@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/lib/output-cap.js

@@ -0,0 +1,80 @@
+// Per-model output-token ceilings learned from provider rejections.
+//
+// Clients size max_tokens for the model they think they are talking to:
+// Claude Code asks for 128000, Open WebUI for 65536. Several free models stop
+// lower and reject the request outright instead of clamping it, observed live:
+//   - Ollama Cloud: "max_tokens (128000) exceeds model's maximum output tokens
+//     (65536) for model nemotron-3-ultra"
+//   - Groq: "`max_tokens` must be less than or equal to `65536`, the maximum
+//     value for `max_tokens` is less than the `context_window` for this model"
+// The catalog has no output-limit column, so the ceiling is learned from the
+// first rejection and applied to every later request on that model through the
+// per-route output budget (resolveMaxTokens clamps max_tokens to it). A
+// restart forgets the ceilings; the first request after it pays one failover
+// hop to relearn each one.
+const learned = new Map();
+const MAX_TOKENS_PARAM = /\b(max_tokens|max_completion_tokens|max_output_tokens|maxoutputtokens|max_new_tokens)\b/;
+// The number that follows a ceiling phrase: "less than or equal to `65536`",
+// "maximum output tokens (65536)", "at most 32768", "no more than 8192",
+// "exceeds the maximum allowed value of 4096" (OpenRouter), "greater than the
+// maximum 16384" (Fireworks), "must be less than 8192" (DeepInfra). No bare
+// "exceeds N" or "less than N": those read any number in the message ("input
+// tokens exceeds 200", "exceeds 30000 TPM").
+const CEILING_PHRASE = '(?:less than or equal to|must be less than|at most|no (?:more|greater) than|(?:cannot|must not|can not) exceed|greater than the maximum|maximum output tokens|maximum allowed value|max output tokens|maximum value|output limit|maximum is)\\W{0,4}(?:of\\s+)?\\W{0,2}(\\d{3,7})';
+// The ceiling phrase must follow the parameter name within the same clause
+// (60 characters, no '.' or ';' in between), so a number that belongs to some
+// other limit in a message that merely mentions max_tokens is never learned.
+const CEILING = new RegExp(`\\b(?:max_tokens|max_completion_tokens|max_output_tokens|maxoutputtokens|max_new_tokens)\\b[^.;]{0,60}?${CEILING_PHRASE}`);
+// A learned ceiling below this is almost certainly a misread (a real output
+// limit this small is not something a client would hit by accident), and a
+// wrong low cap would truncate every reply on the model until restart.
+export const MIN_LEARNED_OUTPUT_CAP = 1024;
+function capKey(platform, modelId) {
+    return `${platform}:${modelId}`;
+}
+/** The output ceiling a provider names when it rejects max_tokens as too
+ *  large, or null when the error is anything else. Both the parameter name and
+ *  a ceiling phrase must appear, so a context-window rejection that merely
+ *  mentions "maximum output tokens" (Cloudflare) never matches. */
+export function parseMaxTokensCeiling(message) {
+    const msg = String(message ?? '').toLowerCase();
+    if (!MAX_TOKENS_PARAM.test(msg))
+        return null;
+    const match = CEILING.exec(msg);
+    if (!match)
+        return null;
+    const ceiling = Number(match[1]);
+    return Number.isFinite(ceiling) && ceiling > 0 ? ceiling : null;
+}
+/** Learn the ceiling from a max_tokens rejection. Returns it, or null when the
+ *  error is not one, or when the reading is below MIN_LEARNED_OUTPUT_CAP. The
+ *  lowest reading wins. */
+export function learnOutputCapFromError(route, err) {
+    const status = typeof err?.status === 'number' ? err.status : 0;
+    if (status !== 0 && status !== 400 && status !== 422)
+        return null;
+    const ceiling = parseMaxTokensCeiling(err?.message);
+    if (ceiling == null || ceiling < MIN_LEARNED_OUTPUT_CAP)
+        return null;
+    const key = capKey(route.platform, route.modelId);
+    const current = learned.get(key);
+    learned.set(key, current == null ? ceiling : Math.min(current, ceiling));
+    return ceiling;
+}
+export function learnedOutputCap(platform, modelId) {
+    return learned.get(capKey(platform, modelId));
+}
+/** The output budget for one route: what is left of its context window after
+ *  the input, lowered to any learned output ceiling. Adapters pass it to
+ *  resolveMaxTokens as `contextBudget`. */
+export function routeOutputBudget(route, estimatedInputTokens) {
+    const windowLeft = route.contextWindow != null ? route.contextWindow - estimatedInputTokens : undefined;
+    const cap = learnedOutputCap(route.platform, route.modelId);
+    if (cap == null)
+        return windowLeft;
+    return windowLeft == null ? cap : Math.min(windowLeft, cap);
+}
+export function resetLearnedOutputCaps() {
+    learned.clear();
+}
+//# sourceMappingURL=output-cap.js.map

package/dist/lib/output-cap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-cap.js","sourceRoot":"","sources":["../../src/lib/output-cap.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,0CAA0C;AAC1C,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,2BAA2B;AAE3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE1C,MAAM,gBAAgB,GAAG,yFAAyF,CAAC;AACnH,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,6CAA6C;AAC7C,MAAM,cAAc,GAAG,mRAAmR,CAAC;AAC3S,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,0GAA0G,cAAc,EAAE,CAAC,CAAC;AACvJ,4EAA4E;AAC5E,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,SAAS,MAAM,CAAC,QAAgB,EAAE,OAAe;IAC/C,OAAO,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;;mEAGmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED;;2BAE2B;AAC3B,MAAM,UAAU,uBAAuB,CAAC,KAA4C,EAAE,GAAQ;IAC5F,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,GAAG,sBAAsB;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAe;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;2CAE2C;AAC3C,MAAM,UAAU,iBAAiB,CAC/B,KAA2E,EAC3E,oBAA4B;IAE5B,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,GAAG,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACnC,OAAO,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC"}

package/dist/lib/password.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): string;
+export declare function verifyPassword(password: string, stored: string): boolean;
+//# sourceMappingURL=password.d.ts.map

package/dist/lib/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/lib/password.ts"],"names":[],"mappings":"AAOA,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAaxE"}

package/dist/lib/password.js

@@ -0,0 +1,27 @@
+import crypto from 'crypto';
+// Password hashing with Node's built-in scrypt (no external dependency).
+// Stored format: `scrypt$<saltHex>$<hashHex>`.
+const KEYLEN = 64;
+const SALT_BYTES = 16;
+export function hashPassword(password) {
+    const salt = crypto.randomBytes(SALT_BYTES);
+    const hash = crypto.scryptSync(password, salt, KEYLEN);
+    return `scrypt$${salt.toString('hex')}$${hash.toString('hex')}`;
+}
+export function verifyPassword(password, stored) {
+    const parts = stored.split('$');
+    if (parts.length !== 3 || parts[0] !== 'scrypt')
+        return false;
+    const salt = Buffer.from(parts[1], 'hex');
+    const expected = Buffer.from(parts[2], 'hex');
+    let actual;
+    try {
+        actual = crypto.scryptSync(password, salt, expected.length);
+    }
+    catch {
+        return false;
+    }
+    // Constant-time compare; lengths match by construction (both KEYLEN).
+    return actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
+}
+//# sourceMappingURL=password.js.map

package/dist/lib/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/lib/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,yEAAyE;AACzE,+CAA+C;AAC/C,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,sEAAsE;IACtE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACvF,CAAC"}

package/dist/lib/process-safety-net.d.ts

@@ -0,0 +1,32 @@
+/** Pure: true when the error is a recoverable network transport failure that
+ *  should not crash the process (vs. a programming bug, which should). */
+export declare function isTransportError(err: unknown): boolean;
+export type ProcessErrorDecision = 'swallow' | 'fatal';
+/** Pure: swallow transport errors, treat everything else as fatal. */
+export declare function classifyProcessError(err: unknown): ProcessErrorDecision;
+export interface SafetyNetHooks {
+    log?: (...args: unknown[]) => void;
+    exit?: (code: number) => void;
+    /** Set false to skip registering process.on() handlers (e.g. in test environments
+     *  or runtimes that do not expose a Node process). Default: true. */
+    hasProcessHooks?: boolean;
+}
+/** Decide and act on a process-level error. Returns the decision so callers and
+ *  tests can assert behavior. `fatal` exits 1 (preserving Node's default
+ *  fail-fast); `swallow` logs and lets the process continue. */
+export declare function handleProcessError(kind: 'uncaughtException' | 'unhandledRejection', err: unknown, hooks?: SafetyNetHooks): ProcessErrorDecision;
+/** Pure: true for a write that failed because the reading end of the pipe is gone. */
+export declare function isBrokenPipeWrite(err: unknown): boolean;
+/**
+ * Give stdout/stderr an 'error' listener. Without one, a stream error — the
+ * terminal closed, or the process that started us with piped output exited —
+ * is escalated to an uncaughtException on every later console write. A dead
+ * console is not a reason to crash or to log, so those codes are dropped and
+ * anything else is rethrown to keep the fail-fast contract.
+ */
+export declare function guardStdio(streams?: NodeJS.EventEmitter[]): void;
+/** Install the global handlers once. Idempotent. Call as early as possible at
+ *  boot (before the server starts taking traffic). Pass `hasProcessHooks: false`
+ *  to skip handler registration without changing other hook behaviour. */
+export declare function installProcessSafetyNet(hooks?: SafetyNetHooks): void;
+//# sourceMappingURL=process-safety-net.d.ts.map

package/dist/lib/process-safety-net.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-safety-net.d.ts","sourceRoot":"","sources":["../../src/lib/process-safety-net.ts"],"names":[],"mappings":"AA6CA;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQtD;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvD,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAEvE;AASD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;yEACqE;IACrE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;gEAEgE;AAChE,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,mBAAmB,GAAG,oBAAoB,EAChD,GAAG,EAAE,OAAO,EACZ,KAAK,GAAE,cAAmB,GACzB,oBAAoB,CAetB;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,MAAM,CAAC,YAAY,EAAqC,GAAG,IAAI,CAOlG;AAID;;0EAE0E;AAC1E,wBAAgB,uBAAuB,CAAC,KAAK,GAAE,cAAmB,GAAG,IAAI,CAOxE"}

package/dist/lib/process-safety-net.js

@@ -0,0 +1,123 @@
+// Process-level safety net for late network transport errors (fork-validated:
+// jasnoorgill's safe-fetch / process-safety-net).
+//
+// The failure this guards against: undici resolves `fetch()` and we move on, but
+// the underlying HTTP/2 / TLS socket is later reset by a CDN edge (CloudFront,
+// Cloudflare) AFTER the response was handed off. undici emits that late error on
+// a stream with no listener, Node escalates it to an `uncaughtException`, and —
+// with no handler installed — the whole proxy exits 1. For a gateway whose entire
+// job is uptime in front of flaky free-tier providers, a third party closing a
+// socket must never take the process down.
+//
+// Design: swallow ONLY a tight allowlist of transport-error codes/messages, and
+// preserve Node's default fail-fast (exit 1) for everything else, so genuine
+// bugs still surface loudly. The classifier is a pure function so it can be
+// unit-tested without registering global handlers.
+const TRANSPORT_ERROR_CODES = new Set([
+    // Node socket-level codes
+    'ECONNRESET', 'ECONNREFUSED', 'ECONNABORTED', 'ETIMEDOUT', 'EPIPE',
+    'EAI_AGAIN', 'ENOTFOUND', 'EHOSTUNREACH', 'ENETUNREACH', 'EADDRNOTAVAIL',
+    // undici codes (the late-error culprits)
+    'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT', 'UND_ERR_ABORTED',
+]);
+const TRANSPORT_MESSAGE_HINTS = [
+    'fetch failed', 'other side closed', 'socket hang up', 'terminated',
+    'premature close', 'econnreset', 'request aborted',
+];
+// undici wraps the real socket error in `err.cause`; sometimes nested further.
+// Walk the cause chain (bounded, cycle-safe) collecting codes and messages.
+function walkErrorChain(err) {
+    const out = [];
+    let cur = err;
+    const seen = new Set();
+    for (let depth = 0; cur && typeof cur === 'object' && depth < 6; depth++) {
+        if (seen.has(cur))
+            break;
+        seen.add(cur);
+        out.push({ code: typeof cur.code === 'string' ? cur.code : undefined, message: typeof cur.message === 'string' ? cur.message : undefined });
+        cur = cur.cause;
+    }
+    return out;
+}
+/** Pure: true when the error is a recoverable network transport failure that
+ *  should not crash the process (vs. a programming bug, which should). */
+export function isTransportError(err) {
+    if (err == null)
+        return false;
+    const links = walkErrorChain(err);
+    for (const { code } of links) {
+        if (code && TRANSPORT_ERROR_CODES.has(code))
+            return true;
+    }
+    const joined = links.map(l => l.message ?? '').join(' | ').toLowerCase();
+    return TRANSPORT_MESSAGE_HINTS.some(h => joined.includes(h));
+}
+/** Pure: swallow transport errors, treat everything else as fatal. */
+export function classifyProcessError(err) {
+    return isTransportError(err) ? 'swallow' : 'fatal';
+}
+function describeError(err) {
+    const links = walkErrorChain(err);
+    const code = links.find(l => l.code)?.code;
+    const message = links.find(l => l.message)?.message;
+    return code ? `${code} (${message ?? 'no message'})` : (message ?? String(err));
+}
+/** Decide and act on a process-level error. Returns the decision so callers and
+ *  tests can assert behavior. `fatal` exits 1 (preserving Node's default
+ *  fail-fast); `swallow` logs and lets the process continue. */
+export function handleProcessError(kind, err, hooks = {}) {
+    const log = hooks.log ?? console.error;
+    const decision = classifyProcessError(err);
+    // A write that hit a closed pipe is swallowed WITHOUT logging: when the pipe
+    // is our own stdout/stderr, logging it writes to that same dead pipe, which
+    // raises the next EPIPE — and every one of those lines is also persisted to
+    // server_logs. That loop ran at thousands of rows a second.
+    if (decision === 'swallow' && isBrokenPipeWrite(err))
+        return 'swallow';
+    if (decision === 'swallow') {
+        log(`[safety-net] swallowed transient ${kind}: ${describeError(err)}`);
+        return 'swallow';
+    }
+    log(`[safety-net] fatal ${kind}:`, err);
+    (hooks.exit ?? process.exit)(1);
+    return 'fatal';
+}
+/** Pure: true for a write that failed because the reading end of the pipe is gone. */
+export function isBrokenPipeWrite(err) {
+    const e = err;
+    return !!e && typeof e === 'object' && e.code === 'EPIPE' && e.syscall === 'write';
+}
+// Codes a stdio stream emits once whatever was reading it has gone away.
+const DEAD_STDIO_CODES = new Set(['EPIPE', 'EOF', 'ERR_STREAM_DESTROYED']);
+/**
+ * Give stdout/stderr an 'error' listener. Without one, a stream error — the
+ * terminal closed, or the process that started us with piped output exited —
+ * is escalated to an uncaughtException on every later console write. A dead
+ * console is not a reason to crash or to log, so those codes are dropped and
+ * anything else is rethrown to keep the fail-fast contract.
+ */
+export function guardStdio(streams = [process.stdout, process.stderr]) {
+    for (const stream of streams) {
+        stream.on('error', (err) => {
+            if (err && typeof err.code === 'string' && DEAD_STDIO_CODES.has(err.code))
+                return;
+            throw err;
+        });
+    }
+}
+let installed = false;
+/** Install the global handlers once. Idempotent. Call as early as possible at
+ *  boot (before the server starts taking traffic). Pass `hasProcessHooks: false`
+ *  to skip handler registration without changing other hook behaviour. */
+export function installProcessSafetyNet(hooks = {}) {
+    if (installed)
+        return;
+    installed = true;
+    if (hooks.hasProcessHooks === false)
+        return;
+    guardStdio();
+    process.on('uncaughtException', (err) => handleProcessError('uncaughtException', err, hooks));
+    process.on('unhandledRejection', (reason) => handleProcessError('unhandledRejection', reason, hooks));
+}
+//# sourceMappingURL=process-safety-net.js.map

package/dist/lib/process-safety-net.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-safety-net.js","sourceRoot":"","sources":["../../src/lib/process-safety-net.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AAEnD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,0BAA0B;IAC1B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO;IAClE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe;IACxE,yCAAyC;IACzC,gBAAgB,EAAE,yBAAyB,EAAE,yBAAyB;IACtE,sBAAsB,EAAE,iBAAiB;CAC1C,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG;IAC9B,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY;IACnE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB;CACnD,CAAC;AAEF,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,IAAI,GAAG,GAAQ,GAAG,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5I,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAID,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IACpD,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAUD;;gEAEgE;AAChE,MAAM,UAAU,kBAAkB,CAChC,IAAgD,EAChD,GAAY,EACZ,QAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,4DAA4D;IAC5D,IAAI,QAAQ,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,oCAAoC,IAAI,KAAK,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,GAAG,CAAC,sBAAsB,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,CAAC,GAAG,GAAmD,CAAC;IAC9D,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;AACrF,CAAC;AAED,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,UAAiC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;IAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAsB,EAAE,EAAE;YAC5C,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAClF,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;0EAE0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAwB,EAAE;IAChE,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IACjB,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QAAE,OAAO;IAC5C,UAAU,EAAE,CAAC;IACb,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC"}

package/dist/lib/provider-identity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The host (and port) of a custom endpoint's base_url — the short identifier
+ * that actually tells two endpoints apart. Mirrors the default label
+ * convention in services/custom-endpoint.ts (`new URL(baseUrl).host`) but
+ * returns null instead of a literal when the URL is unparseable, so callers
+ * can fall back to the generic 'custom' id rather than a fake host.
+ */
+export declare function endpointHost(baseUrl: string | null | undefined): string | null;
+/**
+ * The stable provider id for an analytics row. Non-custom platforms keep their
+ * bare slug ('groq', 'openai', …) so existing filters and the platform dot
+ * coloring are untouched. Custom endpoints get 'custom:<base_url>' so two
+ * relays never collide; a custom request whose key is gone (or never had a
+ * base_url) falls back to the plain 'custom' id, preserving the pre-fix shape.
+ */
+export declare function providerIdFor(platform: string, baseUrl: string | null | undefined): string;
+/**
+ * The display name for an analytics row: the platform slug for catalog
+ * providers, and for a custom row the endpoint host plus any non-trivial path.
+ *
+ * Host alone is not an identity: a single gateway commonly fronts several
+ * endpoints ('https://gw.example.com/tenant-a/v1' and '…/tenant-b/v1'), and
+ * naming both of them 'gw.example.com' re-creates the #889 collision one level
+ * down — two rows the operator cannot tell apart. Appending the path makes the
+ * name injective on (host, path), while a bare '…/v1' endpoint still reads as
+ * the plain host it is.
+ *
+ * Derived purely from this row's base_url, like endpoint-scope's handles: the
+ * name never changes because some OTHER endpoint appeared or was deleted, so
+ * every view (by-platform, by-model, errors) agrees on what to call an
+ * endpoint even when they see different subsets of them.
+ *
+ * A null/unparseable base_url falls back to the platform, so there is always
+ * something to render.
+ */
+export declare function providerDisplayName(platform: string, baseUrl: string | null | undefined): string;
+//# sourceMappingURL=provider-identity.d.ts.map

package/dist/lib/provider-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-identity.d.ts","sourceRoot":"","sources":["../../src/lib/provider-identity.ts"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAO9E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAM1F;AA2BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC,MAAM,CAMR"}

package/dist/lib/provider-identity.js

@@ -0,0 +1,110 @@
+// ── Provider identity for analytics ─────────────────────────────────────────
+// Every custom OpenAI-compatible endpoint shares the platform id 'custom'
+// (see services/custom-endpoint.ts), so any analytics view that groups by
+// `platform` alone collapses every custom relay into a single "custom" row and
+// the operator can no longer tell which endpoint did what (#889).
+//
+// The canonical identity of a custom endpoint is the serving key's `base_url`
+// — custom-endpoint.ts already groups its credential pool by base_url, and the
+// router treats every key sharing a base_url as the same endpoint. Grouping by
+// base_url therefore splits one endpoint's pooled keys back into a single row
+// while keeping distinct endpoints apart.
+//
+// These helpers produce the stable id + display name the analytics endpoints
+// attach to each row. They are pure so they can be unit-tested without a DB —
+// module-purity.test.ts enforces that, which is also why they do not import
+// endpoint-scope.ts to normalize their input. The base_url they are handed is
+// expected to ALREADY be the normalized endpoint identity: keys.ts stores it
+// through normalizeBaseUrl(), and routes/analytics.ts re-applies the same
+// trailing-slash normalization in SQL for rows written before it did. That
+// keeps one definition of "same endpoint" (lib/endpoint-scope.ts) instead of a
+// second one hidden in here.
+/**
+ * The host (and port) of a custom endpoint's base_url — the short identifier
+ * that actually tells two endpoints apart. Mirrors the default label
+ * convention in services/custom-endpoint.ts (`new URL(baseUrl).host`) but
+ * returns null instead of a literal when the URL is unparseable, so callers
+ * can fall back to the generic 'custom' id rather than a fake host.
+ */
+export function endpointHost(baseUrl) {
+    if (!baseUrl)
+        return null;
+    try {
+        return new URL(baseUrl).host || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The stable provider id for an analytics row. Non-custom platforms keep their
+ * bare slug ('groq', 'openai', …) so existing filters and the platform dot
+ * coloring are untouched. Custom endpoints get 'custom:<base_url>' so two
+ * relays never collide; a custom request whose key is gone (or never had a
+ * base_url) falls back to the plain 'custom' id, preserving the pre-fix shape.
+ */
+export function providerIdFor(platform, baseUrl) {
+    if (platform !== 'custom')
+        return platform;
+    // The base_url IS the endpoint-scope token of #651 (see the header), so this
+    // id agrees with `models.endpoint_scope` and with the router's view of which
+    // keys are one endpoint.
+    return baseUrl ? `custom:${baseUrl}` : 'custom';
+}
+/**
+ * The part of a base_url's path that carries identity of its own — '' when the
+ * path says nothing a second endpoint on the same host would not also say.
+ *
+ * The root ('/') and a lone API-version segment ('/v1', '/v1beta', '/v2') are
+ * trivial: every relay repeats them, so including them would only add noise to
+ * the common one-endpoint-per-host case. Anything else — a tenant, a project,
+ * a mount point — is exactly what tells two endpoints on one host apart, so it
+ * is kept VERBATIM, version suffix included. Trimming the '/v1' off a kept
+ * path would make '…/tenant-a' and '…/tenant-a/v1' display the same, which is
+ * the collision this exists to prevent.
+ */
+function endpointPathLabel(baseUrl) {
+    let path;
+    try {
+        path = new URL(baseUrl).pathname.replace(/\/+$/, '');
+    }
+    catch {
+        return '';
+    }
+    if (!path)
+        return '';
+    const segments = path.slice(1).split('/');
+    if (segments.length === 1 && /^v\d+[a-z0-9._-]*$/i.test(segments[0]))
+        return '';
+    return path;
+}
+/**
+ * The display name for an analytics row: the platform slug for catalog
+ * providers, and for a custom row the endpoint host plus any non-trivial path.
+ *
+ * Host alone is not an identity: a single gateway commonly fronts several
+ * endpoints ('https://gw.example.com/tenant-a/v1' and '…/tenant-b/v1'), and
+ * naming both of them 'gw.example.com' re-creates the #889 collision one level
+ * down — two rows the operator cannot tell apart. Appending the path makes the
+ * name injective on (host, path), while a bare '…/v1' endpoint still reads as
+ * the plain host it is.
+ *
+ * Derived purely from this row's base_url, like endpoint-scope's handles: the
+ * name never changes because some OTHER endpoint appeared or was deleted, so
+ * every view (by-platform, by-model, errors) agrees on what to call an
+ * endpoint even when they see different subsets of them.
+ *
+ * A null/unparseable base_url falls back to the platform, so there is always
+ * something to render.
+ */
+export function providerDisplayName(platform, baseUrl) {
+    if (platform !== 'custom')
+        return platform;
+    if (!baseUrl)
+        return platform;
+    const host = endpointHost(baseUrl);
+    if (!host)
+        return platform;
+    return host + endpointPathLabel(baseUrl);
+}
+//# sourceMappingURL=provider-identity.js.map

package/dist/lib/provider-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-identity.js","sourceRoot":"","sources":["../../src/lib/provider-identity.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAC1E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,6BAA6B;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAkC;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAkC;IAChF,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,6EAA6E;IAC7E,6EAA6E;IAC7E,yBAAyB;IACzB,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,OAAkC;IAElC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,OAAO,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/provider-size-parser.d.ts

@@ -0,0 +1,6 @@
+export interface ProviderReportedSize {
+    tokens: number;
+    kind: 'input' | 'total';
+}
+export declare function parseProviderReportedSize(platform: string, message: string | null | undefined): ProviderReportedSize | null;
+//# sourceMappingURL=provider-size-parser.d.ts.map

package/dist/lib/provider-size-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-size-parser.d.ts","sourceRoot":"","sources":["../../src/lib/provider-size-parser.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB,GAAG,IAAI,CAQ3H"}

package/dist/lib/provider-size-parser.js

@@ -0,0 +1,72 @@
+// Pull a real token count out of a provider's 413 / context-length error body.
+//
+// The local token estimator (`text.length / 4`) undercounts tool-heavy /
+// code-heavy prompts by 3-10x: a request the estimator scores at 3,700 tokens
+// can be reported as 36,532 by Groq. Without this parser the `tpm_limit` and
+// `context_window` pre-checks in the router pass on the wrong number, the call
+// fires, and the provider 413s — burning one failover hop per model in the
+// chain instead of one hop total. This module is the single source of truth for
+// "what size did the provider say this request was": one regex per supported
+// provider, all derived from the live error corpus.
+//
+// Returns null for anything it can't pin to a real REQUESTED size (not a LIMIT
+// ceiling — see the github case below). Callers feed the result into the
+// routing estimate so the existing size gates skip low-TPM / small-context
+// models on the next attempt instead of letting them re-fail.
+//
+// Why github is intentionally NOT parsed: the body is
+// `Request body too large for gpt-4.1 model. Max size: 8000 tokens.` The 8000
+// is the LIMIT, not the rejected request's size. Returning it would cause
+// every subsequent model with TPM < 8000 to be skipped for the rest of the
+// request — wildly wrong, since most free models have TPM ~6000. The parser
+// returns null and `learnLimitFromError` keeps doing what it already does
+// (lowering `models.tpm_limit` to 8000 for github/gpt-4.1).
+// Pull the first integer out of a comma-thousands-separator-aware capture.
+// Anchored on the literal label the provider uses so a stray digit elsewhere
+// in the body can't match. Accepts a regex with one or two capture groups
+// (second group is used when the first is undefined), so cloudflare can
+// choose between input-only and combined-total via two alternations.
+function pullFirstInt(body, pattern) {
+    const m = body.match(pattern);
+    if (!m)
+        return null;
+    const raw = m[1] != null ? m[1] : m[2];
+    if (raw == null)
+        return null;
+    // Strip thousand-separator commas before parsing: "36,532" → "36532".
+    const cleaned = raw.replace(/,/g, '');
+    if (cleaned === '')
+        return null;
+    const n = Number(cleaned);
+    return Number.isFinite(n) && n > 0 ? n : null;
+}
+// One regex per provider. Each one is anchored on a literal token from a
+// real observed error body so a provider changing its wording trips the test
+// and forces a parser update — bare numbers without an anchor would happily
+// match an unrelated digit anywhere in the message.
+const PATTERNS = {
+    // "Limit 8000, Requested 36532, please reduce your message size..."
+    groq: /Requested\s+([\d,]+)/i,
+    // "...requested about 68982 tokens (4982 of text input, 64000 in the output)..."
+    openrouter: /requested\s+about\s+([\d,]+)\s+tokens/i,
+    // Prefer the INPUT-only count from a 400 ("your prompt contains at least
+    // 23745 input tokens, for a total of at least 24001 tokens"). The input-only
+    // count anchors on "contains at least N input tokens" so the larger
+    // "total of at least 24001" that immediately follows does not win.
+    // Fall back to the combined total from a 413 ("tokens (24092) exceeded
+    // this model context") via the paren-anchored alternative.
+    cloudflare: /(?:contains\s+at\s+least\s+([\d,]+)\s+input\s+tokens|tokens\s*\(([\d,]+)\s*\))/i,
+};
+export function parseProviderReportedSize(platform, message) {
+    if (typeof message !== 'string' || message === '')
+        return null;
+    const re = PATTERNS[platform];
+    if (!re)
+        return null;
+    const tokens = pullFirstInt(message, re);
+    if (tokens == null)
+        return null;
+    const inputOnly = platform === 'cloudflare' && /contains\s+at\s+least\s+[\d,]+\s+input\s+tokens/i.test(message);
+    return { tokens, kind: inputOnly ? 'input' : 'total' };
+}
+//# sourceMappingURL=provider-size-parser.js.map

package/dist/lib/provider-size-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-size-parser.js","sourceRoot":"","sources":["../../src/lib/provider-size-parser.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,EAAE;AACF,sDAAsD;AACtD,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4DAA4D;AAE5D,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,sEAAsE;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,QAAQ,GAA2B;IACvC,oEAAoE;IACpE,IAAI,EAAE,uBAAuB;IAC7B,iFAAiF;IACjF,UAAU,EAAE,wCAAwC;IACpD,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,2DAA2D;IAC3D,UAAU,EAAE,iFAAiF;CAC9F,CAAC;AAOF,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAAkC;IAC5F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,QAAQ,KAAK,YAAY,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC"}

package/dist/lib/provider-timeout.d.ts

@@ -0,0 +1,17 @@
+export declare function providerTimeoutEnvName(platform: string): string;
+/** Effective chat timeout for a platform: the PROVIDER_TIMEOUT_<PLATFORM> env
+ * override when set and valid, else the built-in default. Returns 0 to mean
+ * "no timeout" — callers must skip their abort timer for 0, never schedule
+ * setTimeout(0). */
+export declare function providerTimeoutMs(platform: string, defaultMs: number): number;
+export declare const DEFAULT_STREAM_STALL_TIMEOUT_MS = 90000;
+export declare function streamStallTimeoutEnvName(platform: string): string;
+/** Effective mid-stream inactivity timeout, 0 disables. Resolved per call so
+ * tests can vary the env. Precedence (#584): the per-platform
+ * PROVIDER_STREAM_STALL_TIMEOUT_<PLATFORM> when a platform is given and the
+ * var is set and valid, else the global PROVIDER_STREAM_STALL_TIMEOUT_MS,
+ * else the built-in 90s default. */
+export declare function streamStallTimeoutMs(platform?: string): number;
+/** Test hook: forget which malformed values have already been warned about. */
+export declare function resetTimeoutWarnings(): void;
+//# sourceMappingURL=provider-timeout.d.ts.map

package/dist/lib/provider-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-timeout.d.ts","sourceRoot":"","sources":["../../src/lib/provider-timeout.ts"],"names":[],"mappings":"AA0CA,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;oBAGoB;AACpB,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;oCAIoC;AACpC,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}