@oscharko-dev/keiko 0.1.5 → 0.1.7

package/dist/gateway/capabilities.js

@@ -1,59 +1,3 @@
-// Capability registry: the single source of truth for model routing. Workflow code
-// selects models by querying this registry (by id or by capability requirements),
-// never by hard-coding a model name.
-import { CAPABILITY_DATA } from "./capabilities.data.js";
-export const CAPABILITY_REGISTRY = CAPABILITY_DATA;
-const COST_RANK = { low: 0, medium: 1, high: 2 };
-export function findCapability(modelId) {
-    return CAPABILITY_REGISTRY.find((cap) => cap.id === modelId);
-}
-export function listCapabilities() {
-    return CAPABILITY_REGISTRY;
-}
-export function createDefaultChatCapability(modelId) {
-    return {
-        id: modelId,
-        kind: "chat",
-        contextWindow: 0,
-        maxOutputTokens: 0,
-        toolCalling: true,
-        structuredOutput: true,
-        streaming: true,
-        costClass: "medium",
-        latencyClass: "standard",
-        throughputHint: "runtime-configured endpoint",
-        preferredUseCases: ["Chat", "Agent workflow"],
-        knownLimitations: [
-            "Runtime-configured capability; validate against the target endpoint before production use",
-        ],
-    };
-}
-function matches(cap, query) {
-    if (query.kind !== undefined && cap.kind !== query.kind) {
-        return false;
-    }
-    if (query.toolCalling === true && !cap.toolCalling) {
-        return false;
-    }
-    if (query.structuredOutput === true && !cap.structuredOutput) {
-        return false;
-    }
-    if (query.minContextWindow !== undefined && cap.contextWindow < query.minContextWindow) {
-        return false;
-    }
-    return true;
-}
-// Returns the lowest-cost capability satisfying the query, or undefined if none.
-// Ties on cost class are broken by registry order (first declared wins).
-export function selectCheapest(query) {
-    let best;
-    for (const cap of CAPABILITY_REGISTRY) {
-        if (!matches(cap, query)) {
-            continue;
-        }
-        if (best === undefined || COST_RANK[cap.costClass] < COST_RANK[best.costClass]) {
-            best = cap;
-        }
-    }
-    return best;
-}
+// Re-export shim: capabilities now lives in @oscharko-dev/keiko-model-gateway (issue #160, ADR-0019).
+// All existing import sites (`from "../gateway/capabilities.js"`) keep resolving unchanged via this barrel.
+export { CAPABILITY_REGISTRY, createDefaultChatCapability, findCapability, listCapabilities, selectCheapest, } from "@oscharko-dev/keiko-model-gateway";

package/dist/gateway/config.d.ts

@@ -1,22 +1,2 @@
-import type { CircuitBreakerConfig, GatewayConfig, ModelCapability } from "./types.js";
-export declare const DEFAULT_API_KEY_HEADER_NAME = "authorization";
-export declare const SUPPORTED_API_KEY_HEADER_NAMES: readonly ["authorization", "x-litellm-key", "x-api-key", "api-key"];
-export type EnvSource = Readonly<Record<string, string | undefined>>;
-export interface SafeProviderConfig {
-    readonly modelId: string;
-    readonly credentialHeaderName: string;
-    readonly timeoutMs: number;
-    readonly maxRetries: number;
-    readonly retryBaseDelayMs: number;
-}
-export interface SafeGatewayConfig {
-    readonly providers: readonly SafeProviderConfig[];
-    readonly circuitBreaker: CircuitBreakerConfig;
-    readonly capabilities?: readonly ModelCapability[] | undefined;
-}
-export declare function normalizeApiKeyHeaderName(value: unknown, path: string, fallback?: string): string;
-export declare function apiKeyHeaderValue(headerName: string, apiKey: string): string;
-export declare function validateBaseUrl(baseUrl: string, path: string): void;
-export declare function parseGatewayConfig(raw: unknown, env?: EnvSource): GatewayConfig;
-export declare function loadConfigFromFile(path: string, env?: EnvSource): GatewayConfig;
-export declare function toSafeObject(config: GatewayConfig): SafeGatewayConfig;
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "@oscharko-dev/keiko-model-gateway";
+export type { EnvSource, SafeGatewayConfig, SafeProviderConfig, } from "@oscharko-dev/keiko-model-gateway";

package/dist/gateway/config.js

@@ -1,305 +1,3 @@
-// Gateway config loading, hand-rolled validation, and redaction-aware serialisation.
-// No schema library: validation is explicit if/throw with actionable messages.
-// API keys are sourced only from environment or the config file, never CLI flags,
-// and are excluded from every serialisation path.
-import { readFileSync } from "node:fs";
-import { isIP } from "node:net";
-import { ConfigInvalidError } from "./errors.js";
-const DEFAULT_TIMEOUT_MS = 30_000;
-const DEFAULT_MAX_RETRIES = 3;
-const DEFAULT_RETRY_BASE_DELAY_MS = 500;
-const DEFAULT_FAILURE_THRESHOLD = 5;
-const DEFAULT_COOLDOWN_MS = 30_000;
-const DEFAULT_HALF_OPEN_PROBES = 2;
-export const DEFAULT_API_KEY_HEADER_NAME = "authorization";
-const MAX_API_KEY_HEADER_NAME_LENGTH = 64;
-const API_KEY_HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
-export const SUPPORTED_API_KEY_HEADER_NAMES = [
-    DEFAULT_API_KEY_HEADER_NAME,
-    "x-litellm-key",
-    "x-api-key",
-    "api-key",
-];
-const SUPPORTED_API_KEY_HEADER_NAME_SET = new Set(SUPPORTED_API_KEY_HEADER_NAMES);
-const BEARER_API_KEY_HEADER_NAME_SET = new Set([
-    DEFAULT_API_KEY_HEADER_NAME,
-    "x-litellm-key",
-]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function requirePositiveInt(value, path) {
-    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-        throw new ConfigInvalidError(`${path} must be a positive integer`);
-    }
-    return value;
-}
-function requireNonEmptyString(value, path) {
-    if (typeof value !== "string" || value.length === 0) {
-        throw new ConfigInvalidError(`${path} must be a non-empty string`);
-    }
-    return value;
-}
-function optionalStringArray(value, path, fallback) {
-    if (value === undefined) {
-        return fallback;
-    }
-    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
-        throw new ConfigInvalidError(`${path} must be an array of strings`);
-    }
-    return value;
-}
-function optionalNonNegativeInt(value, path, fallback) {
-    if (value === undefined) {
-        return fallback;
-    }
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
-        throw new ConfigInvalidError(`${path} must be a non-negative integer`);
-    }
-    return value;
-}
-function optionalBoolean(value, path, fallback) {
-    if (value === undefined) {
-        return fallback;
-    }
-    if (typeof value !== "boolean") {
-        throw new ConfigInvalidError(`${path} must be a boolean`);
-    }
-    return value;
-}
-function optionalNonEmptyString(value, path, fallback) {
-    if (value === undefined) {
-        return fallback;
-    }
-    return requireNonEmptyString(value, path);
-}
-export function normalizeApiKeyHeaderName(value, path, fallback = DEFAULT_API_KEY_HEADER_NAME) {
-    if (value === undefined) {
-        return fallback;
-    }
-    if (typeof value !== "string") {
-        throw new ConfigInvalidError(`${path} must be a string`);
-    }
-    const headerName = value.trim().toLowerCase();
-    if (headerName.length === 0) {
-        return fallback;
-    }
-    if (headerName.length > MAX_API_KEY_HEADER_NAME_LENGTH ||
-        !API_KEY_HEADER_NAME_RE.test(headerName)) {
-        throw new ConfigInvalidError(`${path} must be a valid HTTP header name`);
-    }
-    if (!SUPPORTED_API_KEY_HEADER_NAME_SET.has(headerName)) {
-        throw new ConfigInvalidError(`${path} must be one of ${SUPPORTED_API_KEY_HEADER_NAMES.join(", ")}`);
-    }
-    return headerName;
-}
-export function apiKeyHeaderValue(headerName, apiKey) {
-    if (BEARER_API_KEY_HEADER_NAME_SET.has(headerName) &&
-        !apiKey.toLowerCase().startsWith("bearer ")) {
-        return `Bearer ${apiKey}`;
-    }
-    return apiKey;
-}
-function requireEnum(value, path, allowed) {
-    if (typeof value !== "string" || !allowed.includes(value)) {
-        throw new ConfigInvalidError(`${path} must be one of ${allowed.join(", ")}`);
-    }
-    return value;
-}
-// Model id → KEIKO_MODEL_<UPPER>_ form: non-alphanumerics become "_", uppercased.
-function envModelToken(modelId) {
-    return modelId.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
-}
-function resolveSecret(modelId, fileValue, env, suffix) {
-    const perModel = env[`KEIKO_MODEL_${envModelToken(modelId)}_${suffix}`];
-    if (perModel !== undefined && perModel.length > 0) {
-        return perModel;
-    }
-    if (fileValue.length > 0) {
-        return fileValue;
-    }
-    const fallback = env[`KEIKO_DEFAULT_${suffix}`];
-    return fallback ?? "";
-}
-function resolveApiKeyHeaderName(rawValue, path, modelId, env) {
-    const token = envModelToken(modelId);
-    const perModelName = `KEIKO_MODEL_${token}_API_KEY_HEADER_NAME`;
-    const perModel = env[perModelName];
-    if (perModel !== undefined && perModel.length > 0) {
-        return normalizeApiKeyHeaderName(perModel, perModelName);
-    }
-    if (rawValue !== undefined) {
-        return normalizeApiKeyHeaderName(rawValue, path);
-    }
-    return normalizeApiKeyHeaderName(env.KEIKO_DEFAULT_API_KEY_HEADER_NAME, "KEIKO_DEFAULT_API_KEY_HEADER_NAME");
-}
-// Validates a resolved baseUrl for scheme and credential hygiene. Host/IP is
-// intentionally NOT restricted: Keiko addresses private network endpoints
-// (private IPs are a valid, first-class target); this guard is scheme/credential
-// hygiene + defence-in-depth, not host filtering.
-function isLoopbackHost(hostname) {
-    if (hostname === "localhost" || hostname === "::1" || hostname === "[::1]") {
-        return true;
-    }
-    // Real IPv4 loopback only. isIP === 4 guarantees a well-formed dotted-quad, so a "127." prefix
-    // here is the 127.0.0.0/8 block — never a domain such as "127.evil.com" or "127.0.0.1.evil.com".
-    // The WHATWG URL parser has already canonicalised IPv4 shorthand/hex into url.hostname.
-    return isIP(hostname) === 4 && hostname.startsWith("127.");
-}
-export function validateBaseUrl(baseUrl, path) {
-    let url;
-    try {
-        url = new URL(baseUrl);
-    }
-    catch {
-        throw new ConfigInvalidError(`${path}.baseUrl must be a valid absolute URL`);
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new ConfigInvalidError(`${path}.baseUrl must use the http or https scheme`);
-    }
-    if (url.search !== "" || url.hash !== "") {
-        throw new ConfigInvalidError(`${path}.baseUrl must not contain a query string or fragment`);
-    }
-    if (url.protocol === "http:" && !isLoopbackHost(url.hostname)) {
-        throw new ConfigInvalidError(`${path}.baseUrl must use https unless it targets localhost or loopback`);
-    }
-    if (url.username !== "" || url.password !== "") {
-        throw new ConfigInvalidError(`${path}.baseUrl must not embed credentials in the URL; provide the key via apiKey`);
-    }
-}
-function parseProviderCapability(raw, path, modelId) {
-    if (raw === undefined) {
-        return undefined;
-    }
-    if (!isRecord(raw)) {
-        throw new ConfigInvalidError(`${path} must be an object`);
-    }
-    const id = optionalNonEmptyString(raw.id, `${path}.id`, modelId);
-    if (id !== modelId) {
-        throw new ConfigInvalidError(`${path}.id must match the provider modelId`);
-    }
-    return {
-        id,
-        kind: requireEnum(raw.kind, `${path}.kind`, ["chat", "embedding", "ocr-vision"]),
-        contextWindow: optionalNonNegativeInt(raw.contextWindow, `${path}.contextWindow`, 0),
-        maxOutputTokens: optionalNonNegativeInt(raw.maxOutputTokens, `${path}.maxOutputTokens`, 0),
-        toolCalling: optionalBoolean(raw.toolCalling, `${path}.toolCalling`, false),
-        structuredOutput: optionalBoolean(raw.structuredOutput, `${path}.structuredOutput`, false),
-        streaming: optionalBoolean(raw.streaming, `${path}.streaming`, false),
-        costClass: requireEnum(raw.costClass ?? "medium", `${path}.costClass`, [
-            "low",
-            "medium",
-            "high",
-        ]),
-        latencyClass: requireEnum(raw.latencyClass ?? "standard", `${path}.latencyClass`, ["fast", "standard", "slow"]),
-        throughputHint: optionalNonEmptyString(raw.throughputHint, `${path}.throughputHint`, "runtime-configured"),
-        preferredUseCases: optionalStringArray(raw.preferredUseCases, `${path}.preferredUseCases`, [
-            "Runtime-configured model",
-        ]),
-        knownLimitations: optionalStringArray(raw.knownLimitations, `${path}.knownLimitations`, [
-            "Capabilities are runtime-declared and should be verified in the target environment",
-        ]),
-    };
-}
-function resolveProviderConnection(raw, path, modelId, env) {
-    const fileBaseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl : "";
-    const fileApiKey = typeof raw.apiKey === "string" ? raw.apiKey : "";
-    const baseUrl = resolveSecret(modelId, fileBaseUrl, env, "BASE_URL");
-    const apiKey = resolveSecret(modelId, fileApiKey, env, "API_KEY");
-    if (baseUrl.length === 0) {
-        throw new ConfigInvalidError(`${path}.baseUrl must be set via config or environment`);
-    }
-    if (apiKey.length === 0) {
-        throw new ConfigInvalidError(`${path}.apiKey must be set via config or environment`);
-    }
-    validateBaseUrl(baseUrl, path);
-    return { baseUrl, apiKey };
-}
-function parseProviderConfig(raw, path, modelId, env) {
-    const { baseUrl, apiKey } = resolveProviderConnection(raw, path, modelId, env);
-    return {
-        modelId,
-        baseUrl,
-        apiKey,
-        apiKeyHeaderName: resolveApiKeyHeaderName(raw.apiKeyHeaderName, `${path}.apiKeyHeaderName`, modelId, env),
-        timeoutMs: requirePositiveInt(raw.timeoutMs ?? DEFAULT_TIMEOUT_MS, `${path}.timeoutMs`),
-        maxRetries: requireNonNegativeInt(raw.maxRetries ?? DEFAULT_MAX_RETRIES, `${path}.maxRetries`),
-        retryBaseDelayMs: requirePositiveInt(raw.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS, `${path}.retryBaseDelayMs`),
-    };
-}
-function parseProvider(raw, index, env) {
-    const path = `providers[${String(index)}]`;
-    if (!isRecord(raw)) {
-        throw new ConfigInvalidError(`${path} must be an object`);
-    }
-    const modelId = requireNonEmptyString(raw.modelId, `${path}.modelId`);
-    const capability = parseProviderCapability(raw.capability, `${path}.capability`, modelId);
-    return {
-        provider: parseProviderConfig(raw, path, modelId, env),
-        ...(capability === undefined ? {} : { capability }),
-    };
-}
-function requireNonNegativeInt(value, path) {
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
-        throw new ConfigInvalidError(`${path} must be a non-negative integer`);
-    }
-    return value;
-}
-function parseCircuitBreaker(raw) {
-    const source = isRecord(raw) ? raw : {};
-    return {
-        failureThreshold: requirePositiveInt(source.failureThreshold ?? DEFAULT_FAILURE_THRESHOLD, "circuitBreaker.failureThreshold"),
-        cooldownMs: requirePositiveInt(source.cooldownMs ?? DEFAULT_COOLDOWN_MS, "circuitBreaker.cooldownMs"),
-        halfOpenProbes: requirePositiveInt(source.halfOpenProbes ?? DEFAULT_HALF_OPEN_PROBES, "circuitBreaker.halfOpenProbes"),
-    };
-}
-export function parseGatewayConfig(raw, env = {}) {
-    if (!isRecord(raw)) {
-        throw new ConfigInvalidError("config root must be a JSON object");
-    }
-    const providersRaw = raw.providers;
-    if (!Array.isArray(providersRaw) || providersRaw.length === 0) {
-        throw new ConfigInvalidError("providers must be a non-empty array");
-    }
-    const parsed = providersRaw.map((item, index) => parseProvider(item, index, env));
-    const providers = parsed.map((item) => item.provider);
-    const capabilities = parsed
-        .map((item) => item.capability)
-        .filter((item) => item !== undefined);
-    return {
-        providers,
-        circuitBreaker: parseCircuitBreaker(raw.circuitBreaker),
-        ...(capabilities.length === 0 ? {} : { capabilities }),
-    };
-}
-export function loadConfigFromFile(path, env = {}) {
-    let text;
-    try {
-        text = readFileSync(path, "utf8");
-    }
-    catch {
-        throw new ConfigInvalidError(`config file could not be read: ${path}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        throw new ConfigInvalidError(`config file is not valid JSON: ${path}`);
-    }
-    return parseGatewayConfig(parsed, env);
-}
-// Credential- and endpoint-free projection for logging, CLI output, and serialisation.
-export function toSafeObject(config) {
-    return {
-        providers: config.providers.map((provider) => ({
-            modelId: provider.modelId,
-            credentialHeaderName: provider.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME,
-            timeoutMs: provider.timeoutMs,
-            maxRetries: provider.maxRetries,
-            retryBaseDelayMs: provider.retryBaseDelayMs,
-        })),
-        circuitBreaker: config.circuitBreaker,
-        ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
-    };
-}
+// Re-export shim: config now lives in @oscharko-dev/keiko-model-gateway (issue #160, ADR-0019).
+// All existing import sites (`from "../gateway/config.js"`) keep resolving unchanged via this barrel.
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "@oscharko-dev/keiko-model-gateway";

package/dist/gateway/errors.d.ts

@@ -1,72 +1,2 @@
-export declare const ERROR_CODES: {
-    readonly AUTHENTICATION: "GATEWAY_AUTHENTICATION";
-    readonly TRANSPORT: "GATEWAY_TRANSPORT";
-    readonly MODEL_REFUSAL: "GATEWAY_MODEL_REFUSAL";
-    readonly MALFORMED_TOOL_CALL: "GATEWAY_MALFORMED_TOOL_CALL";
-    readonly CONTEXT_OVERFLOW: "GATEWAY_CONTEXT_OVERFLOW";
-    readonly RATE_LIMIT: "GATEWAY_RATE_LIMIT";
-    readonly TIMEOUT: "GATEWAY_TIMEOUT";
-    readonly CANCELLED: "GATEWAY_CANCELLED";
-    readonly CIRCUIT_OPEN: "GATEWAY_CIRCUIT_OPEN";
-    readonly PROVIDER_ERROR: "GATEWAY_PROVIDER_ERROR";
-    readonly CONFIG_INVALID: "GATEWAY_CONFIG_INVALID";
-    readonly UNKNOWN_MODEL: "GATEWAY_UNKNOWN_MODEL";
-};
-export type ErrorCode = (typeof ERROR_CODES)[keyof typeof ERROR_CODES];
-export declare abstract class GatewayError extends Error {
-    abstract readonly code: ErrorCode;
-    abstract readonly retryable: boolean;
-    constructor(message: string, secrets?: readonly string[]);
-}
-export declare class AuthenticationError extends GatewayError {
-    readonly code: "GATEWAY_AUTHENTICATION";
-    readonly retryable = false;
-}
-export declare class TransportError extends GatewayError {
-    readonly code: "GATEWAY_TRANSPORT";
-    readonly retryable = true;
-}
-export declare class ModelRefusalError extends GatewayError {
-    readonly code: "GATEWAY_MODEL_REFUSAL";
-    readonly retryable = false;
-}
-export declare class MalformedToolCallError extends GatewayError {
-    readonly code: "GATEWAY_MALFORMED_TOOL_CALL";
-    readonly retryable = false;
-}
-export declare class ContextOverflowError extends GatewayError {
-    readonly code: "GATEWAY_CONTEXT_OVERFLOW";
-    readonly retryable = false;
-}
-export declare class RateLimitError extends GatewayError {
-    readonly code: "GATEWAY_RATE_LIMIT";
-    readonly retryable = true;
-    readonly retryAfterMs: number | null;
-    constructor(message: string, retryAfterMs?: number | null, secrets?: readonly string[]);
-}
-export declare class TimeoutError extends GatewayError {
-    readonly code: "GATEWAY_TIMEOUT";
-    readonly retryable = true;
-}
-export declare class CancelledError extends GatewayError {
-    readonly code: "GATEWAY_CANCELLED";
-    readonly retryable = false;
-}
-export declare class CircuitOpenError extends GatewayError {
-    readonly code: "GATEWAY_CIRCUIT_OPEN";
-    readonly retryable = false;
-}
-export declare class ProviderError extends GatewayError {
-    readonly code: "GATEWAY_PROVIDER_ERROR";
-    readonly retryable = false;
-    readonly httpStatus: number;
-    constructor(message: string, httpStatus: number, secrets?: readonly string[]);
-}
-export declare class ConfigInvalidError extends GatewayError {
-    readonly code: "GATEWAY_CONFIG_INVALID";
-    readonly retryable = false;
-}
-export declare class UnknownModelError extends GatewayError {
-    readonly code: "GATEWAY_UNKNOWN_MODEL";
-    readonly retryable = false;
-}
+export { ERROR_CODES, GatewayError, AuthenticationError, TransportError, ModelRefusalError, MalformedToolCallError, ContextOverflowError, RateLimitError, TimeoutError, CancelledError, CircuitOpenError, ProviderError, ConfigInvalidError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";
+export type { ErrorCode } from "@oscharko-dev/keiko-security/errors/gateway";

package/dist/gateway/errors.js

@@ -1,82 +1,4 @@
-// Typed error taxonomy with stable string `code` discriminants. Callers switch on
-// `error.code`; they never parse `error.message`. Every message is redacted at
-// construction so errors are always safe to log.
-import { redact } from "./redaction.js";
-export const ERROR_CODES = {
-    AUTHENTICATION: "GATEWAY_AUTHENTICATION",
-    TRANSPORT: "GATEWAY_TRANSPORT",
-    MODEL_REFUSAL: "GATEWAY_MODEL_REFUSAL",
-    MALFORMED_TOOL_CALL: "GATEWAY_MALFORMED_TOOL_CALL",
-    CONTEXT_OVERFLOW: "GATEWAY_CONTEXT_OVERFLOW",
-    RATE_LIMIT: "GATEWAY_RATE_LIMIT",
-    TIMEOUT: "GATEWAY_TIMEOUT",
-    CANCELLED: "GATEWAY_CANCELLED",
-    CIRCUIT_OPEN: "GATEWAY_CIRCUIT_OPEN",
-    PROVIDER_ERROR: "GATEWAY_PROVIDER_ERROR",
-    CONFIG_INVALID: "GATEWAY_CONFIG_INVALID",
-    UNKNOWN_MODEL: "GATEWAY_UNKNOWN_MODEL",
-};
-export class GatewayError extends Error {
-    constructor(message, secrets = []) {
-        super(redact(message, secrets));
-        this.name = new.target.name;
-    }
-}
-export class AuthenticationError extends GatewayError {
-    code = ERROR_CODES.AUTHENTICATION;
-    retryable = false;
-}
-export class TransportError extends GatewayError {
-    code = ERROR_CODES.TRANSPORT;
-    retryable = true;
-}
-export class ModelRefusalError extends GatewayError {
-    code = ERROR_CODES.MODEL_REFUSAL;
-    retryable = false;
-}
-export class MalformedToolCallError extends GatewayError {
-    code = ERROR_CODES.MALFORMED_TOOL_CALL;
-    retryable = false;
-}
-export class ContextOverflowError extends GatewayError {
-    code = ERROR_CODES.CONTEXT_OVERFLOW;
-    retryable = false;
-}
-export class RateLimitError extends GatewayError {
-    code = ERROR_CODES.RATE_LIMIT;
-    retryable = true;
-    retryAfterMs;
-    constructor(message, retryAfterMs = null, secrets = []) {
-        super(message, secrets);
-        this.retryAfterMs = retryAfterMs;
-    }
-}
-export class TimeoutError extends GatewayError {
-    code = ERROR_CODES.TIMEOUT;
-    retryable = true;
-}
-export class CancelledError extends GatewayError {
-    code = ERROR_CODES.CANCELLED;
-    retryable = false;
-}
-export class CircuitOpenError extends GatewayError {
-    code = ERROR_CODES.CIRCUIT_OPEN;
-    retryable = false;
-}
-export class ProviderError extends GatewayError {
-    code = ERROR_CODES.PROVIDER_ERROR;
-    retryable = false;
-    httpStatus;
-    constructor(message, httpStatus, secrets = []) {
-        super(message, secrets);
-        this.httpStatus = httpStatus;
-    }
-}
-export class ConfigInvalidError extends GatewayError {
-    code = ERROR_CODES.CONFIG_INVALID;
-    retryable = false;
-}
-export class UnknownModelError extends GatewayError {
-    code = ERROR_CODES.UNKNOWN_MODEL;
-    retryable = false;
-}
+// Re-export shim: the gateway error taxonomy now lives in @oscharko-dev/keiko-security
+// (issue #159, ADR-0019). All existing import sites (`from "../gateway/errors.js"`) keep
+// resolving unchanged via this barrel.
+export { ERROR_CODES, GatewayError, AuthenticationError, TransportError, ModelRefusalError, MalformedToolCallError, ContextOverflowError, RateLimitError, TimeoutError, CancelledError, CircuitOpenError, ProviderError, ConfigInvalidError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";

package/dist/gateway/gateway.d.ts

@@ -1,19 +1,2 @@
-import type { Clock, CircuitBreakerStatus, GatewayConfig, GatewayRequest, NormalizedResponse, ProviderAdapter } from "./types.js";
-export interface GatewayDeps {
-    readonly adapter?: ProviderAdapter | undefined;
-    readonly clock?: Clock | undefined;
-}
-export declare class Gateway {
-    private readonly config;
-    private readonly clock;
-    private readonly adapter;
-    private readonly providers;
-    private readonly breakers;
-    constructor(config: GatewayConfig, deps?: GatewayDeps);
-    chat(request: GatewayRequest): Promise<NormalizedResponse>;
-    circuitStatus(modelId: string): CircuitBreakerStatus;
-    private invoke;
-    private route;
-    private breakerFor;
-    private adapterFor;
-}
+export { Gateway } from "@oscharko-dev/keiko-model-gateway";
+export type { GatewayDeps } from "@oscharko-dev/keiko-model-gateway";

package/dist/gateway/gateway.js

@@ -1,94 +1,3 @@
-// Orchestrator: routes a request through the capability registry, then through the
-// circuit breaker, bounded retry, and the provider adapter. Usage metadata
-// (request id, latency, cost class) is owned by the gateway, not the provider, so
-// the audit ledger (issue #10) has a reliable typed target on every response.
-import { randomUUID } from "node:crypto";
-import { UnknownModelError } from "./errors.js";
-import { findConfiguredCapability } from "./model-selection.js";
-import { OpenAiAdapter } from "./openai-adapter.js";
-import { CircuitBreaker, executeWithRetry, systemClock } from "./resilience.js";
-export class Gateway {
-    config;
-    clock;
-    adapter;
-    providers;
-    breakers = new Map();
-    constructor(config, deps = {}) {
-        this.config = config;
-        this.clock = deps.clock ?? systemClock;
-        this.adapter = deps.adapter;
-        this.providers = new Map(config.providers.map((p) => [p.modelId, p]));
-    }
-    async chat(request) {
-        const route = this.route(request.modelId);
-        const breaker = this.breakerFor(route.provider);
-        const requestId = randomUUID();
-        const start = this.clock.now();
-        const adapter = this.adapterFor(requestId, route.capability);
-        const result = await executeWithRetry((attemptTimeoutMs) => this.invoke(breaker, adapter, request, {
-            ...route.provider,
-            ...(attemptTimeoutMs === undefined ? {} : { timeoutMs: attemptTimeoutMs }),
-        }), route.provider, this.clock, request.cancellationSignal);
-        return {
-            ...result,
-            usage: {
-                ...result.usage,
-                requestId,
-                latencyMs: Math.max(1, this.clock.now() - start),
-                costClass: route.capability.costClass,
-            },
-        };
-    }
-    circuitStatus(modelId) {
-        const breaker = this.breakers.get(modelId);
-        return (breaker?.status(modelId) ?? {
-            modelId,
-            state: "closed",
-            consecutiveFailures: 0,
-            openedAt: null,
-        });
-    }
-    async invoke(breaker, adapter, request, provider) {
-        breaker.assertAllowed();
-        try {
-            const response = await adapter.call(request, provider);
-            breaker.recordSuccess();
-            return response;
-        }
-        catch (error) {
-            breaker.recordFailure();
-            throw error;
-        }
-    }
-    route(modelId) {
-        const provider = this.providers.get(modelId);
-        if (provider === undefined) {
-            throw new UnknownModelError(`no provider configured for model '${modelId}'`);
-        }
-        const capability = findConfiguredCapability(this.config, modelId);
-        if (capability === undefined) {
-            throw new UnknownModelError(`model '${modelId}' has no capability metadata`);
-        }
-        if (capability.kind !== "chat") {
-            throw new UnknownModelError(`model '${modelId}' has kind '${capability.kind}'; the chat path requires a chat model`);
-        }
-        return { provider, capability };
-    }
-    breakerFor(provider) {
-        const existing = this.breakers.get(provider.modelId);
-        if (existing !== undefined) {
-            return existing;
-        }
-        const breaker = new CircuitBreaker(provider.modelId, this.config.circuitBreaker, this.clock);
-        this.breakers.set(provider.modelId, breaker);
-        return breaker;
-    }
-    adapterFor(requestId, capability) {
-        return (this.adapter ??
-            new OpenAiAdapter({
-                requestId,
-                costClass: capability.costClass,
-                now: this.clock.now,
-            }));
-    }
-}
+// Re-export shim: gateway now lives in @oscharko-dev/keiko-model-gateway (issue #160, ADR-0019).
+// All existing import sites (`from "../gateway/gateway.js"`) keep resolving unchanged via this barrel.
+export { Gateway } from "@oscharko-dev/keiko-model-gateway";