@genesislcap/foundation-ai 15.40.0 → 15.42.0

package/dist/esm/transports/post-with-retry.js

@@ -3,6 +3,7 @@ import { authoritativeAbortReason } from '../utils/abort-reason';
 import { abortableDelay } from '../utils/abortable-delay';
 import { combineSignals } from '../utils/combine-signals';
 import { logger } from '../utils/logger';
+import { AI_SERVICE_ERROR_CODES, AIServiceError, aiServiceAccessRefusalOf, aiServiceDetailOf, aiServiceErrorCodeOf, isUncodedTooLarge, routerRefusalDetailOf, } from './ai-service-error';
 import { budgetExhaustedFrom, codeOf, isBudgetRejection, parseJsonOrUndefined, } from './budget-exhausted-error';
 import { ContextOverflowError, contextOverflowOf } from './context-overflow-error';
 import { readFramedBody } from './ndjson-frames';
@@ -19,11 +20,17 @@ const MAX_RETRIES = 5;
  */
 export function postWithRetry(options) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const { url, headers, body, credentials, vendorLabel, retryableStatuses, timeout, stallTimeout, backoffBaseMs, signal, } = options;
         // The vendor behind this transport's label, resolved once — the refusal classifier dispatches on
         // it, and it is the only vendor knowledge this envelope needs (GENC-1506).
         const vendor = vendorOfTransportLabel(vendorLabel);
+        // The service's own text is logged here, for whoever runs the app; the error's message leaves it
+        // out, because that message reaches places that keep it (GENC-1611).
+        const serviceRefusal = (code, status, detail) => {
+            logger.error(`${vendorLabel}Transport: the AI service refused the request (${status} ${code})${detail ? `: ${detail}` : ''}`);
+            return new AIServiceError(vendorLabel, code, status, detail);
+        };
         // Total time this sequence has spent waiting BEYOND its own ladder because a server asked it to.
         // The per-attempt cap alone is not a bound on the sequence — five capped waits is five minutes, with
         // no timer running through any of them — so the allowance is tracked here and spent down across
@@ -164,6 +171,26 @@ export function postWithRetry(options) {
                     if (isBudgetRejection(response.status, codeOf(parsed))) {
                         throw budgetExhaustedFrom(vendorLabel, parsed, errText || undefined);
                     }
+                    // The AI SERVICE wall (GENC-1611): the app's own endpoint naming what is wrong. Keyed on the
+                    // code, not the status, so a missing key costs one request whether it comes as the app
+                    // proxy's 424 or as Create's 503. VENDOR_UNREACHABLE keeps the ladder below and is only
+                    // named once the ladder gives up.
+                    const serviceCode = aiServiceErrorCodeOf(codeOf(parsed));
+                    if (serviceCode && serviceCode !== AI_SERVICE_ERROR_CODES.VENDOR_UNREACHABLE) {
+                        throw serviceRefusal(serviceCode, response.status, aiServiceDetailOf(parsed));
+                    }
+                    // The app's router turned the request away before the service ran: no session, or not the
+                    // right the endpoint demands. Its NACK carries no code and no vendor envelope, which is what
+                    // tells it apart from a vendor's own 401/403 (the provider wall above, or passed through).
+                    const accessRefusal = aiServiceAccessRefusalOf(response.status, parsed, errText);
+                    if (accessRefusal) {
+                        throw serviceRefusal(accessRefusal, response.status, (_e = routerRefusalDetailOf(parsed)) !== null && _e !== void 0 ? _e : (errText || undefined));
+                    }
+                    // A 413 with no code is a size cap in front of the endpoint (the router's, or a proxy's), which
+                    // answers before the endpoint can. It is never worth sending again.
+                    if (isUncodedTooLarge(response.status, parsed)) {
+                        throw serviceRefusal(AI_SERVICE_ERROR_CODES.REQUEST_TOO_LARGE, response.status, errText || undefined);
+                    }
                     // An explicit `x-should-retry: false` outranks our own retryable-status set (GENC-1506).
                     // The provider knows things the status does not — a 429 it will keep refusing, say — and
                     // Anthropic's own SDK honours this header. Absent means "no opinion", never `false`.
@@ -177,12 +204,15 @@ export function postWithRetry(options) {
                         yield backoff(attempt, retryAfterMs(response.headers) || retryInfoMs(parsed));
                         continue;
                     }
+                    if (serviceCode) {
+                        throw serviceRefusal(serviceCode, response.status, aiServiceDetailOf(parsed));
+                    }
                     throw new Error(`${vendorLabel} request error ${response.status}: ${errText}`);
                 }
                 // The proxy streams NDJSON heartbeat frames when it supports them; an old
                 // proxy ignores our Accept header and returns plain JSON, so branch on
                 // what actually came back.
-                if (((_f = (_e = response.headers) === null || _e === void 0 ? void 0 : _e.get('content-type')) === null || _f === void 0 ? void 0 : _f.toLowerCase().includes('application/x-ndjson')) &&
+                if (((_g = (_f = response.headers) === null || _f === void 0 ? void 0 : _f.get('content-type')) === null || _g === void 0 ? void 0 : _g.toLowerCase().includes('application/x-ndjson')) &&
                     response.body) {
                     rearmStallTimer();
                     const frame = yield readFramedBody(response.body, rearmStallTimer, vendorLabel, stallTimeout);
@@ -194,7 +224,7 @@ export function postWithRetry(options) {
                     if (frame.code === 'UPSTREAM_STALLED') {
                         // The proxy watchdog saw no upstream data — same tagged shape as a
                         // local stall, so the driver's TimeoutError branch handles both.
-                        throw new DOMException(`${vendorLabel} request stalled: ${(_g = frame.error) !== null && _g !== void 0 ? _g : 'no upstream data'}`, 'TimeoutError');
+                        throw new DOMException(`${vendorLabel} request stalled: ${(_h = frame.error) !== null && _h !== void 0 ? _h : 'no upstream data'}`, 'TimeoutError');
                     }
                     // The budget wall, framed (GENC-1464) — the in-band twin of the 402 above,
                     // through the same predicate, keyed on status OR code. Classified before
@@ -214,11 +244,16 @@ export function postWithRetry(options) {
                     }
                     const framedOverflow = contextOverflowOf(vendor, frame.status, frame);
                     if (framedOverflow) {
-                        throw new ContextOverflowError(vendorLabel, framedOverflow.promptTokens, framedOverflow.limitTokens, (_h = framedOverflow.message) !== null && _h !== void 0 ? _h : frame.error);
+                        throw new ContextOverflowError(vendorLabel, framedOverflow.promptTokens, framedOverflow.limitTokens, (_j = framedOverflow.message) !== null && _j !== void 0 ? _j : frame.error);
                     }
                     if (isBudgetRejection(frame.status, frame.code)) {
                         throw budgetExhaustedFrom(vendorLabel, frame);
                     }
+                    // The AI SERVICE wall, framed — the same rule as the legacy branch above.
+                    const framedServiceCode = aiServiceErrorCodeOf(frame.code);
+                    if (framedServiceCode && framedServiceCode !== AI_SERVICE_ERROR_CODES.VENDOR_UNREACHABLE) {
+                        throw serviceRefusal(framedServiceCode, frame.status, aiServiceDetailOf(frame));
+                    }
                     // An in-band retryable status joins the same attempt/backoff ladder as
                     // its HTTP-status equivalent (shared attempt counter). No `x-should-retry` to consult here —
                     // in framed mode the HTTP response is the proxy's own 200, so its headers say nothing about
@@ -229,7 +264,10 @@ export function postWithRetry(options) {
                         yield backoff(attempt, retryInfoMs(frame));
                         continue;
                     }
-                    throw new Error(`${vendorLabel} request error ${frame.status}: ${(_j = frame.error) !== null && _j !== void 0 ? _j : JSON.stringify(frame.details)}`);
+                    if (framedServiceCode) {
+                        throw serviceRefusal(framedServiceCode, frame.status, aiServiceDetailOf(frame));
+                    }
+                    throw new Error(`${vendorLabel} request error ${frame.status}: ${(_k = frame.error) !== null && _k !== void 0 ? _k : JSON.stringify(frame.details)}`);
                 }
                 return (yield response.json());
             }