@velum-labs/routekit-gateway 0.17.3 → 0.17.4

package/dist/adapters/openai-responses-wire.d.ts

@@ -1,2 +1,39 @@
+export type ResponsesReasoningOwner = {
+    provider: string;
+    nativeModel: string;
+};
+export type ResponsesReasoningInputPolicy = {
+    mode: "drop";
+} | {
+    mode: "relay";
+} | {
+    mode: "forward";
+    owner: ResponsesReasoningOwner;
+    /** Keep the RouteKit wrapper for a later Chat-to-Responses provider bridge. */
+    unwrap?: boolean;
+};
+export type ParsedResponsesEncryptedContent = {
+    owner: ResponsesReasoningOwner;
+    ciphertext: string;
+};
+export type PreparedResponsesReasoningInput = {
+    body: unknown;
+    dropped: number;
+};
+/** Wrap provider-owned opaque reasoning without expanding the ciphertext itself. */
+export declare function wrapResponsesEncryptedContent(ciphertext: string, owner: ResponsesReasoningOwner): string;
+/** Parse a RouteKit-owned encrypted-reasoning envelope. Raw provider ciphertext is ownerless. */
+export declare function parseResponsesEncryptedContent(value: unknown): ParsedResponsesEncryptedContent | undefined;
+/**
+ * Apply the destination policy to Responses input without mutating the request.
+ * Incompatible reasoning items are removed while their assistant/tool carriers
+ * remain in the portable transcript.
+ */
+export declare function prepareResponsesReasoningInput(body: unknown, policy: ResponsesReasoningInputPolicy): PreparedResponsesReasoningInput;
+/**
+ * Add ownership to encrypted reasoning emitted by a successful native
+ * Responses call. Provider failures and unrelated response formats pass through.
+ */
+export declare function wrapResponsesReasoningResponse(response: Response, owner: ResponsesReasoningOwner): Promise<Response>;
 /** Normalize OpenAI Responses call ids without mutating the caller's request. */
 export declare function normalizeOpenAiResponsesCallIds(body: unknown): unknown;

package/dist/adapters/openai-responses-wire.js

@@ -1,6 +1,248 @@
 import { createHash } from "node:crypto";
 const OPENAI_RESPONSES_CALL_ID_MAX_LENGTH = 64;
 const NORMALIZED_CALL_ID_PREFIX = "rk_";
+const ENCRYPTED_REASONING_PREFIX = "rk1.";
+function sameOwner(left, right) {
+    return left.provider === right.provider && left.nativeModel === right.nativeModel;
+}
+/** Wrap provider-owned opaque reasoning without expanding the ciphertext itself. */
+export function wrapResponsesEncryptedContent(ciphertext, owner) {
+    if (parseResponsesEncryptedContent(ciphertext) !== undefined)
+        return ciphertext;
+    const encodedOwner = Buffer.from(JSON.stringify({ p: owner.provider, m: owner.nativeModel }), "utf8").toString("base64url");
+    return `${ENCRYPTED_REASONING_PREFIX}${encodedOwner}.${ciphertext}`;
+}
+/** Parse a RouteKit-owned encrypted-reasoning envelope. Raw provider ciphertext is ownerless. */
+export function parseResponsesEncryptedContent(value) {
+    if (typeof value !== "string" || !value.startsWith(ENCRYPTED_REASONING_PREFIX)) {
+        return undefined;
+    }
+    const separator = value.indexOf(".", ENCRYPTED_REASONING_PREFIX.length);
+    if (separator === -1)
+        return undefined;
+    const encodedOwner = value.slice(ENCRYPTED_REASONING_PREFIX.length, separator);
+    const ciphertext = value.slice(separator + 1);
+    if (encodedOwner.length === 0 || ciphertext.length === 0)
+        return undefined;
+    if (!/^[A-Za-z0-9_-]+$/.test(encodedOwner))
+        return undefined;
+    try {
+        const ownerBytes = Buffer.from(encodedOwner, "base64url");
+        if (ownerBytes.toString("base64url") !== encodedOwner)
+            return undefined;
+        const parsed = JSON.parse(ownerBytes.toString("utf8"));
+        if (parsed === null ||
+            typeof parsed !== "object" ||
+            typeof parsed.p !== "string" ||
+            parsed.p.length === 0 ||
+            typeof parsed.m !== "string" ||
+            parsed.m.length === 0) {
+            return undefined;
+        }
+        return {
+            owner: { provider: parsed.p, nativeModel: parsed.m },
+            ciphertext
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Apply the destination policy to Responses input without mutating the request.
+ * Incompatible reasoning items are removed while their assistant/tool carriers
+ * remain in the portable transcript.
+ */
+export function prepareResponsesReasoningInput(body, policy) {
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+        return { body, dropped: 0 };
+    }
+    const record = body;
+    if (!Array.isArray(record.input))
+        return { body, dropped: 0 };
+    let dropped = 0;
+    let changed = false;
+    const input = [];
+    for (const candidate of record.input) {
+        if (typeof candidate !== "object" ||
+            candidate === null ||
+            Array.isArray(candidate)) {
+            input.push(candidate);
+            continue;
+        }
+        const item = candidate;
+        if (item.type !== "reasoning" ||
+            typeof item.encrypted_content !== "string" ||
+            item.encrypted_content.length === 0) {
+            input.push(candidate);
+            continue;
+        }
+        const parsed = parseResponsesEncryptedContent(item.encrypted_content);
+        if (policy.mode === "drop") {
+            dropped += 1;
+            changed = true;
+            continue;
+        }
+        if (policy.mode === "relay") {
+            if (parsed === undefined) {
+                dropped += 1;
+                changed = true;
+                continue;
+            }
+            input.push(candidate);
+            continue;
+        }
+        if (parsed === undefined || !sameOwner(parsed.owner, policy.owner)) {
+            dropped += 1;
+            changed = true;
+            continue;
+        }
+        if (policy.unwrap === false) {
+            input.push(candidate);
+            continue;
+        }
+        input.push({ ...item, encrypted_content: parsed.ciphertext });
+        changed = true;
+    }
+    return {
+        body: changed ? { ...record, input } : body,
+        dropped
+    };
+}
+function wrapEncryptedReasoningValue(value, owner) {
+    if (Array.isArray(value)) {
+        let changed = false;
+        const items = value.map((item) => {
+            const transformed = wrapEncryptedReasoningValue(item, owner);
+            changed ||= transformed.changed;
+            return transformed.value;
+        });
+        return { value: changed ? items : value, changed };
+    }
+    if (typeof value !== "object" || value === null) {
+        return { value, changed: false };
+    }
+    const record = value;
+    let changed = false;
+    const output = {};
+    for (const [key, field] of Object.entries(record)) {
+        if (key === "encrypted_content" &&
+            record.type === "reasoning" &&
+            typeof field === "string" &&
+            field.length > 0) {
+            const wrapped = wrapResponsesEncryptedContent(field, owner);
+            output[key] = wrapped;
+            changed ||= wrapped !== field;
+            continue;
+        }
+        const transformed = wrapEncryptedReasoningValue(field, owner);
+        output[key] = transformed.value;
+        changed ||= transformed.changed;
+    }
+    return { value: changed ? output : value, changed };
+}
+function sseDataValue(line) {
+    if (line === "data")
+        return "";
+    if (!line.startsWith("data:"))
+        return undefined;
+    const value = line.slice("data:".length);
+    return value.startsWith(" ") ? value.slice(1) : value;
+}
+function wrapSseFrame(frame, delimiter, owner) {
+    const lineEnding = frame.includes("\r\n") ? "\r\n" : "\n";
+    const lines = frame.split(/\r?\n/);
+    const data = lines.flatMap((line) => {
+        const value = sseDataValue(line);
+        return value === undefined ? [] : [value];
+    });
+    if (data.length === 0 || data.join("\n") === "[DONE]") {
+        return `${frame}${delimiter}`;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(data.join("\n"));
+    }
+    catch {
+        return `${frame}${delimiter}`;
+    }
+    const transformed = wrapEncryptedReasoningValue(parsed, owner);
+    if (!transformed.changed)
+        return `${frame}${delimiter}`;
+    let emittedData = false;
+    const rewritten = lines.flatMap((line) => {
+        if (sseDataValue(line) === undefined)
+            return [line];
+        if (emittedData)
+            return [];
+        emittedData = true;
+        return [`data: ${JSON.stringify(transformed.value)}`];
+    });
+    return `${rewritten.join(lineEnding)}${delimiter}`;
+}
+function wrapResponsesReasoningSse(source, owner) {
+    const decoder = new TextDecoder();
+    const encoder = new TextEncoder();
+    let buffer = "";
+    return source.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            buffer += decoder.decode(chunk, { stream: true });
+            for (;;) {
+                const match = /\r?\n\r?\n/.exec(buffer);
+                if (match === null || match.index === undefined)
+                    break;
+                const frame = buffer.slice(0, match.index);
+                const delimiter = match[0];
+                buffer = buffer.slice(match.index + delimiter.length);
+                controller.enqueue(encoder.encode(wrapSseFrame(frame, delimiter, owner)));
+            }
+        },
+        flush(controller) {
+            buffer += decoder.decode();
+            if (buffer.length > 0)
+                controller.enqueue(encoder.encode(buffer));
+        }
+    }));
+}
+/**
+ * Add ownership to encrypted reasoning emitted by a successful native
+ * Responses call. Provider failures and unrelated response formats pass through.
+ */
+export async function wrapResponsesReasoningResponse(response, owner) {
+    if (!response.ok || response.body === null)
+        return response;
+    const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+    if (contentType.includes("text/event-stream")) {
+        const headers = new Headers(response.headers);
+        headers.delete("content-length");
+        headers.delete("content-encoding");
+        return new Response(wrapResponsesReasoningSse(response.body, owner), {
+            status: response.status,
+            statusText: response.statusText,
+            headers
+        });
+    }
+    if (!contentType.includes("json"))
+        return response;
+    let parsed;
+    try {
+        parsed = await response.clone().json();
+    }
+    catch {
+        return response;
+    }
+    const transformed = wrapEncryptedReasoningValue(parsed, owner);
+    if (!transformed.changed)
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete("content-length");
+    headers.delete("content-encoding");
+    return new Response(JSON.stringify(transformed.value), {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+    });
+}
 function normalizedCallId(callId, attempt = 0) {
     const hash = createHash("sha256").update(callId, "utf8");
     if (attempt > 0)

package/dist/adapters/responses.js

@@ -15,6 +15,7 @@
 import { randomId } from "@velum-labs/routekit-runtime";
 import { attachReasoningSelection, attachReasoningSelectionError, attachResponsesReasoningMetadata, reasoningSelectionErrorOf, hasExplicitReasoningSelection, reasoningSelectionOf, routeKitRequestValidationErrorOf, responsesReasoningMetadataOf } from "./openai-chat-wire.js";
 import { droppedField } from "./dropped.js";
+import { prepareResponsesReasoningInput, wrapResponsesReasoningResponse } from "./openai-responses-wire.js";
 import { unwrapUpstreamError } from "./upstream-error.js";
 import { openAiSseToResponses } from "./responses-stream.js";
 import { chatUsageToResponses } from "./responses-usage.js";
@@ -775,6 +776,24 @@ export function chatToResponses(openai, model, toolRegistry = EMPTY_TOOL_REGISTR
 function jsonResponse(status, value) {
     return new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json" } });
 }
+function responsesReasoningOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses) {
+    const route = backend.resolveModelRoute?.(upstreamModel);
+    return route === undefined
+        ? {
+            // The only Chat backend that reconstructs OpenAI Responses is the
+            // Codex bridge. Native Responses fall back to their protocol identity.
+            provider: !supportsNativeResponses && destinationWireShape === "openai-responses"
+                ? "codex"
+                : destinationWireShape ?? "openai-responses",
+            nativeModel: upstreamModel
+        }
+        : { provider: route.provider, nativeModel: route.nativeId };
+}
+function recordDroppedEncryptedReasoning(count) {
+    if (count > 0) {
+        droppedField("responses", "encrypted_content", "input.reasoning");
+    }
+}
 export async function handleResponses(backend, body, modelCallId, signal, backendOptions = {}) {
     const requestedModel = body.model ?? backend.defaultModel ?? "";
     const validationError = routeKitRequestValidationErrorOf(body);
@@ -829,6 +848,7 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
     const nativeResponses = backend.responses?.bind(backend);
     const supportsNativeResponses = nativeResponses !== undefined &&
         (backend.supportsResponses?.(upstreamModel) ?? true);
+    const reasoningOwner = responsesReasoningOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses);
     if (body.previous_response_id != null && !supportsNativeResponses) {
         return jsonResponse(400, {
             error: {
@@ -839,29 +859,21 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
             }
         });
     }
-    const hasEncryptedReasoning = Array.isArray(body.input) &&
-        body.input.some((item) => item.type === "reasoning" &&
-            typeof item.encrypted_content === "string" &&
-            item.encrypted_content.length > 0);
     const requestsEncryptedReasoning = Array.isArray(body.include) && body.include.includes("reasoning.encrypted_content");
     const preservesOpaqueReasoning = supportsNativeResponses ||
         destinationWireShape === "openai-responses" ||
         destinationWireShape === "routekit-envelope";
-    if (hasEncryptedReasoning && !preservesOpaqueReasoning) {
-        return jsonResponse(400, {
-            error: {
-                type: "invalid_request_error",
-                code: "unsupported_encrypted_reasoning",
-                param: "input",
-                message: `model "${requestedModel}" cannot consume OpenAI Responses encrypted reasoning`
-            }
-        });
-    }
     if (supportsNativeResponses && nativeResponses !== undefined) {
-        return nativeResponses(body, signal, {
+        const prepared = prepareResponsesReasoningInput(body, {
+            mode: "forward",
+            owner: reasoningOwner
+        });
+        recordDroppedEncryptedReasoning(prepared.dropped);
+        const response = await nativeResponses(prepared.body, signal, {
             ...backendOptions,
             modelCallId
         });
+        return wrapResponsesReasoningResponse(response, reasoningOwner);
     }
     // Server-executed web search is honored when the caller declared the tool,
     // an executor is available (a provider key exists), and no *client* tool
@@ -872,9 +884,17 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
     const executor = declaresWebSearch && !clientNameCollision ? resolveWebSearchExecutor("responses") : undefined;
     const serverTools = executor !== undefined;
     const toolRegistry = responsesToolRegistry(body, { serverTools });
-    const translatedBody = requestsEncryptedReasoning && !preservesOpaqueReasoning
+    const includeCompatibleBody = requestsEncryptedReasoning && !preservesOpaqueReasoning
         ? { ...body, include: body.include?.filter((value) => value !== "reasoning.encrypted_content") }
         : body;
+    const reasoningPolicy = destinationWireShape === "routekit-envelope"
+        ? { mode: "relay" }
+        : destinationWireShape === "openai-responses"
+            ? { mode: "forward", owner: reasoningOwner, unwrap: false }
+            : { mode: "drop" };
+    const prepared = prepareResponsesReasoningInput(includeCompatibleBody, reasoningPolicy);
+    recordDroppedEncryptedReasoning(prepared.dropped);
+    const translatedBody = prepared.body;
     let chat;
     try {
         chat = responsesToChat(translatedBody, upstreamModel, { serverTools, destinationWireShape });

package/dist/backend.d.ts

@@ -6,7 +6,7 @@
  * surface can stream straight through and the dialect adapters can consume the
  * same core without a second abstraction.
  */
-import type { ModelReasoningCapabilities, RequestAttribution } from "@velum-labs/routekit-contracts";
+import type { ModelCapabilityMetadata, ModelReasoningCapabilities, RequestAttribution } from "@velum-labs/routekit-contracts";
 export type BackendModelRoute = {
     /** Stable RouteKit catalog id (`provider/model`). */
     publicId: string;
@@ -14,6 +14,7 @@ export type BackendModelRoute = {
     nativeId: string;
     /** Configured provider that owns the model. */
     provider: string;
+    metadata?: ModelCapabilityMetadata;
     reasoning?: ModelReasoningCapabilities;
 };
 export type Backend = {
@@ -51,6 +52,8 @@ export type Backend = {
     servesModel?(model: string): boolean;
     /** Capabilities advertised for a model id. */
     capabilities?(model: string): Readonly<Record<string, string>>;
+    /** OpenRouter-compatible architecture and parameter metadata. */
+    modelMetadata?(model: string): ModelCapabilityMetadata | undefined;
     /** Structured reasoning controls advertised for a model id. */
     reasoningCapabilities?(model: string): ModelReasoningCapabilities | undefined;
     /**

package/dist/bedrock-source.js

@@ -27,6 +27,34 @@ function activeAnthropicProfile(profile, anthropicModels) {
             return id !== undefined && anthropicModels.has(id);
         });
 }
+function bedrockMetadata(model) {
+    const inputModalities = (model.inputModalities ?? []).map((value) => value.toLowerCase());
+    const outputModalities = (model.outputModalities ?? []).map((value) => value.toLowerCase());
+    const inputs = inputModalities.length > 0 ? inputModalities : ["text"];
+    const outputs = outputModalities.length > 0 ? outputModalities : ["text"];
+    return {
+        architecture: {
+            modality: `${inputs.join("+")}->${outputs.join("+")}`,
+            inputModalities: inputs,
+            outputModalities: outputs
+        },
+        supportedParameters: ["tools", "tool_choice"],
+        provenance: inputModalities.length > 0 || outputModalities.length > 0 ? "provider" : "route"
+    };
+}
+function bedrockDiscoveredModel(id, model) {
+    return {
+        id,
+        metadata: bedrockMetadata(model),
+        ...(model.responseStreamingSupported !== undefined
+            ? {
+                capabilities: {
+                    streaming: model.responseStreamingSupported ? "supported" : "unsupported"
+                }
+            }
+            : {})
+    };
+}
 function textParts(content) {
     if (typeof content === "string")
         return content;
@@ -372,19 +400,30 @@ export class BedrockProviderSource {
     async discoverModels(signal) {
         const foundation = await this.#control.send(new ListFoundationModelsCommand({ byProvider: "Anthropic" }), signal === undefined ? undefined : { abortSignal: signal });
         const foundations = (foundation.modelSummaries ?? []).filter(anthropicFoundationModel);
-        const ids = new Set(foundations.map((model) => model.modelId));
-        const discovered = new Set(ids);
+        const byId = new Map(foundations.map((model) => [model.modelId, model]));
+        const ids = new Set(byId.keys());
+        const discovered = new Map(foundations.map((model) => [
+            model.modelId,
+            bedrockDiscoveredModel(model.modelId, model)
+        ]));
         let nextToken;
         do {
             const profiles = await this.#control.send(new ListInferenceProfilesCommand({ ...(nextToken !== undefined ? { nextToken } : {}) }), signal === undefined ? undefined : { abortSignal: signal });
-            for (const profile of profiles.inferenceProfileSummaries ?? [])
-                if (activeAnthropicProfile(profile, ids))
-                    discovered.add(profile.inferenceProfileId);
+            for (const profile of profiles.inferenceProfileSummaries ?? []) {
+                if (!activeAnthropicProfile(profile, ids))
+                    continue;
+                const backingId = (profile.models ?? [])
+                    .map((model) => foundationIdFromArn(model.modelArn))
+                    .find((id) => id !== undefined && ids.has(id));
+                if (backingId !== undefined) {
+                    discovered.set(profile.inferenceProfileId, bedrockDiscoveredModel(profile.inferenceProfileId, byId.get(backingId)));
+                }
+            }
             nextToken = profiles.nextToken;
         } while (nextToken !== undefined && nextToken.length > 0);
         if (discovered.size === 0)
             throw new Error("model discovery returned no active Anthropic Bedrock models");
-        return [...discovered].map((id) => ({ id }));
+        return [...discovered.values()];
     }
     async chat(body, signal, _options) {
         let input;

package/dist/codex-model-selection.d.ts

@@ -0,0 +1,26 @@
+import { type CodexModelCandidate, type CodexStartupSelection, type ModelCapabilityMetadata, type ModelSelectionSignals } from "@velum-labs/routekit-contracts";
+export type OpenRouterModelMetadata = ModelCapabilityMetadata & Pick<ModelSelectionSignals, "createdAt">;
+export type OpenRouterModelMetadataClientOptions = {
+    fetch?: typeof fetch;
+    now?: () => number;
+    freshMs?: number;
+    staleMs?: number;
+    timeoutMs?: number;
+    baseUrl?: string;
+};
+export declare class OpenRouterModelMetadataClient {
+    #private;
+    constructor(options?: OpenRouterModelMetadataClientOptions);
+    models(signal?: AbortSignal): Promise<ReadonlyMap<string, OpenRouterModelMetadata>>;
+}
+export type ResolvedCodexStartupSelection = CodexStartupSelection & {
+    models: readonly CodexModelCandidate[];
+};
+export declare function resolveCodexStartupModel(input: {
+    models: readonly CodexModelCandidate[];
+    preferredModel?: string;
+    requestedModel?: string;
+    signal?: AbortSignal;
+}, dependencies?: {
+    openRouter?: OpenRouterModelMetadataClient;
+}): Promise<ResolvedCodexStartupSelection>;