@mupt-ai/dari-gateway 0.2.0 → 0.3.0

package/dist/self_host/platform.js

@@ -0,0 +1,50 @@
+import { errorCode } from "../http/errors.js";
+import { resolveSelfHostedRouter } from "./resolve.js";
+/**
+ * The self-hosted platform: routers from the config file, subscriptions and
+ * prefix-cache state in the gateway's SQLite database, and one content-free
+ * log line per request.
+ */
+export function createSelfHostedPlatform(deps) {
+    const resolver = {
+        ...deps,
+        prefixHits: (args) => deps.prefixes.hits(args),
+    };
+    return {
+        resolveRouter: (request) => resolveSelfHostedRouter(resolver, request),
+        writePrefixState: async (write) => {
+            deps.prefixes.write(write);
+        },
+        writePendingLease: async (write) => {
+            deps.prefixes.writePendingLease(write, deps.config.routers[write.router_id]?.zdr ?? false);
+        },
+        markSubscriptionUnavailable: async (hold) => hold.credentialId !== undefined &&
+            deps.subscriptions.markUnavailable(hold.credentialId, hold.limit.resetsAt, hold.limit.reason),
+        async recordUsage() {
+            // Resolution never reports a "managed" key source here.
+            throw new Error("The self-hosted gateway has no managed provider keys to account.");
+        },
+        recordRequest(record) {
+            console.info("routing request", JSON.stringify(record.summary));
+        },
+        captureRequestError(error, context) {
+            if (context.status < 500)
+                return;
+            console.error("routing request error", JSON.stringify({
+                router_id: context.routerId,
+                request_id: context.requestId ?? null,
+                source_protocol: context.sourceProtocol,
+                status: context.status,
+                error_code: errorCode(error, "internal_error"),
+            }));
+        },
+        captureOperationalError(error, context) {
+            console.error("gateway operational error", JSON.stringify({
+                code: context.code,
+                request_id: context.requestId ?? null,
+                router_id: context.routerId ?? null,
+                error: error instanceof Error ? error.message : String(error),
+            }));
+        },
+    };
+}

package/dist/self_host/prefix_store.d.ts

@@ -0,0 +1,46 @@
+/**
+ * SQLite storage for per-turn conversation prefix state: the entries that
+ * resolve returns as prefix hits (cache warmth, conversation identity, the
+ * previous routing decision) and the prefetched lease stamped onto them.
+ *
+ * Rows hold hashes, identifiers, and token counts. Under ZDR the free-text
+ * fields (`reason`, pending-lease reason and selector output) are dropped
+ * before they are written.
+ *
+ * Freshness only advances: every write is guarded by `updated_at`, so
+ * duplicate or out-of-order applications of the same turn are no-ops.
+ * Timestamps are stored as epoch milliseconds.
+ */
+import type { Database } from "bun:sqlite";
+import type { RouterPrefixHit } from "@mupt-ai/dari-router/policy-engine";
+import type { PendingLeaseWrite, PrefixStateWrite } from "../platform/platform.js";
+export declare class PrefixStore {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * Apply one turn's prefix entry and/or refresh the entry whose cache it
+     * read. Freshness is stamped with the request's `received_at` (provider
+     * caches are read at the start of the serving request), never write time.
+     * Returns false, writing nothing, when the entry violates a constraint.
+     */
+    write(write: PrefixStateWrite, now?: Date): boolean;
+    /**
+     * Stamp (or clear, with a null lease) the conversation's prefetched lease
+     * on every recent row: the prefetch lands asynchronously, and the expiry
+     * turn's lookup must find it on whichever row is deepest by then. Writes
+     * decided shallower than the last applied one are stale and skipped.
+     * `zdr` is the router's setting. Returns the number of rows updated.
+     */
+    writePendingLease(write: PendingLeaseWrite, zdr: boolean, now?: Date): number;
+    /**
+     * Recent entries of the router matching `prefixHashes` on either hash tier,
+     * then (for lease recovery) recent entries of `conversationId`. Each lookup
+     * is newest-first, deepest-first within a timestamp, and capped; duplicates
+     * keep their first position.
+     */
+    hits(args: {
+        routerId: string;
+        prefixHashes: readonly string[];
+        conversationId?: string;
+    }, now?: Date): RouterPrefixHit[];
+}

package/dist/self_host/prefix_store.js

@@ -0,0 +1,261 @@
+import { ROUTING_PREFIX_HASHES_MAX_COUNT } from "../platform/routing_contract.js";
+// Resolve returns entries up to this age so a continuation after a pause still
+// recovers its conversation id and previous decision; the runtime itself
+// downgrades hits past the provider cache-warmth window to identity-only.
+const CONVERSATION_LOOKBACK_MS = 30 * 60_000;
+// Rows older than this are deleted. Must stay above the lookback.
+const RETENTION_MS = 60 * 60_000;
+const CONVERSATION_ID_MAX_CHARS = 64;
+const MODEL_NAME_MAX_CHARS = 240;
+const REASON_MAX_CHARS = 2000;
+const REASONING_BUCKET_MAX_CHARS = 32;
+// A 512-token thinking trace is ~3k chars; the cap only guards against a
+// runaway completion being fanned across every recent row.
+const PENDING_LEASE_OUTPUT_TEXT_MAX_CHARS = 20_000;
+// Pending-lease columns are owned by writePendingLease: re-applying a turn
+// must not wipe a stamp that landed in between, so the upsert leaves them alone
+// (the fence column is only ever raised).
+const ENTRY_COLUMNS = [
+    "prefix_hash", "loose_prefix_hash", "router_id", "organization_id", "conversation_id",
+    "model", "provider", "next_model", "next_reasoning_effort", "message_depth",
+    "provider_block_depth", "prompt_anchor_depth", "input_tokens", "cache_read_tokens",
+    "cache_write_tokens", "prompt_tokens", "benchmark_replay_depth", "tool_choice_fp",
+    "response_format_fp", "reasoning_bucket", "lease_turns_remaining", "reason", "updated_at",
+];
+const PENDING_COLUMNS = [
+    "pending_lease_model", "pending_lease_reasoning_effort", "pending_lease_turns",
+    "pending_lease_reason", "pending_lease_output_text", "pending_lease_decided_at_depth",
+];
+const UPSERT_SQL = `INSERT INTO routing_prefix_entries (${[...ENTRY_COLUMNS, ...PENDING_COLUMNS].join(", ")})
+  VALUES (${[...ENTRY_COLUMNS, ...PENDING_COLUMNS].map((column) => `$${column}`).join(", ")})
+  ON CONFLICT (prefix_hash) DO UPDATE SET
+    ${ENTRY_COLUMNS.filter((column) => column !== "prefix_hash").map((column) => `${column} = excluded.${column}`).join(",\n    ")},
+    pending_lease_decided_at_depth = max(
+      coalesce(routing_prefix_entries.pending_lease_decided_at_depth, 0),
+      excluded.pending_lease_decided_at_depth
+    )
+  WHERE routing_prefix_entries.updated_at < excluded.updated_at`;
+export class PrefixStore {
+    db;
+    constructor(db) {
+        this.db = db;
+        db.run(`CREATE TABLE IF NOT EXISTS routing_prefix_entries (
+      prefix_hash TEXT PRIMARY KEY,
+      loose_prefix_hash TEXT,
+      router_id TEXT NOT NULL,
+      organization_id TEXT,
+      conversation_id TEXT NOT NULL,
+      model TEXT NOT NULL,
+      provider TEXT,
+      next_model TEXT,
+      next_reasoning_effort TEXT,
+      message_depth INTEGER NOT NULL,
+      provider_block_depth INTEGER,
+      prompt_anchor_depth INTEGER,
+      input_tokens INTEGER NOT NULL,
+      cache_read_tokens INTEGER NOT NULL,
+      cache_write_tokens INTEGER NOT NULL,
+      prompt_tokens INTEGER NOT NULL,
+      benchmark_replay_depth INTEGER,
+      tool_choice_fp TEXT NOT NULL,
+      response_format_fp TEXT NOT NULL,
+      reasoning_bucket TEXT,
+      lease_turns_remaining INTEGER,
+      pending_lease_model TEXT,
+      pending_lease_reasoning_effort TEXT,
+      pending_lease_turns INTEGER,
+      pending_lease_reason TEXT,
+      pending_lease_output_text TEXT,
+      pending_lease_decided_at_depth INTEGER,
+      reason TEXT,
+      updated_at INTEGER NOT NULL
+    )`);
+        db.run("CREATE INDEX IF NOT EXISTS ix_routing_prefix_entries_updated_at ON routing_prefix_entries (updated_at)");
+        db.run("CREATE INDEX IF NOT EXISTS ix_routing_prefix_entries_router_id ON routing_prefix_entries (router_id)");
+        db.run("CREATE INDEX IF NOT EXISTS ix_routing_prefix_entries_conversation_id ON routing_prefix_entries (conversation_id)");
+        db.run("CREATE INDEX IF NOT EXISTS ix_routing_prefix_entries_loose_prefix_hash ON routing_prefix_entries (loose_prefix_hash)");
+    }
+    /**
+     * Apply one turn's prefix entry and/or refresh the entry whose cache it
+     * read. Freshness is stamped with the request's `received_at` (provider
+     * caches are read at the start of the serving request), never write time.
+     * Returns false, writing nothing, when the entry violates a constraint.
+     */
+    write(write, now = new Date()) {
+        const cacheClock = Date.parse(write.received_at);
+        if (!Number.isFinite(cacheClock))
+            throw new Error("received_at must be an ISO timestamp.");
+        const apply = this.db.transaction(() => {
+            const entry = write.prefix_entry;
+            if (entry !== null) {
+                this.db.query(UPSERT_SQL).run(entryValues(write, entry, cacheClock));
+            }
+            if (write.touched_prefix_hash !== null) {
+                this.db
+                    .query("UPDATE routing_prefix_entries SET updated_at = ? WHERE prefix_hash = ? AND updated_at < ?")
+                    .run(cacheClock, write.touched_prefix_hash, cacheClock);
+            }
+            // Deterministic sweep; expired rows are already invisible to hits().
+            this.db.query("DELETE FROM routing_prefix_entries WHERE updated_at < ?").run(now.getTime() - RETENTION_MS);
+        });
+        try {
+            apply();
+        }
+        catch (error) {
+            if (isConstraintError(error))
+                return false;
+            throw error;
+        }
+        return true;
+    }
+    /**
+     * Stamp (or clear, with a null lease) the conversation's prefetched lease
+     * on every recent row: the prefetch lands asynchronously, and the expiry
+     * turn's lookup must find it on whichever row is deepest by then. Writes
+     * decided shallower than the last applied one are stale and skipped.
+     * `zdr` is the router's setting. Returns the number of rows updated.
+     */
+    writePendingLease(write, zdr, now = new Date()) {
+        const lease = write.pending_lease;
+        const result = this.db
+            .query(`UPDATE routing_prefix_entries SET
+          pending_lease_model = $model,
+          pending_lease_reasoning_effort = $effort,
+          pending_lease_turns = $turns,
+          pending_lease_reason = $reason,
+          pending_lease_output_text = $output,
+          pending_lease_decided_at_depth = $depth
+        WHERE router_id = $router AND conversation_id = $conversation AND updated_at > $cutoff
+          AND (pending_lease_decided_at_depth IS NULL OR pending_lease_decided_at_depth <= $depth)`)
+            .run({
+            $model: lease?.model ?? null,
+            $effort: lease?.reasoning_effort ?? null,
+            $turns: lease?.turns ?? null,
+            $reason: zdr ? null : lease?.reason ?? null,
+            $output: zdr ? null : clip(lease?.output_text, PENDING_LEASE_OUTPUT_TEXT_MAX_CHARS),
+            $depth: write.decided_at_depth,
+            $router: write.router_id,
+            $conversation: write.conversation_id,
+            $cutoff: now.getTime() - CONVERSATION_LOOKBACK_MS,
+        });
+        return result.changes;
+    }
+    /**
+     * Recent entries of the router matching `prefixHashes` on either hash tier,
+     * then (for lease recovery) recent entries of `conversationId`. Each lookup
+     * is newest-first, deepest-first within a timestamp, and capped; duplicates
+     * keep their first position.
+     */
+    hits(args, now = new Date()) {
+        const hashes = args.prefixHashes.slice(-ROUTING_PREFIX_HASHES_MAX_COUNT);
+        const cutoff = now.getTime() - CONVERSATION_LOOKBACK_MS;
+        const recent = (filter, params) => this.db
+            .query(`SELECT * FROM routing_prefix_entries
+            WHERE router_id = ? AND updated_at > ? AND (${filter})
+            ORDER BY updated_at DESC, message_depth DESC
+            LIMIT ${ROUTING_PREFIX_HASHES_MAX_COUNT}`)
+            .all(args.routerId, cutoff, ...params);
+        const rows = [];
+        if (hashes.length > 0) {
+            const placeholders = hashes.map(() => "?").join(", ");
+            rows.push(...recent(`prefix_hash IN (${placeholders}) OR loose_prefix_hash IN (${placeholders})`, [...hashes, ...hashes]));
+        }
+        if (args.conversationId)
+            rows.push(...recent("conversation_id = ?", [args.conversationId]));
+        const unique = new Map();
+        for (const row of rows)
+            if (!unique.has(row.prefix_hash))
+                unique.set(row.prefix_hash, row);
+        return [...unique.values()].map(toHit);
+    }
+}
+function entryValues(write, entry, cacheClock) {
+    const text = (key, maxChars) => {
+        const value = entry[key];
+        if (value === undefined || value === null)
+            return null;
+        if (typeof value !== "string")
+            throw new Error(`prefix_entry.${key} must be a string.`);
+        return maxChars === undefined ? value : clip(value, maxChars);
+    };
+    const int = (key) => {
+        const value = entry[key];
+        if (value === undefined || value === null)
+            return null;
+        if (typeof value !== "number" || !Number.isInteger(value)) {
+            throw new Error(`prefix_entry.${key} must be an integer.`);
+        }
+        return value;
+    };
+    return {
+        $prefix_hash: text("prefix_hash"),
+        $loose_prefix_hash: text("loose_prefix_hash"),
+        $router_id: write.router_id,
+        $organization_id: write.organization_id,
+        $conversation_id: text("conversation_id", CONVERSATION_ID_MAX_CHARS),
+        $model: text("model", MODEL_NAME_MAX_CHARS),
+        $provider: text("provider", MODEL_NAME_MAX_CHARS),
+        $next_model: text("next_model", MODEL_NAME_MAX_CHARS),
+        $next_reasoning_effort: text("next_reasoning_effort"),
+        $message_depth: int("message_depth"),
+        $provider_block_depth: int("provider_block_depth"),
+        $prompt_anchor_depth: int("prompt_anchor_depth"),
+        $input_tokens: int("input_tokens"),
+        $cache_read_tokens: int("cache_read_tokens"),
+        $cache_write_tokens: int("cache_write_tokens"),
+        $prompt_tokens: int("prompt_tokens"),
+        $benchmark_replay_depth: int("benchmark_replay_depth"),
+        $tool_choice_fp: text("tool_choice_fp"),
+        $response_format_fp: text("response_format_fp"),
+        $reasoning_bucket: text("reasoning_bucket", REASONING_BUCKET_MAX_CHARS),
+        $lease_turns_remaining: int("lease_turns_remaining"),
+        $reason: write.zdr ? null : text("reason", REASON_MAX_CHARS),
+        $updated_at: cacheClock,
+        $pending_lease_model: text("pending_lease_model"),
+        $pending_lease_reasoning_effort: text("pending_lease_reasoning_effort"),
+        $pending_lease_turns: int("pending_lease_turns"),
+        $pending_lease_reason: write.zdr ? null : text("pending_lease_reason"),
+        $pending_lease_output_text: write.zdr ? null : text("pending_lease_output_text", PENDING_LEASE_OUTPUT_TEXT_MAX_CHARS),
+        // Every row carries a fence at its own conversation depth so a slow
+        // prefetch decided earlier cannot stamp rows appended after a newer write.
+        $pending_lease_decided_at_depth: int("lease_depth"),
+    };
+}
+// Stripped, truncated, and null when blank.
+function clip(value, maxChars) {
+    const normalized = value?.trim();
+    return normalized ? normalized.slice(0, maxChars) : null;
+}
+function isConstraintError(error) {
+    return error instanceof Error && "code" in error && String(error.code).startsWith("SQLITE_CONSTRAINT");
+}
+function toHit(row) {
+    return {
+        hash: row.prefix_hash,
+        loose_hash: row.loose_prefix_hash,
+        conversation_id: row.conversation_id,
+        model: row.model,
+        provider: row.provider,
+        next_model: row.next_model,
+        next_reasoning_effort: row.next_reasoning_effort,
+        message_depth: row.message_depth,
+        provider_block_depth: row.provider_block_depth,
+        prompt_anchor_depth: row.prompt_anchor_depth,
+        prompt_tokens: row.prompt_tokens,
+        benchmark_replay_depth: row.benchmark_replay_depth,
+        input_tokens: row.input_tokens,
+        cache_read_tokens: row.cache_read_tokens,
+        cache_write_tokens: row.cache_write_tokens,
+        tool_choice_fp: row.tool_choice_fp,
+        response_format_fp: row.response_format_fp,
+        reasoning_bucket: row.reasoning_bucket,
+        lease_turns_remaining: row.lease_turns_remaining,
+        pending_lease_model: row.pending_lease_model,
+        pending_lease_reasoning_effort: row.pending_lease_reasoning_effort,
+        pending_lease_turns: row.pending_lease_turns,
+        pending_lease_reason: row.pending_lease_reason,
+        pending_lease_output_text: row.pending_lease_output_text,
+        reason: row.reason,
+        updated_at: new Date(row.updated_at).toISOString(),
+    };
+}

package/dist/self_host/resolve.d.ts

@@ -0,0 +1,28 @@
+import { type RouterPrefixHit } from "@mupt-ai/dari-router/policy-engine";
+import type { ResolveRouterRequest } from "../platform/platform.js";
+import type { ResolvedRouter } from "../types.js";
+import type { GatewayConfig } from "./config.js";
+import { type OAuthFetch, type SubscriptionStore } from "./subscriptions/index.js";
+export declare const SELF_HOSTED_ORGANIZATION_ID = "self-hosted";
+export declare const SELF_HOSTED_USER_ID = "self-hosted";
+export type SelfHostedResolverDeps = {
+    config: GatewayConfig;
+    gatewayKeys: readonly string[];
+    subscriptions: SubscriptionStore;
+    prefixHits: (args: {
+        routerId: string;
+        prefixHashes: readonly string[];
+        conversationId?: string;
+    }) => RouterPrefixHit[];
+    providerApiKey: (provider: string) => Promise<string | undefined>;
+    env: Record<string, string | undefined>;
+    fetch: OAuthFetch;
+};
+/**
+ * Resolve a configured router for one request. Each provider is served by a
+ * connected personal subscription when the router allows it and one is
+ * available, otherwise by the provider's API key; models whose provider has
+ * neither are left out.
+ */
+export declare function resolveSelfHostedRouter(deps: SelfHostedResolverDeps, request: ResolveRouterRequest): Promise<ResolvedRouter>;
+export declare function gatewayKeyIndex(keys: readonly string[], presented: string): number | null;

package/dist/self_host/resolve.js

@@ -0,0 +1,167 @@
+import { timingSafeEqual } from "node:crypto";
+import { nativeModelId, providerForModel, } from "@mupt-ai/dari-router/policy-engine";
+import { HttpError } from "../http/errors.js";
+import { codexModelConfig } from "../models/subscriptions.js";
+import { registeredModelPrice } from "../providers/pi.js";
+import { freshAccessToken, } from "./subscriptions/index.js";
+// A self-hosted gateway is one tenant; these stand in for the hosted
+// organization and the user a personal subscription belongs to.
+export const SELF_HOSTED_ORGANIZATION_ID = "self-hosted";
+export const SELF_HOSTED_USER_ID = "self-hosted";
+/**
+ * Resolve a configured router for one request. Each provider is served by a
+ * connected personal subscription when the router allows it and one is
+ * available, otherwise by the provider's API key; models whose provider has
+ * neither are left out.
+ */
+export async function resolveSelfHostedRouter(deps, request) {
+    const keyIndex = gatewayKeyIndex(deps.gatewayKeys, request.apiKey);
+    if (keyIndex === null) {
+        throw new HttpError(401, "Missing or invalid router/API key.", "routing_key_resolution_failed");
+    }
+    const router = deps.config.routers[request.routerId];
+    if (router === undefined) {
+        throw new HttpError(404, `Router ${request.routerId} is not configured on this gateway.`, "router_not_found");
+    }
+    const now = new Date();
+    const credentials = new Map();
+    const exhausted = new Set();
+    for (const provider of new Set(router.models.map((model) => providerForModel(model.id)))) {
+        const subscription = router.subscriptions
+            ? subscriptionProviderFor(provider, request.clientHarness)
+            : null;
+        const active = subscription === null
+            ? null
+            : deps.subscriptions.activeCredential(subscription, now);
+        if (active !== null) {
+            credentials.set(provider, {
+                key: await freshAccessToken(deps.subscriptions, active, { fetch: deps.fetch }),
+                source: "subscription",
+                subscription: active,
+            });
+            continue;
+        }
+        if (subscription !== null && deps.subscriptions.list(subscription).length > 0) {
+            exhausted.add(subscription);
+        }
+        const apiKey = await providerApiKey(deps, provider);
+        credentials.set(provider, apiKey ? { key: apiKey, source: "user" } : null);
+    }
+    const models = router.models.filter((model) => credentials.get(providerForModel(model.id)) != null);
+    if (models.length === 0)
+        throw unavailableRouterError(request.routerId, exhausted);
+    const resolved = {
+        router_id: request.routerId,
+        organization_id: SELF_HOSTED_ORGANIZATION_ID,
+        api_key_id: `gateway_key_${keyIndex + 1}`,
+        attributed_user_id: SELF_HOSTED_USER_ID,
+        enabled_models: models.map((model) => model.id),
+        provider_keys: {},
+        provider_key_sources: {},
+        subscription_credential_ids: {},
+        zdr: router.zdr,
+        speculative_routing: false,
+        primary_retries: router.retries,
+        model_fallback_enabled: router.fallback,
+        fallback_requires_different_provider: router.fallbackRequiresDifferentProvider,
+        lease_context_enabled: false,
+        routing_strategy: "dari",
+        custom_config: null,
+        evals: [],
+        model_thinking_levels: thinkingLevels(router),
+        model_prices: {},
+        model_configs: {},
+        prefix_hits: deps.prefixHits({
+            routerId: request.routerId,
+            prefixHashes: request.prefixHashes ?? [],
+            ...(request.conversationId ? { conversationId: request.conversationId } : {}),
+        }),
+    };
+    for (const [provider, credential] of credentials) {
+        if (credential == null)
+            continue;
+        for (const servingProvider of servingProviders(provider, credential)) {
+            resolved.provider_keys[servingProvider] = credential.key;
+            resolved.provider_key_sources[servingProvider] = credential.source;
+            if (credential.subscription) {
+                resolved.subscription_credential_ids[servingProvider] = credential.subscription.id;
+            }
+        }
+    }
+    for (const model of models) {
+        const price = registeredModelPrice(model.id);
+        if (price !== null)
+            resolved.model_prices[model.id] = price;
+        const provider = providerForModel(model.id);
+        const endpoint = deps.config.providers[provider];
+        if (credentials.get(provider)?.subscription?.provider === "openai_codex") {
+            resolved.model_configs[model.id] = codexModelConfig(model.id, price);
+        }
+        else if (endpoint !== undefined) {
+            resolved.model_configs[model.id] = {
+                provider,
+                native_model_id: nativeModelId(model.id),
+                api: endpoint.api,
+                base_url: endpoint.baseUrl,
+                cost: price ?? { input: 0, output: 0 },
+            };
+        }
+    }
+    return resolved;
+}
+// Configured endpoints read their own key variable, or send a placeholder
+// when they take none; known providers use their standard variable.
+async function providerApiKey(deps, provider) {
+    const endpoint = deps.config.providers[provider];
+    if (endpoint === undefined)
+        return (await deps.providerApiKey(provider))?.trim() || undefined;
+    if (endpoint.apiKeyEnv === undefined)
+        return "no-key";
+    return deps.env[endpoint.apiKeyEnv]?.trim() || undefined;
+}
+export function gatewayKeyIndex(keys, presented) {
+    const candidate = Buffer.from(presented);
+    for (const [index, key] of keys.entries()) {
+        const expected = Buffer.from(key);
+        if (expected.length === candidate.length && timingSafeEqual(expected, candidate)) {
+            return index;
+        }
+    }
+    return null;
+}
+// Claude Code plans serve only Claude Code itself and Muse Code plans only
+// Muse Code; ChatGPT plans serve any client through the Codex backend.
+function subscriptionProviderFor(provider, clientHarness) {
+    if (provider === "anthropic") {
+        return clientHarness === "claude_code" ? "anthropic_claude_code" : null;
+    }
+    if (provider === "meta")
+        return clientHarness === "muse_code" ? "meta_muse" : null;
+    if (provider === "openai")
+        return "openai_codex";
+    return null;
+}
+// A ChatGPT plan serves OpenAI models as the `openai-codex` provider, and the
+// runtime looks keys up by serving provider.
+function servingProviders(provider, credential) {
+    return credential.subscription?.provider === "openai_codex"
+        ? [provider, "openai-codex"]
+        : [provider];
+}
+function thinkingLevels(router) {
+    return Object.fromEntries(router.models.flatMap((model) => model.thinking ? [[model.id, model.thinking]] : []));
+}
+const SUBSCRIPTION_PLAN_NAMES = {
+    anthropic_claude_code: "Claude Code",
+    openai_codex: "ChatGPT",
+    meta_muse: "Muse Code",
+};
+function unavailableRouterError(routerId, exhausted) {
+    if (exhausted.size > 0) {
+        const plans = [...exhausted]
+            .map((provider) => SUBSCRIPTION_PLAN_NAMES[provider])
+            .join(" and ");
+        return new HttpError(424, `Every connected ${plans} subscription is at its usage limit, and no API key can serve router ${routerId} instead.`, "personal_subscription_unavailable");
+    }
+    return new HttpError(424, `No credentials can serve router ${routerId}: set a provider API key or connect a subscription.`, "provider_credentials_missing");
+}

package/dist/self_host/subscriptions/access.d.ts

@@ -0,0 +1,10 @@
+import { type OAuthFetch } from "./oauth.js";
+import type { SubscriptionCredential, SubscriptionStore } from "./store.js";
+/**
+ * A usable access token for a subscription, refreshed and persisted first
+ * when it expires within five minutes. Records the credential as used.
+ */
+export declare function freshAccessToken(store: SubscriptionStore, credential: SubscriptionCredential, options: {
+    fetch: OAuthFetch;
+    now?: Date;
+}): Promise<string>;

package/dist/self_host/subscriptions/access.js

@@ -0,0 +1,37 @@
+import { refreshOAuth } from "./oauth.js";
+const REFRESH_MARGIN_MS = 5 * 60_000;
+// One refresh per credential at a time in this process. Providers rotate
+// refresh tokens, so a second concurrent refresh with the old token would fail.
+const inFlight = new Map();
+/**
+ * A usable access token for a subscription, refreshed and persisted first
+ * when it expires within five minutes. Records the credential as used.
+ */
+export async function freshAccessToken(store, credential, options) {
+    const now = options.now ?? new Date();
+    store.touch(credential.id, now);
+    if (!expiresSoon(credential, now))
+        return credential.accessToken;
+    const pending = inFlight.get(credential.id);
+    if (pending !== undefined)
+        return pending;
+    const refresh = (async () => {
+        // Another caller may have refreshed since `credential` was read.
+        const current = store.get(credential.id);
+        if (current === null)
+            throw new Error("Connected subscription credential is no longer available.");
+        if (!expiresSoon(current, now))
+            return current.accessToken;
+        const tokens = await refreshOAuth(current, { fetch: options.fetch, now });
+        if (tokens.provider !== current.provider) {
+            throw new Error("Subscription OAuth provider returned a mismatched credential.");
+        }
+        store.updateTokens(current.id, tokens, now);
+        return tokens.accessToken;
+    })().finally(() => inFlight.delete(credential.id));
+    inFlight.set(credential.id, refresh);
+    return refresh;
+}
+function expiresSoon(credential, now) {
+    return credential.expiresAt.getTime() <= now.getTime() + REFRESH_MARGIN_MS;
+}

package/dist/self_host/subscriptions/http.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The subscription endpoints the Dari CLI calls, with the same paths and JSON
+ * shapes as the hosted API. The gateway is single-tenant: `current` is the
+ * only organization, and every caller that passes the gateway's own auth owns
+ * every subscription. Errors are `{"detail": "..."}`, which the CLI prints.
+ */
+import { type OAuthFetch } from "./oauth.js";
+import { type SubscriptionStore } from "./store.js";
+export type SubscriptionHttpDeps = {
+    store: SubscriptionStore;
+    fetch: OAuthFetch;
+    now?: () => Date;
+};
+/** Handle a subscription route, or return null when the request is not one. */
+export declare function handleSubscriptionRequest(request: Request, deps: SubscriptionHttpDeps): Promise<Response | null>;