@gentbajko/slopify 3.25.8 → 4.0.0

package/dist/adapters/llm/codex-limits.js

@@ -1,10 +1,8 @@
-import { spawn } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { z } from "zod";
 import { cliCommand } from "../../kernel/cli-command.js";
 import { isoOfEpoch, windowKindOf, } from "../../kernel/ports/plan-limits.js";
+import { withChildSession } from "./child-session.js";
+import { lines } from "./sse-lines.js";
 // The Codex plan windows. `codex exec --json` reports none, so they are asked of the CLI's
 // app server with `account/rateLimits/read` - a metadata-only exchange that starts no thread
 // and spends nothing. Measured on 0.155.1: the reply carries `rateLimits.primary` and
@@ -40,49 +38,26 @@ export function codexWindows(result) {
 // method, a slow start: the windows are reported beside a run, never needed for it.
 export async function nodeCodexLimits(binary, env, timeoutMs = 10_000) {
     const command = cliCommand(binary);
-    const directory = await mkdtemp(join(tmpdir(), "slopify-codex-limits-"));
-    const child = spawn(command.file, [...command.args, "app-server", "--listen", "stdio://"], {
-        cwd: directory,
-        env: { ...env, PWD: directory },
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true,
-        detached: process.platform !== "win32",
-    });
-    child.on("error", () => { });
-    child.stdin.on("error", () => { });
-    child.stderr.resume();
-    const closed = new Promise((resolve) => child.once("close", () => resolve()));
-    const terminate = (signal) => {
-        if (process.platform !== "win32" && child.pid !== undefined) {
-            try {
-                process.kill(-child.pid, signal);
-                return;
-            }
-            catch {
-                /* The process may already have exited. */
-            }
-        }
-        child.kill(signal);
-    };
-    const timer = setTimeout(() => terminate("SIGKILL"), timeoutMs);
-    const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
-    let buffer = "";
-    try {
-        send({
-            id: 1,
-            method: "initialize",
-            params: { clientInfo: { name: "slopify_limits", version: "1.0" } },
-        });
-        child.stdout.setEncoding("utf8");
-        for await (const piece of child.stdout) {
-            buffer += piece;
-            if (buffer.length > 1024 * 1024)
-                return null;
-            let newline = buffer.indexOf("\n");
-            while (newline >= 0) {
-                const line = buffer.slice(0, newline).trim();
-                buffer = buffer.slice(newline + 1);
-                newline = buffer.indexOf("\n");
+    const oversize = () => new Error("Oversized reply");
+    return withChildSession({
+        file: command.file,
+        args: [...command.args, "app-server", "--listen", "stdio://"],
+        env: (directory) => ({ ...env, PWD: directory }),
+        directoryPrefix: "slopify-codex-limits-",
+        timeoutMs,
+        graceMs: 1000,
+    }, async ({ child, send }) => {
+        try {
+            send({
+                id: 1,
+                method: "initialize",
+                params: { clientInfo: { name: "slopify_limits", version: "1.0" } },
+            });
+            for await (const raw of lines(child.stdout, undefined, {
+                chars: 1024 * 1024,
+                error: oversize,
+            })) {
+                const line = raw.trim();
                 if (line === "")
                     continue;
                 const reply = z
@@ -99,28 +74,12 @@ export async function nodeCodexLimits(binary, env, timeoutMs = 10_000) {
                     return windows.length === 0 ? null : windows;
                 }
             }
+            return null;
         }
-        return null;
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-        terminate("SIGTERM");
-        let grace;
-        await Promise.race([
-            closed,
-            new Promise((resolve) => {
-                grace = setTimeout(() => {
-                    terminate("SIGKILL");
-                    resolve();
-                }, 1000);
-            }),
-        ]);
-        clearTimeout(grace);
-        await rm(directory, { recursive: true, force: true });
-    }
+        catch {
+            return null;
+        }
+    });
 }
 const months = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
 // Codex refuses a turn over the plan's allowance with "You've hit your usage limit. … Try

package/dist/adapters/llm/codex-server-models.js

@@ -1,10 +1,8 @@
-import { spawn } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { z } from "zod";
 import { cliCommand } from "../../kernel/cli-command.js";
 import { thinkingModes as knownEfforts } from "../../kernel/ports/llm.js";
+import { cappedOutput, withChildSession } from "./child-session.js";
+import { lines } from "./sse-lines.js";
 const text = z
     .string()
     .trim()
@@ -28,39 +26,18 @@ const pageSchema = z.object({
 // model/list is a metadata-only app-server exchange: no thread, turn or tool is started.
 export async function nodeCodexServerModels(binary, env, timeoutMs = 15_000) {
     const command = cliCommand(binary);
-    const directory = await mkdtemp(join(tmpdir(), "slopify-codex-models-"));
-    const child = spawn(command.file, [...command.args, "app-server", "--listen", "stdio://"], {
-        cwd: directory,
-        env: { ...env, PWD: directory },
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true,
-        detached: process.platform !== "win32",
-    });
-    child.on("error", () => { });
-    child.stdin.on("error", () => { });
-    child.stderr.resume();
-    const closed = new Promise((resolve) => child.once("close", () => resolve()));
-    function terminate(signal) {
-        if (process.platform !== "win32" && child.pid !== undefined) {
-            try {
-                process.kill(-child.pid, signal);
-                return;
-            }
-            catch {
-                /* The process may already have exited. */
-            }
-        }
-        child.kill(signal);
-    }
-    const timer = setTimeout(() => terminate("SIGKILL"), timeoutMs);
-    const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
-    let expectedId = 1;
-    let pages = 0;
-    let bytes = 0;
-    let buffer = "";
-    const models = new Map();
-    const cursors = new Set();
-    try {
+    return withChildSession({
+        file: command.file,
+        args: [...command.args, "app-server", "--listen", "stdio://"],
+        env: (directory) => ({ ...env, PWD: directory }),
+        directoryPrefix: "slopify-codex-models-",
+        timeoutMs,
+        graceMs: 500,
+    }, async ({ child, send }) => {
+        let expectedId = 1;
+        let pages = 0;
+        const models = new Map();
+        const cursors = new Set();
         send({
             id: expectedId,
             method: "initialize",
@@ -68,83 +45,58 @@ export async function nodeCodexServerModels(binary, env, timeoutMs = 15_000) {
                 clientInfo: { name: "slopify_model_discovery", version: "1.0" },
             },
         });
-        child.stdout.setEncoding("utf8");
-        for await (const piece of child.stdout) {
-            bytes += Buffer.byteLength(piece);
-            if (bytes > 4 * 1024 * 1024)
-                throw new Error("Oversized metadata");
-            buffer += piece;
-            let newline = buffer.indexOf("\n");
-            while (newline >= 0) {
-                const line = buffer.slice(0, newline).trim();
-                buffer = buffer.slice(newline + 1);
-                newline = buffer.indexOf("\n");
-                if (line === "")
-                    continue;
-                const event = z
-                    .object({
-                    id: z.unknown().optional(),
-                    result: z.unknown().optional(),
-                    error: z.unknown().optional(),
-                })
-                    .parse(JSON.parse(line));
-                if (event.id !== expectedId)
-                    continue;
-                if (event.error !== undefined)
-                    throw new Error("Discovery refused");
-                let cursor;
-                if (expectedId === 1) {
-                    send({ method: "initialized" });
+        const oversize = () => new Error("Oversized metadata");
+        for await (const raw of lines(cappedOutput(child.stdout, 4 * 1024 * 1024, oversize))) {
+            const line = raw.trim();
+            if (line === "")
+                continue;
+            const event = z
+                .object({
+                id: z.unknown().optional(),
+                result: z.unknown().optional(),
+                error: z.unknown().optional(),
+            })
+                .parse(JSON.parse(line));
+            if (event.id !== expectedId)
+                continue;
+            if (event.error !== undefined)
+                throw new Error("Discovery refused");
+            let cursor;
+            if (expectedId === 1) {
+                send({ method: "initialized" });
+            }
+            else {
+                const page = pageSchema.parse(event.result);
+                for (const row of page.data) {
+                    if (row.hidden === true || models.has(row.model))
+                        continue;
+                    const thinkingModes = row.supportedReasoningEfforts
+                        ?.map((item) => item.reasoningEffort)
+                        .filter((effort) => knownEfforts.includes(effort));
+                    models.set(row.model, {
+                        id: row.model,
+                        name: codexModelName(row.displayName),
+                        ...(thinkingModes?.length ? { thinkingModes } : {}),
+                    });
                 }
-                else {
-                    const page = pageSchema.parse(event.result);
-                    for (const row of page.data) {
-                        if (row.hidden === true || models.has(row.model))
-                            continue;
-                        const thinkingModes = row.supportedReasoningEfforts
-                            ?.map((item) => item.reasoningEffort)
-                            .filter((effort) => knownEfforts.includes(effort));
-                        models.set(row.model, {
-                            id: row.model,
-                            name: codexModelName(row.displayName),
-                            ...(thinkingModes?.length ? { thinkingModes } : {}),
-                        });
-                    }
-                    cursor = page.nextCursor;
-                    if (!cursor) {
-                        if (models.size === 0)
-                            throw new Error("No visible models");
-                        return [...models.values()];
-                    }
-                    if (cursors.has(cursor) || ++pages >= 20)
-                        throw new Error("Invalid pagination");
-                    cursors.add(cursor);
+                cursor = page.nextCursor;
+                if (!cursor) {
+                    if (models.size === 0)
+                        throw new Error("No visible models");
+                    return [...models.values()];
                 }
-                send({
-                    id: ++expectedId,
-                    method: "model/list",
-                    params: { limit: 100, includeHidden: false, ...(cursor ? { cursor } : {}) },
-                });
+                if (cursors.has(cursor) || ++pages >= 20)
+                    throw new Error("Invalid pagination");
+                cursors.add(cursor);
             }
+            send({
+                id: ++expectedId,
+                method: "model/list",
+                params: { limit: 100, includeHidden: false, ...(cursor ? { cursor } : {}) },
+            });
         }
         throw new Error("Discovery ended before its reply");
-    }
-    finally {
-        clearTimeout(timer);
-        terminate("SIGTERM");
-        let grace;
-        await Promise.race([
-            closed,
-            new Promise((resolve) => {
-                grace = setTimeout(() => {
-                    terminate("SIGKILL");
-                    resolve();
-                }, 500);
-            }),
-        ]);
-        clearTimeout(grace);
-        await rm(directory, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 });
-    }
+    });
 }
 export function codexModelName(name) {
     return name.replace(/^(GPT-\d+(?:\.\d+)?)-/i, "$1 ");

package/dist/adapters/llm/codex.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
 import { cliCheck, cliReported } from "../explain.js";
+import { accessField } from "../model-access.js";
 import { cliLoginError } from "./cli-login-error.js";
 import { codexPlanLimit } from "./codex-limits.js";
 import { nodeCodexModels } from "./codex-models.js";
@@ -52,7 +53,10 @@ const disabledFeatures = [
 // "-i, --image <FILE>... Optional image(s) to attach to the initial prompt"), which needs no
 // tool: `view_image` stays disabled. Each is given as its own flag so a path is never read as
 // the prompt.
-export function codexArgs(req, directory, documents, images) {
+// One ephemeral, read-only turn in `directory` with every local tool, hook, plugin, skill and
+// project document left out. The content adapter and the in-app assistant (`assistant-cli.ts`)
+// both start from it and add their own instructions, search setting and MCP servers.
+export function hardenedCodexBase(directory) {
     return [
         "exec",
         "--json",
@@ -86,6 +90,11 @@ export function codexArgs(req, directory, documents, images) {
         "include_environment_context=false",
         "-c",
         'shell_environment_policy.inherit="none"',
+    ];
+}
+export function codexArgs(req, directory, documents, images) {
+    return [
+        ...hardenedCodexBase(directory),
         "-c",
         `instructions=${JSON.stringify(writingRole + (documents ? " Use the explicitly supplied research MCP tool to read request documents; it is the only permitted local reference source." : ""))}`,
         "-c",
@@ -221,6 +230,7 @@ export function codexLlm(deps) {
                         throw codexLimitError(failed, planLimit);
                     throw providerError({
                         kind: "other",
+                        ...accessField(null, failed),
                         message: cliReported(binary, redact(cliShaped(binary, turnFailed, event.value).error.message), cliCheck(binary)),
                     });
                 }
@@ -234,6 +244,7 @@ export function codexLlm(deps) {
                         throw codexLimitError(failed, planLimit);
                     throw providerError({
                         kind: "other",
+                        ...accessField(null, failed),
                         message: cliReported(binary, redact(cliShaped(binary, errorEvent, event.value).message), cliCheck(binary)),
                     });
                 }

package/dist/adapters/llm/openrouter.js

@@ -2,8 +2,9 @@ import { z } from "zod";
 import { redact } from "../../kernel/log.js";
 import { documentMessages } from "../../kernel/ports/llm-documents.js";
 import { providerError } from "../../kernel/ports/model.js";
-import { droppedStream, httpFailure, missingKey, providerSaid, refreshList, unreadable, } from "../explain.js";
-import { retryAfter } from "../retry-after.js";
+import { droppedStream, httpFailure, providerSaid, refreshList, unreadable } from "../explain.js";
+import { failureText, httpProviderError, kindOfStatus, requireKey, safeJson, } from "../http-failure.js";
+import { accessField, modelAccessOf } from "../model-access.js";
 import { noImages } from "./image-workspace.js";
 import { sseData } from "./sse-lines.js";
 // The HTTP gateway adapter: the platform's own `fetch` plus the line reader beside this
@@ -86,7 +87,8 @@ export function openRouterLlm(deps) {
                 // A stream that has already answered 200 reports a mid-flight failure in a data
                 // frame; without this the stage would store half an article as a success.
                 throw providerError({
-                    kind: kindOf(statusOf(chunk.error.code)),
+                    kind: kindOfStatus(statusOf(chunk.error.code)),
+                    ...accessField(statusOf(chunk.error.code), chunk.error.message),
                     message: streamFailure(statusOf(chunk.error.code), redact(chunk.error.message)),
                 });
             }
@@ -147,47 +149,16 @@ export function openRouterLlm(deps) {
     };
 }
 function headers(key) {
-    // An attempt that finds no key fails rather than calling anonymously
-    // and being told off by the provider in words the user cannot act on. `missing_key`
-    // rather than `auth` because the same rule makes it terminal: there is nothing to
-    // retry until the user saves a key, and the wrapper is where that is decided.
-    if (key === undefined || key === "") {
-        throw providerError({ kind: "missing_key", message: missingKey("OpenRouter") });
-    }
-    return { Authorization: `Bearer ${key}`, ...appHeaders };
-}
-// Only the adapter sees the vendor's status code, so only the adapter names the kind.
-function kindOf(status) {
-    if (status === 401 || status === 403) {
-        return "auth";
-    }
-    if (status === 429) {
-        return "rate_limit";
-    }
-    // ceiling: everything else is `other` and is retried, so a 400 or a 402 fails the same
-    // way four times over. A terminal "this will never work" kind has to reach the port's
-    // error contract first, which is not this adapter's to widen.
-    // The provider's own server failed; the same request may well succeed later.
-    if (status >= 500)
-        return "dropped";
-    return "other";
+    // An attempt that finds no key fails rather than calling anonymously and being told off by
+    // the provider in words the user cannot act on.
+    return { Authorization: `Bearer ${requireKey(key, "OpenRouter")}`, ...appHeaders };
 }
 async function failure(response, next) {
-    const text = await response.text().catch(() => "");
+    const text = await failureText(response);
     const parsed = errorBody.safeParse(safeJson(text));
     // The provider's own words, through the redactor - an error body may quote the key back.
     const message = redact(parsed.success ? parsed.data.error.message : text.trim() || response.statusText);
-    const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-    return providerError({
-        kind: kindOf(response.status),
-        message: httpFailure({
-            provider: "OpenRouter",
-            status: response.status,
-            detail: message,
-            next,
-        }),
-        ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
-    });
+    return httpProviderError(response, kindOfStatus(response.status), httpFailure({ provider: "OpenRouter", status: response.status, detail: message, next }), undefined, modelAccessOf(response.status, message));
 }
 // A mid-stream error carries an HTTP-like code; with none, the provider's words are all there is.
 function streamFailure(status, detail) {
@@ -211,11 +182,3 @@ function parseChunk(data) {
     }
     return parsed.data;
 }
-function safeJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-}

package/dist/adapters/llm/run-cli.js

@@ -4,6 +4,7 @@ import { cliCommand } from "../../kernel/cli-command.js";
 import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
 import { cliName, commandOf, quoted } from "../explain.js";
+import { safeJson } from "../http-failure.js";
 // ceiling: the last 8 KiB of stderr is kept. A CLI that writes megabytes of progress there
 // would otherwise be held in memory for the length of a run, and the tail is the part that
 // says why it stopped. Streaming stderr to the log is the upgrade if a provider ever
@@ -108,7 +109,7 @@ export function nodeRunCli(binary, args, signal, options) {
     return {
         ...(inputWritten === undefined ? {} : { inputWritten }),
         pid: child.pid,
-        stdout: child.stdout === null ? nothing : bytesOf(child.stdout),
+        stdout: bytesOf(child.stdout),
         stderr: () => stderr,
         ended,
         kill: terminate,
@@ -181,13 +182,6 @@ export function endedKind(ended) {
 export function stuckCli(binary) {
     return `The ${cliName(binary)} stopped responding and could not be shut down. Close any leftover ${commandOf(binary)} processes or restart your computer, then use Try again.`;
 }
-// Unreachable while stdio names `pipe` for fd 1; it is here so the type carries no null
-// and no non-null assertion is needed to read the stream.
-const nothing = {
-    [Symbol.asyncIterator]: () => ({
-        next: () => Promise.resolve({ done: true, value: undefined }),
-    }),
-};
 const typed = z.object({ type: z.string() });
 // A JSONL line off a CLI's stdout. The raw value travels with its `type` because a schema
 // that names only `type` strips every other key, and each event's own shape is checked
@@ -215,22 +209,12 @@ export function cliShaped(binary, schema, value) {
     }
     return parsed.data;
 }
+// fd 1 is always a pipe with no encoding, so its pieces are bytes; the null check is for the type.
 async function* bytesOf(source) {
+    if (source === null)
+        return;
     for await (const piece of source) {
-        if (typeof piece === "string") {
-            yield new TextEncoder().encode(piece);
-            continue;
-        }
-        if (piece instanceof Uint8Array) {
+        if (piece instanceof Uint8Array)
             yield piece;
-        }
-    }
-}
-function safeJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
     }
 }

package/dist/adapters/llm/sse-lines.js

@@ -5,7 +5,9 @@
 // the middle of one, or inside a multi-byte character. TextDecoder's streaming mode holds
 // back the tail of a split UTF-8 sequence instead of emitting a replacement character,
 // and the leftover buffer holds back a split line.
-export async function* lines(chunks, signal) {
+export async function* lines(chunks, signal, 
+// A producer that never ends a line would otherwise grow the buffer without bound.
+pending) {
     const decoder = new TextDecoder("utf-8");
     let buffer = "";
     for await (const chunk of chunks) {
@@ -15,6 +17,8 @@ export async function* lines(chunks, signal) {
             yield withoutCr(buffer.slice(0, at));
             buffer = buffer.slice(at + 1);
         }
+        if (pending !== undefined && buffer.length > pending.chars)
+            throw pending.error();
     }
     buffer += decoder.decode();
     // A producer that ends without a trailing newline still wrote a whole line, and one cut

package/dist/adapters/model-access.js

@@ -0,0 +1,37 @@
+// Whether a provider's failure says the account can't use the chosen model. Read from the
+// status and the provider's own words, since only the adapter sees them; it never changes the
+// error's kind, so a run fails exactly as before. Undefined: the failure says nothing about
+// the model.
+// Not-found comes first: OpenAI's "does not exist or you do not have access to it" is about a
+// model id, not a plan. The loose phrases count only when the text is about a model, so a
+// voice or a file that does not exist is not mistaken for one.
+const notFound = /model_not_found|not a valid model|model not found|no endpoints found|invalid model|unknown model|is not found for api version|models\/[^ ]+ is not found/i;
+const looseNotFound = /does not exist|may not exist|not[_ ]found/i;
+const noAccess = /not supported when using codex with a chatgpt account|not (?:available|included|supported) (?:on|in|for|with) your (?:current )?(?:plan|account|subscription|tier|region|country)|upgrade your (?:plan|subscription)|must be verified to use the model|does not have access to (?:the )?model|do not have access to (?:this|the) model|not allowed to (?:use|access) (?:this|the) model|requires a paid plan/i;
+const mentionsModel = /\bmodel/i;
+// `atModel`: the request went to the model's own address (fal.ai's and Replicate's endpoints,
+// Google's models/<id>), so a 404 or 403 there is about the model whatever the words say.
+export function modelAccessOf(status, text, atModel = false) {
+    if (notFound.test(text))
+        return "not-found";
+    // "Upgrade your plan" or "not found" alone is as often about credits, a voice or a feature
+    // as about a model.
+    if (mentionsModel.test(text)) {
+        if (looseNotFound.test(text))
+            return "not-found";
+        if (noAccess.test(text))
+            return "no-access";
+    }
+    else if (!atModel)
+        return undefined;
+    if (status === 404)
+        return "not-found";
+    if (status === 403)
+        return "no-access";
+    return undefined;
+}
+// Spread into a providerError init.
+export function accessField(status, text, atModel = false) {
+    const access = modelAccessOf(status, text, atModel);
+    return access === undefined ? {} : { access };
+}

package/dist/adapters/tts/cartesia.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
 import { redact } from "../../kernel/log.js";
 import { providerError } from "../../kernel/ports/model.js";
-import { httpFailure, missingKey, noAudio, voiceFix } from "../explain.js";
-import { retryAfter } from "../retry-after.js";
+import { httpFailure, noAudio, voiceFix } from "../explain.js";
+import { failureText, httpProviderError, kindOfStatus, requireKey, safeJson, } from "../http-failure.js";
+import { modelAccessOf } from "../model-access.js";
 import { cartesiaLanguages, lookUp } from "./voice-languages.js";
 // The HTTP gateway adapter for Cartesia. `fetch` and
 // nothing else; `/tts/bytes` streams the audio it renders, so the response body is
@@ -69,45 +70,21 @@ export function cartesiaTts(deps) {
     };
 }
 function keyOf(deps) {
-    const key = deps.key();
-    // An absent key is terminal, so it never becomes a request.
-    if (key === undefined || key === "") {
-        throw providerError({ kind: "missing_key", message: missingKey("Cartesia") });
-    }
-    return key;
-}
-function kindOf(status) {
-    if (status === 401 || status === 403) {
-        return "auth";
-    }
-    // `concurrency_limited` is the plan's own limit and arrives as a 429 like any other, so
-    // the status is enough and the code below only reaches the message.
-    if (status === 429) {
-        return "rate_limit";
-    }
-    // ceiling: as in the other two adapters, everything else is `other` and is retried.
-    // The provider's own server failed; the same request may well succeed later.
-    if (status >= 500)
-        return "dropped";
-    return "other";
+    return requireKey(deps.key(), "Cartesia");
 }
 async function failure(response, voiceId) {
-    const text = await response.text().catch(() => "");
+    const text = await failureText(response);
     const message = redact(detailOf(text) || response.statusText);
-    const retryAfterMs = retryAfter(response.headers.get("retry-after"));
-    return providerError({
-        kind: kindOf(response.status),
-        // `voice_not_found` has to say which voice was asked for; Cartesia's
-        // own message does not repeat the id.
-        message: httpFailure({
-            provider: "Cartesia",
-            status: response.status,
-            detail: message,
-            subject: `narration request for voice "${voiceId}"`,
-            fix: voiceFix(voiceId),
-        }),
-        ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
-    });
+    return httpProviderError(response, kindOfStatus(response.status), 
+    // `voice_not_found` has to say which voice was asked for; Cartesia's
+    // own message does not repeat the id.
+    httpFailure({
+        provider: "Cartesia",
+        status: response.status,
+        detail: message,
+        subject: `narration request for voice "${voiceId}"`,
+        fix: voiceFix(voiceId),
+    }), undefined, modelAccessOf(response.status, text));
 }
 function detailOf(text) {
     const parsed = errorBody.safeParse(safeJson(text));
@@ -120,11 +97,3 @@ function detailOf(text) {
     const parts = [code, message].filter((part) => part !== undefined && part !== "");
     return parts.length === 0 ? text.trim() : parts.join(": ");
 }
-function safeJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-}