Crate forge_gateway 

forge-gateway - the account pool: one backend per forge.toml provider token, plus account selection, health, probe scheduling, backoff, and the inference listener spawned sessions route through.

Each ProviderBackend owns credential resolution, the probe request and its payload mapping, the billing shape, and what repair a failed probe allows for one provider. The ProviderHost port, implemented by forge-agent, is the only process plumbing a backend may reach, so this crate stays HTTP + mapping and is testable offline.

AccountStateMap holds each account’s health, usage snapshot and probe schedule; Gateway::select_for is the one place the account serving a session’s model is decided.

Re-exports

pub use crate::account::AccountKey;

pub use crate::account::AccountState;

pub use crate::account::AccountStateMap;

pub use crate::account::LoadingState;

pub use crate::account::Unusable;

pub use crate::account::UsageFetchStatus;

pub use crate::anthropic::Anthropic;

pub use crate::anthropic::CLAUDE_CODE_OAUTH_TOKEN_ENV;

pub use crate::anthropic::token_bearer;

pub use crate::codex::Codex;

pub use crate::forward::Gateway;

pub use crate::forward::SelectFailure;

pub use crate::openrouter::Openrouter;

pub use crate::pool::AccountPool;

pub use crate::zai::Zai;

pub(crate) use std::collections::HashMap; 🔒

pub(crate) use std::time::Duration; 🔒

pub(crate) use async_trait::async_trait; 🔒

Modules

account

Account state, health and probe scheduling.

anthropic 🔒

The Anthropic backend. The account’s credential is its setup token, which probes a minimal billed /v1/messages call - the usage endpoint refuses setup tokens, while a /v1/messages response carries the anthropic-ratelimit-unified-* windows as headers, a 429 most of all. An account with no token has no credential at all.

binding

Session registration: the binding of (org, project, session) to an account, and the env set a child is stamped with.

codex 🔒

The Codex backend: a base-url proxy serving Anthropic’s windowed /api/oauth/usage shape, authenticated by the account’s flat base_url + token pair stamped onto ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN. The response always maps leniently - a proxy emits each window on its own and {} is the cold steady state, not a malformed response.

forward

The route handler: hello probe, path parsing, splice, re-header, and the streaming forward.

helpers

Composable pieces the backends build probes and snapshots from: the windowed /api/oauth/usage round-trip, the payload-to-window mappers, and the timestamp parsing the snapshot mappers share.

listener

The gateway’s inference listener: loopback only, one fixed port.

openrouter 🔒

The OpenRouter backend: the per-key spend probe against {base}/v1/key with the account credit pool from {base}/v1/credits alongside it. The configured base url already ends in /api (that is what the chat API wants), so only the /v1/... tails are appended; appending the documented site-relative paths yields /api/api/..., which 404s.

pool

The account pool: the account state map behind one handle.

rotation

Rotation state: which accounts are exhausted, when their cooldowns end, and how many 429s are on the streak.

selection

Account selection: which account serves a session the gateway has no binding for.

splice

The byte-level model splice.

zai 🔒

The Zai backend: the GLM coding plan’s monitor probe against {host_root}/api/monitor/usage/quota/limit, authenticated by the account’s flat token stamped onto ANTHROPIC_AUTH_TOKEN (no Bearer prefix). The configured base url carries the /api/anthropic chat prefix, so the monitor URL derives from the scheme+host alone. Every Z.ai monitor endpoint answers HTTP 200 regardless of outcome - a wrong key and a wrong path share the status with a healthy response - so the verdict lives inside the {success, code, msg} envelope.

Structs

AccountEnv

Everything a backend may read about one account. env is the merged global [env] + [accounts.env] block; the merge happens in forge-workspace config load and stays there.

UsageSnapshot

Snapshot of the user’s Anthropic plan utilization at a point in time. Composed by the forge-gateway backends and rendered by a view.

Enums

AccountBudget

What an account has left, in the terms its backend bills in.

BillingModel

Billing shape: plan windows that reset (a percentage of an allowance) or per-key spend over a period.

OauthUsageError

Failure modes for the OAuth usage fetcher.

ProbeError

Why a probe did not produce a snapshot: a credential miss, a wire error class from the round-trip, or a 200 whose body maps to nothing.

Provider

Which backend an account talks to, declared per [[accounts]] in forge.toml. This is the single source of truth for how the account is probed and how its usage renders; nothing infers either from ANTHROPIC_BASE_URL, which answers where the credential lives rather than what the backend bills for.

RepairAction

What a backend allows after one of its probes failed, decided by ProviderBackend::repair. The boot loader executes the verdict against its state machine.

UsageSourceKind

Origin of a UsageSnapshot, and with it which half of the snapshot carries data: Oauth and ZaiMonitor fill the windows, OpenRouterKey fills UsageSnapshot::spend.

Statics

ANTHROPIC 🔒

BACKENDS 🔒

CODEX 🔒

OPENROUTER 🔒

ZAI 🔒

Traits

ProviderBackend

One backend per forge.toml provider token. The impls are stateless unit structs; per-account state arrives through AccountEnv, never through self.

ProviderHost

The host port, implemented by forge-agent. The only process plumbing a backend may reach, so the crate stays HTTP + mapping and is testable offline.

Functions

all

Every registered backend.

backend

The backend registered for token. Every Provider variant resolves; the Option keeps the trait open for a token whose backend is not worth a probe.

warn_unusable_snapshot 🔒

A cached snapshot that cannot be used under this backend.