@mupt-ai/dari-gateway 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { createRequestHandler, type GatewayHandlerOptions } from "./http/handler.js";
+export type { GatewayPlatform, OperationalErrorContext, PendingLeaseWrite, PrefixStateWrite, ProviderCredentialRequest, RequestErrorContext, RequestRecord, RequestSummary, RequestTags, ResolveRouterRequest, SubscriptionHold, } from "./platform/platform.js";
+export { DEFAULT_CATALOG_PROVIDERS, listModelCatalog, type CatalogModel, type CatalogModelPrice, type CatalogPriceTier, type ModelCatalogOptions, } from "./models/catalog.js";
+export { createAutoRoutingSelectorBackend } from "./strategies/auto_routing_selector.js";
+export { createPrioritySelectorBackend } from "./strategies/priority_selector.js";
+export { createLlmSelectorBackend, type SelectorBackend } from "./strategies/routing.js";
+export type { ProviderCredential, ResolvedRouter, SubscriptionKind } from "./types.js";

package/dist/index.js

@@ -0,0 +1,9 @@
+// Public entry points. Every module is also importable by path
+// (`@mupt-ai/dari-gateway/<dir>/<module>`) for deployments that compose the
+// gateway with their own platform. This entry needs no Bun APIs; the Bun
+// server and the SQLite-backed self-hosted gateway live in `./bun`.
+export { createRequestHandler } from "./http/handler.js";
+export { DEFAULT_CATALOG_PROVIDERS, listModelCatalog, } from "./models/catalog.js";
+export { createAutoRoutingSelectorBackend } from "./strategies/auto_routing_selector.js";
+export { createPrioritySelectorBackend } from "./strategies/priority_selector.js";
+export { createLlmSelectorBackend } from "./strategies/routing.js";

package/dist/ingress/anthropic_messages.d.ts

@@ -0,0 +1,3 @@
+import type { SelectorBackend } from "../strategies/routing.js";
+export declare function handleAnthropicMessages(request: Request, routerId: string, selectorBackend: SelectorBackend): Promise<Response>;
+export declare function anthropicErrorResponse(error: unknown): Response;

package/dist/ingress/anthropic_messages.js

@@ -0,0 +1,122 @@
+import { isRecord } from "@mupt-ai/dari-router/policy-engine";
+import { anthropicMessagesResponse } from "../protocol/output/anthropic_messages.js";
+import { anthropicMessagesSseStream } from "../protocol/output/anthropic_messages_stream.js";
+import { anthropicToken } from "../http/auth.js";
+import { errorResponseHeaders, normalizeError } from "../http/errors.js";
+import { captureRequestError } from "../observability/errors.js";
+import { anthropicMessagesToInteraction } from "../protocol/input/anthropic_messages.js";
+import { handleRoutedCompletion } from "../runtime/routed_completion.js";
+import { claudeCodeRequestContext } from "./claude_code/request_context.js";
+import { claudeCodeConversationIdentity, } from "../runtime/harness_identity/index.js";
+import { parseJsonRequest } from "./json.js";
+const LEGACY_CLAUDE_CODE_BETA = "claude-code-20250219";
+const SAFEGUARDS_BETA_PREFIX = "dangerous-tool-use-";
+export async function handleAnthropicMessages(request, routerId, selectorBackend) {
+    try {
+        const apiKey = anthropicToken(request.headers);
+        const rawPayload = await parseJsonRequest(request);
+        const interaction = anthropicMessagesToInteraction(rawPayload);
+        const isClaudeCode = isClaudeCodeRequest(request.headers);
+        const anthropicSafeguards = safeguardsFrom(rawPayload, request.headers);
+        const forwarded = anthropicSafeguards === undefined
+            ? interaction
+            : { ...interaction, anthropicSafeguards };
+        const payload = isClaudeCode
+            ? {
+                ...forwarded,
+                agentContext: claudeCodeRequestContext(request.headers),
+                // Native tool results may be followed by harness-injected text.
+                // Preserve their structural continuation semantics, not prompt inference.
+                ...(latestMessageHasToolResult(rawPayload.messages)
+                    ? { requestPurpose: "tool_continuation" } : {}),
+                claudeCodeUserAgent: request.headers.get("user-agent").trim(),
+            }
+            : forwarded;
+        return await handleRoutedCompletion({
+            request,
+            routerId,
+            apiKey,
+            payload,
+            responseBody: anthropicMessagesResponse,
+            streamBody: anthropicMessagesSseStream,
+            errorResponse: anthropicErrorResponse,
+            selectorBackend,
+            clientHarness: isClaudeCode ? "claude_code" : undefined,
+            harnessConversationIdentity: isClaudeCode
+                ? claudeCodeConversationIdentity(request.headers, payload.promptCacheKey)
+                : undefined,
+        });
+    }
+    catch (error) {
+        const response = anthropicErrorResponse(error);
+        captureRequestError(error, {
+            request,
+            routerId,
+            sourceProtocol: "anthropic_messages",
+            status: response.status,
+        });
+        return response;
+    }
+}
+function latestMessageHasToolResult(messages) {
+    if (!Array.isArray(messages))
+        return false;
+    const message = messages.at(-1);
+    return isRecord(message) && message.role === "user" && Array.isArray(message.content)
+        && message.content.some((block) => isRecord(block) && block.type === "tool_result");
+}
+// A safeguards body field only works with its paired beta, so forward the two
+// together or not at all.
+function safeguardsFrom(payload, headers) {
+    if (!Array.isArray(payload.safeguards) || payload.safeguards.length === 0) {
+        return undefined;
+    }
+    const betas = [...anthropicBetas(headers)].filter((beta) => beta.startsWith(SAFEGUARDS_BETA_PREFIX));
+    return betas.length === 0 ? undefined : { safeguards: payload.safeguards, betas };
+}
+function anthropicBetas(headers) {
+    return new Set((headers.get("anthropic-beta") ?? "")
+        .split(",")
+        .map((value) => value.trim().toLowerCase())
+        .filter(Boolean));
+}
+function isClaudeCodeRequest(headers) {
+    const userAgent = headers.get("user-agent")?.trim().toLowerCase() ?? "";
+    const app = headers.get("x-app")?.trim().toLowerCase();
+    const betas = anthropicBetas(headers);
+    return (userAgent.startsWith("claude-cli/") &&
+        (app === "cli" || app === "cli-bg") &&
+        (Boolean(headers.get("x-claude-code-session-id")?.trim()) ||
+            betas.has(LEGACY_CLAUDE_CODE_BETA)));
+}
+// Dari-specific codes clients act on; every other code stays internal.
+const CLIENT_VISIBLE_ERROR_CODES = new Set([
+    "personal_subscription_unavailable",
+    "subscription_switched",
+    "subscription_usage_limit",
+]);
+export function anthropicErrorResponse(error) {
+    const { status, message, code } = normalizeError(error);
+    return Response.json({
+        type: "error",
+        error: {
+            type: anthropicErrorType(status),
+            message,
+            ...(CLIENT_VISIBLE_ERROR_CODES.has(code) ? { code } : {}),
+        },
+    }, { status, headers: errorResponseHeaders(error) });
+}
+function anthropicErrorType(status) {
+    switch (status) {
+        case 401:
+            return "authentication_error";
+        case 403:
+            return "permission_error";
+        case 404:
+            return "not_found_error";
+        case 429:
+            return "rate_limit_error";
+        default:
+            return status >= 500 ? "api_error" : "invalid_request_error";
+    }
+}

package/dist/ingress/anthropic_models.d.ts

@@ -0,0 +1 @@
+export declare function anthropicModelsResponse(): Record<string, unknown>;

package/dist/ingress/anthropic_models.js

@@ -0,0 +1,23 @@
+/* Anthropic-compatible model discovery. Claude Desktop, Cowork, and other
+   Anthropic-SDK gateway clients list models before first use and parse the
+   Anthropic list shape ({data: [{type: "model", ...}]}), not the Codex
+   catalog shape. Discovery advertises the tier synonyms from router_model.ts —
+   the only ids such clients accept as usable (verified in-app: `dari/routing`
+   is rejected, bare tier names classify). Fixed created_at keeps the response
+   byte-stable. */
+import { ANTHROPIC_ROUTER_MODEL_TIERS } from "../protocol/input/router_model.js";
+const ROUTER_MODEL_CREATED_AT = "2026-01-01T00:00:00Z";
+const tierLabel = (tier) => `Dari Routing (${tier[0].toUpperCase()}${tier.slice(1)} tier)`;
+export function anthropicModelsResponse() {
+    return {
+        data: ANTHROPIC_ROUTER_MODEL_TIERS.map((tier) => ({
+            type: "model",
+            id: tier,
+            display_name: tierLabel(tier),
+            created_at: ROUTER_MODEL_CREATED_AT,
+        })),
+        first_id: ANTHROPIC_ROUTER_MODEL_TIERS[0],
+        last_id: ANTHROPIC_ROUTER_MODEL_TIERS[ANTHROPIC_ROUTER_MODEL_TIERS.length - 1],
+        has_more: false,
+    };
+}

package/dist/ingress/chat_completions.d.ts

@@ -0,0 +1,2 @@
+import type { SelectorBackend } from "../strategies/routing.js";
+export declare function handleChatCompletions(request: Request, routerId: string, selectorBackend: SelectorBackend): Promise<Response>;

package/dist/ingress/chat_completions.js

@@ -0,0 +1,44 @@
+import { bearerToken } from "../http/auth.js";
+import { errorResponse } from "../http/errors.js";
+import { captureRequestError } from "../observability/errors.js";
+import { chatCompletionResponse, chatCompletionsSseStream } from "../protocol/output/chat_completions.js";
+import { chatCompletionsToInteraction } from "../protocol/input/chat_completions.js";
+import { handleRoutedCompletion } from "../runtime/routed_completion.js";
+import { chatCompletionsConversationIdentity, openCodeRequestContext, } from "../runtime/harness_identity/index.js";
+import { parseJsonRequest } from "./json.js";
+import { museCodeClientId } from "./muse_code.js";
+export async function handleChatCompletions(request, routerId, selectorBackend) {
+    try {
+        const apiKey = bearerToken(request.headers);
+        const payload = await parseJsonRequest(request);
+        const interaction = chatCompletionsToInteraction({ ...payload, source_protocol: "openai_chat" });
+        const agentContext = openCodeRequestContext(request.headers);
+        const museClientId = museCodeClientId(request.headers);
+        return await handleRoutedCompletion({
+            request,
+            routerId,
+            apiKey,
+            payload: {
+                ...interaction,
+                ...(agentContext === undefined ? {} : { agentContext }),
+                ...(museClientId === undefined ? {} : { museCodeClientId: museClientId }),
+            },
+            responseBody: chatCompletionResponse,
+            streamBody: chatCompletionsSseStream,
+            errorResponse,
+            selectorBackend,
+            clientHarness: museClientId === undefined ? undefined : "muse_code",
+            harnessConversationIdentity: chatCompletionsConversationIdentity(request.headers, payload.prompt_cache_key),
+        });
+    }
+    catch (error) {
+        const response = errorResponse(error);
+        captureRequestError(error, {
+            request,
+            routerId,
+            sourceProtocol: "openai_chat",
+            status: response.status,
+        });
+        return response;
+    }
+}

package/dist/ingress/claude_code/request_context.d.ts

@@ -0,0 +1,2 @@
+import type { AgentRequestContext } from "../../interaction/types.js";
+export declare function claudeCodeRequestContext(headers: Headers): AgentRequestContext;

package/dist/ingress/claude_code/request_context.js

@@ -0,0 +1,31 @@
+import { HttpError } from "../../http/errors.js";
+const REQUEST_CLASSES = new Set([
+    "main", "subagent", "workflow", "auxiliary", "compaction", "side_reply",
+]);
+// These are client-supplied routing hints, not authentication claims. Never
+// infer them from prompt text: a user can legitimately paste any such prompt.
+export function claudeCodeRequestContext(headers) {
+    const value = headers.get("x-claude-code-request-class")?.trim();
+    const requestClass = REQUEST_CLASSES.has(value)
+        ? value
+        : "unknown";
+    const agentId = identifier(headers, "x-claude-code-agent-id");
+    if ((requestClass === "subagent" || requestClass === "workflow") && !agentId) {
+        throw new HttpError(400, "Agent requests require x-claude-code-agent-id.", "invalid_request_error", "x-claude-code-agent-id");
+    }
+    return {
+        requestClass,
+        ...(agentId === undefined ? {} : { agentId }),
+        parentAgentId: identifier(headers, "x-claude-code-parent-agent-id"),
+        agentType: identifier(headers, "x-claude-code-agent-type"),
+    };
+}
+function identifier(headers, name) {
+    const value = headers.get(name)?.trim();
+    if (!value)
+        return undefined;
+    if (value.length > 200) {
+        throw new HttpError(400, `${name} must not exceed 200 characters.`, "invalid_request_error", name);
+    }
+    return value;
+}

package/dist/ingress/codex.d.ts

@@ -0,0 +1,3 @@
+import type { SelectorBackend } from "../strategies/routing.js";
+export declare function handleResponses(request: Request, routerId: string, selectorBackend: SelectorBackend): Promise<Response>;
+export declare function handleResponsesWebSocketFallback(): Response;

package/dist/ingress/codex.js

@@ -0,0 +1,69 @@
+import { bearerToken } from "../http/auth.js";
+import { errorResponse } from "../http/errors.js";
+import { captureRequestError } from "../observability/errors.js";
+import { openAIResponsesResponse } from "../protocol/output/openai_responses.js";
+import { openAIResponsesSseStream } from "../protocol/output/openai_responses_stream.js";
+import { openAIResponsesToInteraction } from "../protocol/input/openai_responses.js";
+import { parseJsonRequest } from "./json.js";
+import { museCodeClientId } from "./muse_code.js";
+import { handleRoutedCompletion } from "../runtime/routed_completion.js";
+import { codexConversationIdentity, codexRequestPurpose, codexRequestContext, } from "../runtime/harness_identity/index.js";
+export async function handleResponses(request, routerId, selectorBackend) {
+    try {
+        const apiKey = bearerToken(request.headers);
+        const rawPayload = await parseJsonRequest(request);
+        const interaction = openAIResponsesToInteraction(rawPayload);
+        const requestPurpose = codexRequestPurpose(request.headers, rawPayload);
+        const agentContext = codexRequestContext(request.headers, rawPayload);
+        const museClientId = museCodeClientId(request.headers);
+        const payload = {
+            ...interaction,
+            ...(requestPurpose === undefined ? {} : { requestPurpose }),
+            ...(agentContext === undefined ? {} : { agentContext }),
+            ...(museClientId === undefined ? {} : { museCodeClientId: museClientId }),
+        };
+        const harnessConversationIdentity = codexConversationIdentity(request.headers, rawPayload);
+        // Codex applies its global model_reasoning_effort setting to custom model
+        // providers. That preference describes a direct model, not a heterogeneous
+        // router, so let Dari select the reasoning effort for verified Codex turns.
+        // Parsing above still validates malformed Responses reasoning controls.
+        if (harnessConversationIdentity !== undefined)
+            payload.reasoning = undefined;
+        return await handleRoutedCompletion({
+            request,
+            routerId,
+            apiKey,
+            payload,
+            responseBody: openAIResponsesResponse,
+            streamBody: openAIResponsesSseStream,
+            errorResponse,
+            selectorBackend,
+            clientHarness: museClientId === undefined ? undefined : "muse_code",
+            harnessConversationIdentity,
+        });
+    }
+    catch (error) {
+        const response = errorResponse(error);
+        captureRequestError(error, {
+            request,
+            routerId,
+            sourceProtocol: "openai_responses",
+            status: response.status,
+        });
+        return response;
+    }
+}
+export function handleResponsesWebSocketFallback() {
+    return Response.json({
+        error: {
+            message: "Responses WebSocket is not supported by this router endpoint; use HTTP Responses.",
+            type: "unsupported_transport",
+            code: "unsupported_transport",
+        },
+    }, {
+        status: 426,
+        headers: {
+            "Cache-Control": "no-store",
+        },
+    });
+}

package/dist/ingress/codex_models.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedRouter } from "../types.js";
+export declare function codexModelsResponse(router: Pick<ResolvedRouter, "enabled_models" | "model_configs" | "allow_long_context">, imageInputFor: (model: string) => boolean): Record<string, unknown>;

package/dist/ingress/codex_models.js

@@ -0,0 +1,89 @@
+import { CANONICAL_ROUTER_MODEL, explicitModelSlug } from "../protocol/input/router_model.js";
+import { effectiveContextWindow } from "../models/context_limits.js";
+import { modelSupportsHostedWebSearch } from "../providers/model_capabilities.js";
+const DEFAULT_CODEX_CONTEXT_WINDOW = 128_000;
+function codexRouterContextWindow(router) {
+    const windows = router.enabled_models.map((model) => {
+        const configured = effectiveContextWindow(router.model_configs?.[model], router.allow_long_context === true);
+        return typeof configured === "number" && Number.isFinite(configured) && configured > 0
+            ? Math.floor(configured)
+            : DEFAULT_CODEX_CONTEXT_WINDOW;
+    });
+    return windows.length > 0 ? Math.max(...windows) : DEFAULT_CODEX_CONTEXT_WINDOW;
+}
+function codexRouterSupportsHostedWebSearch(router) {
+    return router.enabled_models.some((model) => {
+        const config = router.model_configs?.[model];
+        return config ? modelSupportsHostedWebSearch({ model: config }) : false;
+    });
+}
+function codexCatalogEntry(args) {
+    return {
+        slug: args.slug,
+        display_name: args.displayName,
+        description: args.description,
+        default_reasoning_level: null,
+        supported_reasoning_levels: [],
+        shell_type: "shell_command",
+        visibility: "list",
+        supported_in_api: true,
+        priority: args.priority,
+        additional_speed_tiers: [],
+        service_tiers: [],
+        default_service_tier: null,
+        availability_nux: null,
+        upgrade: null,
+        base_instructions: "You are Codex, a coding agent. You and the user share one workspace, and your job is to collaborate with them until their goal is genuinely handled.",
+        model_messages: null,
+        include_skills_usage_instructions: false,
+        // Codex 0.144 requires the legacy field; current main reads the renamed field below.
+        supports_reasoning_summaries: false,
+        supports_reasoning_summary_parameter: false,
+        default_reasoning_summary: "none",
+        support_verbosity: false,
+        default_verbosity: null,
+        apply_patch_tool_type: "freeform",
+        web_search_tool_type: args.hostedWebSearch ? "text" : null,
+        truncation_policy: { mode: "tokens", limit: 10_000 },
+        supports_parallel_tool_calls: true,
+        supports_image_detail_original: false,
+        context_window: args.contextWindow,
+        max_context_window: args.contextWindow,
+        auto_compact_token_limit: null,
+        comp_hash: null,
+        effective_context_window_percent: 95,
+        experimental_supported_tools: [],
+        input_modalities: args.imageInput ? ["text", "image"] : ["text"],
+        supports_search_tool: false,
+        use_responses_lite: false,
+        auto_review_model_override: args.slug,
+        tool_mode: null,
+        multi_agent_version: null,
+    };
+}
+/* `dari/routing` stays first (the Codex launcher patches it); each enabled
+   model follows as `dari/model/<id>` so Codex's /model menu can switch to it. */
+export function codexModelsResponse(router, imageInputFor) {
+    return {
+        models: [
+            codexCatalogEntry({
+                slug: CANONICAL_ROUTER_MODEL,
+                displayName: "Dari Routing",
+                description: "Routes Codex HTTP Responses requests through the configured Dari model router.",
+                priority: 0,
+                contextWindow: codexRouterContextWindow(router),
+                hostedWebSearch: codexRouterSupportsHostedWebSearch(router),
+                imageInput: router.enabled_models.some(imageInputFor),
+            }),
+            ...router.enabled_models.map((model, index) => codexCatalogEntry({
+                slug: explicitModelSlug(model),
+                displayName: model,
+                description: `Serves ${model} directly, without routing.`,
+                priority: index + 1,
+                contextWindow: codexRouterContextWindow({ ...router, enabled_models: [model] }),
+                hostedWebSearch: codexRouterSupportsHostedWebSearch({ ...router, enabled_models: [model] }),
+                imageInput: imageInputFor(model),
+            })),
+        ],
+    };
+}

package/dist/ingress/json.d.ts

@@ -0,0 +1 @@
+export declare function parseJsonRequest<T extends Record<string, unknown>>(request: Request): Promise<T>;

package/dist/ingress/json.js

@@ -0,0 +1,95 @@
+import { Readable } from "node:stream";
+import { createBrotliDecompress, createGunzip, createInflate, createZstdDecompress, } from "node:zlib";
+import { HttpError } from "../http/errors.js";
+const MAX_ENCODED_JSON_REQUEST_BYTES = 64 * 1024 * 1024;
+const MAX_DECODED_JSON_REQUEST_BYTES = 64 * 1024 * 1024;
+const MAX_CONTENT_ENCODING_LAYERS = 3;
+export async function parseJsonRequest(request) {
+    let payload;
+    try {
+        payload = JSON.parse(await requestText(request));
+    }
+    catch (error) {
+        if (error instanceof HttpError)
+            throw error;
+        throw new HttpError(400, "Request body must be valid JSON.", "invalid_request_error");
+    }
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+        throw new HttpError(400, "Request body must be a JSON object.", "invalid_request_error");
+    }
+    return payload;
+}
+async function requestText(request) {
+    const contentLength = request.headers.get("content-length");
+    if (contentLength !== null) {
+        const parsed = Number(contentLength);
+        if (Number.isFinite(parsed) && parsed > MAX_ENCODED_JSON_REQUEST_BYTES) {
+            throw requestTooLarge();
+        }
+    }
+    const encodings = contentEncodings(request.headers.get("content-encoding"));
+    if (encodings.length > MAX_CONTENT_ENCODING_LAYERS) {
+        throw new HttpError(415, "Too many Content-Encoding layers.", "unsupported_content_encoding", "content-encoding");
+    }
+    let stream = boundedChunks(request.body ?? emptyByteStream(), MAX_ENCODED_JSON_REQUEST_BYTES);
+    for (const encoding of encodings.reverse()) {
+        stream = boundedChunks(decodedChunks(stream, encoding), MAX_DECODED_JSON_REQUEST_BYTES);
+    }
+    return await readText(stream);
+}
+function contentEncodings(header) {
+    if (!header)
+        return [];
+    return header
+        .split(",")
+        .map((value) => value.trim().toLowerCase())
+        .filter((value) => value && value !== "identity");
+}
+async function* boundedChunks(stream, maxBytes) {
+    let bytesRead = 0;
+    for await (const chunk of stream) {
+        bytesRead += chunk.byteLength;
+        if (bytesRead > maxBytes)
+            throw requestTooLarge();
+        yield chunk;
+    }
+}
+async function* decodedChunks(stream, encoding) {
+    const decoded = Readable.from(stream).pipe(decompressor(encoding));
+    try {
+        for await (const chunk of decoded) {
+            if (!(chunk instanceof Uint8Array))
+                throw new Error("Decompressor emitted a non-byte chunk.");
+            yield chunk;
+        }
+    }
+    finally {
+        decoded.destroy();
+    }
+}
+function decompressor(encoding) {
+    if (encoding === "zstd")
+        return createZstdDecompress();
+    if (encoding === "gzip" || encoding === "x-gzip")
+        return createGunzip();
+    if (encoding === "deflate")
+        return createInflate();
+    if (encoding === "br")
+        return createBrotliDecompress();
+    throw new HttpError(415, `Unsupported Content-Encoding '${encoding}'.`, "unsupported_content_encoding", "content-encoding");
+}
+async function readText(stream) {
+    const decoder = new TextDecoder();
+    const parts = [];
+    for await (const chunk of stream) {
+        parts.push(decoder.decode(chunk, { stream: true }));
+    }
+    parts.push(decoder.decode());
+    return parts.join("");
+}
+async function* emptyByteStream() {
+    return;
+}
+function requestTooLarge() {
+    return new HttpError(413, "Request body is too large.", "request_entity_too_large");
+}

package/dist/ingress/models.d.ts

@@ -0,0 +1 @@
+export declare function handleModels(request: Request, routerId: string): Promise<Response>;

package/dist/ingress/models.js

@@ -0,0 +1,65 @@
+/* Shared GET /models discovery route. One URL serves two client protocols:
+   Codex reads the Codex catalog; Anthropic-SDK clients (Claude Desktop /
+   Cowork gateway probes, Claude Code) read the Anthropic list shape. The
+   handler detects the caller, authenticates in that protocol's auth shape,
+   and selects the matching catalog adapter. `?detail=1` instead returns the
+   model catalog (models/catalog.ts), optionally narrowed with
+   `provider=<id>[,<id>...]`. */
+import { anthropicToken, bearerToken } from "../http/auth.js";
+import { errorResponse } from "../http/errors.js";
+import { captureRequestError } from "../observability/errors.js";
+import { anthropicErrorResponse } from "./anthropic_messages.js";
+import { listModelCatalog } from "../models/catalog.js";
+import { modelSupportsImageInput } from "../providers/model_capabilities.js";
+import { modelMetadataLookup } from "../providers/pi.js";
+import { resolveRouter } from "../strategies/routing.js";
+import { anthropicModelsResponse } from "./anthropic_models.js";
+import { codexModelsResponse } from "./codex_models.js";
+export async function handleModels(request, routerId) {
+    // Anthropic SDK clients always send anthropic-version, and API-key probes
+    // authenticate via x-api-key instead of a bearer Authorization header.
+    // Codex sends neither.
+    const anthropicClient = request.headers.has("anthropic-version") ||
+        (!request.headers.get("authorization") && request.headers.has("x-api-key"));
+    try {
+        const apiKey = anthropicClient ? anthropicToken(request.headers) : bearerToken(request.headers);
+        // Resolution authenticates the key and confirms the router exists even
+        // when the response body (Anthropic shape) does not depend on it.
+        const router = await resolveRouter({ routerId, apiKey });
+        const query = new URL(request.url).searchParams;
+        if (query.get("detail") === "1") {
+            const providers = query.get("provider")?.split(",").map((id) => id.trim()).filter(Boolean);
+            const data = await listModelCatalog({
+                ...(providers?.length ? { providers } : {}),
+                signal: request.signal,
+            });
+            return Response.json({ object: "list", data }, { headers: { "Cache-Control": "no-store" } });
+        }
+        if (anthropicClient) {
+            return Response.json(anthropicModelsResponse(), {
+                headers: {
+                    "Cache-Control": "no-store",
+                },
+            });
+        }
+        const metadataLookup = modelMetadataLookup(router.model_configs);
+        const imageInputFor = (model) => modelSupportsImageInput(metadataLookup(model));
+        return Response.json(codexModelsResponse(router, imageInputFor), {
+            headers: {
+                "Cache-Control": "no-store",
+            },
+        });
+    }
+    catch (error) {
+        // Each protocol's clients parse their own error envelope: Anthropic's
+        // {type:"error",error:{type,message}} vs the OpenAI {error:{...}} shape.
+        const response = anthropicClient ? anthropicErrorResponse(error) : errorResponse(error);
+        captureRequestError(error, {
+            request,
+            routerId,
+            sourceProtocol: anthropicClient ? "anthropic_models" : "openai_models",
+            status: response.status,
+        });
+        return response;
+    }
+}

package/dist/ingress/muse_code.d.ts

@@ -0,0 +1,2 @@
+/** Muse Code's x-client-id when the request comes from Muse Code. */
+export declare function museCodeClientId(headers: Headers): string | undefined;

package/dist/ingress/muse_code.js

@@ -0,0 +1,8 @@
+// Muse Code names its surface (TUI, `muse exec`, desktop, `muse serve`) in
+// x-client-id on every model request.
+const MUSE_CODE_CLIENT_IDS = new Set(["tbh:tui", "tbh:exec", "tbh:desktop", "tbh:serve"]);
+/** Muse Code's x-client-id when the request comes from Muse Code. */
+export function museCodeClientId(headers) {
+    const clientId = headers.get("x-client-id")?.trim().toLowerCase();
+    return clientId !== undefined && MUSE_CODE_CLIENT_IDS.has(clientId) ? clientId : undefined;
+}

package/dist/ingress/muse_models.d.ts

@@ -0,0 +1,9 @@
+import type { ResolvedRouter } from "../types.js";
+/**
+ * Muse Code fetches its model list from its base URL's origin
+ * (`/muse-code/models`) before its first request. A list of only the router's
+ * models lets Muse Code pick from them and start on the first; `dari/routing`
+ * leads it only on the Autorouting plan.
+ */
+export declare function museCodeModelsResponse(router: Pick<ResolvedRouter, "enabled_models" | "autorouting_enabled">): Record<string, unknown>;
+export declare function handleMuseCodeModels(request: Request, routerId: string): Promise<Response>;

package/dist/ingress/muse_models.js

@@ -0,0 +1,32 @@
+import { bearerToken } from "../http/auth.js";
+import { errorResponse } from "../http/errors.js";
+import { resolveRouter } from "../strategies/routing.js";
+/**
+ * Muse Code fetches its model list from its base URL's origin
+ * (`/muse-code/models`) before its first request. A list of only the router's
+ * models lets Muse Code pick from them and start on the first; `dari/routing`
+ * leads it only on the Autorouting plan.
+ */
+export function museCodeModelsResponse(router) {
+    const ids = [
+        ...(router.autorouting_enabled === false ? [] : ["dari/routing"]),
+        ...router.enabled_models.map((model) => `dari/model/${model}`),
+    ];
+    return {
+        data: ids.map((id, index) => ({
+            id,
+            display_label: id === "dari/routing" ? "Dari Routing" : id.slice("dari/model/".length),
+            is_default: index === 0,
+        })),
+    };
+}
+export async function handleMuseCodeModels(request, routerId) {
+    try {
+        // Only Muse Code fetches this list, so its plans apply even without a Meta key.
+        const router = await resolveRouter({ routerId, apiKey: bearerToken(request.headers), clientHarness: "muse_code" });
+        return Response.json(museCodeModelsResponse(router), { headers: { "Cache-Control": "no-store" } });
+    }
+    catch (error) {
+        return errorResponse(error);
+    }
+}