@elsium-ai/app 0.2.2 → 0.3.0

package/dist/index.js

@@ -389,6 +389,189 @@ function createLogger(options = {}) {
     }
   };
 }
+// ../core/src/schema.ts
+var log = createLogger();
+function zodDefKind(def) {
+  return typeof def.type === "string" ? def.type : def.typeName;
+}
+function zodObjectToJsonSchema(schema, convert) {
+  const shape = typeof schema.shape === "function" ? schema.shape() : schema.shape;
+  const properties = {};
+  const required = [];
+  for (const [key, value] of Object.entries(shape)) {
+    const fieldSchema = value;
+    properties[key] = convert(fieldSchema);
+    const fieldDef = fieldSchema._def;
+    const fieldKind = zodDefKind(fieldDef);
+    if (fieldKind !== "optional" && fieldKind !== "ZodOptional" && fieldKind !== "default" && fieldKind !== "ZodDefault") {
+      required.push(key);
+    }
+    if (fieldDef.description) {
+      properties[key].description = fieldDef.description;
+    }
+  }
+  return { type: "object", properties, required };
+}
+function zodToJsonSchema(schema) {
+  if (!("_def" in schema))
+    return { type: "object" };
+  const def = schema._def;
+  const kind = zodDefKind(def);
+  switch (kind) {
+    case "object":
+    case "ZodObject":
+      return zodObjectToJsonSchema(def, zodToJsonSchema);
+    case "string":
+    case "ZodString":
+      return { type: "string" };
+    case "number":
+    case "ZodNumber":
+      return { type: "number" };
+    case "boolean":
+    case "ZodBoolean":
+      return { type: "boolean" };
+    case "array":
+    case "ZodArray":
+      return {
+        type: "array",
+        items: zodToJsonSchema(def.element ?? def.type)
+      };
+    case "enum":
+    case "ZodEnum": {
+      const values = def.values ?? (def.entries ? Object.values(def.entries) : []);
+      return { type: "string", enum: values };
+    }
+    case "optional":
+    case "ZodOptional":
+      return zodToJsonSchema(def.innerType);
+    case "default":
+    case "ZodDefault":
+      return zodToJsonSchema(def.innerType);
+    case "nullable":
+    case "ZodNullable": {
+      const inner = zodToJsonSchema(def.innerType);
+      return { ...inner, nullable: true };
+    }
+    case "ZodLiteral":
+      return { type: typeof def.value, const: def.value };
+    case "ZodUnion": {
+      const options = def.options.map(zodToJsonSchema);
+      return { anyOf: options };
+    }
+    case "ZodRecord":
+      return {
+        type: "object",
+        additionalProperties: def.valueType ? zodToJsonSchema(def.valueType) : { type: "string" }
+      };
+    case "ZodTuple": {
+      const items = (def.items ?? []).map(zodToJsonSchema);
+      return { type: "array", prefixItems: items, minItems: items.length, maxItems: items.length };
+    }
+    case "ZodDate":
+      return { type: "string", format: "date-time" };
+    default:
+      log.warn(`zodToJsonSchema: unsupported type ${kind}, defaulting to string`);
+      return { type: "string" };
+  }
+}
+// ../core/src/registry.ts
+var log2 = createLogger();
+var BLOCKED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+// ../core/src/shutdown.ts
+function createShutdownManager(config) {
+  const drainTimeoutMs = config?.drainTimeoutMs ?? 30000;
+  const signals = config?.signals ?? ["SIGTERM", "SIGINT"];
+  if (drainTimeoutMs < 0 || !Number.isFinite(drainTimeoutMs)) {
+    throw new ElsiumError({
+      code: "CONFIG_ERROR",
+      message: "drainTimeoutMs must be >= 0 and finite",
+      retryable: false
+    });
+  }
+  let shuttingDown = false;
+  let inFlightCount = 0;
+  let drainResolve = null;
+  let shutdownPromise = null;
+  const signalHandlers = [];
+  function checkDrained() {
+    if (inFlightCount === 0 && drainResolve) {
+      drainResolve();
+      drainResolve = null;
+    }
+  }
+  async function shutdown() {
+    if (shutdownPromise)
+      return shutdownPromise;
+    shuttingDown = true;
+    shutdownPromise = (async () => {
+      config?.onDrainStart?.();
+      if (inFlightCount === 0) {
+        config?.onDrainComplete?.();
+        return;
+      }
+      const drainPromise = new Promise((resolve) => {
+        drainResolve = resolve;
+      });
+      let drainTimer;
+      const timeoutPromise = new Promise((resolve) => {
+        drainTimer = setTimeout(() => resolve("timeout"), drainTimeoutMs);
+      });
+      const result = await Promise.race([
+        drainPromise.then(() => "drained"),
+        timeoutPromise
+      ]);
+      if (drainTimer !== undefined)
+        clearTimeout(drainTimer);
+      if (result === "timeout") {
+        config?.onForceShutdown?.();
+      } else {
+        config?.onDrainComplete?.();
+      }
+    })();
+    return shutdownPromise;
+  }
+  const manager = {
+    get inFlight() {
+      return inFlightCount;
+    },
+    get isShuttingDown() {
+      return shuttingDown;
+    },
+    async trackOperation(fn) {
+      if (shuttingDown) {
+        throw new ElsiumError({
+          code: "VALIDATION_ERROR",
+          message: "Server is shutting down, not accepting new operations",
+          retryable: true
+        });
+      }
+      inFlightCount++;
+      try {
+        return await fn();
+      } finally {
+        inFlightCount--;
+        checkDrained();
+      }
+    },
+    shutdown,
+    dispose() {
+      for (const { signal, handler } of signalHandlers) {
+        process.removeListener(signal, handler);
+      }
+      signalHandlers.length = 0;
+    }
+  };
+  if (typeof process !== "undefined" && process.on) {
+    for (const signal of signals) {
+      const handler = () => {
+        manager.shutdown();
+      };
+      signalHandlers.push({ signal, handler });
+      process.on(signal, handler);
+    }
+  }
+  return manager;
+}
 // ../gateway/src/provider.ts
 var providerRegistry = new Map;
 var metadataRegistry = new Map;
@@ -520,7 +703,7 @@ function xrayMiddleware(options = {}) {
 }
 
 // ../gateway/src/pricing.ts
-var log = createLogger();
+var log3 = createLogger();
 var PRICING = {
   "claude-opus-4-6": { inputPerMillion: 15, outputPerMillion: 75 },
   "claude-sonnet-4-6": { inputPerMillion: 3, outputPerMillion: 15 },
@@ -558,7 +741,7 @@ function resolveModelName(model) {
 function calculateCost(model, usage) {
   const pricing = PRICING[resolveModelName(model)];
   if (!pricing) {
-    log.warn(`Unknown model "${model}" — cost will be reported as $0. Register pricing with registerPricing().`);
+    log3.warn(`Unknown model "${model}" — cost will be reported as $0. Register pricing with registerPricing().`);
     return {
       inputCost: 0,
       outputCost: 0,
@@ -652,15 +835,33 @@ function createAnthropicProvider(config) {
     if (part.type === "text")
       return { type: "text", text: part.text };
     if (part.type === "image" && part.source?.type === "base64") {
+      const src = part.source;
       return {
         type: "image",
         source: {
           type: "base64",
-          media_type: part.source.mediaType,
-          data: part.source.data
+          media_type: src.mediaType,
+          data: src.data
         }
       };
     }
+    if (part.type === "document" && part.source) {
+      if (part.source.type === "base64") {
+        const src = part.source;
+        return {
+          type: "document",
+          source: {
+            type: "base64",
+            media_type: src.mediaType,
+            data: src.data
+          }
+        };
+      }
+      return { type: "text", text: "[document: url source not supported by Anthropic]" };
+    }
+    if (part.type === "audio") {
+      return { type: "text", text: "[audio content not supported by this provider]" };
+    }
     return { type: "text", text: "[unsupported content]" };
   }
   function formatMultipartContent(msg, role) {
@@ -769,6 +970,16 @@ function createAnthropicProvider(config) {
       const tools = formatTools(req.tools);
       if (tools)
         body.tools = tools;
+      if (req.schema) {
+        const jsonSchema = zodToJsonSchema(req.schema);
+        const structuredTool = {
+          name: "_structured_output",
+          description: "Return structured output matching the required schema",
+          input_schema: jsonSchema
+        };
+        body.tools = [...tools ?? [], structuredTool];
+        body.tool_choice = { type: "tool", name: "_structured_output" };
+      }
       const startTime = performance.now();
       const raw = await retry(async () => {
         const controller = new AbortController;
@@ -978,7 +1189,31 @@ function createGoogleProvider(config) {
     return { role, parts };
   }
   function formatGeminiMultipartContent(msg, role) {
-    const parts = msg.content.filter((p) => p.type === "text").map((p) => ({ text: p.text }));
+    const parts = [];
+    for (const p of msg.content) {
+      if (p.type === "text") {
+        parts.push({ text: p.text });
+      } else if (p.type === "image") {
+        const img = p;
+        if (img.source.type === "base64") {
+          parts.push({ inlineData: { mimeType: img.source.mediaType, data: img.source.data } });
+        } else {
+          parts.push({ fileData: { mimeType: "image/jpeg", fileUri: img.source.url } });
+        }
+      } else if (p.type === "audio" || p.type === "document") {
+        const media = p;
+        if (media.source.type === "base64") {
+          parts.push({
+            inlineData: { mimeType: media.source.mediaType, data: media.source.data }
+          });
+        } else {
+          const urlSource = media.source;
+          parts.push({
+            fileData: { mimeType: "application/octet-stream", fileUri: urlSource.url }
+          });
+        }
+      }
+    }
     return { role, parts };
   }
   function formatMessages(messages) {
@@ -1075,6 +1310,10 @@ function createGoogleProvider(config) {
       config2.topP = req.topP;
     if (req.stopSequences?.length)
       config2.stopSequences = req.stopSequences;
+    if (req.schema) {
+      config2.responseMimeType = "application/json";
+      config2.responseSchema = zodToJsonSchema(req.schema);
+    }
     return config2;
   }
   function buildRequestBody(req) {
@@ -1153,7 +1392,8 @@ async function handleGoogleErrorResponse(response) {
     throw ElsiumError.authError("google");
   }
   if (response.status === 429) {
-    throw ElsiumError.rateLimit("google");
+    const retryAfter = response.headers.get("retry-after");
+    throw ElsiumError.rateLimit("google", retryAfter ? Number.parseInt(retryAfter) * 1000 : undefined);
   }
   throw ElsiumError.providerError(`Google API error ${response.status}: ${errorBody}`, {
     provider: "google",
@@ -1339,6 +1579,43 @@ function createOpenAIProvider(config) {
     }
     return openaiMsg;
   }
+  function formatUserContent(msg) {
+    if (typeof msg.content === "string")
+      return msg.content;
+    const parts = [];
+    for (const part of msg.content) {
+      if (part.type === "text") {
+        parts.push({ type: "text", text: part.text });
+      } else if (part.type === "image") {
+        if (part.source.type === "base64") {
+          const url = `data:${part.source.mediaType};base64,${part.source.data}`;
+          parts.push({ type: "image_url", image_url: { url } });
+        } else {
+          parts.push({ type: "image_url", image_url: { url: part.source.url } });
+        }
+      } else if (part.type === "audio") {
+        if (part.source.type === "base64") {
+          const format = part.source.mediaType.split("/")[1] ?? "wav";
+          parts.push({
+            type: "input_audio",
+            input_audio: { data: part.source.data, format }
+          });
+        } else {
+          parts.push({ type: "text", text: "[audio: url source requires file upload]" });
+        }
+      } else if (part.type === "document") {
+        if (part.source.type === "base64") {
+          parts.push({
+            type: "text",
+            text: `[document: ${part.source.mediaType} content attached as base64]`
+          });
+        } else {
+          parts.push({ type: "text", text: `[document: ${part.source.url}]` });
+        }
+      }
+    }
+    return parts;
+  }
   function formatMessages(messages) {
     const formatted = [];
     for (const msg of messages) {
@@ -1354,7 +1631,7 @@ function createOpenAIProvider(config) {
         formatted.push(formatAssistantMessage(msg));
         continue;
       }
-      formatted.push({ role: "user", content: extractTextContent(msg) });
+      formatted.push({ role: "user", content: formatUserContent(msg) });
     }
     return formatted;
   }
@@ -1431,6 +1708,17 @@ function createOpenAIProvider(config) {
       const tools = formatTools(req.tools);
       if (tools)
         body.tools = tools;
+      if (req.schema) {
+        const jsonSchema = zodToJsonSchema(req.schema);
+        body.response_format = {
+          type: "json_schema",
+          json_schema: {
+            name: "structured_output",
+            strict: true,
+            schema: jsonSchema
+          }
+        };
+      }
       const startTime = performance.now();
       const raw = await retry(async () => {
         const controller = new AbortController;
@@ -1590,7 +1878,7 @@ var PROVIDER_FACTORIES = {
   openai: createOpenAIProvider,
   google: createGoogleProvider
 };
-function gateway(config) {
+function validateGatewayConfig(config) {
   const factory = PROVIDER_FACTORIES[config.provider];
   if (!factory) {
     throw new ElsiumError({
@@ -1599,21 +1887,92 @@ function gateway(config) {
       retryable: false
     });
   }
+  if (typeof config.apiKey !== "string" || config.apiKey.trim() === "") {
+    throw new ElsiumError({
+      code: "CONFIG_ERROR",
+      message: "apiKey must be a non-empty string",
+      retryable: false
+    });
+  }
+  if (config.timeout !== undefined && (!Number.isFinite(config.timeout) || config.timeout <= 0)) {
+    throw new ElsiumError({
+      code: "CONFIG_ERROR",
+      message: "timeout must be a positive finite number",
+      retryable: false
+    });
+  }
+  if (config.maxRetries !== undefined && (!Number.isFinite(config.maxRetries) || !Number.isInteger(config.maxRetries) || config.maxRetries < 0)) {
+    throw new ElsiumError({
+      code: "CONFIG_ERROR",
+      message: "maxRetries must be a non-negative finite integer",
+      retryable: false
+    });
+  }
+  return factory;
+}
+function autoRegisterProvider(provider) {
+  if (!provider.metadata)
+    return;
+  registerProviderMetadata(provider.name, provider.metadata);
+  if (!provider.metadata.pricing)
+    return;
+  for (const [model, pricing] of Object.entries(provider.metadata.pricing)) {
+    registerPricing(model, pricing);
+  }
+}
+function validateRequestLimits(request, maxMessages, maxInputTokens) {
+  if (request.messages.length > maxMessages) {
+    throw ElsiumError.validation(`Message count ${request.messages.length} exceeds limit of ${maxMessages}`);
+  }
+  let estimatedTokens = 0;
+  for (const msg of request.messages) {
+    const text = typeof msg.content === "string" ? msg.content : msg.content.map((p) => p.type === "text" ? p.text : "").join("");
+    estimatedTokens += Math.ceil(text.length / 4);
+  }
+  if (estimatedTokens > maxInputTokens) {
+    throw ElsiumError.validation(`Estimated input tokens (~${estimatedTokens}) exceeds limit of ${maxInputTokens}`);
+  }
+}
+function buildMiddlewareContext(req, providerName, defaultModel, metadata) {
+  return {
+    request: req,
+    provider: providerName,
+    model: req.model ?? defaultModel,
+    traceId: generateTraceId(),
+    startTime: performance.now(),
+    metadata
+  };
+}
+async function accumulateStreamEvents(stream, emit) {
+  let textContent = "";
+  let usage = { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+  let stopReason = "end_turn";
+  let id = "";
+  for await (const event of stream) {
+    emit(event);
+    if (event.type === "text_delta") {
+      textContent += event.text;
+    } else if (event.type === "message_end") {
+      usage = event.usage;
+      stopReason = event.stopReason;
+    } else if (event.type === "message_start") {
+      id = event.id;
+    }
+  }
+  return { textContent, usage, stopReason, id };
+}
+function gateway(config) {
+  const factory = validateGatewayConfig(config);
   const provider = factory({
     apiKey: config.apiKey,
     baseUrl: config.baseUrl,
     timeout: config.timeout,
     maxRetries: config.maxRetries
   });
-  if (provider.metadata) {
-    registerProviderMetadata(provider.name, provider.metadata);
-    if (provider.metadata.pricing) {
-      for (const [model, pricing] of Object.entries(provider.metadata.pricing)) {
-        registerPricing(model, pricing);
-      }
-    }
-  }
+  autoRegisterProvider(provider);
   const defaultModel = config.model ?? provider.defaultModel;
+  const maxMessages = config.maxMessages ?? 1000;
+  const maxInputTokens = config.maxInputTokens ?? 1e6;
   let xrayStore = null;
   const allMiddleware = [...config.middleware ?? []];
   if (config.xray) {
@@ -1628,14 +1987,7 @@ function gateway(config) {
     if (!composedMiddleware) {
       return provider.complete(req);
     }
-    const ctx = {
-      request: req,
-      provider: provider.name,
-      model: req.model ?? defaultModel,
-      traceId: generateTraceId(),
-      startTime: performance.now(),
-      metadata: request.metadata ?? {}
-    };
+    const ctx = buildMiddlewareContext(req, provider.name, defaultModel, request.metadata ?? {});
     return composedMiddleware(ctx, async (c) => provider.complete(c.request));
   }
   return {
@@ -1647,34 +1999,27 @@ function gateway(config) {
       return xrayStore?.callHistory(limit) ?? [];
     },
     async complete(request) {
+      validateRequestLimits(request, maxMessages, maxInputTokens);
       return executeWithMiddleware(request);
     },
     stream(request) {
+      validateRequestLimits(request, maxMessages, maxInputTokens);
       const req = { ...request, model: request.model ?? defaultModel };
       if (composedMiddleware) {
-        const ctx = {
-          request: req,
-          provider: provider.name,
-          model: req.model ?? defaultModel,
-          traceId: generateTraceId(),
-          startTime: performance.now(),
-          metadata: request.metadata ?? {}
-        };
+        const ctx = buildMiddlewareContext(req, provider.name, defaultModel, request.metadata ?? {});
         return createStream(async (emit) => {
           await composedMiddleware(ctx, async (c) => {
-            const stream = provider.stream(c.request);
-            for await (const event of stream) {
-              emit(event);
-            }
+            const result = await accumulateStreamEvents(provider.stream(c.request), emit);
+            const latencyMs = Math.round(performance.now() - ctx.startTime);
             return {
-              id: "",
-              message: { role: "assistant", content: "" },
-              usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
-              cost: { inputCost: 0, outputCost: 0, totalCost: 0, currency: "USD" },
+              id: result.id,
+              message: { role: "assistant", content: result.textContent },
+              usage: result.usage,
+              cost: calculateCost(c.model, result.usage),
               model: c.model,
               provider: provider.name,
-              stopReason: "end_turn",
-              latencyMs: 0,
+              stopReason: result.stopReason,
+              latencyMs,
               traceId: ctx.traceId
             };
           });
@@ -1684,107 +2029,52 @@ function gateway(config) {
     },
     async generate(request) {
       const { schema, ...rest } = request;
-      const jsonSchema = schemaToJsonSchema(schema);
-      const systemPrompt = [
-        rest.system ?? "",
-        "You MUST respond with valid JSON matching this schema:",
-        JSON.stringify(jsonSchema, null, 2),
-        "Respond ONLY with the JSON object, no markdown or explanation."
-      ].filter(Boolean).join(`
-
-`);
+      const jsonSchema = zodToJsonSchema(schema);
       const response = await executeWithMiddleware({
         ...rest,
-        system: systemPrompt
+        schema,
+        system: [
+          rest.system ?? "",
+          "You MUST respond with valid JSON matching this schema:",
+          JSON.stringify(jsonSchema, null, 2),
+          "Respond ONLY with the JSON object, no markdown or explanation."
+        ].filter(Boolean).join(`
+
+`)
       });
-      const text = typeof response.message.content === "string" ? response.message.content : "";
-      const jsonMatch = text.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) {
-        throw ElsiumError.validation("LLM response did not contain valid JSON", {
-          response: text
-        });
+      let parsed;
+      if (response.stopReason === "tool_use" && response.message.toolCalls?.length) {
+        const structuredCall = response.message.toolCalls.find((tc) => tc.name === "_structured_output");
+        if (structuredCall) {
+          parsed = structuredCall.arguments;
+        }
+      }
+      if (parsed === undefined) {
+        const text = typeof response.message.content === "string" ? response.message.content : "";
+        const jsonMatch = text.match(/\{[\s\S]*\}/);
+        if (!jsonMatch) {
+          throw ElsiumError.validation("LLM response did not contain valid JSON", {
+            response: text
+          });
+        }
+        parsed = JSON.parse(jsonMatch[0]);
       }
-      const parsed = JSON.parse(jsonMatch[0]);
       const result = schema.safeParse(parsed);
       if (!result.success) {
         throw ElsiumError.validation("LLM response did not match schema", {
-          errors: result.error.issues,
-          response: text
+          errors: result.error.issues
         });
       }
       return { data: result.data, response };
     }
   };
 }
-function schemaToJsonSchema(schema) {
-  try {
-    if ("_def" in schema) {
-      const def = schema._def;
-      const result = convertZodDef(def);
-      if (result)
-        return result;
-    }
-  } catch {}
-  return { type: "string" };
-}
-function zodDefKind(def) {
-  return typeof def.type === "string" ? def.type : def.typeName;
-}
-function convertZodDef(def) {
-  const kind = zodDefKind(def);
-  switch (kind) {
-    case "object":
-    case "ZodObject":
-      return convertZodObject(def);
-    case "string":
-    case "ZodString":
-      return { type: "string" };
-    case "number":
-    case "ZodNumber":
-      return { type: "number" };
-    case "boolean":
-    case "ZodBoolean":
-      return { type: "boolean" };
-    case "array":
-    case "ZodArray":
-      return convertZodArray(def);
-    case "enum":
-    case "ZodEnum": {
-      const values = def.values ?? (def.entries ? Object.values(def.entries) : []);
-      return { type: "string", enum: values };
-    }
-    case "optional":
-    case "ZodOptional":
-      return convertZodOptional(def);
-    default:
-      return null;
-  }
-}
-function convertZodObject(def) {
-  if (!def.shape)
-    return null;
-  const shape = typeof def.shape === "function" ? def.shape() : def.shape;
-  const properties = {};
-  const required = [];
-  for (const [key, value] of Object.entries(shape)) {
-    properties[key] = schemaToJsonSchema(value);
-    const valDef = value._def;
-    const valKind = zodDefKind(valDef);
-    if (valKind !== "optional" && valKind !== "ZodOptional") {
-      required.push(key);
-    }
-  }
-  return { type: "object", properties, required };
-}
-function convertZodArray(def) {
-  return {
-    type: "array",
-    items: schemaToJsonSchema(def.element ?? def.type)
-  };
-}
-function convertZodOptional(def) {
-  return schemaToJsonSchema(def.innerType ?? def.innerType);
-}
+// ../gateway/src/cache.ts
+var log4 = createLogger();
+// ../gateway/src/output-guardrails.ts
+var log5 = createLogger();
+// ../gateway/src/batch.ts
+var log6 = createLogger();
 // ../observe/src/span.ts
 function createSpan(name, options = {}) {
   const id = generateId("spn");
@@ -1854,7 +2144,8 @@ function createSpan(name, options = {}) {
   return span;
 }
 // ../observe/src/tracer.ts
-var log2 = createLogger();
+import { writeFileSync } from "node:fs";
+var log7 = createLogger();
 function observe(config = {}) {
   const {
     output = ["console"],
@@ -1869,7 +2160,21 @@ function observe(config = {}) {
   for (const out of output) {
     if (out === "console") {
       handlers.push(consoleHandler);
-    } else if (out === "json-file") {} else {
+    } else if (out === "json-file") {
+      exporters.push({
+        name: "json-file",
+        export(spansToExport) {
+          const filename = `.elsium/traces-${Date.now()}.json`;
+          try {
+            writeFileSync(filename, JSON.stringify(spansToExport, null, 2));
+          } catch (err2) {
+            log7.error("Failed to write trace file", {
+              error: err2 instanceof Error ? err2.message : String(err2)
+            });
+          }
+        }
+      });
+    } else {
       exporters.push(out);
     }
   }
@@ -1938,7 +2243,7 @@ function observe(config = {}) {
 function consoleHandler(span) {
   const duration = span.durationMs !== undefined ? `${span.durationMs}ms` : "running";
   const status = span.status === "error" ? "[ERROR]" : span.status === "ok" ? "[OK]" : "[...]";
-  log2.info("span", {
+  log7.info("span", {
     trace: span.traceId,
     span: span.name,
     kind: span.kind,
@@ -1975,8 +2280,10 @@ function createNoopSpan(name, kind) {
     }
   };
 }
+// ../observe/src/experiment.ts
+var log8 = createLogger();
 // ../observe/src/otel.ts
-var log3 = createLogger();
+var log9 = createLogger();
 // ../../node_modules/.bun/@hono+node-server@1.19.9/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
 import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
@@ -4049,7 +4356,7 @@ var Hono2 = class extends Hono {
 // src/middleware.ts
 import { timingSafeEqual } from "node:crypto";
 function corsMiddleware(config = true) {
-  const opts = typeof config === "boolean" ? { origin: [], methods: ["GET", "POST", "OPTIONS"] } : config;
+  const opts = typeof config === "boolean" ? { origin: "*", methods: ["GET", "POST", "OPTIONS"] } : config;
   return async (c, next) => {
     const requestOrigin = c.req.header("Origin") ?? "";
     let allowedOrigin;
@@ -4126,8 +4433,203 @@ function rateLimitMiddleware(config) {
     await next();
   };
 }
+function requestIdMiddleware() {
+  return async (c, next) => {
+    const raw2 = c.req.header("X-Request-ID");
+    const id = raw2 && /^[\w\-.:]{1,128}$/.test(raw2) ? raw2 : generateId("req");
+    c.set("requestId", id);
+    await next();
+    c.res.headers.set("X-Request-ID", id);
+  };
+}
+function requestLoggerMiddleware(logger) {
+  const log10 = logger ?? createLogger();
+  return async (c, next) => {
+    const start = Date.now();
+    await next();
+    const duration = Date.now() - start;
+    log10.info(`${c.req.method} ${c.req.path}`, {
+      method: c.req.method,
+      path: c.req.path,
+      status: c.res.status,
+      durationMs: duration,
+      requestId: c.get("requestId")
+    });
+  };
+}
+
+// ../../node_modules/.bun/hono@4.12.3/node_modules/hono/dist/utils/stream.js
+var StreamingApi = class {
+  writer;
+  encoder;
+  writable;
+  abortSubscribers = [];
+  responseReadable;
+  aborted = false;
+  closed = false;
+  constructor(writable, _readable) {
+    this.writable = writable;
+    this.writer = writable.getWriter();
+    this.encoder = new TextEncoder;
+    const reader = _readable.getReader();
+    this.abortSubscribers.push(async () => {
+      await reader.cancel();
+    });
+    this.responseReadable = new ReadableStream({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        done ? controller.close() : controller.enqueue(value);
+      },
+      cancel: () => {
+        this.abort();
+      }
+    });
+  }
+  async write(input) {
+    try {
+      if (typeof input === "string") {
+        input = this.encoder.encode(input);
+      }
+      await this.writer.write(input);
+    } catch {}
+    return this;
+  }
+  async writeln(input) {
+    await this.write(input + `
+`);
+    return this;
+  }
+  sleep(ms) {
+    return new Promise((res) => setTimeout(res, ms));
+  }
+  async close() {
+    try {
+      await this.writer.close();
+    } catch {}
+    this.closed = true;
+  }
+  async pipe(body) {
+    this.writer.releaseLock();
+    await body.pipeTo(this.writable, { preventClose: true });
+    this.writer = this.writable.getWriter();
+  }
+  onAbort(listener) {
+    this.abortSubscribers.push(listener);
+  }
+  abort() {
+    if (!this.aborted) {
+      this.aborted = true;
+      this.abortSubscribers.forEach((subscriber) => subscriber());
+    }
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.3/node_modules/hono/dist/helper/streaming/utils.js
+var isOldBunVersion = () => {
+  const version = typeof Bun !== "undefined" ? Bun.version : undefined;
+  if (version === undefined) {
+    return false;
+  }
+  const result = version.startsWith("1.1") || version.startsWith("1.0") || version.startsWith("0.");
+  isOldBunVersion = () => result;
+  return result;
+};
+
+// ../../node_modules/.bun/hono@4.12.3/node_modules/hono/dist/helper/streaming/stream.js
+var contextStash = /* @__PURE__ */ new WeakMap;
+var stream = (c, cb, onError) => {
+  const { readable, writable } = new TransformStream;
+  const stream2 = new StreamingApi(writable, readable);
+  if (isOldBunVersion()) {
+    c.req.raw.signal.addEventListener("abort", () => {
+      if (!stream2.closed) {
+        stream2.abort();
+      }
+    });
+  }
+  contextStash.set(stream2.responseReadable, c);
+  (async () => {
+    try {
+      await cb(stream2);
+    } catch (e) {
+      if (e === undefined) {} else if (e instanceof Error && onError) {
+        await onError(e, stream2);
+      } else {
+        console.error(e);
+      }
+    } finally {
+      stream2.close();
+    }
+  })();
+  return c.newResponse(stream2.responseReadable);
+};
+
+// src/sse.ts
+function sseHeaders() {
+  return {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  };
+}
+function formatSSE(event, data) {
+  const json = JSON.stringify(data);
+  if (event === "message") {
+    return `data: ${json}
+
+`;
+  }
+  return `event: ${event}
+data: ${json}
+
+`;
+}
+function streamResponse(c, source) {
+  const headers = sseHeaders();
+  for (const [key, value] of Object.entries(headers)) {
+    c.header(key, value);
+  }
+  return stream(c, async (s) => {
+    try {
+      for await (const event of source) {
+        const sseData = formatSSE("message", event);
+        await s.write(sseData);
+      }
+    } catch (err2) {
+      const errorEvent = {
+        type: "error",
+        error: err2 instanceof Error ? err2 : new Error(String(err2))
+      };
+      const sseData = formatSSE("error", {
+        type: "error",
+        message: errorEvent.error.message
+      });
+      await s.write(sseData);
+    }
+  });
+}
 
 // src/routes.ts
+function parseJsonBody(raw2) {
+  try {
+    return { ok: true, data: JSON.parse(raw2) };
+  } catch {
+    return { ok: false };
+  }
+}
+function elsiumErrorResponse(c, err2, fallbackMessage) {
+  if (err2 instanceof ElsiumError) {
+    return c.json({ error: err2.message, code: err2.code }, err2.statusCode ?? 500);
+  }
+  return c.json({ error: fallbackMessage }, 500);
+}
+function resolveAgent(name, agents, defaultAgent) {
+  const agent = name ? agents.get(name) : defaultAgent;
+  if (agent)
+    return { agent };
+  return { error: name ? `Agent "${name}" not found` : "No default agent configured" };
+}
 function createRoutes(deps) {
   const app = new Hono2;
   let totalRequests = 0;
@@ -4168,17 +4670,32 @@ function createRoutes(deps) {
     if (rawText.length > MAX_BODY_SIZE) {
       return c.json({ error: "Request body too large (max 1MB)" }, 413);
     }
-    const body = JSON.parse(rawText);
+    const parsed = parseJsonBody(rawText);
+    if (!parsed.ok) {
+      return c.json({ error: "Invalid JSON in request body" }, 400);
+    }
+    const body = parsed.data;
     if (!body.message) {
       return c.json({ error: "message is required" }, 400);
     }
-    const agent = body.agent ? deps.agents.get(body.agent) : deps.defaultAgent;
-    if (!agent) {
-      return c.json({
-        error: body.agent ? `Agent "${body.agent}" not found` : "No default agent configured"
-      }, 404);
+    const resolved = resolveAgent(body.agent, deps.agents, deps.defaultAgent);
+    if ("error" in resolved) {
+      return c.json({ error: resolved.error }, 404);
+    }
+    if (body.stream) {
+      const stream2 = deps.gateway.stream({
+        messages: [{ role: "user", content: body.message }],
+        system: resolved.agent.config.system,
+        model: resolved.agent.config.model
+      });
+      return streamResponse(c, stream2);
+    }
+    let result;
+    try {
+      result = await resolved.agent.run(body.message);
+    } catch (err2) {
+      return elsiumErrorResponse(c, err2, "Agent execution failed");
     }
-    const result = await agent.run(body.message);
     deps.tracer?.trackLLMCall({
       model: "unknown",
       inputTokens: result.usage.totalInputTokens,
@@ -4195,7 +4712,7 @@ function createRoutes(deps) {
         totalTokens: result.usage.totalTokens,
         cost: result.usage.totalCost
       },
-      model: agent.config.model ?? "default",
+      model: resolved.agent.config.model ?? "default",
       traceId: result.traceId
     };
     return c.json(response);
@@ -4207,7 +4724,11 @@ function createRoutes(deps) {
     if (rawText.length > MAX_BODY_SIZE) {
       return c.json({ error: "Request body too large (max 1MB)" }, 413);
     }
-    const body = JSON.parse(rawText);
+    const parsed = parseJsonBody(rawText);
+    if (!parsed.ok) {
+      return c.json({ error: "Invalid JSON in request body" }, 400);
+    }
+    const body = parsed.data;
     if (!body.messages?.length) {
       return c.json({ error: "messages array is required" }, 400);
     }
@@ -4215,13 +4736,28 @@ function createRoutes(deps) {
       role: m.role,
       content: m.content
     }));
-    const response = await deps.gateway.complete({
-      messages,
-      model: body.model,
-      system: body.system,
-      maxTokens: body.maxTokens,
-      temperature: body.temperature
-    });
+    if (body.stream) {
+      const stream2 = deps.gateway.stream({
+        messages,
+        model: body.model,
+        system: body.system,
+        maxTokens: body.maxTokens,
+        temperature: body.temperature
+      });
+      return streamResponse(c, stream2);
+    }
+    let response;
+    try {
+      response = await deps.gateway.complete({
+        messages,
+        model: body.model,
+        system: body.system,
+        maxTokens: body.maxTokens,
+        temperature: body.temperature
+      });
+    } catch (err2) {
+      return elsiumErrorResponse(c, err2, "Completion failed");
+    }
     deps.tracer?.trackLLMCall({
       model: response.model,
       inputTokens: response.usage.inputTokens,
@@ -4250,9 +4786,18 @@ function createRoutes(deps) {
 }
 
 // src/app.ts
-var log4 = createLogger();
+var log10 = createLogger();
 function createApp(config) {
   const app = new Hono2;
+  app.onError((err2, c) => {
+    const statusCode = err2 instanceof ElsiumError ? err2.statusCode ?? 500 : 500;
+    const code = err2 instanceof ElsiumError ? err2.code : "UNKNOWN";
+    log10.error("Unhandled error", { error: err2.message, code, path: c.req.path });
+    return c.json({ error: err2.message, code }, statusCode);
+  });
+  app.notFound((c) => {
+    return c.json({ error: "Not found" }, 404);
+  });
   const providerNames = Object.keys(config.gateway.providers);
   const primaryProvider = providerNames[0];
   const primaryConfig = config.gateway.providers[primaryProvider];
@@ -4267,6 +4812,8 @@ function createApp(config) {
     costTracking: config.observe?.costTracking ?? true
   });
   const serverConfig = config.server ?? {};
+  app.use("*", requestIdMiddleware());
+  app.use("*", requestLoggerMiddleware(log10));
   if (serverConfig.cors) {
     app.use("*", corsMiddleware(serverConfig.cors));
   }
@@ -4289,7 +4836,7 @@ function createApp(config) {
     defaultAgent,
     tracer,
     startTime: Date.now(),
-    version: "0.1.0",
+    version: config.version ?? "0.2.2",
     providers: providerNames
   });
   app.route("/", routes);
@@ -4305,13 +4852,25 @@ function createApp(config) {
         port: listenPort,
         hostname
       });
-      log4.info("ElsiumAI server started", {
+      let shutdownManager;
+      if (serverConfig.gracefulShutdown) {
+        const drainTimeoutMs = typeof serverConfig.gracefulShutdown === "object" ? serverConfig.gracefulShutdown.drainTimeoutMs : undefined;
+        shutdownManager = createShutdownManager({
+          drainTimeoutMs,
+          onDrainStart: () => log10.info("Draining connections..."),
+          onDrainComplete: () => log10.info("Drain complete")
+        });
+      }
+      log10.info("ElsiumAI server started", {
         url: `http://${hostname}:${listenPort}`,
         routes: ["POST /chat", "POST /complete", "GET /health", "GET /metrics", "GET /agents"]
       });
       return {
         port: listenPort,
-        stop: () => {
+        stop: async () => {
+          if (shutdownManager) {
+            await shutdownManager.shutdown();
+          }
           server.close();
         }
       };
@@ -4319,7 +4878,7 @@ function createApp(config) {
   };
 }
 // src/rbac.ts
-var log5 = createLogger();
+var log11 = createLogger();
 var BUILT_IN_ROLES = [
   {
     name: "admin",
@@ -4357,7 +4916,7 @@ function matchPermission(granted, required) {
 }
 function createRBAC(config) {
   if (config.trustRoleHeader === true) {
-    log5.warn("RBAC: trustRoleHeader is enabled — any client can self-assign roles via the X-Role header. Only use this in development or behind a trusted reverse proxy.");
+    log11.warn("RBAC: trustRoleHeader is enabled — any client can self-assign roles via the X-Role header. Only use this in development or behind a trusted reverse proxy.");
   }
   const roleMap = new Map;
   for (const role of BUILT_IN_ROLES) {
@@ -4413,8 +4972,62 @@ function createRBAC(config) {
     }
   };
 }
+// src/tenant.ts
+var log12 = createLogger();
+function tenantMiddleware(config) {
+  const { extractTenant, onUnknownTenant = "reject", defaultTenant } = config;
+  return async (c, next) => {
+    const tenant = extractTenant(c);
+    if (!tenant) {
+      if (onUnknownTenant === "default" && defaultTenant) {
+        c.set("tenant", defaultTenant);
+        log12.debug("Using default tenant", { tenantId: defaultTenant.tenantId });
+      } else {
+        return c.json({ error: "Tenant identification required" }, 401);
+      }
+    } else {
+      c.set("tenant", tenant);
+      log12.debug("Tenant identified", { tenantId: tenant.tenantId });
+    }
+    await next();
+  };
+}
+function tenantRateLimitMiddleware() {
+  const windows = new Map;
+  return async (c, next) => {
+    const tenant = c.get("tenant");
+    if (!tenant?.limits?.maxRequestsPerMinute) {
+      await next();
+      return;
+    }
+    const limit = tenant.limits.maxRequestsPerMinute;
+    const now = Date.now();
+    const windowMs = 60000;
+    const key = tenant.tenantId;
+    let entry = windows.get(key);
+    if (!entry || now - entry.windowStart > windowMs) {
+      entry = { count: 0, windowStart: now };
+      windows.set(key, entry);
+    }
+    entry.count++;
+    if (entry.count > limit) {
+      return c.json({
+        error: "Rate limit exceeded",
+        retryAfterMs: windowMs - (now - entry.windowStart)
+      }, 429);
+    }
+    await next();
+  };
+}
 export {
+  tenantRateLimitMiddleware,
+  tenantMiddleware,
+  streamResponse,
+  sseHeaders,
+  requestLoggerMiddleware,
+  requestIdMiddleware,
   rateLimitMiddleware,
+  formatSSE,
   createRoutes,
   createRBAC,
   createApp,