@oscharko-dev/keiko 0.1.5 → 0.1.7

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/config.js

@@ -0,0 +1,305 @@
+// Gateway config loading, hand-rolled validation, and redaction-aware serialisation.
+// No schema library: validation is explicit if/throw with actionable messages.
+// API keys are sourced only from environment or the config file, never CLI flags,
+// and are excluded from every serialisation path.
+import { readFileSync } from "node:fs";
+import { isIP } from "node:net";
+import { ConfigInvalidError } from "@oscharko-dev/keiko-security/errors/gateway";
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_RETRIES = 3;
+const DEFAULT_RETRY_BASE_DELAY_MS = 500;
+const DEFAULT_FAILURE_THRESHOLD = 5;
+const DEFAULT_COOLDOWN_MS = 30_000;
+const DEFAULT_HALF_OPEN_PROBES = 2;
+export const DEFAULT_API_KEY_HEADER_NAME = "authorization";
+const MAX_API_KEY_HEADER_NAME_LENGTH = 64;
+const API_KEY_HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
+export const SUPPORTED_API_KEY_HEADER_NAMES = [
+    DEFAULT_API_KEY_HEADER_NAME,
+    "x-litellm-key",
+    "x-api-key",
+    "api-key",
+];
+const SUPPORTED_API_KEY_HEADER_NAME_SET = new Set(SUPPORTED_API_KEY_HEADER_NAMES);
+const BEARER_API_KEY_HEADER_NAME_SET = new Set([
+    DEFAULT_API_KEY_HEADER_NAME,
+    "x-litellm-key",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requirePositiveInt(value, path) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+        throw new ConfigInvalidError(`${path} must be a positive integer`);
+    }
+    return value;
+}
+function requireNonEmptyString(value, path) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ConfigInvalidError(`${path} must be a non-empty string`);
+    }
+    return value;
+}
+function optionalStringArray(value, path, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new ConfigInvalidError(`${path} must be an array of strings`);
+    }
+    return value;
+}
+function optionalNonNegativeInt(value, path, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+        throw new ConfigInvalidError(`${path} must be a non-negative integer`);
+    }
+    return value;
+}
+function optionalBoolean(value, path, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    if (typeof value !== "boolean") {
+        throw new ConfigInvalidError(`${path} must be a boolean`);
+    }
+    return value;
+}
+function optionalNonEmptyString(value, path, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    return requireNonEmptyString(value, path);
+}
+export function normalizeApiKeyHeaderName(value, path, fallback = DEFAULT_API_KEY_HEADER_NAME) {
+    if (value === undefined) {
+        return fallback;
+    }
+    if (typeof value !== "string") {
+        throw new ConfigInvalidError(`${path} must be a string`);
+    }
+    const headerName = value.trim().toLowerCase();
+    if (headerName.length === 0) {
+        return fallback;
+    }
+    if (headerName.length > MAX_API_KEY_HEADER_NAME_LENGTH ||
+        !API_KEY_HEADER_NAME_RE.test(headerName)) {
+        throw new ConfigInvalidError(`${path} must be a valid HTTP header name`);
+    }
+    if (!SUPPORTED_API_KEY_HEADER_NAME_SET.has(headerName)) {
+        throw new ConfigInvalidError(`${path} must be one of ${SUPPORTED_API_KEY_HEADER_NAMES.join(", ")}`);
+    }
+    return headerName;
+}
+export function apiKeyHeaderValue(headerName, apiKey) {
+    if (BEARER_API_KEY_HEADER_NAME_SET.has(headerName) &&
+        !apiKey.toLowerCase().startsWith("bearer ")) {
+        return `Bearer ${apiKey}`;
+    }
+    return apiKey;
+}
+function requireEnum(value, path, allowed) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new ConfigInvalidError(`${path} must be one of ${allowed.join(", ")}`);
+    }
+    return value;
+}
+// Model id → KEIKO_MODEL_<UPPER>_ form: non-alphanumerics become "_", uppercased.
+function envModelToken(modelId) {
+    return modelId.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
+}
+function resolveSecret(modelId, fileValue, env, suffix) {
+    const perModel = env[`KEIKO_MODEL_${envModelToken(modelId)}_${suffix}`];
+    if (perModel !== undefined && perModel.length > 0) {
+        return perModel;
+    }
+    if (fileValue.length > 0) {
+        return fileValue;
+    }
+    const fallback = env[`KEIKO_DEFAULT_${suffix}`];
+    return fallback ?? "";
+}
+function resolveApiKeyHeaderName(rawValue, path, modelId, env) {
+    const token = envModelToken(modelId);
+    const perModelName = `KEIKO_MODEL_${token}_API_KEY_HEADER_NAME`;
+    const perModel = env[perModelName];
+    if (perModel !== undefined && perModel.length > 0) {
+        return normalizeApiKeyHeaderName(perModel, perModelName);
+    }
+    if (rawValue !== undefined) {
+        return normalizeApiKeyHeaderName(rawValue, path);
+    }
+    return normalizeApiKeyHeaderName(env.KEIKO_DEFAULT_API_KEY_HEADER_NAME, "KEIKO_DEFAULT_API_KEY_HEADER_NAME");
+}
+// Validates a resolved baseUrl for scheme and credential hygiene. Host/IP is
+// intentionally NOT restricted: Keiko addresses private network endpoints
+// (private IPs are a valid, first-class target); this guard is scheme/credential
+// hygiene + defence-in-depth, not host filtering.
+function isLoopbackHost(hostname) {
+    if (hostname === "localhost" || hostname === "::1" || hostname === "[::1]") {
+        return true;
+    }
+    // Real IPv4 loopback only. isIP === 4 guarantees a well-formed dotted-quad, so a "127." prefix
+    // here is the 127.0.0.0/8 block — never a domain such as "127.evil.com" or "127.0.0.1.evil.com".
+    // The WHATWG URL parser has already canonicalised IPv4 shorthand/hex into url.hostname.
+    return isIP(hostname) === 4 && hostname.startsWith("127.");
+}
+export function validateBaseUrl(baseUrl, path) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw new ConfigInvalidError(`${path}.baseUrl must be a valid absolute URL`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new ConfigInvalidError(`${path}.baseUrl must use the http or https scheme`);
+    }
+    if (url.search !== "" || url.hash !== "") {
+        throw new ConfigInvalidError(`${path}.baseUrl must not contain a query string or fragment`);
+    }
+    if (url.protocol === "http:" && !isLoopbackHost(url.hostname)) {
+        throw new ConfigInvalidError(`${path}.baseUrl must use https unless it targets localhost or loopback`);
+    }
+    if (url.username !== "" || url.password !== "") {
+        throw new ConfigInvalidError(`${path}.baseUrl must not embed credentials in the URL; provide the key via apiKey`);
+    }
+}
+function parseProviderCapability(raw, path, modelId) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (!isRecord(raw)) {
+        throw new ConfigInvalidError(`${path} must be an object`);
+    }
+    const id = optionalNonEmptyString(raw.id, `${path}.id`, modelId);
+    if (id !== modelId) {
+        throw new ConfigInvalidError(`${path}.id must match the provider modelId`);
+    }
+    return {
+        id,
+        kind: requireEnum(raw.kind, `${path}.kind`, ["chat", "embedding", "ocr-vision"]),
+        contextWindow: optionalNonNegativeInt(raw.contextWindow, `${path}.contextWindow`, 0),
+        maxOutputTokens: optionalNonNegativeInt(raw.maxOutputTokens, `${path}.maxOutputTokens`, 0),
+        toolCalling: optionalBoolean(raw.toolCalling, `${path}.toolCalling`, false),
+        structuredOutput: optionalBoolean(raw.structuredOutput, `${path}.structuredOutput`, false),
+        streaming: optionalBoolean(raw.streaming, `${path}.streaming`, false),
+        costClass: requireEnum(raw.costClass ?? "medium", `${path}.costClass`, [
+            "low",
+            "medium",
+            "high",
+        ]),
+        latencyClass: requireEnum(raw.latencyClass ?? "standard", `${path}.latencyClass`, ["fast", "standard", "slow"]),
+        throughputHint: optionalNonEmptyString(raw.throughputHint, `${path}.throughputHint`, "runtime-configured"),
+        preferredUseCases: optionalStringArray(raw.preferredUseCases, `${path}.preferredUseCases`, [
+            "Runtime-configured model",
+        ]),
+        knownLimitations: optionalStringArray(raw.knownLimitations, `${path}.knownLimitations`, [
+            "Capabilities are runtime-declared and should be verified in the target environment",
+        ]),
+    };
+}
+function resolveProviderConnection(raw, path, modelId, env) {
+    const fileBaseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl : "";
+    const fileApiKey = typeof raw.apiKey === "string" ? raw.apiKey : "";
+    const baseUrl = resolveSecret(modelId, fileBaseUrl, env, "BASE_URL");
+    const apiKey = resolveSecret(modelId, fileApiKey, env, "API_KEY");
+    if (baseUrl.length === 0) {
+        throw new ConfigInvalidError(`${path}.baseUrl must be set via config or environment`);
+    }
+    if (apiKey.length === 0) {
+        throw new ConfigInvalidError(`${path}.apiKey must be set via config or environment`);
+    }
+    validateBaseUrl(baseUrl, path);
+    return { baseUrl, apiKey };
+}
+function parseProviderConfig(raw, path, modelId, env) {
+    const { baseUrl, apiKey } = resolveProviderConnection(raw, path, modelId, env);
+    return {
+        modelId,
+        baseUrl,
+        apiKey,
+        apiKeyHeaderName: resolveApiKeyHeaderName(raw.apiKeyHeaderName, `${path}.apiKeyHeaderName`, modelId, env),
+        timeoutMs: requirePositiveInt(raw.timeoutMs ?? DEFAULT_TIMEOUT_MS, `${path}.timeoutMs`),
+        maxRetries: requireNonNegativeInt(raw.maxRetries ?? DEFAULT_MAX_RETRIES, `${path}.maxRetries`),
+        retryBaseDelayMs: requirePositiveInt(raw.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS, `${path}.retryBaseDelayMs`),
+    };
+}
+function parseProvider(raw, index, env) {
+    const path = `providers[${String(index)}]`;
+    if (!isRecord(raw)) {
+        throw new ConfigInvalidError(`${path} must be an object`);
+    }
+    const modelId = requireNonEmptyString(raw.modelId, `${path}.modelId`);
+    const capability = parseProviderCapability(raw.capability, `${path}.capability`, modelId);
+    return {
+        provider: parseProviderConfig(raw, path, modelId, env),
+        ...(capability === undefined ? {} : { capability }),
+    };
+}
+function requireNonNegativeInt(value, path) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+        throw new ConfigInvalidError(`${path} must be a non-negative integer`);
+    }
+    return value;
+}
+function parseCircuitBreaker(raw) {
+    const source = isRecord(raw) ? raw : {};
+    return {
+        failureThreshold: requirePositiveInt(source.failureThreshold ?? DEFAULT_FAILURE_THRESHOLD, "circuitBreaker.failureThreshold"),
+        cooldownMs: requirePositiveInt(source.cooldownMs ?? DEFAULT_COOLDOWN_MS, "circuitBreaker.cooldownMs"),
+        halfOpenProbes: requirePositiveInt(source.halfOpenProbes ?? DEFAULT_HALF_OPEN_PROBES, "circuitBreaker.halfOpenProbes"),
+    };
+}
+export function parseGatewayConfig(raw, env = {}) {
+    if (!isRecord(raw)) {
+        throw new ConfigInvalidError("config root must be a JSON object");
+    }
+    const providersRaw = raw.providers;
+    if (!Array.isArray(providersRaw) || providersRaw.length === 0) {
+        throw new ConfigInvalidError("providers must be a non-empty array");
+    }
+    const parsed = providersRaw.map((item, index) => parseProvider(item, index, env));
+    const providers = parsed.map((item) => item.provider);
+    const capabilities = parsed
+        .map((item) => item.capability)
+        .filter((item) => item !== undefined);
+    return {
+        providers,
+        circuitBreaker: parseCircuitBreaker(raw.circuitBreaker),
+        ...(capabilities.length === 0 ? {} : { capabilities }),
+    };
+}
+export function loadConfigFromFile(path, env = {}) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        throw new ConfigInvalidError(`config file could not be read: ${path}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new ConfigInvalidError(`config file is not valid JSON: ${path}`);
+    }
+    return parseGatewayConfig(parsed, env);
+}
+// Credential- and endpoint-free projection for logging, CLI output, and serialisation.
+export function toSafeObject(config) {
+    return {
+        providers: config.providers.map((provider) => ({
+            modelId: provider.modelId,
+            credentialHeaderName: provider.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME,
+            timeoutMs: provider.timeoutMs,
+            maxRetries: provider.maxRetries,
+            retryBaseDelayMs: provider.retryBaseDelayMs,
+        })),
+        circuitBreaker: config.circuitBreaker,
+        ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
+    };
+}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.d.ts

@@ -0,0 +1,20 @@
+import type { Clock, CircuitBreakerStatus, GatewayConfig, GatewayRequest, NormalizedResponse, ProviderAdapter } from "./types.js";
+export interface GatewayDeps {
+    readonly adapter?: ProviderAdapter | undefined;
+    readonly clock?: Clock | undefined;
+}
+export declare class Gateway {
+    private readonly config;
+    private readonly clock;
+    private readonly adapter;
+    private readonly providers;
+    private readonly breakers;
+    constructor(config: GatewayConfig, deps?: GatewayDeps);
+    chat(request: GatewayRequest): Promise<NormalizedResponse>;
+    circuitStatus(modelId: string): CircuitBreakerStatus;
+    private invoke;
+    private route;
+    private breakerFor;
+    private adapterFor;
+}
+//# sourceMappingURL=gateway.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EAGd,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAOD,qBAAa,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAG3C,MAAM,EAAE,aAAa,EACtC,IAAI,GAAE,WAAgB;IAOlB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2BhE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;YAYtC,MAAM;IAiBpB,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAUnB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.js

@@ -0,0 +1,94 @@
+// Orchestrator: routes a request through the capability registry, then through the
+// circuit breaker, bounded retry, and the provider adapter. Usage metadata
+// (request id, latency, cost class) is owned by the gateway, not the provider, so
+// the audit ledger (issue #10) has a reliable typed target on every response.
+import { randomUUID } from "node:crypto";
+import { UnknownModelError } from "@oscharko-dev/keiko-security/errors/gateway";
+import { findConfiguredCapability } from "./model-selection.js";
+import { OpenAiAdapter } from "./openai-adapter.js";
+import { CircuitBreaker, executeWithRetry, systemClock } from "./resilience.js";
+export class Gateway {
+    config;
+    clock;
+    adapter;
+    providers;
+    breakers = new Map();
+    constructor(config, deps = {}) {
+        this.config = config;
+        this.clock = deps.clock ?? systemClock;
+        this.adapter = deps.adapter;
+        this.providers = new Map(config.providers.map((p) => [p.modelId, p]));
+    }
+    async chat(request) {
+        const route = this.route(request.modelId);
+        const breaker = this.breakerFor(route.provider);
+        const requestId = randomUUID();
+        const start = this.clock.now();
+        const adapter = this.adapterFor(requestId, route.capability);
+        const result = await executeWithRetry((attemptTimeoutMs) => this.invoke(breaker, adapter, request, {
+            ...route.provider,
+            ...(attemptTimeoutMs === undefined ? {} : { timeoutMs: attemptTimeoutMs }),
+        }), route.provider, this.clock, request.cancellationSignal);
+        return {
+            ...result,
+            usage: {
+                ...result.usage,
+                requestId,
+                latencyMs: Math.max(1, this.clock.now() - start),
+                costClass: route.capability.costClass,
+            },
+        };
+    }
+    circuitStatus(modelId) {
+        const breaker = this.breakers.get(modelId);
+        return (breaker?.status(modelId) ?? {
+            modelId,
+            state: "closed",
+            consecutiveFailures: 0,
+            openedAt: null,
+        });
+    }
+    async invoke(breaker, adapter, request, provider) {
+        breaker.assertAllowed();
+        try {
+            const response = await adapter.call(request, provider);
+            breaker.recordSuccess();
+            return response;
+        }
+        catch (error) {
+            breaker.recordFailure();
+            throw error;
+        }
+    }
+    route(modelId) {
+        const provider = this.providers.get(modelId);
+        if (provider === undefined) {
+            throw new UnknownModelError(`no provider configured for model '${modelId}'`);
+        }
+        const capability = findConfiguredCapability(this.config, modelId);
+        if (capability === undefined) {
+            throw new UnknownModelError(`model '${modelId}' has no capability metadata`);
+        }
+        if (capability.kind !== "chat") {
+            throw new UnknownModelError(`model '${modelId}' has kind '${capability.kind}'; the chat path requires a chat model`);
+        }
+        return { provider, capability };
+    }
+    breakerFor(provider) {
+        const existing = this.breakers.get(provider.modelId);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const breaker = new CircuitBreaker(provider.modelId, this.config.circuitBreaker, this.clock);
+        this.breakers.set(provider.modelId, breaker);
+        return breaker;
+    }
+    adapterFor(requestId, capability) {
+        return (this.adapter ??
+            new OpenAiAdapter({
+                requestId,
+                costClass: capability.costClass,
+                now: this.clock.now,
+            }));
+    }
+}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_RESPONSE_BYTES = 10000000;
+export interface GatewayFetchOptions extends RequestInit {
+    readonly fetchImpl?: typeof fetch | undefined;
+    readonly useCaFallback?: boolean | undefined;
+}
+export declare function isMissingIssuerError(error: unknown): boolean;
+export declare function isRecoverableTlsTrustError(error: unknown): boolean;
+export declare function gatewayTrustedCaCertificates(): readonly string[];
+export declare function gatewayFetch(url: string, options?: GatewayFetchOptions): Promise<Response>;
+export declare function readJsonCapped(response: Response, maxBytes?: number): Promise<unknown>;
+//# sourceMappingURL=http.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,WAAa,CAAC;AAE7C,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC9C;AA2BD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOlE;AAoCD,wBAAgB,4BAA4B,IAAI,SAAS,MAAM,EAAE,CAUhE;AAwDD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.js

@@ -0,0 +1,175 @@
+import { readFileSync } from "node:fs";
+import { request as httpsRequest } from "node:https";
+import * as tls from "node:tls";
+// Caps a single gateway response at 10 MB; real chat completions are far smaller.
+export const MAX_RESPONSE_BYTES = 10_000_000;
+function headersFromNode(headers) {
+    const out = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                out.append(name, item);
+        }
+        else if (value !== undefined) {
+            out.set(name, value);
+        }
+    }
+    return out;
+}
+function headersToRecord(headers) {
+    const out = {};
+    const normalized = new Headers(headers);
+    normalized.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function isMissingIssuerError(error) {
+    const cause = isRecord(error) ? error.cause : undefined;
+    const candidates = [error, cause];
+    return candidates.some((item) => {
+        if (!isRecord(item))
+            return false;
+        return item.code === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
+    });
+}
+const RECOVERABLE_TLS_TRUST_ERROR_CODES = new Set([
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+]);
+export function isRecoverableTlsTrustError(error) {
+    const cause = isRecord(error) ? error.cause : undefined;
+    const candidates = [error, cause];
+    return candidates.some((item) => {
+        if (!isRecord(item) || typeof item.code !== "string")
+            return false;
+        return RECOVERABLE_TLS_TRUST_ERROR_CODES.has(item.code);
+    });
+}
+function usesHttps(url) {
+    try {
+        return new URL(url).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function extraCaCertificates() {
+    const path = process.env.NODE_EXTRA_CA_CERTS;
+    if (path === undefined || path.trim().length === 0) {
+        return [];
+    }
+    try {
+        return [readFileSync(path, "utf8")];
+    }
+    catch {
+        return [];
+    }
+}
+function nodeCaCertificates(source) {
+    const getter = tls.getCACertificates;
+    if (typeof getter !== "function") {
+        return [];
+    }
+    try {
+        return getter(source);
+    }
+    catch {
+        return [];
+    }
+}
+export function gatewayTrustedCaCertificates() {
+    return Array.from(new Set([
+        ...nodeCaCertificates("default"),
+        ...tls.rootCertificates,
+        ...nodeCaCertificates("system"),
+        ...nodeCaCertificates("extra"),
+        ...extraCaCertificates(),
+    ]));
+}
+function bodyToString(body) {
+    if (body === undefined || body === null) {
+        return undefined;
+    }
+    if (typeof body === "string") {
+        return body;
+    }
+    if (body instanceof URLSearchParams) {
+        return body.toString();
+    }
+    throw new TypeError("gateway HTTP fallback supports string request bodies only");
+}
+function fetchWithCaBundle(url, init) {
+    const body = bodyToString(init.body);
+    const headers = headersToRecord(init.headers);
+    return new Promise((resolve, reject) => {
+        const req = httpsRequest(url, {
+            method: init.method ?? "GET",
+            headers,
+            ca: [...gatewayTrustedCaCertificates()],
+            signal: init.signal ?? undefined,
+        }, (res) => {
+            const chunks = [];
+            let total = 0;
+            res.on("data", (chunk) => {
+                total += chunk.length;
+                if (total > MAX_RESPONSE_BYTES) {
+                    req.destroy();
+                    reject(new Error("gateway response exceeded the size limit"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on("end", () => {
+                resolve(new Response(Buffer.concat(chunks), {
+                    status: res.statusCode ?? 500,
+                    statusText: res.statusMessage ?? "",
+                    headers: headersFromNode(res.headers),
+                }));
+            });
+            res.on("error", reject);
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+export async function gatewayFetch(url, options = {}) {
+    const { fetchImpl, useCaFallback = fetchImpl === undefined, ...init } = options;
+    const doFetch = fetchImpl ?? globalThis.fetch;
+    try {
+        return await doFetch(url, init);
+    }
+    catch (error) {
+        if (useCaFallback && usesHttps(url) && isRecoverableTlsTrustError(error)) {
+            return fetchWithCaBundle(url, init);
+        }
+        throw error;
+    }
+}
+export async function readJsonCapped(response, maxBytes = MAX_RESPONSE_BYTES) {
+    if (response.body === null) {
+        return response.json();
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const parts = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error("response body exceeded the size limit");
+        }
+        parts.push(decoder.decode(value, { stream: true }));
+    }
+    parts.push(decoder.decode());
+    return JSON.parse(parts.join(""));
+}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
+export type { CircuitBreakerConfig, CircuitBreakerStatus, CircuitState, ChatMessage, Clock, CostClass, FinishReason, GatewayConfig, GatewayRequest, LatencyClass, ModelCapability, ModelKind, ModelProviderConfig, NormalizedResponse, NormalizedToolCall, ProviderAdapter, ResponseFormat, StreamDelta, StreamEvent, ToolDefinition, UsageMetadata, } from "./types.js";
+export { CAPABILITY_REGISTRY, createDefaultChatCapability, findCapability, listCapabilities, resolveCostClass, selectCheapest, type CapabilityQuery, } from "./capabilities.js";
+export { CAPABILITY_DATA } from "./capabilities.data.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, type EnvSource, type SafeGatewayConfig, type SafeProviderConfig, } from "./config.js";
+export { Gateway, type GatewayDeps } from "./gateway.js";
+export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, type ModelSelectionQuery, } from "./model-selection.js";
+export { redact } from "@oscharko-dev/keiko-security";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, type ErrorCode, } from "@oscharko-dev/keiko-security/errors/gateway";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,KAAK,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,SAAS,GACf,MAAM,6CAA6C,CAAC"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.js

@@ -0,0 +1,12 @@
+// Public barrel for the model gateway: wire/config types, the Gateway orchestrator,
+// capability helpers, config loaders, model selection, and the typed error taxonomy.
+// Low-level provider adapters, HTTP transport, response normalization, and retry primitives
+// are intentionally kept off this surface so productive calls cannot bypass Gateway routing.
+export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
+export { CAPABILITY_REGISTRY, createDefaultChatCapability, findCapability, listCapabilities, resolveCostClass, selectCheapest, } from "./capabilities.js";
+export { CAPABILITY_DATA } from "./capabilities.data.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "./config.js";
+export { Gateway } from "./gateway.js";
+export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, } from "./model-selection.js";
+export { redact } from "@oscharko-dev/keiko-security";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/model-selection.d.ts

@@ -0,0 +1,12 @@
+import type { GatewayConfig, ModelCapability, ModelKind } from "./types.js";
+export interface ModelSelectionQuery {
+    readonly kind: ModelKind;
+    readonly toolCalling?: boolean | undefined;
+    readonly structuredOutput?: boolean | undefined;
+    readonly minContextWindow?: number | undefined;
+}
+export declare function assertConfiguredModel(config: GatewayConfig, modelId: string): void;
+export declare function findConfiguredCapability(config: GatewayConfig, modelId: string): ModelCapability | undefined;
+export declare function listConfiguredCapabilities(config: GatewayConfig): readonly ModelCapability[];
+export declare function selectConfiguredModel(config: GatewayConfig, query: ModelSelectionQuery): string | undefined;
+//# sourceMappingURL=model-selection.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/model-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-selection.d.ts","sourceRoot":"","sources":["../src/model-selection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAkBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIlF;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,GACd,eAAe,GAAG,SAAS,CAQ7B;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,eAAe,EAAE,CAI5F;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,mBAAmB,GACzB,MAAM,GAAG,SAAS,CAWpB"}