@atomic-chat/core 0.5.1

package/dist/server/http.js

@@ -0,0 +1,220 @@
+/**
+ * The little bit of HTTP the core needs: a path router, JSON body reading with a cap, the shared
+ * error envelope `{error:{code,message,details?}}` that the app already parses, and the loopback
+ * checks the control listener relies on (PLAN.md §3.6).
+ *
+ * Deliberately not a framework: the control surface is a dozen routes, and a dependency here would
+ * have to be audited for the signed binary.
+ */
+import { AtomicCoreError } from '../contracts/index.js';
+export const MAX_JSON_BODY_BYTES = 8 * 1024 * 1024;
+export class Router {
+    routes = [];
+    add(method, pattern, handler) {
+        this.routes.push({ method, pattern, handler, segments: splitPath(pattern) });
+        return this;
+    }
+    get(pattern, handler) {
+        return this.add('GET', pattern, handler);
+    }
+    post(pattern, handler) {
+        return this.add('POST', pattern, handler);
+    }
+    put(pattern, handler) {
+        return this.add('PUT', pattern, handler);
+    }
+    patch(pattern, handler) {
+        return this.add('PATCH', pattern, handler);
+    }
+    delete(pattern, handler) {
+        return this.add('DELETE', pattern, handler);
+    }
+    /** The matching route, or `undefined`; `methodMismatch` distinguishes 404 from 405. */
+    find(method, path) {
+        const segments = splitPath(path);
+        let methodMismatch = false;
+        for (const route of this.routes) {
+            const params = matchSegments(route.segments, segments);
+            if (!params)
+                continue;
+            if (route.method !== method) {
+                methodMismatch = true;
+                continue;
+            }
+            return { route, match: { params } };
+        }
+        return methodMismatch ? { methodMismatch: true } : undefined;
+    }
+}
+function splitPath(path) {
+    return path.split('/').filter((s) => s.length > 0);
+}
+function matchSegments(pattern, actual) {
+    const params = {};
+    let p = 0;
+    let a = 0;
+    while (p < pattern.length) {
+        const seg = pattern[p];
+        if (seg.startsWith('*')) {
+            // Greedy rest-parameter, leaving room for the fixed segments that follow it.
+            const remainingFixed = pattern.length - p - 1;
+            const take = actual.length - a - remainingFixed;
+            if (take < 1)
+                return undefined;
+            params[seg.slice(1)] = actual.slice(a, a + take).join('/');
+            a += take;
+            p++;
+            continue;
+        }
+        if (a >= actual.length)
+            return undefined;
+        const value = actual[a];
+        if (seg.startsWith(':'))
+            params[seg.slice(1)] = decodeURIComponent(value);
+        else if (seg !== value)
+            return undefined;
+        p++;
+        a++;
+    }
+    return a === actual.length ? params : undefined;
+}
+export function sendJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        'content-length': Buffer.byteLength(payload),
+        'cache-control': 'no-store',
+    });
+    res.end(payload);
+}
+/** HTTP status for a core error code. Anything unmapped is a 500: an unknown failure is not the caller's fault. */
+export function statusForCode(code) {
+    switch (code) {
+        case 'UNAUTHORIZED':
+        case 'AUTH_REQUIRED':
+            return 401;
+        case 'FORBIDDEN_HOST':
+            return 403;
+        case 'MODEL_NOT_FOUND':
+        case 'MODEL_FILE_NOT_FOUND':
+        case 'PROVIDER_NOT_FOUND':
+        case 'MODEL_NOT_LOADED':
+        case 'NO_MODEL_LOADED':
+        case 'JOB_NOT_FOUND':
+        case 'ENGINE_MISSING':
+        case 'MODEL_MISSING':
+        case 'SIDE_FILE_MISSING':
+            return 404;
+        case 'CORE_ALREADY_RUNNING':
+        case 'AUTH_CANCELLED':
+        case 'MODEL_LOAD_CANCELLED':
+        case 'REMOTE_ACCESS_SERVER_STOPPED':
+        case 'REMOTE_ACCESS_OPERATION_IN_PROGRESS':
+        case 'REMOTE_ACCESS_STOP_FAILED':
+        case 'JOB_BUSY':
+        case 'BACKEND_IN_USE':
+        case 'NOT_CONFIGURED':
+        case 'CANCELLED':
+        case 'ENGINE_UPDATE_REQUIRED':
+            return 409;
+        case 'QUEUE_FULL':
+            return 429;
+        case 'DISK_FULL':
+            return 507;
+        case 'AUTH_FAILED':
+        case 'UPSTREAM_ERROR':
+            return 502;
+        case 'INVALID_ARGUMENT':
+        case 'INVALID_REQUEST':
+        case 'INVALID_DIMENSIONS':
+        case 'UNSUPPORTED_WORKFLOW':
+        case 'UNSUPPORTED_BACKEND':
+        case 'MODEL_INCOMPATIBLE':
+            return 400;
+        case 'CORE_NOT_RUNNING':
+        case 'FOUNDATION_MODELS_UNAVAILABLE':
+            return 503;
+        case 'MODEL_LOAD_TIMED_OUT':
+        case 'SERVER_START_TIMED_OUT':
+            return 504;
+        default:
+            return 500;
+    }
+}
+export function toCoreError(error) {
+    if (error instanceof AtomicCoreError)
+        return error;
+    const e = error;
+    const code = typeof e?.code === 'string' ? e.code : 'INTERNAL_ERROR';
+    return new AtomicCoreError(code, typeof e?.message === 'string' ? e.message : String(error));
+}
+export function sendError(res, error, status) {
+    const coreError = toCoreError(error);
+    sendJson(res, status ?? statusForCode(coreError.code), { error: coreError.toJSON() });
+}
+/**
+ * Past the limit the rest of the body is read and discarded, up to this many times the limit, before
+ * the refusal is written: Bun's `node:http` (1.3.10) delivers an answer written while the request
+ * body is still arriving as an empty 200, Node delivers the refusal either way (ADR
+ * 2026-09-22-detect-a-client-that-hangs-up-before-the-answer-under-bun). Beyond the ceiling the
+ * connection is dropped instead of read on.
+ */
+export const OVERSIZE_DRAIN_FACTOR = 8;
+export async function readJsonBody(req, limit = MAX_JSON_BODY_BYTES) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        size += buf.length;
+        if (size > limit) {
+            if (size > limit * OVERSIZE_DRAIN_FACTOR) {
+                req.destroy();
+                break;
+            }
+            chunks.length = 0;
+            continue;
+        }
+        chunks.push(buf);
+    }
+    if (size > limit)
+        throw new AtomicCoreError('INVALID_ARGUMENT', 'Request body is too large.', `> ${limit} bytes`);
+    if (size === 0)
+        return {};
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch (e) {
+        throw new AtomicCoreError('INVALID_ARGUMENT', 'Request body is not valid JSON.', e.message);
+    }
+}
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '0:0:0:0:0:0:0:1']);
+/** Peer address check: the control listener answers only to processes on this machine. */
+export function isLoopbackAddress(address) {
+    if (!address)
+        return false;
+    const clean = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address;
+    return clean === '127.0.0.1' || clean.startsWith('127.') || clean === '::1' || clean === '0:0:0:0:0:0:0:1';
+}
+/**
+ * Host-header check, which is what stops a browser page from posting to the control port through
+ * DNS rebinding: the name must itself be loopback, not merely resolve to it today.
+ */
+export function hostHeaderIsLoopback(host) {
+    if (!host)
+        return false;
+    const value = host.trim().toLowerCase();
+    const hostname = value.startsWith('[') ? value.slice(1, value.indexOf(']')) : (value.split(':')[0] ?? '');
+    return LOOPBACK_HOSTNAMES.has(hostname);
+}
+/** `?name=value` for a request path. */
+export function queryOf(req) {
+    const raw = req.url ?? '/';
+    const q = raw.indexOf('?');
+    return new URLSearchParams(q >= 0 ? raw.slice(q + 1) : '');
+}
+export function pathOf(req) {
+    const raw = req.url ?? '/';
+    const q = raw.indexOf('?');
+    return q >= 0 ? raw.slice(0, q) : raw;
+}
+//# sourceMappingURL=http.js.map

package/dist/server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAmBlD,MAAM,OAAO,MAAM;IACA,MAAM,GAAoB,EAAE,CAAA;IAE7C,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,OAAgB;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAgB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,OAAgB;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAgB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,OAAgB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,OAAe,EAAE,OAAgB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,uFAAuF;IACvF,IAAI,CACF,MAAc,EACd,IAAY;QAEZ,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,cAAc,GAAG,KAAK,CAAA;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YACtD,IAAI,CAAC,MAAM;gBAAE,SAAQ;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,cAAc,GAAG,IAAI,CAAA;gBACrB,SAAQ;YACV,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAA;QACrC,CAAC;QACD,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,OAAiB,EAAE,MAAgB;IACxD,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAW,CAAA;QAChC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,6EAA6E;YAC7E,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CAAA;YAC/C,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC9B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1D,CAAC,IAAI,IAAI,CAAA;YACT,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAA;QACjC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;aACpE,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,SAAS,CAAA;QACxC,CAAC,EAAE,CAAA;QACH,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACpC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5C,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAClB,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,GAAG,CAAA;QACZ,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAA;QACZ,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB,CAAC;QAC1B,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,eAAe,CAAC;QACrB,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe,CAAC;QACrB,KAAK,mBAAmB;YACtB,OAAO,GAAG,CAAA;QACZ,KAAK,sBAAsB,CAAC;QAC5B,KAAK,gBAAgB,CAAC;QACtB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,8BAA8B,CAAC;QACpC,KAAK,qCAAqC,CAAC;QAC3C,KAAK,2BAA2B,CAAC;QACjC,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC;QACtB,KAAK,WAAW,CAAC;QACjB,KAAK,wBAAwB;YAC3B,OAAO,GAAG,CAAA;QACZ,KAAK,YAAY;YACf,OAAO,GAAG,CAAA;QACZ,KAAK,WAAW;YACd,OAAO,GAAG,CAAA;QACZ,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAA;QACZ,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,qBAAqB,CAAC;QAC3B,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAA;QACZ,KAAK,kBAAkB,CAAC;QACxB,KAAK,+BAA+B;YAClC,OAAO,GAAG,CAAA;QACZ,KAAK,sBAAsB,CAAC;QAC5B,KAAK,wBAAwB;YAC3B,OAAO,GAAG,CAAA;QACZ;YACE,OAAO,GAAG,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAA;IAClD,MAAM,CAAC,GAAG,KAA8C,CAAA;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACnF,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,KAAc,EAAE,MAAe;IAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,KAAK,GAAG,mBAAmB;IAE3B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAA;QAClB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,IAAI,GAAG,KAAK,GAAG,qBAAqB,EAAE,CAAC;gBACzC,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,MAAK;YACP,CAAC;YACD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,GAAG,KAAK;QACd,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAO,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAA;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,iCAAiC,EAAG,CAAW,CAAC,OAAO,CAAC,CAAA;IACxG,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAExF,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,OAAkC;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACvF,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,iBAAiB,CAAA;AAC5G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA+B;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACzG,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AACzC,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,OAAO,CAAC,GAAoB;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1B,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAoB;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACvC,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The two listeners: the loopback-only control API (`/atomic/v1`) and the optional public
+ * OpenAI-compatible API (`/v1`), plus the client registry they share. PLAN.md §3.6.
+ */
+export * from './http.js';
+export * from './clients.js';
+export * from './control/index.js';
+export * from './public/index.js';
+export * from './state-file.js';

package/dist/server/index.js

@@ -0,0 +1,10 @@
+/**
+ * The two listeners: the loopback-only control API (`/atomic/v1`) and the optional public
+ * OpenAI-compatible API (`/v1`), plus the client registry they share. PLAN.md §3.6.
+ */
+export * from './http.js';
+export * from './clients.js';
+export * from './control/index.js';
+export * from './public/index.js';
+export * from './state-file.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA"}

package/dist/server/public/ctx.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Growing a local model's context when a request overflows it, then finding where the reloaded
+ * model now listens.
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (`maybe_auto_increase_and_retry`),
+ * src-tauri/src/core/server/context_expansion.rs (`request_context_increase` leader/follower slots).
+ *
+ * Concurrent overflows of the same model share one reload: the first caller leads, the rest wait for
+ * its outcome. Without that, N parallel requests would each reload the model and ratchet the context
+ * N steps at once.
+ */
+import type { LocalProvider } from '../../router/index.js';
+import type { PublicServerDeps } from './types.js';
+export type CtxTrigger = 'error' | 'finish_length' | 'compute_error_recovery';
+/**
+ * Ask for a larger context; on success, the session's new port and key, resolved afresh because
+ * the model is now a different process. Embedding sessions are never grown: their inputs are
+ * batched to a fixed size and have no overflow to fix.
+ */
+export declare function autoIncreaseCtx(deps: PublicServerDeps, provider: LocalProvider, modelId: string, trigger: CtxTrigger): Promise<{
+    port: number;
+    apiKey: string;
+} | undefined>;

package/dist/server/public/ctx.js

@@ -0,0 +1,42 @@
+/**
+ * Growing a local model's context when a request overflows it, then finding where the reloaded
+ * model now listens.
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (`maybe_auto_increase_and_retry`),
+ * src-tauri/src/core/server/context_expansion.rs (`request_context_increase` leader/follower slots).
+ *
+ * Concurrent overflows of the same model share one reload: the first caller leads, the rest wait for
+ * its outcome. Without that, N parallel requests would each reload the model and ratchet the context
+ * N steps at once.
+ */
+const inFlight = new WeakMap();
+function requestIncrease(deps, provider, modelId, trigger) {
+    let pending = inFlight.get(deps);
+    if (!pending)
+        inFlight.set(deps, (pending = new Map()));
+    const key = `${provider}:${modelId}`;
+    const existing = pending.get(key);
+    if (existing)
+        return existing;
+    const leader = deps
+        .increaseCtx(provider, modelId, trigger)
+        .catch((e) => ({ ok: false, reason: e.message }))
+        .finally(() => pending.delete(key));
+    pending.set(key, leader);
+    return leader;
+}
+/**
+ * Ask for a larger context; on success, the session's new port and key, resolved afresh because
+ * the model is now a different process. Embedding sessions are never grown: their inputs are
+ * batched to a fixed size and have no overflow to fix.
+ */
+export async function autoIncreaseCtx(deps, provider, modelId, trigger) {
+    if (deps.findLocal(provider, modelId)?.isEmbedding)
+        return undefined;
+    const outcome = await requestIncrease(deps, provider, modelId, trigger);
+    if (!outcome.ok)
+        return undefined;
+    const session = deps.findLocal(provider, modelId);
+    return session ? { port: session.port, apiKey: session.apiKey } : undefined;
+}
+//# sourceMappingURL=ctx.js.map

package/dist/server/public/ctx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctx.js","sourceRoot":"","sources":["../../../src/server/public/ctx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA8D,CAAA;AAE1F,SAAS,eAAe,CACtB,IAAsB,EACtB,QAAuB,EACvB,OAAe,EACf,OAAmB;IAEnB,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,MAAM,GAAG,IAAI;SAChB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;SACvC,KAAK,CAAC,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;SACxF,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAsB,EACtB,QAAuB,EACvB,OAAe,EACf,OAAmB;IAEnB,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW;QAAE,OAAO,SAAS,CAAA;IACpE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,SAAS,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7E,CAAC"}

package/dist/server/public/dynamic-hosts.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Hosts the Local API Server trusts without the user typing them into Trusted Hosts.
+ *
+ * `isValidHost` rejects any `Host` header that is not loopback or listed in the configured trusted
+ * hosts. That is the DNS-rebinding guard, and it stays byte for byte as it was. Two callers, though,
+ * arrive with a `Host` nobody could have typed in advance:
+ *
+ *  - a Cloudflare quick tunnel, whose `<words>.trycloudflare.com` name is only known once
+ *    `cloudflared` has printed it, and is new on every start;
+ *  - a LAN client dialling this machine's own address, which changes with the network (sleep/wake,
+ *    Wi-Fi switch, DHCP lease).
+ *
+ * Neither weakens the guard. A rebinding attack puts the *attacker's* domain in `Host`; it cannot
+ * make the header equal the tunnel's real public name or the literal address of the socket the
+ * request arrived on.
+ *
+ * Ported from: src-tauri/src/core/server/dynamic_hosts.rs (image-generation line, `767ff6350`).
+ * ADR 2026-09-17-trust-the-tunnel-name-and-the-accepted-socket-address-per-request.
+ */
+export declare class DynamicTrustedHosts {
+    private tunnel;
+    /**
+     * Trust `host` (a bare hostname, no scheme, port or path) until cleared. Anything else clears it:
+     * a blank value must not trust the empty string, and `*` must never reach `isValidHost`, where it
+     * allows every host.
+     */
+    setTunnelHost(host: string): void;
+    clearTunnelHost(): void;
+    tunnelHost(): string | undefined;
+    /**
+     * The extra trusted-hosts group for one request.
+     *
+     * `localAddress` is the local address of the accepted socket. It is trusted only when it says
+     * something a loopback bind could not: an unspecified or loopback address adds nothing
+     * (`isValidHost` already allows loopback), so a server bound to `127.0.0.1` gains no new names.
+     */
+    groupFor(localAddress?: string | null): string[];
+}
+/** The `Host`-header spelling of a socket's local address, or `undefined` when it adds nothing. */
+export declare function socketAddressLiteral(localAddress?: string | null): string | undefined;

package/dist/server/public/dynamic-hosts.js

@@ -0,0 +1,117 @@
+/**
+ * Hosts the Local API Server trusts without the user typing them into Trusted Hosts.
+ *
+ * `isValidHost` rejects any `Host` header that is not loopback or listed in the configured trusted
+ * hosts. That is the DNS-rebinding guard, and it stays byte for byte as it was. Two callers, though,
+ * arrive with a `Host` nobody could have typed in advance:
+ *
+ *  - a Cloudflare quick tunnel, whose `<words>.trycloudflare.com` name is only known once
+ *    `cloudflared` has printed it, and is new on every start;
+ *  - a LAN client dialling this machine's own address, which changes with the network (sleep/wake,
+ *    Wi-Fi switch, DHCP lease).
+ *
+ * Neither weakens the guard. A rebinding attack puts the *attacker's* domain in `Host`; it cannot
+ * make the header equal the tunnel's real public name or the literal address of the socket the
+ * request arrived on.
+ *
+ * Ported from: src-tauri/src/core/server/dynamic_hosts.rs (image-generation line, `767ff6350`).
+ * ADR 2026-09-17-trust-the-tunnel-name-and-the-accepted-socket-address-per-request.
+ */
+import { isIPv4, isIPv6 } from 'node:net';
+/** One or more dot-separated DNS labels: nothing that `isValidHost` would read as a wildcard. */
+const BARE_HOSTNAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+export class DynamicTrustedHosts {
+    tunnel;
+    /**
+     * Trust `host` (a bare hostname, no scheme, port or path) until cleared. Anything else clears it:
+     * a blank value must not trust the empty string, and `*` must never reach `isValidHost`, where it
+     * allows every host.
+     */
+    setTunnelHost(host) {
+        const value = host.trim().replace(/\.+$/, '').toLowerCase();
+        this.tunnel = BARE_HOSTNAME.test(value) ? value : undefined;
+    }
+    clearTunnelHost() {
+        this.tunnel = undefined;
+    }
+    tunnelHost() {
+        return this.tunnel;
+    }
+    /**
+     * The extra trusted-hosts group for one request.
+     *
+     * `localAddress` is the local address of the accepted socket. It is trusted only when it says
+     * something a loopback bind could not: an unspecified or loopback address adds nothing
+     * (`isValidHost` already allows loopback), so a server bound to `127.0.0.1` gains no new names.
+     */
+    groupFor(localAddress) {
+        const group = [];
+        if (this.tunnel !== undefined)
+            group.push(this.tunnel);
+        const literal = socketAddressLiteral(localAddress);
+        if (literal !== undefined)
+            group.push(literal);
+        return group;
+    }
+}
+/** The `Host`-header spelling of a socket's local address, or `undefined` when it adds nothing. */
+export function socketAddressLiteral(localAddress) {
+    if (!localAddress)
+        return undefined;
+    // A link-local address arrives with its zone (`fe80::1%en0`); a `Host` header never carries one.
+    const address = unmapIpv4(localAddress.split('%')[0] ?? '');
+    if (isIPv4(address)) {
+        if (address === '0.0.0.0' || address.startsWith('127.'))
+            return undefined;
+        return address;
+    }
+    if (isIPv6(address)) {
+        const lower = address.toLowerCase();
+        if (isIpv6Unspecified(lower) || isIpv6Loopback(lower))
+            return undefined;
+        // `isValidHost` strips the port of a bracketed literal only when the trusted entry is bracketed too.
+        return `[${lower}]`;
+    }
+    return undefined;
+}
+/**
+ * A dual-stack listener reports IPv4 peers as `::ffff:a.b.c.d` (or, from some stacks, in the hex
+ * form `::ffff:c0a8:105`), but the client wrote plain `a.b.c.d` in its `Host` header.
+ */
+function unmapIpv4(address) {
+    const lower = address.toLowerCase();
+    if (!lower.startsWith('::ffff:'))
+        return address;
+    const rest = lower.slice('::ffff:'.length);
+    if (isIPv4(rest))
+        return rest;
+    const hex = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(rest);
+    if (!hex)
+        return address;
+    const high = parseInt(hex[1], 16);
+    const low = parseInt(hex[2], 16);
+    return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+}
+/** The eight groups of an IPv6 literal, or `undefined` for a form this does not need to understand. */
+function ipv6Groups(address) {
+    if (address.includes('.'))
+        return undefined;
+    const [head, tail, ...extra] = address.split('::');
+    if (head === undefined || extra.length > 0)
+        return undefined;
+    const parse = (part) => (part === '' ? [] : part.split(':').map((group) => parseInt(group, 16)));
+    const leading = parse(head);
+    if (tail === undefined)
+        return leading.length === 8 ? leading : undefined;
+    const trailing = parse(tail);
+    const zeros = 8 - leading.length - trailing.length;
+    return zeros < 0 ? undefined : [...leading, ...new Array(zeros).fill(0), ...trailing];
+}
+function isIpv6Unspecified(address) {
+    return ipv6Groups(address)?.every((group) => group === 0) === true;
+}
+function isIpv6Loopback(address) {
+    const groups = ipv6Groups(address);
+    return groups !== undefined && groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+}
+//# sourceMappingURL=dynamic-hosts.js.map

package/dist/server/public/dynamic-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-hosts.js","sourceRoot":"","sources":["../../../src/server/public/dynamic-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEzC,iGAAiG;AACjG,MAAM,aAAa,GAAG,mEAAmE,CAAA;AAEzF,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAoB;IAElC;;;;OAIG;IACH,aAAa,CAAC,IAAY;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,CAAC;IAED,eAAe;QACb,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACzB,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,YAA4B;QACnC,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtD,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAClD,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,UAAU,oBAAoB,CAAC,YAA4B;IAC/D,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IACnC,iGAAiG;IACjG,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QACzE,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACnC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACvE,qGAAqG;QACrG,OAAO,IAAI,KAAK,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,GAAG,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAA;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAA;IAC1C,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;AAChE,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IAClD,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,KAAK,CAAS,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAA;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AACpG,CAAC"}

package/dist/server/public/errors.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Reading upstream failures: is this a context overflow, a poisoned compute backend, an OOM — and
+ * what the client is told in each case.
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (`is_compute_backend_error`,
+ * `compute_error_envelope`, `structure_backend_error_body`, `is_context_overflow_finish_length_json`,
+ * `body_indicates_oom`), src-tauri/src/core/server/context_expansion.rs (`is_context_limit_error`).
+ *
+ * The wording of every message is part of the contract: the app's UI and external agents match on
+ * it to decide whether to offer a larger context or a smaller model.
+ */
+import type { JsonValue } from '../shims/index.js';
+/** A request that no longer fits the loaded context window, as llama.cpp and MLX word it. */
+export declare function isContextLimitError(status: number, body: string): boolean;
+export declare function bodyIndicatesOom(body: string): boolean;
+/**
+ * A fatal compute failure that leaves the ggml backend unusable until it is recreated (a Metal OOM
+ * during prompt processing answers 500 "Compute error" and every later request fails the same way).
+ */
+export declare function isComputeBackendError(status: number, body: string): boolean;
+export declare function structuredErrorJson(message: string, type: string, code: string): string;
+export declare function computeErrorEnvelope(oom: boolean): string;
+/**
+ * A local engine's error as the client receives it: an existing `{"error": {...}}` envelope passes
+ * unchanged, anything else (plain stderr text, mlx-vlm's `{"detail": ...}`) is wrapped with a typed
+ * `code`, keeping the original text as the message so the overflow and OOM matchers still see it.
+ */
+export declare function structureBackendErrorBody(body: string, oom: boolean, ctxOverflow: boolean): string;
+export declare function clientMaxTokens(requestBody: Buffer): number | undefined;
+/**
+ * A 200 whose `finish_reason` is `length` because the context window ran out rather than because
+ * the client capped the output. With no client cap, `length` can only mean the window. With a cap,
+ * only a stop clearly short of it counts; an unknown token count is taken as client-driven, so a
+ * `max_tokens: 16` health check never grows the context.
+ */
+export declare function isContextOverflowFinishLength(response: JsonValue, requestBody: Buffer): boolean;

package/dist/server/public/errors.js

@@ -0,0 +1,120 @@
+/**
+ * Reading upstream failures: is this a context overflow, a poisoned compute backend, an OOM — and
+ * what the client is told in each case.
+ *
+ * Ported from: src-tauri/src/core/server/proxy.rs (`is_compute_backend_error`,
+ * `compute_error_envelope`, `structure_backend_error_body`, `is_context_overflow_finish_length_json`,
+ * `body_indicates_oom`), src-tauri/src/core/server/context_expansion.rs (`is_context_limit_error`).
+ *
+ * The wording of every message is part of the contract: the app's UI and external agents match on
+ * it to decide whether to offer a larger context or a smaller model.
+ */
+import { isJsonObject, serdeToString } from '../shims/index.js';
+/** A request that no longer fits the loaded context window, as llama.cpp and MLX word it. */
+export function isContextLimitError(status, body) {
+    if (![400, 413, 500, 503].includes(status))
+        return false;
+    const b = body.toLowerCase();
+    if (b.includes('the request exceeds the available context size'))
+        return true;
+    if (b.includes('max_kv_size') || b.includes('max-kv-size') || b.includes('max kv size'))
+        return true;
+    if (b.includes('kv cache') && (b.includes('exceed') || b.includes('overflow') || b.includes('too')))
+        return true;
+    return (b.includes('context') &&
+        ['size', 'length', 'limit', 'exceed', 'overflow', 'too long', 'too large'].some((w) => b.includes(w)));
+}
+export function bodyIndicatesOom(body) {
+    const b = body.toLowerCase();
+    return [
+        'out of memory',
+        'outofmemory',
+        'cuda_error_out_of_memory',
+        'failed to allocate',
+        'insufficient memory',
+        'erroroutofdevicememory',
+    ].some((p) => b.includes(p));
+}
+/**
+ * A fatal compute failure that leaves the ggml backend unusable until it is recreated (a Metal OOM
+ * during prompt processing answers 500 "Compute error" and every later request fails the same way).
+ */
+export function isComputeBackendError(status, body) {
+    if (status !== 500)
+        return false;
+    const b = body.toLowerCase();
+    return [
+        'compute error',
+        'failed to decode',
+        'failed to compute graph',
+        'backend is in error state',
+        'ggml_backend_sched_graph_compute',
+    ].some((p) => b.includes(p));
+}
+export function structuredErrorJson(message, type, code) {
+    return serdeToString({ error: { message, type, code } });
+}
+export function computeErrorEnvelope(oom) {
+    const message = oom
+        ? 'The model ran out of memory while processing this request. Try a smaller or lighter model, reduce the context size, or remove attached images. On Apple Silicon, memory is shared with the system, so closing other memory-heavy apps can free up headroom.'
+        : 'The model failed during computation — most often because it ran out of memory. Try a smaller or lighter model, reduce the context size, or remove attached images. On Apple Silicon, memory is shared with the system, so closing other memory-heavy apps can free up headroom.';
+    return structuredErrorJson(message, 'server_error', 'insufficient_memory');
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isStructuredErrorBody(body) {
+    const parsed = parseJson(body);
+    return isJsonObject(parsed) && isJsonObject(parsed['error']);
+}
+/**
+ * A local engine's error as the client receives it: an existing `{"error": {...}}` envelope passes
+ * unchanged, anything else (plain stderr text, mlx-vlm's `{"detail": ...}`) is wrapped with a typed
+ * `code`, keeping the original text as the message so the overflow and OOM matchers still see it.
+ */
+export function structureBackendErrorBody(body, oom, ctxOverflow) {
+    if (isStructuredErrorBody(body))
+        return body;
+    const code = ctxOverflow ? 'context_length_exceeded' : oom ? 'insufficient_memory' : 'server_error';
+    const type = ctxOverflow ? 'invalid_request_error' : 'server_error';
+    return structuredErrorJson(body, type, code);
+}
+/** serde_json `as_u64`: non-negative integers only. */
+function asU64(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+export function clientMaxTokens(requestBody) {
+    const json = parseJson(requestBody.toString('utf8'));
+    if (!isJsonObject(json))
+        return undefined;
+    for (const key of ['max_tokens', 'max_completion_tokens']) {
+        const v = asU64(json[key]);
+        if (v !== undefined && v > 0)
+            return v;
+    }
+    return undefined;
+}
+/**
+ * A 200 whose `finish_reason` is `length` because the context window ran out rather than because
+ * the client capped the output. With no client cap, `length` can only mean the window. With a cap,
+ * only a stop clearly short of it counts; an unknown token count is taken as client-driven, so a
+ * `max_tokens: 16` health check never grows the context.
+ */
+export function isContextOverflowFinishLength(response, requestBody) {
+    const choices = isJsonObject(response) ? response['choices'] : undefined;
+    const hasLength = Array.isArray(choices) && choices.some((c) => isJsonObject(c) && c['finish_reason'] === 'length');
+    if (!hasLength)
+        return false;
+    const cap = clientMaxTokens(requestBody);
+    if (cap === undefined)
+        return true;
+    const usage = isJsonObject(response) ? response['usage'] : undefined;
+    const done = asU64(isJsonObject(usage) ? usage['completion_tokens'] : undefined);
+    return done !== undefined && done + 1 < cap;
+}
+//# sourceMappingURL=errors.js.map