@velum-labs/routekit-daemon 1.3.2 → 1.5.0

package/dist/internal-providers/provider-openrouter/pricing.js

@@ -0,0 +1,108 @@
+import { hashCanonicalSha256 } from "@velum-labs/routekit-contracts";
+import { Effect } from "effect";
+import { z } from "zod";
+const OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
+class OpenRouterPricingDiscoveryError extends Error {
+    _tag = "OpenRouterPricingDiscoveryError";
+}
+const decimal = z.union([z.string(), z.number()]);
+const pricingSchema = z
+    .object({
+    prompt: decimal,
+    completion: decimal,
+    input_cache_read: decimal.optional(),
+    input_cache_write: decimal.optional(),
+    overrides: z
+        .array(z
+        .object({
+        min_prompt_tokens: z.number().int().nonnegative(),
+        prompt: decimal,
+        completion: decimal,
+        input_cache_read: decimal.optional(),
+        input_cache_write: decimal.optional()
+    })
+        .passthrough())
+        .optional()
+})
+    .passthrough();
+const responseSchema = z
+    .object({
+    data: z.array(z
+        .object({
+        id: z.string().min(1),
+        pricing: pricingSchema
+    })
+        .passthrough())
+})
+    .passthrough();
+function perMillion(value) {
+    const parsed = typeof value === "number" ? value : Number(value);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        throw new Error("OpenRouter returned an invalid token price.");
+    }
+    return parsed * 1_000_000;
+}
+function rates(pricing) {
+    return {
+        inputPer1mTokens: perMillion(pricing.prompt),
+        ...(pricing.input_cache_read === undefined
+            ? {}
+            : { cachedInputReadPer1mTokens: perMillion(pricing.input_cache_read) }),
+        ...(pricing.input_cache_write === undefined
+            ? {}
+            : { cachedInputWritePer1mTokens: perMillion(pricing.input_cache_write) }),
+        outputPer1mTokens: perMillion(pricing.completion)
+    };
+}
+export function decodeOpenRouterPricing(value, retrievedAt) {
+    const parsed = responseSchema.parse(value);
+    const revision = hashCanonicalSha256(parsed.data.map(({ id, pricing }) => ({ id, pricing })));
+    return parsed.data.map(({ id, pricing }) => ({
+        key: `openrouter/${id}`,
+        subject: { provider: "openrouter", nativeModel: id },
+        currency: "USD",
+        rates: rates(pricing),
+        ...(pricing.overrides === undefined
+            ? {}
+            : {
+                overrides: pricing.overrides.map((override) => ({
+                    minimumInputTokens: override.min_prompt_tokens,
+                    rates: rates(override)
+                }))
+            }),
+        evidence: {
+            kind: "provider-catalog",
+            source: OPENROUTER_MODELS_URL,
+            revision,
+            retrievedAt
+        }
+    }));
+}
+export const openRouterPricingAdapter = {
+    source: OPENROUTER_MODELS_URL,
+    discover: ({ transport, retrievedAt, signal }) => Effect.gen(function* () {
+        const response = yield* transport(OPENROUTER_MODELS_URL, {
+            method: "GET",
+            headers: { accept: "application/json", "x-title": "RouteKit" },
+            ...(signal === undefined ? {} : { signal })
+        }, { responseMode: "buffered" });
+        if (!response.ok) {
+            return yield* Effect.fail(new OpenRouterPricingDiscoveryError(`OpenRouter pricing discovery failed with HTTP ${response.status}.`));
+        }
+        const contentLength = Number(response.headers.get("content-length"));
+        if (Number.isFinite(contentLength) && contentLength > 8 * 1024 * 1024) {
+            return yield* Effect.fail(new OpenRouterPricingDiscoveryError("OpenRouter pricing catalog exceeds the size limit."));
+        }
+        const text = yield* Effect.tryPromise({
+            try: () => response.text(),
+            catch: () => new OpenRouterPricingDiscoveryError("OpenRouter pricing catalog could not be read.")
+        });
+        if (Buffer.byteLength(text, "utf8") > 8 * 1024 * 1024) {
+            return yield* Effect.fail(new OpenRouterPricingDiscoveryError("OpenRouter pricing catalog exceeds the size limit."));
+        }
+        return yield* Effect.try({
+            try: () => decodeOpenRouterPricing(JSON.parse(text), retrievedAt),
+            catch: () => new OpenRouterPricingDiscoveryError("OpenRouter pricing catalog is invalid.")
+        });
+    })
+};

package/dist/internal-providers/provider-openrouter/test/connection.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-openrouter/test/connection.test.js

@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { calculatePKCECodeChallenge } from "oauth4webapi";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { openRouterCredentials, openRouterEnrollment } from "../connection.js";
+test("official OpenRouter SDK performs S256 code-to-key exchange without exposing the key in source config", async () => {
+    let calls = 0;
+    const context = {
+        enrollmentId: "connection", sourceId: "production", nonce: "nonce",
+        settings: {}, callbackUrl: "https://cloud.example/callback?state=nonce",
+        fetch: async (input, init) => {
+            calls += 1;
+            const request = new Request(input, init);
+            assert.equal(request.url, "https://openrouter.ai/api/v1/auth/keys");
+            const body = await request.json();
+            assert.equal(body.code, "authorization-code");
+            assert.equal(body.code_challenge_method, "S256");
+            assert.equal(await calculatePKCECodeChallenge(body.code_verifier), challenge);
+            return Response.json({ key: "secret-generated-key", user_id: null });
+        }
+    };
+    const started = await runRouteKitEffect(openRouterEnrollment.start(context, {}));
+    assert.equal(started.kind, "action");
+    if (started.kind !== "action" || started.action.kind !== "external")
+        throw new Error("Missing external action");
+    const authorize = new URL(started.action.url);
+    const challenge = authorize.searchParams.get("code_challenge");
+    assert.equal(authorize.searchParams.get("code_challenge_method"), "S256");
+    assert.equal(authorize.searchParams.get("callback_url"), context.callbackUrl);
+    assert.doesNotMatch(JSON.stringify(started.action), /verifier/);
+    const completed = await runRouteKitEffect(openRouterEnrollment.resume(context, started.state, {
+        kind: "callback", parameters: { code: "authorization-code" }
+    }));
+    assert.equal(completed.kind, "complete");
+    if (completed.kind !== "complete")
+        throw new Error("Missing connection");
+    assert.doesNotMatch(JSON.stringify(completed.connection.config), /secret-generated-key/);
+    const runtime = await runRouteKitEffect(openRouterCredentials.resolve(completed.connection.credential, { sourceId: "production" }));
+    assert.equal(runtime.environment?.ROUTEKIT_CLOUD_GRANT_OPENROUTER_KEY, "secret-generated-key");
+    assert.equal(calls, 1);
+});
+test("denial and unknown enrollment state versions do not contact OpenRouter", async () => {
+    const context = {
+        enrollmentId: "connection", sourceId: "production", nonce: "nonce", settings: {},
+        callbackUrl: "https://cloud.example/callback",
+        fetch: async () => { assert.fail("Must not exchange"); }
+    };
+    await assert.rejects(runRouteKitEffect(openRouterEnrollment.resume(context, { version: 2, data: {} }, { kind: "callback", parameters: { code: "x" } })));
+    await assert.rejects(runRouteKitEffect(openRouterEnrollment.resume(context, { version: 1, data: { verifier: "v".repeat(43) } }, { kind: "callback", parameters: { error: "access_denied" } })));
+});
+test("an ambiguous OpenRouter exchange is never retried and does not expose upstream details", async () => {
+    for (const failure of ["http", "network"]) {
+        let calls = 0;
+        const context = {
+            enrollmentId: "connection", sourceId: "production", nonce: "nonce", settings: {},
+            callbackUrl: "https://cloud.example/callback",
+            fetch: async () => {
+                calls += 1;
+                if (failure === "network")
+                    throw new Error("private-upstream-detail");
+                return Response.json({ error: { message: "private-upstream-detail", code: 500 } }, { status: 500 });
+            }
+        };
+        await assert.rejects(runRouteKitEffect(openRouterEnrollment.resume(context, { version: 1, data: { verifier: "v".repeat(43) } }, { kind: "callback", parameters: { code: "possibly-consumed-code" } })), (error) => {
+            assert.match(String(error), /authorization could not be completed/);
+            assert.doesNotMatch(String(error), /private-upstream-detail|possibly-consumed-code/);
+            return true;
+        });
+        assert.equal(calls, 1);
+    }
+});

package/dist/internal-providers/provider-openrouter/test/pricing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-openrouter/test/pricing.test.js

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { decodeOpenRouterPricing } from "../pricing.js";
+test("decodes OpenRouter token prices and long-prompt overrides", () => {
+    const quotes = decodeOpenRouterPricing({
+        data: [
+            {
+                id: "openai/gpt-6-astra",
+                pricing: {
+                    prompt: "0.00001",
+                    completion: "0.00005",
+                    input_cache_read: "0.000001",
+                    input_cache_write: "0.0000125",
+                    overrides: [
+                        {
+                            min_prompt_tokens: 272000,
+                            prompt: "0.00002",
+                            completion: "0.000075",
+                            input_cache_read: "0.000002",
+                            input_cache_write: "0.000025"
+                        }
+                    ]
+                }
+            }
+        ]
+    }, "2026-09-08T00:00:00.000Z");
+    assert.equal(quotes.length, 1);
+    assert.deepEqual(quotes[0]?.subject, {
+        provider: "openrouter",
+        nativeModel: "openai/gpt-6-astra"
+    });
+    assert.deepEqual(quotes[0]?.rates, {
+        inputPer1mTokens: 10,
+        cachedInputReadPer1mTokens: 1,
+        cachedInputWritePer1mTokens: 12.5,
+        outputPer1mTokens: 50
+    });
+    assert.deepEqual(quotes[0]?.overrides?.[0]?.rates, {
+        inputPer1mTokens: 20,
+        cachedInputReadPer1mTokens: 2,
+        cachedInputWritePer1mTokens: 25,
+        outputPer1mTokens: 75
+    });
+    assert.match(quotes[0]?.evidence.revision ?? "", /^sha256:[a-f0-9]{64}$/);
+});

package/dist/internal-providers/provider-openrouter/test/provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-openrouter/test/provider.test.js

@@ -0,0 +1,141 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { codexCompatibility } from "@velum-labs/routekit-contracts";
+import { attachAnthropicRequestMetadata, attachReasoningSelection, createConnectedProviderSource } from "@velum-labs/routekit-provider-core";
+import { runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { Effect } from "effect";
+import { openrouter } from "../index.js";
+test("OpenRouter flow resolves its stored key before the authenticated identity probe", async () => {
+    let calls = 0;
+    const source = await runRouteKitEffect(createConnectedProviderSource(openrouter, {
+        sourceId: "oauth-connection",
+        config: {
+            use: "openrouter",
+            auth: { kind: "env-bearer", env: "ROUTEKIT_CLOUD_GRANT_OPENROUTER_KEY" }
+        },
+        env: {},
+        resources: {
+            transport: (url, init) => {
+                calls++;
+                assert.equal(url, "https://openrouter.ai/api/v1/key");
+                assert.equal(new Headers(init.headers).get("authorization"), "Bearer stored-flow-key");
+                assert.equal(init.redirect, "error");
+                return Effect.succeed(Response.json({ data: { label: "RouteKit" } }));
+            }
+        }
+    }, { version: 1, kind: "api-key", payload: { key: "stored-flow-key" } }, { validate: true }));
+    assert.equal(source.sourceId, "oauth-connection");
+    assert.equal(calls, 1);
+});
+test("configured OpenRouter IDs stay fail closed without provider capability metadata", async () => {
+    const prepared = openrouter.connection.prepare({
+        sourceId: "openrouter-production",
+        methodId: "api-key",
+        values: {
+            "api-key": "openrouter-secret",
+            models: ["anthropic/claude-sonnet"]
+        }
+    });
+    const source = await runRouteKitEffect(openrouter.createSource({
+        sourceId: "openrouter-production",
+        config: prepared.config,
+        env: prepared.environment
+    }));
+    const [model] = await runRouteKitEffect(source.discovery.discoverModels());
+    assert.deepEqual(model, { id: "anthropic/claude-sonnet" });
+    assert.equal(codexCompatibility({
+        id: `openrouter-production/${model.id}`,
+        provider: "openrouter",
+        architecture: model?.metadata?.architecture,
+        supportedParameters: model?.metadata?.supportedParameters,
+        reasoning: model?.reasoning
+    }).status, "incompatible");
+});
+test("OpenRouter discovery owns the reasoning efforts for its routed models", async () => {
+    const prepared = openrouter.connection.prepare({
+        sourceId: "openrouter-production",
+        methodId: "api-key",
+        values: { "api-key": "openrouter-secret" }
+    });
+    const requests = [];
+    const source = await runRouteKitEffect(openrouter.createSource({
+        sourceId: "openrouter-production",
+        config: prepared.config,
+        env: prepared.environment,
+        resources: {
+            transport: (url) => {
+                requests.push(url);
+                return Effect.succeed(Response.json({
+                    data: [
+                        {
+                            id: "openai/gpt-5.6-sol",
+                            supported_parameters: ["reasoning", "reasoning_effort", "tools"],
+                            reasoning: {
+                                mandatory: false,
+                                default_enabled: true,
+                                supported_efforts: ["max", "xhigh", "high", "medium", "low", "none"],
+                                default_effort: "medium"
+                            }
+                        },
+                        { id: "openai/private-model" }
+                    ]
+                }));
+            }
+        }
+    }));
+    const models = await runRouteKitEffect(source.discovery.discoverModels());
+    assert.deepEqual(requests, ["https://openrouter.ai/api/v1/models"]);
+    assert.equal(models[0]?.reasoning?.status, "supported");
+    assert.equal(models[0]?.reasoning?.wireShape, "openrouter");
+    assert.equal(models[0]?.reasoning?.defaultEffort, "medium");
+    assert.deepEqual(models[0]?.reasoning?.efforts?.map((effort) => effort.id), [
+        "max", "xhigh", "high", "medium", "low", "none"
+    ]);
+    assert.equal(models[0]?.reasoning?.provenance, "provider");
+    assert.equal(models[1]?.reasoning, undefined);
+});
+test("OpenRouter egress projects native Claude reasoning as enabled or token budget", async () => {
+    const prepared = openrouter.connection.prepare({
+        sourceId: "openrouter-production",
+        methodId: "api-key",
+        values: { "api-key": "openrouter-secret", models: ["anthropic/claude-haiku-4.5"] }
+    });
+    const payloads = [];
+    const source = await runRouteKitEffect(openrouter.createSource({
+        sourceId: "openrouter-production",
+        config: prepared.config,
+        env: prepared.environment,
+        resources: {
+            transport: (_url, init) => {
+                payloads.push(JSON.parse(String(init.body)));
+                return Effect.succeed(Response.json({ choices: [] }));
+            }
+        }
+    }));
+    const capability = {
+        status: "supported",
+        adaptive: true,
+        budget: { minTokens: 1_024 },
+        wireShape: "openrouter",
+        provenance: "provider"
+    };
+    for (const selection of [
+        { mode: "adaptive" },
+        { mode: "budget", budgetTokens: 2048 }
+    ]) {
+        const body = {
+            model: "anthropic/claude-haiku-4.5",
+            messages: [{ role: "user", content: "hi" }],
+            reasoning_effort: "high"
+        };
+        attachReasoningSelection(body, selection);
+        attachAnthropicRequestMetadata(body, {
+            thinking: selection.mode === "adaptive"
+                ? { type: "adaptive" }
+                : { type: "enabled", budget_tokens: selection.budgetTokens }
+        });
+        await runRouteKitEffect(source.requests.chat(body, undefined, { reasoningCapabilities: capability }));
+    }
+    assert.deepEqual(payloads.map((body) => body.reasoning), [{ enabled: true }, { max_tokens: 2048 }]);
+    assert.ok(payloads.every((body) => body.reasoning_effort === undefined));
+});

package/dist/internal-providers/provider-openrouter/test/validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal-providers/provider-openrouter/test/validation.test.js

@@ -0,0 +1,225 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createConnectedProviderSource } from "@velum-labs/routekit-provider-core";
+import { RouteKitFailure, runRouteKitEffect } from "@velum-labs/routekit-runtime/effect";
+import { Effect, Fiber } from "effect";
+import { TestClock } from "effect/testing";
+import { openrouter } from "../index.js";
+const key = "private-openrouter-key";
+const currentKey = { data: { label: "RouteKit", limit: 0, limit_remaining: 0, usage: 42 } };
+const modelId = "vendor/private-model";
+function context(transport, configured = false) {
+    return {
+        sourceId: "team-router",
+        config: {
+            use: "openrouter",
+            auth: { kind: "env-bearer", env: "TEAM_ROUTER_KEY" },
+            ...(configured ? { options: { models: [modelId] } } : {})
+        },
+        env: { TEAM_ROUTER_KEY: key },
+        resources: { transport }
+    };
+}
+function validate(input) {
+    assert.ok(openrouter.connection.validate, "OpenRouter owns its connection validation hook");
+    return openrouter.connection.validate(input);
+}
+function safeFailure(error) {
+    assert.doesNotMatch(String(error) + JSON.stringify(error), /private-openrouter-key|upstream-secret/);
+    return true;
+}
+test("pasted and stored browser keys are probed once before either discovery or configured IDs", async () => {
+    for (const stored of [false, true]) {
+        for (const configured of [false, true]) {
+            const requests = [];
+            const input = context((url, init) => {
+                requests.push(url);
+                assert.equal(new Headers(init.headers).get("authorization"), `Bearer ${key}`);
+                if (url.endsWith("/key")) {
+                    assert.equal(init.method, "GET");
+                    assert.equal(init.redirect, "error");
+                    assert.equal(init.body, undefined);
+                    return Effect.succeed(Response.json(currentKey));
+                }
+                assert.equal(url, "https://openrouter.ai/api/v1/models");
+                return Effect.succeed(Response.json({ data: [{ id: modelId }] }));
+            }, configured);
+            if (stored) {
+                input.config = {
+                    ...input.config,
+                    auth: { kind: "env-bearer", env: "ROUTEKIT_CLOUD_GRANT_OPENROUTER_KEY" }
+                };
+                input.env = {};
+            }
+            const source = await runRouteKitEffect(createConnectedProviderSource(openrouter, input, stored ? { version: 1, kind: "api-key", payload: { key } } : undefined, { validate: true }));
+            assert.deepEqual(requests, ["https://openrouter.ai/api/v1/key"]);
+            assert.equal(source.sourceId, "team-router");
+            assert.deepEqual((await runRouteKitEffect(source.discovery.discoverModels())).map((m) => m.id), [modelId]);
+            assert.deepEqual(requests, configured
+                ? ["https://openrouter.ai/api/v1/key"]
+                : ["https://openrouter.ai/api/v1/key", "https://openrouter.ai/api/v1/models"]);
+        }
+    }
+});
+test("the hook preserves canonical and custom API prefixes without duplicating api or v1", async () => {
+    for (const [baseUrl, expected] of [
+        [undefined, "https://openrouter.ai/api/v1/key"],
+        ["https://openrouter.ai/api", "https://openrouter.ai/api/v1/key"],
+        ["https://openrouter.ai/api/v1/", "https://openrouter.ai/api/v1/key"],
+        ["https://proxy.example", "https://proxy.example/v1/key"],
+        ["https://proxy.example/v1", "https://proxy.example/v1/key"],
+        ["https://proxy.example/team/api/", "https://proxy.example/team/api/v1/key"],
+        ["https://proxy.example/team/api/v1/", "https://proxy.example/team/api/v1/key"]
+    ]) {
+        let calls = 0;
+        const input = context((url, init) => {
+            calls++;
+            assert.equal(url, expected);
+            assert.equal(init.redirect, "error");
+            assert.equal(new Headers(init.headers).get("authorization"), `Bearer ${key}`);
+            return Effect.succeed(Response.json(currentKey));
+        });
+        input.config = { ...input.config, ...(baseUrl === undefined ? {} : { baseUrl }) };
+        await runRouteKitEffect(validate(input));
+        assert.equal(calls, 1);
+    }
+});
+test("registry environment and custom authentication headers match source authentication", async () => {
+    for (const customHeader of [false, true]) {
+        const input = context((_url, init) => {
+            const headers = new Headers(init.headers);
+            assert.equal(headers.get(customHeader ? "x-proxy-key" : "authorization"), customHeader ? key : `Bearer ${key}`);
+            if (customHeader)
+                assert.equal(headers.get("authorization"), null);
+            return Effect.succeed(Response.json(currentKey));
+        });
+        input.config = {
+            use: "openrouter",
+            ...(customHeader ? {
+                baseUrl: "https://proxy.example/api",
+                auth: { kind: "env-header", env: "OPENROUTER_API_KEY", header: "x-proxy-key" }
+            } : {})
+        };
+        input.env = { OPENROUTER_API_KEY: key };
+        await runRouteKitEffect(validate(input));
+    }
+});
+test("zero, exhausted, negative remaining, and unlimited allowances still identify a valid key", async () => {
+    for (const allowance of [
+        { limit: 0, limit_remaining: 0 },
+        { limit: 10, limit_remaining: 0, usage: 10 },
+        { limit: 10, limit_remaining: -1, usage: 11 },
+        { limit: null, limit_remaining: null }
+    ]) {
+        await runRouteKitEffect(validate(context(() => Effect.succeed(Response.json({ data: { label: "RouteKit", ...allowance } })))));
+    }
+});
+test("HTTP rejections fail before discovery and discard rather than expose upstream bodies", async () => {
+    for (const configured of [false, true]) {
+        for (const status of [401, 403, 402, 429, 500, 503, 307]) {
+            let calls = 0;
+            let cancelled = false;
+            const input = context((url) => {
+                calls++;
+                assert.equal(url, "https://openrouter.ai/api/v1/key");
+                return Effect.succeed(new Response(new ReadableStream({
+                    start(controller) { controller.enqueue(new TextEncoder().encode("upstream-secret")); },
+                    cancel() { cancelled = true; }
+                }), { status, headers: { location: "https://unintended.example" } }));
+            }, configured);
+            await assert.rejects(runRouteKitEffect(createConnectedProviderSource(openrouter, input, undefined, { validate: true })), (error) => {
+                assert.match(String(error), new RegExp(`HTTP ${status} at /v1/key`));
+                return safeFailure(error);
+            });
+            assert.equal(calls, 1);
+            assert.equal(cancelled, true);
+        }
+    }
+});
+test("malformed JSON, public catalogs, empty bodies and oversized responses cannot validate", async () => {
+    for (const body of [
+        "upstream-secret", "null", "[]", "{}", '{"data":[]}',
+        '{"data":{"label":123}}', '{"data":[{"id":"public-model"}]}',
+        JSON.stringify({ data: { label: "upstream-secret".repeat(6_000) } })
+    ]) {
+        await assert.rejects(runRouteKitEffect(validate(context(() => Effect.succeed(new Response(body))))), safeFailure);
+    }
+    await assert.rejects(runRouteKitEffect(validate(context(() => Effect.succeed(new Response(null, { status: 204 }))))), safeFailure);
+});
+test("missing credentials and transport failures are sanitized and never retried", async () => {
+    const missing = context(() => { assert.fail("Missing credentials must not leave the process"); });
+    missing.env = {};
+    await assert.rejects(runRouteKitEffect(validate(missing)), safeFailure);
+    let calls = 0;
+    await assert.rejects(runRouteKitEffect(validate(context(() => {
+        calls++;
+        return Effect.fail(new RouteKitFailure({ message: `upstream-secret ${key}` }));
+    }))), safeFailure);
+    assert.equal(calls, 1);
+});
+test("streamed identity JSON handles split UTF-8 and cancels bodies that exceed the size bound", async () => {
+    const bytes = new TextEncoder().encode(JSON.stringify({ data: { label: "RouteKit 🔑" } }));
+    await runRouteKitEffect(validate(context(() => Effect.succeed(new Response(new ReadableStream({
+        start(controller) {
+            for (const byte of bytes)
+                controller.enqueue(Uint8Array.of(byte));
+            controller.close();
+        }
+    }))))));
+    let pulls = 0;
+    let cancelled = false;
+    await assert.rejects(runRouteKitEffect(validate(context(() => Effect.succeed(new Response(new ReadableStream({
+        pull(controller) {
+            pulls++;
+            controller.enqueue(new Uint8Array(4 * 1024));
+        },
+        cancel() { cancelled = true; }
+    })))))), /invalid current-key response/);
+    assert.ok(pulls <= 18, `Read ${pulls} chunks from an unbounded response`);
+    assert.equal(cancelled, true);
+});
+test("a stalled cleanup cannot hide or indefinitely delay the sanitized HTTP failure", { timeout: 2_000 }, async () => {
+    let cancelled = false;
+    await assert.rejects(runRouteKitEffect(validate(context(() => Effect.succeed(new Response(new ReadableStream({
+        cancel() {
+            cancelled = true;
+            return new Promise(() => { });
+        }
+    }), { status: 401 }))))), /HTTP 401 at \/v1\/key/);
+    assert.equal(cancelled, true);
+});
+test("the hook bounds stalled headers and bodies, cancelling owned work at its deadline", async () => {
+    for (const stage of ["headers", "body"]) {
+        let cancelled = false;
+        let markStarted;
+        const started = new Promise((resolve) => { markStarted = resolve; });
+        const transport = stage === "headers"
+            ? () => Effect.tryPromise({
+                try: (signal) => new Promise(() => {
+                    signal.addEventListener("abort", () => { cancelled = true; }, { once: true });
+                    markStarted();
+                }),
+                catch: () => new RouteKitFailure({ message: "upstream-secret" })
+            })
+            : () => Effect.succeed(new Response(new ReadableStream({
+                pull() { markStarted(); return new Promise(() => { }); },
+                cancel() { cancelled = true; }
+            }, { highWaterMark: 0 })));
+        const result = await runRouteKitEffect(Effect.gen(function* () {
+            const fiber = yield* validate(context(transport)).pipe(
+            // Cloud validates while acquiring a source; the hook must remain interruptible.
+            Effect.uninterruptible, Effect.catch((error) => Effect.succeed(error)), Effect.forkChild);
+            yield* Effect.promise(() => started);
+            yield* TestClock.adjust(10_001);
+            return yield* Fiber.join(fiber);
+        }).pipe(Effect.provide(TestClock.layer())));
+        assert.match(String(result), /exceeded its deadline/);
+        assert.equal(cancelled, true, stage);
+        safeFailure(result);
+    }
+});
+test("source creation without host validation does not introduce a probe or inference", async () => {
+    await runRouteKitEffect(createConnectedProviderSource(openrouter, context(() => {
+        assert.fail("Unvalidated source creation must not use transport");
+    }, true)));
+});

package/dist/launcher-service.d.ts

@@ -1,12 +1,8 @@
 import type { EffectRouteKitControlHandlers } from "@velum-labs/routekit-control/effect";
 type LauncherHandlers = Pick<EffectRouteKitControlHandlers, "launcher.prepare">;
-export type LauncherApplicationServiceOptions = {
+export type LauncherHandlerDependencies = {
     listModels: EffectRouteKitControlHandlers["models.list"];
 };
-/** Owns coding-tool launch preparation against the live catalog. */
-export declare class LauncherApplicationService {
-    private readonly options;
-    constructor(options: LauncherApplicationServiceOptions);
-    handlers(): LauncherHandlers;
-}
+/** Bind coding-tool launch preparation to the live catalog's handler. */
+export declare function launcherHandlers({ listModels }: LauncherHandlerDependencies): LauncherHandlers;
 export {};