@mupt-ai/dari-gateway 0.2.0 → 0.3.0

package/dist/self_host/subscriptions/store.d.ts

@@ -0,0 +1,78 @@
+/**
+ * SQLite storage for personal subscription credentials and pending OAuth flows.
+ *
+ * Tokens are stored as PLAINTEXT in the gateway's own database file. Anyone
+ * who can read that file can use the connected subscriptions until the
+ * provider revokes them, so keep the file on storage only the gateway's
+ * operator can read, and treat backups of it as secrets.
+ *
+ * Connection order (`position`) is the order routing switches through: the
+ * active credential for a provider is the first one, in that order, that is
+ * not held. A hold ends on its own once `unavailable_until` passes.
+ */
+import type { Database } from "bun:sqlite";
+import type { OAuthTokens, SubscriptionProvider } from "./oauth.js";
+export type SubscriptionCredential = {
+    id: string;
+    provider: SubscriptionProvider;
+    name: string;
+    label: string | null;
+    accountEmail: string | null;
+    accountId: string | null;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+    unavailableUntil: Date | null;
+    unavailableReason: string | null;
+    position: number;
+    createdAt: Date;
+    updatedAt: Date;
+    lastUsedAt: Date | null;
+};
+export type PendingOAuthSession = {
+    token: string;
+    provider: SubscriptionProvider;
+    flow: Record<string, string>;
+    credentialName: string | null;
+    expiresAt: Date;
+};
+export declare class SubscriptionStore {
+    private readonly db;
+    constructor(db: Database);
+    /** Every subscription, grouped by provider, in connection order. */
+    list(provider?: SubscriptionProvider): SubscriptionCredential[];
+    get(id: string): SubscriptionCredential | null;
+    getByName(name: string): SubscriptionCredential | null;
+    /** The credential routing uses now, or null when none is connected or every one is held. */
+    activeCredential(provider: SubscriptionProvider, now?: Date): SubscriptionCredential | null;
+    /**
+     * Store tokens from a completed OAuth flow. `reconnectName` replaces that
+     * subscription (null when it is not connected). Otherwise a subscription
+     * for the same account email is replaced, and anything else is connected
+     * last in order under the first free name.
+     */
+    connect(tokens: OAuthTokens, reconnectName: string | null, now?: Date): SubscriptionCredential | null;
+    /** Persist refreshed tokens. Keeps the stored account id when the refresh carries none. */
+    updateTokens(id: string, tokens: OAuthTokens, now?: Date): void;
+    touch(id: string, now?: Date): void;
+    /** An empty label clears it. Null when the subscription is not connected. */
+    rename(name: string, label: string | null, now?: Date): SubscriptionCredential | null;
+    /** Remove a subscription. Returns what was removed, or null when it was not connected. */
+    disconnect(name: string): SubscriptionCredential | null;
+    /**
+     * Hold an exhausted subscription until its reset. A hold only grows: a later
+     * report with an earlier reset never shortens a longer one. Returns whether
+     * a subscription for the same provider is available now.
+     */
+    markUnavailable(id: string, until: Date, reason: string, now?: Date): boolean;
+    /** Clear a usage-limit hold. Null when the subscription is not connected. */
+    markAvailable(name: string, now?: Date): SubscriptionCredential | null;
+    createSession(session: Omit<PendingOAuthSession, "token">, now?: Date): PendingOAuthSession;
+    /** A pending session, including an expired one so callers can say it expired. */
+    getSession(token: string): PendingOAuthSession | null;
+    deleteSession(token: string): void;
+    private freeName;
+}
+export declare function isHeld(credential: SubscriptionCredential, now: Date): boolean;
+/** Subscription names are env-var-style identifiers; matching is case-insensitive. */
+export declare function normalizeName(name: string): string;

package/dist/self_host/subscriptions/store.js

@@ -0,0 +1,236 @@
+import { randomBytes, randomUUID } from "node:crypto";
+const BASE_NAMES = {
+    anthropic_claude_code: "ANTHROPIC_CLAUDE_CODE_OAUTH_TOKEN",
+    openai_codex: "OPENAI_CODEX_OAUTH_TOKEN",
+    meta_muse: "META_MUSE_OAUTH_TOKEN",
+};
+export class SubscriptionStore {
+    db;
+    constructor(db) {
+        this.db = db;
+        db.run(`CREATE TABLE IF NOT EXISTS subscription_credentials (
+      id TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      name TEXT NOT NULL UNIQUE,
+      label TEXT,
+      account_email TEXT,
+      account_id TEXT,
+      access_token TEXT NOT NULL,
+      refresh_token TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      unavailable_until INTEGER,
+      unavailable_reason TEXT,
+      position INTEGER NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      last_used_at INTEGER
+    )`);
+        db.run(`CREATE TABLE IF NOT EXISTS subscription_oauth_sessions (
+      token TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      flow_json TEXT NOT NULL,
+      credential_name TEXT,
+      expires_at INTEGER NOT NULL
+    )`);
+    }
+    /** Every subscription, grouped by provider, in connection order. */
+    list(provider) {
+        const rows = provider === undefined
+            ? this.db.query("SELECT * FROM subscription_credentials ORDER BY provider, position").all()
+            : this.db
+                .query("SELECT * FROM subscription_credentials WHERE provider = ? ORDER BY position")
+                .all(provider);
+        return rows.map(credentialFromRow);
+    }
+    get(id) {
+        const row = this.db.query("SELECT * FROM subscription_credentials WHERE id = ?").get(id);
+        return row === null ? null : credentialFromRow(row);
+    }
+    getByName(name) {
+        const row = this.db
+            .query("SELECT * FROM subscription_credentials WHERE name = ?")
+            .get(normalizeName(name));
+        return row === null ? null : credentialFromRow(row);
+    }
+    /** The credential routing uses now, or null when none is connected or every one is held. */
+    activeCredential(provider, now = new Date()) {
+        // Stay on the most recently used subscription while it serves, so its
+        // prompt cache stays warm; once it is held, move on in connection order.
+        const credentials = this.list(provider);
+        let start = 0;
+        credentials.forEach((credential, index) => {
+            const lastUsed = credential.lastUsedAt?.getTime() ?? -1;
+            if (lastUsed > (credentials[start].lastUsedAt?.getTime() ?? -1))
+                start = index;
+        });
+        for (let offset = 0; offset < credentials.length; offset += 1) {
+            const credential = credentials[(start + offset) % credentials.length];
+            if (!isHeld(credential, now))
+                return credential;
+        }
+        return null;
+    }
+    /**
+     * Store tokens from a completed OAuth flow. `reconnectName` replaces that
+     * subscription (null when it is not connected). Otherwise a subscription
+     * for the same account email is replaced, and anything else is connected
+     * last in order under the first free name.
+     */
+    connect(tokens, reconnectName, now = new Date()) {
+        return this.db.transaction(() => {
+            const existing = reconnectName !== null
+                ? this.getByName(reconnectName)
+                : this.list(tokens.provider).find((credential) => tokens.accountEmail !== null && credential.accountEmail === tokens.accountEmail) ?? null;
+            if (reconnectName !== null && existing?.provider !== tokens.provider)
+                return null;
+            if (existing !== null) {
+                // Another (or an unidentified) account must not inherit the previous account's hold.
+                const sameAccount = tokens.accountEmail !== null && tokens.accountEmail === existing.accountEmail;
+                this.db.run(`UPDATE subscription_credentials SET access_token = ?, refresh_token = ?, expires_at = ?,
+             account_id = ?, account_email = ?, unavailable_until = ?, unavailable_reason = ?, updated_at = ?
+           WHERE id = ?`, [
+                    tokens.accessToken,
+                    tokens.refreshToken,
+                    tokens.expiresAt.getTime(),
+                    tokens.accountId,
+                    tokens.accountEmail,
+                    sameAccount ? existing.unavailableUntil?.getTime() ?? null : null,
+                    sameAccount ? existing.unavailableReason : null,
+                    now.getTime(),
+                    existing.id,
+                ]);
+                return this.get(existing.id);
+            }
+            const id = `cred_${randomUUID().replaceAll("-", "")}`;
+            const position = this.db
+                .query("SELECT COALESCE(MAX(position), 0) + 1 AS next FROM subscription_credentials")
+                .get().next;
+            this.db.run(`INSERT INTO subscription_credentials (id, provider, name, account_email, account_id, access_token,
+           refresh_token, expires_at, position, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+                id,
+                tokens.provider,
+                this.freeName(BASE_NAMES[tokens.provider]),
+                tokens.accountEmail,
+                tokens.accountId,
+                tokens.accessToken,
+                tokens.refreshToken,
+                tokens.expiresAt.getTime(),
+                position,
+                now.getTime(),
+                now.getTime(),
+            ]);
+            return this.get(id);
+        })();
+    }
+    /** Persist refreshed tokens. Keeps the stored account id when the refresh carries none. */
+    updateTokens(id, tokens, now = new Date()) {
+        this.db.run(`UPDATE subscription_credentials SET access_token = ?, refresh_token = ?, expires_at = ?,
+         account_id = COALESCE(?, account_id), updated_at = ? WHERE id = ?`, [tokens.accessToken, tokens.refreshToken, tokens.expiresAt.getTime(), tokens.accountId, now.getTime(), id]);
+    }
+    touch(id, now = new Date()) {
+        this.db.run("UPDATE subscription_credentials SET last_used_at = ? WHERE id = ?", [now.getTime(), id]);
+    }
+    /** An empty label clears it. Null when the subscription is not connected. */
+    rename(name, label, now = new Date()) {
+        const normalized = label?.trim() || null;
+        if (normalized !== null && normalized.length > 120) {
+            throw new RangeError("Subscription name must be at most 120 characters.");
+        }
+        const credential = this.getByName(name);
+        if (credential === null)
+            return null;
+        this.db.run("UPDATE subscription_credentials SET label = ?, updated_at = ? WHERE id = ?", [
+            normalized,
+            now.getTime(),
+            credential.id,
+        ]);
+        return this.get(credential.id);
+    }
+    /** Remove a subscription. Returns what was removed, or null when it was not connected. */
+    disconnect(name) {
+        const credential = this.getByName(name);
+        if (credential === null)
+            return null;
+        this.db.run("DELETE FROM subscription_credentials WHERE id = ?", [credential.id]);
+        return credential;
+    }
+    /**
+     * Hold an exhausted subscription until its reset. A hold only grows: a later
+     * report with an earlier reset never shortens a longer one. Returns whether
+     * a subscription for the same provider is available now.
+     */
+    markUnavailable(id, until, reason, now = new Date()) {
+        const credential = this.get(id);
+        if (credential === null)
+            return false;
+        if (!isHeld(credential, now) || until > credential.unavailableUntil) {
+            this.db.run("UPDATE subscription_credentials SET unavailable_until = ?, unavailable_reason = ?, updated_at = ? WHERE id = ?", [until.getTime(), reason, now.getTime(), id]);
+        }
+        return this.activeCredential(credential.provider, now) !== null;
+    }
+    /** Clear a usage-limit hold. Null when the subscription is not connected. */
+    markAvailable(name, now = new Date()) {
+        const credential = this.getByName(name);
+        if (credential === null)
+            return null;
+        this.db.run("UPDATE subscription_credentials SET unavailable_until = NULL, unavailable_reason = NULL, updated_at = ? WHERE id = ?", [now.getTime(), credential.id]);
+        return this.get(credential.id);
+    }
+    createSession(session, now = new Date()) {
+        const token = randomBytes(32).toString("base64url");
+        this.db.run("DELETE FROM subscription_oauth_sessions WHERE expires_at <= ?", [now.getTime()]);
+        this.db.run("INSERT INTO subscription_oauth_sessions (token, provider, flow_json, credential_name, expires_at) VALUES (?, ?, ?, ?, ?)", [token, session.provider, JSON.stringify(session.flow), session.credentialName, session.expiresAt.getTime()]);
+        return { token, ...session };
+    }
+    /** A pending session, including an expired one so callers can say it expired. */
+    getSession(token) {
+        const row = this.db
+            .query("SELECT * FROM subscription_oauth_sessions WHERE token = ?")
+            .get(token);
+        if (row === null)
+            return null;
+        return {
+            token: row.token,
+            provider: row.provider,
+            flow: JSON.parse(row.flow_json),
+            credentialName: row.credential_name,
+            expiresAt: new Date(row.expires_at),
+        };
+    }
+    deleteSession(token) {
+        this.db.run("DELETE FROM subscription_oauth_sessions WHERE token = ?", [token]);
+    }
+    freeName(base) {
+        let name = base;
+        for (let index = 2; this.getByName(name) !== null; index += 1)
+            name = `${base}_${index}`;
+        return name;
+    }
+}
+export function isHeld(credential, now) {
+    return credential.unavailableUntil !== null && credential.unavailableUntil > now;
+}
+/** Subscription names are env-var-style identifiers; matching is case-insensitive. */
+export function normalizeName(name) {
+    return name.trim().toUpperCase();
+}
+function credentialFromRow(row) {
+    return {
+        id: row.id,
+        provider: row.provider,
+        name: row.name,
+        label: row.label,
+        accountEmail: row.account_email,
+        accountId: row.account_id,
+        accessToken: row.access_token,
+        refreshToken: row.refresh_token,
+        expiresAt: new Date(row.expires_at),
+        unavailableUntil: row.unavailable_until === null ? null : new Date(row.unavailable_until),
+        unavailableReason: row.unavailable_reason,
+        position: row.position,
+        createdAt: new Date(row.created_at),
+        updatedAt: new Date(row.updated_at),
+        lastUsedAt: row.last_used_at === null ? null : new Date(row.last_used_at),
+    };
+}

package/dist/strategies/auto_routing_selector.d.ts

@@ -0,0 +1,12 @@
+import type { SelectorBackend } from "./routing.js";
+export declare const DARI_AUTO_ROUTING_ENDPOINT = "https://routing.dari.dev/v1/auto-router";
+/**
+ * Choose among a router's models with Dari Auto Routing, the hosted routing
+ * policy. Each selection is one call to the Auto Router API with a Dari API
+ * key; the gateway still executes the chosen model with its own credentials.
+ */
+export declare function createAutoRoutingSelectorBackend(config: {
+    apiKey: string;
+    endpoint?: string;
+    fetch?: typeof fetch;
+}): SelectorBackend;

package/dist/strategies/auto_routing_selector.js

@@ -0,0 +1,61 @@
+import { parseSelectorDecision } from "@mupt-ai/dari-router/policy-engine";
+import { HttpError } from "../http/errors.js";
+export const DARI_AUTO_ROUTING_ENDPOINT = "https://routing.dari.dev/v1/auto-router";
+// Same selector identity and input budget as `createAutoRouter` in
+// @mupt-ai/dari-router, which calls the same API.
+const AUTO_ROUTER_MODEL = "dari/auto-router";
+const AUTO_ROUTER_CONTEXT_WINDOW_CHARS = 32_000;
+const AUTO_ROUTER_TIMEOUT_MS = 30_000;
+/**
+ * Choose among a router's models with Dari Auto Routing, the hosted routing
+ * policy. Each selection is one call to the Auto Router API with a Dari API
+ * key; the gateway still executes the chosen model with its own credentials.
+ */
+export function createAutoRoutingSelectorBackend(config) {
+    const apiKey = config.apiKey.trim();
+    if (!apiKey) {
+        throw new Error("Dari Auto Routing needs an API key.");
+    }
+    const endpoint = (config.endpoint ?? DARI_AUTO_ROUTING_ENDPOINT)
+        .replace(/\/+$/, "")
+        .replace(/\/select$/, "");
+    const fetchImpl = config.fetch ?? fetch;
+    return {
+        selectorModel: AUTO_ROUTER_MODEL,
+        contextWindowChars: async () => AUTO_ROUTER_CONTEXT_WINDOW_CHARS,
+        select: async (args) => {
+            let response;
+            try {
+                response = await fetchImpl(`${endpoint}/select`, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${apiKey}`,
+                        "Content-Type": "application/json",
+                    },
+                    body: JSON.stringify(args.selectorRequest),
+                    signal: AbortSignal.timeout(AUTO_ROUTER_TIMEOUT_MS),
+                });
+            }
+            catch {
+                throw new HttpError(502, "Dari Auto Routing request failed.", "selector_execution_failed");
+            }
+            if (!response.ok) {
+                throw new HttpError(502, `Dari Auto Routing returned HTTP ${response.status}.`, "selector_execution_failed");
+            }
+            const outputText = await response.text();
+            // The gateway applies its own stateless hold; drop any lease the
+            // policy stamps so it is not mistaken for a negotiated one.
+            const { leaseTurnsRemaining: _leaseTurnsRemaining, ...decision } = parseSelectorDecision(outputText).decision;
+            return {
+                decision,
+                selectorModel: args.selectorModel,
+                candidates: args.candidates,
+                selectorInput: args.selectorInput,
+                selectorRequest: args.selectorRequest,
+                outputText,
+                usage: null,
+                latencyMs: Date.now() - args.startedAt,
+            };
+        },
+    };
+}

package/dist/strategies/eval_relevance.d.ts

@@ -0,0 +1,17 @@
+import { type ChatMessage, type JevEvalRelevanceSelection, type ResolvedJevConfig, type RouterEval } from "@mupt-ai/dari-router/policy-engine";
+import type { ResolvedRouter } from "../types.js";
+export type EvalRelevanceDetails = {
+    model: string;
+    cards: JevEvalRelevanceSelection["cards"];
+    usage: JevEvalRelevanceSelection["usage"];
+} | {
+    error: "eval_relevance_failed";
+};
+export declare function relevantEvals(args: {
+    credentials: ResolvedRouter;
+    selectorMessages: ChatMessage[];
+    config: ResolvedJevConfig;
+}): Promise<{
+    evals: RouterEval[];
+    details: EvalRelevanceDetails;
+}>;

package/dist/strategies/eval_relevance.js

@@ -0,0 +1,32 @@
+import { RouterFrameworkError } from "@mupt-ai/dari-router";
+import { JevOutputError, selectRelevantEvals, } from "@mupt-ai/dari-router/policy-engine";
+import { publicCatalogSelectorEvals } from "../context/eval_catalog.js";
+import { scrubSecrets } from "../telemetry/scrub.js";
+// The candidate pool is every eval the organization can use: its own cards
+// plus the public catalog. Jev keeps the cards relevant to this request and
+// those become the selector's evidence. A Jev outage degrades to the
+// organization's own cards rather than failing the request.
+export async function relevantEvals(args) {
+    const organizationEvals = args.credentials.evals ?? [];
+    const pool = [
+        ...organizationEvals,
+        ...publicCatalogSelectorEvals(args.credentials.public_eval_catalog),
+    ];
+    try {
+        const selection = await selectRelevantEvals(pool, {
+            task: args.selectorMessages.find((message) => message.role === "user") ?? null,
+            conversation: args.selectorMessages,
+        }, args.config);
+        return {
+            evals: selection.evals,
+            details: { model: selection.model, cards: selection.cards, usage: selection.usage },
+        };
+    }
+    catch (error) {
+        if (!(error instanceof RouterFrameworkError || error instanceof JevOutputError)) {
+            throw error;
+        }
+        console.error("eval relevance failed", scrubSecrets(error.message));
+        return { evals: organizationEvals, details: { error: "eval_relevance_failed" } };
+    }
+}

package/dist/strategies/fallback_decision.d.ts

@@ -0,0 +1,8 @@
+import { type RoutingCandidate, type RoutingDecision } from "@mupt-ai/dari-router/policy-engine";
+export declare function deriveFallbackDecision(args: {
+    candidates: RoutingCandidate[];
+    selected: RoutingCandidate;
+    enabled?: boolean;
+    requiresDifferentProvider?: boolean;
+    providerForModel?: (model: string) => string;
+}): RoutingDecision | undefined;

package/dist/strategies/fallback_decision.js

@@ -0,0 +1,17 @@
+import { providerForModel, } from "@mupt-ai/dari-router/policy-engine";
+export function deriveFallbackDecision(args) {
+    if (!args.enabled)
+        return undefined;
+    const resolveProvider = args.providerForModel ?? providerForModel;
+    const selectedProvider = resolveProvider(args.selected.model);
+    const fallback = args.candidates.find((candidate) => candidate.model !== args.selected.model &&
+        (!args.requiresDifferentProvider ||
+            resolveProvider(candidate.model) !== selectedProvider));
+    return fallback
+        ? {
+            selectedModel: fallback.model,
+            reasoningEffort: fallback.reasoningEffort,
+            reason: "Runtime-selected fallback for the routed primary decision.",
+        }
+        : undefined;
+}

package/dist/strategies/priority_selector.d.ts

@@ -0,0 +1,7 @@
+import type { SelectorBackend } from "./routing.js";
+/**
+ * Serve the router's first eligible model/thinking-level pair, in the order
+ * the router lists them. Provider failures still fall back to the next pair
+ * when the router enables model fallback.
+ */
+export declare function createPrioritySelectorBackend(): SelectorBackend;

package/dist/strategies/priority_selector.js

@@ -0,0 +1,37 @@
+const PRIORITY_SELECTOR_MODEL = "dari-gateway/priority";
+// Priority selection reads no messages, so the sized selector input only
+// needs room for the router's candidates.
+const PRIORITY_CONTEXT_WINDOW_CHARS = 1_000_000;
+/**
+ * Serve the router's first eligible model/thinking-level pair, in the order
+ * the router lists them. Provider failures still fall back to the next pair
+ * when the router enables model fallback.
+ */
+export function createPrioritySelectorBackend() {
+    return {
+        selectorModel: PRIORITY_SELECTOR_MODEL,
+        contextWindowChars: async () => PRIORITY_CONTEXT_WINDOW_CHARS,
+        prepareMessages: () => [],
+        supportsSpeculativeRouting: false,
+        select: async (args) => {
+            const first = args.candidates[0];
+            if (first === undefined) {
+                throw new Error("Priority selection needs at least one candidate.");
+            }
+            return {
+                decision: {
+                    selectedModel: first.model,
+                    reasoningEffort: first.reasoningEffort,
+                    reason: "First eligible model on the router.",
+                },
+                selectorModel: args.selectorModel,
+                candidates: args.candidates,
+                selectorInput: args.selectorInput,
+                selectorRequest: args.selectorRequest,
+                outputText: "",
+                usage: null,
+                latencyMs: Date.now() - args.startedAt,
+            };
+        },
+    };
+}

package/dist/strategies/route_decision.d.ts

@@ -0,0 +1,22 @@
+import type { ChatMessage, PreviousDecision, RoutingDecision, StrategyCandidateResolution, SelectorLeaseHistoryEntry } from "@mupt-ai/dari-router/policy-engine";
+import { type SelectorBackend, type SelectorRun } from "./routing.js";
+import type { SelectorImage } from "./selector_projection.js";
+import type { ResolvedRouter } from "../types.js";
+export type RoutedDecision = {
+    decision: RoutingDecision;
+    fallbackDecision?: RoutingDecision;
+    run?: SelectorRun;
+    details?: Record<string, unknown>;
+};
+type RouteDecisionArgs = {
+    selectorMessages: ChatMessage[];
+    selectorImages?: SelectorImage[];
+    resolution: StrategyCandidateResolution;
+    credentials: ResolvedRouter;
+    previousDecision?: PreviousDecision;
+    conversationId: string;
+    selectorBackend: SelectorBackend;
+    leaseHistory?: SelectorLeaseHistoryEntry[];
+};
+export declare function routeDecision(args: RouteDecisionArgs): Promise<RoutedDecision>;
+export {};

package/dist/strategies/route_decision.js

@@ -0,0 +1,65 @@
+import { publicCatalogSelectorEvals } from "../context/eval_catalog.js";
+import { HttpError } from "../http/errors.js";
+import { relevantEvals } from "./eval_relevance.js";
+import { executionProviderForModel } from "../models/execution_provider.js";
+import { selectModel } from "./routing.js";
+export async function routeDecision(args) {
+    const { credentials, resolution } = args;
+    const custom = resolution.strategy === "custom"
+        ? resolution.custom
+        : undefined;
+    if (custom === null) {
+        throw new HttpError(502, "Router custom rule configuration is missing.", "custom_config_missing");
+    }
+    if (custom && resolution.candidates.length === 0) {
+        const error = new HttpError(502, "No custom routing rule or default model/thinking-level pair is routable for this request.", "custom_no_routable_candidates");
+        error.decisionDetails = { custom_rules: custom.audit };
+        throw error;
+    }
+    const relevance = args.selectorBackend.evalRelevance !== undefined
+        && resolution.candidates.length > 1
+        ? await relevantEvals({
+            credentials,
+            selectorMessages: args.selectorMessages,
+            config: args.selectorBackend.evalRelevance,
+        })
+        : undefined;
+    const run = await selectModel({
+        messages: args.selectorMessages,
+        ...(args.selectorImages !== undefined && args.selectorImages.length > 0
+            ? { images: args.selectorImages }
+            : {}),
+        candidates: resolution.candidates,
+        allCandidates: resolution.allCandidates,
+        evals: relevance?.evals ?? credentials.evals ?? [],
+        imputationReferenceEvals: credentials.eval_score_imputation === true
+            ? publicCatalogSelectorEvals(credentials.public_eval_catalog)
+            : undefined,
+        previousDecision: args.previousDecision,
+        costEstimates: resolution.costEstimates,
+        sessionId: args.conversationId,
+        ...(custom
+            ? { customRules: custom.rules, defaultTarget: custom.defaultTarget }
+            : {}),
+        selectorBackend: args.selectorBackend,
+        modelFallbackEnabled: credentials.model_fallback_enabled !== false,
+        fallbackRequiresDifferentProvider: credentials.fallback_requires_different_provider !== false,
+        executionProviderForModel: (model) => executionProviderForModel(credentials, model),
+        imputeEvalScores: credentials.eval_score_imputation === true,
+        leaseHistory: args.leaseHistory,
+        leaseContextEnabled: credentials.lease_context_enabled !== false,
+    });
+    const details = {
+        ...(custom ? { custom_rules: custom.audit } : {}),
+        ...(run.usage?.policy_bypassed === "single_candidate"
+            ? { selector_policy_bypass: "single_candidate" }
+            : {}),
+        ...(relevance ? { eval_relevance: relevance.details } : {}),
+    };
+    return {
+        decision: run.decision,
+        fallbackDecision: run.fallbackDecision,
+        run,
+        ...(Object.keys(details).length > 0 ? { details } : {}),
+    };
+}