@oscharko-dev/keiko 0.2.0-beta.3 → 0.2.0-beta.5

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.js

@@ -77,9 +77,21 @@ function readCertificateFile(path) {
         return [];
     }
 }
+// One-time set of paths we have already warned about so the warning fires once per path.
+const warnedCaBundlePaths = new Set();
 function extraCaCertificates(caBundlePath) {
     const paths = [process.env.NODE_EXTRA_CA_CERTS, caBundlePath].filter((path) => path !== undefined && path.trim().length > 0);
-    return paths.flatMap((path) => readCertificateFile(path));
+    return paths.flatMap((path) => {
+        const certs = readCertificateFile(path);
+        // Warn once when a configured path yields no certificates so the operator
+        // can tell the file is missing or unreadable without throwing at startup.
+        if (certs.length === 0 && !warnedCaBundlePaths.has(path)) {
+            warnedCaBundlePaths.add(path);
+            // eslint-disable-next-line no-console
+            console.warn(`[keiko-model-gateway] CA bundle at ${path} could not be read or is empty`);
+        }
+        return certs;
+    });
 }
 function nodeCaCertificates(source) {
     const getter = tls.getCACertificates;
@@ -102,6 +114,10 @@ export function gatewayTrustedCaCertificates(caBundlePath) {
         ...extraCaCertificates(caBundlePath),
     ]));
 }
+// Exposed for tests to reset the one-time warning set between runs.
+export function _resetWarnedCaBundlePaths() {
+    warnedCaBundlePaths.clear();
+}
 function bodyToString(body) {
     if (body === undefined || body === null) {
         return undefined;
@@ -120,11 +136,15 @@ function bodyToString(body) {
 // the CA-bundle fallback streams tokens instead of buffering the whole response.
 export function streamingResponseFromNode(res, onCancel, maxBytes = MAX_RESPONSE_BYTES) {
     let total = 0;
+    let done = false;
     const body = new ReadableStream({
         start(controller) {
             res.on("data", (chunk) => {
+                if (done)
+                    return;
                 total += chunk.length;
                 if (total > maxBytes) {
+                    done = true;
                     controller.error(new Error("gateway response exceeded the size limit"));
                     onCancel();
                     return;
@@ -132,13 +152,20 @@ export function streamingResponseFromNode(res, onCancel, maxBytes = MAX_RESPONSE
                 controller.enqueue(new Uint8Array(chunk));
             });
             res.on("end", () => {
+                if (done)
+                    return;
+                done = true;
                 controller.close();
             });
             res.on("error", (error) => {
+                if (done)
+                    return;
+                done = true;
                 controller.error(error);
             });
         },
         cancel() {
+            done = true;
             onCancel();
         },
     });
@@ -148,9 +175,21 @@ export function streamingResponseFromNode(res, onCancel, maxBytes = MAX_RESPONSE
         headers: headersFromNode(res.headers),
     });
 }
-function fetchWithCaBundle(url, init, egress) {
+// Composes a caller-supplied AbortSignal with an AbortSignal.timeout so both
+// cancellation and deadline are observed. Returns undefined when neither is set.
+function composeSignal(callerSignal, timeoutMs) {
+    const timeoutSignal = timeoutMs !== undefined ? AbortSignal.timeout(timeoutMs) : undefined;
+    if (callerSignal != null && timeoutSignal !== undefined) {
+        return AbortSignal.any([callerSignal, timeoutSignal]);
+    }
+    if (callerSignal != null)
+        return callerSignal;
+    return timeoutSignal;
+}
+function fetchWithCaBundle(url, init, egress, maxResponseBytes) {
     const body = bodyToString(init.body);
     const headers = headersToRecord(init.headers);
+    const cap = maxResponseBytes ?? MAX_RESPONSE_BYTES;
     return new Promise((resolve, reject) => {
         const req = httpsRequest(url, {
             method: init.method ?? "GET",
@@ -158,7 +197,7 @@ function fetchWithCaBundle(url, init, egress) {
             ca: [...gatewayTrustedCaCertificates(egress?.caBundlePath)],
             signal: init.signal ?? undefined,
         }, (res) => {
-            resolve(streamingResponseFromNode(res, () => req.destroy()));
+            resolve(streamingResponseFromNode(res, () => req.destroy(), cap));
         });
         req.on("error", reject);
         req.end(body);
@@ -177,6 +216,14 @@ function defaultPort(protocol) {
 function targetPort(url) {
     return url.port.length > 0 ? url.port : defaultPort(url.protocol);
 }
+// Returns the Host header value for a target URL: omit the port when it is the
+// default for the scheme (443 for https, 80 for http) so the value matches what
+// undici sends directly and satisfies SigV4 pre-signed S3 URLs behind a proxy.
+function hostHeader(url) {
+    const isDefaultPort = (url.protocol === "https:" && (url.port === "" || url.port === "443")) ||
+        (url.protocol === "http:" && (url.port === "" || url.port === "80"));
+    return isDefaultPort ? url.hostname : `${url.hostname}:${url.port}`;
+}
 function noProxyRuleMatches(rule, host, hostPort) {
     if (rule.length === 0)
         return false;
@@ -239,19 +286,33 @@ const PROXY_UNREACHABLE_CODES = new Set([
     "EHOSTUNREACH",
     "ENETUNREACH",
 ]);
+const ABORT_ERROR_NAMES = new Set(["AbortError", "TimeoutError"]);
 function mapProxyError(error) {
     if (error instanceof OutboundHttpEgressError)
         return error;
     if (isRecoverableTlsTrustError(error)) {
         return new OutboundHttpEgressError("TLS_CA_FAILURE", "TLS certificate verification failed for outbound egress.");
     }
-    const code = isRecord(error) && typeof error.code === "string" ? error.code : undefined;
-    if (code !== undefined && PROXY_UNREACHABLE_CODES.has(code)) {
-        return new OutboundHttpEgressError("PROXY_UNREACHABLE", "Configured proxy is unreachable.");
+    if (error instanceof Error) {
+        const code = isRecord(error) ? error.code : undefined;
+        if ((typeof code === "string" && PROXY_UNREACHABLE_CODES.has(code)) ||
+            ABORT_ERROR_NAMES.has(error.name)) {
+            return new OutboundHttpEgressError("PROXY_UNREACHABLE", "Configured proxy is unreachable.");
+        }
+        return error;
+    }
+    return new OutboundHttpEgressError("PROXY_EGRESS_FAILED", "Outbound egress failed.");
+}
+const PROXY_UNREACHABLE_ERROR = new OutboundHttpEgressError("PROXY_UNREACHABLE", "Configured proxy is unreachable.");
+function attachAbortGuard(signal, onAbort) {
+    if (signal.aborted) {
+        onAbort();
+        return () => undefined;
     }
-    return error instanceof Error
-        ? error
-        : new OutboundHttpEgressError("PROXY_EGRESS_FAILED", "Outbound egress failed.");
+    signal.addEventListener("abort", onAbort, { once: true });
+    return () => {
+        signal.removeEventListener("abort", onAbort);
+    };
 }
 function openProxySocket(proxy, ca, signal) {
     const host = proxy.hostname;
@@ -278,23 +339,20 @@ function openProxySocket(proxy, ca, signal) {
         const onAbort = () => {
             socket.destroy();
             settle(() => {
-                reject(new DOMException("The operation was aborted.", "AbortError"));
+                reject(PROXY_UNREACHABLE_ERROR);
             });
         };
+        let removeAbort = () => undefined;
         const cleanup = () => {
             socket.off("error", onError);
-            signal?.removeEventListener("abort", onAbort);
+            removeAbort();
         };
         const socket = proxy.protocol === "https:"
             ? tls.connect({ host, port, servername: tlsServerName(host), ca: [...ca] }, onConnect)
             : netConnect({ host, port }, onConnect);
         socket.once("error", onError);
         if (signal !== undefined) {
-            if (signal.aborted) {
-                onAbort();
-                return;
-            }
-            signal.addEventListener("abort", onAbort, { once: true });
+            removeAbort = attachAbortGuard(signal, onAbort);
         }
     });
 }
@@ -302,16 +360,14 @@ function readConnectHeader(socket, signal) {
     return new Promise((resolve, reject) => {
         const chunks = [];
         let settled = false;
-        const cleanup = () => {
-            socket.off("data", onData);
-            socket.off("error", onError);
-            signal?.removeEventListener("abort", onAbort);
-        };
+        let removeAbort = () => undefined;
         const settle = (fn) => {
             if (settled)
                 return;
             settled = true;
-            cleanup();
+            socket.off("data", onData);
+            socket.off("error", onError);
+            removeAbort();
             fn();
         };
         const onData = (chunk) => {
@@ -335,17 +391,13 @@ function readConnectHeader(socket, signal) {
         const onAbort = () => {
             socket.destroy();
             settle(() => {
-                reject(new DOMException("The operation was aborted.", "AbortError"));
+                reject(PROXY_UNREACHABLE_ERROR);
             });
         };
         socket.on("data", onData);
         socket.once("error", onError);
         if (signal !== undefined) {
-            if (signal.aborted) {
-                onAbort();
-                return;
-            }
-            signal.addEventListener("abort", onAbort, { once: true });
+            removeAbort = attachAbortGuard(signal, onAbort);
         }
     });
 }
@@ -415,10 +467,15 @@ function responseFromClientRequest(start) {
         start(resolve, reject);
     });
 }
-function fetchHttpViaProxy(target, init, proxy, ca) {
+function fetchHttpViaProxy(target, init, proxy, ca, maxResponseBytes) {
     const body = bodyToString(init.body);
     const headers = headersToRecord(init.headers);
+    // Ensure Host header omits the default port (fixes SigV4 pre-signed S3 URLs).
+    if (!Object.prototype.hasOwnProperty.call(headers, "host")) {
+        headers.host = hostHeader(target);
+    }
     const request = proxy.protocol === "https:" ? httpsRequest : httpRequest;
+    const cap = maxResponseBytes ?? MAX_RESPONSE_BYTES;
     return responseFromClientRequest((resolve, reject) => {
         const req = request({
             protocol: proxy.protocol,
@@ -432,7 +489,7 @@ function fetchHttpViaProxy(target, init, proxy, ca) {
         }, (res) => {
             resolve(streamingResponseFromNode(res, () => {
                 req.destroy();
-            }));
+            }, cap));
         });
         req.on("error", (error) => {
             reject(mapProxyError(error));
@@ -440,13 +497,19 @@ function fetchHttpViaProxy(target, init, proxy, ca) {
         req.end(body);
     });
 }
-async function fetchHttpsViaProxy(target, init, proxy, ca) {
+async function fetchHttpsViaProxy(target, init, proxy, ca, maxResponseBytes) {
     const body = bodyToString(init.body);
     const headers = headersToRecord(init.headers);
     if (!Object.prototype.hasOwnProperty.call(headers, "connection")) {
         headers.connection = "close";
     }
+    // Ensure Host header omits :443 so it matches what undici sends directly and
+    // satisfies SigV4 pre-signed S3 URLs behind a proxy.
+    if (!Object.prototype.hasOwnProperty.call(headers, "host")) {
+        headers.host = hostHeader(target);
+    }
     const socket = await createTlsTunnel(target, proxy, ca, init.signal ?? undefined);
+    const cap = maxResponseBytes ?? MAX_RESPONSE_BYTES;
     return responseFromClientRequest((resolve, reject) => {
         const req = httpRequest({
             method: init.method ?? "GET",
@@ -459,7 +522,7 @@ async function fetchHttpsViaProxy(target, init, proxy, ca) {
         }, (res) => {
             resolve(streamingResponseFromNode(res, () => {
                 req.destroy();
-            }));
+            }, cap));
         });
         req.on("error", (error) => {
             reject(mapProxyError(error));
@@ -467,31 +530,38 @@ async function fetchHttpsViaProxy(target, init, proxy, ca) {
         req.end(body);
     });
 }
-function fetchViaProxy(target, init, proxyRaw, egress) {
+function fetchViaProxy(target, init, proxyRaw, egress, maxResponseBytes) {
     const proxy = parseProxyUrl(proxyRaw);
     const ca = gatewayTrustedCaCertificates(egress?.caBundlePath);
     return target.protocol === "https:"
-        ? fetchHttpsViaProxy(target, init, proxy, ca)
-        : fetchHttpViaProxy(target, init, proxy, ca);
+        ? fetchHttpsViaProxy(target, init, proxy, ca, maxResponseBytes)
+        : fetchHttpViaProxy(target, init, proxy, ca, maxResponseBytes);
 }
-export async function gatewayFetch(url, options = {}) {
-    const { fetchImpl, useCaFallback = fetchImpl === undefined, egress, ...init } = options;
-    const doFetch = fetchImpl ?? globalThis.fetch;
-    const target = new URL(url);
-    const proxy = fetchImpl === undefined ? proxyForTarget(target, egress) : undefined;
-    if (proxy !== undefined) {
-        return fetchViaProxy(target, init, proxy, egress);
-    }
+// Extracted from gatewayFetch to keep its cyclomatic complexity within the limit.
+async function fetchDirectWithCaFallback(url, init, doFetch, useCaFallback, egress, maxResponseBytes) {
     try {
         return await doFetch(url, init);
     }
     catch (error) {
         if (useCaFallback && usesHttps(url) && isRecoverableTlsTrustError(error)) {
-            return fetchWithCaBundle(url, init, egress);
+            return fetchWithCaBundle(url, init, egress, maxResponseBytes);
         }
         throw error;
     }
 }
+export async function gatewayFetch(url, options = {}) {
+    const { fetchImpl, useCaFallback = fetchImpl === undefined, egress, timeoutMs, maxResponseBytes, ...rest } = options;
+    // Compose caller signal + optional timeout into a single signal for all paths.
+    const composedSignal = composeSignal(rest.signal, timeoutMs);
+    const init = composedSignal !== undefined ? { ...rest, signal: composedSignal } : rest;
+    const doFetch = fetchImpl ?? globalThis.fetch;
+    const target = new URL(url);
+    const proxy = fetchImpl === undefined ? proxyForTarget(target, egress) : undefined;
+    if (proxy !== undefined) {
+        return fetchViaProxy(target, init, proxy, egress, maxResponseBytes);
+    }
+    return fetchDirectWithCaFallback(url, init, doFetch, useCaFallback, egress, maxResponseBytes);
+}
 export async function readJsonCapped(response, maxBytes = MAX_RESPONSE_BYTES) {
     if (response.body === null) {
         return response.json();

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.d.ts

@@ -4,5 +4,6 @@ export interface UsageSeed {
     readonly latencyMs: number;
     readonly costClass: CostClass;
 }
+export declare function textFromContent(value: unknown): string;
 export declare function normalizeChatResponse(rawPayload: unknown, modelId: string, seed: UsageSeed, expectStructured?: boolean): NormalizedResponse;
 //# sourceMappingURL=normalize.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,SAAS,EAET,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAwFD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,gBAAgB,UAAQ,GACvB,kBAAkB,CAYpB"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,SAAS,EAET,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAqGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQtD;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,gBAAgB,UAAQ,GACvB,kBAAkB,CAYpB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.js

@@ -79,6 +79,27 @@ function firstChoice(payload) {
     }
     return isRecord(choices[0]) ? choices[0] : undefined;
 }
+function textPart(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (!isRecord(value)) {
+        return "";
+    }
+    if (typeof value.text === "string") {
+        return value.text;
+    }
+    return typeof value.content === "string" ? value.content : "";
+}
+export function textFromContent(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (!Array.isArray(value)) {
+        return "";
+    }
+    return value.map(textPart).join("");
+}
 export function normalizeChatResponse(rawPayload, modelId, seed, expectStructured = false) {
     const payload = isRecord(rawPayload) ? rawPayload : {};
     const usage = buildUsage(payload, seed);
@@ -87,7 +108,7 @@ export function normalizeChatResponse(rawPayload, modelId, seed, expectStructure
     const finishReason = mapFinishReason(choice?.finish_reason);
     assertNotRefusal(message, finishReason);
     const toolCalls = parseToolCalls(message);
-    const content = typeof message.content === "string" ? message.content : "";
+    const content = textFromContent(message.content);
     const structuredOutput = expectStructured && content.length > 0 ? parseStructuredOutput(content) : null;
     return { modelId, content, finishReason, toolCalls, structuredOutput, usage };
 }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAyOD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA4B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAoBnC;YAIa,YAAY;IA0B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAWR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAmBV,QAAQ;YAYR,aAAa;CAO5B"}
+{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AA4PD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA2B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAqBnC;YAIa,YAAY;IA0B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAWR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAmBV,QAAQ;YAYR,aAAa;CAO5B"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.js

@@ -5,8 +5,9 @@
 import { AuthenticationError, CancelledError, ContextOverflowError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, } from "@oscharko-dev/keiko-security/errors/gateway";
 import { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME } from "./config.js";
 import { gatewayFetch, readJsonCapped, readSseStream } from "./http.js";
-import { normalizeChatResponse } from "./normalize.js";
+import { normalizeChatResponse, textFromContent } from "./normalize.js";
 import { redact } from "@oscharko-dev/keiko-security";
+const PROVIDER_EMPTY_ASSISTANT_STATUS = 200;
 function buildMessage(message) {
     const toolCalls = message.toolCalls?.map((call) => ({
         id: call.id,
@@ -72,7 +73,11 @@ function firstStreamChoice(chunk) {
 function deltaFromChunk(chunk) {
     const choice = firstStreamChoice(chunk);
     const delta = choice !== undefined && isRecord(choice.delta) ? choice.delta : undefined;
-    return delta !== undefined && typeof delta.content === "string" ? delta.content : undefined;
+    if (delta === undefined || !("content" in delta)) {
+        return undefined;
+    }
+    const content = textFromContent(delta.content);
+    return content.length > 0 ? content : undefined;
 }
 function finishReasonFromChunk(chunk) {
     const choice = firstStreamChoice(chunk);
@@ -135,6 +140,12 @@ function redactResponse(response, secrets) {
         structuredOutput: redactRecord(response.structuredOutput, secrets),
     };
 }
+function assertUsableAssistantResponse(response, modelId, secrets) {
+    if (response.content.trim().length > 0 || response.toolCalls.length > 0) {
+        return;
+    }
+    throw new ProviderError(`provider returned an empty assistant response for '${modelId}'`, PROVIDER_EMPTY_ASSISTANT_STATUS, secrets);
+}
 function errorSignal(payload) {
     const error = isRecord(payload) && isRecord(payload.error) ? payload.error : payload;
     if (!isRecord(error)) {
@@ -192,11 +203,13 @@ export class OpenAiAdapter {
             mapHttpError(response, config.modelId, secrets, errorPayload);
         }
         const payload = await this.readBody(response, config, secrets);
-        return redactResponse(normalizeChatResponse(payload, config.modelId, {
+        const normalized = normalizeChatResponse(payload, config.modelId, {
             requestId: this.deps.requestId,
             latencyMs: this.now() - start,
             costClass: this.deps.costClass,
-        }, request.responseFormat?.type === "json_schema"), secrets);
+        }, request.responseFormat?.type === "json_schema");
+        assertUsableAssistantResponse(normalized, config.modelId, secrets);
+        return redactResponse(normalized, secrets);
     };
     // Streaming chat path (Layer 1): yields redacted content-delta tokens as they
     // arrive, then a terminal `done` with the assembled, redacted NormalizedResponse.
@@ -217,6 +230,7 @@ export class OpenAiAdapter {
             yield { type: "delta", token };
         }
         const assembled = this.assembleResponse(config, start, acc);
+        assertUsableAssistantResponse(assembled, config.modelId, secrets);
         yield { type: "done", response: redactResponse(assembled, secrets) };
     };
     // Iterates the SSE stream, yielding each redacted content token while mutating

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/qualityIntelligence/dispatcher.d.ts

@@ -20,5 +20,19 @@ export interface QualityIntelligenceDispatcherResult {
     readonly budget: QualityIntelligenceBudgetState;
     readonly cacheHit: boolean;
 }
+/**
+ * Compose a single Quality Intelligence model call with capability gate, budget reservation,
+ * prompt segmentation, replay cache, composed timeout/cancellation, and qi/* safe-error shaping.
+ *
+ * REUSABLE PRIMITIVE — NOT the current live path. The live generation/judge runtime
+ * (`keiko-server` generationPort.ts / judgePort.ts) deliberately calls the gateway `ModelPort`
+ * directly and applies its own capability gate + prompt segmentation, inheriting timeout / retry /
+ * circuit-breaking from the gateway resilience layer (`resilience.ts`) — the same machinery Chat
+ * and grounded-QA use. This dispatcher (and its budget / replayCache / circuitBreaker / cancellation
+ * helpers) is the ported-from-Test-Intelligence composition kept available for a future multi-call
+ * QI flow that wants combined budget + cache + circuit semantics at one call site. It must NOT be
+ * force-wired into the live ports (that would change the resilience contract) and must NOT be
+ * deleted as "dead code" (#279: ported TI ideas live here as generic gateway capabilities).
+ */
 export declare function dispatchQualityIntelligenceRequest(args: QualityIntelligenceDispatcherArgs): Promise<QualityIntelligenceDispatcherResult>;
 //# sourceMappingURL=dispatcher.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/qualityIntelligence/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/dispatcher.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAGV,eAAe,EACf,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAGL,KAAK,yCAAyC,EAC/C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,kCAAkC,EACxC,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,yCAAyC,EAAE,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAuED,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,iCAAiC,GACtC,OAAO,CAAC,mCAAmC,CAAC,CAuC9C"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/dispatcher.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAGV,eAAe,EACf,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAGL,KAAK,yCAAyC,EAC/C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,kCAAkC,EACxC,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,yCAAyC,EAAE,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAuED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE,iCAAiC,GACtC,OAAO,CAAC,mCAAmC,CAAC,CAuC9C"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/qualityIntelligence/dispatcher.js

@@ -65,6 +65,20 @@ async function invokePort(ctx) {
         handle.dispose();
     }
 }
+/**
+ * Compose a single Quality Intelligence model call with capability gate, budget reservation,
+ * prompt segmentation, replay cache, composed timeout/cancellation, and qi/* safe-error shaping.
+ *
+ * REUSABLE PRIMITIVE — NOT the current live path. The live generation/judge runtime
+ * (`keiko-server` generationPort.ts / judgePort.ts) deliberately calls the gateway `ModelPort`
+ * directly and applies its own capability gate + prompt segmentation, inheriting timeout / retry /
+ * circuit-breaking from the gateway resilience layer (`resilience.ts`) — the same machinery Chat
+ * and grounded-QA use. This dispatcher (and its budget / replayCache / circuitBreaker / cancellation
+ * helpers) is the ported-from-Test-Intelligence composition kept available for a future multi-call
+ * QI flow that wants combined budget + cache + circuit semantics at one call site. It must NOT be
+ * force-wired into the live ports (that would change the resilience contract) and must NOT be
+ * deleted as "dead code" (#279: ported TI ideas live here as generic gateway capabilities).
+ */
 export async function dispatchQualityIntelligenceRequest(args) {
     assertProfileCompatibleWithModel(args.profile, args.model);
     if (isExhausted(args.budget)) {

package/node_modules/@oscharko-dev/keiko-model-gateway/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-model-gateway",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "build": "tsc -b tsconfig.json",
-    "typecheck": "tsc -b tsconfig.json --noEmit",
+    "typecheck": "tsc -b tsconfig.json",
     "test": "vitest run"
   },
   "files": [