@relayplane/proxy 1.3.2 → 1.4.0

package/dist/server.js

@@ -1,637 +1,1258 @@
-#!/usr/bin/env node
+"use strict";
 /**
- * RelayPlane Local LLM Proxy Server
+ * RelayPlane Agent Ops Proxy Server
+ *
+ * OpenAI-compatible proxy server with integrated observability via the Learning Ledger
+ * and auth enforcement via Auth Gate.
  *
- * Routes OpenAI-compatible requests to multiple providers.
  * Features:
- * - /health endpoint for monitoring
- * - Usage tracking with spending warnings
- * - Model aliases (rp:fast, rp:cheap, rp:best)
- * - Dry-run mode for testing
+ * - OpenAI-compatible `/v1/chat/completions` endpoint
+ * - Auth Gate integration for consumer vs API auth detection
+ * - Learning Ledger integration for run tracking
+ * - Timing capture (latency_ms, ttft_ms)
+ * - Structured error handling
+ *
+ * @packageDocumentation
  */
-import * as http from 'http';
-import * as https from 'https';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-const VERSION = '1.1.0';
-const startTime = Date.now();
-// Configuration
-const PORT = parseInt(process.env.RELAYPLANE_PROXY_PORT || '8787', 10);
-const HOST = process.env.RELAYPLANE_PROXY_HOST || '127.0.0.1';
-const CONFIG_DIR = process.env.RELAYPLANE_CONFIG_DIR || path.join(os.homedir(), '.relayplane');
-const stats = {
-    requestsHandled: 0,
-    requestsSuccessful: 0,
-    requestsFailed: 0,
-    totalInputTokens: 0,
-    totalOutputTokens: 0,
-    totalCost: 0,
-    byModel: new Map(),
-    byProvider: new Map(),
-};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyServer = void 0;
+exports.createProxyServer = createProxyServer;
+exports.createSandboxedProxyServer = createSandboxedProxyServer;
+const http = __importStar(require("node:http"));
+const ledger_1 = require("@relayplane/ledger");
+const auth_gate_1 = require("@relayplane/auth-gate");
+const policy_engine_1 = require("@relayplane/policy-engine");
+const routing_engine_1 = require("@relayplane/routing-engine");
+const explainability_1 = require("@relayplane/explainability");
+const learning_engine_1 = require("@relayplane/learning-engine");
+const middleware_js_1 = require("./middleware.js");
+const relay_config_js_1 = require("./relay-config.js");
 /**
- * Model alias mappings
+ * Provider endpoint configuration
  */
-const MODEL_ALIASES = {
-    'rp:fast': { model: 'llama-3.1-8b-instant', provider: 'groq' },
-    'rp:cheap': { model: 'llama-3.1-8b-instant', provider: 'groq' },
-    'rp:best': { model: 'claude-3-5-sonnet-20241022', provider: 'anthropic' },
-    'rp:balanced': { model: 'gpt-4o-mini', provider: 'openai' },
-};
-const PROVIDERS = {
-    openai: {
-        baseUrl: 'https://api.openai.com',
-        apiKeyEnv: 'OPENAI_API_KEY',
-        headerName: 'Authorization',
-        headerPrefix: 'Bearer ',
-    },
+const PROVIDER_ENDPOINTS = {
     anthropic: {
-        baseUrl: 'https://api.anthropic.com',
-        apiKeyEnv: 'ANTHROPIC_API_KEY',
-        headerName: 'x-api-key',
-        headerPrefix: '',
-        extraHeaders: {
-            'anthropic-version': '2023-06-01',
-        },
+        baseUrl: 'https://api.anthropic.com/v1',
+        authHeader: 'x-api-key',
     },
-    groq: {
-        baseUrl: 'https://api.groq.com/openai',
-        apiKeyEnv: 'GROQ_API_KEY',
-        headerName: 'Authorization',
-        headerPrefix: 'Bearer ',
-    },
-    together: {
-        baseUrl: 'https://api.together.xyz',
-        apiKeyEnv: 'TOGETHER_API_KEY',
-        headerName: 'Authorization',
-        headerPrefix: 'Bearer ',
+    openai: {
+        baseUrl: 'https://api.openai.com/v1',
+        authHeader: 'Authorization',
     },
     openrouter: {
-        baseUrl: 'https://openrouter.ai/api',
-        apiKeyEnv: 'OPENROUTER_API_KEY',
-        headerName: 'Authorization',
-        headerPrefix: 'Bearer ',
+        baseUrl: 'https://openrouter.ai/api/v1',
+        authHeader: 'Authorization',
     },
 };
 /**
- * Model to provider mapping (simplified)
+ * Model to provider mapping
  */
-function detectProvider(model) {
-    if (model.startsWith('gpt-') || model.startsWith('o1-'))
-        return 'openai';
-    if (model.startsWith('claude-'))
+function getProviderForModel(model) {
+    if (model.startsWith('claude') || model.startsWith('anthropic')) {
         return 'anthropic';
-    if (model.startsWith('llama-') || model.startsWith('mixtral-'))
-        return 'groq';
-    if (model.startsWith('meta-llama/') || model.startsWith('mistralai/'))
-        return 'together';
-    if (model.includes('/'))
-        return 'openrouter';
-    return 'openai'; // Default fallback
+    }
+    if (model.startsWith('gpt') || model.startsWith('o1') || model.startsWith('o3')) {
+        return 'openai';
+    }
+    // Default to openrouter for other models
+    return 'openrouter';
 }
 /**
- * Track which warnings we've already logged to avoid spam
+ * RelayPlane Agent Ops Proxy Server
  */
-const loggedWarnings = {
-    daily80: false,
-    daily90: false,
-    daily100: false,
-    monthly80: false,
-    monthly90: false,
-    monthly100: false,
-};
-function loadConfig() {
-    const configPath = path.join(CONFIG_DIR, 'config.json');
-    try {
-        if (fs.existsSync(configPath)) {
-            return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+class ProxyServer {
+    server = null;
+    ledger;
+    authGate;
+    policyEngine;
+    routingEngine;
+    capabilityRegistry;
+    providerManager;
+    explainer;
+    comparator;
+    simulator;
+    learningEngine = null;
+    config;
+    constructor(config = {}) {
+        this.config = {
+            port: config.port ?? 4801,
+            host: config.host ?? '127.0.0.1',
+            verbose: config.verbose ?? false,
+            defaultWorkspaceId: config.defaultWorkspaceId ?? 'default',
+            defaultAgentId: config.defaultAgentId ?? 'default',
+            defaultAuthEnforcementMode: config.defaultAuthEnforcementMode ?? 'recommended',
+            enforcePolicies: config.enforcePolicies ?? true,
+            enableRouting: config.enableRouting ?? true,
+            enableLearning: config.enableLearning ?? false,
+            ...config,
+        };
+        // Initialize ledger
+        this.ledger = config.ledger ?? (0, ledger_1.createLedger)();
+        // Initialize auth storage and gate
+        const authStorage = config.authStorage ?? new auth_gate_1.MemoryAuthProfileStorage();
+        this.authGate = (0, auth_gate_1.createAuthGate)({
+            storage: authStorage,
+            ledger: this.ledger,
+            defaultSettings: {
+                auth_enforcement_mode: this.config.defaultAuthEnforcementMode,
+            },
+        });
+        // Initialize policy engine
+        const policyStorage = config.policyStorage ?? new policy_engine_1.MemoryPolicyStorage();
+        this.policyEngine = config.policyEngine ?? (0, policy_engine_1.createPolicyEngine)({
+            storage: policyStorage,
+            ledger: this.ledger,
+        });
+        // Initialize routing engine (Phase 3)
+        this.capabilityRegistry = config.capabilityRegistry ?? (0, routing_engine_1.createCapabilityRegistry)({
+            providerOverrides: this.buildProviderOverrides(),
+        });
+        this.providerManager = config.providerManager ?? (0, routing_engine_1.createProviderManagerWithBuiltIns)();
+        this.routingEngine = config.routingEngine ?? (0, routing_engine_1.createRoutingEngine)({
+            registry: this.capabilityRegistry,
+            ledger: this.ledger,
+        });
+        // Initialize explainability components (Phase 4)
+        this.explainer = (0, explainability_1.createExplanationEngine)({
+            ledger: this.ledger,
+            policyEngine: this.policyEngine,
+            routingEngine: this.routingEngine,
+            capabilityRegistry: this.capabilityRegistry,
+        });
+        this.comparator = (0, explainability_1.createRunComparator)({
+            ledger: this.ledger,
+            explanationEngine: this.explainer,
+        });
+        this.simulator = (0, explainability_1.createSimulator)({
+            policyEngine: this.policyEngine,
+            routingEngine: this.routingEngine,
+            capabilityRegistry: this.capabilityRegistry,
+        });
+        // Initialize learning engine (Phase 5)
+        if (this.config.enableLearning) {
+            this.learningEngine = config.learningEngine ?? (0, learning_engine_1.createLearningEngine)(this.ledger.getStorage(), undefined, config.learningConfig);
         }
+        // Set API keys from config
+        this.configureProviderApiKeys();
     }
-    catch {
-        // Ignore errors
+    /**
+     * Build provider overrides from config
+     */
+    buildProviderOverrides() {
+        const overrides = {};
+        const providers = this.config.providers ?? {};
+        if (providers.anthropic) {
+            overrides.anthropic = {
+                enabled: true,
+                base_url: providers.anthropic.baseUrl,
+            };
+        }
+        if (providers.openai) {
+            overrides.openai = {
+                enabled: true,
+                base_url: providers.openai.baseUrl,
+            };
+        }
+        if (providers.openrouter) {
+            overrides.openrouter = {
+                enabled: true,
+                base_url: providers.openrouter.baseUrl,
+            };
+        }
+        if (providers.google) {
+            overrides.google = {
+                enabled: true,
+                base_url: providers.google.baseUrl,
+            };
+        }
+        if (providers.together) {
+            overrides.together = {
+                enabled: true,
+                base_url: providers.together.baseUrl,
+            };
+        }
+        if (providers.deepseek) {
+            overrides.deepseek = {
+                enabled: true,
+                base_url: providers.deepseek.baseUrl,
+            };
+        }
+        return overrides;
     }
-    return null;
-}
-function loadDailyUsage() {
-    const today = new Date().toISOString().split('T')[0];
-    const usagePath = path.join(CONFIG_DIR, 'daily-usage.json');
-    try {
-        if (fs.existsSync(usagePath)) {
-            const data = JSON.parse(fs.readFileSync(usagePath, 'utf-8'));
-            if (data.date === today) {
-                return data;
-            }
+    /**
+     * Configure provider API keys from config
+     */
+    configureProviderApiKeys() {
+        const providers = this.config.providers ?? {};
+        if (providers.anthropic?.apiKey) {
+            this.providerManager.setApiKey('anthropic', providers.anthropic.apiKey);
+        }
+        if (providers.openai?.apiKey) {
+            this.providerManager.setApiKey('openai', providers.openai.apiKey);
         }
+        if (providers.openrouter?.apiKey) {
+            this.providerManager.setApiKey('openrouter', providers.openrouter.apiKey);
+        }
+        if (providers.google?.apiKey) {
+            this.providerManager.setApiKey('google', providers.google.apiKey);
+        }
+        if (providers.together?.apiKey) {
+            this.providerManager.setApiKey('together', providers.together.apiKey);
+        }
+        if (providers.deepseek?.apiKey) {
+            this.providerManager.setApiKey('deepseek', providers.deepseek.apiKey);
+        }
+        // Also try environment variables
+        const configs = this.capabilityRegistry.getEnabledProviders();
+        this.providerManager.setApiKeysFromEnv(configs);
     }
-    catch {
-        // Ignore errors
+    /**
+     * Start the proxy server
+     */
+    async start() {
+        return new Promise((resolve) => {
+            this.server = http.createServer((req, res) => {
+                this.handleRequest(req, res).catch((err) => {
+                    this.log('error', `Unhandled error: ${err}`);
+                    this.sendError(res, 500, 'internal_error', 'Internal server error');
+                });
+            });
+            this.server.listen(this.config.port, this.config.host, () => {
+                this.log('info', `RelayPlane Proxy listening on http://${this.config.host}:${this.config.port}`);
+                resolve();
+            });
+        });
     }
-    return { date: today, cost: 0, requests: 0 };
-}
-/**
- * Save daily usage to file
- */
-function saveDailyUsage(usage) {
-    const usagePath = path.join(CONFIG_DIR, 'daily-usage.json');
-    try {
-        if (!fs.existsSync(CONFIG_DIR)) {
-            fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    /**
+     * Stop the proxy server
+     */
+    async stop() {
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => {
+                    this.log('info', 'Proxy server stopped');
+                    resolve();
+                });
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    /**
+     * Handle incoming request
+     */
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+        // CORS headers
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-RelayPlane-Workspace, X-RelayPlane-Agent, X-RelayPlane-Session, X-RelayPlane-Automated');
+        // Handle preflight
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // Health check
+        if (url.pathname === '/health' || url.pathname === '/') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ status: 'ok', version: '0.1.0' }));
+            return;
+        }
+        // OpenAI-compatible chat completions
+        if (url.pathname === '/v1/chat/completions' && req.method === 'POST') {
+            await this.handleChatCompletions(req, res);
+            return;
+        }
+        // Models endpoint (for client compatibility)
+        if (url.pathname === '/v1/models' && req.method === 'GET') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                object: 'list',
+                data: [
+                    { id: 'claude-3-5-sonnet', object: 'model', owned_by: 'anthropic' },
+                    { id: 'claude-3-5-haiku', object: 'model', owned_by: 'anthropic' },
+                    { id: 'gpt-4o', object: 'model', owned_by: 'openai' },
+                    { id: 'gpt-4o-mini', object: 'model', owned_by: 'openai' },
+                ],
+            }));
+            return;
+        }
+        // Policy Management API (Phase 2)
+        if (url.pathname === '/v1/policies' && req.method === 'GET') {
+            await this.handleListPolicies(req, res);
+            return;
         }
-        fs.writeFileSync(usagePath, JSON.stringify(usage, null, 2));
+        if (url.pathname === '/v1/policies' && req.method === 'POST') {
+            await this.handleCreatePolicy(req, res);
+            return;
+        }
+        if (url.pathname.startsWith('/v1/policies/') && req.method === 'GET') {
+            const policyId = url.pathname.split('/')[3];
+            if (policyId) {
+                await this.handleGetPolicy(res, policyId);
+                return;
+            }
+        }
+        if (url.pathname.startsWith('/v1/policies/') && req.method === 'PATCH') {
+            const policyId = url.pathname.split('/')[3];
+            if (policyId) {
+                await this.handleUpdatePolicy(req, res, policyId);
+                return;
+            }
+        }
+        if (url.pathname.startsWith('/v1/policies/') && req.method === 'DELETE') {
+            const policyId = url.pathname.split('/')[3];
+            if (policyId) {
+                await this.handleDeletePolicy(res, policyId);
+                return;
+            }
+        }
+        if (url.pathname === '/v1/policies/test' && req.method === 'POST') {
+            await this.handlePolicyTest(req, res);
+            return;
+        }
+        // Budget state endpoint
+        if (url.pathname === '/v1/budget' && req.method === 'GET') {
+            await this.handleGetBudget(req, res);
+            return;
+        }
+        // ========================================================================
+        // Explainability API (Phase 4)
+        // ========================================================================
+        // GET /v1/runs/{id}/explain - Full decision chain explanation
+        if (url.pathname.match(/^\/v1\/runs\/[^/]+\/explain$/) && req.method === 'GET') {
+            const runId = url.pathname.split('/')[3];
+            const format = url.searchParams.get('format') ?? 'full';
+            await this.handleExplainRun(res, runId, format);
+            return;
+        }
+        // GET /v1/runs/{id}/timeline - Timeline view only
+        if (url.pathname.match(/^\/v1\/runs\/[^/]+\/timeline$/) && req.method === 'GET') {
+            const runId = url.pathname.split('/')[3];
+            await this.handleRunTimeline(res, runId);
+            return;
+        }
+        // GET /v1/runs/{id}/decisions - Raw decision chain
+        if (url.pathname.match(/^\/v1\/runs\/[^/]+\/decisions$/) && req.method === 'GET') {
+            const runId = url.pathname.split('/')[3];
+            await this.handleRunDecisions(res, runId);
+            return;
+        }
+        // GET /v1/runs/{id} - Run inspector (all details)
+        if (url.pathname.match(/^\/v1\/runs\/[^/]+$/) && req.method === 'GET') {
+            const runId = url.pathname.split('/')[3];
+            await this.handleRunInspector(res, runId);
+            return;
+        }
+        // GET /v1/runs/compare?ids=run1,run2 - Run comparison
+        if (url.pathname === '/v1/runs/compare' && req.method === 'GET') {
+            const idsParam = url.searchParams.get('ids');
+            const includeDecisions = url.searchParams.get('include_decisions') === 'true';
+            await this.handleCompareRuns(res, idsParam, includeDecisions);
+            return;
+        }
+        // POST /v1/simulate/policy - Policy simulation
+        if (url.pathname === '/v1/simulate/policy' && req.method === 'POST') {
+            await this.handleSimulatePolicy(req, res);
+            return;
+        }
+        // POST /v1/simulate/routing - Routing simulation
+        if (url.pathname === '/v1/simulate/routing' && req.method === 'POST') {
+            await this.handleSimulateRouting(req, res);
+            return;
+        }
+        // ========================================================================
+        // Learning Engine API (Phase 5)
+        // ========================================================================
+        if (this.learningEngine) {
+            // GET /v1/analytics/summary
+            if (url.pathname === '/v1/analytics/summary' && req.method === 'GET') {
+                await this.handleAnalyticsSummary(req, res);
+                return;
+            }
+            // POST /v1/analytics/analyze
+            if (url.pathname === '/v1/analytics/analyze' && req.method === 'POST') {
+                await this.handleRunAnalysis(req, res);
+                return;
+            }
+            // GET /v1/suggestions
+            if (url.pathname === '/v1/suggestions' && req.method === 'GET') {
+                await this.handleListSuggestions(req, res);
+                return;
+            }
+            // POST /v1/suggestions/:id/approve
+            if (url.pathname.match(/^\/v1\/suggestions\/[^/]+\/approve$/) && req.method === 'POST') {
+                const id = url.pathname.split('/')[3];
+                await this.handleApproveSuggestion(req, res, id);
+                return;
+            }
+            // POST /v1/suggestions/:id/reject
+            if (url.pathname.match(/^\/v1\/suggestions\/[^/]+\/reject$/) && req.method === 'POST') {
+                const id = url.pathname.split('/')[3];
+                await this.handleRejectSuggestion(req, res, id);
+                return;
+            }
+            // GET /v1/rules
+            if (url.pathname === '/v1/rules' && req.method === 'GET') {
+                await this.handleListRules(req, res);
+                return;
+            }
+            // GET /v1/rules/:id/effectiveness
+            if (url.pathname.match(/^\/v1\/rules\/[^/]+\/effectiveness$/) && req.method === 'GET') {
+                const id = url.pathname.split('/')[3];
+                await this.handleRuleEffectiveness(res, id);
+                return;
+            }
+        }
+        // 404 for unknown routes
+        this.sendError(res, 404, 'not_found', `Unknown endpoint: ${url.pathname}`);
     }
-    catch {
-        // Ignore errors
+    // ============================================================================
+    // Policy Management Handlers (Phase 2)
+    // ============================================================================
+    async handleListPolicies(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const policies = await this.policyEngine.listPolicies(workspaceId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ policies }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
     }
-}
-function loadMonthlyUsage() {
-    const currentMonth = new Date().toISOString().slice(0, 7); // YYYY-MM
-    const usagePath = path.join(CONFIG_DIR, 'monthly-usage.json');
-    try {
-        if (fs.existsSync(usagePath)) {
-            const data = JSON.parse(fs.readFileSync(usagePath, 'utf-8'));
-            if (data.month === currentMonth) {
-                return data;
-            }
+    async handleCreatePolicy(req, res) {
+        try {
+            const body = await this.readBody(req);
+            const policy = JSON.parse(body);
+            const policyId = await this.policyEngine.createPolicy(policy);
+            const created = await this.policyEngine.getPolicy(policyId);
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ policy: created }));
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Invalid policy');
         }
     }
-    catch {
-        // Ignore errors
+    async handleGetPolicy(res, policyId) {
+        try {
+            const policy = await this.policyEngine.getPolicy(policyId);
+            if (!policy) {
+                this.sendError(res, 404, 'not_found', 'Policy not found');
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ policy }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
     }
-    return { month: currentMonth, cost: 0, requests: 0 };
-}
-function saveMonthlyUsage(usage) {
-    const usagePath = path.join(CONFIG_DIR, 'monthly-usage.json');
-    try {
-        if (!fs.existsSync(CONFIG_DIR)) {
-            fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    async handleUpdatePolicy(req, res, policyId) {
+        try {
+            const body = await this.readBody(req);
+            const updates = JSON.parse(body);
+            await this.policyEngine.updatePolicy(policyId, updates);
+            const updated = await this.policyEngine.getPolicy(policyId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ policy: updated }));
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Invalid update');
         }
-        fs.writeFileSync(usagePath, JSON.stringify(usage, null, 2));
     }
-    catch {
-        // Ignore errors
+    async handleDeletePolicy(res, policyId) {
+        try {
+            await this.policyEngine.deletePolicy(policyId);
+            res.writeHead(204);
+            res.end();
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
     }
-}
-/**
- * Check spending limits and log warnings
- */
-function checkAndWarnLimits(dailyUsage, monthlyUsage, config) {
-    const warnings = [];
-    // Check daily limits
-    if (config?.limits?.daily) {
-        const dailyPercent = (dailyUsage.cost / config.limits.daily) * 100;
-        if (dailyPercent >= 100 && !loggedWarnings.daily100) {
-            console.warn(`⚠️  DAILY LIMIT REACHED: $${dailyUsage.cost.toFixed(2)} / $${config.limits.daily} (100%)`);
-            loggedWarnings.daily100 = true;
-            warnings.push(`Daily limit reached: $${dailyUsage.cost.toFixed(2)} of $${config.limits.daily}`);
-        }
-        else if (dailyPercent >= 90 && !loggedWarnings.daily90) {
-            console.warn(`⚠️  Daily spending at 90%: $${dailyUsage.cost.toFixed(2)} / $${config.limits.daily}`);
-            loggedWarnings.daily90 = true;
-            warnings.push(`⚠️ You've used $${dailyUsage.cost.toFixed(2)} of your $${config.limits.daily} daily limit`);
-        }
-        else if (dailyPercent >= 80 && !loggedWarnings.daily80) {
-            console.warn(`⚠️  Daily spending at 80%: $${dailyUsage.cost.toFixed(2)} / $${config.limits.daily}`);
-            loggedWarnings.daily80 = true;
-            warnings.push(`⚠️ You've used $${dailyUsage.cost.toFixed(2)} of your $${config.limits.daily} daily limit`);
-        }
-    }
-    // Check monthly limits
-    if (config?.limits?.monthly) {
-        const monthlyPercent = (monthlyUsage.cost / config.limits.monthly) * 100;
-        if (monthlyPercent >= 100 && !loggedWarnings.monthly100) {
-            console.warn(`⚠️  MONTHLY LIMIT REACHED: $${monthlyUsage.cost.toFixed(2)} / $${config.limits.monthly} (100%)`);
-            loggedWarnings.monthly100 = true;
-            warnings.push(`Monthly limit reached: $${monthlyUsage.cost.toFixed(2)} of $${config.limits.monthly}`);
-        }
-        else if (monthlyPercent >= 90 && !loggedWarnings.monthly90) {
-            console.warn(`⚠️  Monthly spending at 90%: $${monthlyUsage.cost.toFixed(2)} / $${config.limits.monthly}`);
-            loggedWarnings.monthly90 = true;
-            warnings.push(`⚠️ You've used $${monthlyUsage.cost.toFixed(2)} of your $${config.limits.monthly} monthly limit`);
-        }
-        else if (monthlyPercent >= 80 && !loggedWarnings.monthly80) {
-            console.warn(`⚠️  Monthly spending at 80%: $${monthlyUsage.cost.toFixed(2)} / $${config.limits.monthly}`);
-            loggedWarnings.monthly80 = true;
-            warnings.push(`⚠️ You've used $${monthlyUsage.cost.toFixed(2)} of your $${config.limits.monthly} monthly limit`);
-        }
-    }
-    return warnings.length > 0 ? warnings.join('; ') : null;
-}
-/**
- * Log usage to JSONL file
- */
-function logUsage(record) {
-    const usagePath = path.join(CONFIG_DIR, 'usage.jsonl');
-    try {
-        if (!fs.existsSync(CONFIG_DIR)) {
-            fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    async handlePolicyTest(req, res) {
+        try {
+            const body = await this.readBody(req);
+            const testRequest = JSON.parse(body);
+            const decision = await this.policyEngine.dryRun(testRequest);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ decision }));
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Invalid test request');
         }
-        fs.appendFileSync(usagePath, JSON.stringify(record) + '\n');
     }
-    catch {
-        // Ignore errors
+    async handleGetBudget(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+            const scopeType = (url.searchParams.get('scope_type') ?? 'workspace');
+            const scopeId = url.searchParams.get('scope_id') ?? workspaceId;
+            const period = (url.searchParams.get('period') ?? 'day');
+            const state = await this.policyEngine.getBudgetState(workspaceId, scopeType, scopeId, period);
+            if (!state) {
+                // Return empty state if no budget configured
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ budget_state: null, message: 'No budget state found' }));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ budget_state: state }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
     }
-}
-/**
- * Estimate cost for a request (simplified pricing)
- */
-function estimateCost(model, inputTokens, outputTokens) {
-    // Simplified pricing per 1M tokens
-    const pricing = {
-        'gpt-4o': { input: 5.0, output: 15.0 },
-        'gpt-4o-mini': { input: 0.15, output: 0.6 },
-        'gpt-4-turbo': { input: 10.0, output: 30.0 },
-        'gpt-3.5-turbo': { input: 0.5, output: 1.5 },
-        'claude-3-5-sonnet-20241022': { input: 3.0, output: 15.0 },
-        'claude-3-opus-20240229': { input: 15.0, output: 75.0 },
-        'claude-3-haiku-20240307': { input: 0.25, output: 1.25 },
-        'llama-3.1-8b-instant': { input: 0.05, output: 0.08 },
-        'llama-3.1-70b-versatile': { input: 0.59, output: 0.79 },
-        'mixtral-8x7b-32768': { input: 0.24, output: 0.24 },
-    };
-    const price = pricing[model] || { input: 1.0, output: 2.0 };
-    return (inputTokens / 1_000_000) * price.input + (outputTokens / 1_000_000) * price.output;
-}
-/**
- * Parse request body
- */
-async function parseBody(req) {
-    return new Promise((resolve, reject) => {
-        let body = '';
-        req.on('data', chunk => (body += chunk.toString()));
-        req.on('end', () => resolve(body));
-        req.on('error', reject);
-    });
-}
-/**
- * Send JSON response
- */
-function sendJson(res, status, data) {
-    res.writeHead(status, {
-        'Content-Type': 'application/json',
-        'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Dry-Run',
-    });
-    res.end(JSON.stringify(data));
-}
-/**
- * Get provider configuration status
- */
-function getProviderStatus() {
-    const providerStatus = {};
-    for (const [name, config] of Object.entries(PROVIDERS)) {
-        const apiKey = process.env[config.apiKeyEnv];
-        providerStatus[name] = apiKey ? 'configured' : 'not_configured';
+    // ============================================================================
+    // Explainability Handlers (Phase 4)
+    // ============================================================================
+    /**
+     * Handle GET /v1/runs/{id}/explain - Full decision chain explanation
+     */
+    async handleExplainRun(res, runId, format) {
+        try {
+            const explanation = await this.explainer.explain(runId, format);
+            if (!explanation) {
+                this.sendError(res, 404, 'not_found', `Run not found: ${runId}`);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                run_id: runId,
+                format,
+                chain: explanation.chain,
+                timeline: explanation.timeline,
+                narrative: explanation.narrative,
+                debug_info: explanation.debug_info,
+            }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
     }
-    return providerStatus;
-}
-/**
- * Handle /health endpoint
- */
-function handleHealth(res) {
-    const config = loadConfig();
-    const dailyUsage = loadDailyUsage();
-    const monthlyUsage = loadMonthlyUsage();
-    const health = {
-        status: 'ok',
-        uptime: Math.floor((Date.now() - startTime) / 1000),
-        version: VERSION,
-        providers: getProviderStatus(),
-        requestsHandled: stats.requestsHandled,
-        requestsSuccessful: stats.requestsSuccessful,
-        requestsFailed: stats.requestsFailed,
-        dailyCost: dailyUsage.cost,
-        dailyLimit: config?.limits?.daily,
-        monthlyCost: monthlyUsage.cost,
-        monthlyLimit: config?.limits?.monthly,
-        usage: {
-            inputTokens: stats.totalInputTokens,
-            outputTokens: stats.totalOutputTokens,
-            totalCost: stats.totalCost,
-        },
-    };
-    sendJson(res, 200, health);
-}
-/**
- * Handle /v1/models endpoint
- */
-function handleModels(res) {
-    const models = [
-        // OpenAI
-        { id: 'gpt-4o', provider: 'openai', alias: null },
-        { id: 'gpt-4o-mini', provider: 'openai', alias: 'rp:balanced' },
-        { id: 'gpt-4-turbo', provider: 'openai', alias: null },
-        { id: 'gpt-3.5-turbo', provider: 'openai', alias: null },
-        // Anthropic
-        { id: 'claude-3-5-sonnet-20241022', provider: 'anthropic', alias: 'rp:best' },
-        { id: 'claude-3-opus-20240229', provider: 'anthropic', alias: null },
-        { id: 'claude-3-haiku-20240307', provider: 'anthropic', alias: null },
-        // Groq
-        { id: 'llama-3.1-70b-versatile', provider: 'groq', alias: null },
-        { id: 'llama-3.1-8b-instant', provider: 'groq', alias: 'rp:fast, rp:cheap' },
-        { id: 'mixtral-8x7b-32768', provider: 'groq', alias: null },
-        // Aliases
-        { id: 'rp:fast', provider: 'groq', alias: '→ llama-3.1-8b-instant' },
-        { id: 'rp:cheap', provider: 'groq', alias: '→ llama-3.1-8b-instant' },
-        { id: 'rp:best', provider: 'anthropic', alias: '→ claude-3-5-sonnet-20241022' },
-        { id: 'rp:balanced', provider: 'openai', alias: '→ gpt-4o-mini' },
-    ];
-    sendJson(res, 200, {
-        object: 'list',
-        data: models.map(m => ({
-            id: m.id,
-            object: 'model',
-            owned_by: m.provider,
-            relayplane_alias: m.alias,
-        })),
-    });
-}
-/**
- * Handle chat completions (and other API endpoints)
- */
-async function handleProxy(req, res, pathname) {
-    const startMs = Date.now();
-    const isDryRun = req.headers['x-dry-run'] === 'true';
-    try {
-        const body = await parseBody(req);
-        let data;
+    /**
+     * Handle GET /v1/runs/{id}/timeline - Timeline view only
+     */
+    async handleRunTimeline(res, runId) {
         try {
-            data = JSON.parse(body);
+            const timeline = await this.explainer.getTimeline(runId);
+            if (timeline.length === 0) {
+                this.sendError(res, 404, 'not_found', `Run not found: ${runId}`);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ run_id: runId, timeline }));
         }
-        catch {
-            sendJson(res, 400, { error: { message: 'Invalid JSON body' } });
-            return;
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
         }
-        let model = data.model || 'gpt-4o';
-        let provider;
-        // Resolve model alias
-        if (MODEL_ALIASES[model]) {
-            const alias = MODEL_ALIASES[model];
-            model = alias.model;
-            provider = alias.provider;
-            data.model = model;
+    }
+    /**
+     * Handle GET /v1/runs/{id}/decisions - Raw decision chain
+     */
+    async handleRunDecisions(res, runId) {
+        try {
+            const chain = await this.explainer.getDecisionChain(runId);
+            if (!chain) {
+                this.sendError(res, 404, 'not_found', `Run not found: ${runId}`);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                run_id: runId,
+                decisions: chain.decisions,
+                summary: chain.summary,
+                insights: chain.insights,
+            }));
         }
-        else {
-            provider = detectProvider(model);
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
         }
-        const providerConfig = PROVIDERS[provider];
-        if (!providerConfig) {
-            sendJson(res, 400, { error: { message: `Unknown provider for model: ${model}` } });
-            return;
+    }
+    /**
+     * Handle GET /v1/runs/{id} - Run inspector (all details)
+     */
+    async handleRunInspector(res, runId) {
+        try {
+            // Get run from ledger
+            const run = await this.ledger.getRun(runId);
+            if (!run) {
+                this.sendError(res, 404, 'not_found', `Run not found: ${runId}`);
+                return;
+            }
+            // Get events
+            const events = await this.ledger.getRunEvents(runId);
+            // Get decision chain
+            const chain = await this.explainer.getDecisionChain(runId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                run,
+                events,
+                decision_chain: chain,
+            }));
         }
-        const apiKey = process.env[providerConfig.apiKeyEnv];
-        if (!apiKey) {
-            sendJson(res, 401, {
-                error: { message: `Missing API key: ${providerConfig.apiKeyEnv}` },
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    /**
+     * Handle GET /v1/runs/compare?ids=run1,run2 - Run comparison
+     */
+    async handleCompareRuns(res, idsParam, includeDecisions) {
+        try {
+            if (!idsParam) {
+                this.sendError(res, 400, 'invalid_request', 'Missing required parameter: ids');
+                return;
+            }
+            const runIds = idsParam.split(',').map(id => id.trim()).filter(Boolean);
+            if (runIds.length < 2) {
+                this.sendError(res, 400, 'invalid_request', 'At least 2 run IDs required for comparison');
+                return;
+            }
+            const comparison = await this.comparator.compare(runIds, {
+                includeDecisionDiff: includeDecisions,
             });
-            return;
+            if (!comparison) {
+                this.sendError(res, 404, 'not_found', 'One or more runs not found');
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(comparison));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    /**
+     * Handle POST /v1/simulate/policy - Policy simulation
+     */
+    async handleSimulatePolicy(req, res) {
+        try {
+            const body = await this.readBody(req);
+            const request = JSON.parse(body);
+            // Use workspace from header if not in body
+            if (!request.workspace_id) {
+                request.workspace_id = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            }
+            const result = await this.simulator.simulatePolicy(request);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(result));
         }
-        // Estimate tokens (rough estimate)
-        const inputTokens = Math.ceil(JSON.stringify(data.messages || data).length / 4);
-        const expectedOutputTokens = data.max_tokens || 500;
-        const estimatedCost = estimateCost(model, inputTokens, expectedOutputTokens);
-        // Check spending limits
-        const config = loadConfig();
-        const dailyUsage = loadDailyUsage();
-        const monthlyUsage = loadMonthlyUsage();
-        if (config?.limits?.daily) {
-            if (dailyUsage.cost + estimatedCost > config.limits.daily) {
-                sendJson(res, 429, {
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Invalid simulation request');
+        }
+    }
+    /**
+     * Handle POST /v1/simulate/routing - Routing simulation
+     */
+    async handleSimulateRouting(req, res) {
+        try {
+            const body = await this.readBody(req);
+            const request = JSON.parse(body);
+            // Use workspace from header if not in body
+            if (!request.workspace_id) {
+                request.workspace_id = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            }
+            const result = await this.simulator.simulateRouting(request);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(result));
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Invalid simulation request');
+        }
+    }
+    /**
+     * Handle /v1/chat/completions
+     */
+    async handleChatCompletions(req, res) {
+        const startTime = Date.now();
+        let runId = null;
+        try {
+            // Parse request body
+            const body = await this.readBody(req);
+            const request = JSON.parse(body);
+            // Extract metadata from headers
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const agentId = req.headers['x-relayplane-agent'] ?? this.config.defaultAgentId;
+            const sessionId = req.headers['x-relayplane-session'];
+            const isAutomated = req.headers['x-relayplane-automated'] === 'true';
+            // Determine provider
+            const provider = getProviderForModel(request.model);
+            // Detect auth type from Authorization header
+            const authHeader = req.headers['authorization'];
+            const authType = this.detectAuthType(authHeader);
+            const executionMode = isAutomated ? 'background' : 'interactive';
+            // Validate auth via Auth Gate
+            const authResult = await this.authGate.validate({
+                workspace_id: workspaceId,
+                metadata: {
+                    session_type: isAutomated ? 'background' : 'interactive',
+                    headers: {
+                        'X-RelayPlane-Automated': isAutomated ? 'true' : 'false',
+                    },
+                },
+            });
+            // Start ledger run
+            runId = await this.ledger.startRun({
+                workspace_id: workspaceId,
+                agent_id: agentId,
+                session_id: sessionId,
+                provider,
+                model: request.model,
+                auth_type: authType,
+                execution_mode: executionMode,
+                compliance_mode: this.config.defaultAuthEnforcementMode,
+                auth_risk: authResult.ledger_flags.auth_risk,
+                policy_override: authResult.ledger_flags.policy_override,
+            });
+            // Record auth validation
+            await this.authGate.emitAuthEvent(runId, authResult);
+            // Check if auth was denied
+            if (!authResult.allow) {
+                const latencyMs = Date.now() - startTime;
+                await this.ledger.completeRun(runId, {
+                    status: 'failed',
+                    input_tokens: 0,
+                    output_tokens: 0,
+                    total_tokens: 0,
+                    cost_usd: 0,
+                    latency_ms: latencyMs,
                     error: {
-                        message: `Daily spending limit reached ($${dailyUsage.cost.toFixed(2)} / $${config.limits.daily})`,
-                        code: 'spending_limit_exceeded',
+                        code: 'auth_denied',
+                        message: authResult.reason ?? 'Authentication denied',
+                        retryable: false,
                     },
                 });
+                this.sendError(res, 403, 'auth_denied', authResult.reason ?? 'Authentication denied', runId, authResult.guidance_url);
                 return;
             }
-        }
-        if (config?.limits?.monthly) {
-            if (monthlyUsage.cost + estimatedCost > config.limits.monthly) {
-                sendJson(res, 429, {
+            // Evaluate policies (Phase 2)
+            if (this.config.enforcePolicies) {
+                const estimatedCost = this.policyEngine.estimateCost(request.model, provider, request.messages?.reduce((sum, m) => sum + (m.content?.length ?? 0) / 4, 0) ?? 1000, // Rough token estimate
+                request.max_tokens ?? 1000);
+                const policyDecision = await this.policyEngine.evaluate({
+                    workspace_id: workspaceId,
+                    agent_id: agentId,
+                    session_id: sessionId,
+                    run_id: runId,
+                    request: {
+                        model: request.model,
+                        provider,
+                        estimated_cost_usd: estimatedCost,
+                        estimated_tokens: request.max_tokens,
+                        context_size: request.messages?.reduce((sum, m) => sum + (m.content?.length ?? 0), 0),
+                        tools_requested: request.tools?.map((t) => t.function?.name).filter((n) => !!n),
+                    },
+                });
+                // Record policy evaluation in ledger
+                await this.ledger.recordPolicyEvaluation(runId, policyDecision.policies_evaluated.map((p) => ({
+                    policy_id: p.policy_id,
+                    policy_name: p.policy_name,
+                    matched: p.matched,
+                    action_taken: p.action_taken,
+                })));
+                // Check if policy denied the request
+                if (!policyDecision.allow) {
+                    const latencyMs = Date.now() - startTime;
+                    await this.ledger.completeRun(runId, {
+                        status: 'failed',
+                        input_tokens: 0,
+                        output_tokens: 0,
+                        total_tokens: 0,
+                        cost_usd: 0,
+                        latency_ms: latencyMs,
+                        error: {
+                            code: policyDecision.approval_required ? 'approval_required' : 'policy_denied',
+                            message: policyDecision.reason ?? 'Policy denied the request',
+                            retryable: false,
+                        },
+                    });
+                    if (policyDecision.approval_required) {
+                        this.sendError(res, 403, 'approval_required', policyDecision.reason ?? 'Approval required', runId);
+                    }
+                    else {
+                        this.sendError(res, 403, 'policy_denied', policyDecision.reason ?? 'Policy denied the request', runId);
+                    }
+                    return;
+                }
+                // Apply any modifications from policy (e.g., model downgrade, context cap)
+                if (policyDecision.modified_request) {
+                    if (policyDecision.modified_request.model) {
+                        request.model = policyDecision.modified_request.model;
+                    }
+                }
+                // Log budget warning if present
+                if (policyDecision.budget_warning) {
+                    this.log('info', `Budget warning for ${workspaceId}: ${policyDecision.budget_warning}`);
+                }
+            }
+            // Record routing decision
+            await this.ledger.recordRouting(runId, {
+                selected_provider: provider,
+                selected_model: request.model,
+                reason: 'Direct model selection by client',
+            });
+            // Forward to provider
+            const providerConfig = this.config.providers?.[provider];
+            if (!providerConfig?.apiKey) {
+                const latencyMs = Date.now() - startTime;
+                await this.ledger.completeRun(runId, {
+                    status: 'failed',
+                    input_tokens: 0,
+                    output_tokens: 0,
+                    total_tokens: 0,
+                    cost_usd: 0,
+                    latency_ms: latencyMs,
                     error: {
-                        message: `Monthly spending limit reached ($${monthlyUsage.cost.toFixed(2)} / $${config.limits.monthly})`,
-                        code: 'spending_limit_exceeded',
+                        code: 'provider_not_configured',
+                        message: `Provider ${provider} is not configured`,
+                        retryable: false,
                     },
                 });
+                this.sendError(res, 500, 'provider_not_configured', `Provider ${provider} is not configured`, runId);
                 return;
             }
+            // Make provider request
+            const providerResponse = await this.forwardToProvider(provider, request, providerConfig, runId);
+            const latencyMs = Date.now() - startTime;
+            if (providerResponse.success) {
+                const costUsd = this.estimateCost(provider, providerResponse.usage);
+                // Complete run successfully
+                await this.ledger.completeRun(runId, {
+                    status: 'completed',
+                    input_tokens: providerResponse.usage?.prompt_tokens ?? 0,
+                    output_tokens: providerResponse.usage?.completion_tokens ?? 0,
+                    total_tokens: providerResponse.usage?.total_tokens ?? 0,
+                    cost_usd: costUsd,
+                    latency_ms: latencyMs,
+                    ttft_ms: providerResponse.ttft_ms,
+                });
+                // Record spend for budget tracking (Phase 2)
+                if (this.config.enforcePolicies) {
+                    await this.policyEngine.recordSpend(workspaceId, agentId, runId, costUsd);
+                }
+                // Add run_id to response
+                const responseData = providerResponse.data;
+                const responseWithMeta = {
+                    ...responseData,
+                    relayplane: {
+                        run_id: runId,
+                        latency_ms: latencyMs,
+                        ttft_ms: providerResponse.ttft_ms,
+                    },
+                };
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(responseWithMeta));
+            }
+            else {
+                // Complete run with failure
+                await this.ledger.completeRun(runId, {
+                    status: 'failed',
+                    input_tokens: 0,
+                    output_tokens: 0,
+                    total_tokens: 0,
+                    cost_usd: 0,
+                    latency_ms: latencyMs,
+                    error: {
+                        code: providerResponse.error?.code ?? 'provider_error',
+                        message: providerResponse.error?.message ?? 'Provider request failed',
+                        provider_error: providerResponse.error?.raw,
+                        retryable: providerResponse.error?.retryable ?? false,
+                    },
+                });
+                this.sendError(res, providerResponse.error?.status ?? 500, providerResponse.error?.code ?? 'provider_error', providerResponse.error?.message ?? 'Provider request failed', runId);
+            }
         }
-        // Dry run mode - return estimate without making actual request
-        if (isDryRun) {
-            sendJson(res, 200, {
-                dry_run: true,
-                routing: {
-                    model,
-                    provider,
-                    endpoint: `${providerConfig.baseUrl}${pathname}`,
-                },
-                estimate: {
-                    inputTokens,
-                    expectedOutputTokens,
-                    estimatedCost,
-                    currency: 'USD',
-                },
-                limits: {
-                    daily: config?.limits?.daily,
-                    dailyUsed: dailyUsage.cost,
-                    dailyRemaining: config?.limits?.daily
-                        ? config.limits.daily - dailyUsage.cost
-                        : null,
-                    monthly: config?.limits?.monthly,
-                    monthlyUsed: monthlyUsage.cost,
-                    monthlyRemaining: config?.limits?.monthly
-                        ? config.limits.monthly - monthlyUsage.cost
-                        : null,
+        catch (err) {
+            const latencyMs = Date.now() - startTime;
+            const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+            if (runId) {
+                await this.ledger.completeRun(runId, {
+                    status: 'failed',
+                    input_tokens: 0,
+                    output_tokens: 0,
+                    total_tokens: 0,
+                    cost_usd: 0,
+                    latency_ms: latencyMs,
+                    error: {
+                        code: 'internal_error',
+                        message: errorMessage,
+                        retryable: false,
+                    },
+                });
+            }
+            this.sendError(res, 500, 'internal_error', errorMessage, runId ?? undefined);
+        }
+    }
+    /**
+     * Forward request to provider
+     */
+    async forwardToProvider(provider, request, config, runId) {
+        const endpoint = PROVIDER_ENDPOINTS[provider];
+        if (!endpoint) {
+            return {
+                success: false,
+                error: {
+                    code: 'unknown_provider',
+                    message: `Unknown provider: ${provider}`,
+                    status: 500,
+                    retryable: false,
                 },
-            });
-            return;
+            };
         }
-        // Make actual request to provider
-        const url = new URL(pathname, providerConfig.baseUrl);
+        const baseUrl = config.baseUrl ?? endpoint.baseUrl;
+        const url = `${baseUrl}/chat/completions`;
         const headers = {
             'Content-Type': 'application/json',
-            'User-Agent': `relayplane-proxy/${VERSION}`,
-            [providerConfig.headerName]: providerConfig.headerPrefix + apiKey,
-            ...providerConfig.extraHeaders,
         };
-        const proxyReq = (url.protocol === 'https:' ? https : http).request(url, {
-            method: 'POST',
-            headers,
-        }, proxyRes => {
-            const chunks = [];
-            proxyRes.on('data', chunk => chunks.push(chunk));
-            proxyRes.on('end', () => {
-                const responseBody = Buffer.concat(chunks).toString();
-                const latencyMs = Date.now() - startMs;
-                // Parse response for usage tracking
-                let outputTokens = expectedOutputTokens;
-                let success = proxyRes.statusCode === 200;
+        // Set auth header
+        if (provider === 'anthropic') {
+            headers['x-api-key'] = config.apiKey;
+            headers['anthropic-version'] = '2023-06-01';
+        }
+        else {
+            headers['Authorization'] = `Bearer ${config.apiKey}`;
+        }
+        try {
+            const ttftStart = Date.now();
+            const response = await fetch(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(request),
+            });
+            // Record provider call
+            await this.ledger.recordProviderCall(runId, {
+                provider,
+                model: request.model,
+                attempt: 1,
+                ttft_ms: Date.now() - ttftStart,
+            });
+            if (!response.ok) {
+                const errorBody = await response.text();
+                let parsedError;
                 try {
-                    const respData = JSON.parse(responseBody);
-                    if (respData.usage) {
-                        outputTokens = respData.usage.completion_tokens || outputTokens;
-                    }
+                    parsedError = JSON.parse(errorBody);
                 }
                 catch {
-                    // Ignore parse errors
-                }
-                const actualCost = estimateCost(model, inputTokens, outputTokens);
-                // Update stats
-                stats.requestsHandled++;
-                if (success) {
-                    stats.requestsSuccessful++;
+                    parsedError = errorBody;
                 }
-                else {
-                    stats.requestsFailed++;
-                }
-                stats.totalInputTokens += inputTokens;
-                stats.totalOutputTokens += outputTokens;
-                stats.totalCost += actualCost;
-                // Update model stats
-                const modelStats = stats.byModel.get(model) || { requests: 0, tokens: 0, cost: 0 };
-                modelStats.requests++;
-                modelStats.tokens += inputTokens + outputTokens;
-                modelStats.cost += actualCost;
-                stats.byModel.set(model, modelStats);
-                // Update provider stats
-                const providerStats = stats.byProvider.get(provider) || { requests: 0, tokens: 0, cost: 0 };
-                providerStats.requests++;
-                providerStats.tokens += inputTokens + outputTokens;
-                providerStats.cost += actualCost;
-                stats.byProvider.set(provider, providerStats);
-                // Update daily usage
-                dailyUsage.cost += actualCost;
-                dailyUsage.requests++;
-                saveDailyUsage(dailyUsage);
-                // Update monthly usage
-                monthlyUsage.cost += actualCost;
-                monthlyUsage.requests++;
-                saveMonthlyUsage(monthlyUsage);
-                // Log usage
-                logUsage({
-                    timestamp: new Date().toISOString(),
-                    model,
-                    provider,
-                    inputTokens,
-                    outputTokens,
-                    cost: actualCost,
-                    latencyMs,
-                    success,
-                });
-                // Check limits and log warnings to console
-                const usageWarning = checkAndWarnLimits(dailyUsage, monthlyUsage, config);
-                // Add usage warning header if approaching limit
-                const responseHeaders = {
-                    'Content-Type': 'application/json',
-                    'Access-Control-Allow-Origin': '*',
-                    'X-RelayPlane-Cost': actualCost.toFixed(6),
-                    'X-RelayPlane-Latency': latencyMs.toString(),
+                return {
+                    success: false,
+                    error: {
+                        code: `provider_${response.status}`,
+                        message: `Provider returned ${response.status}`,
+                        status: response.status,
+                        retryable: response.status >= 500 || response.status === 429,
+                        raw: parsedError,
+                    },
                 };
-                if (config?.limits?.daily) {
-                    responseHeaders['X-RelayPlane-Daily-Usage'] = `${dailyUsage.cost.toFixed(2)}/${config.limits.daily}`;
-                }
-                if (config?.limits?.monthly) {
-                    responseHeaders['X-RelayPlane-Monthly-Usage'] = `${monthlyUsage.cost.toFixed(2)}/${config.limits.monthly}`;
-                }
-                if (usageWarning) {
-                    responseHeaders['X-RelayPlane-Usage-Warning'] = usageWarning;
-                }
-                res.writeHead(proxyRes.statusCode || 200, responseHeaders);
-                res.end(responseBody);
-            });
-        });
-        proxyReq.on('error', error => {
-            stats.requestsHandled++;
-            stats.requestsFailed++;
-            logUsage({
-                timestamp: new Date().toISOString(),
-                model,
-                provider,
-                inputTokens,
-                outputTokens: 0,
-                cost: 0,
-                latencyMs: Date.now() - startMs,
+            }
+            const data = await response.json();
+            const ttftMs = Date.now() - ttftStart;
+            return {
+                success: true,
+                data,
+                usage: data.usage,
+                ttft_ms: ttftMs,
+            };
+        }
+        catch (err) {
+            return {
                 success: false,
-            });
-            sendJson(res, 502, { error: { message: `Proxy error: ${error.message}` } });
+                error: {
+                    code: 'network_error',
+                    message: err instanceof Error ? err.message : 'Network error',
+                    status: 500,
+                    retryable: true,
+                    raw: err,
+                },
+            };
+        }
+    }
+    /**
+     * Detect auth type from Authorization header
+     */
+    detectAuthType(authHeader) {
+        if (!authHeader)
+            return 'api';
+        // Consumer auth typically uses session tokens or OAuth
+        // API auth uses API keys starting with specific prefixes
+        if (authHeader.includes('sk-ant-') ||
+            authHeader.includes('sk-') ||
+            authHeader.includes('Bearer sk-')) {
+            return 'api';
+        }
+        // Default to consumer if it looks like a session token
+        if (authHeader.startsWith('Bearer ') && authHeader.length > 100) {
+            return 'consumer';
+        }
+        return 'api';
+    }
+    /**
+     * Estimate cost based on provider and usage
+     */
+    estimateCost(provider, usage) {
+        if (!usage)
+            return 0;
+        // Approximate pricing per 1K tokens
+        const pricing = {
+            anthropic: { input: 0.003, output: 0.015 }, // Claude 3.5 Sonnet
+            openai: { input: 0.005, output: 0.015 }, // GPT-4o
+            openrouter: { input: 0.003, output: 0.015 }, // Varies
+        };
+        const rates = pricing[provider] ?? { input: 0.003, output: 0.015 };
+        return ((usage.prompt_tokens / 1000) * rates.input + (usage.completion_tokens / 1000) * rates.output);
+    }
+    /**
+     * Read request body
+     */
+    readBody(req) {
+        return new Promise((resolve, reject) => {
+            let body = '';
+            req.on('data', (chunk) => (body += chunk));
+            req.on('end', () => resolve(body));
+            req.on('error', reject);
         });
-        proxyReq.write(JSON.stringify(data));
-        proxyReq.end();
     }
-    catch (error) {
-        sendJson(res, 500, { error: { message: error.message } });
+    /**
+     * Send error response
+     */
+    sendError(res, status, code, message, runId, guidanceUrl) {
+        const error = {
+            error: {
+                message,
+                type: 'relayplane_error',
+                code,
+                run_id: runId,
+            },
+        };
+        if (guidanceUrl) {
+            error.error['guidance_url'] = guidanceUrl;
+        }
+        res.writeHead(status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(error));
+    }
+    // ============================================================================
+    // Learning Engine Handlers (Phase 5)
+    // ============================================================================
+    async handleAnalyticsSummary(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+            const from = url.searchParams.get('from') ?? new Date(Date.now() - 7 * 86400000).toISOString();
+            const to = url.searchParams.get('to') ?? new Date().toISOString();
+            const summary = await this.learningEngine.getAnalyticsSummary({
+                workspace_id: workspaceId,
+                from,
+                to,
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ summary }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleRunAnalysis(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const result = await this.learningEngine.runAnalysis(workspaceId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(result));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleListSuggestions(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+            const status = url.searchParams.get('status');
+            const suggestions = await this.learningEngine.listSuggestions({
+                workspace_id: workspaceId,
+                status: status || undefined,
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ suggestions }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleApproveSuggestion(req, res, id) {
+        try {
+            const body = await this.readBody(req);
+            const parsed = body ? JSON.parse(body) : {};
+            const rule = await this.learningEngine.approveSuggestion(id, {
+                user_id: parsed.user_id ?? 'system',
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ rule }));
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleRejectSuggestion(req, res, id) {
+        try {
+            const body = await this.readBody(req);
+            const parsed = body ? JSON.parse(body) : {};
+            await this.learningEngine.rejectSuggestion(id, {
+                user_id: parsed.user_id ?? 'system',
+                reason: parsed.reason ?? 'Rejected via API',
+            });
+            res.writeHead(204);
+            res.end();
+        }
+        catch (err) {
+            this.sendError(res, 400, 'invalid_request', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleListRules(req, res) {
+        try {
+            const workspaceId = req.headers['x-relayplane-workspace'] ?? this.config.defaultWorkspaceId;
+            const rules = await this.learningEngine.listRules(workspaceId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ rules }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    async handleRuleEffectiveness(res, ruleId) {
+        try {
+            const effectiveness = await this.learningEngine.getRuleEffectiveness(ruleId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ effectiveness }));
+        }
+        catch (err) {
+            this.sendError(res, 500, 'internal_error', err instanceof Error ? err.message : 'Unknown error');
+        }
+    }
+    /**
+     * Log message
+     */
+    log(level, message) {
+        if (this.config.verbose || level === 'error') {
+            const timestamp = new Date().toISOString();
+            console.log(`[${timestamp}] [${level.toUpperCase()}] ${message}`);
+        }
+    }
+    /**
+     * Get the ledger instance (useful for testing)
+     */
+    getLedger() {
+        return this.ledger;
+    }
+    /**
+     * Get the auth gate instance (useful for testing)
+     */
+    getAuthGate() {
+        return this.authGate;
+    }
+    /**
+     * Get the policy engine instance (useful for testing and policy management)
+     */
+    getPolicyEngine() {
+        return this.policyEngine;
+    }
+    /**
+     * Get the routing engine instance (Phase 3)
+     */
+    getRoutingEngine() {
+        return this.routingEngine;
+    }
+    /**
+     * Get the capability registry instance (Phase 3)
+     */
+    getCapabilityRegistry() {
+        return this.capabilityRegistry;
+    }
+    /**
+     * Get the provider manager instance (Phase 3)
+     */
+    getProviderManager() {
+        return this.providerManager;
+    }
+    /**
+     * Get the explanation engine instance (Phase 4)
+     */
+    getExplainer() {
+        return this.explainer;
+    }
+    /**
+     * Get the run comparator instance (Phase 4)
+     */
+    getComparator() {
+        return this.comparator;
+    }
+    /**
+     * Get the simulator instance (Phase 4)
+     */
+    getSimulator() {
+        return this.simulator;
+    }
+    /**
+     * Get the learning engine instance (Phase 5)
+     */
+    getLearningEngine() {
+        return this.learningEngine;
     }
 }
+exports.ProxyServer = ProxyServer;
 /**
- * Main request handler
+ * Create a new proxy server
  */
-function handleRequest(req, res) {
-    const url = new URL(req.url || '/', `http://${HOST}:${PORT}`);
-    const pathname = url.pathname;
-    // CORS preflight
-    if (req.method === 'OPTIONS') {
-        res.writeHead(204, {
-            'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-            'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Dry-Run',
-        });
-        res.end();
-        return;
-    }
-    // Health check endpoint
-    if (pathname === '/health' && req.method === 'GET') {
-        handleHealth(res);
-        return;
-    }
-    // Models endpoint
-    if (pathname === '/v1/models' && req.method === 'GET') {
-        handleModels(res);
-        return;
-    }
-    // Chat completions and other API endpoints
-    if (pathname.startsWith('/v1/') && req.method === 'POST') {
-        handleProxy(req, res, pathname);
-        return;
-    }
-    // Root endpoint
-    if (pathname === '/' && req.method === 'GET') {
-        sendJson(res, 200, {
-            name: 'RelayPlane Proxy',
-            version: VERSION,
-            status: 'ok',
-            endpoints: {
-                health: '/health',
-                models: '/v1/models',
-                chat: '/v1/chat/completions',
-            },
-        });
-        return;
+function createProxyServer(config) {
+    return new ProxyServer(config);
+}
+/**
+ * Create a proxy server with optional circuit breaker middleware wrapping.
+ * This gives the advanced proxy the same circuit breaker protection as standalone.
+ */
+function createSandboxedProxyServer(config) {
+    const server = createProxyServer(config);
+    if (config?.relayplane?.enabled) {
+        const middleware = new middleware_js_1.RelayPlaneMiddleware((0, relay_config_js_1.resolveConfig)(config.relayplane));
+        return { server, middleware };
     }
-    // 404 for unknown routes
-    sendJson(res, 404, { error: { message: 'Not found' } });
+    return { server };
 }
-// Create and start server
-const server = http.createServer(handleRequest);
-server.listen(PORT, HOST, () => {
-    console.log(`🚀 RelayPlane Proxy v${VERSION}`);
-    console.log(`   Listening on http://${HOST}:${PORT}`);
-    console.log(`   Health check: http://${HOST}:${PORT}/health`);
-    console.log(`   Press Ctrl+C to stop`);
-});
-// Graceful shutdown
-process.on('SIGTERM', () => {
-    console.log('\nShutting down...');
-    server.close(() => {
-        console.log('Server stopped.');
-        process.exit(0);
-    });
-});
-process.on('SIGINT', () => {
-    console.log('\nShutting down...');
-    server.close(() => {
-        console.log('Server stopped.');
-        process.exit(0);
-    });
-});
 //# sourceMappingURL=server.js.map