    "path": "/v1/wallet/refund",
-                    "token": result["token"],
-                    "amount": remaining_balance,
-                    "currency": key.refund_currency or "sat",
-                },
-            )
-
     except HTTPException:
-        # Minting failed — restore the debited balance
-        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved, key.refund_mint_url or "")
+        # Re-raise HTTP exceptions (like 400 for balance too small)
         raise
     except Exception as e:
-        # Minting failed — restore the debited balance
-        await _restore_balance(session, key.hashed_key, pre_debit_balance, pre_debit_reserved, key.refund_mint_url or "")
+        # If refund fails, don't modify the database
         error_msg = str(e)
-        logger.error(
-            "refund_wallet_endpoint: mint/send failed",
-            extra={
-                "error": error_msg,
-                "error_type": type(e).__name__,
-                "hashed_key": key.hashed_key,
-                "remaining_balance": remaining_balance,
-                "refund_currency": key.refund_currency,
-                "refund_mint_url": key.refund_mint_url,
-                "has_refund_address": bool(key.refund_address),
-            },
-        )
-        if is_mint_connection_error(e):
+        if (
+            "mint" in error_msg.lower()
+            or "connection" in error_msg.lower()
+            or isinstance(e, Exception)
+            and "ConnectError" in str(type(e))
+        ):
             raise HTTPException(status_code=503, detail="Mint service unavailable")
         else:
             raise HTTPException(status_code=500, detail="Refund failed")
 
     await _refund_cache_set(bearer_value, result)
 
-    if "token" in result:
-        try:
-            await store_cashu_transaction(
-                token=result["token"],
-                amount=remaining_balance,
-                unit=key.refund_currency or "sat",
-                mint_url=key.refund_mint_url,
-                typ="out",
-                collected=False,
-                source="apikey",
-                api_key_hashed_key=key.hashed_key,
-            )
-        except Exception:
-            pass  # store_cashu_transaction already logs
-
-    logger.info(
-        "refund_wallet_endpoint: refund successful",
-        extra={
-            "refunded_msats": remaining_balance_msats,
-            "previous_reserved_balance": key.reserved_balance,
-        },
-    )
+    await session.delete(key)
+    await session.commit()
 
     return result
 
 
-@router.get("/history")
-async def wallet_history(
-    key: ApiKey = Depends(get_key_from_header),
-    session: AsyncSession = Depends(get_session),
-) -> dict[str, list[dict[str, str | int | bool | None]]]:
-    if key.parent_key_hash:
-        raise HTTPException(
-            status_code=400,
-            detail="Cannot view child key history. Please use the parent key instead.",
-        )
-
-    result = await session.exec(
-        select(CashuTransaction)
-        .where(CashuTransaction.api_key_hashed_key == key.hashed_key)
-        .order_by(col(CashuTransaction.created_at).desc())
-    )
-    transactions = result.all()
-    return {
-        "transactions": [
-            {
-                "id": tx.id,
-                "type": tx.type,
-                "source": tx.source,
-                "amount": tx.amount,
-                "unit": tx.unit,
-                "mint_url": tx.mint_url,
-                "created_at": tx.created_at,
-                "collected": tx.collected,
-                "swept": tx.swept,
-            }
-            for tx in transactions
-        ]
-    }
-
-
 @router.post("/donate")
 async def donate(token: str, ref: str | None = None) -> str:
     try:
@@ -561,9 +253,6 @@ async def donate(token: str, ref: str | None = None) -> str:
 
 class ChildKeyRequest(BaseModel):
     count: int
-    balance_limit: int | None = None
-    balance_limit_reset: str | None = None
-    validity_date: int | None = None
 
 
 @router.post("/child-key")
@@ -596,24 +285,10 @@ async def create_child_key(
             detail=f"Insufficient balance to create {count} child keys. {total_cost} mSats required.",
         )
 
-    # Deduct cost from parent atomically — guards against concurrent requests
-    # that both pass the balance check above on stale in-memory state.
-    deduct_stmt = (
-        update(ApiKey)
-        .where(col(ApiKey.hashed_key) == key.hashed_key)
-        .where(col(ApiKey.balance) - col(ApiKey.reserved_balance) >= total_cost)
-        .values(
-            balance=col(ApiKey.balance) - total_cost,
-            total_spent=col(ApiKey.total_spent) + total_cost,
-        )
-    )
-    result = await session.exec(deduct_stmt)  # type: ignore[call-overload]
-
-    if result.rowcount == 0:
-        raise HTTPException(
-            status_code=402,
-            detail=f"Insufficient balance to create {count} child keys. {total_cost} mSats required.",
-        )
+    # Deduct cost from parent
+    key.balance -= total_cost
+    key.total_spent += total_cost
+    session.add(key)
 
     # Generate new keys
     import secrets
@@ -627,18 +302,11 @@ async def create_child_key(
             hashed_key=new_key_hash,
             balance=0,
             parent_key_hash=key.hashed_key,
-            balance_limit=payload.balance_limit,
-            balance_limit_reset=payload.balance_limit_reset,
-            balance_limit_reset_date=int(time.time())
-            if payload.balance_limit_reset
-            else None,
-            validity_date=payload.validity_date,
         )
         session.add(child_key)
         new_keys.append("sk-" + new_key_hash)
 
     await session.commit()
-    await session.refresh(key)
 
     response_data = {
         "api_keys": new_keys,
@@ -652,40 +320,6 @@ async def create_child_key(
     return response_data
 
 
-class ChildKeyResetRequest(BaseModel):
-    child_key: str
-
-
-@router.post("/child-key/reset")
-async def reset_child_key_spent(
-    payload: ChildKeyResetRequest,
-    key: ApiKey = Depends(get_key_from_header),
-    session: AsyncSession = Depends(get_session),
-) -> dict:
-    """Resets the total_spent of a child key. Must be called by the parent."""
-    child_key_raw = payload.child_key
-    if child_key_raw.startswith("sk-"):
-        child_key_raw = child_key_raw[3:]
-
-    child_key = await session.get(ApiKey, child_key_raw)
-    if not child_key:
-        raise HTTPException(status_code=404, detail="Child key not found.")
-
-    if child_key.parent_key_hash != key.hashed_key:
-        raise HTTPException(
-            status_code=403, detail="Unauthorized. You are not the parent of this key."
-        )
-
-    child_key.total_spent = 0
-    if child_key.balance_limit_reset:
-        child_key.balance_limit_reset_date = int(time.time())
-    session.add(child_key)
-    await session.commit()
-
-    return {"success": True, "message": "Child key balance reset successfully."}
-
-
-
 @router.api_route(
     "/{path:path}",
     methods=["GET", "POST", "PUT", "DELETE"],
@@ -698,7 +332,7 @@ async def wallet_catch_all(path: str) -> NoReturn:
     )
 
 
-balance_router.include_router(lightning_router, include_in_schema=False)
+balance_router.include_router(lightning_router)
 balance_router.include_router(router)
 
 deprecated_wallet_router = APIRouter(prefix="/v1/wallet", include_in_schema=False)

routstr/core/db.py

@@ -1,22 +1,13 @@
-import asyncio
-import hashlib
 import os
-import pathlib
-import sqlite3
 import time
-import uuid
 from contextlib import asynccontextmanager
-from enum import Enum
 from typing import AsyncGenerator
 
 from alembic import command
 from alembic.config import Config
-from alembic.util.exc import CommandError
-from sqlalchemy import Index, UniqueConstraint, case, delete, or_
-from sqlalchemy.exc import IntegrityError, OperationalError
+from sqlalchemy import UniqueConstraint
 from sqlalchemy.ext.asyncio.engine import create_async_engine
-from sqlalchemy.orm import aliased
-from sqlmodel import Field, Relationship, SQLModel, col, func, select, update
+from sqlmodel import Field, Relationship, SQLModel, func, select, update
 from sqlmodel.ext.asyncio.session import AsyncSession
 
 from .logging import get_logger
@@ -37,14 +28,6 @@ class ApiKey(SQLModel, table=True):  # type: ignore
     reserved_balance: int = Field(
         default=0, description="Reserved balance in millisatoshis (msats)"
     )
-    reserved_at: int | None = Field(
-        default=None,
-        description=(
-            "Unix timestamp of the most recent balance reservation. Used to "
-            "detect and release stale reservations (e.g. after client "
-            "disconnects). NULL when no reservation has been made yet."
-        ),
-    )
     refund_address: str | None = Field(
         default=None,
         description="Lightning address to refund remaining balance after key expires",
@@ -57,14 +40,6 @@ class ApiKey(SQLModel, table=True):  # type: ignore
         default=0, description="Total spent in millisatoshis (msats)"
     )
     total_requests: int = Field(default=0)
-    created_at: int | None = Field(
-        default_factory=lambda: int(time.time()),
-        nullable=True,
-        description=(
-            "Unix timestamp when the key was created. Nullable: keys created "
-            "before this column existed have no value and sort last."
-        ),
-    )
     refund_mint_url: str | None = Field(
         default=None,
         description="URL of the mint used to create the cashu-token",
@@ -76,22 +51,6 @@ class ApiKey(SQLModel, table=True):  # type: ignore
     parent_key_hash: str | None = Field(
         default=None, foreign_key="api_keys.hashed_key", index=True
     )
-    balance_limit: int | None = Field(
-        default=None,
-        description="Max spendable balance in msats for this key (mostly for child keys)",
-    )
-    balance_limit_reset: str | None = Field(
-        default=None,
-        description="Reset policy for balance limit (manual, daily, monthly, etc.)",
-    )
-    balance_limit_reset_date: int | None = Field(
-        default=None,
-        description="Unix timestamp of the last time the balance limit was reset",
-    )
-    validity_date: int | None = Field(
-        default=None,
-        description="Unix timestamp after which the key is no longer valid",
-    )
 
     @property
     def total_balance(self) -> int:
@@ -99,190 +58,11 @@ class ApiKey(SQLModel, table=True):  # type: ignore
 
 
 async def reset_all_reserved_balances(session: AsyncSession) -> None:
-    """Release every active durable reservation during explicit startup reset."""
-    await session.exec(  # type: ignore[call-overload]
-        update(ReservationRelease)
-        .where(col(ReservationRelease.status) == "active")
-        .values(status="released")
-    )
-    await session.exec(  # type: ignore[call-overload]
-        update(ApiKey).values(reserved_balance=0, reserved_at=None)
-    )
+    logger.info("Resetting all reserved balances to 0")
+    stmt = update(ApiKey).values(reserved_balance=0)
+    await session.exec(stmt)  # type: ignore[call-overload]
     await session.commit()
-    logger.info("Reset reserved balances on startup")
-
-
-async def release_stale_reservations(
-    session: AsyncSession,
-    max_age_seconds: int,
-    *,
-    key_hash: str | None = None,
-) -> int:
-    """Release stale durable reservations without touching newer reservations."""
-    cutoff = int(time.time()) - max_age_seconds
-    query = (
-        select(ReservationRelease)
-        .where(col(ReservationRelease.status) == "active")
-        .where(col(ReservationRelease.created_at) < cutoff)
-    )
-    if key_hash is not None:
-        query = query.where(
-            or_(
-                col(ReservationRelease.key_hash) == key_hash,
-                col(ReservationRelease.billing_key_hash) == key_hash,
-            )
-        )
-    reservations = (await session.exec(query)).all()
-    released = 0
-
-    for reservation in reservations:
-        transition = await session.exec(  # type: ignore[call-overload]
-            update(ReservationRelease)
-            .where(col(ReservationRelease.id) == reservation.id)
-            .where(col(ReservationRelease.status) == "active")
-            .values(status="released")
-        )
-        if transition.rowcount != 1:
-            continue
-
-        values = {
-            "reserved_balance": col(ApiKey.reserved_balance)
-            - reservation.reserved_msats,
-            "reserved_at": case(
-                (
-                    col(ApiKey.reserved_balance) - reservation.reserved_msats > 0,
-                    col(ApiKey.reserved_at),
-                ),
-                else_=None,
-            ),
-        }
-        parent_result = await session.exec(  # type: ignore[call-overload]
-            update(ApiKey)
-            .where(col(ApiKey.hashed_key) == reservation.billing_key_hash)
-            .where(col(ApiKey.reserved_balance) >= reservation.reserved_msats)
-            .values(**values)
-        )
-        if parent_result.rowcount != 1:
-            await session.rollback()
-            return 0
-
-        if reservation.billing_key_hash != reservation.key_hash:
-            child_result = await session.exec(  # type: ignore[call-overload]
-                update(ApiKey)
-                .where(col(ApiKey.hashed_key) == reservation.key_hash)
-                .where(col(ApiKey.reserved_balance) >= reservation.reserved_msats)
-                .values(**values)
-            )
-            if child_result.rowcount != 1:
-                await session.rollback()
-                return 0
-        released += 1
-
-    # Rolling upgrades can leave aggregate reservations created before durable
-    # reservation rows existed. Release only stale aggregates that have no active
-    # durable owner; targeted refund cleanup also heals legacy NULL timestamps.
-    legacy_query = select(ApiKey).where(col(ApiKey.reserved_balance) > 0)
-    if key_hash is None:
-        legacy_query = legacy_query.where(col(ApiKey.reserved_at).is_not(None)).where(
-            col(ApiKey.reserved_at) < cutoff
-        )
-    else:
-        legacy_query = legacy_query.where(
-            or_(
-                col(ApiKey.hashed_key) == key_hash,
-                col(ApiKey.parent_key_hash) == key_hash,
-            )
-        ).where(
-            or_(col(ApiKey.reserved_at).is_(None), col(ApiKey.reserved_at) < cutoff)
-        )
-
-    for legacy_key in (await session.exec(legacy_query)).all():
-        active_owner = (
-            await session.exec(
-                select(ReservationRelease.id)
-                .where(col(ReservationRelease.status) == "active")
-                .where(
-                    or_(
-                        col(ReservationRelease.key_hash) == legacy_key.hashed_key,
-                        col(ReservationRelease.billing_key_hash)
-                        == legacy_key.hashed_key,
-                    )
-                )
-                .limit(1)
-            )
-        ).first()
-        if active_owner is not None:
-            continue
-        legacy_key.reserved_balance = 0
-        legacy_key.reserved_at = None
-        session.add(legacy_key)
-        released += 1
-
-    await session.commit()
-    if released:
-        logger.warning(
-            "Released stale reservations",
-            extra={
-                "released_reservations": released,
-                "max_age_seconds": max_age_seconds,
-            },
-        )
-    return released
-
-
-async def prune_dead_api_keys(session: AsyncSession, min_age_seconds: int) -> int:
-    """Delete dead parentless API keys; return the count removed.
-
-    Dead = 0 balance/reservation/spend/requests, older than the grace period,
-    no parent, no children, no pending invoice. Cashu rows are unlinked (not
-    deleted) first to keep the audit trail.
-    """
-    cutoff = int(time.time()) - min_age_seconds
-
-    child = aliased(ApiKey)
-    has_children = (
-        select(child.hashed_key).where(
-            col(child.parent_key_hash) == col(ApiKey.hashed_key)
-        )
-    ).exists()
-    pending_invoice = (
-        select(LightningInvoice.id)
-        .where(col(LightningInvoice.api_key_hash) == col(ApiKey.hashed_key))
-        .where(col(LightningInvoice.status) == "pending")
-    ).exists()
-
-    eligible_hashes = (
-        select(ApiKey.hashed_key)
-        .where(col(ApiKey.balance) == 0)
-        .where(col(ApiKey.reserved_balance) == 0)
-        .where(col(ApiKey.total_spent) == 0)
-        .where(col(ApiKey.total_requests) == 0)
-        .where(col(ApiKey.parent_key_hash).is_(None))
-        .where((col(ApiKey.created_at).is_(None)) | (col(ApiKey.created_at) < cutoff))
-        .where(~pending_invoice)
-        .where(~has_children)
-    )
-
-    # Unlink transactions rather than cascade-deleting them, so the financial
-    # audit trail survives. The eligibility predicate is re-evaluated inside both
-    # statements so a key that gained balance mid-run is left untouched.
-    await session.exec(  # type: ignore[call-overload]
-        update(CashuTransaction)
-        .where(col(CashuTransaction.api_key_hashed_key).in_(eligible_hashes))
-        .values(api_key_hashed_key=None)
-    )
-
-    result = await session.exec(  # type: ignore[call-overload]
-        delete(ApiKey).where(col(ApiKey.hashed_key).in_(eligible_hashes))
-    )
-    await session.commit()
-
-    pruned = int(result.rowcount or 0)
-    logger.info(
-        "Pruned dead API keys",
-        extra={"pruned_keys": pruned, "min_age_seconds": min_age_seconds},
-    )
-    return pruned
+    logger.info("Reserved balances reset successfully")
 
 
 class ModelRow(SQLModel, table=True):  # type: ignore
@@ -305,67 +85,9 @@ class ModelRow(SQLModel, table=True):  # type: ignore
         default=None, description="JSON array of model alias IDs"
     )
     enabled: bool = Field(default=True, description="Whether this model is enabled")
-    forwarded_model_id: str | None = Field(
-        default=None,
-        description="Model ID to use when forwarding requests to upstream provider. Defaults to id if not set.",
-    )
     upstream_provider: "UpstreamProviderRow" = Relationship(back_populates="models")
 
 
-class ModelPathRow(SQLModel, table=True):  # type: ignore
-    """Upstream provider path a model is reachable through.
-
-    Discovery/visibility data only. ``model_id`` is intentionally NOT globally
-    unique: it is the client-visible ``/v1/models`` id (``forwarded_model_id or
-    id``) grouped across every provider that exposes the model. A single model
-    can therefore have several rows — one per direct provider path plus one per
-    OpenRouter sub-provider endpoint.
-    """
-
-    __tablename__ = "model_paths"
-    __table_args__ = (
-        UniqueConstraint(
-            "model_id",
-            "path",
-            "upstream_provider_id",
-            name="uq_model_paths_model_path_provider",
-        ),
-    )
-    id: int | None = Field(default=None, primary_key=True)
-    # No standalone index on model_id: the unique constraint's autoindex already
-    # leads on model_id, so a second index only adds write amplification.
-    model_id: str = Field(
-        description="Client-visible /v1/models id (forwarded_model_id or id)"
-    )
-    path: str = Field(
-        description=(
-            "Opaque selector containing upstream URL, provider ID, model ID, "
-            "and optional endpoint tag"
-        )
-    )
-    provider_slug: str = Field(
-        description="Public slug of the configured upstream provider"
-    )
-    provider_type: str = Field(description="Configured upstream provider type")
-    endpoint_tag: str | None = Field(
-        default=None,
-        description="Exact OpenRouter endpoint tag used for request-side selection",
-    )
-    endpoint_name: str | None = Field(
-        default=None, description="Human-readable endpoint display name"
-    )
-    upstream_provider_id: int = Field(
-        index=True,
-        foreign_key="upstream_providers.id",
-        ondelete="CASCADE",
-        description="upstream_providers.id this path was discovered from",
-    )
-    updated_at: int = Field(
-        default=0,
-        description="Unix timestamp of the refresh cycle that wrote this row",
-    )
-
-
 class LightningInvoice(SQLModel, table=True):  # type: ignore
     __tablename__ = "lightning_invoices"
 
@@ -386,186 +108,14 @@ class LightningInvoice(SQLModel, table=True):  # type: ignore
     )
     expires_at: int = Field(description="Unix timestamp when invoice expires")
     paid_at: int | None = Field(default=None, description="Unix timestamp when paid")
-    balance_limit: int | None = Field(
-        default=None,
-        description="Max spendable msats for the created key",
-    )
-    balance_limit_reset: str | None = Field(
-        default=None,
-        description="Reset policy for balance limit (daily, weekly, monthly)",
-    )
-    validity_date: int | None = Field(
-        default=None,
-        description="Unix timestamp after which the created key expires",
-    )
-
-
-class CashuTransaction(SQLModel, table=True):  # type: ignore
-    __tablename__ = "cashu_transactions"
-
-    id: str = Field(
-        primary_key=True,
-        default_factory=lambda: uuid.uuid4().hex,
-        description="Unique transaction identifier",
-    )
-    token: str = Field(description="Serialized Cashu token")
-    amount: int = Field(description="Amount in the token's unit")
-    unit: str = Field(description="Token unit (sat or msat)")
-    mint_url: str | None = Field(default=None, description="Mint URL for the token")
-    type: str = Field(default="out", description="Transaction type: in or out")
-    request_id: str | None = Field(default=None, description="Associated request ID")
-    created_at: int = Field(
-        default_factory=lambda: int(time.time()),
-        description="Unix timestamp",
-    )
-    collected: bool = Field(default=False)
-    swept: bool = Field(default=False)
-    source: str = Field(
-        default="x-cashu",
-        description="Payment source: x-cashu or apikey",
-    )
-    api_key_hashed_key: str | None = Field(
-        default=None,
-        foreign_key="api_keys.hashed_key",
-        index=True,
-        description="Associated API key hash for wallet history",
-    )
-
-
-async def store_cashu_transaction(
-    token: str,
-    amount: int,
-    unit: str,
-    mint_url: str | None = None,
-    typ: str = "out",
-    request_id: str | None = None,
-    collected: bool = False,
-    created_at: int | None = None,
-    source: str = "x-cashu",
-    api_key_hashed_key: str | None = None,
-    transaction_id: str | None = None,
-    log_failure: bool = True,
-) -> bool:
-    try:
-        async with create_session() as session:
-            tx = CashuTransaction(
-                id=transaction_id or uuid.uuid4().hex,
-                token=token,
-                amount=amount,
-                unit=unit,
-                mint_url=mint_url,
-                type=typ,
-                request_id=request_id,
-                collected=collected,
-                created_at=created_at or int(time.time()),
-                source=source,
-                api_key_hashed_key=api_key_hashed_key,
-            )
-            session.add(tx)
-            await session.commit()
-    except Exception:
-        if log_failure:
-            logger.critical(
-                "Failed to store Cashu transaction",
-                extra={"type": typ, "request_id": request_id, "source": source},
-                exc_info=True,
-            )
-        raise
-    return True
-
-
-async def _cashu_transaction_exists(transaction_id: str) -> bool:
-    async with create_session() as session:
-        return await session.get(CashuTransaction, transaction_id) is not None
-
-
-async def store_cashu_transaction_with_retry(
-    token: str,
-    amount: int,
-    unit: str,
-    mint_url: str | None = None,
-    typ: str = "out",
-    request_id: str | None = None,
-    collected: bool = False,
-    created_at: int | None = None,
-    source: str = "x-cashu",
-    api_key_hashed_key: str | None = None,
-    max_attempts: int = 3,
-) -> bool:
-    """Retry a critical Cashu transaction write with bounded backoff."""
-    transaction_id = hashlib.sha256(f"{typ}\0{token}".encode()).hexdigest()
-    last_error: Exception | None = None
-    for attempt in range(1, max_attempts + 1):
-        try:
-            return await store_cashu_transaction(
-                token=token,
-                amount=amount,
-                unit=unit,
-                mint_url=mint_url,
-                typ=typ,
-                request_id=request_id,
-                collected=collected,
-                created_at=created_at,
-                source=source,
-                api_key_hashed_key=api_key_hashed_key,
-                transaction_id=transaction_id,
-                log_failure=False,
-            )
-        except IntegrityError as error:
-            try:
-                if await _cashu_transaction_exists(transaction_id):
-                    return True
-            except Exception as lookup_error:
-                last_error = lookup_error
-            else:
-                last_error = error
-        except Exception as error:
-            last_error = error
-
-        if last_error is not None:
-            if attempt == max_attempts:
-                break
-            delay = 0.25 * (2 ** (attempt - 1))
-            logger.warning(
-                "Cashu transaction storage failed; retrying",
-                extra={
-                    "type": typ,
-                    "request_id": request_id,
-                    "attempt": attempt,
-                    "max_attempts": max_attempts,
-                    "retry_delay_seconds": delay,
-                },
-            )
-            await asyncio.sleep(delay)
-
-    logger.critical(
-        "Cashu transaction storage failed after bounded retries",
-        extra={
-            "type": typ,
-            "request_id": request_id,
-            "attempts": max_attempts,
-            "error": str(last_error),
-        },
-    )
-    if last_error is None:
-        raise RuntimeError("Cashu transaction storage failed without an exception")
-    raise last_error
 
 
 class UpstreamProviderRow(SQLModel, table=True):  # type: ignore
     __tablename__ = "upstream_providers"
     __table_args__ = (
-        UniqueConstraint(
-            "base_url", "api_key", name="uq_upstream_providers_base_url_api_key"
-        ),
+        UniqueConstraint("base_url", "api_key", name="uq_upstream_providers_base_url_api_key"),
     )
     id: int | None = Field(default=None, primary_key=True)
-    slug: str | None = Field(
-        default=None,
-        unique=True,
-        index=True,
-        description="Stable external slug used for updates via API key.",
-    )
     provider_type: str = Field(
         description="Provider type: custom, openai, anthropic, azure, openrouter, etc."
     )
@@ -578,196 +128,12 @@ class UpstreamProviderRow(SQLModel, table=True):  # type: ignore
     provider_fee: float = Field(
         default=1.01, description="Provider fee multiplier (default 1%)"
     )
-    provider_settings: str | None = Field(
-        default=None, description="JSON string for provider-specific settings"
-    )
     models: list["ModelRow"] = Relationship(
         back_populates="upstream_provider",
         sa_relationship_kwargs={"cascade": "all, delete-orphan"},
     )
 
 
-class ReservationRelease(SQLModel, table=True):  # type: ignore
-    __tablename__ = "reservation_releases"
-    __table_args__ = (
-        Index("ix_reservation_releases_status_created_at", "status", "created_at"),
-    )
-
-    id: str = Field(primary_key=True)
-    key_hash: str = Field(index=True)
-    billing_key_hash: str = Field(index=True)
-    reserved_msats: int
-    status: str = Field(default="active")
-    created_at: int = Field(default_factory=lambda: int(time.time()))
-
-
-class RoutstrFee(SQLModel, table=True):  # type: ignore
-    __tablename__ = "routstr_fees"
-    id: int = Field(default=1, primary_key=True)
-    accumulated_msats: int = Field(default=0)
-    total_paid_msats: int = Field(default=0)
-    last_paid_at: int | None = Field(default=None)
-    payout_in_progress_msats: int = Field(default=0)
-    payout_started_at: int | None = Field(default=None)
-
-
-class NsecState(str, Enum):
-    """Ownership state of the node's nsec — an explicit 3-state machine.
-
-    The single ``encrypted_nsec`` column cannot distinguish "never migrated" from
-    "intentionally cleared" (both leave it empty), which let a cleared identity be
-    resurrected from a stale legacy ``NSEC``. This names the three states so the
-    bootstrap branches on ownership rather than inferring it:
-
-    * ``legacy`` — the vault has not taken ownership; a plaintext ``NSEC`` (env or
-      old settings blob) may still exist and should be migrated in once.
-    * ``encrypted`` — the vault owns a ciphertext; decrypt it, never re-read env.
-    * ``cleared`` — the vault owns it but the operator emptied it; stay empty,
-      never re-import from a stale legacy copy.
-    """
-
-    legacy = "legacy"
-    encrypted = "encrypted"
-    cleared = "cleared"
-
-
-class Secret(SQLModel, table=True):  # type: ignore
-    """Node-level secrets, stored encrypted/hashed at rest (singleton, id=1).
-
-    The asymmetric column names document the encoding: ``_hash`` is one-way
-    (scrypt, verify only) while ``encrypted_`` is reversible (Fernet). Per-provider
-    upstream keys live on ``upstream_providers``, not here. See ``routstr.core.vault``.
-    """
-
-    __tablename__ = "secrets"
-    id: int = Field(default=1, primary_key=True)
-    admin_password_hash: str | None = Field(default=None)
-    encrypted_nsec: str | None = Field(default=None)
-    nsec_state: NsecState = Field(default=NsecState.legacy)
-    updated_at: int | None = Field(default=None)
-
-
-class CliToken(SQLModel, table=True):  # type: ignore
-    """Long-lived authorization token for CLI/agent use against admin endpoints."""
-
-    __tablename__ = "cli_tokens"
-    id: str = Field(primary_key=True, default_factory=lambda: uuid.uuid4().hex)
-    token: str = Field(unique=True, index=True, description="Bearer token value")
-    name: str = Field(description="Human-readable label for this token")
-    created_at: int = Field(default_factory=lambda: int(time.time()))
-    last_used_at: int | None = Field(default=None)
-    expires_at: int | None = Field(
-        default=None, description="Optional expiry unix timestamp; null = never expires"
-    )
-
-
-async def accumulate_routstr_fee(session: AsyncSession, amount_msats: int) -> None:
-    stmt = (
-        update(RoutstrFee)
-        .where(col(RoutstrFee.id) == 1)
-        .values(accumulated_msats=RoutstrFee.accumulated_msats + amount_msats)
-    )
-    result = await session.exec(stmt)  # type: ignore[call-overload]
-    if result.rowcount == 0:
-        session.add(RoutstrFee(id=1, accumulated_msats=amount_msats))
-    await session.commit()
-
-
-async def get_routstr_fee(session: AsyncSession) -> RoutstrFee:
-    fee = await session.get(RoutstrFee, 1)
-    if fee is None:
-        fee = RoutstrFee(id=1, accumulated_msats=0, total_paid_msats=0)
-        session.add(fee)
-        await session.commit()
-        await session.refresh(fee)
-    return fee
-
-
-async def get_secret(session: AsyncSession) -> Secret:
-    secret = await session.get(Secret, 1)
-    if secret is None:
-        secret = Secret(id=1)
-        session.add(secret)
-        try:
-            await session.commit()
-        except IntegrityError:
-            # Another worker created the singleton row between our read and
-            # insert (multiple workers booting against one shared DB). Roll back
-            # and read the row they committed instead of failing startup.
-            await session.rollback()
-            secret = await session.get(Secret, 1)
-            if secret is None:
-                raise
-            return secret
-        await session.refresh(secret)
-    return secret
-
-
-async def set_admin_password(session: AsyncSession, password: str) -> None:
-    """Store the admin password as a one-way hash on the Secret singleton."""
-    from .vault import hash_password
-
-    secret = await get_secret(session)
-    secret.admin_password_hash = hash_password(password)
-    secret.updated_at = int(time.time())
-    session.add(secret)
-    await session.commit()
-
-
-async def set_nsec(session: AsyncSession, nsec: str) -> None:
-    """Store the node's nsec, Fernet-encrypted, on the Secret singleton.
-
-    An empty string clears it (the node then holds no Nostr identity and signs
-    no events). Either way the vault now owns the nsec, so the state moves off
-    ``legacy``: a cleared identity (``cleared``) must not be resurrected from a
-    stale legacy ``NSEC`` on the next boot.
-    """
-    from .vault import encrypt
-
-    secret = await get_secret(session)
-    secret.encrypted_nsec = encrypt(nsec) if nsec else None
-    secret.nsec_state = NsecState.encrypted if nsec else NsecState.cleared
-    secret.updated_at = int(time.time())
-    session.add(secret)
-    await session.commit()
-
-
-async def reset_routstr_fee(session: AsyncSession, paid_msats: int) -> bool:
-    """Checkpoint a fee payout before making the external payment."""
-    stmt = (
-        update(RoutstrFee)
-        .where(col(RoutstrFee.id) == 1)
-        .where(col(RoutstrFee.payout_in_progress_msats) == 0)
-        .where(col(RoutstrFee.accumulated_msats) >= paid_msats)
-        .values(
-            accumulated_msats=RoutstrFee.accumulated_msats - paid_msats,
-            payout_in_progress_msats=paid_msats,
-            payout_started_at=int(time.time()),
-        )
-    )
-    result = await session.exec(stmt)  # type: ignore[call-overload]
-    await session.commit()
-    return result.rowcount == 1
-
-
-async def complete_routstr_fee_payout(session: AsyncSession, paid_msats: int) -> bool:
-    """Mark a checkpointed payout complete after the external payment succeeds."""
-    stmt = (
-        update(RoutstrFee)
-        .where(col(RoutstrFee.id) == 1)
-        .where(col(RoutstrFee.payout_in_progress_msats) == paid_msats)
-        .values(
-            payout_in_progress_msats=0,
-            payout_started_at=None,
-            total_paid_msats=RoutstrFee.total_paid_msats + paid_msats,
-            last_paid_at=int(time.time()),
-        )
-    )
-    result = await session.exec(stmt)  # type: ignore[call-overload]
-    await session.commit()
-    return result.rowcount == 1
-
-
 async def balances_for_mint_and_unit(
     db_session: AsyncSession, mint_url: str, unit: str
 ) -> int:
@@ -797,64 +163,11 @@ async def create_session() -> AsyncGenerator[AsyncSession, None]:
         yield session
 
 
-def fix_cashu_migrations() -> None:
-    """
-    Fixes Cashu wallet migrations that are not idempotent.
-    This specifically addresses the 'duplicate column name: public_keys' error
-    in the keysets table of Cashu's internal SQLite databases.
-    """
-    project_root = pathlib.Path(__file__).resolve().parents[2]
-    wallet_dir = project_root / ".wallet"
-
-    if not wallet_dir.exists() or not wallet_dir.is_dir():
-        return
-
-    logger.info("Checking Cashu wallet databases for migration idempotency")
-
-    for db_file in wallet_dir.glob("*.sqlite3"):
-        try:
-            conn = sqlite3.connect(db_file)
-            cursor = conn.cursor()
-
-            # Check if keysets table exists
-            cursor.execute(
-                "SELECT name FROM sqlite_master WHERE type='table' AND name='keysets'"
-            )
-            if not cursor.fetchone():
-                conn.close()
-                continue
-
-            # Check if public_keys column exists
-            cursor.execute("PRAGMA table_info(keysets)")
-            columns = [info[1] for info in cursor.fetchall()]
-
-            if "public_keys" not in columns:
-                logger.info(f"Adding missing public_keys column to {db_file.name}")
-                cursor.execute("ALTER TABLE keysets ADD COLUMN public_keys TEXT")
-                conn.commit()
-
-            conn.close()
-        except Exception as e:
-            logger.warning(f"Could not check/fix Cashu database {db_file}: {e}")
-
-
-def _clear_alembic_version() -> None:
-    """Clear the alembic_version table so stamp/upgrade can proceed."""
-    sync_url = DATABASE_URL.replace("+aiosqlite", "")
-    from sqlalchemy import create_engine, text
-
-    eng = create_engine(sync_url)
-    with eng.begin() as conn:
-        conn.execute(text("DELETE FROM alembic_version"))
-    eng.dispose()
-
-
 def run_migrations() -> None:
     """Run Alembic migrations programmatically."""
-    try:
-        # Run Cashu migration fix first
-        fix_cashu_migrations()
+    import pathlib
 
+    try:
         # Get the path to the alembic.ini file
         project_root = pathlib.Path(__file__).resolve().parents[2]
         alembic_ini_path = project_root / "alembic.ini"
@@ -870,30 +183,8 @@ def run_migrations() -> None:
         # Set the database URL in the config
         alembic_cfg.set_main_option("sqlalchemy.url", DATABASE_URL)
 
-        try:
-            command.upgrade(alembic_cfg, "head")
-        except CommandError as e:
-            if "Can't locate revision" in str(e):
-                logger.warning(
-                    "Database stamped with unknown revision (likely from another branch). "
-                    "Re-stamping to current head.",
-                    extra={"error": str(e)},
-                )
-                _clear_alembic_version()
-                command.stamp(alembic_cfg, "head")
-            else:
-                raise
-        except OperationalError as e:
-            if "duplicate column name" in str(e).lower():
-                logger.warning(
-                    "Migration hit a column that already exists (likely added via "
-                    "create_all on another branch). Stamping to current head.",
-                    extra={"error": str(e)},
-                )
-                _clear_alembic_version()
-                command.stamp(alembic_cfg, "head")
-            else:
-                raise
+        # Run migrations to the latest revision
+        command.upgrade(alembic_cfg, "head")
 
         logger.info("Database migrations completed successfully")
 

routstr/core/exceptions.py

@@ -7,26 +7,11 @@ logger = get_logger(__name__)
 
 
 class UpstreamError(Exception):
-    """Exception raised when an upstream provider fails.
+    """Exception raised when an upstream provider fails."""
 
-    ``code`` carries a stable, machine-readable classification (e.g.
-    ``UPSTREAM_RATE_LIMIT``) so callers can distinguish failure kinds without
-    string-matching the message. ``details`` holds optional structured,
-    redaction-safe context. Both default to ``None`` for backwards
-    compatibility.
-    """
-
-    def __init__(
-        self,
-        message: str,
-        status_code: int = 502,
-        code: str | None = None,
-        details: dict[str, object] | None = None,
-    ):
+    def __init__(self, message: str, status_code: int = 502):
         self.message = message
         self.status_code = status_code
-        self.code = code
-        self.details = details
         super().__init__(message)
 
 
@@ -37,20 +22,16 @@ async def http_exception_handler(request: Request, exc: Exception) -> JSONRespon
     # Get status code and detail - works for both FastAPI and Starlette HTTPException
     status_code = getattr(exc, "status_code", 500)
     detail = getattr(exc, "detail", str(exc))
-    path = request.url.path
 
-    # 4xx is client behaviour; the uvicorn access log already records it.
-    # Only 5xx warrants a server-side warning/error log here.
-    if status_code >= 500:
-        logger.error(
-            f"HTTP {status_code} on {path}: {detail}",
-            extra={
-                "request_id": request_id,
-                "status_code": status_code,
-                "detail": detail,
-                "path": path,
-            },
-        )
+    logger.warning(
+        "HTTP exception",
+        extra={
+            "request_id": request_id,
+            "status_code": status_code,
+            "detail": detail,
+            "path": request.url.path,
+        },
+    )
 
     return JSONResponse(
         status_code=status_code,

routstr/core/logging.py

@@ -3,63 +3,50 @@ Logging configuration for Routstr.
 
 CRITICAL LOG MESSAGES FOR USAGE STATISTICS:
 ===========================================
-The following log messages are parsed by the usage tracking system
-(routstr/core/usage_analytics_store.py and routstr/core/log_manager.py).
+The following log messages are parsed by the usage tracking system (routstr/core/admin.py).
 DO NOT modify or remove these messages without updating the usage tracking logic:
 
 1. "Received proxy request" (INFO) - routstr/proxy.py
    - Used to count total incoming requests
    - Includes model information in context
 
-2. "Calculated token-based cost" (INFO) - routstr/auth.py
+    2. "Payment adjustment completed for streaming" (INFO) - routstr/upstream/base.py
+       "Payment adjustment completed for non-streaming" (INFO) - routstr/upstream/base.py
    - Used to track successful completions and revenue
-   - The 'token_cost', 'model', 'input_tokens', and 'output_tokens' fields are extracted for dashboard metrics
+   - The 'cost_data.total_msats' field is extracted for revenue calculation
+   - Must include 'cost_data' in extra dict
 
-3. "Max cost payment finalized" (INFO) - routstr/auth.py
-   - Used as the successful completion fallback when token usage is unavailable
-   - The 'charged_amount', 'model', 'input_tokens', and 'output_tokens' fields are extracted for dashboard metrics
-
-4. "Payment processed successfully" (INFO) - routstr/auth.py
+3. "Payment processed successfully" (INFO) - routstr/auth.py
    - Used to count successful payment processing events
    - Tracks payment-related metrics
 
-5. "Upstream request failed, revert payment" (WARNING) - routstr/proxy.py
+4. "Upstream request failed, revert payment" (WARNING) - routstr/proxy.py
    - Used to track failed requests and refunds
    - The 'max_cost_for_model' field is extracted for refund calculation
    - Must include 'max_cost_for_model' in extra dict
 
-6. Any ERROR level logs with "upstream" in the message
+5. Any ERROR level logs with "upstream" in the message
    - Used to count upstream provider errors
    - Helps identify service reliability issues
 
 If you need to modify these messages, ensure you also update the parsing logic in:
-- routstr/core/usage_analytics_store.py
-- routstr/core/log_manager.py
+- routstr/core/admin.py:_aggregate_metrics_by_time()
+- routstr/core/admin.py:_get_summary_stats()
+- routstr/core/admin.py:get_revenue_by_model()
 """
 
 import logging.config
 import logging.handlers
 import os
 import re
-import sys
 import tomllib
 from datetime import datetime
 from pathlib import Path
 from typing import Any
 
 from pythonjsonlogger import jsonlogger
-from rich.console import Console
 from rich.logging import RichHandler
 
-from .redaction import redact_obj, redact_org_ids
-
-# Only use RichHandler when stdout is a real TTY. In non-TTY contexts
-# (docker logs, pipes, CI) Rich pads every line to width and wraps long
-# records, producing visually-empty trailing whitespace and split records.
-# A plain StreamHandler avoids both problems.
-_stdout_is_tty = sys.stdout.isatty()
-_console = Console(soft_wrap=True) if _stdout_is_tty else None
-
 # Define custom TRACE level
 TRACE_LEVEL = 5
 logging.addLevelName(TRACE_LEVEL, "TRACE")
@@ -182,37 +169,6 @@ class RequestIdFilter(logging.Filter):
         return True
 
 
-# Standard ``LogRecord`` attributes that are never user-supplied ``extra``
-# fields; skipped when redacting structured extras (``msg``/``message`` are
-# handled separately above).
-_NON_EXTRA_RECORD_ATTRS = frozenset(
-    {
-        "name",
-        "msg",
-        "args",
-        "levelname",
-        "levelno",
-        "pathname",
-        "filename",
-        "module",
-        "exc_info",
-        "exc_text",
-        "stack_info",
-        "lineno",
-        "funcName",
-        "created",
-        "msecs",
-        "relativeCreated",
-        "thread",
-        "threadName",
-        "processName",
-        "process",
-        "taskName",
-        "message",
-    }
-)
-
-
 class SecurityFilter(logging.Filter):
     """Filter to remove sensitive information from logs."""
 
@@ -236,7 +192,6 @@ class SecurityFilter(logging.Filter):
         """Filter out sensitive information from log records."""
         try:
             message = record.getMessage()
-            message = redact_org_ids(message)
             standalone_patterns = [
                 r"Bearer\s+([a-zA-Z0-9_\-\.]{10,})",  # Bearer token (must be 10 characters or more to reduce false-positives)
                 r"cashu[A-Z]+([a-zA-Z0-9_\-\.=/+]+)",  # Cashu tokens
@@ -258,16 +213,6 @@ class SecurityFilter(logging.Filter):
             record.msg = message
             record.args = ()
 
-            # Structured `extra={...}` fields are emitted by the JSON formatter
-            # straight from the record dict and never pass through the message
-            # formatting above. Redact organization IDs from any string-valued
-            # extra so they cannot leak via structured logs.
-            for attr, value in list(record.__dict__.items()):
-                if attr in _NON_EXTRA_RECORD_ATTRS:
-                    continue
-                if isinstance(value, (str, dict, list, tuple)):
-                    record.__dict__[attr] = redact_obj(value)
-
         except Exception:
             pass
 
@@ -314,26 +259,6 @@ def setup_logging() -> None:
     if console_enabled:
         handlers.append("console")
 
-    if _stdout_is_tty:
-        console_handler: dict[str, Any] = {
-            "()": RichHandler,
-            "level": log_level,
-            "show_time": False,
-            "show_path": False,
-            "rich_tracebacks": True,
-            "markup": True,
-            "console": _console,
-            "filters": ["request_id_filter", "security_filter"],
-        }
-    else:
-        console_handler = {
-            "class": "logging.StreamHandler",
-            "level": log_level,
-            "formatter": "plain",
-            "stream": "ext://sys.stdout",
-            "filters": ["request_id_filter", "security_filter"],
-        }
-
     LOGGING_CONFIG = {
         "version": 1,
         "disable_existing_loggers": False,
@@ -343,10 +268,6 @@ def setup_logging() -> None:
                 "format": "%(asctime)s %(name)s %(levelname)s %(message)s %(pathname)s %(lineno)d %(version)s %(request_id)s",
                 "datefmt": "%Y-%m-%d %H:%M:%S",
             },
-            "plain": {
-                "format": "%(asctime)s %(levelname)-7s %(name)s %(message)s",
-                "datefmt": "%Y-%m-%d %H:%M:%S",
-            },
         },
         "filters": {
             "version_filter": {"()": VersionFilter},
@@ -354,7 +275,15 @@ def setup_logging() -> None:
             "security_filter": {"()": SecurityFilter},
         },
         "handlers": {
-            "console": console_handler,
+            "console": {
+                "()": RichHandler,
+                "level": log_level,
+                "show_time": False,
+                "show_path": False,
+                "rich_tracebacks": True,
+                "markup": True,
+                "filters": ["request_id_filter", "security_filter"],
+            },
             "file": {
                 "()": DailyRotatingFileHandler,
                 "level": log_level,

routstr/core/main.py

@@ -1,262 +1,30 @@
-import asyncio
-from contextlib import asynccontextmanager
-from pathlib import Path
-from typing import AsyncGenerator
+import os
 
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import FileResponse, RedirectResponse
-from fastapi.staticfiles import StaticFiles
+from fastapi.responses import RedirectResponse
 from starlette.exceptions import HTTPException
-from starlette.responses import Response as StarletteResponse
-from starlette.types import Scope
 
-from ..auth import (
-    periodic_dead_key_prune,
-    periodic_key_reset,
-    periodic_stale_reservation_sweep,
-)
 from ..balance import balance_router, deprecated_wallet_router
-from ..lightning import lightning_router, periodic_invoice_watcher
-from ..nostr import (
-    announce_provider,
-    providers_cache_refresher,
-    publish_usage_analytics,
-)
-from ..nostr.discovery import providers_router
-from ..payment.models import models_router, update_sats_pricing
-from ..payment.price import update_prices_periodically
-from ..proxy import initialize_upstreams, proxy_router, refresh_model_maps_periodically
-from ..upstream.auto_topup import periodic_auto_topup
-from ..upstream.deepseek_v4_pricing_shim import register_deepseek_v4_pricing
-from ..upstream.litellm_routing import configure_litellm
-from ..wallet import periodic_payout, periodic_refund_sweep, periodic_routstr_fee_payout
+from ..discovery import providers_router
+from ..payment.models import models_router
+from ..proxy import proxy_router
 from .admin import admin_router
-from .db import create_session, init_db, run_migrations
 from .exceptions import general_exception_handler, http_exception_handler
 from .logging import get_logger, setup_logging
 from .middleware import LoggingMiddleware
-from .not_found import _NOT_FOUND_HTML, not_found_catch_all  # noqa: F401
-from .settings import SettingsService, bootstrap_secrets
 from .settings import settings as global_settings
-from .version import __version__
+from .tasks import lifespan
+from .ui import setup_ui
 
 # Initialize logging first
 setup_logging()
 logger = get_logger(__name__)
 
-
-@asynccontextmanager
-async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]:
-    logger.info("Application startup initiated", extra={"version": __version__})
-
-    btc_price_task = None
-    pricing_task = None
-    payout_task = None
-    nip91_task = None
-    analytics_task = None
-    providers_task = None
-    models_refresh_task = None
-    model_maps_refresh_task = None
-    model_paths_refresh_task = None
-    key_reset_task = None
-    stale_reservation_task = None
-    dead_key_prune_task = None
-    auto_topup_task = None
-    refund_sweep_task = None
-    routstr_fee_task = None
-    invoice_watcher_task = None
-
-    try:
-        # Apply litellm-wide settings (drop_params, chat-completions URL,
-        # debug logging) before any upstream provider dispatches a request.
-        configure_litellm()
-
-        # TEMPORARY: backfill DeepSeek V4 pricing missing from litellm's cost
-        # map (BerriAI/litellm#30430). Remove this call and
-        # deepseek_v4_pricing_shim.py once litellm ships these models.
-        register_deepseek_v4_pricing()
-
-        # Run database migrations on startup
-        run_migrations()
-
-        # Initialize database connection pools
-        # This creates any tables that might not be tracked by migrations yet
-        await init_db()
-
-        # Initialize application settings (env -> computed -> DB precedence)
-        async with create_session() as session:
-            # Move secrets into the encrypted/hashed store and decrypt the nsec
-            # into the in-memory settings BEFORE initializing settings: the
-            # initialize step strips secrets from the persisted blob, so legacy
-            # plaintext (env or old blob) must be migrated into the Secret store
-            # first or the only copy of a blob-only secret would be lost.
-            # Generates and logs an admin password on a fresh node; fails fast if
-            # a stored secret can't be decrypted.
-            await bootstrap_secrets(session)
-            s = await SettingsService.initialize(session)
-            if s.reset_reserved_balance_on_startup:
-                from .db import reset_all_reserved_balances
-
-                await reset_all_reserved_balances(session)
-
-        # Apply app metadata from settings
-        try:
-            app.title = s.name
-            app.description = s.description
-        except Exception:
-            pass
-
-        # await ensure_models_bootstrapped()
-
-        from ..payment.price import _update_prices
-        from ..proxy import get_upstreams
-        from ..upstream.helpers import refresh_upstreams_models_periodically
-
-        _update_prices_task = asyncio.create_task(_update_prices())
-        _initialize_upstreams_task = asyncio.create_task(initialize_upstreams())
-
-        # ensure both setup tasks complete
-        await asyncio.gather(
-            _update_prices_task, _initialize_upstreams_task, return_exceptions=True
-        )
-
-        btc_price_task = asyncio.create_task(update_prices_periodically())
-        pricing_task = asyncio.create_task(update_sats_pricing())
-        if global_settings.models_refresh_interval_seconds > 0:
-            # Pass the accessor (not its current value) so the loop sees providers
-            # added/changed via reinitialize_upstreams() instead of staying pinned
-            # to the startup snapshot.
-            models_refresh_task = asyncio.create_task(
-                refresh_upstreams_models_periodically(get_upstreams)
-            )
-        model_maps_refresh_task = asyncio.create_task(refresh_model_maps_periodically())
-        # Always started: the loop re-reads the enable flag and interval every
-        # iteration, so 0 -> N (or re-enabling) takes effect without a restart.
-        from ..upstream.model_paths import refresh_model_paths_periodically
-
-        model_paths_refresh_task = asyncio.create_task(
-            refresh_model_paths_periodically(get_upstreams)
-        )
-        payout_task = asyncio.create_task(periodic_payout())
-        if global_settings.nsec:
-            nip91_task = asyncio.create_task(announce_provider())
-        analytics_task = asyncio.create_task(publish_usage_analytics())
-        if global_settings.providers_refresh_interval_seconds > 0:
-            providers_task = asyncio.create_task(providers_cache_refresher())
-        key_reset_task = asyncio.create_task(periodic_key_reset())
-        stale_reservation_task = asyncio.create_task(periodic_stale_reservation_sweep())
-        dead_key_prune_task = asyncio.create_task(periodic_dead_key_prune())
-        auto_topup_task = asyncio.create_task(periodic_auto_topup())
-        refund_sweep_task = asyncio.create_task(periodic_refund_sweep())
-        routstr_fee_task = asyncio.create_task(periodic_routstr_fee_payout())
-        invoice_watcher_task = asyncio.create_task(periodic_invoice_watcher())
-
-        yield
-
-    except asyncio.CancelledError:
-        # Expected during shutdown
-        pass
-    except Exception as e:
-        logger.error(
-            "Application startup failed",
-            extra={"error": str(e), "error_type": type(e).__name__},
-        )
-        raise
-    finally:
-        logger.info("Application shutdown initiated")
-
-        if btc_price_task is not None:
-            btc_price_task.cancel()
-        if pricing_task is not None:
-            pricing_task.cancel()
-        if payout_task is not None:
-            payout_task.cancel()
-        if nip91_task is not None:
-            nip91_task.cancel()
-        if analytics_task is not None:
-            analytics_task.cancel()
-        if providers_task is not None:
-            providers_task.cancel()
-        if models_refresh_task is not None:
-            models_refresh_task.cancel()
-        if model_maps_refresh_task is not None:
-            model_maps_refresh_task.cancel()
-        if model_paths_refresh_task is not None:
-            model_paths_refresh_task.cancel()
-        if key_reset_task is not None:
-            key_reset_task.cancel()
-        if stale_reservation_task is not None:
-            stale_reservation_task.cancel()
-        if dead_key_prune_task is not None:
-            dead_key_prune_task.cancel()
-        if auto_topup_task is not None:
-            auto_topup_task.cancel()
-        if refund_sweep_task is not None:
-            refund_sweep_task.cancel()
-        if routstr_fee_task is not None:
-            routstr_fee_task.cancel()
-        if invoice_watcher_task is not None:
-            invoice_watcher_task.cancel()
-
-        try:
-            tasks_to_wait = []
-            if btc_price_task is not None:
-                tasks_to_wait.append(btc_price_task)
-            if pricing_task is not None:
-                tasks_to_wait.append(pricing_task)
-            if payout_task is not None:
-                tasks_to_wait.append(payout_task)
-            if nip91_task is not None:
-                tasks_to_wait.append(nip91_task)
-            if analytics_task is not None:
-                tasks_to_wait.append(analytics_task)
-            if providers_task is not None:
-                tasks_to_wait.append(providers_task)
-            if models_refresh_task is not None:
-                tasks_to_wait.append(models_refresh_task)
-            if model_maps_refresh_task is not None:
-                tasks_to_wait.append(model_maps_refresh_task)
-            if model_paths_refresh_task is not None:
-                tasks_to_wait.append(model_paths_refresh_task)
-            if key_reset_task is not None:
-                tasks_to_wait.append(key_reset_task)
-            if stale_reservation_task is not None:
-                tasks_to_wait.append(stale_reservation_task)
-            if dead_key_prune_task is not None:
-                tasks_to_wait.append(dead_key_prune_task)
-            if auto_topup_task is not None:
-                tasks_to_wait.append(auto_topup_task)
-            if refund_sweep_task is not None:
-                tasks_to_wait.append(refund_sweep_task)
-            if routstr_fee_task is not None:
-                tasks_to_wait.append(routstr_fee_task)
-            if invoice_watcher_task is not None:
-                tasks_to_wait.append(invoice_watcher_task)
-
-            if tasks_to_wait:
-                await asyncio.gather(*tasks_to_wait, return_exceptions=True)
-            logger.info("Background tasks stopped successfully")
-        except Exception as e:
-            logger.error(
-                "Error stopping background tasks",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-
-
-class _ImmutableStaticFiles(StaticFiles):
-    """Static files with long Cache-Control for content-hashed Next.js assets.
-
-    Files under `/_next/static/` are emitted with content hashes in their
-    filenames and never mutate, so we serve them with a one-year immutable
-    cache header so browsers and CDNs stop revalidating on every reload.
-    """
-
-    async def get_response(self, path: str, scope: Scope) -> StarletteResponse:
-        response = await super().get_response(path, scope)
-        if response.status_code == 200:
-            response.headers["Cache-Control"] = "public, max-age=31536000, immutable"
-        return response
+if os.getenv("VERSION_SUFFIX") is not None:
+    __version__ = f"0.3.0-{os.getenv('VERSION_SUFFIX')}"
+else:
+    __version__ = "0.3.0"
 
 
 app = FastAPI(version=__version__, lifespan=lifespan)
@@ -268,20 +36,7 @@ app.add_middleware(
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
-    expose_headers=[
-        "x-routstr-request-id",
-        "x-cashu",
-        "x-routstr-cost-msats",
-        "x-routstr-cost-usd",
-        "x-routstr-input-cost-msats",
-        "x-routstr-output-cost-msats",
-        # EHBP (Tinfoil) protocol headers must be exposed so browser clients
-        # can detect and decrypt encrypted responses. Without these, the
-        # browser hides them via CORS and the SDK treats the response as a
-        # plaintext proxy error, returning raw ciphertext.
-        "Ehbp-Response-Nonce",
-        "Ehbp-Encapsulated-Key",
-    ],
+    expose_headers=["x-routstr-request-id"],
 )
 
 # Add logging middleware
@@ -311,117 +66,13 @@ async def providers() -> RedirectResponse:
     return RedirectResponse("/v1/providers/")
 
 
-UI_DIST_PATH = Path(__file__).parent.parent.parent / "ui_out"
-
-if UI_DIST_PATH.exists() and UI_DIST_PATH.is_dir():
-    logger.info(f"Serving static UI from {UI_DIST_PATH}")
-
-    app.mount(
-        "/_next",
-        _ImmutableStaticFiles(directory=UI_DIST_PATH / "_next", check_dir=True),
-        name="next-static",
-    )
-
-    @app.get("/", include_in_schema=False)
-    async def serve_root_ui() -> FileResponse:
-        return FileResponse(UI_DIST_PATH / "index.html")
-
-    # Serve the App Router RSC payload for the home page.
-    @app.get("/index.txt", include_in_schema=False)
-    async def serve_root_rsc() -> FileResponse:
-        return FileResponse(UI_DIST_PATH / "index.txt", media_type="text/x-component")
-
-    # Next.js is built with `trailingSlash: true`, so all UI page URLs end
-    # with a slash (e.g. `/login/`). The proxy router catches `/{path:path}`
-    # before FastAPI's `redirect_slashes` logic can normalize the URL, so we
-    # must register both the with-slash and without-slash variants here.
-    UI_PAGES = (
-        "dashboard",
-        "login",
-        "model",
-        "providers",
-        "settings",
-        "transactions",
-        "balances",
-        "logs",
-        "usage",
-        "unauthorized",
-    )
-
-    def _register_ui_page(name: str) -> None:
-        page_dir = UI_DIST_PATH / name
-        index_html = page_dir / "index.html"
-        index_txt = page_dir / "index.txt"
-
-        async def serve_page() -> FileResponse:
-            return FileResponse(index_html)
-
-        async def serve_page_rsc() -> FileResponse:
-            return FileResponse(index_txt, media_type="text/x-component")
-
-        app.add_api_route(
-            f"/{name}",
-            serve_page,
-            methods=["GET"],
-            include_in_schema=False,
-            name=f"serve_{name}_ui",
-        )
-        app.add_api_route(
-            f"/{name}/",
-            serve_page,
-            methods=["GET"],
-            include_in_schema=False,
-            name=f"serve_{name}_ui_slash",
-        )
-        app.add_api_route(
-            f"/{name}/index.txt",
-            serve_page_rsc,
-            methods=["GET"],
-            include_in_schema=False,
-            name=f"serve_{name}_rsc",
-        )
-
-    for _page in UI_PAGES:
-        _register_ui_page(_page)
-
-    @app.get("/admin")
-    async def admin_redirect() -> FileResponse:
-        return FileResponse(UI_DIST_PATH / "index.html")
-
-    @app.get("/favicon.ico", include_in_schema=False)
-    async def serve_favicon() -> FileResponse:
-        icon_path = UI_DIST_PATH / "icon.ico"
-        if icon_path.exists():
-            return FileResponse(icon_path)
-        return FileResponse(UI_DIST_PATH / "favicon.ico")
-
-    @app.get("/icon.ico", include_in_schema=False)
-    async def serve_icon() -> FileResponse:
-        return FileResponse(UI_DIST_PATH / "icon.ico")
-
-else:
-    logger.warning(
-        "UI dist directory not found at %s; serving API only. Run `make ui-build` "
-        "to build the static UI served from here, or `make ui-dev` for the Next.js "
-        "dev server with hot reload on :3000 (it targets this backend on :8000).",
-        UI_DIST_PATH,
-    )
-
-    @app.get("/", include_in_schema=False)
-    async def root_fallback() -> dict:
-        return {
-            "name": global_settings.name,
-            "description": global_settings.description,
-            "version": __version__,
-            "status": "running",
-            "ui": "not available",
-        }
+# Setup UI serving
+setup_ui(app)
 
 
 app.include_router(models_router)
 app.include_router(admin_router)
 app.include_router(balance_router)
-app.include_router(lightning_router)
 app.include_router(deprecated_wallet_router)
 app.include_router(providers_router)
 app.include_router(proxy_router)

routstr/core/middleware.py

@@ -14,54 +14,8 @@ logger = get_logger(__name__)
 request_id_context: ContextVar[str | None] = ContextVar("request_id")
 
 
-# Methods that are never logged: HEAD requests are health probes from
-# monitoring/load balancers, OPTIONS are CORS preflights — both are framework
-# chatter, not user-meaningful events.
-_SKIP_LOG_METHODS: frozenset[str] = frozenset({"HEAD", "OPTIONS"})
-
-# Path prefixes to skip. Includes Next.js static chunks and the admin
-# dashboard's internal polling API (/admin/api/*) which the UI hits on a timer
-# to refresh balances, logs, providers, etc. — high volume, low diagnostic
-# value. Mutating admin actions are recorded separately in the audit log.
-_SKIP_LOG_PREFIXES: tuple[str, ...] = (
-    "/_next/",
-    "/admin/api/",
-)
-
-# Exact paths to skip. RSC payload prefetches (`*/index.txt`) fire automatically
-# as the user hovers near `<Link>`s, and `/v1/wallet/info` is polled by the UI.
-_SKIP_LOG_EXACT: frozenset[str] = frozenset(
-    {
-        "/favicon.ico",
-        "/icon.ico",
-        "/v1/wallet/info",
-        "/index.txt",
-        "/login/index.txt",
-        "/model/index.txt",
-        "/providers/index.txt",
-        "/settings/index.txt",
-        "/transactions/index.txt",
-        "/balances/index.txt",
-        "/logs/index.txt",
-        "/usage/index.txt",
-        "/unauthorized/index.txt",
-    }
-)
-
-
-def _should_log(method: str, path: str) -> bool:
-    if method in _SKIP_LOG_METHODS:
-        return False
-    if path in _SKIP_LOG_EXACT:
-        return False
-    return not any(path.startswith(prefix) for prefix in _SKIP_LOG_PREFIXES)
-
-
 class LoggingMiddleware(BaseHTTPMiddleware):
-    """Middleware to log proxy interactions and page navigation.
-
-    Skips logging for static assets and Next.js chunks to avoid noise.
-    """
+    """Middleware to log detailed request and response information."""
 
     async def dispatch(self, request: Request, call_next: Callable) -> Response:
         # Generate request ID
@@ -71,20 +25,62 @@ class LoggingMiddleware(BaseHTTPMiddleware):
         # Set request ID in context for logging
         token = request_id_context.set(request_id)
 
-        path = request.url.path
-        should_log = _should_log(request.method, path)
-
         # Start timing
         start_time = time.time()
 
-        if should_log:
-            logger.info(
-                "Incoming request",
+        # Log request details
+        request_body = None
+        if request.method in ["POST", "PUT", "PATCH"]:
+            try:
+                # Only read body for non-streaming requests
+                if hasattr(request, "_body"):
+                    request_body = await request.body()
+            except Exception:
+                pass
+
+        # Extract request info
+        client_host = None
+        if request.client:
+            client_host = request.client.host
+
+        # Log incoming request
+        logger.info(
+            "Incoming request",
+            extra={
+                "request_id": request_id,
+                "method": request.method,
+                "path": request.url.path,
+                "query_params": dict(request.query_params),
+                "client_host": client_host,
+                "headers": {
+                    k: v
+                    for k, v in request.headers.items()
+                    if k.lower()
+                    not in [
+                        "authorization",
+                        "x-cashu",
+                        "cookie",
+                        "cf-connecting-ip",
+                        "cf-ipcountry",
+                        "x-forwarded-for",
+                        "x-real-ip",
+                    ]
+                },
+                "body_size": len(request_body) if request_body else 0,
+            },
+        )
+
+        # Log at TRACE level for full body (security filter will redact sensitive data)
+        if request_body and hasattr(logger, "exception"):
+            logger.exception(
+                "Request body",
                 extra={
                     "request_id": request_id,
                     "method": request.method,
-                    "path": path,
-                    "query_params": dict(request.query_params),
+                    "path": request.url.path,
+                    "body": request_body.decode("utf-8", errors="ignore")[
+                        :1000
+                    ],  # Limit size
                 },
             )
 
@@ -92,33 +88,39 @@ class LoggingMiddleware(BaseHTTPMiddleware):
         try:
             response = await call_next(request)
 
-            if should_log:
-                duration = time.time() - start_time
-                logger.info(
-                    "Request completed",
-                    extra={
-                        "request_id": request_id,
-                        "method": request.method,
-                        "path": path,
-                        "status_code": response.status_code,
-                        "duration_ms": round(duration * 1000, 2),
-                    },
-                )
+            # Calculate duration
+            duration = time.time() - start_time
+
+            # Log response
+            logger.info(
+                "Request completed",
+                extra={
+                    "request_id": request_id,
+                    "method": request.method,
+                    "path": request.url.path,
+                    "status_code": response.status_code,
+                    "duration_ms": round(duration * 1000, 2),
+                    "client_host": client_host,
+                },
+            )
             if hasattr(response, "headers"):
                 response.headers["x-routstr-request-id"] = request_id
 
             return response
 
         except Exception as e:
-            # Always log failures, even for skipped paths, so we don't lose errors.
+            # Calculate duration
             duration = time.time() - start_time
+
+            # Log error
             logger.error(
                 "Request failed",
                 extra={
                     "request_id": request_id,
                     "method": request.method,
-                    "path": path,
+                    "path": request.url.path,
                     "duration_ms": round(duration * 1000, 2),
+                    "client_host": client_host,
                     "error": str(e),
                     "error_type": type(e).__name__,
                 },

routstr/core/not_found.py

@@ -1,55 +0,0 @@
-"""Shared 404 handler used by the proxy catch-all and tests."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-from fastapi import Request
-from fastapi.responses import HTMLResponse, JSONResponse, Response
-
-_NOT_FOUND_HTML_FILE = Path(__file__).parent.parent.parent / "ui_out" / "404.html"
-
-
-def _read_not_found_html() -> str | None:
-    try:
-        return _NOT_FOUND_HTML_FILE.read_text(encoding="utf-8")
-    except OSError:
-        return None
-
-
-_NOT_FOUND_HTML: str | None = _read_not_found_html()
-
-
-def build_not_found_response(request: Request, path: str) -> Response:
-    """Return a 404 response.
-
-    HTML 404 page only for GET requests from browsers (Accept: text/html).
-    All POST requests and API clients receive a JSON 404.
-    """
-    accept = request.headers.get("accept", "").lower()
-    prefers_html = (
-        request.method == "GET"
-        and "text/html" in accept
-        and "application/json" not in accept
-    )
-    request_id = getattr(request.state, "request_id", "unknown")
-
-    if prefers_html and _NOT_FOUND_HTML is not None:
-        return HTMLResponse(content=_NOT_FOUND_HTML, status_code=404)
-
-    return JSONResponse(
-        status_code=404,
-        content={
-            "error": {
-                "message": f"Path '/{path}' not found",
-                "type": "not_found",
-                "code": 404,
-            },
-            "request_id": request_id,
-        },
-    )
-
-
-async def not_found_catch_all(request: Request, path: str) -> Response:
-    """ASGI handler form of :func:`build_not_found_response`."""
-    return build_not_found_response(request, path)

routstr/core/provider_slugs.py

@@ -1,65 +0,0 @@
-from __future__ import annotations
-
-import re
-from itertools import count
-from typing import Collection
-
-from sqlmodel import select
-from sqlmodel.ext.asyncio.session import AsyncSession
-
-from .db import UpstreamProviderRow
-
-_SLUG_BASE_PATTERN = re.compile(r"[^a-z0-9]+")
-_MAX_SLUG_LENGTH = 64
-
-
-def provider_slug_base(provider_type: str) -> str:
-    """Return a deterministic slug base for a provider type."""
-    base = _SLUG_BASE_PATTERN.sub("-", provider_type.lower()).strip("-")
-    if not base:
-        base = "provider"
-    elif base.isdigit():
-        base = f"provider-{base}"
-    elif len(base) < 3:
-        base = f"{base}-provider"
-
-    if len(base) > _MAX_SLUG_LENGTH:
-        base = base[:_MAX_SLUG_LENGTH].rstrip("-") or "provider"
-    return base
-
-
-def provider_slug_candidate(base: str, suffix_number: int) -> str:
-    if suffix_number == 1:
-        return base
-
-    suffix = f"-{suffix_number}"
-    max_base_length = _MAX_SLUG_LENGTH - len(suffix)
-    return f"{base[:max_base_length].rstrip('-')}{suffix}"
-
-
-async def allocate_unique_provider_slug(
-    session: AsyncSession,
-    provider_type: str,
-    reserved_slugs: Collection[str] = (),
-) -> str:
-    """Allocate a stable, deterministic provider slug.
-
-    The first provider of a type gets ``openai``; later collisions get
-    ``openai-2``, ``openai-3``, etc. ``reserved_slugs`` covers rows staged in
-    memory but not flushed yet, such as settings/env seeding.
-    """
-    base = provider_slug_base(provider_type)
-    reserved = {slug.lower() for slug in reserved_slugs}
-
-    for suffix_number in count(1):
-        candidate = provider_slug_candidate(base, suffix_number)
-        if candidate in reserved:
-            continue
-
-        result = await session.exec(
-            select(UpstreamProviderRow).where(UpstreamProviderRow.slug == candidate)
-        )
-        if result.first() is None:
-            return candidate
-
-    raise RuntimeError("unreachable")

routstr/core/redaction.py

@@ -1,51 +0,0 @@
-"""Redaction helpers for sensitive provider identifiers.
-
-Single source of truth for stripping account-scoped identifiers (e.g. OpenAI
-organization IDs) from any text before it is logged, returned to a caller, or
-written to an audit entry.
-"""
-
-from __future__ import annotations
-
-import re
-from typing import Any
-
-# OpenAI-style organization identifiers look like ``org-<base62>``. Require at
-# least 6 trailing chars so the already-redacted literal ``org-[REDACTED]`` is
-# never re-matched (``[`` is not in the character class).
-_ORG_ID_PATTERN = re.compile(r"\borg-[A-Za-z0-9]{6,}\b")
-
-ORG_ID_PLACEHOLDER = "org-[REDACTED]"
-
-
-def redact_org_ids(text: str) -> str:
-    """Replace OpenAI-style organization IDs with ``org-[REDACTED]``.
-
-    Args:
-        text: Arbitrary text that may embed an ``org-*`` identifier.
-
-    Returns:
-        The text with every organization ID replaced. Non-string input is
-        returned unchanged after coercion to ``str``.
-    """
-    if not text:
-        return text
-    return _ORG_ID_PATTERN.sub(ORG_ID_PLACEHOLDER, text)
-
-
-def redact_obj(obj: Any) -> Any:
-    """Recursively redact organization IDs in arbitrary nested structures.
-
-    Strings are redacted in place; dicts and lists/tuples are walked so that
-    identifiers nested inside structured payloads (e.g. log ``extra`` fields or
-    error ``details``) are also stripped. Other types are returned unchanged.
-    """
-    if isinstance(obj, str):
-        return redact_org_ids(obj)
-    if isinstance(obj, dict):
-        return {key: redact_obj(value) for key, value in obj.items()}
-    if isinstance(obj, list):
-        return [redact_obj(value) for value in obj]
-    if isinstance(obj, tuple):
-        return tuple(redact_obj(value) for value in obj)
-    return obj

routstr/core/settings.py

@@ -3,8 +3,6 @@ from __future__ import annotations
 import asyncio
 import json
 import os
-import secrets
-import time
 from datetime import datetime, timezone
 from typing import Any
 
@@ -28,6 +26,7 @@ class Settings(BaseSettings):
     # Core
     upstream_base_url: str = Field(default="", env="UPSTREAM_BASE_URL")
     upstream_api_key: str = Field(default="", env="UPSTREAM_API_KEY")
+    admin_password: str = Field(default="", env="ADMIN_PASSWORD")
 
     # Node info
     name: str = Field(default="ARoutstrNode", env="NAME")
@@ -42,15 +41,6 @@ class Settings(BaseSettings):
     primary_mint: str = Field(default="", env="PRIMARY_MINT_URL")
     primary_mint_unit: str = Field(default="sat", env="PRIMARY_MINT_UNIT")
 
-    # Lightning payout configuration
-    # Minimum available balance (in satoshis) before profit is paid out over
-    # Lightning
-    min_payout_sat: int = Field(default=210, gt=0, env="MIN_PAYOUT_SAT")
-    # Interval (seconds) between periodic payout attempts. Must be positive.
-    payout_interval_seconds: int = Field(
-        default=900, gt=0, env="PAYOUT_INTERVAL_SECONDS"
-    )
-
     # Pricing
     # Default behavior: derive pricing from MODELS
     # If fixed_pricing is True -> use fixed_cost_per_request and ignore tokens
@@ -62,26 +52,12 @@ class Settings(BaseSettings):
     exchange_fee: float = Field(default=1.005, env="EXCHANGE_FEE")
     upstream_provider_fee: float = Field(default=1.05, env="UPSTREAM_PROVIDER_FEE")
     tolerance_percentage: float = Field(default=1.0, env="TOLERANCE_PERCENTAGE")
-    child_key_cost: int = Field(default=0, env="CHILD_KEY_COST")
+    child_key_cost: int = Field(default=1000, env="CHILD_KEY_COST")
     # Minimum per-request charge in millisatoshis when model pricing is free/zero
     min_request_msat: int = Field(default=1, env="MIN_REQUEST_MSAT")
     reset_reserved_balance_on_startup: bool = Field(
         default=True, env="RESET_RESERVED_BALANCE_ON_STARTUP"
     )  # deactivate in horizontal scaling setups
-    # Reservations older than this are considered leaked (client disconnect,
-    # crash, abandoned stream) and released by the background sweeper and the
-    # refund endpoint.
-    stale_reservation_timeout_seconds: int = Field(
-        default=300, env="STALE_RESERVATION_TIMEOUT_SECONDS"
-    )
-    # Background prune of dead (zero balance, never used) API keys.
-    # Interval 0 disables it; min-age is a grace period (default 1 week).
-    dead_key_prune_interval_seconds: int = Field(
-        default=3600, env="DEAD_KEY_PRUNE_INTERVAL_SECONDS"
-    )
-    dead_key_min_age_seconds: int = Field(
-        default=604_800, env="DEAD_KEY_MIN_AGE_SECONDS"
-    )
 
     # Network
     cors_origins: list[str] = Field(default_factory=lambda: ["*"], env="CORS_ORIGINS")
@@ -95,18 +71,9 @@ class Settings(BaseSettings):
     models_refresh_interval_seconds: int = Field(
         default=360, env="MODELS_REFRESH_INTERVAL_SECONDS"
     )
-    model_paths_refresh_interval_seconds: int = Field(
-        default=600, env="MODEL_PATHS_REFRESH_INTERVAL_SECONDS"
-    )
     enable_pricing_refresh: bool = Field(default=True, env="ENABLE_PRICING_REFRESH")
     enable_models_refresh: bool = Field(default=True, env="ENABLE_MODELS_REFRESH")
-    enable_model_paths_refresh: bool = Field(
-        default=True, env="ENABLE_MODEL_PATHS_REFRESH"
-    )
     refund_cache_ttl_seconds: int = Field(default=3600, env="REFUND_CACHE_TTL_SECONDS")
-    refund_sweep_ttl_seconds: int = Field(
-        default=604800, env="REFUND_SWEEP_TTL_SECONDS"
-    )
 
     # Logging
     log_level: str = Field(default="INFO", env="LOG_LEVEL")
@@ -125,85 +92,12 @@ class Settings(BaseSettings):
 
     # Discovery
     relays: list[str] = Field(default_factory=list, env="RELAYS")
-    enable_analytics_sharing: bool = Field(default=True, env="ENABLE_ANALYTICS_SHARING")
-
-
-def _normalize_settings_data(data: dict[str, Any]) -> dict[str, Any]:
-    """Discard unknown keys from persisted settings."""
-    normalized: dict[str, Any] = {}
-    known_fields = Settings.__fields__
-
-    for key, value in data.items():
-        if key in known_fields:
-            normalized[key] = value
-
-    return normalized
-
-
-# Secrets are credentials, not config: they live in the encrypted/hashed Secret
-# store (and decrypted in-memory for runtime use), never in the persisted
-# settings blob. ``admin_password`` is gone from the model entirely; ``nsec``
-# remains a live field but is stripped from every blob write so it is never
-# written back to plaintext. ``upstream_api_key`` is intentionally *not* here:
-# it has no encrypted home yet (it is node-scoped today but really belongs on a
-# provider), so stripping it would lose it on the next restart. It stays in the
-# blob as before; encrypting it is follow-up work. See ``bootstrap_secrets`` and
-# ``routstr.core.vault``.
-SECRET_FIELDS = frozenset({"admin_password", "nsec"})
-
-
-def _strip_secret_fields(data: dict[str, Any]) -> dict[str, Any]:
-    """Return a copy of ``data`` without any secret fields (for persistence)."""
-    return {k: v for k, v in data.items() if k not in SECRET_FIELDS}
-
-
-def _apply_to_live_settings(data: dict[str, Any]) -> None:
-    """Apply ``data`` onto the live ``settings`` for all in-process importers.
-
-    Secrets are owned exclusively by ``bootstrap_secrets``, which runs first and
-    has already decrypted the authoritative nsec into memory (importing any
-    legacy plaintext on the way). Never re-apply secret fields from env/blob
-    here: a non-empty but stale ``NSEC`` env var would otherwise override an nsec
-    the vault has taken ownership of (e.g. after the operator rotates it in the
-    UI), and an empty one would wipe the live value. Skip them entirely.
-    """
-    for k, v in data.items():
-        if k in SECRET_FIELDS:
-            continue
-        setattr(settings, k, v)
 
 
 def _compute_primary_mint(cashu_mints: list[str]) -> str:
     return cashu_mints[0] if cashu_mints else "https://mint.minibits.cash/Bitcoin"
 
 
-def derive_npub_from_nsec(nsec: str) -> str | None:
-    """Derive the npub (bech32) from an nsec or 64-char hex private key, or None.
-
-    Parsing is delegated to :func:`routstr.nostr.listing.nsec_to_keypair`, the
-    single place that knows the nsec/hex formats (and already returns ``None`` on
-    any unusable input); this only bech32-encodes the resulting public key. The
-    contract stays "return None on unusable input", so a bad key never crashes
-    boot.
-    """
-    try:
-        from nostr.key import PublicKey  # type: ignore
-
-        from ..nostr.listing import nsec_to_keypair
-    except ImportError:
-        return None
-
-    keypair = nsec_to_keypair(nsec)
-    if keypair is None:
-        return None
-    _privkey_hex, pubkey_hex = keypair
-
-    try:
-        return PublicKey(bytes.fromhex(pubkey_hex)).bech32()
-    except (ValueError, AttributeError):
-        return None
-
-
 def resolve_bootstrap() -> Settings:
     base = Settings()  # Reads env with custom parse_env_var
     # Back-compat env mapping
@@ -249,7 +143,7 @@ def resolve_bootstrap() -> Settings:
         pass
     if not base.onion_url:
         try:
-            from ..nostr.listing import discover_onion_url_from_tor  # type: ignore
+            from ..nip91 import discover_onion_url_from_tor  # type: ignore
 
             discovered = discover_onion_url_from_tor()
             if discovered:
@@ -258,9 +152,23 @@ def resolve_bootstrap() -> Settings:
             pass
     # Derive NPUB from NSEC if not provided
     if not base.npub and base.nsec:
-        npub = derive_npub_from_nsec(base.nsec)
-        if npub:
-            base.npub = npub
+        try:
+            from nostr.key import PrivateKey  # type: ignore
+
+            if base.nsec.startswith("nsec"):
+                pk = PrivateKey.from_nsec(base.nsec)
+            elif len(base.nsec) == 64:
+                pk = PrivateKey(bytes.fromhex(base.nsec))
+            else:
+                pk = None
+            if pk is not None:
+                try:
+                    base.npub = pk.public_key.bech32()
+                except Exception:
+                    # Fallback to hex if bech32 not available
+                    base.npub = pk.public_key.hex()
+        except Exception:
+            pass
     if not base.cors_origins:
         base.cors_origins = ["*"]
     if not base.primary_mint:
@@ -310,37 +218,29 @@ class SettingsService:
                     text(
                         "INSERT INTO settings (id, data, updated_at) VALUES (1, :data, :updated_at)"
                     ).bindparams(
-                        data=json.dumps(_strip_secret_fields(env_resolved.dict())),
+                        data=json.dumps(env_resolved.dict()),
                         updated_at=datetime.now(timezone.utc),
                     )
                 )
                 await db_session.commit()
                 cls._current = settings
                 # Update the existing instance in-place for all live importers
-                _apply_to_live_settings(env_resolved.dict())
+                for k, v in env_resolved.dict().items():
+                    setattr(settings, k, v)
                 return cls._current
 
             db_id, db_data, _updated_at = row
             try:
-                db_json_raw = (
+                db_json = (
                     json.loads(db_data) if isinstance(db_data, str) else dict(db_data)
                 )
-                if not isinstance(db_json_raw, dict):
-                    db_json_raw = {}
             except Exception:
-                db_json_raw = {}
-            db_json = _normalize_settings_data(db_json_raw)
+                db_json = {}
 
-            valid_fields = set(env_resolved.dict().keys())
             merged_dict: dict[str, Any] = dict(env_resolved.dict())
             merged_dict.update(
-                {
-                    k: v
-                    for k, v in db_json.items()
-                    if v not in (None, "", [], {}) and k in valid_fields
-                }
+                {k: v for k, v in db_json.items() if v not in (None, "", [], {})}
             )
-            merged_dict = Settings(**merged_dict).dict()
 
             # Ensure primary_mint is consistent with cashu_mints if not explicitly set
             if not merged_dict.get("primary_mint"):
@@ -348,37 +248,20 @@ class SettingsService:
                     merged_dict.get("cashu_mints", [])
                 )
 
-            # Keep npub consistent with the live nsec. bootstrap_secrets has
-            # already run and holds the single authoritative nsec (decrypted from
-            # the encrypted store, or freshly imported). merged_dict starts from
-            # the env/blob, which may carry a STALE nsec — and therefore a stale
-            # derived npub — after the vault took ownership. Derive from the live
-            # value and OVERRIDE, not just fill: otherwise the node keeps the
-            # vault's private key but announces the old env key's npub (npub is a
-            # pure derivation of nsec, never configured independently of it).
-            if settings.nsec:
-                derived_npub = derive_npub_from_nsec(settings.nsec)
-                if derived_npub:
-                    merged_dict["npub"] = derived_npub
-
-            # Persist without secrets; compare against the stripped target so a
-            # legacy blob that still carries plaintext secrets gets rewritten
-            # (and thereby sunset) even when its non-secret values are unchanged.
-            persisted = _strip_secret_fields(merged_dict)
-            if db_json_raw != persisted:
+            if any(k not in db_json for k in merged_dict.keys()):
                 await db_session.exec(  # type: ignore
                     text(
                         "UPDATE settings SET data = :data, updated_at = :updated_at WHERE id = 1"
                     ).bindparams(
-                        data=json.dumps(persisted),
+                        data=json.dumps(merged_dict),
                         updated_at=datetime.now(timezone.utc),
                     )
                 )
                 await db_session.commit()
 
             # Update the existing instance in-place for all live importers
-            # (keeps the decrypted nsec live in memory).
-            _apply_to_live_settings(merged_dict)
+            for k, v in merged_dict.items():
+                setattr(settings, k, v)
             cls._current = settings
             return cls._current
 
@@ -388,7 +271,7 @@ class SettingsService:
     ) -> Settings:
         async with cls._lock:
             current = cls.get()
-            candidate_dict = {**current.dict(), **_normalize_settings_data(partial)}
+            candidate_dict = {**current.dict(), **partial}
             candidate = Settings(**candidate_dict)
             from sqlmodel import text
 
@@ -400,7 +283,7 @@ class SettingsService:
                 text(
                     "UPDATE settings SET data = :data, updated_at = :updated_at WHERE id = 1"
                 ).bindparams(
-                    data=json.dumps(_strip_secret_fields(candidate.dict())),
+                    data=json.dumps(candidate.dict()),
                     updated_at=datetime.now(timezone.utc),
                 )
             )
@@ -422,159 +305,8 @@ class SettingsService:
                 raise RuntimeError("Settings row missing")
             (data_str,) = row
             data = json.loads(data_str) if isinstance(data_str, str) else dict(data_str)
-            valid_fields = set(settings.dict().keys())
             # Update in-place
             for k, v in data.items():
-                if k in valid_fields:
-                    setattr(settings, k, v)
+                setattr(settings, k, v)
             cls._current = settings
             return settings
-
-
-async def _read_raw_settings_blob(db_session: AsyncSession) -> dict[str, Any]:
-    """Best-effort read of the raw persisted settings JSON (may not exist yet)."""
-    from sqlmodel import text
-
-    try:
-        result = await db_session.exec(  # type: ignore
-            text("SELECT data FROM settings WHERE id = 1")
-        )
-        row = result.first()
-    except Exception:
-        return {}
-    if row is None:
-        return {}
-    (data_str,) = row
-    try:
-        data = json.loads(data_str) if isinstance(data_str, str) else dict(data_str)
-    except Exception:
-        return {}
-    return data if isinstance(data, dict) else {}
-
-
-def _legacy_plaintext(
-    raw_blob: dict[str, Any], env_name: str, blob_key: str
-) -> str | None:
-    """Legacy plaintext for a secret: env first, then the old settings blob."""
-    env_value = os.environ.get(env_name)
-    if env_value:
-        return env_value
-    blob_value = raw_blob.get(blob_key)
-    if isinstance(blob_value, str) and blob_value:
-        return blob_value
-    return None
-
-
-async def bootstrap_secrets(db_session: AsyncSession) -> None:
-    """Move node secrets into the encrypted/hashed Secret store at startup.
-
-    Per secret:
-      * column already set -> use it (the nsec is decrypted into the in-memory
-        ``settings``; a wrong ROUTSTR_SECRET_KEY surfaces as a clear fail-fast).
-      * column empty but legacy plaintext exists (env, or the old settings
-        blob) -> transform it (hash the password / encrypt the nsec) into the
-        column.
-      * nothing (admin password only) -> generate a strong random password,
-        hash it, and log it once with the /admin URL.
-    """
-    from cryptography.fernet import InvalidToken
-    from sqlmodel import col, update
-
-    from . import vault
-    from .db import NsecState, Secret, get_secret
-
-    raw_blob = await _read_raw_settings_blob(db_session)
-    secret = await get_secret(db_session)
-    changed = False
-
-    # Admin password — one-way scrypt hash.
-    if secret.admin_password_hash is None:
-        legacy_password = _legacy_plaintext(
-            raw_blob, "ADMIN_PASSWORD", "admin_password"
-        )
-        if legacy_password:
-            secret.admin_password_hash = vault.hash_password(legacy_password)
-            changed = True
-        else:
-            generated = secrets.token_urlsafe(24)
-            # Claim the empty slot atomically: only the worker whose UPDATE flips
-            # NULL -> hash owns the generated password and announces it. On a
-            # shared DB a racing worker gets rowcount 0, so it neither clobbers
-            # the winner's hash (which the operator may already be using) nor
-            # prints a second password that would never work.
-            claim_stmt = (
-                update(Secret)
-                .where(col(Secret.id) == 1)
-                .where(col(Secret.admin_password_hash).is_(None))
-                .values(
-                    admin_password_hash=vault.hash_password(generated),
-                    updated_at=int(time.time()),
-                )
-            )
-            result = await db_session.exec(claim_stmt)  # type: ignore[call-overload]
-            await db_session.commit()
-            await db_session.refresh(secret)
-            if result.rowcount == 1:
-                admin_url = (settings.http_url or "http://localhost:8000").rstrip("/")
-                # Print to stdout rather than the logger: the operator must see
-                # this once (e.g. `docker compose logs`), but it must not be
-                # persisted into the on-disk log files the logger also writes to.
-                print(
-                    "No admin password set; generated a temporary one (shown "
-                    f"only now): {generated}\nLog in at {admin_url}/admin and "
-                    "change it from the dashboard settings.",
-                    flush=True,
-                )
-
-    # Nostr nsec — reversible Fernet encryption. ``nsec_state`` is the single
-    # source of truth for ownership, so "intentionally cleared" is never
-    # conflated with "never migrated" (the bug the old bool could not encode).
-    if secret.nsec_state == NsecState.encrypted:
-        # The vault owns the identity: decrypt the ciphertext, never re-read
-        # env/blob. A missing ciphertext here means the row is inconsistent (a
-        # failed write or manual edit); fail fast rather than silently dropping
-        # the identity and falling back to a stale legacy copy.
-        if secret.encrypted_nsec is None:
-            raise RuntimeError(
-                "nsec_state is 'encrypted' but no ciphertext is stored; the "
-                "secrets row is inconsistent. Refusing to boot rather than "
-                "silently resurrecting a stale legacy NSEC."
-            )
-        try:
-            settings.nsec = vault.decrypt(secret.encrypted_nsec)
-        except InvalidToken as exc:
-            raise RuntimeError(
-                "Stored nsec cannot be decrypted with the current "
-                "ROUTSTR_SECRET_KEY. The key changed, or this database came from "
-                "another node. Restore the original ROUTSTR_SECRET_KEY to recover."
-            ) from exc
-    elif secret.nsec_state == NsecState.cleared:
-        # The operator emptied the identity via the admin API. A fresh process
-        # has already reloaded a stale ``NSEC`` from env/blob into the live
-        # settings (and may have derived its npub); actively clear both so the
-        # cleared store wins rather than silently resurrecting the old identity.
-        settings.nsec = ""
-        settings.npub = ""
-    else:  # NsecState.legacy — the vault has not taken ownership yet.
-        # Import any legacy plaintext (env, or the old settings blob) exactly
-        # once. Encryption at rest is mandatory, but a missing key is
-        # provisioned, not fatal: vault.encrypt generates and persists a master
-        # key (with a loud one-time operator notice) when none was supplied, so
-        # an upgrading node keeps running. The nsec is never stored in plaintext.
-        legacy_nsec = _legacy_plaintext(raw_blob, "NSEC", "nsec")
-        if legacy_nsec:
-            secret.encrypted_nsec = vault.encrypt(legacy_nsec)
-            secret.nsec_state = NsecState.encrypted
-            settings.nsec = legacy_nsec
-            changed = True
-
-    # Derive npub from whatever nsec we now hold, if not already known.
-    if settings.nsec and not settings.npub:
-        npub = derive_npub_from_nsec(settings.nsec)
-        if npub:
-            settings.npub = npub
-
-    if changed:
-        secret.updated_at = int(time.time())
-        db_session.add(secret)
-        await db_session.commit()

routstr/core/tasks.py

@@ -0,0 +1,143 @@
+import asyncio
+from contextlib import asynccontextmanager
+from typing import AsyncGenerator
+
+from fastapi import FastAPI
+
+# when other refactor is merged:
+# from ..nostr import announce_provider, providers_cache_refresher
+from ..discovery import providers_cache_refresher
+from ..nip91 import announce_provider
+from ..payment.models import update_sats_pricing
+from ..payment.price import update_prices_periodically
+from ..proxy import initialize_upstreams, refresh_model_maps_periodically
+from ..wallet import periodic_payout
+from .db import create_session, init_db, run_migrations
+from .logging import get_logger
+from .settings import SettingsService
+from .settings import settings as global_settings
+
+logger = get_logger(__name__)
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
+    logger.info("Application startup initiated", extra={"version": app.version})
+
+    btc_price_task = None
+    pricing_task = None
+    payout_task = None
+    nip91_task = None
+    providers_task = None
+    models_refresh_task = None
+    model_maps_refresh_task = None
+
+    try:
+        # Run database migrations on startup
+        run_migrations()
+
+        # Initialize database connection pools
+        # This creates any tables that might not be tracked by migrations yet
+        await init_db()
+
+        # Initialize application settings (env -> computed -> DB precedence)
+        async with create_session() as session:
+            s = await SettingsService.initialize(session)
+            if s.reset_reserved_balance_on_startup:
+                from .db import reset_all_reserved_balances
+
+                await reset_all_reserved_balances(session)
+
+        if not s.admin_password:
+            logger.warning(
+                f"Admin password is not set. Visit {s.http_url or 'http://localhost:8000'}/admin to set the password."
+            )
+
+        # Apply app metadata from settings
+        try:
+            app.title = s.name
+            app.description = s.description
+        except Exception:
+            pass
+
+        # await ensure_models_bootstrapped()
+
+        from ..payment.price import _update_prices
+        from ..proxy import get_upstreams
+        from ..upstream.helpers import refresh_upstreams_models_periodically
+
+        _update_prices_task = asyncio.create_task(_update_prices())
+        _initialize_upstreams_task = asyncio.create_task(initialize_upstreams())
+
+        # ensure both setup tasks complete
+        await asyncio.gather(
+            _update_prices_task, _initialize_upstreams_task, return_exceptions=True
+        )
+
+        btc_price_task = asyncio.create_task(update_prices_periodically())
+        pricing_task = asyncio.create_task(update_sats_pricing())
+        if global_settings.models_refresh_interval_seconds > 0:
+            models_refresh_task = asyncio.create_task(
+                refresh_upstreams_models_periodically(get_upstreams())
+            )
+        model_maps_refresh_task = asyncio.create_task(refresh_model_maps_periodically())
+        payout_task = asyncio.create_task(periodic_payout())
+        if global_settings.nsec:
+            nip91_task = asyncio.create_task(announce_provider())
+        if global_settings.providers_refresh_interval_seconds > 0:
+            providers_task = asyncio.create_task(providers_cache_refresher())
+
+        yield
+
+    except asyncio.CancelledError:
+        # Expected during shutdown
+        pass
+    except Exception as e:
+        logger.error(
+            "Application startup failed",
+            extra={"error": str(e), "error_type": type(e).__name__},
+        )
+        raise
+    finally:
+        logger.info("Application shutdown initiated")
+
+        if btc_price_task is not None:
+            btc_price_task.cancel()
+        if pricing_task is not None:
+            pricing_task.cancel()
+        if payout_task is not None:
+            payout_task.cancel()
+        if nip91_task is not None:
+            nip91_task.cancel()
+        if providers_task is not None:
+            providers_task.cancel()
+        if models_refresh_task is not None:
+            models_refresh_task.cancel()
+        if model_maps_refresh_task is not None:
+            model_maps_refresh_task.cancel()
+
+        try:
+            tasks_to_wait = []
+            if btc_price_task is not None:
+                tasks_to_wait.append(btc_price_task)
+            if pricing_task is not None:
+                tasks_to_wait.append(pricing_task)
+            if payout_task is not None:
+                tasks_to_wait.append(payout_task)
+            if nip91_task is not None:
+                tasks_to_wait.append(nip91_task)
+            if providers_task is not None:
+                tasks_to_wait.append(providers_task)
+            if models_refresh_task is not None:
+                tasks_to_wait.append(models_refresh_task)
+            if model_maps_refresh_task is not None:
+                tasks_to_wait.append(model_maps_refresh_task)
+
+            if tasks_to_wait:
+                await asyncio.gather(*tasks_to_wait, return_exceptions=True)
+            logger.info("Background tasks stopped successfully")
+        except Exception as e:
+            logger.error(
+                "Error stopping background tasks",
+                extra={"error": str(e), "error_type": type(e).__name__},
+            )

routstr/core/ui.py

@@ -0,0 +1,152 @@
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.responses import FileResponse, RedirectResponse
+from fastapi.staticfiles import StaticFiles
+
+from .logging import get_logger
+from .settings import settings as global_settings
+
+logger = get_logger(__name__)
+
+
+def setup_ui(app: FastAPI) -> None:
+    UI_DIST_PATH = Path(__file__).parent.parent.parent / "ui_out"
+
+    if UI_DIST_PATH.exists() and UI_DIST_PATH.is_dir():
+        logger.info(f"Serving static UI from {UI_DIST_PATH}")
+
+        app.mount(
+            "/_next",
+            StaticFiles(directory=UI_DIST_PATH / "_next", check_dir=True),
+            name="next-static",
+        )
+
+        @app.get("/", include_in_schema=False)
+        async def serve_root_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "index.html")
+
+        # Add explicit route for /index.txt to redirect to /
+        @app.get("/index.txt", include_in_schema=False)
+        async def redirect_index_txt() -> RedirectResponse:
+            return RedirectResponse("/")
+
+        @app.get("/admin")
+        async def admin_redirect() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "index.html")
+
+        @app.get("/dashboard", include_in_schema=False)
+        async def serve_dashboard_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "index.html")
+
+        @app.get("/login", include_in_schema=False)
+        async def serve_login_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "login" / "index.html")
+
+        # Add explicit route for /login/index.txt to redirect to /login
+        @app.get("/login/index.txt", include_in_schema=False)
+        async def redirect_login_index_txt() -> RedirectResponse:
+            return RedirectResponse("/login")
+
+        @app.get("/model", include_in_schema=False)
+        async def serve_models_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "model" / "index.html")
+
+        # Add explicit route for /model/index.txt to redirect to /model
+        @app.get("/model/index.txt", include_in_schema=False)
+        async def redirect_model_index_txt() -> RedirectResponse:
+            return RedirectResponse("/model")
+
+        @app.get("/providers", include_in_schema=False)
+        async def serve_providers_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "providers" / "index.html")
+
+        # Add explicit route for /providers/index.txt to redirect to /providers
+        @app.get("/providers/index.txt", include_in_schema=False)
+        async def redirect_providers_index_txt() -> RedirectResponse:
+            return RedirectResponse("/providers")
+
+        @app.get("/settings", include_in_schema=False)
+        async def serve_settings_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "settings" / "index.html")
+
+        # Add explicit route for /settings/index.txt to redirect to /settings
+        @app.get("/settings/index.txt", include_in_schema=False)
+        async def redirect_settings_index_txt() -> RedirectResponse:
+            return RedirectResponse("/settings")
+
+        @app.get("/transactions", include_in_schema=False)
+        async def serve_transactions_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "transactions" / "index.html")
+
+        # Add explicit route for /transactions/index.txt to redirect to /transactions
+        @app.get("/transactions/index.txt", include_in_schema=False)
+        async def redirect_transactions_index_txt() -> RedirectResponse:
+            return RedirectResponse("/transactions")
+
+        @app.get("/balances", include_in_schema=False)
+        async def serve_balances_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "balances" / "index.html")
+
+        # Add explicit route for /balances/index.txt to redirect to /balances
+        @app.get("/balances/index.txt", include_in_schema=False)
+        async def redirect_balances_index_txt() -> RedirectResponse:
+            return RedirectResponse("/balances")
+
+        @app.get("/logs", include_in_schema=False)
+        async def serve_logs_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "logs" / "index.html")
+
+        # Add explicit route for /logs/index.txt to redirect to /logs
+        @app.get("/logs/index.txt", include_in_schema=False)
+        async def redirect_logs_index_txt() -> RedirectResponse:
+            return RedirectResponse("/logs")
+
+        @app.get("/usage", include_in_schema=False)
+        async def serve_usage_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "usage" / "index.html")
+
+        # Add explicit route for /usage/index.txt to redirect to /usage
+        @app.get("/usage/index.txt", include_in_schema=False)
+        async def redirect_usage_index_txt() -> RedirectResponse:
+            return RedirectResponse("/usage")
+
+        @app.get("/unauthorized", include_in_schema=False)
+        async def serve_unauthorized_ui() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "unauthorized" / "index.html")
+
+        # Add explicit route for /unauthorized/index.txt to redirect to /unauthorized
+        @app.get("/unauthorized/index.txt", include_in_schema=False)
+        async def redirect_unauthorized_index_txt() -> RedirectResponse:
+            return RedirectResponse("/unauthorized")
+
+        @app.get("/favicon.ico", include_in_schema=False)
+        async def serve_favicon() -> FileResponse:
+            icon_path = UI_DIST_PATH / "icon.ico"
+            if icon_path.exists():
+                return FileResponse(icon_path)
+            return FileResponse(UI_DIST_PATH / "favicon.ico")
+
+        @app.get("/icon.ico", include_in_schema=False)
+        async def serve_icon() -> FileResponse:
+            return FileResponse(UI_DIST_PATH / "icon.ico")
+
+        app.mount(
+            "/static",
+            StaticFiles(directory=UI_DIST_PATH, check_dir=True),
+            name="ui-static",
+        )
+    else:
+        logger.warning(
+            f"UI dist directory not found at {UI_DIST_PATH}, skipping static file serving"
+        )
+
+        @app.get("/", include_in_schema=False)
+        async def root_fallback() -> dict:
+            return {
+                "name": global_settings.name,
+                "description": global_settings.description,
+                "version": app.version,
+                "status": "running",
+                "ui": "not available",
+            }

routstr/core/vault.py

@@ -1,320 +0,0 @@
-"""Encrypt/hash/fingerprint helpers for secrets at rest (issue #553).
-
-Thin wrapper over ``cryptography`` so nothing else in the codebase touches
-Fernet/scrypt/HMAC directly:
-
-- :func:`encrypt`/:func:`decrypt` — Fernet symmetric encryption, keyed by the
-  mandatory master key. Ciphertext is self-describing (``fernet:v1:`` prefix) so
-  a value can be told apart from legacy plaintext and so reading it under the
-  wrong key surfaces as a hard error rather than silent corruption.
-- :func:`hash_password`/:func:`verify_password` — salted scrypt hashing. This is
-  *key-independent*: it never reads the master key, so password login and the
-  recovery script keep working even when the key is missing.
-
-Key custody is flexible but encryption is not optional. The key comes from the
-``ROUTSTR_SECRET_KEY`` env var, else a persisted key file
-(``ROUTSTR_SECRET_KEY_FILE``, defaulting beside the SQLite database so it persists
-on the same volume as the data); when neither is set, :func:`encrypt` generates
-one to the key file and prints a one-time notice, so an existing node upgrades
-without breaking instead of refusing to boot. Reading is strict — :func:`decrypt`
-never generates a key (a new key could not match existing ciphertext) and fails
-fast with the generation command when none is configured. A malformed
-``ROUTSTR_SECRET_KEY`` is an operator error and always fails fast.
-"""
-
-import base64
-import hashlib
-import hmac
-import os
-import secrets
-import tempfile
-from pathlib import Path
-
-from cryptography.fernet import Fernet
-from sqlalchemy.engine import make_url
-from sqlalchemy.exc import ArgumentError
-
-_PREFIX = "fernet:v1:"
-_GEN_COMMAND = (
-    'python -c "from cryptography.fernet import Fernet; '
-    'print(Fernet.generate_key().decode())"'
-)
-
-# Where an auto-generated master key is persisted when the operator supplies no
-# ``ROUTSTR_SECRET_KEY``. Defaults beside the SQLite database so it rides whatever
-# volume already persists the data (a container recreate would otherwise generate
-# a fresh key and be unable to decrypt existing secrets); falls back to the
-# working directory when the DB location is unknown. Override the exact path with
-# ``ROUTSTR_SECRET_KEY_FILE``.
-_KEY_FILE_ENV = "ROUTSTR_SECRET_KEY_FILE"
-_DEFAULT_KEY_FILE = "routstr_secret.key"
-
-# Minimum admin-password length, enforced wherever a password is set/changed
-# (admin endpoints + the recovery script) so the policy lives in one place.
-MIN_PASSWORD_LENGTH = 8
-
-# scrypt parameters; packed into each hash so verification is parameter-free.
-_SCRYPT_N = 2**14
-_SCRYPT_R = 8
-_SCRYPT_P = 1
-_SCRYPT_DKLEN = 32
-_SCRYPT_SALT_BYTES = 16
-
-
-def _database_dir() -> Path | None:
-    """Directory of the SQLite database file, or ``None`` when it has no on-disk
-    location (a non-SQLite URL or ``:memory:``).
-
-    Read from ``DATABASE_URL`` at call time and parsed here rather than importing
-    ``routstr.core.db`` — that module builds the engine at import, which the
-    crypto layer must not drag in. Mirrors db.py's ``DATABASE_URL`` default.
-    """
-    url_str = os.environ.get("DATABASE_URL", "sqlite+aiosqlite:///keys.db")
-    try:
-        url = make_url(url_str)
-    except ArgumentError:
-        return None
-    if url.get_backend_name() != "sqlite" or not url.database:
-        return None
-    if url.database == ":memory:":
-        return None
-    return Path(url.database).parent
-
-
-def _key_file_path() -> Path:
-    """Where the auto-generated master key is read from / written to.
-
-    ``ROUTSTR_SECRET_KEY_FILE`` wins; otherwise the key sits beside the SQLite
-    database so it persists on the same volume as the data, falling back to the
-    working directory when the DB location is unknown.
-    """
-    override = os.environ.get(_KEY_FILE_ENV)
-    if override:
-        return Path(override)
-    directory = _database_dir()
-    return (directory or Path()) / _DEFAULT_KEY_FILE
-
-
-def _read_key_file(path: Path) -> str | None:
-    try:
-        stored = path.read_text().strip()
-    except OSError:
-        return None
-    if not stored:
-        return None
-    _repair_key_file_perms(path)
-    return stored
-
-
-def _repair_key_file_perms(path: Path) -> None:
-    # A master key must never be group/other-readable. On POSIX, tighten loose
-    # permissions to owner-only (0600) rather than trust — or hard-fail on — a
-    # world-readable key; a friendlier repair keeps an upgrading node booting.
-    if os.name != "posix":
-        return
-    try:
-        mode = path.stat().st_mode
-    except OSError:
-        return
-    if mode & 0o077:
-        try:
-            os.chmod(path, 0o600)
-        except OSError:
-            pass
-
-
-def _load_secret_key() -> str | None:
-    """The configured key without provisioning: env var, then the key file."""
-    return os.environ.get("ROUTSTR_SECRET_KEY") or _read_key_file(_key_file_path())
-
-
-def _warn_generated_key(path: Path) -> None:
-    # stdout, not the logger: the operator must see this once (e.g. in
-    # ``docker compose logs``), but it must never be persisted into the on-disk
-    # log files the logger also writes. Mirrors the generated-admin-password
-    # notice so an upgrade cannot silently create an unbacked key.
-    print(
-        "No ROUTSTR_SECRET_KEY was set; generated one to encrypt node secrets at "
-        f"rest and saved it to {path}.\n"
-        "!! BACK UP THIS FILE. If it is lost, the encrypted secrets cannot be "
-        "recovered and will have to be re-entered.\n"
-        "To manage the key yourself (e.g. from a secrets manager) set "
-        "ROUTSTR_SECRET_KEY in the environment instead; the value is in the file "
-        "above.",
-        flush=True,
-    )
-
-
-def _generate_and_persist_key(path: Path) -> str:
-    """Generate a Fernet key, persist it owner-only and atomically, warn once.
-
-    The key is written to a temp file in the same directory, flushed durably,
-    then ``os.link``-ed into place. ``os.link`` publishes the complete file in a
-    single atomic step — a crash mid-write leaves only the temp file (which is
-    removed), never a half-written or empty key at the final path that a later
-    boot would read as corrupt. It also refuses to overwrite an existing key, so
-    a racing worker that generated first keeps ownership (secrets may already be
-    encrypted under its key); the loser adopts that key instead of clobbering it.
-    """
-    key = Fernet.generate_key().decode()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, tmp_name = tempfile.mkstemp(
-        dir=path.parent, prefix=".routstr_secret.", suffix=".tmp"
-    )
-    tmp = Path(tmp_name)
-    try:
-        with os.fdopen(fd, "w") as handle:
-            handle.write(key)  # mkstemp already created it 0600
-            handle.flush()
-            os.fsync(handle.fileno())
-        try:
-            os.link(tmp, path)
-        except FileExistsError:
-            # A concurrent worker linked its key in first; adopt theirs rather
-            # than clobber a key that secrets may already be encrypted under.
-            existing = _read_key_file(path)
-            if existing:
-                return existing
-            raise
-        _fsync_dir(path.parent)
-    finally:
-        tmp.unlink(missing_ok=True)
-    _warn_generated_key(path)
-    return key
-
-
-def _fsync_dir(directory: Path) -> None:
-    # Persist the new directory entry so the linked key survives a crash right
-    # after publish. Best-effort: not every platform lets you fsync a directory.
-    try:
-        dir_fd = os.open(directory, os.O_RDONLY)
-    except OSError:
-        return
-    try:
-        os.fsync(dir_fd)
-    except OSError:
-        pass
-    finally:
-        os.close(dir_fd)
-
-
-def ensure_secret_key() -> str:
-    """Return the master key, provisioning one if the operator supplied none.
-
-    Precedence: the ``ROUTSTR_SECRET_KEY`` env var, then the persisted key file,
-    otherwise a freshly generated key written to the key file (with a one-time
-    operator notice). This keeps encryption at rest mandatory while letting an
-    existing node upgrade without setting a key first. A malformed env key is
-    left to fail at :func:`get_fernet` — it is an operator error, not an unset
-    key, so it must not trigger silent self-provisioning.
-    """
-    env_key = os.environ.get("ROUTSTR_SECRET_KEY")
-    if env_key:
-        return env_key
-    path = _key_file_path()
-    return _read_key_file(path) or _generate_and_persist_key(path)
-
-
-def _fernet_from_key(key: str) -> Fernet:
-    try:
-        return Fernet(key.encode())
-    except (ValueError, TypeError) as exc:
-        raise RuntimeError(
-            "ROUTSTR_SECRET_KEY is malformed; it must be a url-safe base64 "
-            "32-byte Fernet key. Generate one with:\n    " + _GEN_COMMAND
-        ) from exc
-
-
-def get_fernet() -> Fernet:
-    """Build a :class:`Fernet` from the configured key (env var or key file).
-
-    Strict: this never generates a key, so already-encrypted ciphertext is never
-    shadowed by a fresh key. A read with no key configured fails fast with the
-    generation command.
-    """
-    key = _load_secret_key()
-    if not key:
-        raise RuntimeError(
-            "ROUTSTR_SECRET_KEY is not set. It is required to encrypt secrets at "
-            "rest. Generate one with:\n    " + _GEN_COMMAND
-        )
-    return _fernet_from_key(key)
-
-
-def encrypt(plaintext: str) -> str:
-    """Encrypt ``plaintext`` into a self-describing ``fernet:v1:`` token.
-
-    Provisions a master key (env var, key file, or a freshly generated one) so an
-    upgrading node never has to set one before its first secret is stored; the
-    value is always encrypted, never persisted in plaintext.
-    """
-    fernet = _fernet_from_key(ensure_secret_key())
-    return _PREFIX + fernet.encrypt(plaintext.encode()).decode()
-
-
-def is_encrypted(value: str) -> bool:
-    """True if ``value`` carries the ``fernet:v1:`` prefix this module emits."""
-    return value.startswith(_PREFIX)
-
-
-def decrypt(ciphertext: str) -> str:
-    """Decrypt a ``fernet:v1:`` token.
-
-    Raises ``ValueError`` for an unprefixed value (so legacy plaintext is never
-    mistaken for ciphertext) and ``InvalidToken`` when the value was written
-    under a different ``ROUTSTR_SECRET_KEY``.
-    """
-    if not is_encrypted(ciphertext):
-        raise ValueError("value is not fernet:v1: ciphertext")
-    token = ciphertext[len(_PREFIX) :]
-    return get_fernet().decrypt(token.encode()).decode()
-
-
-def hash_password(password: str) -> str:
-    """Salted scrypt hash, self-describing as ``scrypt:n:r:p:salt:hash``."""
-    salt = secrets.token_bytes(_SCRYPT_SALT_BYTES)
-    derived = hashlib.scrypt(
-        password.encode(),
-        salt=salt,
-        n=_SCRYPT_N,
-        r=_SCRYPT_R,
-        p=_SCRYPT_P,
-        dklen=_SCRYPT_DKLEN,
-    )
-    return ":".join(
-        [
-            "scrypt",
-            str(_SCRYPT_N),
-            str(_SCRYPT_R),
-            str(_SCRYPT_P),
-            base64.b64encode(salt).decode(),
-            base64.b64encode(derived).decode(),
-        ]
-    )
-
-
-def verify_password(password: str, stored: str) -> bool:
-    """Constant-time check of ``password`` against a :func:`hash_password` value."""
-    try:
-        scheme, n, r, p, salt_b64, hash_b64 = stored.split(":")
-        if scheme != "scrypt":
-            return False
-        n_int, r_int, p_int = int(n), int(r), int(p)
-        # Cap the work factor at the parameters this module emits. scrypt's
-        # memory cost grows with N*r, so an oversized N/r in a tampered or
-        # corrupt stored hash could turn a single login into an OOM/DoS.
-        if n_int > _SCRYPT_N or r_int > _SCRYPT_R or p_int > _SCRYPT_P:
-            return False
-        salt = base64.b64decode(salt_b64)
-        expected = base64.b64decode(hash_b64)
-        derived = hashlib.scrypt(
-            password.encode(),
-            salt=salt,
-            n=n_int,
-            r=r_int,
-            p=p_int,
-            dklen=len(expected),
-        )
-    except (ValueError, TypeError):
-        return False
-    return hmac.compare_digest(derived, expected)

routstr/core/version.py

@@ -1,81 +0,0 @@
-"""Application version resolution.
-
-Priority order:
-
-1. ``VERSION_SUFFIX`` env var (manual override; preserves prior behaviour).
-2. Bare base version when HEAD is on the matching release tag (detected via
-   ``GIT_TAG`` env or ``git describe --tags --exact-match HEAD``).
-3. ``GIT_COMMIT`` env var (build-time injection) -> ``<base>+g<sha>``.
-4. Local ``.git`` lookup (source checkouts) -> ``<base>+g<sha>``.
-5. Fallback: bare base version.
-
-The ``+g<sha>`` form is PEP 440 local-version syntax so the result remains a
-valid package version.
-"""
-
-from __future__ import annotations
-
-import os
-import subprocess
-from functools import lru_cache
-from pathlib import Path
-
-BASE_VERSION = "0.4.4"
-
-_REPO_ROOT = Path(__file__).resolve().parents[2]
-_GIT_TIMEOUT_SECONDS = 2.0
-
-
-def _run_git(*args: str) -> str | None:
-    try:
-        result = subprocess.run(  # noqa: S603 - fixed argv, no shell
-            ["git", *args],
-            cwd=_REPO_ROOT,
-            check=False,
-            capture_output=True,
-            text=True,
-            timeout=_GIT_TIMEOUT_SECONDS,
-        )
-    except (FileNotFoundError, subprocess.SubprocessError, OSError):
-        return None
-    if result.returncode != 0:
-        return None
-    return result.stdout.strip() or None
-
-
-def _git_short_sha() -> str | None:
-    sha = os.getenv("GIT_COMMIT", "").strip()
-    if sha:
-        return sha[:7]
-    return _run_git("rev-parse", "--short=7", "HEAD")
-
-
-def _on_tagged_release() -> bool:
-    tag = os.getenv("GIT_TAG", "").strip()
-    if tag:
-        return tag.lstrip("v") == BASE_VERSION
-    described = _run_git("describe", "--tags", "--exact-match", "HEAD")
-    if described and described.lstrip("v") == BASE_VERSION:
-        return True
-    return False
-
-
-@lru_cache(maxsize=1)
-def get_version() -> str:
-    suffix = os.getenv("VERSION_SUFFIX")
-    if suffix is not None:
-        return f"{BASE_VERSION}-{suffix}"
-
-    if _on_tagged_release():
-        return BASE_VERSION
-
-    sha = _git_short_sha()
-    if not sha:
-        return BASE_VERSION
-
-    return f"{BASE_VERSION}+g{sha}"
-
-
-__version__ = get_version()
-
-__all__ = ["BASE_VERSION", "__version__", "get_version"]

routstr/discovery.py

@@ -8,8 +8,8 @@ import httpx
 import websockets
 from fastapi import APIRouter, HTTPException
 
-from ..core.logging import get_logger
-from ..core.settings import settings
+from .core.logging import get_logger
+from .core.settings import settings
 
 logger = get_logger(__name__)
 
@@ -72,6 +72,8 @@ async def query_nostr_relay_for_providers(
                     elif data[0] == "NOTICE":
                         try:
                             msg = str(data[1])
+                            if len(msg) > 200:
+                                msg = msg[:200] + "..."
                             logger.debug(f"Relay notice: {msg}")
                         except Exception:
                             logger.debug("Relay notice received")

routstr/lightning.py

@@ -1,14 +1,13 @@
-import asyncio
 import hashlib
 import secrets
 import time
 
-from fastapi import APIRouter, Depends, Header, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, Field
-from sqlmodel import col, select
+from sqlmodel import select
 from sqlmodel.ext.asyncio.session import AsyncSession
 
-from .core.db import ApiKey, LightningInvoice, create_session, get_session
+from .core.db import ApiKey, LightningInvoice, get_session
 from .core.logging import get_logger
 from .core.settings import settings
 from .wallet import get_wallet
@@ -20,27 +19,10 @@ lightning_router = APIRouter(prefix="/lightning")
 
 class InvoiceCreateRequest(BaseModel):
     amount_sats: int = Field(gt=0, le=1_000_000, description="Amount in satoshis")
-    purpose: str = Field(
-        default="create",
-        description="create or topup",
-        pattern="^(create|topup)$",
-    )
+    purpose: str = Field(description="create or topup", pattern="^(create|topup)$")
     api_key: str | None = Field(
-        default=None,
-        description="Deprecated: legacy field for topup. Prefer Authorization header.",
+        default=None, description="Required for topup operations"
     )
-    balance_limit: int | None = Field(default=None)
-    balance_limit_reset: str | None = Field(default=None)
-    validity_date: int | None = Field(default=None)
-
-
-def _extract_bearer_api_key(authorization: str | None) -> str | None:
-    if not authorization:
-        return None
-    token = authorization.strip()
-    if token.lower().startswith("bearer "):
-        token = token[7:].strip()
-    return token or None
 
 
 class InvoiceCreateResponse(BaseModel):
@@ -79,21 +61,18 @@ def generate_invoice_id() -> str:
 @lightning_router.post("/invoice", response_model=InvoiceCreateResponse)
 async def create_invoice(
     request: InvoiceCreateRequest,
-    authorization: str | None = Header(default=None),
     session: AsyncSession = Depends(get_session),
 ) -> InvoiceCreateResponse:
-    api_key_token = _extract_bearer_api_key(authorization) or request.api_key
+    if request.purpose == "topup" and not request.api_key:
+        raise HTTPException(
+            status_code=400, detail="api_key is required for topup operations"
+        )
 
-    if request.purpose == "topup":
-        if not api_key_token:
-            raise HTTPException(
-                status_code=401,
-                detail="Authorization bearer api key is required for topup",
-            )
-        if not api_key_token.startswith("sk-"):
+    if request.purpose == "topup" and request.api_key:
+        if not request.api_key.startswith("sk-"):
             raise HTTPException(status_code=400, detail="Invalid API key format")
 
-        api_key = await session.get(ApiKey, api_key_token[3:])
+        api_key = await session.get(ApiKey, request.api_key[3:])
         if not api_key:
             raise HTTPException(status_code=404, detail="API key not found")
 
@@ -113,11 +92,8 @@ async def create_invoice(
             description=description,
             payment_hash=payment_hash,
             status="pending",
-            api_key_hash=api_key_token[3:] if api_key_token else None,
+            api_key_hash=request.api_key[3:] if request.api_key else None,
             purpose=request.purpose,
-            balance_limit=request.balance_limit,
-            balance_limit_reset=request.balance_limit_reset,
-            validity_date=request.validity_date,
             expires_at=expires_at,
         )
 
@@ -160,13 +136,13 @@ async def get_invoice_status(
     if not invoice:
         raise HTTPException(status_code=404, detail="Invoice not found")
 
-    if invoice.status == "pending":
-        await check_invoice_payment(invoice, session)
-
     if invoice.status == "pending" and int(time.time()) > invoice.expires_at:
         invoice.status = "expired"
         await session.commit()
 
+    if invoice.status == "pending":
+        await check_invoice_payment(invoice, session)
+
     api_key = None
     if invoice.status == "paid" and invoice.purpose == "create":
         if invoice.api_key_hash:
@@ -269,9 +245,6 @@ async def create_api_key_from_invoice(
         balance=invoice.amount_sats * 1000,  # Convert to msats
         refund_currency="sat",
         refund_mint_url=settings.primary_mint,
-        balance_limit=invoice.balance_limit,
-        balance_limit_reset=invoice.balance_limit_reset,
-        validity_date=invoice.validity_date,
     )
 
     session.add(api_key)
@@ -295,41 +268,3 @@ async def topup_api_key_from_invoice(
 
     api_key.balance += invoice.amount_sats * 1000  # Convert to msats
     await session.flush()
-
-
-INVOICE_WATCH_INTERVAL_SECONDS = 5
-INVOICE_WATCH_BATCH_LIMIT = 100
-
-
-async def periodic_invoice_watcher() -> None:
-    """Background task: detect paid Lightning invoices and credit balances.
-
-    Removes the need for clients to poll the status endpoint after paying.
-    """
-    while True:
-        try:
-            async with create_session() as session:
-                now = int(time.time())
-                result = await session.exec(
-                    select(LightningInvoice)
-                    .where(
-                        LightningInvoice.status == "pending",
-                        col(LightningInvoice.expires_at) > now,
-                    )
-                    .limit(INVOICE_WATCH_BATCH_LIMIT)
-                )
-                pending = result.all()
-                for invoice in pending:
-                    try:
-                        await check_invoice_payment(invoice, session)
-                    except Exception as e:
-                        logger.error(
-                            "Invoice watcher failed for invoice",
-                            extra={"invoice_id": invoice.id, "error": str(e)},
-                        )
-        except asyncio.CancelledError:
-            raise
-        except Exception as e:
-            logger.error(f"Invoice watcher loop error: {e}")
-
-        await asyncio.sleep(INVOICE_WATCH_INTERVAL_SECONDS)

routstr/nip91.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Listing: Routstr Provider Discoverability Implementation
+NIP-91: Routstr Provider Discoverability Implementation
 Automatically announces this Routstr proxy instance to Nostr relays.
 """
 
@@ -18,15 +18,15 @@ from nostr.key import PrivateKey
 from nostr.message_type import ClientMessageType
 from nostr.relay_manager import RelayManager
 
-from ..core import get_logger
-from ..core.settings import settings
+from .core import get_logger
+from .core.settings import settings
 
 logger = get_logger(__name__)
 
 
 def get_app_version() -> str | None:
     try:
-        from ..core.version import __version__ as imported_version
+        from .core.main import __version__ as imported_version
 
         return imported_version
     except Exception:
@@ -71,7 +71,7 @@ def nsec_to_keypair(nsec: str) -> tuple[str, str] | None:
         return None
 
 
-def create_listing_event(
+def create_nip91_event(
     private_key_hex: str,
     provider_id: str,
     endpoint_urls: list[str],
@@ -80,7 +80,7 @@ def create_listing_event(
     metadata: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """
-    Create a listing provider announcement event (kind:38421).
+    Create a NIP-91 compliant provider announcement event (kind:38421).
 
     Args:
         private_key_hex: 32-byte hex private key for signing
@@ -164,14 +164,14 @@ def events_semantically_equal(a: dict[str, Any], b: dict[str, Any]) -> bool:
     return True
 
 
-async def query_listing_events(
+async def query_nip91_events(
     relay_url: str,
     pubkey: str,
     provider_id: str | None = None,
     timeout: int = 30,
 ) -> tuple[list[dict[str, Any]], bool]:
     """
-    Query a Nostr relay for listing provider announcements (kind:38421) via nostr library.
+    Query a Nostr relay for NIP-91 provider announcements (kind:38421) via nostr library.
 
     Returns a tuple of (events, ok) where ok indicates whether the relay interaction
     succeeded without transport-level errors.
@@ -188,7 +188,7 @@ async def query_listing_events(
 
             flt = Filter(kinds=[38421], authors=[pubkey], limit=10)
             filters = Filters([flt])
-            sub_id = f"routstr_listing_{int(time.time())}"
+            sub_id = f"nip91_{int(time.time())}"
             rm.add_subscription(sub_id, filters)
             req: list[Any] = [ClientMessageType.REQUEST, sub_id]
             req.extend(filters.to_json_array())
@@ -294,7 +294,7 @@ async def _determine_provider_id(public_key_hex: str, relay_urls: list[str]) ->
 
     async def query_single_relay(relay_url: str) -> list[dict[str, Any]]:
         try:
-            events, _ok = await query_listing_events(relay_url, public_key_hex, None)
+            events, _ok = await query_nip91_events(relay_url, public_key_hex, None)
             return events
         except Exception:
             return []
@@ -330,7 +330,7 @@ async def publish_to_relay(
     timeout: int = 30,
 ) -> bool:
     """
-    Publish a listing event to a nostr relay via nostr library.
+    Publish a NIP-91 event to a nostr relay via nostr library.
     """
 
     def _sync_publish() -> bool:
@@ -341,7 +341,7 @@ async def publish_to_relay(
             time.sleep(1.0)
             # Publish the event as-is via publish_message to preserve signature
             rm.publish_message(json.dumps(["EVENT", event]))
-            logger.debug(f"Sent listing event {event.get('id', '')} to {relay_url}")
+            logger.debug(f"Sent NIP-91 event {event.get('id', '')} to {relay_url}")
             time.sleep(1.0)
             return True
         except Exception as e:
@@ -364,13 +364,13 @@ async def announce_provider() -> None:
     # Check for NSEC in environment (use NSEC only)
     nsec = settings.nsec
     if not nsec:
-        logger.info("Nostr private key not found (NSEC), skipping listing announcement")
+        logger.info("Nostr private key not found (NSEC), skipping NIP-91 announcement")
         return
 
     # Convert NSEC to keypair
     keypair = nsec_to_keypair(nsec)
     if not keypair:
-        logger.error("Failed to parse NSEC, skipping listing announcement")
+        logger.error("Failed to parse NSEC, skipping NIP-91 announcement")
         return
 
     private_key_hex, public_key_hex = keypair
@@ -409,7 +409,7 @@ async def announce_provider() -> None:
 
     if not endpoint_urls:
         logger.warning(
-            "No valid endpoints configured (HTTP_URL/ONION_URL). Skipping listing publish."
+            "No valid endpoints configured (HTTP_URL/ONION_URL). Skipping NIP-91 publish."
         )
         return
 
@@ -434,7 +434,7 @@ async def announce_provider() -> None:
 
     # Create the candidate event that we would publish
     version_str = get_app_version()
-    candidate_event = create_listing_event(
+    candidate_event = create_nip91_event(
         private_key_hex=private_key_hex,
         provider_id=provider_id,
         endpoint_urls=endpoint_urls,
@@ -474,7 +474,7 @@ async def announce_provider() -> None:
         if _should_skip(relay_url):
             logger.debug(f"Skipping {relay_url} due to backoff")
             continue
-        events, ok = await query_listing_events(relay_url, public_key_hex, provider_id)
+        events, ok = await query_nip91_events(relay_url, public_key_hex, provider_id)
         if ok:
             _register_success(relay_url)
             existing_events.extend(events)
@@ -489,7 +489,7 @@ async def announce_provider() -> None:
 
     if not all_match:
         logger.debug(
-            "No matching listing announcement found or differences detected; publishing update"
+            "No matching NIP-91 announcement found or differences detected; publishing update"
         )
         success_count = 0
         for relay_url in relay_urls:
@@ -502,11 +502,11 @@ async def announce_provider() -> None:
             else:
                 _register_failure(relay_url)
         logger.info(
-            f"Published listing announcement to {success_count}/{len(relay_urls)} relays"
+            f"Published NIP-91 announcement to {success_count}/{len(relay_urls)} relays"
         )
     else:
         logger.debug(
-            "Matching listing announcement already present; skipping publish on startup"
+            "Matching NIP-91 announcement already present; skipping publish on startup"
         )
 
     # Re-announce periodically (every 24 hours)
@@ -518,7 +518,7 @@ async def announce_provider() -> None:
 
             # Build fresh candidate event for comparison
             version_str = get_app_version()
-            candidate_event = create_listing_event(
+            candidate_event = create_nip91_event(
                 private_key_hex=private_key_hex,
                 provider_id=provider_id,
                 endpoint_urls=endpoint_urls,
@@ -533,7 +533,7 @@ async def announce_provider() -> None:
                 if _should_skip(relay_url):
                     logger.debug(f"Skipping {relay_url} due to backoff")
                     continue
-                events, ok = await query_listing_events(
+                events, ok = await query_nip91_events(
                     relay_url, public_key_hex, provider_id
                 )
                 if ok:
@@ -549,7 +549,7 @@ async def announce_provider() -> None:
 
             if all_match:
                 logger.debug(
-                    "Matching listing announcement already present; skipping periodic re-announce"
+                    "Matching NIP-91 announcement already present; skipping periodic re-announce"
                 )
                 continue
 
@@ -567,8 +567,8 @@ async def announce_provider() -> None:
                     _register_failure(relay_url)
 
         except asyncio.CancelledError:
-            logger.info("Listing announcement task cancelled")
+            logger.info("NIP-91 announcement task cancelled")
             break
         except Exception as e:
-            logger.debug(f"Error in listing announcement loop: {type(e).__name__}")
+            logger.debug(f"Error in NIP-91 announcement loop: {type(e).__name__}")
             # Continue running despite errors

routstr/nostr/__init__.py

@@ -1,5 +0,0 @@
-from .analytics import publish_usage_analytics
-from .discovery import providers_cache_refresher
-from .listing import announce_provider
-
-__all__ = ["providers_cache_refresher", "announce_provider", "publish_usage_analytics"]

routstr/nostr/analytics.py

@@ -1,419 +0,0 @@
-#!/usr/bin/env python3
-"""
-Nostr usage analytics publisher.
-Publishes a single replaceable analytics snapshot for each provider.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import hashlib
-import json
-import time
-from typing import Any
-
-from nostr.event import Event
-from nostr.key import PrivateKey
-
-from ..core import get_logger
-from ..core.log_manager import log_manager
-from ..core.settings import settings
-from .listing import nsec_to_keypair, publish_to_relay
-
-logger = get_logger(__name__)
-
-ANALYTICS_KIND = 38422
-ANALYTICS_SCHEMA = "routstr.analytics.snapshot.v1"
-DEFAULT_RELAYS = [
-    "wss://relay.nostr.band",
-    "wss://relay.damus.io",
-    "wss://relay.routstr.com",
-    "wss://nos.lol",
-]
-PUBLISH_INTERVAL_SECONDS = 15 * 60
-DISABLED_POLL_SECONDS = 60
-DASHBOARD_WINDOW_HOURS = 24
-DASHBOARD_INTERVAL_MINUTES = 60
-MODEL_LIMIT = 20
-WINDOW_DEFINITIONS: tuple[tuple[str, int, int], ...] = (
-    ("24h", 24, 60),
-    ("7d", 7 * 24, 6 * 60),
-    ("30d", 30 * 24, 24 * 60),
-    ("3m", 90 * 24, 24 * 60),
-    ("1y", 365 * 24, 7 * 24 * 60),
-)
-
-
-def _event_to_dict(ev: Event) -> dict[str, Any]:
-    return {
-        "id": ev.id,
-        "pubkey": ev.public_key,
-        "created_at": ev.created_at,
-        "kind": int(ev.kind) if not isinstance(ev.kind, int) else ev.kind,
-        "tags": ev.tags,
-        "content": ev.content,
-        "sig": ev.signature,
-    }
-
-
-def _resolve_provider_id(public_key_hex: str) -> str:
-    explicit_provider_id = (settings.provider_id or "").strip()
-    if explicit_provider_id:
-        return explicit_provider_id
-    return public_key_hex[:12]
-
-
-def _resolve_endpoint_urls() -> list[str]:
-    urls: list[str] = []
-    http_url = (settings.http_url or "").strip()
-    onion_url = (settings.onion_url or "").strip()
-
-    if http_url and http_url != "http://localhost:8000":
-        urls.append(http_url)
-
-    if onion_url:
-        if onion_url.endswith(".onion") and not (
-            onion_url.startswith("http://") or onion_url.startswith("https://")
-        ):
-            onion_url = f"http://{onion_url}"
-        urls.append(onion_url)
-
-    return urls
-
-
-def _resolve_relays() -> list[str]:
-    configured = [url.strip() for url in settings.relays if url.strip()]
-    return configured if configured else list(DEFAULT_RELAYS)
-
-
-def _to_int(value: Any) -> int:
-    if isinstance(value, bool):
-        return int(value)
-    if isinstance(value, int):
-        return value
-    if isinstance(value, float):
-        return int(value)
-    if isinstance(value, str):
-        try:
-            return int(float(value))
-        except ValueError:
-            return 0
-    return 0
-
-
-def _to_float(value: Any) -> float:
-    if isinstance(value, bool):
-        return float(int(value))
-    if isinstance(value, (int, float)):
-        return float(value)
-    if isinstance(value, str):
-        try:
-            return float(value)
-        except ValueError:
-            return 0.0
-    return 0.0
-
-
-def _aggregate_top_model_usage(
-    model_usage_mix: dict[str, Any],
-) -> tuple[list[dict[str, Any]], dict[str, Any]]:
-    top_models_raw = model_usage_mix.get("top_models", [])
-    mix_metrics_raw = model_usage_mix.get("metrics", [])
-
-    top_models = [model for model in top_models_raw if isinstance(model, str)]
-    metrics = [row for row in mix_metrics_raw if isinstance(row, dict)]
-
-    model_totals: dict[str, dict[str, float | int]] = {
-        model: {
-            "successful_requests": 0,
-            "revenue_msats": 0.0,
-            "total_tokens": 0,
-        }
-        for model in top_models
-    }
-    others = {
-        "successful_requests": 0,
-        "revenue_msats": 0.0,
-        "total_tokens": 0,
-    }
-
-    for metric in metrics:
-        model_counts = metric.get("model_counts", {})
-        model_revenue = metric.get("model_revenue_msats", {})
-        model_tokens = metric.get("model_tokens", {})
-
-        if isinstance(model_counts, dict):
-            for model, count in model_counts.items():
-                if model in model_totals:
-                    model_totals[model]["successful_requests"] += _to_int(count)
-
-        if isinstance(model_revenue, dict):
-            for model, amount in model_revenue.items():
-                if model in model_totals:
-                    model_totals[model]["revenue_msats"] += _to_float(amount)
-
-        if isinstance(model_tokens, dict):
-            for model, token_count in model_tokens.items():
-                if model in model_totals:
-                    model_totals[model]["total_tokens"] += _to_int(token_count)
-
-        others["successful_requests"] += _to_int(metric.get("others", 0))
-        others["revenue_msats"] += _to_float(metric.get("others_revenue_msats", 0.0))
-        others["total_tokens"] += _to_int(metric.get("others_tokens", 0))
-
-    model_rows = [
-        {
-            "model": model,
-            "successful_requests": int(values["successful_requests"]),
-            "revenue_msats": float(values["revenue_msats"]),
-            "total_tokens": int(values["total_tokens"]),
-        }
-        for model, values in model_totals.items()
-    ]
-    model_rows.sort(
-        key=lambda row: _to_int(row.get("successful_requests", 0)),
-        reverse=True,
-    )
-
-    return model_rows, others
-
-
-def _build_summary_payload(summary: dict[str, Any]) -> dict[str, Any]:
-    return {
-        "total_requests": _to_int(summary.get("total_requests", 0)),
-        "successful_chat_completions": _to_int(
-            summary.get("successful_chat_completions", 0)
-        ),
-        "failed_requests": _to_int(summary.get("failed_requests", 0)),
-        "success_rate": _to_float(summary.get("success_rate", 0.0)),
-        "unique_models_count": _to_int(summary.get("unique_models_count", 0)),
-        "input_tokens": _to_int(summary.get("input_tokens", 0)),
-        "output_tokens": _to_int(summary.get("output_tokens", 0)),
-        "total_tokens": _to_int(summary.get("total_tokens", 0)),
-        "revenue_msats": _to_float(summary.get("revenue_msats", 0.0)),
-        "refunds_msats": _to_float(summary.get("refunds_msats", 0.0)),
-        "net_revenue_msats": _to_float(summary.get("net_revenue_msats", 0.0)),
-        "revenue_sats": _to_float(summary.get("revenue_sats", 0.0)),
-        "refunds_sats": _to_float(summary.get("refunds_sats", 0.0)),
-        "net_revenue_sats": _to_float(summary.get("net_revenue_sats", 0.0)),
-    }
-
-
-def _build_window_payload(
-    *,
-    hours: int,
-    interval_minutes: int,
-    model_limit: int,
-) -> dict[str, Any]:
-    dashboard = log_manager.get_usage_dashboard(
-        interval=interval_minutes,
-        hours=hours,
-        error_limit=1,
-        model_limit=model_limit,
-    )
-
-    summary = dashboard.get("summary", {})
-    model_usage_mix = dashboard.get("model_usage_mix", {})
-
-    summary_payload = _build_summary_payload(summary if isinstance(summary, dict) else {})
-    usage_mix_payload = model_usage_mix if isinstance(model_usage_mix, dict) else {}
-    top_model_usage, others_usage = _aggregate_top_model_usage(usage_mix_payload)
-
-    return {
-        "window_hours": hours,
-        "interval_minutes": interval_minutes,
-        "summary": summary_payload,
-        "model_usage_mix": usage_mix_payload,
-        "top_model_usage": top_model_usage,
-        "others_usage": others_usage,
-    }
-
-
-def build_stats_snapshot_payload(
-    provider_id: str,
-    *,
-    public_key_hex: str,
-    generated_at: int,
-    window_hours: int = DASHBOARD_WINDOW_HOURS,
-    interval_minutes: int = DASHBOARD_INTERVAL_MINUTES,
-    model_limit: int = MODEL_LIMIT,
-) -> dict[str, Any]:
-    _ = (window_hours, interval_minutes)
-    windows: dict[str, dict[str, Any]] = {}
-    for key, hours, window_interval_minutes in WINDOW_DEFINITIONS:
-        windows[key] = _build_window_payload(
-            hours=hours,
-            interval_minutes=window_interval_minutes,
-            model_limit=model_limit,
-        )
-
-    primary_window = windows.get("24h", {})
-    summary_payload = (
-        primary_window.get("summary", {})
-        if isinstance(primary_window.get("summary", {}), dict)
-        else {}
-    )
-    usage_mix_payload = (
-        primary_window.get("model_usage_mix", {})
-        if isinstance(primary_window.get("model_usage_mix", {}), dict)
-        else {}
-    )
-    top_model_usage = (
-        primary_window.get("top_model_usage", [])
-        if isinstance(primary_window.get("top_model_usage", []), list)
-        else []
-    )
-    others_usage = (
-        primary_window.get("others_usage", {})
-        if isinstance(primary_window.get("others_usage", {}), dict)
-        else {}
-    )
-
-    return {
-        "schema": ANALYTICS_SCHEMA,
-        "generated_at": generated_at,
-        "provider_id": provider_id,
-        "pubkey": public_key_hex,
-        "npub": settings.npub or "",
-        "endpoint_urls": _resolve_endpoint_urls(),
-        "window_hours": DASHBOARD_WINDOW_HOURS,
-        "interval_minutes": DASHBOARD_INTERVAL_MINUTES,
-        "summary": summary_payload,
-        "model_usage_mix": usage_mix_payload,
-        "top_model_usage": top_model_usage,
-        "others_usage": others_usage,
-        "windows": windows,
-    }
-
-
-def create_stats_snapshot_event(
-    private_key_hex: str,
-    provider_id: str,
-    payload_json: str,
-    *,
-    d_tag: str,
-) -> dict[str, Any]:
-    private_key = PrivateKey(bytes.fromhex(private_key_hex))
-    tags = [
-        ["d", d_tag],
-        ["provider", provider_id],
-        ["schema", ANALYTICS_SCHEMA],
-    ]
-
-    event = Event(
-        public_key=private_key.public_key.hex(),
-        content=payload_json,
-        kind=ANALYTICS_KIND,
-        tags=tags,
-    )
-    private_key.sign_event(event)
-    return _event_to_dict(event)
-
-
-def _fingerprint_payload(payload: dict[str, Any]) -> str:
-    normalized = dict(payload)
-    # Ignore generated timestamp for semantic dedupe.
-    normalized.pop("generated_at", None)
-    payload_json = json.dumps(normalized, separators=(",", ":"), sort_keys=True)
-    return hashlib.sha256(payload_json.encode("utf-8")).hexdigest()
-
-
-async def publish_usage_analytics() -> None:
-    last_payload_hash: str | None = None
-
-    parsed_nsec: str | None = None
-    private_key_hex: str | None = None
-    public_key_hex: str | None = None
-    provider_id: str | None = None
-    warned_missing_nsec = False
-
-    logger.info("Usage analytics sharing task started")
-
-    while True:
-        try:
-            if not settings.enable_analytics_sharing:
-                await asyncio.sleep(DISABLED_POLL_SECONDS)
-                continue
-
-            nsec = (settings.nsec or "").strip()
-            if not nsec:
-                if not warned_missing_nsec:
-                    logger.info("NSEC is not configured; skipping analytics sharing to Nostr")
-                    warned_missing_nsec = True
-                await asyncio.sleep(DISABLED_POLL_SECONDS)
-                continue
-
-            warned_missing_nsec = False
-            if nsec != parsed_nsec or private_key_hex is None or public_key_hex is None:
-                keypair = nsec_to_keypair(nsec)
-                if not keypair:
-                    logger.error("Invalid NSEC; analytics sharing is paused")
-                    await asyncio.sleep(DISABLED_POLL_SECONDS)
-                    continue
-                private_key_hex, public_key_hex = keypair
-                parsed_nsec = nsec
-                provider_id = _resolve_provider_id(public_key_hex)
-                last_payload_hash = None
-
-            if private_key_hex is None or public_key_hex is None:
-                await asyncio.sleep(DISABLED_POLL_SECONDS)
-                continue
-
-            relay_urls = _resolve_relays()
-            if not relay_urls:
-                logger.warning("No Nostr relays configured; analytics sharing skipped")
-                await asyncio.sleep(DISABLED_POLL_SECONDS)
-                continue
-
-            resolved_provider_id = provider_id or _resolve_provider_id(public_key_hex)
-            now_ts = int(time.time())
-            payload = build_stats_snapshot_payload(
-                resolved_provider_id,
-                public_key_hex=public_key_hex,
-                generated_at=now_ts,
-            )
-
-            payload_hash = _fingerprint_payload(payload)
-            if last_payload_hash == payload_hash:
-                await asyncio.sleep(PUBLISH_INTERVAL_SECONDS)
-                continue
-
-            payload_json = json.dumps(payload, separators=(",", ":"), sort_keys=True)
-            d_tag = f"{resolved_provider_id}:stats"
-            event = create_stats_snapshot_event(
-                private_key_hex,
-                resolved_provider_id,
-                payload_json,
-                d_tag=d_tag,
-            )
-
-            success_count = 0
-            for relay_url in relay_urls:
-                if await publish_to_relay(relay_url, event):
-                    success_count += 1
-
-            if success_count > 0:
-                last_payload_hash = payload_hash
-
-            logger.info(
-                "Published analytics snapshot (success=%s/%s provider=%s)",
-                success_count,
-                len(relay_urls),
-                resolved_provider_id,
-                extra={
-                    "relay_success_count": success_count,
-                    "relay_total": len(relay_urls),
-                    "provider_id": resolved_provider_id,
-                },
-            )
-            await asyncio.sleep(PUBLISH_INTERVAL_SECONDS)
-
-        except asyncio.CancelledError:
-            logger.info("Usage analytics sharing task cancelled")
-            break
-        except Exception as e:
-            logger.error(
-                "Usage analytics sharing error",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-            await asyncio.sleep(DISABLED_POLL_SECONDS)

routstr/payment/cost_calculation.py

@@ -1,23 +1,11 @@
 import math
-from typing import TYPE_CHECKING
 
 from pydantic.v1 import BaseModel
 
 from ..core import get_logger
+from ..core.db import AsyncSession
 from ..core.settings import settings
 from .price import sats_usd_price
-from .usage import normalize_usage, parse_token_count
-
-if TYPE_CHECKING:
-    from .models import Model
-
-__all__ = [
-    "CostData",
-    "CostDataError",
-    "MaxCostData",
-    "calculate_cost",
-    "parse_token_count",
-]
 
 logger = get_logger(__name__)
 
@@ -28,12 +16,6 @@ class CostData(BaseModel):
     output_msats: int
     total_msats: int
     total_usd: float = 0.0
-    input_tokens: int = 0
-    output_tokens: int = 0
-    cache_read_input_tokens: int = 0
-    cache_creation_input_tokens: int = 0
-    cache_read_msats: int = 0
-    cache_creation_msats: int = 0
 
 
 class MaxCostData(CostData):
@@ -45,54 +27,18 @@ class CostDataError(BaseModel):
     code: str
 
 
-def _empty_cost(cls: type[CostData] = CostData) -> CostData:
-    """Build an all-zero cost object — a full refund for an empty response.
-
-    Shared by the two paths that must not bill: an upstream response with no
-    usage data at all, and one that reports a USD cost but carries zero tokens
-    in every bucket.
-    """
-    return cls(
-        base_msats=0,
-        input_msats=0,
-        output_msats=0,
-        total_msats=0,
-        total_usd=0.0,
-        input_tokens=0,
-        output_tokens=0,
-        cache_read_input_tokens=0,
-        cache_creation_input_tokens=0,
-        cache_read_msats=0,
-        cache_creation_msats=0,
-    )
-
-
-async def calculate_cost(
-    response_data: dict,
-    max_cost: int,
-    model_obj: "Model | None" = None,
-    provider_fee: float | None = None,
+async def calculate_cost(  # todo: can be sync
+    response_data: dict, max_cost: int, session: AsyncSession
 ) -> CostData | MaxCostData | CostDataError:
-    """Calculate the cost of an API request based on token usage.
+    """
+    Calculate the cost of an API request based on token usage.
 
     Args:
         response_data: Response data containing usage information
         max_cost: Maximum cost in millisats
-        model_obj: The model that actually served the request. When given,
-            its pricing is billed directly; without it, pricing is re-derived
-            from the response's model string via the alias map, which resolves
-            to the best-ranked candidate — not necessarily the serving one.
-        provider_fee: The serving provider's fee multiplier, applied on the
-            USD-cost path and the litellm pricing fallback (configured model
-            pricing already carries the fee baked in). Without it, the fee is
-            re-derived from the response's model string, which yields the
-            best-ranked provider's fee.
 
     Returns:
         Cost data or error information
-
-    The response's usage object is normalized with the default union parser;
-    this function holds no vendor-dialect knowledge of its own.
     """
     logger.debug(
         "Starting cost calculation",
@@ -103,96 +49,61 @@ async def calculate_cost(
         },
     )
 
-    usage = normalize_usage(response_data.get("usage"))
-
-    if usage is None:
+    if "usage" not in response_data or response_data["usage"] is None:
         logger.warning(
-            "No usage data in response — billing at MaxCostData with zero "
-            "tokens. Dashboard will show this request as `(0+0)`. Most "
-            "common cause: upstream stream did not include a final usage "
-            "chunk (OpenAI-compat backends require "
-            "`stream_options.include_usage=true`).",
+            "No usage data in response, using base cost only",
             extra={
                 "max_cost_msats": max_cost,
                 "model": response_data.get("model", "unknown"),
-                "response_keys": sorted(response_data.keys())
-                if isinstance(response_data, dict)
-                else None,
             },
         )
-        return _empty_cost(MaxCostData)
-
-    usage_data = response_data.get("usage") or {}
-    if not isinstance(usage_data, dict):
-        usage_data = {}
-
-    input_tokens = usage.input_tokens
-    output_tokens = usage.output_tokens
-    cache_read_tokens = usage.cache_read_tokens
-    cache_creation_tokens = usage.cache_write_tokens
-
-    # Try USD cost first
-    usd_cost = _resolve_usd_cost(usage_data, response_data)
-    if usd_cost > 0:
-        truly_empty = (
-            input_tokens == 0
-            and output_tokens == 0
-            and cache_read_tokens == 0
-            and cache_creation_tokens == 0
+        return MaxCostData(
+            base_msats=0,
+            input_msats=0,
+            output_msats=0,
+            total_msats=0,
+            total_usd=0.0,
         )
-        if truly_empty:
-            logger.warning(
-                "Upstream reported a USD cost but the response carries no "
-                "tokens at all (input, output, cache-read and cache-creation "
-                "are all zero) — refunding in full rather than billing the "
-                "USD-derived cost for an empty response.",
-                extra={
-                    "model": response_data.get("model", "unknown"),
-                    "usd_cost": usd_cost,
-                    "usage_keys": sorted(usage_data.keys())
-                    if isinstance(usage_data, dict)
-                    else None,
-                },
-            )
-            return _empty_cost()
-        if input_tokens == 0 and output_tokens == 0:
-            logger.warning(
-                "Upstream reported a USD cost but no token counts — "
-                "billing the USD-derived cost while the dashboard will "
-                "show this request as `(0+0)` tokens. Check that the "
-                "upstream actually emits `usage.input_tokens` and "
-                "`usage.output_tokens` (OpenAI-compat streams require "
-                "`stream_options.include_usage=true`).",
-                extra={
-                    "model": response_data.get("model", "unknown"),
-                    "usd_cost": usd_cost,
-                    "usage_keys": sorted(usage_data.keys())
-                    if isinstance(usage_data, dict)
-                    else None,
-                },
-            )
+
+    usage_data = response_data["usage"]
+
+    usd_cost = 0.0
+
+    # Prioritize cost_details.upstream_inference_cost
+    if "cost_details" in usage_data:
+        usd_cost = float(
+            usage_data["cost_details"].get("upstream_inference_cost", 0) or 0
+        )
+
+    # Fallback to cost field if upstream_inference_cost is 0
+    if usd_cost == 0 and "cost" in usage_data:
         try:
-            cost_details = usage_data.get("cost_details", {})
-            if not isinstance(cost_details, dict):
-                cost_details = {}
-            input_usd = _coerce_usd(
-                cost_details.get("input_cost")
-                or cost_details.get("upstream_inference_prompt_cost")
+            usd_cost = float(usage_data.get("cost", 0) or 0)
+        except Exception:
+            pass
+
+    if usd_cost > 0:
+        try:
+            sats_per_usd = 1.0 / sats_usd_price()
+            cost_in_sats = usd_cost * sats_per_usd
+            cost_in_msats = math.ceil(cost_in_sats * 1000)
+
+            logger.info(
+                "Using cost from usage data/details",
+                extra={
+                    "usd_cost": usd_cost,
+                    "cost_in_sats": cost_in_sats,
+                    "cost_in_msats": cost_in_msats,
+                    "model": response_data.get("model", "unknown"),
+                },
             )
-            output_usd = _coerce_usd(
-                cost_details.get("output_cost")
-                or cost_details.get("upstream_inference_completions_cost")
-            )
-            return _calculate_from_usd_cost(
-                usd_cost,
-                input_usd,
-                output_usd,
-                input_tokens,
-                cache_read_tokens,
-                cache_creation_tokens,
-                output_tokens,
-                response_data,
-                provider_fee,
+
+            return CostData(
+                base_msats=-1,
+                input_msats=-1,  # Cost field doesn't break down by token type
+                output_msats=-1,
+                total_msats=cost_in_msats,
+                total_usd=usd_cost,
             )
         except Exception as e:
             logger.warning(
@@ -203,35 +114,69 @@ async def calculate_cost(
                     "model": response_data.get("model", "unknown"),
                 },
             )
+            # Fall through to token-based calculation
 
-    # Fall back to token-based pricing
-    try:
-        pricing_rates = _get_pricing_rates(response_data, model_obj, provider_fee)
-    except ValueError as e:
-        return CostDataError(message=str(e), code="pricing_error")
+    MSATS_PER_1K_INPUT_TOKENS: float = (
+        float(settings.fixed_per_1k_input_tokens) * 1000.0
+    )
+    MSATS_PER_1K_OUTPUT_TOKENS: float = (
+        float(settings.fixed_per_1k_output_tokens) * 1000.0
+    )
 
-    if pricing_rates is None:
-        input_rate = float(settings.fixed_per_1k_input_tokens) * 1000.0
-        output_rate = float(settings.fixed_per_1k_output_tokens) * 1000.0
-        cache_read_rate = input_rate
-        cache_creation_rate = input_rate
-    else:
-        input_rate, output_rate, cache_read_rate, cache_creation_rate = pricing_rates
+    if not settings.fixed_pricing:
+        response_model = response_data.get("model", "")
+        logger.debug(
+            "Using model-based pricing",
+            extra={"model": response_model},
+        )
 
-    if not (input_rate and output_rate):
+        from ..proxy import get_model_instance
+
+        model_obj = get_model_instance(response_model)
+
+        if not model_obj:
+            logger.error(
+                "Invalid model in response",
+                extra={"response_model": response_model},
+            )
+            return CostDataError(
+                message=f"Invalid model in response: {response_model}",
+                code="model_not_found",
+            )
+
+        if not model_obj.sats_pricing:
+            logger.error(
+                "Model pricing not defined",
+                extra={"model": response_model, "model_id": response_model},
+            )
+            return CostDataError(
+                message="Model pricing not defined", code="pricing_not_found"
+            )
+
+        try:
+            mspp = float(model_obj.sats_pricing.prompt)
+            mspc = float(model_obj.sats_pricing.completion)
+        except Exception:
+            return CostDataError(message="Invalid pricing data", code="pricing_invalid")
+
+        MSATS_PER_1K_INPUT_TOKENS = mspp * 1_000_000.0
+        MSATS_PER_1K_OUTPUT_TOKENS = mspc * 1_000_000.0
+
+        logger.info(
+            "Applied model-specific pricing",
+            extra={
+                "model": response_model,
+                "input_price_msats_per_1k": MSATS_PER_1K_INPUT_TOKENS,
+                "output_price_msats_per_1k": MSATS_PER_1K_OUTPUT_TOKENS,
+            },
+        )
+
+    if not (MSATS_PER_1K_OUTPUT_TOKENS and MSATS_PER_1K_INPUT_TOKENS):
         logger.warning(
-            "No token pricing configured — billing at flat MaxCostData. "
-            "Token counts %s in the upstream response but cannot be "
-            "priced; the request will appear in dashboards with the "
-            "raw counts and a fixed max-cost charge.",
-            "are present"
-            if (input_tokens > 0 or output_tokens > 0)
-            else "are zero",
+            "No token pricing configured, using base cost",
             extra={
                 "base_cost_msats": max_cost,
                 "model": response_data.get("model", "unknown"),
-                "input_tokens": input_tokens,
-                "output_tokens": output_tokens,
             },
         )
         return MaxCostData(
@@ -239,297 +184,35 @@ async def calculate_cost(
             input_msats=0,
             output_msats=0,
             total_msats=max_cost,
-            input_tokens=input_tokens,
-            output_tokens=output_tokens,
-            cache_read_input_tokens=cache_read_tokens,
-            cache_creation_input_tokens=cache_creation_tokens,
-            cache_read_msats=0,
-            cache_creation_msats=0,
         )
 
-    return _calculate_from_tokens(
-        input_tokens,
-        output_tokens,
-        cache_read_tokens,
-        cache_creation_tokens,
-        input_rate,
-        output_rate,
-        cache_read_rate,
-        cache_creation_rate,
-        response_data,
+    input_tokens = usage_data.get("prompt_tokens", 0)
+    output_tokens = usage_data.get("completion_tokens", 0)
+
+    # added for response api
+    input_tokens = (
+        input_tokens if input_tokens != 0 else usage_data.get("input_tokens", 0)
+    )
+    output_tokens = (
+        output_tokens if output_tokens != 0 else usage_data.get("output_tokens", 0)
     )
 
-
-# ============================================================================
-# Helper Functions (ordered by call sequence in calculate_cost)
-# ============================================================================
-
-
-def _coerce_usd(value: object) -> float:
-    """Coerce a value to USD float, handling various formats safely."""
-    if value is None or isinstance(value, bool):
-        return 0.0
-    if not isinstance(value, (int, float, str)):
-        return 0.0
-    try:
-        return max(0.0, float(value))
-    except (TypeError, ValueError):
-        return 0.0
-
-
-def _resolve_usd_cost(usage_data: dict, response_data: dict) -> float:
-    """Resolve USD cost with clear priority order.
-
-    Priority:
-
-    1. ``cost_details.total_cost``
-    2. ``cost_details.upstream_inference_cost`` (BYOK — see below)
-    3. ``total_cost`` → ``cost`` (in both usage and response)
-
-    **BYOK path (PPQ.AI):** when ``is_byok`` is true the ``usage.cost`` field
-    is only a small (~5 %) routing fee, not the inference cost.  The real cost
-    lives in ``cost_details.upstream_inference_cost`` and the provider's
-    balance is debited by ``upstream_inference_cost + byok_fee``.  Billing just
-    the fee under-charges by ~20×.
-    """
-    cost_details = usage_data.get("cost_details")
-    if isinstance(cost_details, dict):
-        cost = _coerce_usd(cost_details.get("total_cost"))
-        if cost > 0:
-            return cost
-
-        # PPQ.AI BYOK: upstream_inference_cost is the real inference cost;
-        # usage.cost is only a ~5 % BYOK routing fee.  Bill the sum — what PPQ
-        # actually deducts from the balance.  For non-BYOK providers (e.g.
-        # OpenRouter) usage.cost already equals upstream_inference_cost, so we
-        # fall through to the normal ``cost`` lookup below.
-        upstream_cost = _coerce_usd(
-            cost_details.get("upstream_inference_cost")
-        )
-        if upstream_cost > 0 and usage_data.get("is_byok"):
-            byok_fee = _coerce_usd(usage_data.get("cost"))
-            return upstream_cost + byok_fee
-
-    for source in [usage_data, response_data]:
-        if not isinstance(source, dict):
-            continue
-        for field in ("total_cost", "cost"):
-            cost = _coerce_usd(source.get(field))
-            if cost > 0:
-                return cost
-
-    return 0.0
-
-
-def _get_pricing_rates(
-    response_data: dict,
-    model_obj: "Model | None",
-    provider_fee: float | None,
-) -> tuple[float, float, float, float] | None:
-    """Get configured rates, falling back to LiteLLM's model cost map.
-
-    The served ``model_obj`` (when the caller has it) is billed directly;
-    otherwise the response's model string is resolved through the alias map,
-    which yields the best-ranked candidate rather than the serving one.
-
-    Returns: (input_rate, output_rate, cache_read_rate, cache_write_rate).
-    ``None`` means configured fixed pricing should be used by the caller.
-    """
-    if settings.fixed_pricing and (
-        settings.fixed_per_1k_input_tokens
-        or settings.fixed_per_1k_output_tokens
-    ):
-        return None
-
-    from ..proxy import get_model_instance
-    from .models import litellm_cost_entry
-
-    response_model = response_data.get("model", "")
-    if model_obj is None:
-        logger.warning(
-            "Settling without routed model identity — re-deriving pricing "
-            "from the response's model string via the alias map",
-            extra={"response_model": response_model},
-        )
-        model_obj = get_model_instance(response_model)
-
-    if model_obj and model_obj.sats_pricing:
-        try:
-            mspp = float(model_obj.sats_pricing.prompt)
-            mspc = float(model_obj.sats_pricing.completion)
-            mscr = float(model_obj.sats_pricing.input_cache_read or 0)
-            mscw = float(model_obj.sats_pricing.input_cache_write or 0)
-
-            mspp_1k = mspp * 1_000_000.0
-            mspc_1k = mspc * 1_000_000.0
-            mscr_1k = mscr * 1_000_000.0 if mscr > 0 else mspp_1k
-            mscw_1k = mscw * 1_000_000.0 if mscw > 0 else mspp_1k
-            source = "configured"
-        except Exception as e:
-            logger.error("Invalid pricing data", extra={"error": str(e)})
-            raise ValueError("Invalid pricing data") from e
-    else:
-        pricing_model = (
-            model_obj.forwarded_model_id if model_obj else None
-        ) or response_model
-        pricing = litellm_cost_entry(pricing_model)
-        if pricing is None:
-            logger.error(
-                "Model pricing not found in configured models or LiteLLM",
-                extra={
-                    "response_model": response_model,
-                    "pricing_model": pricing_model,
-                },
-            )
-            raise ValueError(f"Pricing not found for model: {response_model}")
-
-        input_usd = _coerce_usd(pricing.get("input_cost_per_token"))
-        output_usd = _coerce_usd(pricing.get("output_cost_per_token"))
-        if input_usd <= 0 or output_usd <= 0:
-            raise ValueError(f"Incomplete LiteLLM pricing for model: {pricing_model}")
-
-        if provider_fee is None:
-            provider_fee = _resolve_provider_fee(response_model)
-        usd_per_sat = sats_usd_price()
-        mspp_1k = input_usd * provider_fee * 1_000_000.0 / usd_per_sat
-        mspc_1k = output_usd * provider_fee * 1_000_000.0 / usd_per_sat
-        cache_read_usd = _coerce_usd(
-            pricing.get("cache_read_input_token_cost")
-        )
-        cache_write_usd = _coerce_usd(
-            pricing.get("cache_creation_input_token_cost")
-        )
-        mscr_1k = (
-            cache_read_usd * provider_fee * 1_000_000.0 / usd_per_sat
-            if cache_read_usd > 0
-            else mspp_1k
-        )
-        mscw_1k = (
-            cache_write_usd * provider_fee * 1_000_000.0 / usd_per_sat
-            if cache_write_usd > 0
-            else mspp_1k
-        )
-        source = "litellm"
-
-    logger.info(
-        "Applied model-specific pricing",
-        extra={
-            "model": response_model,
-            "pricing_source": source,
-            "input_price_msats_per_1k": mspp_1k,
-            "output_price_msats_per_1k": mspc_1k,
-            "cache_read_price_msats_per_1k": mscr_1k,
-            "cache_write_price_msats_per_1k": mscw_1k,
-        },
+    # added for response api
+    input_tokens = (
+        input_tokens
+        if input_tokens != 0
+        else response_data.get("usage", {}).get("input_tokens", 0)
     )
-    return mspp_1k, mspc_1k, mscr_1k, mscw_1k
-
-
-def _resolve_provider_fee(model_id: str) -> float:
-    """Resolve the provider fee multiplier for the given model id.
-
-    Falls back to 1.0 (no markup) when the provider cannot be resolved so
-    the USD cost path never silently double-applies or omits the fee.
-    """
-    from ..proxy import get_provider_for_model
-
-    if not model_id:
-        return 1.0
-    providers = get_provider_for_model(model_id)
-    if not providers:
-        return 1.0
-    return float(providers[0].provider_fee)
-
-
-def _calculate_from_usd_cost(
-    usd_cost: float,
-    input_usd: float,
-    output_usd: float,
-    input_tokens: int,
-    cache_read_tokens: int,
-    cache_creation_tokens: int,
-    output_tokens: int,
-    response_data: dict,
-    provider_fee: float | None,
-) -> CostData:
-    """Calculate cost from USD figures, deriving input/output split from tokens."""
-    if provider_fee is None:
-        provider_fee = _resolve_provider_fee(response_data.get("model", ""))
-    usd_cost = usd_cost * provider_fee
-    input_usd = input_usd * provider_fee
-    output_usd = output_usd * provider_fee
-    sats_per_usd = 1.0 / sats_usd_price()
-    cost_in_sats = usd_cost * sats_per_usd
-    cost_in_msats = math.ceil(cost_in_sats * 1000)
-
-    if input_usd > 0 or output_usd > 0:
-        # The total is the authoritative billed amount. Allocating that integer
-        # total proportionally avoids losing sub-millisatoshi remainders when
-        # input and output components are each truncated independently.
-        component_usd = input_usd + output_usd
-        input_msats = math.floor(cost_in_msats * input_usd / component_usd)
-        output_msats = cost_in_msats - input_msats
-    else:
-        effective_input_tokens = (
-            input_tokens + cache_read_tokens + cache_creation_tokens
-        )
-        total_tokens = effective_input_tokens + output_tokens
-        input_msats = (
-            int(cost_in_msats * effective_input_tokens / total_tokens)
-            if total_tokens > 0
-            else 0
-        )
-        output_msats = cost_in_msats - input_msats
-
-    logger.info(
-        "Using cost from usage data/details",
-        extra={
-            "usd_cost": usd_cost,
-            "cost_in_sats": cost_in_sats,
-            "cost_in_msats": cost_in_msats,
-            "model": response_data.get("model", "unknown"),
-        },
+    output_tokens = (
+        output_tokens
+        if output_tokens != 0
+        else response_data.get("usage", {}).get("output_tokens", 0)
     )
 
-    return CostData(
-        base_msats=0,
-        input_msats=input_msats,
-        output_msats=output_msats,
-        total_msats=cost_in_msats,
-        total_usd=usd_cost,
-        input_tokens=input_tokens,
-        output_tokens=output_tokens,
-        cache_read_input_tokens=cache_read_tokens,
-        cache_creation_input_tokens=cache_creation_tokens,
-        cache_read_msats=0,
-        cache_creation_msats=0,
-    )
+    input_msats = round(input_tokens / 1000 * MSATS_PER_1K_INPUT_TOKENS, 3)
 
-
-def _calculate_from_tokens(
-    input_tokens: int,
-    output_tokens: int,
-    cache_read_tokens: int,
-    cache_creation_tokens: int,
-    input_rate: float,
-    output_rate: float,
-    cache_read_rate: float,
-    cache_creation_rate: float,
-    response_data: dict,
-) -> CostData:
-    """Calculate cost from token counts using pricing rates."""
-    calc_input_msats = round(input_tokens / 1000 * input_rate, 3)
-    calc_output_msats = round(output_tokens / 1000 * output_rate, 3)
-    calc_cache_read_msats = round(cache_read_tokens / 1000 * cache_read_rate, 3)
-    calc_cache_write_msats = round(
-        cache_creation_tokens / 1000 * cache_creation_rate, 3
-    )
-    token_based_cost = math.ceil(
-        calc_input_msats
-        + calc_output_msats
-        + calc_cache_read_msats
-        + calc_cache_write_msats
-    )
+    output_msats = round(output_tokens / 1000 * MSATS_PER_1K_OUTPUT_TOKENS, 3)
+    token_based_cost = math.ceil(input_msats + output_msats)
     total_usd = (token_based_cost / 1000.0) * sats_usd_price()
 
     logger.info(
@@ -537,39 +220,18 @@ def _calculate_from_tokens(
         extra={
             "input_tokens": input_tokens,
             "output_tokens": output_tokens,
-            "cache_read_input_tokens": cache_read_tokens,
-            "cache_creation_input_tokens": cache_creation_tokens,
-            "input_cost_msats": calc_input_msats,
-            "output_cost_msats": calc_output_msats,
-            "cache_read_cost_msats": calc_cache_read_msats,
-            "cache_creation_cost_msats": calc_cache_write_msats,
+            "input_cost_msats": input_msats,
+            "output_cost_msats": output_msats,
             "total_cost_msats": token_based_cost,
             "total_usd": total_usd,
             "model": response_data.get("model", "unknown"),
         },
     )
 
-    # Fold the cache-read/write cost into the visible ``input_msats`` so a
-    # dashboard that renders I / O / T sees ``input + output == total``
-    # exactly. This mirrors ``_fold_cache_into_input_tokens`` (which rolls the
-    # cache token counts into the visible prompt total). The standalone
-    # ``cache_read_msats`` / ``cache_creation_msats`` fields stay populated for
-    # clients that want the breakdown; nothing sums the components to derive
-    # ``total_msats`` (it is computed independently above), so this is
-    # display-only and does not change what is billed.
-    visible_output_msats = int(calc_output_msats)
-    visible_input_msats = token_based_cost - visible_output_msats
-
     return CostData(
         base_msats=0,
-        input_msats=visible_input_msats,
-        output_msats=visible_output_msats,
+        input_msats=int(input_msats),
+        output_msats=int(output_msats),
         total_msats=token_based_cost,
         total_usd=total_usd,
-        input_tokens=input_tokens,
-        output_tokens=output_tokens,
-        cache_read_input_tokens=cache_read_tokens,
-        cache_creation_input_tokens=cache_creation_tokens,
-        cache_read_msats=int(calc_cache_read_msats),
-        cache_creation_msats=int(calc_cache_write_msats),
     )

routstr/payment/helpers.py

@@ -11,8 +11,6 @@ from PIL import Image
 from sqlmodel.ext.asyncio.session import AsyncSession
 
 from ..core import get_logger
-from ..core.exceptions import UpstreamError
-from ..core.redaction import redact_org_ids
 from ..core.settings import settings
 from ..wallet import deserialize_token_from_string
 
@@ -31,13 +29,15 @@ def check_token_balance(headers: dict, body: dict, max_cost_for_model: int) -> N
             },
         )
     elif auth := headers.get("authorization", None):
+        cashu_token = auth.split(" ")[1] if len(auth.split(" ")) > 1 else ""
         logger.debug(
-            "Skipping preflight token balance check for Authorization header",
+            "Using Authorization header token",
             extra={
-                "auth_preview": auth[:20] + "..." if len(auth) > 20 else auth,
+                "token_preview": cashu_token[:20] + "..."
+                if len(cashu_token) > 20
+                else cashu_token
             },
         )
-        return
     else:
         logger.error("No authentication token provided")
         raise HTTPException(status_code=401, detail="Unauthorized")
@@ -75,7 +75,7 @@ def check_token_balance(headers: dict, body: dict, max_cost_for_model: int) -> N
 
     if max_cost_for_model > amount_msat:
         raise HTTPException(
-            status_code=402,
+            status_code=413,
             detail={
                 "reason": "Insufficient balance",
                 "amount_required_msat": max_cost_for_model,
@@ -169,32 +169,9 @@ async def calculate_discounted_max_cost(
 
     tol = settings.tolerance_percentage
     tol_factor = max(0.0, 1 - float(tol) / 100.0)
-
     max_prompt_allowed_sats = model_pricing.max_prompt_cost * tol_factor
     max_completion_allowed_sats = model_pricing.max_completion_cost * tol_factor
 
-    if model_obj:
-        prompt_token_limit: int | None = None
-        if model_obj.top_provider and (
-            model_obj.top_provider.context_length
-            or model_obj.top_provider.max_completion_tokens
-        ):
-            cl = model_obj.top_provider.context_length
-            mct = model_obj.top_provider.max_completion_tokens
-            if cl and mct:
-                prompt_token_limit = max(0, cl - mct)
-            elif cl:
-                prompt_token_limit = cl
-            elif mct:
-                prompt_token_limit = 0
-        elif model_obj.context_length:
-            prompt_token_limit = model_obj.context_length
-
-        if prompt_token_limit is not None:
-            max_prompt_allowed_sats = (
-                prompt_token_limit * model_pricing.prompt * tol_factor
-            )
-
     adjusted = max_cost_for_model
 
     if messages := body.get("messages"):
@@ -420,27 +397,16 @@ def create_error_response(
     status_code: int,
     request: Request,
     token: str | None = None,
-    code: str | int | None = None,
-    details: dict[str, object] | None = None,
 ) -> Response:
-    """Create a standardized error response.
-
-    ``code`` is a stable, machine-readable classification (e.g.
-    ``UPSTREAM_RATE_LIMIT``); when omitted it defaults to the HTTP status code
-    for backwards compatibility. ``details`` carries optional structured,
-    redaction-safe context.
-    """
-    error_obj: dict[str, object] = {
-        "message": redact_org_ids(message),
-        "type": error_type,
-        "code": code if code is not None else status_code,
-    }
-    if details is not None:
-        error_obj["details"] = details
+    """Create a standardized error response."""
     return Response(
         content=json.dumps(
             {
-                "error": error_obj,
+                "error": {
+                    "message": message,
+                    "type": error_type,
+                    "code": status_code,
+                },
                 "request_id": getattr(request.state, "request_id", "unknown"),
             }
         ),
@@ -448,20 +414,3 @@ def create_error_response(
         media_type="application/json",
         headers={"X-Cashu": token} if token else {},
     )
-
-
-def create_upstream_error_response(
-    error: UpstreamError,
-    request: Request,
-    fallback_status: int = 502,
-) -> Response:
-    """Build an error response from an :class:`UpstreamError`, preserving its
-    structured ``code``, ``details``, and original ``status_code``."""
-    return create_error_response(
-        "upstream_error",
-        str(error),
-        error.status_code or fallback_status,
-        request=request,
-        code=getattr(error, "code", None),
-        details=getattr(error, "details", None),
-    )

routstr/payment/lnurl.py

@@ -1,17 +1,11 @@
 from __future__ import annotations
 
-import asyncio
 import math
 from typing import TypedDict
 
 import httpx
 from cashu.wallet.wallet import Proof, Wallet
 
-# The Cashu library issues POST /v1/melt/bolt11 with timeout=None, so a hung or
-# very slow mint can block a melt (and any caller, e.g. the payout loop)
-# indefinitely. Bound it here so callers fail instead of hanging forever.
-MELT_TIMEOUT_SECONDS = 60
-
 try:
     from bech32 import bech32_decode, convertbits  # type: ignore
 except ModuleNotFoundError:  # pragma: no cover – allow runtime miss
@@ -31,6 +25,82 @@ class LNURLError(Exception):
     """LNURL related errors."""
 
 
+def parse_lightning_invoice_amount(invoice: str, currency: str = "sat") -> int:
+    """Parse Lightning invoice (BOLT-11) to extract amount in specified currency units.
+
+    Args:
+        invoice: BOLT-11 Lightning invoice string
+        currency: Target currency unit ("sat" or "msat")
+
+    Returns:
+        Amount in the specified currency unit
+
+    Raises:
+        LNURLError: If invoice format is invalid or amount cannot be parsed
+    """
+    invoice = invoice.lower().strip()
+
+    if not invoice.startswith("ln"):
+        raise LNURLError("Invalid Lightning invoice format")
+
+    # Find the network part (bc, tb, etc.)
+    network_start = 2
+    while network_start < len(invoice) and invoice[network_start] not in "0123456789":
+        network_start += 1
+
+    if network_start >= len(invoice):
+        raise LNURLError("Invalid Lightning invoice format")
+
+    # Parse amount and multiplier
+    amount_str = ""
+    multiplier = ""
+    i = network_start
+
+    # Extract numeric part
+    while i < len(invoice) and invoice[i].isdigit():
+        amount_str += invoice[i]
+        i += 1
+
+    # Extract multiplier if present
+    if i < len(invoice) and invoice[i] in "munp":
+        multiplier = invoice[i]
+        i += 1
+
+    # Check if we have the required "1" separator
+    if i >= len(invoice) or invoice[i] != "1":
+        raise LNURLError("Invalid Lightning invoice format")
+
+    if not amount_str:
+        raise LNURLError("Lightning invoice amount not specified")
+
+    # Convert to base units
+    try:
+        amount = int(amount_str)
+    except ValueError:
+        raise LNURLError("Invalid Lightning invoice amount")
+
+    # Apply multiplier to get millisatoshis
+    if multiplier == "m":  # milli = 10^-3
+        amount_msat = amount * 100_000_000  # amount is in BTC * 10^-3
+    elif multiplier == "u":  # micro = 10^-6
+        amount_msat = amount * 100_000  # amount is in BTC * 10^-6
+    elif multiplier == "n":  # nano = 10^-9
+        amount_msat = amount * 100  # amount is in BTC * 10^-9
+    elif multiplier == "p":  # pico = 10^-12
+        amount_msat = amount // 10  # amount is in BTC * 10^-12
+    else:
+        # No multiplier means the amount is in BTC
+        amount_msat = amount * 100_000_000_000  # Convert BTC to msat
+
+    # Convert to target currency unit
+    if currency == "msat":
+        return amount_msat
+    elif currency == "sat":
+        return amount_msat // 1000
+    else:
+        raise LNURLError(f"Unsupported currency for Lightning: {currency}")
+
+
 async def decode_lnurl(lnurl: str) -> str:
     """Decode LNURL to get the actual URL.
 
@@ -226,18 +296,10 @@ async def raw_send_to_lnurl(
     if amount:
         proofs, _ = await wallet.select_to_send(proofs, amount, set_reserved=True)
 
-    try:
-        _ = await asyncio.wait_for(
-            wallet.melt(
-                proofs=proofs,
-                invoice=bolt11_invoice,
-                fee_reserve_sat=melt_quote_resp.fee_reserve,
-                quote_id=melt_quote_resp.quote,
-            ),
-            timeout=MELT_TIMEOUT_SECONDS,
-        )
-    except asyncio.TimeoutError as e:
-        raise LNURLError(
-            f"Melt timed out after {MELT_TIMEOUT_SECONDS}s (mint unresponsive)"
-        ) from e
+    _ = await wallet.melt(
+        proofs=proofs,
+        invoice=bolt11_invoice,
+        fee_reserve_sat=melt_quote_resp.fee_reserve,
+        quote_id=melt_quote_resp.quote,
+    )
     return final_amount

routstr/payment/models.py

@@ -3,12 +3,11 @@ import json
 import random
 
 import httpx
-from fastapi import APIRouter, Depends, HTTPException, Request
-from pydantic import BaseModel as V2BaseModel
+from fastapi import APIRouter, Depends
 from pydantic.v1 import BaseModel
 from sqlmodel.ext.asyncio.session import AsyncSession
 
-from ..core.db import ModelRow, UpstreamProviderRow, get_session
+from ..core.db import ModelRow, get_session
 from ..core.logging import get_logger
 from ..core.settings import settings
 from .price import sats_usd_price
@@ -17,24 +16,6 @@ logger = get_logger(__name__)
 
 models_router = APIRouter()
 
-_MODEL_TEST_ENDPOINT_PATHS = {
-    "chat-completions": "chat/completions",
-    "completions": "completions",
-    "embeddings": "embeddings",
-    "responses": "responses",
-}
-
-# Cap the caller-supplied test payload to avoid forwarding oversized bodies
-# upstream on the operator's credentials.
-_MODEL_TEST_MAX_REQUEST_BYTES = 64 * 1024
-
-
-async def _require_admin_api(request: Request) -> None:
-    """Require admin auth without creating an import-time cycle with core.admin."""
-    from ..core.admin import require_admin_api
-
-    await require_admin_api(request)
-
 
 class Architecture(BaseModel):
     modality: str
@@ -79,70 +60,11 @@ class Model(BaseModel):
     upstream_provider_id: int | str | None = None
     canonical_slug: str | None = None
     alias_ids: list[str] | None = None
-    forwarded_model_id: str | None = None
 
     def __hash__(self) -> int:
         return hash(self.id)
 
 
-def litellm_cost_entry(model_id: str) -> dict | None:
-    """Look up ``model_id`` in litellm's bundled cost map.
-
-    litellm ships per-model USD rates keyed by the exact OpenRouter id
-    (``deepseek/deepseek-chat``) or the bare model name (``gpt-4o``,
-    ``claude-sonnet-4-5``), so both spellings are tried. Keys are lowercase, so
-    a mixed-case upstream id (``deepseek-ai/DeepSeek-V4-Flash``) is retried via
-    a case-insensitive scan. Returns the matched cost dict, or ``None``.
-    """
-    import litellm
-
-    candidates = (model_id, model_id.split("/", 1)[-1])
-    for key in candidates:
-        info = litellm.model_cost.get(key)
-        if isinstance(info, dict):
-            return info
-
-    lowered = {c.lower() for c in candidates}
-    for key, info in litellm.model_cost.items():
-        if isinstance(key, str) and key.lower() in lowered and isinstance(info, dict):
-            return info
-    return None
-
-
-def backfill_cache_pricing(model_id: str, pricing: Pricing) -> Pricing:
-    """Fill missing cache rates from litellm's bundled cost map.
-
-    The OpenRouter model feed omits ``input_cache_read``/``input_cache_write``
-    for many models (most DeepSeek entries, openai/gpt-4o, ...). Without a
-    cache rate, billing falls back to the full input rate, which overcharges
-    cache reads (DeepSeek hits are 10x cheaper) and undercharges Anthropic
-    cache writes (1.25x). The lookup (see ``litellm_cost_entry``) tries both
-    id spellings and a case-insensitive fallback.
-
-    Rates already present (e.g. provided by OpenRouter) are authoritative and
-    never overwritten. Unknown models are returned unchanged.
-    """
-    needs_read = (pricing.input_cache_read or 0.0) <= 0.0
-    needs_write = (pricing.input_cache_write or 0.0) <= 0.0
-    if not (needs_read or needs_write):
-        return pricing
-
-    info = litellm_cost_entry(model_id)
-    if info is None:
-        return pricing
-
-    updated = Pricing.parse_obj(pricing.dict())
-    if needs_read:
-        read_rate = info.get("cache_read_input_token_cost")
-        if isinstance(read_rate, (int, float)) and read_rate > 0:
-            updated.input_cache_read = float(read_rate)
-    if needs_write:
-        write_rate = info.get("cache_creation_input_token_cost")
-        if isinstance(write_rate, (int, float)) and write_rate > 0:
-            updated.input_cache_write = float(write_rate)
-    return updated
-
-
 def _has_valid_pricing(model: dict) -> bool:
     """Check if model has valid pricing (not free, no negative values)."""
     pricing = model.get("pricing", {})
@@ -221,6 +143,14 @@ async def async_fetch_openrouter_models(source_filter: str | None = None) -> lis
         return []
 
 
+def is_openrouter_upstream() -> bool:
+    try:
+        base = (settings.upstream_base_url or "").strip().rstrip("/")
+    except Exception:
+        return False
+    return base.lower() == "https://openrouter.ai/api/v1"
+
+
 def _row_to_model(
     row: ModelRow, apply_provider_fee: bool = False, provider_fee: float = 1.01
 ) -> Model:
@@ -231,29 +161,13 @@ def _row_to_model(
     )
     top_provider_dict = json.loads(row.top_provider) if row.top_provider else None
 
+    if apply_provider_fee and isinstance(pricing, dict):
+        pricing = {k: float(v) * provider_fee for k, v in pricing.items()}
+
     if isinstance(pricing, dict) and float(pricing.get("request", 0.0)) <= 0.0:
         pricing["request"] = max(pricing.get("request", 0.0), 0.0)
 
     parsed_pricing = Pricing.parse_obj(pricing)
-
-    # Fill missing cache-read/write rates from litellm's cost map BEFORE applying
-    # the provider fee, so they carry the same markup as every other component.
-    # DB-stored override pricing (e.g. generic providers) omits cache rates;
-    # without this, ``_row_to_model`` bills cache reads at the full input rate —
-    # the ``_apply_provider_fee_to_model`` path backfills, but the override path
-    # used for admin-configured providers did not.
-    #
-    # Key on ``forwarded_model_id`` (the actual upstream model name litellm
-    # prices) when set: an alias row (id="local-alias",
-    # forwarded_model_id="deepseek-v4-flash") would otherwise look up the alias
-    # and miss the cache rate.
-    pricing_model_id = getattr(row, "forwarded_model_id", None) or row.id
-    parsed_pricing = backfill_cache_pricing(pricing_model_id, parsed_pricing)
-
-    if apply_provider_fee:
-        parsed_pricing = Pricing.parse_obj(
-            {k: float(v) * provider_fee for k, v in parsed_pricing.dict().items()}
-        )
     model = Model(
         id=row.id,
         name=row.name,
@@ -271,7 +185,6 @@ def _row_to_model(
         upstream_provider_id=row.upstream_provider_id,
         canonical_slug=getattr(row, "canonical_slug", None),
         alias_ids=json.loads(row.alias_ids) if row.alias_ids else None,
-        forwarded_model_id=getattr(row, "forwarded_model_id", None) or row.id,
     )
 
     if apply_provider_fee:
@@ -290,6 +203,29 @@ def _row_to_model(
     return model
 
 
+def _model_to_row_payload(model: Model) -> dict[str, str | int | bool | None]:
+    return {
+        "id": model.id,
+        "name": model.name,
+        "created": model.created,
+        "description": model.description,
+        "context_length": model.context_length,
+        "architecture": json.dumps(model.architecture.dict()),
+        "pricing": json.dumps(model.pricing.dict()),
+        "sats_pricing": json.dumps(model.sats_pricing.dict())
+        if model.sats_pricing
+        else None,
+        "per_request_limits": json.dumps(model.per_request_limits)
+        if model.per_request_limits is not None
+        else None,
+        "top_provider": json.dumps(model.top_provider.dict())
+        if model.top_provider is not None
+        else None,
+        "enabled": model.enabled,
+        "upstream_provider_id": model.upstream_provider_id,
+    }
+
+
 async def list_models(
     session: AsyncSession,
     upstream_id: int,
@@ -326,6 +262,21 @@ async def list_models(
     ]
 
 
+async def get_model_by_id(
+    model_id: str, provider_id: int, session: AsyncSession
+) -> Model | None:
+    from ..core.db import UpstreamProviderRow
+
+    row = await session.get(ModelRow, (model_id, provider_id))
+    if not row or not row.enabled:
+        return None
+    provider = await session.get(UpstreamProviderRow, provider_id)
+    if not provider or not provider.enabled:
+        return None
+    provider_fee = provider.provider_fee if provider else 1.01
+    return _row_to_model(row, apply_provider_fee=True, provider_fee=provider_fee)
+
+
 def _calculate_usd_max_costs(model: Model) -> tuple[float, float, float]:
     """Calculate max costs in USD based on model context/token limits.
 
@@ -424,7 +375,6 @@ def _update_model_sats_pricing(model: Model, sats_to_usd: float) -> Model:
             upstream_provider_id=model.upstream_provider_id,
             canonical_slug=model.canonical_slug,
             alias_ids=model.alias_ids,
-            forwarded_model_id=model.forwarded_model_id,
         )
     except Exception as e:
         logger.error(
@@ -443,9 +393,6 @@ async def _update_sats_pricing_once() -> None:
     from ..proxy import get_upstreams, refresh_model_maps
 
     upstreams = get_upstreams()
-    if not upstreams:
-        return
-
     sats_to_usd = sats_usd_price()
 
     updated_count = 0
@@ -455,16 +402,11 @@ async def _update_sats_pricing_once() -> None:
             for m in upstream.get_cached_models()
         ]
         upstream._models_cache = updated_models
-        upstream._models_by_id = {
-            m.forwarded_model_id or m.id: m for m in updated_models
-        }
+        upstream._models_by_id = {m.id: m for m in updated_models}
         updated_count += len(updated_models)
 
     if updated_count > 0:
-        logger.info(
-            f"Updated sats pricing for {updated_count} models",
-            extra={"models_updated": updated_count},
-        )
+        logger.info("Updated sats pricing", extra={"models_updated": updated_count})
         await refresh_model_maps()
 
 
@@ -506,139 +448,11 @@ async def update_sats_pricing() -> None:
             logger.error(f"Error updating sats pricing: {e}")
 
 
-class ModelTestRequest(V2BaseModel):
-    model_id: str
-    endpoint_type: str
-    request_data: dict
-
-
-@models_router.post("/api/models/test", dependencies=[Depends(_require_admin_api)])
-async def test_model(
-    payload: ModelTestRequest,
-    session: AsyncSession = Depends(get_session),
-) -> dict:
-    """Test a model by sending a request through its configured upstream provider."""
-    from sqlmodel import select
-
-    result = await session.execute(
-        select(ModelRow).where(ModelRow.id == payload.model_id)
-    )
-    model_row = result.scalars().first()
-
-    if not model_row:
-        return {
-            "success": False,
-            "error": f"Model '{payload.model_id}' not found in database",
-            "status_code": 404,
-        }
-
-    provider = await session.get(UpstreamProviderRow, model_row.upstream_provider_id)
-    if not provider:
-        return {
-            "success": False,
-            "error": "Upstream provider not found",
-            "status_code": 404,
-        }
-
-    endpoint_path = _MODEL_TEST_ENDPOINT_PATHS.get(payload.endpoint_type)
-    if endpoint_path is None:
-        raise HTTPException(status_code=400, detail="Unsupported endpoint_type")
-
-    actual_model_id = model_row.forwarded_model_id or model_row.id
-    request_data = dict(payload.request_data)
-    request_data["model"] = actual_model_id
-
-    try:
-        request_size = len(json.dumps(request_data).encode("utf-8"))
-    except (TypeError, ValueError):
-        raise HTTPException(status_code=400, detail="Invalid request_data")
-    if request_size > _MODEL_TEST_MAX_REQUEST_BYTES:
-        raise HTTPException(status_code=413, detail="request_data too large")
-
-    base_url = provider.base_url.rstrip("/")
-    url = f"{base_url}/{endpoint_path}"
-
-    logger.info(
-        "admin model test",
-        extra={
-            "model_id": payload.model_id,
-            "forwarded_model_id": actual_model_id,
-            "endpoint_type": payload.endpoint_type,
-            "upstream_provider_id": model_row.upstream_provider_id,
-            "request_bytes": request_size,
-        },
-    )
-
-    headers = {
-        "Content-Type": "application/json",
-        "Authorization": f"Bearer {provider.api_key}",
-    }
-
-    try:
-        async with httpx.AsyncClient(timeout=30.0) as client:
-            response = await client.post(url, json=request_data, headers=headers)
-            try:
-                response_data = response.json()
-            except Exception:
-                response_data = {"raw": response.text}
-
-            return {
-                "success": response.status_code < 400,
-                "data": response_data,
-                "status_code": response.status_code,
-            }
-    except Exception as e:
-        return {
-            "success": False,
-            "error": str(e),
-            "status_code": 500,
-        }
-
-
-@models_router.get("/v1/models/paths")
-@models_router.get("/v1/models/paths/", include_in_schema=False)
-async def model_paths() -> dict:
-    """All models with every upstream provider path they are reachable through."""
-    from ..upstream.model_paths import get_all_model_paths
-
-    return await get_all_model_paths()
-
-
-@models_router.get("/v1/models/paths/model")
-@models_router.get("/v1/models/paths/model/", include_in_schema=False)
-async def model_paths_for_model(model_id: str) -> dict:
-    """Paths for a single model.
-
-    Uses a query parameter (``?model_id=...``) under a fully static route so
-    model ids containing ``/`` (e.g. ``anthropic/claude-opus-4.6``) need no URL
-    encoding and there is no dynamic-route ambiguity.
-    """
-    from ..proxy import get_unique_models
-    from ..upstream.model_paths import get_paths_for_model
-
-    result = await get_paths_for_model(model_id)
-    if not result["data"]:
-        advertised_ids = {
-            model.forwarded_model_id or model.id for model in get_unique_models()
-        }
-        if model_id not in advertised_ids:
-            raise HTTPException(status_code=404, detail="Model not found")
-    return result
-
-
 @models_router.get("/v1/models")
-@models_router.get("/v1/models/", include_in_schema=False)
-@models_router.get("/models")
-@models_router.get("/models/", include_in_schema=False)
+@models_router.get("/models", include_in_schema=False)
 async def models(session: AsyncSession = Depends(get_session)) -> dict:
     """Get all available models from all providers with database overrides applied."""
     from ..proxy import get_unique_models
 
     items = get_unique_models()
-    data = []
-    for model in items:
-        m = model.dict()
-        if model.forwarded_model_id:
-            m["id"] = model.forwarded_model_id
-        data.append(m)
-    return {"data": data}
+    return {"data": items}

routstr/payment/usage.py

@@ -1,131 +0,0 @@
-"""Vendor-agnostic normalization of upstream usage objects.
-
-Upstream providers report token usage in vendor dialects that differ in field
-names and in whether cached tokens are included in the input count:
-
-* OpenAI / Azure / xAI / Groq / Moonshot / Qwen / Gemini-compat: cache reads in
-  ``prompt_tokens_details.cached_tokens``, included in ``prompt_tokens``.
-* OpenRouter: same as OpenAI plus cache *writes* in
-  ``prompt_tokens_details.cache_write_tokens``, also included in
-  ``prompt_tokens``.
-* litellm-normalized: same nesting, but names the write field
-  ``prompt_tokens_details.cache_creation_tokens`` (and additionally mirrors the
-  Anthropic top-level fields), with ``prompt_tokens`` as the grand total.
-* Anthropic native: ``cache_read_input_tokens`` / ``cache_creation_input_tokens``
-  top-level, additive to (not included in) ``input_tokens``.
-* DeepSeek: ``prompt_cache_hit_tokens`` / ``prompt_cache_miss_tokens``, with
-  ``prompt_tokens = hit + miss``.
-
-What decides whether cached tokens must be subtracted out of the input count is
-**which prompt field the vendor uses**, not which cache field appears:
-
-* ``prompt_tokens`` present -> cached + cache-write tokens are *included* in it
-  (OpenAI family, DeepSeek, OpenRouter, litellm); subtract both so
-  ``input_tokens`` holds only the regular-rate portion.
-* only ``input_tokens`` (Anthropic native) -> cached tokens are *additive*;
-  leave ``input_tokens`` untouched.
-
-``normalize_usage`` maps all of them onto one canonical ``NormalizedUsage``
-shape so billing code needs no vendor knowledge. The known dialects' field
-names do not collide, so a single union parser is safe; a vendor whose fields
-would genuinely conflict needs a dedicated branch here.
-"""
-
-from pydantic.v1 import BaseModel
-
-
-class NormalizedUsage(BaseModel):
-    """Canonical token usage: input_tokens never includes cached tokens."""
-
-    input_tokens: int = 0
-    output_tokens: int = 0
-    cache_read_tokens: int = 0
-    cache_write_tokens: int = 0
-
-
-def parse_token_count(value: object) -> int:
-    """Parse a token count from various formats (int, float, str, bool)."""
-    if isinstance(value, bool):
-        return 0
-    if isinstance(value, int):
-        return max(0, value)
-    if isinstance(value, float):
-        return max(0, int(value))
-    if isinstance(value, str):
-        try:
-            return max(0, int(float(value)))
-        except ValueError:
-            return 0
-    return 0
-
-
-def _first_token_count(usage_data: dict, *fields: str) -> int:
-    """Return the first positive token count among the given fields."""
-    for field in fields:
-        value = parse_token_count(usage_data.get(field, 0))
-        if value > 0:
-            return value
-    return 0
-
-
-def _extract_cache_tokens(usage_data: dict) -> tuple[int, int]:
-    """Pull (cache_read, cache_write) across all known dialects.
-
-    Precedence (highest first), independent for reads and writes:
-
-    * Anthropic top-level: ``cache_read_input_tokens`` /
-      ``cache_creation_input_tokens``.
-    * Nested ``prompt_tokens_details``: ``cached_tokens`` for reads;
-      ``cache_creation_tokens`` (litellm) or ``cache_write_tokens``
-      (OpenRouter) for writes.
-    * DeepSeek: ``prompt_cache_hit_tokens`` for reads (no write concept).
-    """
-    cache_read = parse_token_count(usage_data.get("cache_read_input_tokens", 0))
-    cache_write = parse_token_count(usage_data.get("cache_creation_input_tokens", 0))
-
-    prompt_details = usage_data.get("prompt_tokens_details")
-    if isinstance(prompt_details, dict):
-        if not cache_read:
-            cache_read = parse_token_count(prompt_details.get("cached_tokens", 0))
-        if not cache_write:
-            cache_write = _first_token_count(
-                prompt_details, "cache_creation_tokens", "cache_write_tokens"
-            )
-
-    if not cache_read:
-        # DeepSeek: prompt_tokens = prompt_cache_hit_tokens + prompt_cache_miss_tokens
-        cache_read = parse_token_count(usage_data.get("prompt_cache_hit_tokens", 0))
-
-    return cache_read, cache_write
-
-
-def normalize_usage(usage_data: object) -> NormalizedUsage | None:
-    """Map a vendor usage dict onto the canonical shape, or None if absent.
-
-    Cached reads and writes are subtracted from the input count exactly once,
-    only for dialects that report a ``prompt_tokens`` grand total that already
-    includes them (OpenAI family, DeepSeek, OpenRouter, litellm). Anthropic
-    native reports them additively under ``input_tokens`` and is left untouched.
-    """
-    if not isinstance(usage_data, dict):
-        return None
-
-    output_tokens = _first_token_count(
-        usage_data, "completion_tokens", "output_tokens"
-    )
-    cache_read, cache_write = _extract_cache_tokens(usage_data)
-
-    # ``prompt_tokens`` is the inclusive grand total; ``input_tokens`` (Anthropic
-    # native) excludes cached tokens. The field chosen decides whether to subtract.
-    if "prompt_tokens" in usage_data:
-        input_tokens = parse_token_count(usage_data.get("prompt_tokens", 0))
-        input_tokens = max(0, input_tokens - cache_read - cache_write)
-    else:
-        input_tokens = parse_token_count(usage_data.get("input_tokens", 0))
-
-    return NormalizedUsage(
-        input_tokens=input_tokens,
-        output_tokens=output_tokens,
-        cache_read_tokens=cache_read,
-        cache_write_tokens=cache_write,
-    )

routstr/proxy.py

@@ -1,4 +1,3 @@
-import asyncio
 import json
 from typing import Any
 
@@ -7,13 +6,7 @@ from fastapi.responses import Response, StreamingResponse
 from sqlmodel import select
 
 from .algorithm import create_model_mappings
-from .auth import (
-    ReservationSnapshot,
-    get_reservation_snapshot,
-    pay_for_request,
-    revert_pay_for_request,
-    validate_bearer_key,
-)
+from .auth import pay_for_request, revert_pay_for_request, validate_bearer_key
 from .core import get_logger
 from .core.db import (
     ApiKey,
@@ -24,28 +17,24 @@ from .core.db import (
     get_session,
 )
 from .core.exceptions import UpstreamError
-from .core.not_found import build_not_found_response
-from .core.settings import settings
 from .payment.helpers import (
     calculate_discounted_max_cost,
     check_token_balance,
     create_error_response,
-    create_upstream_error_response,
     get_max_cost_for_model,
 )
 from .payment.models import Model
 from .upstream import BaseUpstreamProvider
-from .upstream.ehbp import forward_ehbp_request, forward_ehbp_x_cashu_request
 from .upstream.helpers import init_upstreams
-from .upstream.request_correction import correct_request, extract_error_message
 
 logger = get_logger(__name__)
 proxy_router = APIRouter()
 
 _upstreams: list[BaseUpstreamProvider] = []
+_model_instances: dict[str, Model] = {}  # All aliases -> Model
 _provider_map: dict[
-    str, list[tuple[Model, BaseUpstreamProvider]]
-] = {}  # All aliases -> sorted [(candidate Model, its Provider)]
+    str, list[BaseUpstreamProvider]
+] = {}  # All aliases -> List[Provider]
 _unique_models: dict[str, Model] = {}  # Unique model.id -> Model (no duplicates)
 
 
@@ -77,44 +66,14 @@ def get_upstreams() -> list[BaseUpstreamProvider]:
     return _upstreams
 
 
-def get_candidates(
-    model_id: str,
-) -> list[tuple[Model, BaseUpstreamProvider]] | None:
-    """Get the sorted (model, provider) candidate list for a model ID.
-
-    Each provider is paired with its own model for the alias, so routing can
-    forward and bill the candidate that actually serves. Version suffixes
-    (e.g. ``-20251222``) are stripped as a retry when the exact ID is
-    unknown, since upstreams may return a specific version of a base model
-    we track.
-    """
-    if not model_id:
-        return None
-
-    model_id_lower = model_id.lower()
-    if candidates := _provider_map.get(model_id_lower):
-        return candidates
-
-    import re
-
-    base_model_id = re.sub(r"-\d{8}$", "", model_id_lower)
-    if base_model_id != model_id_lower:
-        if candidates := _provider_map.get(base_model_id):
-            return candidates
-
-    return None
-
-
 def get_model_instance(model_id: str) -> Model | None:
-    """Get the best-ranked Model instance for a model ID."""
-    candidates = get_candidates(model_id)
-    return candidates[0][0] if candidates else None
+    """Get Model instance by ID from global cache."""
+    return _model_instances.get(model_id.lower())
 
 
 def get_provider_for_model(model_id: str) -> list[BaseUpstreamProvider] | None:
-    """Get the sorted UpstreamProvider list for a model ID."""
-    candidates = get_candidates(model_id)
-    return [provider for _, provider in candidates] if candidates else None
+    """Get UpstreamProvider list for model ID from global cache."""
+    return _provider_map.get(model_id.lower())
 
 
 def get_unique_models() -> list[Model]:
@@ -122,39 +81,11 @@ def get_unique_models() -> list[Model]:
     return list(_unique_models.values())
 
 
-def _is_tinfoil_attestation_path(path: str) -> bool:
-    """Return True for exact Tinfoil attestation routes, with optional slash."""
-    return path in {
-        "attestation",
-        "attestation/",
-        "tee/attestation",
-        "tee/attestation/",
-    }
-
-
-def _select_unauthenticated_get_upstreams(
-    path: str, upstreams: list[BaseUpstreamProvider]
-) -> list[BaseUpstreamProvider]:
-    """Select upstream candidates for unauthenticated GET bypass paths.
-
-    Tinfoil attestation endpoints are provider-specific. Trying every enabled
-    upstream can return an unrelated provider's 404 before Tinfoil is reached,
-    so route those paths only to Tinfoil providers.
-    """
-    if _is_tinfoil_attestation_path(path):
-        return [
-            upstream
-            for upstream in upstreams
-            if getattr(upstream, "provider_type", None) == "tinfoil"
-        ]
-    return upstreams
-
-
 async def refresh_model_maps() -> None:
     """Refresh global model and provider maps using the cost-based algorithm."""
     from sqlalchemy.orm import selectinload
 
-    global _provider_map, _unique_models
+    global _model_instances, _provider_map, _unique_models
 
     async with create_session() as session:
         # Fetch all providers with their models in a single logical operation
@@ -164,38 +95,24 @@ async def refresh_model_maps() -> None:
         result = await session.exec(query)
         provider_rows = result.all()
 
-    overrides_by_key: dict[tuple[str, int], tuple[ModelRow, float]] = {}
-    disabled_model_keys: set[tuple[str, int]] = set()
+    overrides_by_id: dict[str, tuple[ModelRow, float]] = {}
+    disabled_model_ids: set[str] = set()
 
     for provider in provider_rows:
         if not provider.enabled:
             continue
         for model in provider.models:
-            model_key = (model.id.lower(), model.upstream_provider_id)
             if model.enabled:
-                overrides_by_key[model_key] = (model, provider.provider_fee)
+                overrides_by_id[model.id] = (model, provider.provider_fee)
             else:
-                disabled_model_keys.add(model_key)
+                disabled_model_ids.add(model.id)
 
-    _, _provider_map, _unique_models = create_model_mappings(
+    _model_instances, _provider_map, _unique_models = create_model_mappings(
         upstreams=_upstreams,
-        overrides_by_key=overrides_by_key,
-        disabled_model_keys=disabled_model_keys,
+        overrides_by_id=overrides_by_id,
+        disabled_model_ids=disabled_model_ids,
     )
 
-    # Keep model-path discovery in sync with admin mutations: disabling or
-    # deleting a provider must stop advertising its paths immediately rather
-    # than after the next timed refresh.
-    from .upstream.model_paths import prune_model_paths_for_inactive_providers
-
-    try:
-        await prune_model_paths_for_inactive_providers()
-    except Exception as e:  # noqa: BLE001 - discovery sync must not break routing
-        logger.warning(
-            "Failed to prune model paths for inactive providers",
-            extra={"error": str(e), "error_type": type(e).__name__},
-        )
-
 
 async def refresh_model_maps_periodically() -> None:
     """Background task to refresh model maps every minute."""
@@ -214,130 +131,44 @@ async def refresh_model_maps_periodically() -> None:
             )
 
 
-_API_PATH_PREFIXES = (
-    "v1/",
-    "responses",
-    "chat/",
-    "completions",
-    "models",
-    "embeddings",
-    "audio/",
-    "images/",
-    "moderations",
-    "providers",
-    "tee/",
-    "attestation",
-)
-
-
 @proxy_router.api_route("/{path:path}", methods=["GET", "POST"], response_model=None)
 async def proxy(
     request: Request, path: str, session: AsyncSession = Depends(get_session)
 ) -> Response | StreamingResponse:
-    # GET requests must hit a known API prefix; otherwise return a 404 (HTML
-    # for browsers, JSON for API clients). POST requests are always forwarded
-    # so that OpenAI-style endpoints work with or without the `v1/` prefix
-    # (e.g. `/chat/completions` as well as `/v1/chat/completions`).
-    if request.method == "GET" and not path.startswith(_API_PATH_PREFIXES):
-        return build_not_found_response(request, path)
-
     headers = dict(request.headers)
 
+    if "x-cashu" not in headers and "authorization" not in headers.keys():
+        return create_error_response(
+            "unauthorized", "Unauthorized", 401, request=request
+        )
+
     is_responses_api = path.startswith("v1/responses") or path.startswith("responses")
     request_body = await request.body()
+    request_body_dict = parse_request_body_json(request_body, path)
 
-    # EHBP (Encrypted HTTP Body Protocol) requests carry an Ehbp-Encapsulated-Key
-    # header and a binary HPKE-sealed body. The proxy cannot parse the body to
-    # extract the model id, so the SDK sends it in X-Routstr-Model. Forward the
-    # raw encrypted body to the upstream's /private/ endpoint and stream the
-    # encrypted response back untouched — the SDK's SecureClient decrypts it.
-    is_ehbp = "ehbp-encapsulated-key" in headers
-    if is_ehbp:
-        request_body_dict = {}
-        model_id = headers.get("x-routstr-model", "")
-        if not model_id:
-            return create_error_response(
-                "invalid_request",
-                "EHBP request missing X-Routstr-Model header",
-                400,
-                request=request,
-            )
+    if is_responses_api:
+        model_id = extract_model_from_responses_request(request_body_dict)
     else:
-        request_body_dict = parse_request_body_json(request_body, path)
-        if is_responses_api:
-            model_id = extract_model_from_responses_request(request_body_dict)
-        else:
-            model_id = request_body_dict.get("model", "unknown")
+        model_id = request_body_dict.get("model", "unknown")
 
-    # Exact Tinfoil attestation GET routes don't map to models — forward
-    # without model/cost/auth lookups. Do not prefix-match here: paths such as
-    # /attestationjunk must continue through normal authentication.
-    if request.method == "GET" and _is_tinfoil_attestation_path(path):
-        selected_upstreams = _select_unauthenticated_get_upstreams(path, _upstreams)
-        if not selected_upstreams:
-            return create_error_response(
-                "upstream_error",
-                "No upstream available for unauthenticated GET path",
-                502,
-                request=request,
-            )
-
-        last_error_response = None
-        for i, upstream in enumerate(selected_upstreams):
-            try:
-                headers = upstream.prepare_headers(dict(request.headers))
-                response = await upstream.forward_get_request(request, path, headers)
-                if (
-                    response.status_code in [502, 429]
-                    and i < len(selected_upstreams) - 1
-                ):
-                    logger.warning(
-                        "Upstream %s returned %s for unauthenticated GET %s, trying next",
-                        upstream.provider_type,
-                        response.status_code,
-                        path,
-                    )
-                    continue
-                return response
-            except UpstreamError as e:
-                logger.warning(
-                    "Upstream %s failed for unauthenticated GET %s: %s",
-                    upstream.provider_type,
-                    path,
-                    e,
-                )
-                if i == len(selected_upstreams) - 1:
-                    last_error_response = create_upstream_error_response(e, request)
-                continue
-        return last_error_response or create_error_response(
-            "upstream_error", "All upstreams failed", 502, request=request
-        )
-
-    candidates = get_candidates(model_id)
-
-    if not candidates:
+    model_obj = get_model_instance(model_id)
+    if not model_obj:
         return create_error_response(
             "invalid_model", f"Model '{model_id}' not found", 400, request=request
         )
 
-    if is_ehbp:
-        candidates = [
-            (model, upstream)
-            for model, upstream in candidates
-            if upstream.supports_ehbp
-        ]
-        if not candidates:
-            return create_error_response(
-                "unsupported_request",
-                f"No EHBP-capable provider found for model '{model_id}'",
-                400,
-                request=request,
-            )
+    upstreams = get_provider_for_model(model_id)
+    if not upstreams:
+        return create_error_response(
+            "invalid_model",
+            f"No provider found for model '{model_id}'",
+            400,
+            request=request,
+        )
 
-    # Reserve/max-cost checks use the best-ranked candidate; the failover loop
-    # below rebinds (model_obj, upstream) per candidate so forwarding and
-    # settlement always use the model of the provider actually being tried.
-    model_obj = candidates[0][0]
+    # todo figure out cost calculation since fallback provider is usually not the same price
+    # Use first provider for initial checks/cost calculation
+    # primary_upstream = upstreams[0]
 
     _max_cost_for_model = await get_max_cost_for_model(
         model=model_id, session=session, model_obj=model_obj
@@ -345,32 +176,13 @@ async def proxy(
     max_cost_for_model = await calculate_discounted_max_cost(
         _max_cost_for_model, request_body_dict, model_obj=model_obj
     )
-    # Ensure max_cost_for_model is at least the minimum allowed request cost
-    max_cost_for_model = max(max_cost_for_model, settings.min_request_msat)
-
     check_token_balance(headers, request_body_dict, max_cost_for_model)
 
     if x_cashu := headers.get("x-cashu", None):
         last_error = None
-        for i, (model_obj, upstream) in enumerate(candidates):
+        for i, upstream in enumerate(upstreams):
             try:
-                if is_ehbp:
-                    if not upstream.supports_ehbp:
-                        logger.warning(
-                            "Upstream %s does not support EHBP for model=%s",
-                            upstream.provider_type,
-                            model_id,
-                        )
-                        continue
-                    return await forward_ehbp_x_cashu_request(
-                        request=request,
-                        x_cashu_token=x_cashu,
-                        path=path,
-                        max_cost_for_model=max_cost_for_model,
-                        model_obj=model_obj,
-                        upstream=upstream,
-                    )
-                elif is_responses_api:
+                if is_responses_api:
                     return await upstream.handle_x_cashu_responses(
                         request, x_cashu, path, max_cost_for_model, model_obj
                     )
@@ -380,30 +192,21 @@ async def proxy(
                     )
             except UpstreamError as e:
                 logger.warning(
-                    "Upstream %s failed (x-cashu) for model=%s: %s",
-                    upstream.provider_type,
-                    model_id,
-                    e,
-                    extra={
-                        "provider": upstream.provider_type,
-                        "model": model_id,
-                        "status_code": e.status_code,
-                    },
+                    f"Upstream {upstream.provider_type} failed (x-cashu): {e}"
                 )
-                if i == len(candidates) - 1:
+                if i == len(upstreams) - 1:
                     last_error = e
                 continue
 
-        if last_error is not None:
-            return create_upstream_error_response(last_error, request)
         return create_error_response(
-            "upstream_error", "All upstreams failed", 502, request=request
+            "upstream_error",
+            str(last_error) if last_error else "All upstreams failed",
+            502,
+            request=request,
         )
 
     elif auth := headers.get("authorization", None):
-        key = await get_bearer_token_key(
-            headers, path, session, auth, max_cost_for_model, model_id
-        )
+        key = await get_bearer_token_key(headers, path, session, auth)
 
     else:
         if request.method not in ["GET"]:
@@ -417,12 +220,12 @@ async def proxy(
         logger.debug("Processing unauthenticated GET request", extra={"path": path})
 
         last_error_response = None
-        for i, (_, upstream) in enumerate(candidates):
+        for i, upstream in enumerate(upstreams):
             try:
                 headers = upstream.prepare_headers(dict(request.headers))
                 response = await upstream.forward_get_request(request, path, headers)
 
-                if response.status_code in [502, 429] and i < len(candidates) - 1:
+                if response.status_code in [502, 429] and i < len(upstreams) - 1:
                     error_message = ""
                     try:
                         if hasattr(response, "body"):
@@ -452,158 +255,63 @@ async def proxy(
                 return response
             except UpstreamError as e:
                 logger.warning(f"Upstream {upstream.provider_type} failed (GET): {e}")
-                if i == len(candidates) - 1:
-                    last_error_response = create_upstream_error_response(e, request)
+                if i == len(upstreams) - 1:
+                    last_error_response = create_error_response(
+                        "upstream_error", str(e), 502, request=request
+                    )
                 continue
         return last_error_response or create_error_response(
             "upstream_error", "All upstreams failed", 502, request=request
         )
 
-    reservation_snapshot: ReservationSnapshot | None = None
-    if is_ehbp or request_body_dict:
+    if request_body_dict:
         await pay_for_request(key, max_cost_for_model, session)
-        reservation_snapshot = await get_reservation_snapshot(key, session)
-
-    # Tracks request params already removed in response to upstream rejections,
-    # shared across providers so a stripped param stays stripped on failover and
-    # the reactive retry can never loop unboundedly.
-    already_stripped: set[str] = set()
-
-    for i, (model_obj, upstream) in enumerate(candidates):
-        if i > 0 and request_body_dict:
-            # The reservation was sized to the previous candidate's envelope;
-            # settlement bills the serving candidate, so a pricier fallback
-            # must be re-reserved at its own max cost before it is tried. A
-            # candidate whose envelope the key cannot cover is rejected, just
-            # as it would be had it been ranked first.
-            candidate_max = await get_max_cost_for_model(
-                model=model_id, session=session, model_obj=model_obj
-            )
-            candidate_max = await calculate_discounted_max_cost(
-                candidate_max, request_body_dict, model_obj=model_obj
-            )
-            candidate_max = max(candidate_max, settings.min_request_msat)
-            if candidate_max > max_cost_for_model:
-                await revert_pay_for_request(
-                    key, session, max_cost_for_model, reservation_snapshot
-                )
-                try:
-                    await pay_for_request(key, candidate_max, session)
-                except HTTPException:
-                    if i == len(candidates) - 1:
-                        raise
-                    await pay_for_request(key, max_cost_for_model, session)
-                    reservation_snapshot = await get_reservation_snapshot(key, session)
-                    continue
-                reservation_snapshot = await get_reservation_snapshot(key, session)
-                max_cost_for_model = candidate_max
 
+    for i, upstream in enumerate(upstreams):
         headers = upstream.prepare_headers(dict(request.headers))
 
         try:
-            while True:
-                try:
-                    if is_ehbp:
-                        if not upstream.supports_ehbp:
-                            logger.warning(
-                                "Upstream %s does not support EHBP for model=%s",
-                                upstream.provider_type,
-                                model_id,
-                            )
-                            raise UpstreamError(
-                                f"Provider {upstream.provider_type} does not support EHBP",
-                                status_code=400,
-                            )
-                        response = await forward_ehbp_request(
-                            request=request,
-                            path=path,
-                            headers=headers,
-                            request_body=request_body,
-                            upstream=upstream,
-                            key=key,
-                            max_cost_for_model=max_cost_for_model,
-                            session=session,
-                            model_obj=model_obj,
-                            reservation_snapshot=reservation_snapshot,
-                        )
-                    elif is_responses_api:
-                        response = await upstream.forward_responses_request(
-                            request,
-                            path,
-                            headers,
-                            request_body,
-                            key,
-                            max_cost_for_model,
-                            session,
-                            model_obj,
-                            reservation_snapshot,
-                        )
-                    else:
-                        response = await upstream.forward_request(
-                            request,
-                            path,
-                            headers,
-                            request_body,
-                            key,
-                            max_cost_for_model,
-                            session,
-                            model_obj,
-                            reservation_snapshot,
-                        )
-                except UpstreamError:
-                    # Let the outer UpstreamError handler manage retry/revert
-                    raise
-                except Exception as e:
-                    # Unexpected error (not an upstream failure) — revert and propagate
-                    logger.error(
-                        "Unexpected error in upstream request, reverting payment",
-                        extra={
-                            "error": str(e),
-                            "error_type": type(e).__name__,
-                            "path": path,
-                            "key_hash": key.hashed_key[:8] + "...",
-                            "max_cost_for_model": max_cost_for_model,
-                        },
-                    )
-                    await revert_pay_for_request(
-                        key, session, max_cost_for_model, reservation_snapshot
-                    )
-                    raise
-
-                # Reactive recovery: some models reject one specific request
-                # param (e.g. newer Anthropic models deprecating `temperature`).
-                # When the upstream 400s naming such a param, strip it from the
-                # body and retry the SAME upstream. ``already_stripped`` bounds
-                # this to one retry per distinct param so it always terminates.
-                if response.status_code == 400 and not is_ehbp:
-                    correction = correct_request(
+            try:
+                if is_responses_api:
+                    response = await upstream.forward_responses_request(
+                        request,
+                        path,
+                        headers,
                         request_body,
-                        extract_error_message(response),
-                        already_stripped,
+                        key,
+                        max_cost_for_model,
+                        session,
+                        model_obj,
                     )
-                    if correction is not None:
-                        request_body, bad_param = correction.body, correction.label
-                        already_stripped.add(bad_param)
-                        logger.warning(
-                            "Upstream %s rejected param '%s' for model=%s; "
-                            "stripping and retrying same upstream",
-                            upstream.provider_type,
-                            bad_param,
-                            model_id,
-                            extra={
-                                "provider": upstream.provider_type,
-                                "model": model_id,
-                                "stripped_param": bad_param,
-                                "path": path,
-                            },
-                        )
-                        continue
-                break
+                else:
+                    response = await upstream.forward_request(
+                        request,
+                        path,
+                        headers,
+                        request_body,
+                        key,
+                        max_cost_for_model,
+                        session,
+                        model_obj,
+                    )
+            except Exception as e:
+                logger.error(
+                    "Upstream request failed, ensuring payment is reverted",
+                    extra={
+                        "error": str(e),
+                        "error_type": type(e).__name__,
+                        "path": path,
+                        "key_hash": key.hashed_key[:8] + "...",
+                        "max_cost_for_model": max_cost_for_model,
+                    },
+                )
+                await revert_pay_for_request(key, session, max_cost_for_model)
+                raise
 
             if response.status_code != 200:
                 # Check if we should retry (502 Upstream Error or 429 Rate Limit)
                 should_retry = response.status_code in [502, 429, 400, 401, 403, 404]
-                if should_retry and i < len(candidates) - 1:
+                if should_retry and i < len(upstreams) - 1:
                     error_message = ""
                     try:
                         if hasattr(response, "body"):
@@ -623,80 +331,45 @@ async def proxy(
                     )
 
                     logger.warning(
-                        "Upstream %s returned %s for model=%s, trying next provider",
-                        upstream.provider_type,
-                        response.status_code,
-                        model_id,
+                        f"Upstream {upstream.provider_type} returned {response.status_code}, trying next provider",
                         extra={
                             "status_code": response.status_code,
-                            "provider": upstream.provider_type,
-                            "model": model_id,
+                            "upstream": upstream.provider_type,
                         },
                     )
                     continue
 
                 # 4xx error (user error), or other non-retryable error, or last provider failed
-                await revert_pay_for_request(
-                    key, session, max_cost_for_model, reservation_snapshot
-                )
+                await revert_pay_for_request(key, session, max_cost_for_model)
                 logger.warning(
-                    "Upstream request failed, revert payment "
-                    "(provider=%s model=%s status=%s path=%s)",
-                    upstream.provider_type,
-                    model_id,
-                    response.status_code,
-                    path,
+                    "Upstream request failed, revert payment",
                     extra={
                         "status_code": response.status_code,
                         "path": path,
-                        "provider": upstream.provider_type,
-                        "model": model_id,
                         "key_hash": key.hashed_key[:8] + "...",
                         "key_balance": key.balance,
                         "max_cost_for_model": max_cost_for_model,
+                        "upstream_headers": response.headers
+                        if hasattr(response, "headers")
+                        else None,
                     },
                 )
                 return response
 
             return response
 
-        except asyncio.CancelledError:
-            logger.warning(
-                "Client disconnected mid-request, reverting reservation",
-                extra={
-                    "path": path,
-                    "model": model_id,
-                    "key_hash": key.hashed_key[:8] + "...",
-                    "max_cost_for_model": max_cost_for_model,
-                },
-            )
-            # The cancellation has been caught, so complete exact cleanup in
-            # this task before the request-scoped session can be torn down.
-            await revert_pay_for_request(
-                key, session, max_cost_for_model, reservation_snapshot
-            )
-            raise
-
         except UpstreamError as e:
             logger.warning(
-                "Upstream %s failed for model=%s: %s",
-                upstream.provider_type,
-                model_id,
-                e,
-                extra={
-                    "provider": upstream.provider_type,
-                    "model": model_id,
-                    "status_code": e.status_code,
-                    "retry": i < len(candidates) - 1,
-                },
+                f"Upstream {upstream.provider_type} failed: {e}",
+                extra={"retry": i < len(upstreams) - 1},
             )
 
             # If this was the last provider
-            if i == len(candidates) - 1:
-                await revert_pay_for_request(
-                    key, session, max_cost_for_model, reservation_snapshot
+            if i == len(upstreams) - 1:
+                await revert_pay_for_request(key, session, max_cost_for_model)
+                return create_error_response(
+                    "upstream_error", str(e), 502, request=request
                 )
-                return create_upstream_error_response(e, request)
 
             # Otherwise loop continues to next provider
             continue
@@ -708,16 +381,10 @@ async def proxy(
 
 
 async def get_bearer_token_key(
-    headers: dict,
-    path: str,
-    session: AsyncSession,
-    auth: str,
-    min_cost: int = 0,
-    model_id: str = "unknown",
+    headers: dict, path: str, session: AsyncSession, auth: str
 ) -> ApiKey:
     """Handle bearer token authentication proxy requests."""
-    parts = auth.split()
-    bearer_key = parts[1] if len(parts) > 1 and parts[0].lower() == "bearer" else ""
+    bearer_key = auth.replace("Bearer ", "") if auth.startswith("Bearer ") else ""
     refund_address = headers.get("Refund-LNURL", None)
     key_expiry_time = headers.get("Key-Expiry-Time", None)
 
@@ -730,7 +397,6 @@ async def get_bearer_token_key(
             "bearer_key_preview": bearer_key[:20] + "..."
             if len(bearer_key) > 20
             else bearer_key,
-            "min_cost": min_cost,
         },
     )
 
@@ -769,7 +435,6 @@ async def get_bearer_token_key(
             session,
             refund_address,
             key_expiry_time,  # type: ignore
-            min_cost=min_cost,
         )
         logger.info(
             "Bearer token validated successfully",
@@ -781,16 +446,15 @@ async def get_bearer_token_key(
         )
         return key
     except Exception as e:
-        key_preview = bearer_key[:20] + "..." if len(bearer_key) > 20 else bearer_key
         logger.error(
-            f"Bearer token validation failed: {type(e).__name__}: {e} path={path} model={model_id!r} min_cost={min_cost} key={key_preview!r}",
+            "Bearer token validation failed",
             extra={
                 "error": str(e),
                 "error_type": type(e).__name__,
                 "path": path,
-                "model_id": model_id,
-                "min_cost_msat": min_cost,
-                "bearer_key_preview": key_preview,
+                "bearer_key_preview": bearer_key[:20] + "..."
+                if len(bearer_key) > 20
+                else bearer_key,
             },
         )
         raise

routstr/upstream/__init__.py

@@ -10,8 +10,6 @@ from .openai import OpenAIUpstreamProvider
 from .openrouter import OpenRouterUpstreamProvider
 from .perplexity import PerplexityUpstreamProvider
 from .ppqai import PPQAIUpstreamProvider
-from .routstr import RoutstrUpstreamProvider
-from .tinfoil import TinfoilUpstreamProvider
 from .xai import XAIUpstreamProvider
 
 upstream_provider_classes: list[type[BaseUpstreamProvider]] = [
@@ -26,8 +24,6 @@ upstream_provider_classes: list[type[BaseUpstreamProvider]] = [
     OpenRouterUpstreamProvider,
     PerplexityUpstreamProvider,
     PPQAIUpstreamProvider,
-    RoutstrUpstreamProvider,
-    TinfoilUpstreamProvider,
     XAIUpstreamProvider,
 ]
 """List of all upstream classes"""

routstr/upstream/anthropic.py

@@ -13,8 +13,6 @@ class AnthropicUpstreamProvider(BaseUpstreamProvider):
     provider_type = "anthropic"
     default_base_url = "https://api.anthropic.com/v1"
     platform_url = "https://console.anthropic.com/settings/keys"
-    supports_anthropic_messages = True
-    litellm_provider_prefix = "anthropic/"
 
     def __init__(self, api_key: str, provider_fee: float = 1.01):
         super().__init__(
@@ -24,7 +22,7 @@ class AnthropicUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "AnthropicUpstreamProvider":
         return cls(

routstr/upstream/auto_topup.py

@@ -1,202 +0,0 @@
-import asyncio
-import json
-
-from sqlmodel import select
-
-from ..core import get_logger
-from ..core.db import (
-    CashuTransaction,
-    UpstreamProviderRow,
-    create_session,
-)
-from ..core.db import (
-    store_cashu_transaction_with_retry as store_cashu_transaction,
-)
-from ..wallet import send_token
-from .routstr import RoutstrUpstreamProvider
-
-logger = get_logger(__name__)
-
-# Check every 60 seconds
-AUTO_TOPUP_INTERVAL_SECONDS = 60
-
-
-async def periodic_auto_topup() -> None:
-    """Background task that monitors Routstr provider balances and auto-tops up when below threshold.
-
-    For each Routstr provider with auto_topup enabled in provider_settings:
-    1. Checks the upstream balance via get_balance()
-    2. If balance < topup_threshold, creates a cashu token from the configured mint
-    3. Sends the token to the upstream provider via topup()
-    """
-    # Wait for initial startup to complete
-    await asyncio.sleep(30)
-    logger.info("Auto top-up worker started")
-
-    while True:
-        try:
-            await _run_auto_topup_cycle()
-        except Exception as e:
-            logger.error(
-                "Auto top-up cycle failed",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-
-        await asyncio.sleep(AUTO_TOPUP_INTERVAL_SECONDS)
-
-
-async def _run_auto_topup_cycle() -> None:
-    """Single cycle: check all eligible providers and top up if needed."""
-    async with create_session() as session:
-        query = select(UpstreamProviderRow).where(
-            UpstreamProviderRow.provider_type == "routstr",
-            UpstreamProviderRow.enabled == True,  # noqa: E712
-        )
-        result = await session.exec(query)
-        providers = result.all()
-
-    for row in providers:
-        try:
-            await _check_and_topup(row)
-        except Exception as e:
-            logger.error(
-                "Auto top-up failed for provider",
-                extra={
-                    "provider_id": row.id,
-                    "base_url": row.base_url,
-                    "error": str(e),
-                    "error_type": type(e).__name__,
-                },
-            )
-
-
-async def _check_and_topup(row: UpstreamProviderRow) -> None:
-    """Check a single provider's balance and top up if below threshold."""
-    # Parse provider settings
-    settings: dict = {}
-    if row.provider_settings:
-        try:
-            settings = json.loads(row.provider_settings)
-        except (json.JSONDecodeError, TypeError):
-            return
-
-    if not settings.get("auto_topup"):
-        return
-
-    threshold = settings.get("topup_threshold")
-    amount = settings.get("topup_amount_limit")
-    mint_url = settings.get("topup_mint_url")
-
-    if not threshold or not amount or not mint_url:
-        logger.warning(
-            "Auto top-up enabled but missing configuration",
-            extra={
-                "provider_id": row.id,
-                "has_threshold": bool(threshold),
-                "has_amount": bool(amount),
-                "has_mint": bool(mint_url),
-            },
-        )
-        return
-
-    if not row.api_key:
-        return
-
-    # Instantiate provider and check balance
-    provider = RoutstrUpstreamProvider.from_db_row(row)
-    if provider is None:
-        return
-    balance = await provider.get_balance()
-
-    if balance is None:
-        logger.warning(
-            "Could not fetch balance for auto top-up",
-            extra={"provider_id": row.id, "base_url": row.base_url},
-        )
-        return
-
-    if balance >= threshold * 1000:
-        return
-
-    # Balance is below threshold - create token and top up
-    logger.info(
-        "Auto top-up triggered",
-        extra={
-            "provider_id": row.id,
-            "balance": balance,
-            "threshold": threshold,
-            "topup_amount": amount,
-            "mint_url": mint_url,
-        },
-    )
-
-    try:
-        token = await send_token(amount, "sat", mint_url)
-    except Exception as e:
-        logger.error(
-            "Failed to create cashu token for auto top-up",
-            extra={
-                "provider_id": row.id,
-                "amount": amount,
-                "mint_url": mint_url,
-                "error": str(e),
-            },
-        )
-        return
-
-    try:
-        await store_cashu_transaction(
-            token=token,
-            amount=amount,
-            unit="sat",
-            mint_url=mint_url,
-            typ="out",
-            collected=False,
-            source="auto_topup",
-        )
-    except Exception:
-        logger.critical(
-            "Aborting auto top-up because its cashu token could not be persisted",
-            extra={"provider_id": row.id, "mint_url": mint_url},
-        )
-        return
-
-    result = await provider.topup(token)
-
-    if "error" in result:
-        logger.error(
-            "Auto top-up upstream call failed",
-            extra={
-                "provider_id": row.id,
-                "error": result["error"],
-            },
-        )
-    else:
-        async with create_session() as session:
-            transaction = (
-                await session.exec(
-                    select(CashuTransaction).where(
-                        CashuTransaction.token == token,
-                        CashuTransaction.type == "out",
-                        CashuTransaction.source == "auto_topup",
-                    )
-                )
-            ).first()
-            if transaction is None:
-                logger.critical(
-                    "Completed auto top-up transaction is missing from the database",
-                    extra={"provider_id": row.id, "mint_url": mint_url},
-                )
-            else:
-                transaction.collected = True
-                session.add(transaction)
-                await session.commit()
-
-        logger.info(
-            "Auto top-up completed successfully",
-            extra={
-                "provider_id": row.id,
-                "amount": amount,
-                "new_balance_approx": balance + amount,
-            },
-        )

routstr/upstream/azure.py

@@ -4,7 +4,6 @@ from .base import BaseUpstreamProvider
 
 if TYPE_CHECKING:
     from ..core.db import UpstreamProviderRow
-    from ..payment.models import Model
 
 
 class AzureUpstreamProvider(BaseUpstreamProvider):
@@ -13,7 +12,6 @@ class AzureUpstreamProvider(BaseUpstreamProvider):
     provider_type = "azure"
     default_base_url = None
     platform_url = "https://portal.azure.com/"
-    litellm_provider_prefix = "azure/"
 
     def __init__(
         self,
@@ -38,7 +36,7 @@ class AzureUpstreamProvider(BaseUpstreamProvider):
         self.api_version = api_version
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "AzureUpstreamProvider | None":
         if not provider_row.api_version:
@@ -60,52 +58,19 @@ class AzureUpstreamProvider(BaseUpstreamProvider):
             "platform_url": cls.platform_url,
         }
 
-    def prepare_headers(self, request_headers: dict) -> dict:
-        """Prepare headers for Azure OpenAI, adding api-key."""
-        headers = super().prepare_headers(request_headers)
-        if self.api_key:
-            headers["api-key"] = self.api_key
-            headers.pop("Authorization", None)
-            headers.pop("authorization", None)
-        return headers
-
     def prepare_params(
         self, path: str, query_params: Mapping[str, str] | None
     ) -> Mapping[str, str]:
-        """Prepare query parameters for Azure OpenAI, adding API version."""
+        """Prepare query parameters for Azure OpenAI, adding API version.
+
+        Args:
+            path: Request path
+            query_params: Original query parameters from the client
+
+        Returns:
+            Query parameters dict with Azure API version added for chat completions
+        """
         params = dict(query_params or {})
-        version = (self.api_version or "").replace("\ufeff", "").strip()
-        if not version or version.lower() == "v1":
-            version = "2024-02-15-preview"
-        params["api-version"] = version
+        if path.endswith("chat/completions"):
+            params["api-version"] = self.api_version
         return params
-
-    def normalize_request_path(
-        self, path: str, model_obj: "Model | None" = None
-    ) -> str:
-        """Build Azure deployment-specific request path."""
-        clean_path = super().normalize_request_path(path, model_obj).lstrip("/")
-        if model_obj is None:
-            return clean_path
-
-        deployment_id = getattr(
-            model_obj, "canonical_slug", None
-        ) or self.transform_model_name(model_obj.id)
-        deployment_id = deployment_id.split("/")[-1]
-        return f"openai/deployments/{deployment_id}/{clean_path}"
-
-    def get_request_base_url(
-        self, path: str, model_obj: "Model | None" = None
-    ) -> str:
-        """Use endpoint root, stripping accidental /openai/v1 suffix if present."""
-        base_url = self.base_url.rstrip("/")
-        marker = "/openai/v1"
-        if marker in base_url:
-            base_url = base_url.split(marker, 1)[0].rstrip("/")
-        return base_url
-
-    def transform_model_name(self, model_id: str) -> str:
-        """Extract deployment name from model ID."""
-        if "/" in model_id:
-            return model_id.split("/")[-1]
-        return model_id

routstr/upstream/cache_breakpoints.py

@@ -1,157 +0,0 @@
-"""Inject explicit prompt-cache breakpoints into OpenAI-shaped requests.
-
-Some upstreams cache *explicitly*: the request must carry
-``cache_control: {"type": "ephemeral"}`` markers on the content blocks that
-should be cached. Two model families use this identical wire format:
-
-* **Anthropic Claude** — direct or via OpenRouter's ``anthropic/*`` models.
-* **Alibaba's explicit-cache models on OpenRouter** — ``qwen/qwen3-max``,
-  ``qwen/qwen-plus``, ``qwen/qwen3.6-plus``, ``qwen/qwen3-coder-plus``,
-  ``qwen/qwen3-coder-flash`` and ``deepseek/deepseek-v3.2`` — which OpenRouter
-  documents as using "the same syntax as Anthropic explicit caching".
-
-Every other provider routstr proxies (OpenAI, Azure, xAI/Grok, Groq, Moonshot,
-default DeepSeek, Gemini implicit, Fireworks) caches *automatically* and needs
-no markers — they are left untouched.
-
-A client that doesn't know it is talking to one of these models *through*
-routstr (e.g. an OpenAI-compatible coding agent pointed at a routstr URL) never
-emits the markers — it only adds them when it recognises the provider as
-OpenRouter. So caching silently never engages over routstr even though the same
-client caches fine talking to OpenRouter directly.
-
-This module restores caching by stamping the standard breakpoints onto the
-forwarded body — the system prompt, the last tool, and the last conversation
-message (the format allows up to four; we use three, matching the common
-agent convention) — but only when the client supplied none of its own, so
-explicit client control always wins. The caller is responsible for only
-applying this toward an upstream that accepts the markers (OpenRouter /
-Anthropic), so they never leak to a provider that would reject them.
-"""
-
-from __future__ import annotations
-
-from typing import Any
-
-# The single ephemeral marker stamped onto each chosen breakpoint. A 5-minute
-# TTL (the default for ``ephemeral``) — deliberately not the 1h tier, which
-# carries a higher cache-write premium and should stay opt-in.
-EPHEMERAL_CACHE_CONTROL: dict[str, str] = {"type": "ephemeral"}
-
-# Alibaba's explicit-cache models on OpenRouter. Matched as substrings of the
-# model id (any spelling routstr carries). Snapshot endpoints that OpenRouter
-# documents as *not* supporting explicit caching (e.g. ``qwen3.5-plus-02-15``)
-# are different families and deliberately absent from this list.
-_ALIBABA_EXPLICIT_CACHE_SLUGS: tuple[str, ...] = (
-    "qwen3-max",
-    "qwen-plus",
-    "qwen3.6-plus",
-    "qwen3-coder-plus",
-    "qwen3-coder-flash",
-    "deepseek-v3.2",
-)
-
-
-def is_explicit_cache_model(model_id: str | None, *fallbacks: str | None) -> bool:
-    """True when the target model uses the explicit ``cache_control`` dialect.
-
-    Covers the Claude family (broadly — every Claude model supports it) and
-    Alibaba's documented explicit-cache models, across the id spellings routstr
-    carries: the OpenRouter id (``anthropic/claude-...``, ``qwen/qwen3-max``),
-    the bare upstream id, and any forwarded/canonical alias.
-    """
-    for candidate in (model_id, *fallbacks):
-        if not candidate:
-            continue
-        lowered = candidate.lower()
-        if "claude" in lowered or "anthropic/" in lowered:
-            return True
-        if any(slug in lowered for slug in _ALIBABA_EXPLICIT_CACHE_SLUGS):
-            return True
-    return False
-
-
-def _has_cache_control(obj: Any) -> bool:
-    """Recursively detect any client-supplied ``cache_control`` marker."""
-    if isinstance(obj, dict):
-        if "cache_control" in obj:
-            return True
-        return any(_has_cache_control(v) for v in obj.values())
-    if isinstance(obj, list):
-        return any(_has_cache_control(v) for v in obj)
-    return False
-
-
-def body_has_cache_control(data: dict) -> bool:
-    """True when the request already carries cache_control on messages/tools."""
-    return _has_cache_control(data.get("messages")) or _has_cache_control(
-        data.get("tools")
-    )
-
-
-def _stamp_text_content(message: dict) -> bool:
-    """Add the ephemeral marker to a message's last text block.
-
-    A string content is promoted to the array form Anthropic requires for
-    cache markers; an existing array gets the marker on its last text part.
-    Returns True when a marker was placed.
-    """
-    content = message.get("content")
-    if isinstance(content, str):
-        if not content:
-            return False
-        message["content"] = [
-            {
-                "type": "text",
-                "text": content,
-                "cache_control": dict(EPHEMERAL_CACHE_CONTROL),
-            }
-        ]
-        return True
-    if isinstance(content, list):
-        for part in reversed(content):
-            if isinstance(part, dict) and part.get("type") == "text":
-                part["cache_control"] = dict(EPHEMERAL_CACHE_CONTROL)
-                return True
-    return False
-
-
-def _stamp_system_prompt(messages: list) -> None:
-    for message in messages:
-        if isinstance(message, dict) and message.get("role") in (
-            "system",
-            "developer",
-        ):
-            _stamp_text_content(message)
-            return
-
-
-def _stamp_last_tool(tools: Any) -> None:
-    if isinstance(tools, list) and tools and isinstance(tools[-1], dict):
-        tools[-1]["cache_control"] = dict(EPHEMERAL_CACHE_CONTROL)
-
-
-def _stamp_last_conversation_message(messages: list) -> None:
-    for message in reversed(messages):
-        if isinstance(message, dict) and message.get("role") in ("user", "assistant"):
-            if _stamp_text_content(message):
-                return
-
-
-def inject_anthropic_cache_breakpoints(data: dict) -> bool:
-    """Stamp ephemeral cache breakpoints onto an OpenAI-shaped chat body.
-
-    Mutates ``data`` in place (the established convention in
-    ``prepare_request_body``) and returns True when anything changed. No-ops
-    when the body isn't chat-shaped or the client already set cache_control.
-    """
-    messages = data.get("messages")
-    if not isinstance(messages, list) or not messages:
-        return False
-    if body_has_cache_control(data):
-        return False
-
-    _stamp_system_prompt(messages)
-    _stamp_last_tool(data.get("tools"))
-    _stamp_last_conversation_message(messages)
-    return True

routstr/upstream/clients/gemini.py

@@ -26,14 +26,14 @@ class GeminiClient(BaseAPIClient):
         max_tokens: int | None = None,
         **kwargs: Any,
     ) -> dict[str, Any]:
-        from openai import omit
+        from openai import NOT_GIVEN
 
         response = await self.client.chat.completions.create(
             model=model,
             messages=messages,  # type: ignore
-            temperature=temperature if temperature is not None else omit,
-            max_tokens=max_tokens if max_tokens is not None else omit,
-            top_p=kwargs.get("top_p", omit),
+            temperature=temperature if temperature is not None else NOT_GIVEN,
+            max_tokens=max_tokens if max_tokens is not None else NOT_GIVEN,
+            top_p=kwargs.get("top_p", NOT_GIVEN),
         )
         return response.model_dump()
 
@@ -45,7 +45,7 @@ class GeminiClient(BaseAPIClient):
         max_tokens: int | None = None,
         **kwargs: Any,
     ) -> AsyncGenerator[dict[str, Any], None]:
-        from openai import omit
+        from openai import NOT_GIVEN
 
         usage_callback = kwargs.get("usage_callback")
         completion_callback = kwargs.get("completion_callback")
@@ -55,9 +55,9 @@ class GeminiClient(BaseAPIClient):
             messages=messages,  # type: ignore
             stream=True,
             stream_options={"include_usage": True},
-            temperature=temperature if temperature is not None else omit,
-            max_tokens=max_tokens if max_tokens is not None else omit,
-            top_p=kwargs.get("top_p", omit),
+            temperature=temperature if temperature is not None else NOT_GIVEN,
+            max_tokens=max_tokens if max_tokens is not None else NOT_GIVEN,
+            top_p=kwargs.get("top_p", NOT_GIVEN),
         )
 
         final_usage = None

routstr/upstream/count_tokens.py

@@ -1,108 +0,0 @@
-"""Local handling of Anthropic ``/v1/messages/count_tokens`` for upstreams
-that do not natively expose the endpoint.
-
-Most non-Anthropic upstreams (OpenAI-compat, Gemini OpenAI-compat,
-OpenRouter chat-completions, generic providers) return 400/404 when asked
-to ``POST /messages/count_tokens``. Claude Code and other Anthropic SDK
-clients call this endpoint before each turn to size context windows and
-trigger compaction, so a failure breaks the whole chat.
-
-We answer locally. ``litellm.token_counter`` understands the Anthropic
-message shape and the per-model tokenizers, so we prefer it. If it raises
-(unknown model, encoding lookup failure, ...), we fall back to the
-project's own ``estimate_tokens`` heuristic, which is always defined and
-never raises.
-"""
-
-from __future__ import annotations
-
-import json
-from typing import Any
-
-import litellm
-from fastapi.responses import Response
-
-from ..core import get_logger
-from ..payment.helpers import estimate_tokens
-from ..payment.models import Model
-
-logger = get_logger(__name__)
-
-
-def _parse_request_body(request_body: bytes | None) -> dict[str, Any]:
-    if not request_body:
-        return {}
-    try:
-        parsed = json.loads(request_body)
-    except (ValueError, TypeError):
-        return {}
-    return parsed if isinstance(parsed, dict) else {}
-
-
-def _count_with_litellm(model: str, body: dict[str, Any]) -> int:
-    messages = body.get("messages")
-    if not isinstance(messages, list):
-        messages = []
-
-    system = body.get("system")
-    if isinstance(system, str) and system:
-        messages = [{"role": "system", "content": system}, *messages]
-    elif isinstance(system, list):
-        text = "".join(
-            block.get("text", "")
-            for block in system
-            if isinstance(block, dict) and block.get("type") == "text"
-        )
-        if text:
-            messages = [{"role": "system", "content": text}, *messages]
-
-    tools = body.get("tools") if isinstance(body.get("tools"), list) else None
-
-    return int(
-        litellm.token_counter(
-            model=model,
-            messages=messages,
-            tools=tools,
-        )
-    )
-
-
-def count_tokens_locally(
-    request_body: bytes | None,
-    model_obj: Model | None,
-) -> Response:
-    """Return an Anthropic-compatible count_tokens response without
-    touching the upstream. Always returns 200; never raises."""
-    body = _parse_request_body(request_body)
-
-    model_name = ""
-    if model_obj is not None:
-        model_name = model_obj.forwarded_model_id or model_obj.id or ""
-    if not model_name:
-        body_model = body.get("model")
-        if isinstance(body_model, str):
-            model_name = body_model
-
-    input_tokens: int
-    try:
-        input_tokens = _count_with_litellm(model_name, body)
-    except Exception as exc:
-        messages = body.get("messages")
-        fallback_messages = messages if isinstance(messages, list) else []
-        input_tokens = estimate_tokens(fallback_messages)
-        logger.debug(
-            "litellm token_counter failed; using local estimator",
-            extra={
-                "model": model_name,
-                "error": str(exc),
-                "error_type": type(exc).__name__,
-                "estimated_tokens": input_tokens,
-            },
-        )
-
-    payload = {"input_tokens": max(0, int(input_tokens))}
-    return Response(
-        content=json.dumps(payload).encode(),
-        status_code=200,
-        media_type="application/json",
-    )

routstr/upstream/deepseek_v4_pricing_shim.py

@@ -1,73 +0,0 @@
-"""TEMPORARY: local DeepSeek V4 pricing shim.
-
-litellm's bundled cost map does not yet ship ``deepseek-v4-flash`` /
-``deepseek-v4-pro``. Without an entry, ``backfill_cache_pricing`` cannot find a
-``cache_read_input_token_cost`` and cache reads fall back to the full input
-rate — a large overcharge on cache hits (DeepSeek V4 hits are ~0.008-0.02x
-input, i.e. cached tokens cost 50-120x less than regular input).
-
-This module injects the missing entries into ``litellm.model_cost`` at startup
-so the existing backfill path resolves them. Rates mirror the canonical
-``deepseek`` provider entries now in litellm's ``model_prices`` map
-(``input_cost_per_token`` is the cache-*miss* rate;
-``cache_read_input_token_cost`` is the cache-*hit* rate), sourced from
-https://api-docs.deepseek.com/quick_start/pricing via
-https://github.com/BerriAI/litellm/pull/26380 (issue
-https://github.com/BerriAI/litellm/issues/30430).
-
-=== REMOVAL (once litellm ships these models) ===
-Delete this file and the single ``register_deepseek_v4_pricing()`` call in
-``routstr/core/main.py``. Nothing else depends on it. Entries are only added
-when absent, so a stale shim is harmless after upstream lands — but remove it.
-"""
-
-import litellm
-
-from ..core import get_logger
-
-logger = get_logger(__name__)
-
-# USD per token. Mirrors the canonical ``deepseek`` provider entries in
-# litellm's model_prices map (source: DeepSeek API pricing docs). Keep these in
-# sync with ``litellm.model_cost["deepseek/deepseek-v4-*"]``.
-_DEEPSEEK_V4_RATES: dict[str, dict[str, float]] = {
-    "deepseek-v4-flash": {
-        "input_cost_per_token": 1.4e-07,
-        "output_cost_per_token": 2.8e-07,
-        "cache_read_input_token_cost": 2.8e-09,
-        "cache_creation_input_token_cost": 0.0,
-        "input_cost_per_token_cache_hit": 2.8e-09,
-    },
-    "deepseek-v4-pro": {
-        "input_cost_per_token": 4.35e-07,
-        "output_cost_per_token": 8.7e-07,
-        "cache_read_input_token_cost": 3.625e-09,
-        "cache_creation_input_token_cost": 0.0,
-        "input_cost_per_token_cache_hit": 3.625e-09,
-    },
-}
-
-
-def register_deepseek_v4_pricing() -> None:
-    """Inject DeepSeek V4 pricing into ``litellm.model_cost`` if absent.
-
-    Idempotent and non-destructive: a key already present in the cost map
-    (e.g. once litellm ships it) is left untouched. Registers both the bare
-    (``deepseek-v4-flash``) and prefixed (``deepseek/deepseek-v4-flash``)
-    spellings since ``backfill_cache_pricing`` tries both.
-    """
-    added = []
-    for bare, rates in _DEEPSEEK_V4_RATES.items():
-        for key in (bare, f"deepseek/{bare}"):
-            if key in litellm.model_cost:
-                continue
-            entry: dict[str, object] = dict(rates)
-            entry["litellm_provider"] = "deepseek"
-            entry["mode"] = "chat"
-            litellm.model_cost[key] = entry
-            added.append(key)
-    if added:
-        logger.info(
-            "Registered temporary DeepSeek V4 pricing shim",
-            extra={"models": added},
-        )

routstr/upstream/fireworks.py

@@ -12,7 +12,6 @@ class FireworksUpstreamProvider(BaseUpstreamProvider):
     provider_type = "fireworks"
     default_base_url = "https://api.fireworks.ai/inference/v1"
     platform_url = "https://app.fireworks.ai/settings/users/api-keys"
-    litellm_provider_prefix = "fireworks_ai/"
 
     def __init__(self, api_key: str, provider_fee: float = 1.01):
         super().__init__(
@@ -20,7 +19,7 @@ class FireworksUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "FireworksUpstreamProvider":
         return cls(

routstr/upstream/gemini.py

@@ -1,13 +1,17 @@
 from __future__ import annotations
 
+import json
+from collections.abc import AsyncGenerator
 from typing import TYPE_CHECKING, Any
 
-from . import gemini_messages
+from fastapi import Request
+from fastapi.responses import Response, StreamingResponse
+
 from .base import BaseUpstreamProvider
 from .clients.gemini import GeminiClient
 
 if TYPE_CHECKING:
-    from ..core.db import UpstreamProviderRow
+    from ..core.db import ApiKey, AsyncSession, UpstreamProviderRow
     from ..payment.models import Model
 
 from ..core.logging import get_logger
@@ -16,19 +20,9 @@ logger = get_logger(__name__)
 
 
 class GeminiUpstreamProvider(BaseUpstreamProvider):
-    """Gemini provider — proxies through Gemini's OpenAI-compat surface.
-
-    The chat-completions, embeddings, and models paths all flow through
-    :meth:`BaseUpstreamProvider.forward_request`; we only override
-    ``get_request_base_url`` to redirect to ``{base}/openai/...`` and
-    ``_dispatch_anthropic_messages`` to inject thought-signatures on the
-    /v1/messages path (see :mod:`gemini_messages` for that rationale).
-    """
-
     provider_type = "gemini"
     default_base_url = "https://generativelanguage.googleapis.com/v1beta"
     platform_url = "https://aistudio.google.com/app/apikey"
-    litellm_provider_prefix = "gemini/"
 
     def __init__(
         self,
@@ -45,13 +39,13 @@ class GeminiUpstreamProvider(BaseUpstreamProvider):
 
     @property
     def client(self) -> GeminiClient:
-        """Get or create the Gemini API client (used for the models listing)."""
+        """Get or create the Gemini API client."""
         if self._client is None:
             self._client = GeminiClient(api_key=self.api_key)
         return self._client
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "GeminiUpstreamProvider":
         return cls(
@@ -71,66 +65,240 @@ class GeminiUpstreamProvider(BaseUpstreamProvider):
         }
 
     def transform_model_name(self, model_id: str) -> str:
-        """Reduce a routstr model id to the bare upstream Gemini name.
+        return model_id.removeprefix("gemini/")
 
-        Gemini's OpenAI-compat surface expects the literal model id
-        (e.g. ``gemini-3.1-flash-lite-preview``) — no ``gemini/`` provider
-        prefix and no ``google/`` vendor sub-prefix. Take the last path
-        segment so we tolerate any of:
-
-            ``gemini-2.0-flash``
-            ``gemini/gemini-2.0-flash``
-            ``gemini/google/gemini-3.1-flash-lite-preview``
-        """
-        return model_id.rsplit("/", 1)[-1]
-
-    @property
-    def compat_base_url(self) -> str:
-        """Gemini's OpenAI-compat surface, regardless of what's stored.
-
-        Stored ``base_url`` may be ``.../v1beta`` (the native Gemini API
-        root) or ``.../v1beta/openai`` (already pointed at the compat
-        surface). Normalize to the latter.
-        """
-        return self.base_url.rstrip("/").removesuffix("/openai") + "/openai"
-
-    def get_request_base_url(
-        self, path: str, model_obj: "Model | None" = None
-    ) -> str:
-        """Route every proxied request to the OpenAI-compat surface.
-
-        Required because the stored ``base_url`` typically points at the
-        native Gemini API (``/v1beta``), but :meth:`forward_request`
-        forwards OpenAI-shaped paths (``/chat/completions``,
-        ``/embeddings``, ``/models``) which only exist under the
-        ``/openai`` subtree.
-        """
-        return self.compat_base_url
-
-    async def _dispatch_anthropic_messages(
+    async def forward_request(
         self,
+        request: Request,
+        path: str,
+        headers: dict,
         request_body: bytes | None,
-        model_obj: "Model",
-        *,
-        log_extra: dict[str, Any] | None = None,
-    ) -> tuple[bool, Any, str | None]:
-        """Dispatch /v1/messages via the gemini-specific httpx path.
+        key: ApiKey,
+        max_cost_for_model: int,
+        session: AsyncSession,
+        model_obj: Model,
+    ) -> Response | StreamingResponse:
+        # Remove provider prefix from model ID for Gemini API
+        if "/" in model_obj.id:
+            model_obj.id = model_obj.id.split("/", 1)[1]
 
-        See :mod:`routstr.upstream.gemini_messages` for the full rationale
-        (thought-signature injection, why litellm + the openai SDK can't
-        carry the required ``extra_content`` field).
-        """
-        return await gemini_messages.dispatch_gemini_messages(
-            request_body=request_body,
-            model_obj=model_obj,
-            base_url=self.compat_base_url,
-            api_key=self.api_key,
-            transform_model_name=self.transform_model_name,
-            log_extra=log_extra,
-        )
+        if not path.startswith("chat/completions"):
+            return await super().forward_request(
+                request,
+                path,
+                headers,
+                request_body,
+                key,
+                max_cost_for_model,
+                session,
+                model_obj,
+            )
+
+        if not request_body:
+            return await super().forward_request(
+                request,
+                path,
+                headers,
+                request_body,
+                key,
+                max_cost_for_model,
+                session,
+                model_obj,
+            )
+
+        try:
+            openai_data = json.loads(request_body)
+            messages = openai_data.get("messages", [])
+            temperature = openai_data.get("temperature")
+            max_tokens = openai_data.get("max_tokens")
+            top_p = openai_data.get("top_p")
+            is_streaming = openai_data.get("stream", False)
+
+            logger.info(
+                "Processing Gemini request with client abstraction",
+                extra={
+                    "model": model_obj.id,
+                    "is_streaming": is_streaming,
+                    "message_count": len(messages),
+                    "key_hash": key.hashed_key[:8] + "...",
+                },
+            )
+
+            if is_streaming:
+                final_usage_data: dict | None = None
+
+                def usage_callback(usage_data: dict[str, Any]) -> None:
+                    """Callback to capture usage data during streaming"""
+                    nonlocal final_usage_data
+                    final_usage_data = usage_data
+
+                async def completion_callback(
+                    model: str, usage_data: dict[str, Any] | None
+                ) -> None:
+                    """Callback to handle payment when streaming completes"""
+                    nonlocal final_usage_data
+                    if usage_data:
+                        final_usage_data = usage_data
+
+                    payment_data = {
+                        "model": model,
+                        "usage": final_usage_data,
+                    }
+
+                    from ..auth import adjust_payment_for_tokens
+                    from ..core.db import create_session
+
+                    async with create_session() as new_session:
+                        fresh_key = await new_session.get(key.__class__, key.hashed_key)
+                        if fresh_key:
+                            try:
+                                cost_data = await adjust_payment_for_tokens(
+                                    fresh_key,
+                                    payment_data,
+                                    new_session,
+                                    max_cost_for_model,
+                                )
+
+                                logger.info(
+                                    "Gemini streaming payment finalized",
+                                    extra={
+                                        "cost_data": cost_data,
+                                        "usage_data": final_usage_data,
+                                        "key_hash": key.hashed_key[:8] + "...",
+                                    },
+                                )
+                            except Exception as cost_error:
+                                logger.error(
+                                    "Error finalizing Gemini streaming payment",
+                                    extra={
+                                        "error": str(cost_error),
+                                        "key_hash": key.hashed_key[:8] + "...",
+                                    },
+                                )
+
+                response_generator = self.client.generate_content_stream(
+                    model=model_obj.id,
+                    messages=messages,
+                    temperature=temperature,
+                    max_tokens=max_tokens,
+                    top_p=top_p,
+                    usage_callback=usage_callback,
+                    completion_callback=completion_callback,
+                )
+
+                async def stream_with_cost() -> AsyncGenerator[bytes, None]:
+                    payment_finalized = False
+
+                    async def finalize_payment() -> None:
+                        nonlocal payment_finalized
+                        if payment_finalized:
+                            return
+                        from ..auth import adjust_payment_for_tokens
+                        from ..core.db import create_session
+
+                        async with create_session() as new_session:
+                            fresh_key = await new_session.get(
+                                key.__class__, key.hashed_key
+                            )
+                            if fresh_key:
+                                try:
+                                    await adjust_payment_for_tokens(
+                                        fresh_key,
+                                        {
+                                            "model": model_obj.id,
+                                            "usage": final_usage_data,
+                                        },
+                                        new_session,
+                                        max_cost_for_model,
+                                    )
+                                    payment_finalized = True
+                                except Exception as cost_error:
+                                    logger.error(
+                                        "Error finalizing Gemini streaming payment in fallback",
+                                        extra={
+                                            "error": str(cost_error),
+                                            "key_hash": key.hashed_key[:8] + "...",
+                                        },
+                                    )
+
+                    try:
+                        async for chunk in response_generator:
+                            sse_data = f"data: {json.dumps(chunk)}\n\n"
+                            yield sse_data.encode()
+                    except Exception as e:
+                        logger.error(
+                            "Error in Gemini streaming response",
+                            extra={
+                                "error": str(e),
+                                "error_type": type(e).__name__,
+                                "key_hash": key.hashed_key[:8] + "...",
+                            },
+                        )
+                        raise
+                    finally:
+                        if not payment_finalized:
+                            await finalize_payment()
+
+                return StreamingResponse(
+                    stream_with_cost(),
+                    media_type="text/event-stream",
+                    headers={"Cache-Control": "no-cache", "Connection": "keep-alive"},
+                )
+
+            else:
+                openai_format_response = await self.client.generate_content(
+                    model=model_obj.id,
+                    messages=messages,
+                    temperature=temperature,
+                    max_tokens=max_tokens,
+                    top_p=top_p,
+                )
+
+                from ..auth import adjust_payment_for_tokens
+
+                cost_data = await adjust_payment_for_tokens(
+                    key, openai_format_response, session, max_cost_for_model
+                )
+                openai_format_response["cost"] = cost_data
+
+                logger.info(
+                    "Gemini non-streaming payment completed",
+                    extra={
+                        "cost_data": cost_data,
+                        "model": model_obj.id,
+                        "key_hash": key.hashed_key[:8] + "...",
+                    },
+                )
+
+                return Response(
+                    content=json.dumps(openai_format_response),
+                    media_type="application/json",
+                    headers={"Cache-Control": "no-cache"},
+                )
+
+        except Exception as e:
+            logger.error(
+                "Error in Gemini forward_request",
+                extra={
+                    "error": str(e),
+                    "error_type": type(e).__name__,
+                    "path": path,
+                    "key_hash": key.hashed_key[:8] + "...",
+                },
+            )
+            return await super().forward_request(
+                request,
+                path,
+                headers,
+                request_body,
+                key,
+                max_cost_for_model,
+                session,
+                model_obj,
+            )
 
     async def _fetch_provider_models(self) -> dict:
-        """Fetch models from Gemini API via the OpenAI-compat client."""
+        """Fetch models from Gemini API."""
         try:
             models_data = await self.client.list_models()
 

routstr/upstream/gemini_messages.py

@@ -1,480 +0,0 @@
-"""Custom /v1/messages dispatcher for Gemini's OpenAI-compat endpoint.
-
-Why this exists
----------------
-
-Gemini 2.5 / 3 thinking models reject inbound ``functionCall`` parts that
-lack a ``thought_signature`` field once any prior turn in the conversation
-contains a function call. Anthropic-Messages clients (Claude Code etc.)
-have no concept of thought signatures, so multi-turn tool conversations
-fail with::
-
-    Function call is missing a thought_signature in functionCall parts.
-
-Google's published escape hatch (https://ai.google.dev/gemini-api/docs/
-thought-signatures, FAQ #1) is the dummy signature
-``"skip_thought_signature_validator"`` placed at
-``tool_calls[i].extra_content.google.thought_signature`` for every tool
-call in the request. The hatch is documented specifically for
-"transferring a trace from a different model that does not include thought
-signatures" — exactly our case.
-
-Why we can't reach the wire via litellm
----------------------------------------
-
-``litellm.anthropic.messages.acreate`` flows through the openai SDK, whose
-pydantic ``ChatCompletionMessageToolCall`` model silently drops unknown
-fields like ``extra_content``. Litellm has no openai-compat translator
-that emits ``extra_content.google.thought_signature``. So we bypass both
-litellm and the openai SDK at the transport layer.
-
-Pipeline
---------
-
-1. Translate Anthropic body → OpenAI body via litellm's
-   ``AnthropicAdapter`` (the same translator
-   ``litellm.anthropic.messages.acreate`` uses internally).
-2. Inject ``extra_content.google.thought_signature`` on every
-   ``tool_calls[]`` entry.
-3. Set ``reasoning_effort="none"`` to disable Gemini's thinking pass.
-4. POST directly to ``{base_url}/chat/completions`` with ``stream=true``
-   via ``httpx`` (preserves arbitrary fields verbatim).
-5. Translate OpenAI streaming chunks → Anthropic SSE events.
-"""
-
-from __future__ import annotations
-
-import json
-import uuid
-from collections.abc import AsyncGenerator, AsyncIterator
-from typing import Any, Callable
-
-import httpx
-
-from ..core import get_logger
-from ..core.exceptions import UpstreamError
-from ..payment.models import Model
-from .messages_dispatch import (
-    ANTHROPIC_ONLY_FIELDS,
-    aggregate_anthropic_events_to_message,
-)
-
-logger = get_logger(__name__)
-
-DUMMY_THOUGHT_SIGNATURE = "skip_thought_signature_validator"
-
-# Mapping: OpenAI finish_reason → Anthropic stop_reason
-_FINISH_TO_STOP = {
-    "stop": "end_turn",
-    "length": "max_tokens",
-    "tool_calls": "tool_use",
-    "function_call": "tool_use",
-    "content_filter": "refusal",
-}
-
-
-def inject_thought_signatures(messages: list[dict]) -> None:
-    """Add ``extra_content.google.thought_signature`` to every tool_call.
-
-    Mutates ``messages`` in place. Idempotent: existing signatures are not
-    overwritten.
-    """
-    for msg in messages:
-        tool_calls = msg.get("tool_calls")
-        if not isinstance(tool_calls, list):
-            continue
-        for tc in tool_calls:
-            if not isinstance(tc, dict):
-                continue
-            extra = tc.get("extra_content")
-            if not isinstance(extra, dict):
-                extra = tc["extra_content"] = {}
-            google_cfg = extra.get("google")
-            if not isinstance(google_cfg, dict):
-                google_cfg = extra["google"] = {}
-            google_cfg.setdefault("thought_signature", DUMMY_THOUGHT_SIGNATURE)
-
-
-def _translate_anthropic_to_openai(body: dict, model: str) -> dict:
-    """Use litellm's translator to convert an Anthropic /messages body to
-    OpenAI /chat/completions kwargs.
-
-    Imported lazily because the litellm internal path is heavy and not
-    needed for any other code path in routstr.
-    """
-    from litellm.llms.anthropic.experimental_pass_through.adapters.transformation import (  # noqa: E501
-        AnthropicAdapter,
-    )
-
-    kwargs = {"model": model, **body}
-    translated = AnthropicAdapter().translate_completion_input_params(kwargs)
-    if translated is None:
-        raise UpstreamError(
-            "Failed to translate Anthropic body to OpenAI format",
-            status_code=500,
-        )
-    return dict(translated)
-
-
-def _sse_event(event_type: str, payload: dict) -> bytes:
-    return f"event: {event_type}\ndata: {json.dumps(payload)}\n\n".encode()
-
-
-async def _openai_chunks_to_anthropic_events(
-    line_iter: AsyncIterator[str], requested_model: str | None
-) -> AsyncGenerator[bytes, None]:
-    """Translate an OpenAI chat-completions SSE byte stream into the
-    Anthropic-Messages SSE event sequence.
-
-    Maintains per-chunk state across:
-
-    * one optional text content block (lazy-opened on first text delta)
-    * any number of tool_use blocks indexed by openai's ``delta.tool_calls[].index``
-    * final ``stop_reason`` / ``usage`` carried out via ``message_delta`` /
-      ``message_stop``
-    """
-    msg_id = f"msg_{uuid.uuid4().hex[:24]}"
-    started = False
-    text_block_idx: int | None = None
-    tool_block_indices: dict[int, int] = {}
-    next_block_idx = 0
-    final_finish_reason: str | None = None
-    final_usage: dict[str, int] = {"input_tokens": 0, "output_tokens": 0}
-
-    def open_text_block() -> bytes:
-        nonlocal text_block_idx, next_block_idx
-        text_block_idx = next_block_idx
-        next_block_idx += 1
-        return _sse_event(
-            "content_block_start",
-            {
-                "type": "content_block_start",
-                "index": text_block_idx,
-                "content_block": {"type": "text", "text": ""},
-            },
-        )
-
-    def open_tool_block(delta_idx: int, tc: dict) -> bytes:
-        nonlocal next_block_idx
-        block_idx = next_block_idx
-        next_block_idx += 1
-        tool_block_indices[delta_idx] = block_idx
-        fn = tc.get("function") or {}
-        return _sse_event(
-            "content_block_start",
-            {
-                "type": "content_block_start",
-                "index": block_idx,
-                "content_block": {
-                    "type": "tool_use",
-                    "id": tc.get("id") or f"toolu_{uuid.uuid4().hex[:24]}",
-                    "name": fn.get("name") or "",
-                    "input": {},
-                },
-            },
-        )
-
-    def close_block(idx: int) -> bytes:
-        return _sse_event(
-            "content_block_stop",
-            {"type": "content_block_stop", "index": idx},
-        )
-
-    async for raw_line in line_iter:
-        line = raw_line.strip()
-        if not line:
-            continue
-        if not line.startswith("data:"):
-            continue
-        payload = line[5:].lstrip()
-        if not payload or payload == "[DONE]":
-            continue
-        try:
-            chunk = json.loads(payload)
-        except json.JSONDecodeError:
-            continue
-        if not isinstance(chunk, dict):
-            continue
-
-        if not started:
-            started = True
-            yield _sse_event(
-                "message_start",
-                {
-                    "type": "message_start",
-                    "message": {
-                        "id": chunk.get("id") or msg_id,
-                        "type": "message",
-                        "role": "assistant",
-                        "model": requested_model or chunk.get("model") or "",
-                        "content": [],
-                        "stop_reason": None,
-                        "stop_sequence": None,
-                        "usage": {
-                            "input_tokens": 0,
-                            "output_tokens": 0,
-                        },
-                    },
-                },
-            )
-
-        usage = chunk.get("usage")
-        if isinstance(usage, dict):
-            in_tok = usage.get("prompt_tokens") or usage.get("input_tokens") or 0
-            out_tok = usage.get("completion_tokens") or usage.get("output_tokens") or 0
-            if in_tok:
-                final_usage["input_tokens"] = int(in_tok)
-            if out_tok:
-                final_usage["output_tokens"] = int(out_tok)
-
-        choices = chunk.get("choices") or []
-        if not choices:
-            continue
-        choice = choices[0] if isinstance(choices[0], dict) else {}
-        delta = choice.get("delta") or {}
-        if not isinstance(delta, dict):
-            delta = {}
-
-        # Text delta
-        text = delta.get("content")
-        if isinstance(text, str) and text:
-            if text_block_idx is None:
-                yield open_text_block()
-            yield _sse_event(
-                "content_block_delta",
-                {
-                    "type": "content_block_delta",
-                    "index": text_block_idx,
-                    "delta": {"type": "text_delta", "text": text},
-                },
-            )
-
-        # Tool call deltas
-        tool_calls_delta = delta.get("tool_calls")
-        if isinstance(tool_calls_delta, list):
-            for tc in tool_calls_delta:
-                if not isinstance(tc, dict):
-                    continue
-                d_idx = int(tc.get("index") or 0)
-                if d_idx not in tool_block_indices:
-                    yield open_tool_block(d_idx, tc)
-                block_idx = tool_block_indices[d_idx]
-                fn = tc.get("function") or {}
-                args = fn.get("arguments")
-                if isinstance(args, str) and args:
-                    yield _sse_event(
-                        "content_block_delta",
-                        {
-                            "type": "content_block_delta",
-                            "index": block_idx,
-                            "delta": {
-                                "type": "input_json_delta",
-                                "partial_json": args,
-                            },
-                        },
-                    )
-
-        finish = choice.get("finish_reason")
-        if finish:
-            final_finish_reason = finish
-
-    # Close any open content blocks
-    if text_block_idx is not None:
-        yield close_block(text_block_idx)
-    for block_idx in tool_block_indices.values():
-        yield close_block(block_idx)
-
-    # message_delta with stop_reason and usage
-    stop_reason = _FINISH_TO_STOP.get(final_finish_reason or "", "end_turn")
-    yield _sse_event(
-        "message_delta",
-        {
-            "type": "message_delta",
-            "delta": {"stop_reason": stop_reason, "stop_sequence": None},
-            "usage": final_usage,
-        },
-    )
-    yield _sse_event("message_stop", {"type": "message_stop"})
-
-
-async def _post_and_stream(
-    base_url: str,
-    api_key: str,
-    payload: dict,
-    log_extra: dict[str, Any] | None,
-) -> tuple[httpx.AsyncClient, httpx.Response]:
-    """POST to upstream chat-completions and return (client, response) for
-    streaming. Caller is responsible for closing both."""
-    url = f"{base_url.rstrip('/')}/chat/completions"
-    client = httpx.AsyncClient(timeout=httpx.Timeout(120.0, read=120.0))
-    try:
-        request = client.build_request(
-            "POST",
-            url,
-            json=payload,
-            headers={
-                "Authorization": f"Bearer {api_key}",
-                "Content-Type": "application/json",
-                "Accept": "text/event-stream",
-            },
-        )
-        response = await client.send(request, stream=True)
-    except Exception as exc:
-        await client.aclose()
-        logger.error(
-            "Gemini messages dispatch HTTP error",
-            extra={"error": str(exc), "url": url, **(log_extra or {})},
-        )
-        raise UpstreamError(
-            f"Failed to reach Gemini upstream: {exc}", status_code=502
-        ) from exc
-
-    if response.status_code >= 400:
-        try:
-            body_bytes = await response.aread()
-        finally:
-            await response.aclose()
-            await client.aclose()
-        body_text = body_bytes.decode("utf-8", errors="replace")
-        logger.error(
-            "Gemini messages dispatch upstream error",
-            extra={
-                "status_code": response.status_code,
-                "body": body_text[:1000],
-                "url": url,
-                **(log_extra or {}),
-            },
-        )
-        raise UpstreamError(
-            f"Upstream error via gemini compat: {body_text}",
-            status_code=response.status_code,
-        )
-
-    return client, response
-
-
-async def dispatch_gemini_messages(
-    *,
-    request_body: bytes | None,
-    model_obj: Model,
-    base_url: str,
-    api_key: str,
-    transform_model_name: Callable[[str], str],
-    log_extra: dict[str, Any] | None = None,
-) -> tuple[bool, Any, str | None]:
-    """Dispatch a /v1/messages request to Gemini's OpenAI-compat endpoint
-    with thought-signature injection.
-
-    Returns ``(client_stream, result, requested_model)`` where ``result``
-    is either an ``AsyncIterator[bytes]`` of Anthropic-format SSE events
-    (for streaming clients) or an Anthropic Message dict (after the caller
-    aggregates).
-    """
-    if not request_body:
-        raise UpstreamError(
-            "Missing request body for /v1/messages", status_code=400
-        )
-
-    try:
-        body: dict = json.loads(request_body)
-    except json.JSONDecodeError as exc:
-        raise UpstreamError(
-            f"Invalid JSON in /v1/messages body: {exc}", status_code=400
-        ) from exc
-
-    body.pop("model", None)
-    client_stream = bool(body.pop("stream", False))
-
-    # Anthropic-Messages-only fields that don't translate to OpenAI
-    # Chat Completions. litellm's translator passes through unknown
-    # top-level fields verbatim and Gemini's compat surface 400s on
-    # unknown names like ``context_management`` / ``output_config``.
-    dropped: dict[str, Any] = {}
-    for field in ANTHROPIC_ONLY_FIELDS:
-        if field in body:
-            dropped[field] = body.pop(field)
-    if dropped:
-        logger.debug(
-            "Dropped anthropic-only fields before gemini compat dispatch",
-            extra={"dropped_keys": sorted(dropped.keys())},
-        )
-
-    requested_model = (
-        (model_obj.forwarded_model_id or model_obj.id) if model_obj else None
-    )
-    upstream_model = transform_model_name(model_obj.id)
-
-    openai_kwargs = _translate_anthropic_to_openai(body, upstream_model)
-
-    messages = openai_kwargs.get("messages") or []
-    if isinstance(messages, list):
-        inject_thought_signatures(messages)
-
-    # Disable Gemini's thinking pass; the dummy signature already lifts
-    # validation, but skipping thinking entirely avoids degraded model
-    # output and keeps tool-calling deterministic.
-    openai_kwargs.setdefault("reasoning_effort", "none")
-    openai_kwargs["stream"] = True
-    openai_kwargs["model"] = upstream_model
-    # OpenAI-compat backends (including Gemini's) only emit a final
-    # ``usage`` chunk when the request opts in via this flag. Without it
-    # the cost-calculation pipeline can't read real token counts and
-    # falls back to MaxCostData billing.
-    existing_stream_options = openai_kwargs.get("stream_options")
-    merged_stream_options = (
-        dict(existing_stream_options)
-        if isinstance(existing_stream_options, dict)
-        else {}
-    )
-    merged_stream_options.setdefault("include_usage", True)
-    openai_kwargs["stream_options"] = merged_stream_options
-
-    logger.info(
-        "Dispatching /v1/messages via gemini compat (httpx)",
-        extra={
-            "model": upstream_model,
-            "client_stream": client_stream,
-            "messages_with_tool_calls": sum(
-                1 for m in messages if isinstance(m, dict) and m.get("tool_calls")
-            ),
-            **(log_extra or {}),
-        },
-    )
-
-    http_client, response = await _post_and_stream(
-        base_url, api_key, openai_kwargs, log_extra
-    )
-
-    async def line_iter() -> AsyncGenerator[str, None]:
-        try:
-            async for line in response.aiter_lines():
-                yield line
-        finally:
-            await response.aclose()
-            await http_client.aclose()
-
-    anthropic_event_iter = _openai_chunks_to_anthropic_events(
-        line_iter(), requested_model
-    )
-
-    if not client_stream:
-        # Aggregate the Anthropic SSE byte stream into a single Message dict
-        # so the rest of the pipeline (cost calc, metadata injection,
-        # response building) can treat it identically to a non-streaming
-        # litellm response.
-        try:
-            aggregated = await aggregate_anthropic_events_to_message(
-                anthropic_event_iter
-            )
-        except Exception as exc:
-            logger.error(
-                "Failed to aggregate Gemini compat events into message",
-                extra={"error": str(exc), **(log_extra or {})},
-            )
-            raise UpstreamError(
-                f"Failed to aggregate upstream stream: {exc}",
-                status_code=502,
-            ) from exc
-        return client_stream, aggregated, requested_model
-
-    return client_stream, anthropic_event_iter, requested_model

routstr/upstream/generic.py

@@ -5,12 +5,6 @@ from typing import TYPE_CHECKING
 import httpx
 
 from .base import BaseUpstreamProvider
-from .pricing_resolver import (
-    FallbackPricingResolver,
-    ResolvedPricing,
-    _as_float,
-    estimate_context_length,
-)
 
 if TYPE_CHECKING:
     from ..core.db import UpstreamProviderRow
@@ -51,7 +45,7 @@ class GenericUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "GenericUpstreamProvider":
         return cls(
@@ -70,40 +64,6 @@ class GenericUpstreamProvider(BaseUpstreamProvider):
             "platform_url": cls.platform_url,
         }
 
-    def _native_pricing(
-        self, model_id: str, model_spec: dict
-    ) -> ResolvedPricing | None:
-        """Read pricing/metadata from Venice's bespoke ``model_spec`` schema.
-
-        Returns ``None`` when the upstream reported no *usable* native price —
-        absent, non-numeric, negative, or both-zero — so the caller falls
-        through to the shared resolution chain instead of fabricating a number
-        or trusting a bogus one. This mirrors the money-safety guards the
-        litellm and OpenRouter rungs already apply: a both-zero price would
-        serve the model free, a negative one would credit the caller, and a
-        non-numeric string would otherwise throw and drop the whole catalog.
-        """
-        pricing_info = model_spec.get("pricing", {})
-        input_usd = _as_float(pricing_info.get("input", {}).get("usd"))
-        output_usd = _as_float(pricing_info.get("output", {}).get("usd"))
-        if input_usd is None or output_usd is None:
-            return None
-        if input_usd < 0 or output_usd < 0 or (input_usd == 0 and output_usd == 0):
-            return None
-
-        capabilities = model_spec.get("capabilities", {})
-        input_modalities = ["text"]
-        if capabilities.get("supportsVision", False):
-            input_modalities.append("image")
-
-        return ResolvedPricing(
-            prompt=input_usd / 1_000_000,
-            completion=output_usd / 1_000_000,
-            context_length=model_spec.get("availableContextTokens"),
-            source="native",
-            input_modalities=input_modalities,
-        )
-
     async def fetch_models(self) -> list[Model]:
         """Fetch models from upstream API using /models endpoint."""
         from ..payment.models import Architecture, Model, Pricing, TopProvider
@@ -118,7 +78,6 @@ class GenericUpstreamProvider(BaseUpstreamProvider):
                 response.raise_for_status()
                 data = response.json()
 
-                resolver = FallbackPricingResolver()
                 models_list = []
                 for model_data in data.get("data", []):
                     model_id = model_data.get("id", "")
@@ -130,44 +89,41 @@ class GenericUpstreamProvider(BaseUpstreamProvider):
                     owned_by = model_data.get("owned_by", "unknown")
                     model_spec = model_data.get("model_spec", {})
 
-                    resolved = self._native_pricing(model_id, model_spec)
-                    if resolved is None:
-                        resolved = await resolver.resolve(model_id)
+                    context_length = 4096
+                    if model_spec.get("availableContextTokens"):
+                        context_length = model_spec["availableContextTokens"]
+                    elif any(
+                        pattern in model_id.lower() for pattern in ["32k", "32000"]
+                    ):
+                        context_length = 32768
+                    elif any(
+                        pattern in model_id.lower() for pattern in ["16k", "16000"]
+                    ):
+                        context_length = 16384
+                    elif any(pattern in model_id.lower() for pattern in ["8k", "8000"]):
+                        context_length = 8192
+                    elif "gpt-4" in model_id.lower():
+                        context_length = 8192
+                    elif "claude" in model_id.lower():
+                        context_length = 200000
 
-                    if resolved is None:
-                        # Fail closed: never invent a price. Import the model
-                        # disabled with a warning so the operator can price it
-                        # (the admin UI surfaces disabled remote models).
-                        logger.warning(
-                            f"No pricing source resolved for '{model_id}' from "
-                            f"{self.upstream_name}; importing it disabled",
-                            extra={"model_id": model_id, "base_url": self.base_url},
-                        )
-                        resolved = ResolvedPricing(
-                            prompt=0.0,
-                            completion=0.0,
-                            context_length=None,
-                            source="unresolved",
-                        )
-                        enabled = False
-                    else:
-                        enabled = True
+                    pricing_info = model_spec.get("pricing", {})
+                    input_pricing = pricing_info.get("input", {})
+                    output_pricing = pricing_info.get("output", {})
 
-                    # Prefer the source's own modality string (OpenRouter ships
-                    # one, e.g. "text+image->text"); otherwise derive it from the
-                    # captured input/output modalities in the same "in->out" shape
-                    # rather than flattening vision models to "text->text".
-                    modality = resolved.modality or (
-                        f"{'+'.join(resolved.input_modalities)}"
-                        f"->{'+'.join(resolved.output_modalities)}"
-                    )
+                    prompt_price = input_pricing.get("usd", 0.001) / 1000000
+                    completion_price = output_pricing.get("usd", 0.001) / 1000000
 
-                    # A source can carry a price but no context (e.g. a litellm
-                    # entry missing max_input_tokens); fall back to an id-based
-                    # estimate so we never persist a zero-length window.
-                    context_length = resolved.context_length or estimate_context_length(
-                        model_id
-                    )
+                    capabilities = model_spec.get("capabilities", {})
+                    input_modalities = ["text"]
+                    output_modalities = ["text"]
+
+                    if capabilities.get("supportsVision", False):
+                        input_modalities.append("image")
+
+                    modality = "text"
+                    if capabilities.get("supportsVision", False):
+                        modality = "text->text"
 
                     spec_name = model_spec.get("name", model_name)
                     description = f"{spec_name}"
@@ -183,33 +139,30 @@ class GenericUpstreamProvider(BaseUpstreamProvider):
                             context_length=context_length,
                             architecture=Architecture(
                                 modality=modality,
-                                input_modalities=resolved.input_modalities,
-                                output_modalities=resolved.output_modalities,
-                                tokenizer=resolved.tokenizer,
-                                instruct_type=resolved.instruct_type,
+                                input_modalities=input_modalities,
+                                output_modalities=output_modalities,
+                                tokenizer="unknown",
+                                instruct_type=None,
                             ),
                             pricing=Pricing(
-                                prompt=resolved.prompt,
-                                completion=resolved.completion,
+                                prompt=prompt_price,
+                                completion=completion_price,
                                 request=0.0,
                                 image=0.0,
                                 web_search=0.0,
                                 internal_reasoning=0.0,
-                                input_cache_read=resolved.input_cache_read,
-                                input_cache_write=resolved.input_cache_write,
+                                max_prompt_cost=0.001,
+                                max_completion_cost=0.001,
+                                max_cost=0.001,
                             ),
                             sats_pricing=None,
                             per_request_limits=None,
                             top_provider=TopProvider(
                                 context_length=context_length,
-                                max_completion_tokens=(
-                                    resolved.max_completion_tokens
-                                    if resolved.max_completion_tokens is not None
-                                    else context_length // 2
-                                ),
-                                is_moderated=bool(resolved.is_moderated),
+                                max_completion_tokens=context_length // 2,
+                                is_moderated=False,
                             ),
-                            enabled=enabled,
+                            enabled=True,
                             upstream_provider_id=None,
                             canonical_slug=None,
                         )

routstr/upstream/groq.py

@@ -12,7 +12,6 @@ class GroqUpstreamProvider(BaseUpstreamProvider):
     provider_type = "groq"
     default_base_url = "https://api.groq.com/openai/v1"
     platform_url = "https://console.groq.com/keys"
-    litellm_provider_prefix = "groq/"
 
     def __init__(self, api_key: str, provider_fee: float = 1.01):
         super().__init__(
@@ -20,7 +19,7 @@ class GroqUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(cls, provider_row: "UpstreamProviderRow") -> "GroqUpstreamProvider":
+    def from_db_row(cls, provider_row: "UpstreamProviderRow") -> "GroqUpstreamProvider":
         return cls(
             api_key=provider_row.api_key,
             provider_fee=provider_row.provider_fee,

routstr/upstream/helpers.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import asyncio
 import os
 import re
-from typing import TYPE_CHECKING, Callable
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from ..core.settings import Settings
@@ -12,7 +12,6 @@ from sqlmodel import select
 
 from ..core import get_logger
 from ..core.db import AsyncSession, ModelRow, UpstreamProviderRow, create_session
-from ..core.provider_slugs import allocate_unique_provider_slug
 from ..payment.models import Model
 from .base import BaseUpstreamProvider
 
@@ -94,10 +93,12 @@ async def get_all_models_with_overrides(
         provider_result = await session.exec(select(UpstreamProviderRow))
         providers_by_id = {p.id: p for p in provider_result.all()}
 
-        overrides_by_key: dict[tuple[str, int], tuple[ModelRow, float]] = {
-            (row.id.lower(), row.upstream_provider_id): (
+        overrides_by_id: dict[str, tuple[ModelRow, float]] = {
+            row.id: (
                 row,
-                providers_by_id[row.upstream_provider_id].provider_fee,
+                providers_by_id[row.upstream_provider_id].provider_fee
+                if row.upstream_provider_id in providers_by_id
+                else 1.01,
             )
             for row in override_rows
             if row.upstream_provider_id is not None
@@ -105,43 +106,28 @@ async def get_all_models_with_overrides(
             and providers_by_id[row.upstream_provider_id].enabled
         }
 
-    all_models: dict[tuple[str, str], Model] = {}
+    all_models: dict[str, Model] = {}
 
     for upstream in upstreams:
-        upstream_db_id = getattr(upstream, "db_id", None)
-        provider_key = (
-            f"db:{upstream_db_id}"
-            if isinstance(upstream_db_id, int)
-            else f"{getattr(upstream, 'provider_type', '')}|{getattr(upstream, 'base_url', '')}"
-        )
         for model in upstream.get_cached_models():
-            model_key = (
-                (model.id.lower(), upstream_db_id)
-                if isinstance(upstream_db_id, int)
-                else None
-            )
-            if model_key is not None and model_key in overrides_by_key:
-                override_row, provider_fee = overrides_by_key[model_key]
-                all_models[(model.id.lower(), provider_key)] = _row_to_model(
+            if model.id in overrides_by_id:
+                override_row, provider_fee = overrides_by_id[model.id]
+                all_models[model.id] = _row_to_model(
                     override_row, apply_provider_fee=True, provider_fee=provider_fee
                 )
             elif model.enabled:
-                all_models[(model.id.lower(), provider_key)] = model
+                all_models[model.id] = model
 
     return list(all_models.values())
 
 
 async def refresh_upstreams_models_periodically(
-    upstreams_provider: (
-        Callable[[], list[BaseUpstreamProvider]] | list[BaseUpstreamProvider]
-    ),
+    upstreams: list[BaseUpstreamProvider],
 ) -> None:
     """Background task to periodically refresh models cache for all providers.
 
     Args:
-        upstreams_provider: Either a callable returning the live upstream list
-            (preferred — picks up providers added/changed via reinitialize_upstreams),
-            or a static list (legacy, will go stale after reinitialize_upstreams).
+        upstreams: List of upstream provider instances
     """
     import asyncio
     import random
@@ -153,14 +139,9 @@ async def refresh_upstreams_models_periodically(
         logger.info("Provider models refresh disabled (interval <= 0)")
         return
 
-    def _resolve_upstreams() -> list[BaseUpstreamProvider]:
-        if callable(upstreams_provider):
-            return upstreams_provider()
-        return upstreams_provider
-
     while True:
         try:
-            for upstream in _resolve_upstreams():
+            for upstream in upstreams:
                 try:
                     await upstream.refresh_models_cache()
                 except Exception as e:
@@ -207,14 +188,13 @@ async def init_upstreams() -> list[BaseUpstreamProvider]:
         existing_providers = result.all()
 
         if not existing_providers:
+            logger.info(
+                "No upstream providers found in database, seeding from settings"
+            )
             await _seed_providers_from_settings(session, settings)
             await session.commit()
             result = await session.exec(select(UpstreamProviderRow))
             existing_providers = result.all()
-            if existing_providers:
-                logger.info(
-                    f"Seeded {len(existing_providers)} upstream providers from settings"
-                )
 
         async def _init_single_provider(
             provider_row: UpstreamProviderRow,
@@ -257,7 +237,6 @@ async def _seed_providers_from_settings(
 
     providers_to_add: list[UpstreamProviderRow] = []
     seeded_provider_keys: set[tuple[str, str]] = set()
-    reserved_slugs: set[str] = set()
 
     provider_classes_by_type = {
         cls.provider_type: cls
@@ -272,7 +251,6 @@ async def _seed_providers_from_settings(
         ("PERPLEXITY_API_KEY", "perplexity", None, None),
         ("FIREWORKS_API_KEY", "fireworks", None, None),
         ("XAI_API_KEY", "xai", None, None),
-        ("TINFOIL_API_KEY", "tinfoil", None, None),
     ]
 
     for env_key, provider_type, _, _ in env_mappings:
@@ -288,13 +266,8 @@ async def _seed_providers_from_settings(
                     )
                 )
                 if not result.first():
-                    slug = await allocate_unique_provider_slug(
-                        session, provider_type, reserved_slugs
-                    )
-                    reserved_slugs.add(slug)
                     providers_to_add.append(
                         UpstreamProviderRow(
-                            slug=slug,
                             provider_type=provider_type,
                             base_url=base_url,
                             api_key=api_key,
@@ -313,13 +286,8 @@ async def _seed_providers_from_settings(
             )
         )
         if not result.first():
-            slug = await allocate_unique_provider_slug(
-                session, "ollama", reserved_slugs
-            )
-            reserved_slugs.add(slug)
             providers_to_add.append(
                 UpstreamProviderRow(
-                    slug=slug,
                     provider_type="ollama",
                     base_url=ollama_base_url,
                     api_key=ollama_api_key,
@@ -339,13 +307,8 @@ async def _seed_providers_from_settings(
                 )
             )
             if not result.first():
-                slug = await allocate_unique_provider_slug(
-                    session, "azure", reserved_slugs
-                )
-                reserved_slugs.add(slug)
                 providers_to_add.append(
                     UpstreamProviderRow(
-                        slug=slug,
                         provider_type="azure",
                         base_url=base_url,
                         api_key=api_key,
@@ -366,13 +329,8 @@ async def _seed_providers_from_settings(
                 )
             )
             if not result.first():
-                slug = await allocate_unique_provider_slug(
-                    session, "custom", reserved_slugs
-                )
-                reserved_slugs.add(slug)
                 providers_to_add.append(
                     UpstreamProviderRow(
-                        slug=slug,
                         provider_type="custom",
                         base_url=base_url,
                         api_key=api_key,
@@ -385,7 +343,7 @@ async def _seed_providers_from_settings(
         session.add(provider)
         logger.info(
             f"Seeding {provider.provider_type} provider",  # type: ignore[str-format]
-            extra={"base_url": provider.base_url, "slug": provider.slug},
+            extra={"base_url": provider.base_url},
         )
 
 
@@ -420,7 +378,9 @@ def _instantiate_provider(
             return provider
 
         if provider_row.provider_type == "custom":
-            return BaseUpstreamProvider.from_db_row(provider_row)
+            return BaseUpstreamProvider(
+                provider_row.base_url, provider_row.api_key, provider_row.provider_fee
+            )
 
         logger.error(
             f"Unknown provider type: {provider_row.provider_type}",

routstr/upstream/litellm_routing.py

@@ -1,162 +0,0 @@
-"""Map an upstream `base_url` to the correct litellm provider prefix.
-
-Used by `BaseUpstreamProvider.get_litellm_provider_prefix` so that custom /
-generic provider rows (which inherit the base class default) get routed to
-the right litellm backend instead of falling back to `openai/`.
-
-The table is compiled from litellm 1.74's
-`litellm/litellm_core_utils/get_llm_provider_logic.py` (the
-`openai_compatible_endpoints` table) plus the providers documented at
-https://docs.litellm.ai/docs/providers. Substring match is used so that
-URLs with paths, ports, regional subdomains, etc. all resolve correctly.
-
-Order matters: more specific needles must appear before more generic ones
-(e.g. ``openai.azure.com`` before ``api.openai.com``).
-"""
-
-from __future__ import annotations
-
-import os
-from urllib.parse import urlsplit
-
-import litellm
-
-DEFAULT_PREFIX = "openai/"
-
-LITELLM_HOST_PREFIX_MAP: tuple[tuple[str, str], ...] = (
-    # Azure must win over api.openai.com because the host ends with
-    # `openai.azure.com` and we don't want it picked up as plain OpenAI.
-    ("openai.azure.com", "azure/"),
-    # Google
-    ("generativelanguage.googleapis.com", "gemini/"),
-    ("aiplatform.googleapis.com", "vertex_ai/"),
-    # First-class providers with native litellm prefixes
-    ("api.openai.com", "openai/"),
-    ("api.anthropic.com", "anthropic/"),
-    ("api.groq.com", "groq/"),
-    ("api.fireworks.ai", "fireworks_ai/"),
-    ("api.x.ai", "xai/"),
-    ("api.perplexity.ai", "perplexity/"),
-    ("openrouter.ai", "openrouter/"),
-    ("api.deepseek.com", "deepseek/"),
-    ("api.together.xyz", "together_ai/"),
-    ("codestral.mistral.ai", "codestral/"),
-    ("api.mistral.ai", "mistral/"),
-    ("api.cohere.com", "cohere_chat/"),
-    ("api.cohere.ai", "cohere_chat/"),
-    ("api.deepinfra.com", "deepinfra/"),
-    ("api.endpoints.anyscale.com", "anyscale/"),
-    ("api.cerebras.ai", "cerebras/"),
-    ("inference.baseten.co", "baseten/"),
-    ("api.sambanova.ai", "sambanova/"),
-    ("api.ai21.com", "ai21_chat/"),
-    ("api.friendli.ai", "friendliai/"),
-    ("api.galadriel.com", "galadriel/"),
-    ("api.llama.com", "meta_llama/"),
-    ("api.featherless.ai", "featherless_ai/"),
-    ("inference.api.nscale.com", "nscale/"),
-    ("dashscope-intl.aliyuncs.com", "dashscope/"),
-    ("api.moonshot.ai", "moonshot/"),
-    ("api.moonshot.cn", "moonshot/"),
-    ("api.minimax.io", "minimax/"),
-    ("api.minimaxi.com", "minimax/"),
-    ("platform.publicai.co", "publicai/"),
-    ("api.synthetic.new", "synthetic/"),
-    ("api.stima.tech", "apertis/"),
-    ("nano-gpt.com", "nano-gpt/"),
-    ("api.poe.com", "poe/"),
-    ("llm.chutes.ai", "chutes/"),
-    ("api.v0.dev", "v0/"),
-    ("api.lambda.ai", "lambda_ai/"),
-    ("api.hyperbolic.xyz", "hyperbolic/"),
-    ("ai-gateway.vercel.sh", "vercel_ai_gateway/"),
-    ("api.inference.wandb.ai", "wandb/"),
-    ("integrate.api.nvidia.com", "nvidia_nim/"),
-    ("api.studio.nebius.com", "nebius/"),
-    ("api.novita.ai", "novita/"),
-    ("ark.cn-beijing.volces.com", "volcengine/"),
-    ("api.voyageai.com", "voyage/"),
-    ("api.jina.ai", "jina_ai/"),
-    ("api.aimlapi.com", "aiml/"),
-    ("api.snowflakecomputing.com", "snowflake/"),
-    ("databricks.com", "databricks/"),
-    ("huggingface.co", "huggingface/"),
-)
-
-# Substrings that indicate an Ollama deployment regardless of port/scheme.
-OLLAMA_HOST_HINTS: tuple[str, ...] = (
-    "localhost:11434",
-    "127.0.0.1:11434",
-    "ollama",
-)
-
-
-def detect_litellm_prefix(
-    base_url: str | None, default: str = DEFAULT_PREFIX
-) -> str:
-    """Return the litellm provider prefix (`"<provider>/"`) for `base_url`.
-
-    Falls back to `default` when the host doesn't match any known provider.
-    The default is `openai/` because every unmatched OpenAI-compatible
-    server is, by definition, an OpenAI-compatible server.
-    """
-    if not base_url:
-        return default
-
-    parsed = urlsplit(base_url)
-    host = parsed.netloc.lower() or base_url.lower()
-
-    for needle, prefix in LITELLM_HOST_PREFIX_MAP:
-        if needle in host:
-            return prefix
-
-    if any(hint in host for hint in OLLAMA_HOST_HINTS):
-        return "ollama_chat/"
-
-    return default
-
-
-_configured = False
-
-
-def configure_litellm() -> None:
-    """Apply litellm global settings used by the messages-dispatch path.
-
-    Idempotent: safe to call from both app startup and module-level
-    initializers without side effects on the second invocation.
-
-    Settings applied:
-
-    * ``LITELLM_DEBUG=1`` enables litellm's verbose debug logger.
-    * Forces the Anthropic-messages adapter to call OpenAI Chat Completions
-      (POST ``/chat/completions``) instead of the Responses API (POST
-      ``/responses``) for ``openai/``-prefixed providers. OpenAI-compatible
-      upstreams like Google's generativelanguage compat endpoint expose
-      ``/chat/completions`` but not ``/responses``, which would 404. Set
-      ``LITELLM_USE_RESPONSES_API_FOR_ANTHROPIC_MESSAGES=1`` to opt out.
-    * Silently drops Anthropic-Messages-only parameters (``thinking``,
-      ``cache_control``, ``context_management``, ...) when translating to
-      providers that don't accept them, instead of raising
-      ``UnsupportedParamsError``. Set ``LITELLM_STRICT_PARAMS=1`` to opt
-      out.
-    """
-    global _configured
-    if _configured:
-        return
-
-    if os.getenv("LITELLM_DEBUG") == "1":
-        try:
-            litellm._turn_on_debug()  # type: ignore[no-untyped-call]
-        except Exception:
-            pass
-
-    if os.getenv("LITELLM_USE_RESPONSES_API_FOR_ANTHROPIC_MESSAGES") != "1":
-        try:
-            litellm.use_chat_completions_url_for_anthropic_messages = True
-        except Exception:
-            pass
-
-    if os.getenv("LITELLM_STRICT_PARAMS") != "1":
-        litellm.drop_params = True
-
-    _configured = True

routstr/upstream/messages_dispatch.py

@@ -1,575 +0,0 @@
-"""Pure helpers for translating ``/v1/messages`` to upstream chat completions
-via litellm.
-
-This module owns the litellm/Anthropic-Messages translation layer:
-
-* SSE parsing (``parse_sse_blocks``, ``events_from_chunk``)
-* Payload coercion (``coerce_litellm_payload``)
-* Stream aggregation (``aggregate_anthropic_events_to_message``) — drains
-  a streamed Anthropic event sequence into a single Message dict
-* Per-event annotation for streaming (``annotate_event``,
-  ``stream_annotated_events``) — handles the model-rewrite + token-tally
-  bookkeeping shared by the bearer-key and x-cashu streaming paths
-* The dispatch entry point (``dispatch_anthropic_messages``)
-* Refund math (``compute_refund``)
-
-Nothing in here touches ``BaseUpstreamProvider``; the thin instance methods
-on the provider class forward to these functions and only retain logic that
-genuinely needs ``self`` (cost adjustment, metadata injection, refund
-sending).
-"""
-
-from __future__ import annotations
-
-import json
-from collections.abc import AsyncGenerator, AsyncIterator
-from typing import Any, Callable, NamedTuple, cast
-
-import litellm
-
-from ..core import get_logger
-from ..core.exceptions import UpstreamError
-from ..core.redaction import redact_org_ids
-from ..payment.models import Model
-from .rate_limit import classify_rate_limit
-
-logger = get_logger(__name__)
-
-# Anthropic-Messages-only fields that don't translate to OpenAI
-# Chat Completions. ``litellm.drop_params`` only filters *known*
-# unsupported params; these newer/extension fields get passed through
-# verbatim and the upstream rejects them with a 400. Pop them here so the
-# request reaches the upstream cleanly.
-ANTHROPIC_ONLY_FIELDS: tuple[str, ...] = (
-    "thinking",
-    "cache_control",
-    "context_management",
-    "output_config",
-    "mcp_servers",
-    "service_tier",
-    "anthropic_version",
-    "anthropic_beta",
-)
-
-
-def coerce_litellm_payload(payload: object) -> dict:
-    """Convert a litellm event into a plain dict.
-
-    Non-streaming responses come back as Anthropic-shaped pydantic models
-    or dicts. Streaming may yield raw bytes/str (SSE-encoded); those go
-    through ``events_from_chunk`` instead, not here.
-    """
-    if isinstance(payload, dict):
-        return dict(payload)
-    if hasattr(payload, "model_dump"):
-        return cast(dict, payload.model_dump())
-    raise TypeError(f"Cannot coerce {type(payload).__name__} to dict")
-
-
-def parse_sse_blocks(buffer: bytes) -> tuple[list[dict], bytes]:
-    """Parse complete SSE event blocks out of a byte buffer.
-
-    Returns (events, remaining_buffer). Events are JSON objects parsed from
-    one or more ``data:`` lines per block. Comments, blank lines, and
-    ``[DONE]`` sentinels are ignored. A trailing partial block is preserved
-    in remaining_buffer.
-    """
-    events: list[dict] = []
-    while True:
-        sep = buffer.find(b"\n\n")
-        if sep < 0:
-            sep_rn = buffer.find(b"\r\n\r\n")
-            if sep_rn < 0:
-                break
-            block = buffer[:sep_rn]
-            buffer = buffer[sep_rn + 4 :]
-        else:
-            block = buffer[:sep]
-            buffer = buffer[sep + 2 :]
-
-        data_lines: list[str] = []
-        for raw_line in block.replace(b"\r\n", b"\n").split(b"\n"):
-            line = raw_line.decode("utf-8", errors="replace")
-            if line.startswith(":"):
-                continue
-            if line.startswith("data:"):
-                data_lines.append(line[5:].lstrip())
-        if not data_lines:
-            continue
-        payload = "\n".join(data_lines).strip()
-        if not payload or payload == "[DONE]":
-            continue
-        try:
-            obj = json.loads(payload)
-        except json.JSONDecodeError:
-            continue
-        if isinstance(obj, dict):
-            events.append(obj)
-    return events, buffer
-
-
-def events_from_chunk(
-    chunk: object, sse_buffer: bytes
-) -> tuple[list[dict], bytes]:
-    """Normalize a stream chunk into one or more event dicts.
-
-    ``litellm.anthropic.messages.acreate(stream=True)`` yields raw SSE
-    bytes in practice; some adapters yield strings or typed events. Handle
-    all three.
-    """
-    if isinstance(chunk, (bytes, bytearray)):
-        sse_buffer += bytes(chunk)
-        events, sse_buffer = parse_sse_blocks(sse_buffer)
-        return events, sse_buffer
-    if isinstance(chunk, str):
-        sse_buffer += chunk.encode("utf-8")
-        events, sse_buffer = parse_sse_blocks(sse_buffer)
-        return events, sse_buffer
-    return [coerce_litellm_payload(chunk)], sse_buffer
-
-
-async def aggregate_anthropic_events_to_message(
-    iterator: AsyncIterator[Any],
-) -> dict:
-    """Drain an Anthropic-Messages event iterator into a single Message dict.
-
-    Produces the shape ``litellm.anthropic.messages.acreate(stream=False)``
-    would have returned. Used to transparently stream from upstream while
-    still returning a non-streaming response to the client. Lets us
-    sidestep upstream quirks (e.g. Fireworks rejects ``max_tokens > 4096``
-    unless ``stream=true``) without leaking that into client-visible
-    behavior.
-    """
-    sse_buffer = b""
-    message: dict = {}
-    blocks: list[dict] = []
-    partial_json: dict[int, str] = {}
-    final_stop_reason: str | None = None
-    final_stop_sequence: str | None = None
-    final_usage: dict[str, Any] = {}
-    final_model: str | None = None
-
-    async for chunk in iterator:
-        events, sse_buffer = events_from_chunk(chunk, sse_buffer)
-        for event in events:
-            etype = event.get("type")
-            if etype == "message_start":
-                raw = event.get("message") or {}
-                if isinstance(raw, dict):
-                    message = dict(raw)
-                    existing = message.get("content")
-                    blocks = list(existing) if isinstance(existing, list) else []
-                    usage = message.get("usage")
-                    if isinstance(usage, dict):
-                        final_usage = dict(usage)
-                    if isinstance(message.get("model"), str):
-                        final_model = message["model"]
-            elif etype == "content_block_start":
-                idx = int(event.get("index") or 0)
-                cb = event.get("content_block") or {}
-                cb_dict = dict(cb) if isinstance(cb, dict) else {}
-                while len(blocks) <= idx:
-                    blocks.append({})
-                blocks[idx] = cb_dict
-            elif etype == "content_block_delta":
-                idx = int(event.get("index") or 0)
-                if idx >= len(blocks):
-                    continue
-                delta = event.get("delta") or {}
-                if not isinstance(delta, dict):
-                    continue
-                dtype = delta.get("type")
-                block = blocks[idx]
-                if dtype == "text_delta":
-                    block["text"] = (block.get("text") or "") + (
-                        delta.get("text") or ""
-                    )
-                elif dtype == "input_json_delta":
-                    partial_json[idx] = partial_json.get(idx, "") + (
-                        delta.get("partial_json") or ""
-                    )
-                elif dtype == "thinking_delta":
-                    block["thinking"] = (block.get("thinking") or "") + (
-                        delta.get("thinking") or ""
-                    )
-                elif dtype == "signature_delta":
-                    block["signature"] = (block.get("signature") or "") + (
-                        delta.get("signature") or ""
-                    )
-            elif etype == "content_block_stop":
-                idx = int(event.get("index") or 0)
-                raw_json = partial_json.pop(idx, None)
-                if raw_json is not None and idx < len(blocks):
-                    try:
-                        blocks[idx]["input"] = (
-                            json.loads(raw_json) if raw_json else {}
-                        )
-                    except json.JSONDecodeError:
-                        blocks[idx]["input"] = raw_json
-            elif etype == "message_delta":
-                delta = event.get("delta") or {}
-                if isinstance(delta, dict):
-                    if "stop_reason" in delta:
-                        final_stop_reason = delta.get("stop_reason")
-                    if "stop_sequence" in delta:
-                        final_stop_sequence = delta.get("stop_sequence")
-                usage = event.get("usage")
-                if isinstance(usage, dict):
-                    final_usage.update(usage)
-            # message_stop: nothing to merge
-
-    if not message:
-        # Upstream returned no message_start; expose what we can so the
-        # client at least sees the assembled content.
-        message = {
-            "id": "",
-            "type": "message",
-            "role": "assistant",
-            "content": [],
-        }
-
-    message["content"] = blocks
-    if final_model and not message.get("model"):
-        message["model"] = final_model
-    if final_stop_reason is not None:
-        message["stop_reason"] = final_stop_reason
-    if final_stop_sequence is not None:
-        message["stop_sequence"] = final_stop_sequence
-    if final_usage:
-        existing_usage = message.get("usage")
-        merged = dict(existing_usage) if isinstance(existing_usage, dict) else {}
-        merged.update(final_usage)
-        message["usage"] = merged
-    return message
-
-
-class AnnotatedEvent(NamedTuple):
-    """One Anthropic SSE event after model-rewrite + token-tally bookkeeping.
-
-    ``sse_bytes`` is the wire-ready ``event:`` / ``data:`` block; the two
-    streaming paths in ``BaseUpstreamProvider`` consume ``sse_bytes`` plus
-    the tallies and only differ in whether they stream live or buffer
-    first.
-
-    ``cache_read_input_tokens`` and ``cache_creation_input_tokens`` are
-    surfaced separately so the cost path can price them against the cache
-    rate rather than fold them silently into the regular input bucket.
-
-    ``total_cost`` / ``input_cost`` / ``output_cost`` carry any
-    USD cost figures the upstream attached to this event (from
-    ``usage.cost``, ``usage.total_cost``, or ``usage.cost_details``) so the
-    streaming paths can re-embed them in the rebuilt ``usage`` dict and let
-    ``calculate_cost`` convert directly USD→sats instead of falling back to
-    token-based math.
-    """
-
-    event: dict
-    sse_bytes: bytes
-    input_tokens: int
-    output_tokens: int
-    cache_read_input_tokens: int
-    cache_creation_input_tokens: int
-    total_cost: float
-    input_cost: float
-    output_cost: float
-    model: str | None
-
-
-def annotate_event(event: dict, requested_model: str | None) -> AnnotatedEvent:
-    """Rewrite ``model`` fields and extract per-event token / model info.
-
-    Mutates ``event`` in place when ``requested_model`` is set so the
-    upstream's true model name doesn't leak to the client.
-    """
-    if requested_model:
-        msg = event.get("message")
-        if isinstance(msg, dict) and "model" in msg:
-            msg["model"] = requested_model
-        if "model" in event:
-            event["model"] = requested_model
-
-    in_tokens = 0
-    out_tokens = 0
-    cache_read_tokens = 0
-    cache_create_tokens = 0
-    total_cost = 0.0
-    input_cost = 0.0
-    output_cost = 0.0
-    model: str | None = None
-
-    def _coerce_float(value: object) -> float:
-        if value is None or isinstance(value, bool):
-            return 0.0
-        if not isinstance(value, (int, float, str)):
-            return 0.0
-        try:
-            return max(0.0, float(value))
-        except (TypeError, ValueError):
-            return 0.0
-
-    def _accumulate(usage: dict) -> None:
-        nonlocal in_tokens, out_tokens, cache_read_tokens, cache_create_tokens
-        nonlocal total_cost, input_cost, output_cost
-        in_tokens += int(usage.get("input_tokens") or 0)
-        out_tokens += int(usage.get("output_tokens") or 0)
-        cache_read_tokens += int(usage.get("cache_read_input_tokens") or 0)
-        cache_create_tokens += int(usage.get("cache_creation_input_tokens") or 0)
-        total_cost += _coerce_float(usage.get("total_cost"))
-        input_cost += _coerce_float(usage.get("input_cost"))
-        output_cost += _coerce_float(usage.get("output_cost"))
-
-    msg_for_meta = event.get("message")
-    if isinstance(msg_for_meta, dict):
-        if msg_for_meta.get("model"):
-            model = str(msg_for_meta["model"])
-        usage = msg_for_meta.get("usage")
-        if isinstance(usage, dict):
-            _accumulate(usage)
-
-    if isinstance(event.get("usage"), dict):
-        _accumulate(event["usage"])
-
-    # Some upstreams (notably OpenRouter-style proxies) attach cost fields
-    # directly at the event root rather than inside ``usage``.
-    for field in ("total_cost", "cost"):
-        total_cost = max(total_cost, _coerce_float(event.get(field)))
-    input_cost = max(input_cost, _coerce_float(event.get("input_cost")))
-    output_cost = max(output_cost, _coerce_float(event.get("output_cost")))
-    root_cost_details = event.get("cost_details")
-    if isinstance(root_cost_details, dict):
-        total_cost = max(
-            total_cost,
-            _coerce_float(root_cost_details.get("total_cost")),
-        )
-        input_cost = max(
-            input_cost,
-            _coerce_float(root_cost_details.get("input_cost")),
-        )
-        output_cost = max(
-            output_cost,
-            _coerce_float(root_cost_details.get("output_cost")),
-        )
-
-    event_type = str(event.get("type") or "")
-    payload = json.dumps(event)
-    if event_type:
-        sse_bytes = f"event: {event_type}\ndata: {payload}\n\n".encode()
-    else:
-        sse_bytes = f"data: {payload}\n\n".encode()
-
-    return AnnotatedEvent(
-        event,
-        sse_bytes,
-        in_tokens,
-        out_tokens,
-        cache_read_tokens,
-        cache_create_tokens,
-        total_cost,
-        input_cost,
-        output_cost,
-        model,
-    )
-
-
-async def stream_annotated_events(
-    iterator: AsyncIterator[Any],
-    requested_model: str | None,
-) -> AsyncGenerator[AnnotatedEvent, None]:
-    """Yield annotated, SSE-serialized events from a litellm stream.
-
-    Both streaming paths in ``BaseUpstreamProvider`` consume this; the only
-    divergence between them — yield-as-you-go vs buffer-then-replay — stays
-    in the caller.
-    """
-    sse_buffer = b""
-    async for chunk in iterator:
-        events, sse_buffer = events_from_chunk(chunk, sse_buffer)
-        for event in events:
-            yield annotate_event(event, requested_model)
-
-
-def embed_usd_costs(
-    usage: dict,
-    total_cost: float,
-    input_cost: float,
-    output_cost: float,
-) -> None:
-    """Mutate ``usage`` so ``calculate_cost`` will pick up the USD totals.
-
-    Mirrors the upstream shape: when any USD figure is present, attach
-    ``cost`` (used by the simple-fallback branch in ``calculate_cost``) and
-    a ``cost_details`` block (used by the preferred branch — also gives the
-    input/output USD split when we have one).
-    """
-    if total_cost <= 0 and input_cost <= 0 and output_cost <= 0:
-        return
-
-    cost_details: dict[str, float] = {}
-    effective_total = total_cost
-    if effective_total <= 0 and (input_cost > 0 or output_cost > 0):
-        effective_total = input_cost + output_cost
-
-    if effective_total > 0:
-        cost_details["total_cost"] = effective_total
-        usage["cost"] = effective_total
-    if input_cost > 0:
-        cost_details["input_cost"] = input_cost
-    if output_cost > 0:
-        cost_details["output_cost"] = output_cost
-    if cost_details:
-        usage["cost_details"] = cost_details
-
-
-def compute_refund(amount: int, unit: str, cost_msats: int) -> int:
-    if unit == "msat":
-        return amount - cost_msats
-    if unit == "sat":
-        return amount - (cost_msats + 999) // 1000
-    raise ValueError(f"Invalid unit: {unit}")
-
-
-async def dispatch_anthropic_messages(
-    *,
-    request_body: bytes | None,
-    model_obj: Model,
-    base_url: str,
-    api_key: str,
-    provider_prefix: str,
-    transform_model_name: Callable[[str], str],
-    log_extra: dict[str, Any] | None = None,
-) -> tuple[bool, Any, str | None]:
-    """Call ``litellm.anthropic.messages.acreate`` and return
-    ``(client_stream, result, requested_model)``.
-
-    Shared by the bearer-key and x-cashu paths. Raises :class:`UpstreamError`
-    on bad input or upstream failure.
-    """
-    if not request_body:
-        raise UpstreamError(
-            "Missing request body for /v1/messages", status_code=400
-        )
-
-    try:
-        body: dict = json.loads(request_body)
-    except json.JSONDecodeError as exc:
-        raise UpstreamError(
-            f"Invalid JSON in /v1/messages body: {exc}", status_code=400
-        ) from exc
-
-    body.pop("model", None)
-    # `stream` here is what the **client** asked for. Upstream is always
-    # streamed (see `upstream_stream` below); when the client asked for a
-    # non-streaming response we drain and aggregate the events into a
-    # single Anthropic Message dict before returning. This sidesteps
-    # provider-specific non-streaming caps (e.g. Fireworks rejects
-    # `max_tokens > 4096` unless `stream=true`).
-    client_stream = bool(body.pop("stream", False))
-    upstream_stream = True
-
-    dropped: dict[str, Any] = {}
-    for field in ANTHROPIC_ONLY_FIELDS:
-        if field in body:
-            dropped[field] = body.pop(field)
-    if dropped:
-        logger.debug(
-            "Dropped anthropic-only fields before litellm dispatch",
-            extra={"dropped_keys": sorted(dropped.keys())},
-        )
-
-    # Convention: `model.id` is the canonical upstream model name;
-    # `forwarded_model_id` is the public alias the internal API exposes
-    # and echoes back to the client.
-    requested_model = (
-        (model_obj.forwarded_model_id or model_obj.id) if model_obj else None
-    )
-    upstream_model = transform_model_name(model_obj.id)
-    litellm_model = f"{provider_prefix}{upstream_model}"
-
-    kwargs: dict = {
-        "model": litellm_model,
-        "api_base": base_url,
-        "api_key": api_key,
-        "stream": upstream_stream,
-        **body,
-    }
-
-    logger.info(
-        "Dispatching /v1/messages via litellm",
-        extra={
-            "model": litellm_model,
-            "resolved_provider": provider_prefix.rstrip("/"),
-            "client_stream": client_stream,
-            "upstream_stream": upstream_stream,
-            **(log_extra or {}),
-        },
-    )
-
-    try:
-        result = await litellm.anthropic.messages.acreate(**kwargs)
-    except Exception as exc:
-        raw_message = getattr(exc, "message", None) or str(exc) or repr(exc)
-        # Redact provider account identifiers before the message reaches logs
-        # or the surfaced error.
-        exc_message = redact_org_ids(raw_message)
-        exc_status = getattr(exc, "status_code", None)
-        exc_response = getattr(exc, "response", None)
-        response_text = None
-        if exc_response is not None:
-            try:
-                response_text = redact_org_ids(
-                    getattr(exc_response, "text", str(exc_response))
-                )
-            except Exception:
-                response_text = "<unreadable>"
-        status_for_classify = exc_status if isinstance(exc_status, int) else 502
-        rate_limit = classify_rate_limit(
-            status_for_classify, exc_message, getattr(exc, "headers", None)
-        )
-        logger.error(
-            "litellm dispatch failed",
-            extra={
-                "error": exc_message,
-                "error_type": type(exc).__name__,
-                "status_code": exc_status,
-                "error_code": rate_limit.code if rate_limit else None,
-                "llm_provider": getattr(exc, "llm_provider", None),
-                "body": redact_org_ids(str(getattr(exc, "body", "") or "")) or None,
-                "response_text": response_text,
-                "model": litellm_model,
-                "api_base": base_url,
-            },
-        )
-        raise UpstreamError(
-            f"Upstream error via litellm: {exc_message}",
-            status_code=status_for_classify,
-            code=rate_limit.code if rate_limit else None,
-            details=rate_limit.as_details() if rate_limit else None,
-        ) from exc
-
-    if not client_stream and hasattr(result, "__aiter__"):
-        # Client asked for a non-streaming response but we always stream
-        # from upstream — drain the events into a single Anthropic Message
-        # dict so the rest of the pipeline can treat it as if upstream had
-        # returned non-streaming. Some litellm adapters return a
-        # non-streaming dict even when ``stream=True``; in that case,
-        # leave the result as-is.
-        try:
-            aggregated: Any = await aggregate_anthropic_events_to_message(
-                cast(AsyncIterator[Any], result)
-            )
-        except Exception as exc:
-            logger.error(
-                "Failed to aggregate streamed events into message",
-                extra={
-                    "error": str(exc),
-                    "error_type": type(exc).__name__,
-                    "model": litellm_model,
-                },
-            )
-            raise UpstreamError(
-                f"Failed to aggregate upstream stream: {exc}",
-                status_code=502,
-            ) from exc
-        return client_stream, aggregated, requested_model
-
-    return client_stream, result, requested_model

routstr/upstream/model_paths.py

@@ -1,807 +0,0 @@
-"""Model-path discovery service.
-
-Exposes every selectable upstream route a Routstr model is reachable through.
-This PR remains discovery-only: request-side routing will consume the opaque
-selectors in a follow-up.
-
-A path is a standard percent-encoded query string containing the configured
-upstream URL, provider ID, client-visible model ID and, for an exact OpenRouter
-endpoint, its machine-readable tag::
-
-    url=https%3A%2F%2Fapi.anthropic.com%2Fv1&provider-id=12&model-id=claude-sonnet-4
-    url=https%3A%2F%2Fopenrouter.ai%2Fapi%2Fv1&provider-id=42&model-id=claude-sonnet-4&endpoint=google-vertex%2Fus
-"""
-
-from __future__ import annotations
-
-import asyncio
-import ipaddress
-import random
-import time
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any, Callable
-from urllib.parse import urlencode, urlsplit
-
-import httpx
-from sqlalchemy.dialects.sqlite import insert
-from sqlalchemy.orm import selectinload
-from sqlmodel import col, delete, select
-
-from ..core.db import ModelPathRow, ModelRow, UpstreamProviderRow, create_session
-from ..core.logging import get_logger
-
-if TYPE_CHECKING:
-    from .base import BaseUpstreamProvider
-
-logger = get_logger(__name__)
-
-# Bound the per-model OpenRouter /endpoints fan-out so a provider with hundreds
-# of models does not open hundreds of concurrent requests every refresh.
-_OPENROUTER_CONCURRENCY = 5
-_OPENROUTER_TIMEOUT_SECONDS = 10.0
-
-# Rows inserted per statement during persist. Keeps each INSERT bounded while
-# avoiding per-row round-trips that hold SQLite's write lock for ~1s per cycle.
-_PERSIST_CHUNK_SIZE = 500
-
-# Admin mutations enqueue provider IDs here instead of running OpenRouter's
-# per-model endpoint fan-out inside the request. One worker serializes refreshes
-# and coalesces repeated mutations for the same provider.
-_scheduled_provider_refresh_ids: set[int] = set()
-_scheduled_provider_refresh_task: asyncio.Task[None] | None = None
-
-# Visibility key used across this module: routing carries the provider
-# dimension everywhere (ModelRow's primary key is (id, upstream_provider_id)),
-# so all model-id keyed maps here do too, lowercased like proxy.refresh_model_maps.
-ModelKey = tuple[str, int]
-
-
-@dataclass(frozen=True)
-class EndpointIdentity:
-    """Exact OpenRouter endpoint identity returned by ``/endpoints``."""
-
-    tag: str
-    provider_name: str | None
-
-
-@dataclass(frozen=True)
-class ConfiguredProviderIdentity:
-    """Public identity of one configured upstream provider."""
-
-    id: int
-    slug: str
-    provider_type: str
-    base_url: str
-
-
-@dataclass(frozen=True)
-class DiscoveredPath:
-    """One model route ready for persistence and API serialization."""
-
-    model_id: str
-    path: str
-    provider: ConfiguredProviderIdentity
-    endpoint_tag: str | None = None
-    endpoint_name: str | None = None
-
-
-@dataclass(frozen=True)
-class ProviderPathSnapshot:
-    """Refresh result plus model IDs whose prior rows must survive degradation."""
-
-    paths: tuple[DiscoveredPath, ...]
-    preserve_model_ids: frozenset[str] = frozenset()
-
-
-def public_provider_url(base_url: str) -> str:
-    """Mask private IP addresses and URLs with explicit ports."""
-    parsed = urlsplit(base_url)
-    try:
-        if parsed.port is not None:
-            return "http://localhost"
-    except ValueError:
-        # An invalid explicit port must not accidentally leak through.
-        return "http://localhost"
-
-    hostname = parsed.hostname
-    if hostname is None:
-        return base_url
-    try:
-        address = ipaddress.ip_address(hostname)
-    except ValueError:
-        return base_url
-    return "http://localhost" if address.is_private else base_url
-
-
-def encode_model_path(
-    base_url: str,
-    provider_id: int,
-    model_id: str,
-    endpoint_tag: str | None = None,
-) -> str:
-    """Encode the complete upstream route selector advertised to clients."""
-    components: list[tuple[str, str | int]] = [
-        ("url", base_url),
-        ("provider-id", provider_id),
-        ("model-id", model_id),
-    ]
-    if endpoint_tag:
-        components.append(("endpoint", endpoint_tag))
-    return urlencode(components)
-
-
-def _make_http_client() -> httpx.AsyncClient:
-    """Client factory, separated so tests can substitute a mock transport."""
-    return httpx.AsyncClient()
-
-
-def is_openrouter_base_url(base_url: str | None) -> bool:
-    """True when ``base_url`` points at OpenRouter.
-
-    Deliberately separate from ``BaseUpstreamProvider._upstream_accepts_cache_control``:
-    that predicate also returns True for native Anthropic (correct for
-    cache-control, wrong for OpenRouter endpoint discovery). This one keys only
-    on the URL so a ``GenericUpstreamProvider`` aimed at OpenRouter is matched
-    while native Anthropic is not.
-    """
-    return "openrouter.ai" in (base_url or "")
-
-
-def exposed_model_id(model: object) -> str:
-    """Return exactly the ID advertised by ``/v1/models``.
-
-    A forwarded ID is already a public routable alias and must remain intact,
-    including any slash. Without one, ``/v1/models`` exposes the base ID.
-    """
-    forwarded = getattr(model, "forwarded_model_id", None)
-    if forwarded:
-        return forwarded
-    return public_model_id(getattr(model, "id"))
-
-
-def public_model_id(model_id: str) -> str:
-    """Model id exposed by model-path API responses.
-
-    Uses the same rule as ``create_model_mappings.get_base_model_id`` and
-    ``resolve_model_alias`` — strip everything before the *first* slash — so
-    the id shown here can be sent back to ``/v1/chat/completions`` verbatim.
-    """
-    return model_id.split("/", 1)[1] if "/" in model_id else model_id
-
-
-def openrouter_author_slug(model: object) -> str | None:
-    """Return a canonical ``author/slug`` for the OpenRouter endpoints API.
-
-    Prefer ``canonical_slug``, then a slash-containing ``id``, then a
-    slash-containing ``forwarded_model_id``. The forwarded id is exactly what
-    the proxy sends upstream for admin-created alias rows (``base.py`` forwards
-    ``forwarded_model_id or id``), so it is a valid OpenRouter id when the
-    bare ``id`` is a local alias with no slash.
-    """
-    canonical = getattr(model, "canonical_slug", None)
-    if canonical and "/" in canonical:
-        return canonical
-    model_id = getattr(model, "id", None)
-    if model_id and "/" in model_id:
-        return model_id
-    forwarded = getattr(model, "forwarded_model_id", None)
-    if forwarded and "/" in forwarded:
-        return forwarded
-    return None
-
-
-class _RefreshCycleState:
-    """Per-refresh shared state: fetch dedupe cache and rate-limit latch.
-
-    ``endpoint_cache`` dedupes byte-identical ``/endpoints`` fetches when two
-    providers point at the same OpenRouter base URL. ``rate_limited`` latches
-    on the first 429 so the rest of the cycle stops hammering a throttled API;
-    the whole provider result then degrades to "unknown" instead of an empty
-    list, which preserves previously persisted rows.
-    """
-
-    def __init__(self) -> None:
-        self.endpoint_cache: dict[tuple[str, str], list[EndpointIdentity] | None] = {}
-        self.rate_limited = False
-
-
-async def _fetch_openrouter_endpoint_subproviders(
-    client: httpx.AsyncClient,
-    base_url: str,
-    api_key: str,
-    author_slug: str,
-    semaphore: asyncio.Semaphore,
-    cycle: _RefreshCycleState,
-) -> list[EndpointIdentity] | None:
-    """Return exact endpoint identities for one model, or ``None`` when unknown.
-
-    ``None`` (not ``[]``) signals a degraded fetch — network failure, rate
-    limit, non-200, or an unparseable payload — so callers can distinguish
-    "this model has no endpoints" from "we could not find out". Failures are
-    logged and swallowed so one model never breaks the whole refresh.
-    """
-    cache_key = (base_url, author_slug)
-    if cache_key in cycle.endpoint_cache:
-        return cycle.endpoint_cache[cache_key]
-    if cycle.rate_limited:
-        return None
-
-    url = f"{base_url.rstrip('/')}/models/{author_slug}/endpoints"
-    headers = {"Authorization": f"Bearer {api_key}"} if api_key else {}
-    result: list[EndpointIdentity] | None
-    async with semaphore:
-        try:
-            resp = await client.get(
-                url, headers=headers, timeout=_OPENROUTER_TIMEOUT_SECONDS
-            )
-        except Exception as e:  # noqa: BLE001 - isolate per-model failures
-            logger.warning(
-                "OpenRouter endpoint discovery request failed",
-                extra={"author_slug": author_slug, "error": str(e)},
-            )
-            cycle.endpoint_cache[cache_key] = None
-            return None
-
-    if resp.status_code == 429:
-        logger.warning(
-            "OpenRouter endpoint discovery rate-limited; aborting cycle",
-            extra={"author_slug": author_slug},
-        )
-        cycle.rate_limited = True
-        cycle.endpoint_cache[cache_key] = None
-        return None
-    if resp.status_code != 200:
-        logger.warning(
-            "OpenRouter endpoint discovery non-200",
-            extra={"author_slug": author_slug, "status_code": resp.status_code},
-        )
-        cycle.endpoint_cache[cache_key] = None
-        return None
-
-    try:
-        payload = resp.json()
-        data = payload.get("data") if isinstance(payload, dict) else None
-        endpoints = data.get("endpoints") if isinstance(data, dict) else None
-        if not isinstance(endpoints, list):
-            raise ValueError("endpoints must be a list")
-        identities: dict[str, EndpointIdentity] = {}
-        for endpoint in endpoints:
-            if not isinstance(endpoint, dict):
-                continue
-            tag = endpoint.get("tag")
-            if not isinstance(tag, str) or not tag.strip():
-                continue
-            provider_name = endpoint.get("provider_name")
-            identities.setdefault(
-                tag,
-                EndpointIdentity(
-                    tag=tag,
-                    provider_name=provider_name
-                    if isinstance(provider_name, str) and provider_name
-                    else None,
-                ),
-            )
-        if endpoints and not identities:
-            raise ValueError("endpoints contain no usable tags")
-        result = list(identities.values())
-    except Exception as e:  # noqa: BLE001
-        logger.warning(
-            "OpenRouter endpoint discovery bad payload",
-            extra={"author_slug": author_slug, "error": str(e)},
-        )
-        result = None
-
-    cycle.endpoint_cache[cache_key] = result
-    return result
-
-
-async def _load_model_visibility() -> tuple[
-    dict[ModelKey, ModelRow],
-    set[ModelKey],
-    dict[int, ConfiguredProviderIdentity],
-]:
-    """Load the same DB model visibility inputs used by routing.
-
-    ``refresh_model_maps`` builds routing from enabled providers, enabled DB
-    override rows, and disabled model keys — all keyed on
-    ``(model_id.lower(), upstream_provider_id)`` because ``ModelRow``'s primary
-    key is composite and the same id legitimately exists on several providers.
-    Model-path discovery uses the same keying so disabling a model on one
-    provider never hides it on another, and one provider's
-    ``forwarded_model_id`` alias is never applied to a different provider.
-    """
-    async with create_session() as session:
-        query = select(UpstreamProviderRow).options(
-            selectinload(UpstreamProviderRow.models)  # type: ignore[arg-type]
-        )
-        provider_rows = (await session.exec(query)).all()
-
-    overrides_by_key: dict[ModelKey, ModelRow] = {}
-    disabled_model_keys: set[ModelKey] = set()
-    provider_identities: dict[int, ConfiguredProviderIdentity] = {}
-
-    for provider in provider_rows:
-        if not provider.enabled or provider.id is None:
-            continue
-        provider_identities[provider.id] = ConfiguredProviderIdentity(
-            id=provider.id,
-            slug=provider.slug or f"provider-{provider.id}",
-            provider_type=provider.provider_type,
-            base_url=public_provider_url(provider.base_url),
-        )
-        for model in provider.models:
-            key = (model.id.lower(), provider.id)
-            if model.enabled:
-                overrides_by_key[key] = model
-            else:
-                disabled_model_keys.add(key)
-
-    return overrides_by_key, disabled_model_keys, provider_identities
-
-
-def _apply_model_visibility(
-    upstream: BaseUpstreamProvider,
-    overrides_by_key: dict[ModelKey, ModelRow] | None,
-    disabled_model_keys: set[ModelKey] | None,
-) -> list[object]:
-    """Return provider models after DB disabled/override state is applied.
-
-    Only the identity fields (``id``, ``forwarded_model_id``,
-    ``canonical_slug``) matter for path discovery, so DB override rows are used
-    directly rather than rebuilt into fully priced ``Model`` objects — the
-    pricing pipeline costs ~0.7ms of event-loop CPU per row for data this
-    module immediately discards.
-    """
-    overrides_by_key = overrides_by_key or {}
-    disabled_model_keys = disabled_model_keys or set()
-    upstream_provider_id = getattr(upstream, "db_id", None)
-    if not isinstance(upstream_provider_id, int):
-        return [
-            model
-            for model in upstream.get_cached_models()
-            if getattr(model, "enabled", True)
-        ]
-
-    visible_models: list[object] = []
-    seen_model_ids: set[str] = set()
-
-    for model in upstream.get_cached_models():
-        model_id = getattr(model, "id", "")
-        key = (model_id.lower(), upstream_provider_id)
-        if not getattr(model, "enabled", True) or key in disabled_model_keys:
-            continue
-        # Apply overrides only for this provider's own model row.
-        override_row = overrides_by_key.get(key)
-        visible: object = model if override_row is None else override_row
-        visible_models.append(visible)
-        seen_model_ids.add(model_id.lower())
-
-    # DB-only override rows for this provider with no cached counterpart.
-    for (model_id_lower, provider_id), override_row in overrides_by_key.items():
-        if provider_id != upstream_provider_id:
-            continue
-        if model_id_lower in seen_model_ids:
-            continue
-        visible_models.append(override_row)
-        seen_model_ids.add(model_id_lower)
-
-    return visible_models
-
-
-async def _collect_provider_paths(
-    upstream: BaseUpstreamProvider,
-    provider_identity: ConfiguredProviderIdentity,
-    overrides_by_key: dict[ModelKey, ModelRow] | None = None,
-    disabled_model_keys: set[ModelKey] | None = None,
-    cycle: _RefreshCycleState | None = None,
-) -> ProviderPathSnapshot:
-    """Collect selectable routes while marking model-level degraded fetches.
-
-    A failed OpenRouter lookup preserves only that model's prior rows. Other
-    models in the same provider still refresh, so a partial outage cannot erase
-    valid discovery data or freeze the entire provider snapshot.
-    """
-    cycle = cycle or _RefreshCycleState()
-    models = _apply_model_visibility(upstream, overrides_by_key, disabled_model_keys)
-
-    def _base_path(model: object) -> DiscoveredPath:
-        model_id = exposed_model_id(model)
-        return DiscoveredPath(
-            model_id=model_id,
-            path=encode_model_path(
-                provider_identity.base_url, provider_identity.id, model_id
-            ),
-            provider=provider_identity,
-        )
-
-    if not is_openrouter_base_url(upstream.base_url):
-        return ProviderPathSnapshot(paths=tuple(_base_path(model) for model in models))
-
-    if not (upstream.provider_type or "").strip():
-        return ProviderPathSnapshot(paths=())
-
-    semaphore = asyncio.Semaphore(_OPENROUTER_CONCURRENCY)
-    async with _make_http_client() as client:
-
-        async def _for_model(
-            model: object,
-        ) -> tuple[list[DiscoveredPath], str | None]:
-            model_id = exposed_model_id(model)
-            author_slug = openrouter_author_slug(model)
-            if not author_slug:
-                return [_base_path(model)], None
-            endpoints = await _fetch_openrouter_endpoint_subproviders(
-                client,
-                upstream.base_url,
-                upstream.api_key,
-                author_slug,
-                semaphore,
-                cycle,
-            )
-            if endpoints is None:
-                return [], model_id
-            paths = [_base_path(model)]
-            paths.extend(
-                DiscoveredPath(
-                    model_id=model_id,
-                    path=encode_model_path(
-                        provider_identity.base_url,
-                        provider_identity.id,
-                        model_id,
-                        endpoint.tag,
-                    ),
-                    provider=provider_identity,
-                    endpoint_tag=endpoint.tag,
-                    endpoint_name=endpoint.provider_name,
-                )
-                for endpoint in endpoints
-            )
-            return paths, None
-
-        results = await asyncio.gather(
-            *(_for_model(model) for model in models), return_exceptions=True
-        )
-
-    paths: list[DiscoveredPath] = []
-    preserve_model_ids: set[str] = set()
-    for model, result in zip(models, results):
-        if isinstance(result, BaseException):
-            model_id = exposed_model_id(model)
-            preserve_model_ids.add(model_id)
-            logger.warning(
-                "OpenRouter endpoint discovery task errored",
-                extra={"provider": upstream.provider_type, "error": str(result)},
-            )
-            continue
-        model_paths, preserved_model_id = result
-        paths.extend(model_paths)
-        if preserved_model_id:
-            preserve_model_ids.add(preserved_model_id)
-
-    return ProviderPathSnapshot(
-        paths=tuple(paths), preserve_model_ids=frozenset(preserve_model_ids)
-    )
-
-
-async def _persist_provider_paths(
-    upstream_provider_id: int, snapshot: ProviderPathSnapshot
-) -> None:
-    """Replace refreshed rows while retaining model-level degraded snapshots."""
-    unique_paths = list(
-        {(path.model_id, path.path): path for path in snapshot.paths}.values()
-    )
-    now = int(time.time())
-    async with create_session() as session:
-        delete_stmt = delete(ModelPathRow).where(
-            col(ModelPathRow.upstream_provider_id) == upstream_provider_id
-        )
-        if snapshot.preserve_model_ids:
-            delete_stmt = delete_stmt.where(
-                col(ModelPathRow.model_id).not_in(sorted(snapshot.preserve_model_ids))
-            )
-        await session.exec(delete_stmt)  # type: ignore[call-overload]
-        for start in range(0, len(unique_paths), _PERSIST_CHUNK_SIZE):
-            chunk = unique_paths[start : start + _PERSIST_CHUNK_SIZE]
-            values = [
-                {
-                    "model_id": discovered.model_id,
-                    "path": discovered.path,
-                    "provider_slug": discovered.provider.slug,
-                    "provider_type": discovered.provider.provider_type,
-                    "endpoint_tag": discovered.endpoint_tag,
-                    "endpoint_name": discovered.endpoint_name,
-                    "upstream_provider_id": upstream_provider_id,
-                    "updated_at": now,
-                }
-                for discovered in chunk
-            ]
-            insert_stmt = insert(ModelPathRow).values(values)
-            await session.execute(
-                insert_stmt.on_conflict_do_update(
-                    index_elements=["model_id", "path", "upstream_provider_id"],
-                    set_={
-                        "provider_slug": insert_stmt.excluded.provider_slug,
-                        "provider_type": insert_stmt.excluded.provider_type,
-                        "endpoint_tag": insert_stmt.excluded.endpoint_tag,
-                        "endpoint_name": insert_stmt.excluded.endpoint_name,
-                        "updated_at": insert_stmt.excluded.updated_at,
-                    },
-                )
-            )
-        await session.commit()
-
-
-async def prune_model_paths_for_inactive_providers() -> None:
-    """Delete paths whose provider is no longer enabled in the database.
-
-    Called from ``refresh_model_maps`` so admin mutations (disable/delete
-    provider) stop advertising a provider's paths immediately instead of
-    waiting for the next timed refresh. Uses the DB as the source of truth, so
-    it is safe at boot even before upstreams initialize.
-    """
-    async with create_session() as session:
-        enabled_ids = (
-            await session.exec(
-                select(UpstreamProviderRow.id).where(
-                    col(UpstreamProviderRow.enabled).is_(True)
-                )
-            )
-        ).all()
-        stmt = delete(ModelPathRow)
-        if enabled_ids:
-            stmt = stmt.where(
-                col(ModelPathRow.upstream_provider_id).not_in(
-                    [pid for pid in enabled_ids if pid is not None]
-                )
-            )
-        await session.exec(stmt)  # type: ignore[call-overload]
-        await session.commit()
-
-
-async def refresh_model_paths(
-    upstreams: list[BaseUpstreamProvider],
-) -> None:
-    """Recompute and persist model paths for every enabled provider.
-
-    One provider's failure is logged and isolated; it must not break the rest.
-    A provider whose paths could not be determined this cycle keeps its
-    previously persisted rows. An empty ``upstreams`` list (e.g. a failed
-    ``initialize_upstreams`` at boot) is treated as "unknown" and touches
-    nothing.
-    """
-    if not upstreams:
-        logger.warning("Skipping model paths refresh: no live upstreams")
-        return
-
-    (
-        overrides_by_key,
-        disabled_model_keys,
-        provider_identities,
-    ) = await _load_model_visibility()
-    await prune_model_paths_for_inactive_providers()
-
-    cycle = _RefreshCycleState()
-    for upstream in upstreams:
-        if upstream.db_id is None or upstream.db_id not in provider_identities:
-            continue
-        try:
-            snapshot = await _collect_provider_paths(
-                upstream,
-                provider_identity=provider_identities[upstream.db_id],
-                overrides_by_key=overrides_by_key,
-                disabled_model_keys=disabled_model_keys,
-                cycle=cycle,
-            )
-            if snapshot.preserve_model_ids:
-                logger.warning(
-                    "Some model paths are unknown; keeping their previous rows",
-                    extra={
-                        "provider": upstream.provider_type or upstream.base_url,
-                        "db_id": upstream.db_id,
-                        "preserved_models": len(snapshot.preserve_model_ids),
-                    },
-                )
-            await _persist_provider_paths(upstream.db_id, snapshot)
-        except Exception as e:  # noqa: BLE001 - isolate per-provider failures
-            logger.error(
-                "Failed to refresh model paths for provider",
-                extra={
-                    "provider": upstream.provider_type or upstream.base_url,
-                    "db_id": upstream.db_id,
-                    "error": str(e),
-                    "error_type": type(e).__name__,
-                },
-            )
-
-
-async def refresh_model_paths_for_provider(upstream_provider_id: int) -> None:
-    """Synchronize one provider when model-path discovery is enabled."""
-    if _refresh_interval_seconds() <= 0:
-        return
-
-    from ..proxy import get_upstreams
-
-    matching = [
-        upstream
-        for upstream in get_upstreams()
-        if upstream.db_id == upstream_provider_id
-    ]
-    if matching:
-        await refresh_model_paths(matching)
-    else:
-        await prune_model_paths_for_inactive_providers()
-
-
-async def _drain_scheduled_provider_refreshes() -> None:
-    """Serialize and coalesce model-path refreshes scheduled by admin writes."""
-    global _scheduled_provider_refresh_task
-
-    try:
-        # Let mutations in the same event-loop turn collapse into one refresh.
-        await asyncio.sleep(0)
-        while _scheduled_provider_refresh_ids:
-            if _refresh_interval_seconds() <= 0:
-                _scheduled_provider_refresh_ids.clear()
-                return
-            provider_id = min(_scheduled_provider_refresh_ids)
-            _scheduled_provider_refresh_ids.remove(provider_id)
-            try:
-                await refresh_model_paths_for_provider(provider_id)
-            except asyncio.CancelledError:
-                raise
-            except Exception as exc:  # noqa: BLE001 - background best effort
-                logger.warning(
-                    "Failed to refresh model paths after admin mutation",
-                    extra={
-                        "upstream_provider_id": provider_id,
-                        "error": str(exc),
-                        "error_type": type(exc).__name__,
-                    },
-                )
-    finally:
-        _scheduled_provider_refresh_task = None
-
-
-async def schedule_model_paths_refresh_for_provider(
-    upstream_provider_id: int,
-) -> None:
-    """Queue a non-blocking, coalesced refresh after an admin mutation."""
-    global _scheduled_provider_refresh_task
-
-    if _refresh_interval_seconds() <= 0:
-        return
-    _scheduled_provider_refresh_ids.add(upstream_provider_id)
-    if (
-        _scheduled_provider_refresh_task is None
-        or _scheduled_provider_refresh_task.done()
-    ):
-        _scheduled_provider_refresh_task = asyncio.create_task(
-            _drain_scheduled_provider_refreshes(),
-            name="model-path-admin-refresh",
-        )
-
-
-def _refresh_interval_seconds() -> int:
-    """Current interval, re-read every loop so runtime setting changes apply."""
-    from ..core.settings import settings
-
-    if not getattr(settings, "enable_model_paths_refresh", True):
-        return 0
-    return int(getattr(settings, "model_paths_refresh_interval_seconds", 0) or 0)
-
-
-async def refresh_model_paths_periodically(
-    upstreams_provider: (
-        Callable[[], list[BaseUpstreamProvider]] | list[BaseUpstreamProvider]
-    ),
-) -> None:
-    """Background task mirroring ``refresh_upstreams_models_periodically``.
-
-    The interval and enable flag are re-read every iteration, so the refresh
-    can be turned off (or on) and retuned without a restart. While disabled the
-    task idles instead of exiting, so re-enabling takes effect.
-    """
-    _DISABLED_POLL_SECONDS = 60.0
-
-    def _resolve_upstreams() -> list[BaseUpstreamProvider]:
-        if callable(upstreams_provider):
-            return upstreams_provider()
-        return upstreams_provider
-
-    while True:
-        interval = _refresh_interval_seconds()
-        if interval <= 0:
-            try:
-                await asyncio.sleep(_DISABLED_POLL_SECONDS)
-            except asyncio.CancelledError:
-                break
-            continue
-
-        try:
-            await refresh_model_paths(_resolve_upstreams())
-        except asyncio.CancelledError:
-            break
-        except Exception as e:  # noqa: BLE001
-            logger.error(
-                "Error in model paths refresh loop",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-
-        try:
-            jitter = max(0.0, float(interval) * 0.1)
-            await asyncio.sleep(interval + random.uniform(0, jitter))
-        except asyncio.CancelledError:
-            break
-
-
-def _serialize_path(row: ModelPathRow) -> dict[str, Any]:
-    endpoint = None
-    if row.endpoint_tag or row.endpoint_name:
-        endpoint = {"tag": row.endpoint_tag, "name": row.endpoint_name}
-    return {
-        "path": row.path,
-        "provider": {
-            "id": row.upstream_provider_id,
-            "slug": row.provider_slug,
-            "type": row.provider_type,
-        },
-        "endpoint": endpoint,
-    }
-
-
-async def get_all_model_paths() -> dict:
-    """All models with their exact selectable routes."""
-    async with create_session() as session:
-        rows = (
-            await session.exec(
-                select(ModelPathRow).order_by(
-                    col(ModelPathRow.model_id),
-                    col(ModelPathRow.path),
-                    col(ModelPathRow.upstream_provider_id),
-                )
-            )
-        ).all()
-
-    grouped: dict[str, list[dict[str, Any]]] = {}
-    seen_paths: dict[str, set[str]] = {}
-    updated_at = 0
-    for row in rows:
-        updated_at = max(updated_at, row.updated_at)
-        if row.path in seen_paths.setdefault(row.model_id, set()):
-            continue
-        seen_paths[row.model_id].add(row.path)
-        grouped.setdefault(row.model_id, []).append(_serialize_path(row))
-    data = [
-        {
-            "id": grouped_model_id,
-            "paths": grouped[grouped_model_id],
-        }
-        for grouped_model_id in sorted(grouped)
-    ]
-    return {"data": data, "updated_at": updated_at or None}
-
-
-async def get_paths_for_model(model_id: str) -> dict:
-    """Return paths only for the exact model ID advertised by ``/v1/models``."""
-    async with create_session() as session:
-        rows = (
-            await session.exec(
-                select(ModelPathRow)
-                .where(col(ModelPathRow.model_id) == model_id)
-                .order_by(
-                    col(ModelPathRow.path),
-                    col(ModelPathRow.upstream_provider_id),
-                )
-            )
-        ).all()
-
-    seen: set[str] = set()
-    paths: list[dict] = []
-    updated_at = 0
-    for row in rows:
-        updated_at = max(updated_at, row.updated_at)
-        if row.path in seen:
-            continue
-        seen.add(row.path)
-        paths.append(_serialize_path(row))
-    return {"data": paths, "updated_at": updated_at or None}

routstr/upstream/ollama.py

@@ -3,11 +3,13 @@ from __future__ import annotations
 from typing import TYPE_CHECKING
 
 import httpx
+from fastapi import Request
+from fastapi.responses import Response, StreamingResponse
 
 from .base import BaseUpstreamProvider
 
 if TYPE_CHECKING:
-    from ..core.db import UpstreamProviderRow
+    from ..core.db import ApiKey, AsyncSession, UpstreamProviderRow
     from ..payment.models import Model
 
 from ..core.logging import get_logger
@@ -21,7 +23,6 @@ class OllamaUpstreamProvider(BaseUpstreamProvider):
     provider_type = "ollama"
     default_base_url = "http://localhost:11434"
     platform_url = None
-    litellm_provider_prefix = "ollama_chat/"
 
     def __init__(
         self,
@@ -43,7 +44,7 @@ class OllamaUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "OllamaUpstreamProvider":
         return cls(
@@ -66,11 +67,38 @@ class OllamaUpstreamProvider(BaseUpstreamProvider):
         """Strip 'ollama/' prefix for Ollama API compatibility."""
         return model_id.removeprefix("ollama/")
 
-    def get_request_base_url(
-        self, path: str, model_obj: Model | None = None
-    ) -> str:
-        """Route proxy traffic through Ollama's OpenAI-compatible /v1 endpoint."""
-        return f"{self.base_url.rstrip('/')}/v1"
+    async def forward_request(
+        self,
+        request: Request,
+        path: str,
+        headers: dict,
+        request_body: bytes | None,
+        key: ApiKey,
+        max_cost_for_model: int,
+        session: AsyncSession,
+        model_obj: Model,
+    ) -> Response | StreamingResponse:
+        """Override to use OpenAI-compatible endpoint for proxy requests."""
+        if path.startswith("v1/"):
+            path = path.replace("v1/", "")
+
+        original_base_url = self.base_url
+        self.base_url = f"{self.base_url}/v1"
+
+        try:
+            result = await super().forward_request(
+                request,
+                path,
+                headers,
+                request_body,
+                key,
+                max_cost_for_model,
+                session,
+                model_obj,
+            )
+            return result
+        finally:
+            self.base_url = original_base_url
 
     async def fetch_models(self) -> list[Model]:
         """Fetch models from Ollama API using /api/tags endpoint."""
@@ -185,7 +213,7 @@ class OllamaUpstreamProvider(BaseUpstreamProvider):
             except Exception:
                 self._models_cache = models_with_fees
 
-            self._models_by_id = {m.forwarded_model_id or m.id: m for m in self._models_cache}
+            self._models_by_id = {m.id: m for m in self._models_cache}
             logger.info(
                 f"Refreshed models cache for {self.base_url}",
                 extra={"model_count": len(models)},

routstr/upstream/openai.py

@@ -20,7 +20,7 @@ class OpenAIUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "OpenAIUpstreamProvider":
         return cls(

routstr/upstream/openrouter.py

@@ -15,35 +15,6 @@ class OpenRouterUpstreamProvider(BaseUpstreamProvider):
     provider_type = "openrouter"
     default_base_url = "https://openrouter.ai/api/v1"
     platform_url = "https://openrouter.ai/settings/keys"
-    supports_anthropic_messages = True
-    litellm_provider_prefix = "openrouter/"
-
-    def _apply_provider_field(self, response_json: object) -> None:
-        """Stamp the ``provider`` field for OpenRouter responses.
-
-        OpenRouter is a router, not the real serving provider, so a bare
-        ``"openrouter"`` value carries no useful information. Rules:
-
-        - Real upstream sub-provider (e.g. ``"GMICloud"``) -> ``"openrouter:GMICloud"``.
-        - Missing sub-provider, or one that merely echoes ``"openrouter"`` ->
-          ``"unknown"``.
-        - Idempotent: re-stamping never produces ``"openrouter:openrouter:..."``;
-          the ``openrouter:`` prefix appears at most once.
-        """
-        if not isinstance(response_json, dict):
-            return
-        provider_type = (self.provider_type or "").strip()
-        existing = response_json.get("provider")
-        sub = existing.strip() if isinstance(existing, str) else ""
-        # Strip any already-applied "openrouter:" prefixes (idempotency).
-        prefix = f"{provider_type}:"
-        while sub.lower().startswith(prefix.lower()):
-            sub = sub[len(prefix) :].strip()
-        # No real sub-provider, or it just echoes our own router name.
-        if not sub or sub.lower() == provider_type.lower():
-            response_json["provider"] = "unknown"
-            return
-        response_json["provider"] = f"{provider_type}:{sub}"
 
     def __init__(self, api_key: str, provider_fee: float = 1.06):
         """Initialize OpenRouter provider with API key.
@@ -57,7 +28,7 @@ class OpenRouterUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "OpenRouterUpstreamProvider":
         return cls(

routstr/upstream/perplexity.py

@@ -13,7 +13,6 @@ class PerplexityUpstreamProvider(BaseUpstreamProvider):
     provider_type = "perplexity"
     default_base_url = "https://api.perplexity.ai/"
     platform_url = "https://www.perplexity.ai/account/api/keys"
-    litellm_provider_prefix = "perplexity/"
 
     def __init__(self, api_key: str, provider_fee: float = 1.01):
         super().__init__(
@@ -23,7 +22,7 @@ class PerplexityUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "PerplexityUpstreamProvider":
         return cls(

routstr/upstream/ppqai.py

@@ -1,14 +1,13 @@
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 import httpx
-from pydantic.v1 import BaseModel, Field
+from pydantic import BaseModel
 
 from ..core.logging import get_logger
 from ..payment.models import Architecture, Model, Pricing, async_fetch_openrouter_models
 from .base import BaseUpstreamProvider, TopupData
-from .ehbp import EHBPForwardingTarget
 
 if TYPE_CHECKING:
     from ..core.db import UpstreamProviderRow
@@ -17,20 +16,18 @@ logger = get_logger(__name__)
 
 
 class PPQAIModelPricing(BaseModel):
-    ui: Optional[dict[str, float]] = None
-    api: Optional[dict[str, float]] = None
-    input_per_1M_tokens: Optional[float] = Field(None, alias="input_per_1M_tokens")
-    output_per_1M_tokens: Optional[float] = Field(None, alias="output_per_1M_tokens")
+    ui: dict[str, float]
+    api: dict[str, float]
 
 
 class PPQAIModel(BaseModel):
     id: str
-    provider: Optional[str] = None
+    provider: str
     name: str
     created_at: int
     context_length: int
     pricing: PPQAIModelPricing
-    popular: bool = False
+    popular: bool
 
 
 class PPQAIUpstreamProvider(BaseUpstreamProvider):
@@ -40,10 +37,6 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
     default_base_url = "https://api.ppq.ai"
     platform_url = "https://ppq.ai/api-docs"
     IGNORED_MODEL_IDS: list[str] = ["auto"]
-    # PPQ.AI has a private encrypted endpoint, but this proxy currently has no
-    # provider-attested usage extractor/model binding for it. Keep EHBP disabled
-    # until a ConfidentialInferenceProfile can bill it without max-cost fallback.
-    supports_ehbp = False
 
     def __init__(self, api_key: str, provider_fee: float = 1.0):
         super().__init__(
@@ -51,7 +44,7 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
         )
 
     @classmethod
-    def _build_from_row(
+    def from_db_row(
         cls, provider_row: "UpstreamProviderRow"
     ) -> "PPQAIUpstreamProvider":
         return cls(
@@ -75,20 +68,6 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
     def transform_model_name(self, model_id: str) -> str:
         return model_id
 
-    def get_ehbp_forwarding_target(
-        self, path: str, model_obj: Model
-    ) -> EHBPForwardingTarget:
-        """Return the PPQ.AI private enclave target for EHBP requests.
-
-        PPQ.AI exposes EHBP-aware inference under /private/v1/... separate
-        from the public /v1/... endpoint. The encrypted body remains opaque to
-        Routstr, so PPQ.AI also needs X-Private-Model for routing/billing.
-        """
-        return EHBPForwardingTarget(
-            url=f"{self.base_url.rstrip('/')}/private/{path.lstrip('/')}",
-            headers={"X-Private-Model": model_obj.forwarded_model_id or model_obj.id},
-        )
-
     @classmethod
     async def create_account_static(cls) -> dict[str, object]:
         """Create a new PPQ.AI account without requiring an instance.
@@ -155,54 +134,31 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
                         )
 
                         if or_model:
-                            input_price = None
-                            if ppqai_model.pricing.api:
-                                input_price = ppqai_model.pricing.api.get(
-                                    "input_per_1M"
-                                )
-                            elif ppqai_model.pricing.input_per_1M_tokens:
-                                input_price = ppqai_model.pricing.input_per_1M_tokens
-
-                            if input_price is not None:
+                            if input_price := ppqai_model.pricing.api.get(
+                                "input_per_1M"
+                            ):
                                 or_model.pricing.prompt = input_price / 1_000_000
-
-                            output_price = None
-                            if ppqai_model.pricing.api:
-                                output_price = ppqai_model.pricing.api.get(
-                                    "output_per_1M"
-                                )
-                            elif ppqai_model.pricing.output_per_1M_tokens:
-                                output_price = ppqai_model.pricing.output_per_1M_tokens
-
-                            if output_price is not None:
+                            if output_price := ppqai_model.pricing.api.get(
+                                "output_per_1M"
+                            ):
                                 or_model.pricing.completion = output_price / 1_000_000
-
                             if cl := ppqai_model.context_length:
                                 or_model.context_length = cl
                             models.append(or_model)
                         else:
-                            input_price = 0.0
-                            if ppqai_model.pricing.api:
-                                input_price = ppqai_model.pricing.api.get(
-                                    "input_per_1M", 0.0
-                                )
-                            elif ppqai_model.pricing.input_per_1M_tokens:
-                                input_price = ppqai_model.pricing.input_per_1M_tokens
-
-                            output_price = 0.0
-                            if ppqai_model.pricing.api:
-                                output_price = ppqai_model.pricing.api.get(
-                                    "output_per_1M", 0.0
-                                )
-                            elif ppqai_model.pricing.output_per_1M_tokens:
-                                output_price = ppqai_model.pricing.output_per_1M_tokens
+                            input_price = ppqai_model.pricing.api.get(
+                                "input_per_1M", 0.0
+                            )
+                            output_price = ppqai_model.pricing.api.get(
+                                "output_per_1M", 0.0
+                            )
 
                             models.append(
                                 Model(
                                     id=ppqai_model.id,
                                     name=ppqai_model.name,
                                     created=ppqai_model.created_at // 1000,
-                                    description=f"{ppqai_model.provider or 'PPQ.AI'} model",
+                                    description=f"{ppqai_model.provider} model",
                                     context_length=ppqai_model.context_length,
                                     architecture=Architecture(
                                         modality="text->text",
@@ -248,14 +204,17 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
                 f"Disabling PPQ.AI provider ({self.base_url}) due to insufficient balance",
                 extra={"error": error_message},
             )
+            from sqlmodel import select
+
             from ..core.db import UpstreamProviderRow, create_session
 
             async with create_session() as session:
-                provider = (
-                    await session.get(UpstreamProviderRow, self.db_id)
-                    if self.db_id is not None
-                    else None
+                statement = select(UpstreamProviderRow).where(
+                    UpstreamProviderRow.base_url == self.base_url,
+                    UpstreamProviderRow.api_key == self.api_key,
                 )
+                result = await session.exec(statement)
+                provider = result.first()
 
                 if provider:
                     provider.enabled = False
@@ -324,6 +283,7 @@ class PPQAIUpstreamProvider(BaseUpstreamProvider):
         )
 
         async with httpx.AsyncClient(timeout=30.0) as client:
+            print(f"Payload: {payload}", "sending to", url)
             response = await client.post(url, headers=headers, json=payload)
             response.raise_for_status()
             invoice_data = response.json()

routstr/upstream/pricing_resolver.py

@@ -1,203 +0,0 @@
-"""Shared price/metadata resolution chain for upstream model discovery.
-
-Most OpenAI-compatible ``/models`` responses carry no pricing. Rather than let
-a provider fabricate one, this module resolves a model through decreasingly
-trustworthy sources — litellm's bundled cost map (curated list prices, mirrors
-provider docs), then the OpenRouter feed (resale prices, broader coverage) —
-and returns ``None`` when none of them know the model, so the caller can fail
-closed instead of inventing a number.
-
-Provider-native pricing (a gateway's own ``/models`` schema, e.g. Venice's
-``model_spec``) is authoritative and handled by the provider before this chain
-is consulted; only the shared fallback lives here so a later refactor can hoist
-it into the base provider unchanged.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, field
-
-
-@dataclass
-class ResolvedPricing:
-    """Per-token pricing plus whatever metadata the answering source carried.
-
-    Prices are USD per token. ``source`` records provenance
-    (``native``/``litellm``/``openrouter``/``unresolved``) so later work can
-    surface where each price came from.
-    """
-
-    prompt: float
-    completion: float
-    context_length: int | None
-    source: str
-    modality: str | None = None
-    max_completion_tokens: int | None = None
-    input_cache_read: float = 0.0
-    input_cache_write: float = 0.0
-    input_modalities: list[str] = field(default_factory=lambda: ["text"])
-    output_modalities: list[str] = field(default_factory=lambda: ["text"])
-    tokenizer: str = "unknown"
-    instruct_type: str | None = None
-    is_moderated: bool | None = None
-
-
-def estimate_context_length(model_id: str) -> int:
-    """Best-effort context window from a model id when no source reports one.
-
-    The last rung of the fallback chain, reached only for a model whose price
-    resolved but whose context did not (or that imported disabled). Context is
-    not a billing input, so a rough id-based guess is acceptable here where a
-    guessed *price* never would be.
-    """
-    lowered = model_id.lower()
-    if any(pattern in lowered for pattern in ["32k", "32000"]):
-        return 32768
-    if any(pattern in lowered for pattern in ["16k", "16000"]):
-        return 16384
-    if any(pattern in lowered for pattern in ["8k", "8000"]):
-        return 8192
-    if "gpt-4" in lowered:
-        return 8192
-    if "claude" in lowered:
-        return 200000
-    return 4096
-
-
-def _as_float(value: object) -> float | None:
-    """OpenRouter reports prices as strings; coerce, ``None`` if unparseable."""
-    try:
-        return float(value)  # type: ignore[arg-type]
-    except (TypeError, ValueError):
-        return None
-
-
-def _as_int(value: object) -> int | None:
-    """Coerce an already-numeric token count to ``int``, else ``None``."""
-    return int(value) if isinstance(value, (int, float)) else None
-
-
-def _from_litellm(model_id: str) -> ResolvedPricing | None:
-    # Lazy import so the resolver stays import-light and shares the exact
-    # lookup semantics used by cache-rate backfill.
-    from ..payment.models import litellm_cost_entry
-
-    info = litellm_cost_entry(model_id)
-    if info is None:
-        return None
-
-    prompt = info.get("input_cost_per_token")
-    completion = info.get("output_cost_per_token")
-    if not isinstance(prompt, (int, float)) or not isinstance(completion, (int, float)):
-        return None
-    # A both-zero entry is litellm listing a model without a real price (free
-    # moderation/rerank tiers do this) — treating 0/0 as resolved would serve
-    # the model for free. Reject it (and any negative) so the caller falls
-    # through, mirroring async_fetch_openrouter_models' _has_valid_pricing.
-    if prompt < 0 or completion < 0 or (prompt == 0 and completion == 0):
-        return None
-
-    input_modalities = ["text"]
-    if info.get("supports_vision"):
-        input_modalities.append("image")
-
-    return ResolvedPricing(
-        prompt=float(prompt),
-        completion=float(completion),
-        # max_input_tokens is the context window; max_tokens is litellm's
-        # completion cap (it tracks max_output_tokens for ~94% of models), so
-        # it is never a context source. A missing window falls to the id-based
-        # estimate downstream rather than borrowing the output cap.
-        context_length=_as_int(info.get("max_input_tokens")),
-        source="litellm",
-        max_completion_tokens=_as_int(info.get("max_output_tokens")),
-        input_cache_read=float(info.get("cache_read_input_token_cost") or 0.0),
-        input_cache_write=float(info.get("cache_creation_input_token_cost") or 0.0),
-        input_modalities=input_modalities,
-    )
-
-
-def _match_openrouter(model_id: str, feed: list[dict]) -> dict | None:
-    """Find ``model_id`` in the OpenRouter feed, exact id before bare tail.
-
-    Bare-tail matching (``deepseek-chat`` ↔ ``deepseek/deepseek-chat``) is a
-    looser, lower-trust match — OpenRouter fans a model out across resellers —
-    so an exact id match always wins first. When several entries share the bare
-    tail, the one with the highest *combined* (prompt + completion) per-token
-    cost wins: the choice must be deterministic (not feed-order-dependent) and
-    money-safe whichever way traffic leans, since undercharging is the hazard.
-    Ranking on prompt alone could pick an entry that is cheap on input but dear
-    on output. The live feed has no such collisions today; this only governs
-    the latent case.
-    """
-    bare = model_id.split("/", 1)[-1]
-    exact = next((m for m in feed if m.get("id") == model_id), None)
-    if exact is not None:
-        return exact
-    matches = [m for m in feed if m.get("id", "").split("/", 1)[-1] == bare]
-    if not matches:
-        return None
-
-    def _combined_cost(m: dict) -> float:
-        pricing = m.get("pricing", {})
-        return (_as_float(pricing.get("prompt")) or 0.0) + (
-            _as_float(pricing.get("completion")) or 0.0
-        )
-
-    return max(matches, key=_combined_cost)
-
-
-def _from_openrouter(model_id: str, feed: list[dict]) -> ResolvedPricing | None:
-    entry = _match_openrouter(model_id, feed)
-    if entry is None:
-        return None
-
-    pricing = entry.get("pricing", {})
-    prompt = _as_float(pricing.get("prompt"))
-    completion = _as_float(pricing.get("completion"))
-    if prompt is None or completion is None:
-        return None
-
-    architecture = entry.get("architecture", {})
-    top_provider = entry.get("top_provider", {})
-
-    return ResolvedPricing(
-        prompt=prompt,
-        completion=completion,
-        context_length=_as_int(entry.get("context_length")),
-        source="openrouter",
-        modality=architecture.get("modality"),
-        max_completion_tokens=_as_int(top_provider.get("max_completion_tokens")),
-        input_cache_read=_as_float(pricing.get("input_cache_read")) or 0.0,
-        input_cache_write=_as_float(pricing.get("input_cache_write")) or 0.0,
-        input_modalities=architecture.get("input_modalities") or ["text"],
-        output_modalities=architecture.get("output_modalities") or ["text"],
-        tokenizer=architecture.get("tokenizer") or "unknown",
-        instruct_type=architecture.get("instruct_type"),
-        is_moderated=top_provider.get("is_moderated"),
-    )
-
-
-class FallbackPricingResolver:
-    """Resolves models via litellm → OpenRouter for one discovery pass.
-
-    The OpenRouter catalog is fetched at most once and only when a model
-    actually misses litellm, so a provider full of litellm-known models never
-    touches the network. Instantiate one per ``fetch_models`` call.
-    """
-
-    def __init__(self) -> None:
-        self._openrouter_feed: list[dict] | None = None
-
-    async def resolve(self, model_id: str) -> ResolvedPricing | None:
-        """Resolve ``model_id``; ``None`` if no source knows it."""
-        resolved = _from_litellm(model_id)
-        if resolved is not None:
-            return resolved
-
-        if self._openrouter_feed is None:
-            # Lazy import so tests can patch the feed at its source.
-            from ..payment.models import async_fetch_openrouter_models
-
-            self._openrouter_feed = await async_fetch_openrouter_models()
-        return _from_openrouter(model_id, self._openrouter_feed)

routstr/upstream/rate_limit.py

@@ -1,136 +0,0 @@
-"""Detection and parsing of upstream provider rate-limit errors.
-
-Upstream OpenAI-compatible providers signal rate limits via HTTP 429 and/or a
-human-readable message such as::
-
-    Rate limit reached for gpt-5.5-2026-04-23 (for limit gpt-5.5) in organization
-    org-XXXX on tokens per min (TPM): Limit 180000000, Used 180000000,
-    Requested 8929. Please try again in 2ms.
-
-This module classifies those failures into a stable :data:`UPSTREAM_RATE_LIMIT`
-code and extracts useful debugging fields. All retained text is redacted of
-organization IDs first.
-"""
-
-from __future__ import annotations
-
-import re
-from dataclasses import asdict, dataclass
-
-from ..core.redaction import redact_org_ids
-
-# Stable error code callers can switch on to distinguish upstream rate limits
-# from generic request failures. The literal value matches the identifier named
-# in issue #555 ("UPSTREAM_RATE_LIMIT") so the public API contract is exact.
-UPSTREAM_RATE_LIMIT = "UPSTREAM_RATE_LIMIT"
-
-# Message fragments that indicate a rate-limit even when the status code is not
-# 429 (some providers wrap it in a 400/500 envelope).
-_RATE_LIMIT_MARKERS = (
-    "rate limit reached",
-    "rate_limit_exceeded",
-    "rate limit exceeded",
-    "too many requests",
-)
-
-_MODEL_RE = re.compile(r"Rate limit reached for ([^\s(]+)", re.IGNORECASE)
-_LIMIT_NAME_RE = re.compile(r"\(for limit ([^)]+)\)", re.IGNORECASE)
-_METRIC_RE = re.compile(r"on ([a-z ]+\((?:TPM|RPM|TPD|RPD|IPM)\))", re.IGNORECASE)
-_LIMIT_RE = re.compile(r"Limit (\d+)", re.IGNORECASE)
-_USED_RE = re.compile(r"Used (\d+)", re.IGNORECASE)
-_REQUESTED_RE = re.compile(r"Requested (\d+)", re.IGNORECASE)
-_RETRY_RE = re.compile(r"try again in ([\d.]+)\s*(ms|s)", re.IGNORECASE)
-
-
-@dataclass
-class RateLimitInfo:
-    """Structured, redaction-safe view of an upstream rate-limit error."""
-
-    code: str
-    message: str
-    model: str | None = None
-    limit_name: str | None = None
-    metric: str | None = None
-    limit: int | None = None
-    used: int | None = None
-    requested: int | None = None
-    retry_after_seconds: float | None = None
-
-    def as_details(self) -> dict[str, object]:
-        """Return a JSON-serialisable dict for embedding in an error envelope."""
-        return {k: v for k, v in asdict(self).items() if v is not None}
-
-
-def _looks_like_rate_limit(status_code: int, message: str) -> bool:
-    if status_code == 429:
-        return True
-    lowered = message.lower()
-    return any(marker in lowered for marker in _RATE_LIMIT_MARKERS)
-
-
-def _parse_retry_after_header(headers: dict[str, str] | None) -> float | None:
-    """Parse a ``Retry-After`` header (delta-seconds form) into seconds."""
-    if not headers:
-        return None
-    raw = headers.get("retry-after") or headers.get("Retry-After")
-    if raw is None:
-        return None
-    try:
-        return float(str(raw).strip())
-    except (TypeError, ValueError):
-        return None
-
-
-def _int_or_none(match: re.Match[str] | None) -> int | None:
-    if match is None:
-        return None
-    try:
-        return int(match.group(1))
-    except (TypeError, ValueError):
-        return None
-
-
-def classify_rate_limit(
-    status_code: int,
-    message: str,
-    headers: dict[str, str] | None = None,
-) -> RateLimitInfo | None:
-    """Classify an upstream error as a rate-limit and extract its fields.
-
-    Args:
-        status_code: HTTP status code from the upstream response.
-        message: Upstream error message (may contain sensitive identifiers).
-        headers: Optional upstream response headers, used for ``Retry-After``.
-
-    Returns:
-        A :class:`RateLimitInfo` when the error is a rate-limit, else ``None``.
-    """
-    message = message or ""
-    if not _looks_like_rate_limit(status_code, message):
-        return None
-
-    redacted = redact_org_ids(message)
-
-    model_match = _MODEL_RE.search(redacted)
-    metric_match = _METRIC_RE.search(redacted)
-
-    retry_after = _parse_retry_after_header(headers)
-    if retry_after is None:
-        retry_match = _RETRY_RE.search(redacted)
-        if retry_match is not None:
-            value = float(retry_match.group(1))
-            retry_after = value / 1000.0 if retry_match.group(2).lower() == "ms" else value
-
-    limit_name_match = _LIMIT_NAME_RE.search(redacted)
-
-    return RateLimitInfo(
-        code=UPSTREAM_RATE_LIMIT,
-        message=redacted,
-        model=model_match.group(1) if model_match else None,
-        limit_name=limit_name_match.group(1).strip() if limit_name_match else None,
-        metric=metric_match.group(1).strip() if metric_match else None,
-        limit=_int_or_none(_LIMIT_RE.search(redacted)),
-        used=_int_or_none(_USED_RE.search(redacted)),
-        requested=_int_or_none(_REQUESTED_RE.search(redacted)),
-        retry_after_seconds=retry_after,
-    )

routstr/upstream/request_correction.py

@@ -1,142 +0,0 @@
-"""Reactive request-correction layer.
-
-When an upstream rejects a request with a recoverable 4xx error, this layer
-tries to *fix* the request body and let the caller retry the same upstream
-instead of failing outright. It is provider-agnostic: correctors key off the
-upstream's own error wording, so the same recovery works across every provider.
-
-The layer is a small pipeline of :data:`Corrector` callables. Each corrector
-inspects the parsed request body and the upstream error message and either
-returns a corrected body (plus a short label identifying the fix) or declines
-by returning ``None``. Adding a new reactive fix means writing one corrector
-and adding it to :data:`DEFAULT_CORRECTORS` — no changes to the proxy loop.
-
-All corrections are immutable: a corrector never mutates the body it is given,
-it returns a new ``dict``. The proxy threads an ``applied`` set of fix labels
-through retries so each distinct fix is applied at most once, guaranteeing the
-retry loop always terminates.
-"""
-
-from __future__ import annotations
-
-import json
-import re
-from collections.abc import Callable, Sequence
-from dataclasses import dataclass
-
-from fastapi.responses import Response
-
-from ..core import get_logger
-
-logger = get_logger(__name__)
-
-
-# Matches upstream error text that names a single rejected request parameter,
-# e.g. "`temperature` is deprecated for this model." or
-# "parameter 'top_p' is not supported". Keys off the upstream's own wording so
-# a 400 about an unsupported sampling/option field can be recovered by stripping
-# that field and retrying the same upstream.
-_UNSUPPORTED_PARAM_RE = re.compile(
-    r"[`'\"]?(?P<param>[a-zA-Z_][a-zA-Z0-9_]*)[`'\"]?\s+is\s+"
-    r"(?:deprecated|not\s+supported|unsupported|no\s+longer\s+supported)",
-    re.IGNORECASE,
-)
-
-
-# A corrector inspects the parsed request body and the upstream error message
-# and returns ``(new_body_dict, label)`` for a fix it can apply, or ``None`` to
-# decline. ``label`` identifies the fix so it is applied at most once per request.
-Corrector = Callable[[dict, str], "tuple[dict, str] | None"]
-
-
-@dataclass(frozen=True)
-class Correction:
-    """A successful request correction ready to retry.
-
-    ``body`` is the corrected JSON body (encoded), ``label`` identifies the fix
-    that was applied (e.g. the stripped param name) so the caller can guard
-    against applying the same fix twice.
-    """
-
-    body: bytes
-    label: str
-
-
-def extract_error_message(response: Response) -> str:
-    """Best-effort extraction of an error message string from a proxy Response."""
-    body_bytes = getattr(response, "body", None)
-    if not body_bytes:
-        return ""
-    try:
-        data = json.loads(body_bytes)
-    except Exception:
-        return body_bytes.decode("utf-8", errors="ignore")[:500]
-    if isinstance(data, dict):
-        err = data.get("error")
-        if isinstance(err, dict):
-            msg = err.get("message") or err.get("detail")
-            if isinstance(msg, str):
-                return msg
-        elif isinstance(err, str):
-            return err
-        if isinstance(data.get("message"), str):
-            return data["message"]
-    return ""
-
-
-def strip_unsupported_param(
-    body: dict, error_message: str
-) -> tuple[dict, str] | None:
-    """Drop a top-level param the upstream named as unsupported/deprecated.
-
-    Returns ``(new_body, param)`` (a new dict, original untouched) when the
-    error names a top-level param present in the body, otherwise ``None``.
-    """
-    match = _UNSUPPORTED_PARAM_RE.search(error_message)
-    if not match:
-        return None
-    param = match.group("param")
-    if param not in body:
-        return None
-    new_body = {k: v for k, v in body.items() if k != param}
-    return new_body, param
-
-
-# Ordered pipeline of correctors tried on each recoverable rejection.
-DEFAULT_CORRECTORS: tuple[Corrector, ...] = (strip_unsupported_param,)
-
-
-def correct_request(
-    request_body: bytes,
-    error_message: str,
-    applied: set[str],
-    correctors: Sequence[Corrector] = DEFAULT_CORRECTORS,
-) -> Correction | None:
-    """Try to correct a rejected request body so it can be retried.
-
-    Runs each corrector in order against the parsed body and ``error_message``.
-    The first corrector that proposes a fix whose ``label`` is not already in
-    ``applied`` wins; its result is returned as a :class:`Correction`. Returns
-    ``None`` when nothing parses, nothing matches, or every proposed fix was
-    already applied — the caller then treats the response as a normal failure.
-
-    ``applied`` is read-only here; the caller records the returned ``label`` to
-    bound retries and guarantee forward progress.
-    """
-    if not request_body or not error_message:
-        return None
-    try:
-        data = json.loads(request_body)
-    except Exception:
-        return None
-    if not isinstance(data, dict):
-        return None
-    for corrector in correctors:
-        result = corrector(data, error_message)
-        if result is None:
-            continue
-        new_body, label = result
-        if label in applied:
-            continue
-        return Correction(body=json.dumps(new_body).encode(), label=label)
-    return None

routstr/upstream/routstr.py

@@ -1,180 +0,0 @@
-from typing import TYPE_CHECKING, Any
-
-import httpx
-
-from ..core import get_logger
-from ..payment.models import Model
-from .base import BaseUpstreamProvider
-
-if TYPE_CHECKING:
-    from ..core.db import UpstreamProviderRow
-
-logger = get_logger(__name__)
-
-
-class RoutstrUpstreamProvider(BaseUpstreamProvider):
-    """Upstream provider for communicating with another Routstr instance."""
-
-    provider_type = "routstr"
-    default_base_url = None
-    platform_url = None
-    # Upstream Routstr nodes serve `/v1/messages` natively, so forward the
-    # request as-is instead of round-tripping through litellm's
-    # Anthropic→OpenAI translator.
-    supports_anthropic_messages = True
-
-    def __init__(
-        self,
-        base_url: str,
-        api_key: str,
-        provider_fee: float = 1.01,
-        provider_settings: dict | None = None,
-    ):
-        """Initialize Routstr provider.
-
-        Args:
-            base_url: Base URL of the upstream Routstr instance
-            api_key: API key for the upstream Routstr instance
-            provider_fee: Provider fee multiplier
-            provider_settings: Provider-specific settings (auto-topup, etc.)
-        """
-        # Ensure base_url doesn't end with /v1 as BaseUpstreamProvider appends it if needed
-        # but Routstr paths are usually absolute from base.
-        super().__init__(
-            base_url=base_url.rstrip("/"),
-            api_key=api_key,
-            provider_fee=provider_fee,
-        )
-        self.settings = provider_settings or {}
-
-    def normalize_request_path(
-        self, path: str, model_obj: "Model | None" = None
-    ) -> str:
-        """Preserve the ``v1/`` prefix when forwarding to an upstream Routstr.
-        """
-        return path.lstrip("/")
-
-    @classmethod
-    def _build_from_row(
-        cls, provider_row: "UpstreamProviderRow"
-    ) -> "RoutstrUpstreamProvider":
-        import json
-
-        settings = {}
-        if provider_row.provider_settings:
-            try:
-                settings = json.loads(provider_row.provider_settings)
-            except Exception:
-                pass
-
-        return cls(
-            base_url=provider_row.base_url,
-            api_key=provider_row.api_key,
-            provider_fee=provider_row.provider_fee,
-            provider_settings=settings,
-        )
-
-    @classmethod
-    def get_provider_metadata(cls) -> dict[str, object]:
-        return {
-            "id": cls.provider_type,
-            "name": "Routstr Node",
-            "default_base_url": "",
-            "fixed_base_url": False,
-            "platform_url": cls.platform_url,
-            "can_create_account": False,
-            "can_topup": True,
-            "can_show_balance": True,
-        }
-
-    async def get_balance(self) -> float | None:
-        """Fetch balance from the upstream Routstr node.
-
-        Returns:
-            Balance in satoshis, or None if failed
-        """
-        url = f"{self.base_url}/v1/balance/info"
-        headers = {"Authorization": f"Bearer {self.api_key}"} if self.api_key else {}
-
-        async with httpx.AsyncClient() as client:
-            try:
-                response = await client.get(url, headers=headers, timeout=10.0)
-                response.raise_for_status()
-                data = response.json()
-                # Routstr balance info usually contains 'balance' in msats or sats
-                # Check for msats and convert to sats
-                if "balance_msats" in data:
-                    return float(data["balance_msats"]) / 1000.0
-                return float(data.get("balance", 0))
-            except Exception as e:
-                logger.error(
-                    "Failed to fetch balance from upstream Routstr",
-                    extra={"url": url, "error": str(e)},
-                )
-                return None
-
-    async def topup(self, cashu_token: str) -> dict[str, Any]:
-        """Top up balance on the upstream Routstr node.
-
-        Args:
-            cashu_token: Cashu token to deposit
-
-        Returns:
-            Dict containing top-up result
-        """
-        url = f"{self.base_url}/v1/balance/topup"
-        headers = {"Authorization": f"Bearer {self.api_key}"}
-        payload = {"cashu_token": cashu_token}
-
-        async with httpx.AsyncClient() as client:
-            try:
-                response = await client.post(
-                    url, headers=headers, json=payload, timeout=30.0
-                )
-                response.raise_for_status()
-                return response.json()
-            except Exception as e:
-                logger.error(
-                    "Failed to topup upstream Routstr",
-                    extra={"url": url, "error": str(e)},
-                )
-                return {"error": str(e)}
-
-    async def fetch_models(self) -> list[Model]:
-        """Fetch models from the upstream Routstr node."""
-        url = f"{self.base_url}/v1/models"
-
-        async with httpx.AsyncClient() as client:
-            try:
-                response = await client.get(url, headers={}, timeout=15.0)
-                response.raise_for_status()
-                data = response.json()
-                models = data.get("data", [])
-                return [Model(**m) for m in models]
-            except Exception as e:
-                logger.error(
-                    "Failed to fetch models from upstream Routstr",
-                    extra={"url": url, "error": str(e)},
-                )
-                return []
-
-    async def refund_balance(self) -> dict[str, Any]:
-        """Request a refund from the upstream Routstr node.
-
-        Returns:
-            Dict containing refund result and token
-        """
-        url = f"{self.base_url}/v1/balance/refund"
-        headers = {"Authorization": f"Bearer {self.api_key}"}
-
-        async with httpx.AsyncClient() as client:
-            try:
-                response = await client.post(url, headers=headers, timeout=30.0)
-                response.raise_for_status()
-                return response.json()
-            except Exception as e:
-                logger.error(
-                    "Failed to request refund from upstream Routstr",
-                    extra={"url": url, "error": str(e)},
-                )
-                return {"error": str(e)}

routstr/upstream/tinfoil.py

@@ -1,236 +0,0 @@
-from __future__ import annotations
-
-from typing import TYPE_CHECKING
-
-import httpx
-from fastapi import Request
-from fastapi.responses import Response, StreamingResponse
-from pydantic.v1 import BaseModel
-
-from ..core.exceptions import UpstreamError
-from ..core.logging import get_logger
-from ..payment.models import Architecture, Model, Pricing
-from .base import BaseUpstreamProvider
-from .ehbp import (
-    _ENCLAVE_URL_HEADER,
-    _PROXY_ONLY_HEADERS,
-    _RESPONSE_USAGE_HEADER,
-    ConfidentialInferenceProfile,
-    EHBPForwardingTarget,
-)
-
-if TYPE_CHECKING:
-    from ..core.db import UpstreamProviderRow
-
-logger = get_logger(__name__)
-
-
-class TinfoilModelPricing(BaseModel):
-    inputTokenPricePer1M: float = 0.0
-    outputTokenPricePer1M: float = 0.0
-    requestPrice: float = 0.0
-
-
-class TinfoilModel(BaseModel):
-    id: str
-    context_window: int = 0
-    created: int = 0
-    multimodal: bool = False
-    reasoning: bool = False
-    tool_calling: bool = False
-    type: str = "chat"
-    pricing: TinfoilModelPricing = TinfoilModelPricing()
-    endpoints: list[str] = []
-
-
-class TinfoilUpstreamProvider(BaseUpstreamProvider):
-    """Direct upstream provider for the Tinfoil inference API.
-
-    Tinfoil hosts open-source models inside attested secure enclaves and exposes
-    an OpenAI-compatible API at ``https://inference.tinfoil.sh``. Request and
-    response bodies are encrypted end-to-end with EHBP (HPKE), so Routstr acts
-    as a blind relay: it forwards the opaque encrypted body, never sees
-    plaintext, and bills from the ``X-Tinfoil-Usage-Metrics`` header that
-    Tinfoil returns outside the encrypted body when
-    ``X-Tinfoil-Request-Usage-Metrics: true`` is set.
-    """
-
-    provider_type = "tinfoil"
-    default_base_url = "https://inference.tinfoil.sh"
-    platform_url = "https://docs.tinfoil.sh"
-    supports_ehbp = True
-    confidential_inference_profile = ConfidentialInferenceProfile(
-        usage_response_header=_RESPONSE_USAGE_HEADER,
-        client_target_url_header=_ENCLAVE_URL_HEADER,
-        allow_client_target_override=True,
-        proxy_only_headers=_PROXY_ONLY_HEADERS,
-    )
-
-    def __init__(self, api_key: str, provider_fee: float = 1.0):
-        super().__init__(
-            base_url=self.default_base_url,
-            api_key=api_key,
-            provider_fee=provider_fee,
-        )
-
-    @classmethod
-    def _build_from_row(
-        cls, provider_row: "UpstreamProviderRow"
-    ) -> "TinfoilUpstreamProvider":
-        return cls(
-            api_key=provider_row.api_key,
-            provider_fee=provider_row.provider_fee,
-        )
-
-    @classmethod
-    def get_provider_metadata(cls) -> dict[str, object]:
-        return {
-            "id": cls.provider_type,
-            "name": "Tinfoil",
-            "default_base_url": cls.default_base_url,
-            "fixed_base_url": True,
-            "platform_url": cls.platform_url,
-            "can_create_account": False,
-            "can_topup": False,
-            "can_show_balance": False,
-        }
-
-    def transform_model_name(self, model_id: str) -> str:
-        return model_id.removeprefix("tinfoil/")
-
-    def get_confidential_inference_profile(self) -> ConfidentialInferenceProfile:
-        return self.confidential_inference_profile
-
-    async def forward_get_request(
-        self,
-        request: Request,
-        path: str,
-        headers: dict,
-    ) -> Response | StreamingResponse:
-        """Handle Tinfoil-specific GET endpoints.
-
-        * ``/attestation`` (or ``/tee/attestation``): proxy to the Tinfoil ATC
-          (attestation bundle proxy) at ``https://atc.tinfoil.sh/attestation``.
-        * Other GETs: forward to the provider base URL
-          (``https://inference.tinfoil.sh``). ``X-Tinfoil-Enclave-Url`` is an
-          EHBP-only header used for encrypted POST requests and is not honored
-          for unencrypted GET requests.
-        """
-        clean_path = path.removeprefix("tee/").rstrip("/")
-        if clean_path == "attestation":
-            return await self._proxy_attestation(headers)
-        return await super().forward_get_request(request, path, headers)
-
-    async def _proxy_attestation(self, headers: dict) -> Response:
-        url = "https://atc.tinfoil.sh/attestation"
-        async with httpx.AsyncClient(
-            transport=httpx.AsyncHTTPTransport(retries=1),
-            timeout=30.0,
-        ) as client:
-            try:
-                resp = await client.get(
-                    url,
-                    headers={
-                        "Accept": headers.get("accept", "application/json"),
-                    },
-                )
-                response_headers = dict(resp.headers)
-                response_headers.pop("content-encoding", None)
-                response_headers.pop("content-length", None)
-                return Response(
-                    content=resp.content,
-                    status_code=resp.status_code,
-                    headers=response_headers,
-                )
-            except Exception as exc:
-                raise UpstreamError(
-                    f"Error fetching Tinfoil attestation: {type(exc).__name__}",
-                    status_code=502,
-                ) from exc
-
-    def get_ehbp_forwarding_target(
-        self, path: str, model_obj: Model
-    ) -> EHBPForwardingTarget:
-        """Return the Tinfoil enclave target for EHBP requests.
-
-        Requests usage metrics from the enclave so Routstr can bill exactly
-        without decrypting the response body. The actual forwarding URL is
-        overridden at dispatch time by ``X-Tinfoil-Enclave-Url`` when the SDK
-        sends it (see ``routstr/upstream/ehbp.py``).
-        """
-        return EHBPForwardingTarget(
-            url=f"{self.base_url.rstrip('/')}/{path.lstrip('/')}",
-            headers={"X-Tinfoil-Request-Usage-Metrics": "true"},
-            profile=self.confidential_inference_profile,
-        )
-
-    async def fetch_models(self) -> list[Model]:
-        """Fetch models from the public Tinfoil models endpoint.
-
-        ``GET /v1/models`` is unauthenticated and returns all available models
-        with their pricing in USD per 1M tokens.
-        """
-        url = f"{self.base_url}/v1/models"
-        try:
-            async with httpx.AsyncClient(timeout=30.0) as client:
-                response = await client.get(url)
-                response.raise_for_status()
-                data = response.json()
-                models_data = data.get("data", [])
-
-                models: list[Model] = []
-                for model_data in models_data:
-                    try:
-                        tf = TinfoilModel.parse_obj(model_data)
-                        input_price = tf.pricing.inputTokenPricePer1M
-                        output_price = tf.pricing.outputTokenPricePer1M
-                        request_price = tf.pricing.requestPrice
-
-                        modality = "text->text"
-                        input_modalities = ["text"]
-                        output_modalities = ["text"]
-                        if tf.multimodal:
-                            modality = "text->text+image"
-                            input_modalities = ["text", "image"]
-
-                        models.append(
-                            Model(
-                                id=tf.id,
-                                name=tf.id,
-                                created=tf.created,
-                                description=f"Tinfoil {tf.type} model",
-                                context_length=tf.context_window,
-                                architecture=Architecture(
-                                    modality=modality,
-                                    input_modalities=input_modalities,
-                                    output_modalities=output_modalities,
-                                    tokenizer="Unknown",
-                                    instruct_type=None,
-                                ),
-                                pricing=Pricing(
-                                    prompt=input_price / 1_000_000,
-                                    completion=output_price / 1_000_000,
-                                    request=request_price,
-                                    image=0.0,
-                                    web_search=0.0,
-                                    internal_reasoning=0.0,
-                                ),
-                            )
-                        )
-                    except Exception as e:
-                        logger.warning(
-                            "Failed to parse Tinfoil model",
-                            extra={
-                                "model_id": model_data.get("id", "unknown"),
-                                "error": str(e),
-                                "error_type": type(e).__name__,
-                            },
-                        )
-
-                return models
-        except Exception as e:
-            logger.error(
-                "Error fetching models from Tinfoil",
-                extra={"error": str(e), "error_type": type(e).__name__},
-            )
-            return []

routstr/upstream/tinfoil_trailer.py

@@ -1,189 +0,0 @@
-"""h11-based HTTP client for EHBP requests that captures HTTP trailers.
-
-httpx/httpcore silently discard HTTP trailers during chunked transfer
-decoding. Tinfoil returns ``X-Tinfoil-Usage-Metrics`` as a trailer on
-streaming responses, so we need a lower-level HTTP client that preserves
-trailers from the h11 ``EndOfMessage`` event.
-
-Because EHBP response bodies are opaque encrypted blobs, buffering the full
-response is acceptable — the client decrypts the complete body regardless of
-whether it arrived streamed or buffered.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import ssl
-from dataclasses import dataclass, field
-from urllib.parse import urlsplit
-
-import h11
-
-from ..core import get_logger
-
-logger = get_logger(__name__)
-
-_READ_BUFSIZE = 65536
-_DEFAULT_TIMEOUT_SECONDS = 30.0
-_DEFAULT_CLOSE_TIMEOUT_SECONDS = 1.0
-_DEFAULT_MAX_RESPONSE_BYTES = 25 * 1024 * 1024
-_HOP_BY_HOP_HEADERS = {
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-}
-
-
-@dataclass
-class TrailerResponse:
-    """Buffered HTTP response with optional trailer headers."""
-
-    status_code: int
-    headers: list[tuple[str, str]]
-    body: bytes
-    trailers: list[tuple[str, str]] = field(default_factory=list)
-
-
-def _get_header(headers: list[tuple[str, str]], name: str) -> str | None:
-    name_lower = name.lower()
-    for k, v in headers:
-        if k.lower() == name_lower:
-            return v
-    return None
-
-
-def _strip_hop_by_hop_headers(headers: dict[str, str]) -> dict[str, str]:
-    """Remove connection-specific headers before serializing a new request."""
-    connection_tokens: set[str] = set()
-    for key, value in headers.items():
-        if key.lower() == "connection":
-            connection_tokens.update(
-                token.strip().lower() for token in value.split(",") if token.strip()
-            )
-
-    excluded = _HOP_BY_HOP_HEADERS | connection_tokens
-    return {key: value for key, value in headers.items() if key.lower() not in excluded}
-
-
-async def forward_with_trailer(
-    *,
-    method: str,
-    url: str,
-    headers: dict[str, str],
-    body: bytes,
-    timeout_seconds: float = _DEFAULT_TIMEOUT_SECONDS,
-    max_response_bytes: int = _DEFAULT_MAX_RESPONSE_BYTES,
-    close_timeout_seconds: float = _DEFAULT_CLOSE_TIMEOUT_SECONDS,
-) -> TrailerResponse:
-    """Send an HTTP/1.1 request via h11 and capture HTTP trailers.
-
-    Returns a :class:`TrailerResponse` with the full buffered body and any
-    trailer headers from the ``EndOfMessage`` event.
-    """
-    parsed = urlsplit(url)
-    host = parsed.hostname
-    if not host:
-        raise ValueError(f"Invalid URL (no hostname): {url}")
-    port = parsed.port or 443
-    path = parsed.path or "/"
-    if parsed.query:
-        path = f"{path}?{parsed.query}"
-
-    # FastAPI has already decoded the incoming request body. Do not carry the
-    # original connection's framing or other hop-by-hop metadata into the new
-    # upstream connection.
-    headers = _strip_hop_by_hop_headers(headers)
-
-    ssl_ctx = ssl.create_default_context()
-    reader, writer = await asyncio.wait_for(
-        asyncio.open_connection(host, port, ssl=ssl_ctx),
-        timeout=timeout_seconds,
-    )
-
-    try:
-        # Build HTTP/1.1 request
-        header_lines = [f"{method} {path} HTTP/1.1"]
-        has_host = any(k.lower() == "host" for k in headers)
-        if not has_host:
-            header_lines.append(f"Host: {host}")
-        header_lines.append("Connection: close")
-
-        for key, value in headers.items():
-            if key.lower() == "host":
-                continue
-            header_lines.append(f"{key}: {value}")
-
-        if body and not any(k.lower() == "content-length" for k in headers):
-            header_lines.append(f"Content-Length: {len(body)}")
-
-        request_data = "\r\n".join(header_lines).encode() + b"\r\n\r\n"
-        if body:
-            request_data += body
-
-        writer.write(request_data)
-        await asyncio.wait_for(writer.drain(), timeout=timeout_seconds)
-
-        # Parse response with h11
-        conn = h11.Connection(h11.CLIENT)
-        status_code = 0
-        resp_headers: list[tuple[str, str]] = []
-        body_chunks: list[bytes] = []
-        body_size = 0
-        trailers: list[tuple[str, str]] = []
-
-        while True:
-            event = conn.next_event()
-
-            if event is h11.NEED_DATA:
-                data = await asyncio.wait_for(
-                    reader.read(_READ_BUFSIZE),
-                    timeout=timeout_seconds,
-                )
-                conn.receive_data(data if data else b"")
-                continue
-
-            if isinstance(event, h11.Response):
-                status_code = event.status_code
-                resp_headers = [(k.decode(), v.decode()) for k, v in event.headers]
-
-            elif isinstance(event, h11.Data):
-                body_size += len(event.data)
-                if body_size > max_response_bytes:
-                    raise ValueError(
-                        f"EHBP response exceeded {max_response_bytes} bytes"
-                    )
-                body_chunks.append(event.data)
-
-            elif isinstance(event, h11.EndOfMessage):
-                for k, v in event.headers:
-                    trailers.append((k.decode(), v.decode()))
-                break
-
-            elif isinstance(event, h11.PAUSED):
-                # Shouldn't happen for simple request/response, but break safely
-                logger.warning("h11 PAUSED event during EHBP response parsing")
-                break
-
-            elif isinstance(event, h11.ConnectionClosed):
-                break
-
-        return TrailerResponse(
-            status_code=status_code,
-            headers=resp_headers,
-            body=b"".join(body_chunks),
-            trailers=trailers,
-        )
-    finally:
-        writer.close()
-        if close_timeout_seconds > 0:
-            try:
-                await asyncio.wait_for(
-                    writer.wait_closed(), timeout=close_timeout_seconds
-                )
-            except Exception:
-                pass