@wudao-org/providers 0.0.0-stage → 0.4.21

package/dist/pricing.js

@@ -0,0 +1,70 @@
+// 借鉴弧 B1（SoL-Pi C1）— providers 的价目面：模型价格目录 schema + 缓存
+// 经济学 ratio 的自动推导。
+//
+// 立场（对 SoL-Pi 的 N7 负裁决的正面侧）：cacheWriteReadRatio 不做用户配置
+// 项、不手填常量（他们的 12.5 抄 GPT-5.6 定价）。推导链：
+//   catalog pin（registry 行的 models[].prices——用户 overlay，builtin 只有
+//   文档核实的数字才钉）> WUDAO_PRICE_<MODEL> env（CLI /cost 的既有约定，
+//   "in,out,cacheRead,cacheWrite" per-M-USD）> 保守缺省（core 的
+//   DEFAULT_CACHE_WRITE_READ_RATIO，ratioSource:"default" 类型化标注）。
+//
+// ratio 语义：重读每 token 价格 ÷ 缓存命中每 token 价格。重读价取
+// max(input, cacheWrite)：OpenAI/Anthropic 语义下 cacheWrite ≥ input（压缩后
+// 重建前缀按 write 计价）；DeepSeek 语义下无独立 write 价、重建按 miss=input
+// 计价（usageCostUsd 的 write=0 形）。cacheRead ≤ 0（免费缓存或坏行）推不出
+// 比值——回落下一档，绝不除零。
+import { DEFAULT_CACHE_WRITE_READ_RATIO } from "@wudao-org/core";
+/** registry/目录行的 fail-closed 形状校验：必需面在场且 finite ≥ 0，可选面
+ * 在场时同样。坏行拒收（fail-visible），绝不猜成 rate。 */
+export function isModelPrices(v) {
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        return false;
+    const r = v;
+    const nonNeg = (x) => typeof x === "number" && Number.isFinite(x) && x >= 0;
+    if (!nonNeg(r.inputPerM) || !nonNeg(r.cacheReadPerM))
+        return false;
+    if (r.outputPerM !== undefined && !nonNeg(r.outputPerM))
+        return false;
+    if (r.cacheWritePerM !== undefined && !nonNeg(r.cacheWritePerM))
+        return false;
+    return true;
+}
+/** 从一档价格推导 ratio。cacheRead > 0 时 = prefill/cacheRead；cacheRead = 0
+ * 且 prefill > 0（免费缓存——DeepSeek 2024 真实存在过）时幸存前缀每请求
+ * $0：归档节省为 0 而重建仍付费 → 永不经济（Infinity，窗口保护兜底）。
+ * 两档推不出（全 0 / NaN）→ undefined（回落下一档）。 */
+function ratioFrom(source) {
+    if (source.cacheReadPerM > 0) {
+        const r = Math.max(source.inputPerM, source.cacheWritePerM ?? 0) / source.cacheReadPerM;
+        return Number.isFinite(r) ? r : undefined;
+    }
+    const prefill = Math.max(source.inputPerM, source.cacheWritePerM ?? 0);
+    return prefill > 0 ? Number.POSITIVE_INFINITY : undefined;
+}
+/** ratio 可用 = 有限非负，或显式 +Infinity（免费缓存的永不经济档）。 */
+const usableRatio = (r) => r !== undefined && (Number.isFinite(r) || r === Number.POSITIVE_INFINITY) && r >= 0;
+/**
+ * 推导压缩经济学的定价事实。优先级 catalog > env > 保守缺省；每一档的来源
+ * 都类型化在 ratioSource 上（"default" = 价目未知，决策面板可见）。
+ * 纯函数。
+ */
+export function deriveCachePricing(input) {
+    const fromCatalog = ratioFrom(input.catalog ?? { inputPerM: 0, cacheReadPerM: 0 });
+    if (usableRatio(fromCatalog)) {
+        return { cacheWriteReadRatio: fromCatalog, ratioSource: "catalog" };
+    }
+    const fromEnv = ratioFrom(input.env ?? { inputPerM: 0, cacheReadPerM: 0 });
+    if (usableRatio(fromEnv)) {
+        return { cacheWriteReadRatio: fromEnv, ratioSource: "env" };
+    }
+    return { cacheWriteReadRatio: DEFAULT_CACHE_WRITE_READ_RATIO, ratioSource: "default" };
+}
+/** 在一个 effective profile 的目录里按模型名找价格 pin（精确名；目录缺该
+ * 模型 = undefined）。纯。 */
+export function catalogPricesFor(models, model) {
+    if (models === undefined)
+        return undefined;
+    const entry = models.find((m) => m.name === model);
+    return entry?.prices;
+}
+//# sourceMappingURL=pricing.js.map

package/dist/pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,mBAAmB;AACnB,EAAE;AACF,uDAAuD;AACvD,sCAAsC;AACtC,mEAAmE;AACnE,yDAAyD;AACzD,0DAA0D;AAC1D,iEAAiE;AACjE,EAAE;AACF,8CAA8C;AAC9C,qEAAqE;AACrE,yDAAyD;AACzD,yDAAyD;AACzD,kBAAkB;AAClB,OAAO,EAAE,8BAA8B,EAAqB,MAAM,iBAAiB,CAAC;AAcpF;yCACyC;AACzC,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;yCAGyC;AACzC,SAAS,SAAS,CAAC,MAAmB;IACpC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QACxF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,iDAAiD;AACjD,MAAM,WAAW,GAAG,CAAC,CAAqB,EAAe,EAAE,CACzD,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC;AAED;wBACwB;AACxB,MAAM,UAAU,gBAAgB,CAC9B,MAAuF,EACvF,KAAa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,MAAM,CAAC;AACvB,CAAC"}

package/dist/quota-park.d.ts

@@ -0,0 +1,53 @@
+/** The account/window-level usage-cap body vocabulary. Deliberately does NOT
+ *  include bare "limit" — the context-length family ("maximum context
+ *  length", "context_limit") shares the word, and those classify one branch
+ *  earlier at the HTTP boundary (isContextLengthFailure) with disjoint
+ *  statuses (413/400/500 vs this module's 429); pinning the vocabulary tight
+ *  keeps the two families disjoint even if the ordering ever moves. */
+export declare const QUOTA_BODY_SIGNATURES: readonly RegExp[];
+/** True when a 429 body carries a known account-quota signature. */
+export declare function sniffQuotaBody(body: string): boolean;
+/** Parse the provider's reset moment out of a 429 body (and, as the last
+ *  resort, the already-parsed Retry-After header wait). Sources, first match
+ *  wins: the Chinese absolute wording, the English absolute wording, a body
+ *  `reset-after` seconds figure, the Retry-After header. Fail-closed:
+ *  unparseable/past instants and non-positive header waits yield undefined
+ *  (a past instant is the server's "already reset" — not park material; the
+ *  ordinary ladder path owns it). */
+export declare function parseQuotaResetAt(body: string, retryAfterMs?: number, now?: number): Date | undefined;
+/** True iff the (status, body, deadline) triple is an account-level quota
+ *  window past the 60s fail cap — the park candidate. All four gates must
+ *  hold: HTTP 429, the quota vocabulary, a parseable reset moment, and a wait
+ *  strictly beyond RETRY_AFTER_FAIL_CAP_MS (exactly-at-cap stays with the
+ *  ladder — the existing `>` comparison). Everything else keeps today's
+ *  semantics byte-for-byte. */
+export declare function isQuotaParkFailure(status: number, body: string, retryAfterMs?: number, now?: number): boolean;
+/** The typed account-quota failure (113-B3). Carries the parsed reset moment
+ *  and the failing leg's provider identity — the CLI driver parks the run
+ *  until resetAt (+margin) and schedules a one-shot wake. Message keeps a
+ *  NON-transport prefix (`provider quota reached:` — deliberately not
+ *  `provider (request|stream) failed: <status>`, so no message-regex consumer
+ *  can misread it as a retryable status), and the name check in
+ *  isRetryableProviderError makes the ladder's skip explicit regardless. */
+export declare class QuotaParkError extends Error {
+    readonly status: number;
+    readonly body: string;
+    /** The parsed reset instant (see parseQuotaResetAt). */
+    readonly resetAt: Date;
+    /** v7 γ4 family: the failing leg's provider identity (registry id, or the
+     *  baseURL host when the config carries no registry identity). */
+    readonly provider: string;
+    /** The failing leg's model id (the fallback chain swaps it — identity names
+     *  the LEG). Omitted when unknown (omit-never-null). */
+    readonly model?: string;
+    constructor(which: "request" | "stream", status: number, body: string, resetAt: Date, provider: string, model?: string);
+}
+/** Classify at the HTTP boundary: build the typed QuotaParkError when the
+ *  (status, body, deadline) triple is a park candidate, undefined otherwise
+ *  (the caller falls through to the generic ProviderHttpError — today's
+ *  semantics). */
+export declare function tryQuotaParkError(which: "request" | "stream", status: number, body: string, retryAfterMs: number | undefined, identity: {
+    readonly provider?: string;
+    readonly model?: string;
+}, now?: number): QuotaParkError | undefined;
+//# sourceMappingURL=quota-park.d.ts.map

package/dist/quota-park.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-park.d.ts","sourceRoot":"","sources":["../src/quota-park.ts"],"names":[],"mappings":"AAqBA;;;;;uEAKuE;AACvE,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EASlD,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAoBD;;;;;;qCAMqC;AACrC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,GAAG,SAAS,CAkBjH;AAED;;;;;+BAK+B;AAC/B,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAKT;AAED;;;;;;4EAM4E;AAC5E,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB;sEACkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;4DACwD;IACxD,SAAiB,KAAK,CAAC,EAAE,MAAM,CAAC;gBAG9B,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM;CAajB;AAED;;;kBAGkB;AAClB,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,GAAG,QAAQ,EAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACjE,GAAG,GAAE,MAAmB,GACvB,cAAc,GAAG,SAAS,CAW5B"}

package/dist/quota-park.js

@@ -0,0 +1,135 @@
+// 113-B3（prime-agent #2375 形 + 超越点）— 账户级配额 429 的识别与类型化
+// 停摆错误。
+//
+// 马拉松三次实证的问题形态：glm-5.3 账户级配额 429，错误体自带重置时刻——
+//   429 [1308][已达到 5 小时的使用上限。您的限额将在 2026-09-24 05:30:32 重置。]
+// 在位者（r1a Task 4）的裁决：Retry-After/等待 >60s 帽=硬停直接抛错。小时级
+// 配额窗下这个"硬停"就是"整 run 报废"——基准马拉松里烧穿了两批任务。本模块
+// 只把这一类错从"匿名硬停"升级为带 resetAt 的类型化 QuotaParkError：识别在
+// HTTP 边界（与 ContextLengthError/MandatoryReasoning 同位、在通用
+// ProviderHttpError 之前），梯子不重试它（isRetryableProviderError 的 name
+// 判）、fallback 链不换腿（账户级配额是 provider 域，换模型烧的还是同一账
+// 户），上层的 CLI 驱动据 resetAt 停摆 run 并排一次性唤醒。
+//
+// 语义红线：不改 60s 帽语义。≤60s 的配额等待（Retry-After 短、或重置时刻
+// 30s 后就到）不分类——仍走既有梯子路径（Retry-After 精确等待，429 可重
+// 试）；无重置信息的普通 429 不误判——仍是 ProviderHttpError。只有"429 +
+// 配额词表 + 可解析的重置时刻 + 距今 >60s"四条全中才升级。纯函数模块（只
+// 依赖 retry-after 的帽常量，无环），永不触碰请求序列化（前缀缓存字节稳定）。
+import { RETRY_AFTER_FAIL_CAP_MS } from "./retry-after.js";
+/** The account/window-level usage-cap body vocabulary. Deliberately does NOT
+ *  include bare "limit" — the context-length family ("maximum context
+ *  length", "context_limit") shares the word, and those classify one branch
+ *  earlier at the HTTP boundary (isContextLengthFailure) with disjoint
+ *  statuses (413/400/500 vs this module's 429); pinning the vocabulary tight
+ *  keeps the two families disjoint even if the ordering ever moves. */
+export const QUOTA_BODY_SIGNATURES = [
+    /使用上限/, // glm/bigmodel 1308：已达到 5 小时的使用上限
+    /用量上限/,
+    /已达到.{0,12}上限/,
+    /限额将在/, // …您的限额将在 <时刻> 重置
+    /配额/,
+    /\bquota\b/i,
+    /usage\s+limit/i,
+    /rate\s*limit/i,
+];
+/** True when a 429 body carries a known account-quota signature. */
+export function sniffQuotaBody(body) {
+    return QUOTA_BODY_SIGNATURES.some((re) => re.test(body));
+}
+/** The Chinese absolute reset wording: `将在 2026-09-24 05:30:32 重置`（本
+ *  地墙钟——服务中文错误体的网关按用户所在时区报时；`new Date("…T…")` 无
+ *  时区标记即按本地解析，正是这个语义）。秒可省。 */
+const CN_RESET_RE = /(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}(?::\d{2})?)\s*重置/;
+/** The English absolute wording: `resets at 2026-09-24T05:30:32Z` / `will
+ *  reset on 2026-09-24 05:30:32`（带时区标记则尊重，缺省同中文款按本地）。 */
+const EN_RESET_RE = /reset(?:s|ting)?\s+(?:at|on)\s+(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}(?::\d{2})?)\s*(Z|UTC|[+-]\d{2}:?\d{2})?/i;
+/** Body-relative reset seconds: `Reset-After: 3600` / `"reset_after": 3600`
+ *  （JSON 或散文形，纯秒数——分/时单位的散文不猜，trusted-parse-only）。 */
+const RESET_AFTER_BODY_RE = /reset[-_ ]?after["']?\s*[:=]\s*"?(\d{1,8})"?/i;
+function parseWallClock(date, time, zone) {
+    const at = Date.parse(zone !== undefined ? `${date}T${time}${zone === "UTC" ? "Z" : zone}` : `${date}T${time}`);
+    return Number.isFinite(at) ? new Date(at) : undefined;
+}
+/** Parse the provider's reset moment out of a 429 body (and, as the last
+ *  resort, the already-parsed Retry-After header wait). Sources, first match
+ *  wins: the Chinese absolute wording, the English absolute wording, a body
+ *  `reset-after` seconds figure, the Retry-After header. Fail-closed:
+ *  unparseable/past instants and non-positive header waits yield undefined
+ *  (a past instant is the server's "already reset" — not park material; the
+ *  ordinary ladder path owns it). */
+export function parseQuotaResetAt(body, retryAfterMs, now = Date.now()) {
+    const cn = CN_RESET_RE.exec(body);
+    if (cn !== null) {
+        const at = parseWallClock(cn[1], cn[2], undefined);
+        if (at !== undefined && at.getTime() > now)
+            return at;
+    }
+    const en = EN_RESET_RE.exec(body);
+    if (en !== null) {
+        const at = parseWallClock(en[1], en[2], en[3]);
+        if (at !== undefined && at.getTime() > now)
+            return at;
+    }
+    const rel = RESET_AFTER_BODY_RE.exec(body);
+    if (rel !== null) {
+        const seconds = Number(rel[1]);
+        if (Number.isFinite(seconds) && seconds > 0)
+            return new Date(now + seconds * 1000);
+    }
+    if (retryAfterMs !== undefined && retryAfterMs > 0)
+        return new Date(now + retryAfterMs);
+    return undefined;
+}
+/** True iff the (status, body, deadline) triple is an account-level quota
+ *  window past the 60s fail cap — the park candidate. All four gates must
+ *  hold: HTTP 429, the quota vocabulary, a parseable reset moment, and a wait
+ *  strictly beyond RETRY_AFTER_FAIL_CAP_MS (exactly-at-cap stays with the
+ *  ladder — the existing `>` comparison). Everything else keeps today's
+ *  semantics byte-for-byte. */
+export function isQuotaParkFailure(status, body, retryAfterMs, now = Date.now()) {
+    if (status !== 429)
+        return false;
+    if (!sniffQuotaBody(body))
+        return false;
+    const resetAt = parseQuotaResetAt(body, retryAfterMs, now);
+    return resetAt !== undefined && resetAt.getTime() - now > RETRY_AFTER_FAIL_CAP_MS;
+}
+/** The typed account-quota failure (113-B3). Carries the parsed reset moment
+ *  and the failing leg's provider identity — the CLI driver parks the run
+ *  until resetAt (+margin) and schedules a one-shot wake. Message keeps a
+ *  NON-transport prefix (`provider quota reached:` — deliberately not
+ *  `provider (request|stream) failed: <status>`, so no message-regex consumer
+ *  can misread it as a retryable status), and the name check in
+ *  isRetryableProviderError makes the ladder's skip explicit regardless. */
+export class QuotaParkError extends Error {
+    status;
+    body;
+    /** The parsed reset instant (see parseQuotaResetAt). */
+    resetAt;
+    /** v7 γ4 family: the failing leg's provider identity (registry id, or the
+     *  baseURL host when the config carries no registry identity). */
+    provider;
+    constructor(which, status, body, resetAt, provider, model) {
+        const tail = model !== undefined && model !== "" ? `/${model}` : "";
+        super(`provider quota reached: ${status} ${body} — account usage cap, window resets at ${resetAt.toISOString()} (provider ${provider}${tail}); run parked until reset`);
+        this.name = "QuotaParkError";
+        this.status = status;
+        this.body = body;
+        this.resetAt = resetAt;
+        this.provider = provider;
+        if (model !== undefined && model !== "")
+            this.model = model;
+    }
+}
+/** Classify at the HTTP boundary: build the typed QuotaParkError when the
+ *  (status, body, deadline) triple is a park candidate, undefined otherwise
+ *  (the caller falls through to the generic ProviderHttpError — today's
+ *  semantics). */
+export function tryQuotaParkError(which, status, body, retryAfterMs, identity, now = Date.now()) {
+    if (!isQuotaParkFailure(status, body, retryAfterMs, now))
+        return undefined;
+    const resetAt = parseQuotaResetAt(body, retryAfterMs, now);
+    return new QuotaParkError(which, status, body, resetAt, identity.provider !== undefined && identity.provider !== "" ? identity.provider : "unknown", identity.model);
+}
+//# sourceMappingURL=quota-park.js.map

package/dist/quota-park.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-park.js","sourceRoot":"","sources":["../src/quota-park.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,QAAQ;AACR,EAAE;AACF,6CAA6C;AAC7C,6DAA6D;AAC7D,sDAAsD;AACtD,4CAA4C;AAC5C,oDAAoD;AACpD,yDAAyD;AACzD,+DAA+D;AAC/D,gDAAgD;AAChD,yCAAyC;AACzC,EAAE;AACF,iDAAiD;AACjD,gDAAgD;AAChD,qDAAqD;AACrD,4CAA4C;AAC5C,+CAA+C;AAE/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;uEAKuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM,EAAE,kCAAkC;IAC1C,MAAM;IACN,cAAc;IACd,MAAM,EAAE,kBAAkB;IAC1B,IAAI;IACJ,YAAY;IACZ,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;8BAE8B;AAC9B,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAE3E;yDACyD;AACzD,MAAM,WAAW,GAAG,6GAA6G,CAAC;AAElI;sDACsD;AACtD,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,IAAwB;IAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED;;;;;;qCAMqC;AACrC,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,YAAqB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC7F,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,CAAW,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG;YAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG;YAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;+BAK+B;AAC/B,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY,EACZ,YAAqB,EACrB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,uBAAuB,CAAC;AACpF,CAAC;AAED;;;;;;4EAM4E;AAC5E,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,wDAAwD;IAC/C,OAAO,CAAO;IACvB;sEACkE;IACzD,QAAQ,CAAS;IAK1B,YACE,KAA2B,EAC3B,MAAc,EACd,IAAY,EACZ,OAAa,EACb,QAAgB,EAChB,KAAc;QAEd,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,CACH,2BAA2B,MAAM,IAAI,IAAI,0CAA0C,OAAO,CAAC,WAAW,EAAE,cAAc,QAAQ,GAAG,IAAI,2BAA2B,CACjK,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9D,CAAC;CACF;AAED;;;kBAGkB;AAClB,MAAM,UAAU,iBAAiB,CAC/B,KAA2B,EAC3B,MAAc,EACd,IAAY,EACZ,YAAgC,EAChC,QAAiE,EACjE,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAS,CAAC;IACnE,OAAO,IAAI,cAAc,CACvB,KAAK,EACL,MAAM,EACN,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC3F,QAAQ,CAAC,KAAK,CACf,CAAC;AACJ,CAAC"}

package/dist/rate-pause.d.ts

@@ -0,0 +1,28 @@
+/** Slice ceiling for the sliced re-check loop (CodeWhale C1's 250ms). */
+export declare const RATE_PAUSE_SLICE_MS = 250;
+/** Default pause when a 429 carries no Retry-After — the key pool's rate
+ *  class cooldown (60s), so the provider dimension and the key dimension
+ *  agree on how long a rate signal lasts. */
+export declare const DEFAULT_RATE_PAUSE_MS = 60000;
+export interface RatePauseWindow {
+    /** Wait out any active pause in ≤250ms slices; an abort signal breaks the
+     *  loop with AbortError (the ladder never retries aborts — the caller's
+     *  cancel survives the pause). No-op when idle. */
+    wait(signal?: AbortSignal): Promise<void>;
+    /** Extend the pause deadline (never shorten; clamped to the trust cap). */
+    trip(pauseMs: number): void;
+    /** A successful response proves the pause stale — reset to idle. */
+    clear(): void;
+    /** Current deadline in epoch ms; 0 when idle (assertions/observability). */
+    until(): number;
+}
+export interface RatePauseOptions {
+    /** Injectable clock (tests); default Date.now. */
+    readonly now?: () => number;
+    /** Injectable sleep (tests); default setTimeout-based. */
+    readonly sleep?: (ms: number) => Promise<void>;
+    /** Slice ceiling for wait(); default RATE_PAUSE_SLICE_MS. */
+    readonly sliceMs?: number;
+}
+export declare function createRatePauseWindow(options?: RatePauseOptions): RatePauseWindow;
+//# sourceMappingURL=rate-pause.d.ts.map

package/dist/rate-pause.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-pause.d.ts","sourceRoot":"","sources":["../src/rate-pause.ts"],"names":[],"mappings":"AAgCA,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;6CAE6C;AAC7C,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B;;uDAEmD;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oEAAoE;IACpE,KAAK,IAAI,IAAI,CAAC;IACd,4EAA4E;IAC5E,KAAK,IAAI,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gBAAqB,GAAG,eAAe,CA+BrF"}

package/dist/rate-pause.js

@@ -0,0 +1,72 @@
+// 波次 7 #37 (CodeWhale C1): the provider-level 429 pause window.
+//
+// The M56 key pool already handles the KEY dimension of a 429 — the limited
+// key cools for every request through the shared pool. What it cannot handle
+// is the PROVIDER dimension under concurrency: with a single key (or every
+// key cooling), each concurrent request still enters its OWN retry ladder and
+// hammers a provider that just said "stop" — under subagent fanout, N
+// requests burn N ladders against the same rate limit (the self-harm CodeWhale
+//'s C1 exists for). The window closes that gap:
+//
+//   trip()   — called at the HTTP boundary the moment a 429 arrives while the
+//              key pool has no healthy spare to rotate to (single-key, or all
+//              cooling). Deadline = the response's Retry-After when present,
+//              else the 60s rate-class default; never above the ladder's
+//              Retry-After trust cap, and never SHORTER than an existing
+//              deadline.
+//   wait()   — the leg entry gate, before every generate/stream call. While a
+//              pause is active the caller re-checks the clock in ≤250ms
+//              slices (CodeWhale's sliced re-check) and fires its first HTTP
+//              attempt only after the window lapses. The originator's own
+//              ladder retries are NOT gated (they sit INSIDE one leg call): a
+//              transient 429 still recovers on its normal backoff — today's
+//              behavior, byte-for-byte.
+//   clear()  — any 2xx proves the pause stale (the blip recovered); the next
+//              concurrent request enters immediately.
+//
+// The window is created once per provider factory closure (keyPool topology)
+// and injectable whole through ProviderOptions.ratePauseWindow — tests drive
+// it with a fake clock/sleep pair, embedders can share one window across
+// protocol factories behind a single endpoint.
+import { RETRY_AFTER_FAIL_CAP_MS } from "./retry-after.js";
+/** Slice ceiling for the sliced re-check loop (CodeWhale C1's 250ms). */
+export const RATE_PAUSE_SLICE_MS = 250;
+/** Default pause when a 429 carries no Retry-After — the key pool's rate
+ *  class cooldown (60s), so the provider dimension and the key dimension
+ *  agree on how long a rate signal lasts. */
+export const DEFAULT_RATE_PAUSE_MS = 60_000;
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function createRatePauseWindow(options = {}) {
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? defaultSleep;
+    const sliceMs = options.sliceMs ?? RATE_PAUSE_SLICE_MS;
+    let deadline = 0;
+    const aborted = (signal) => {
+        const err = new Error("aborted while waiting out the provider rate pause");
+        err.name = "AbortError";
+        return err;
+    };
+    return {
+        async wait(signal) {
+            while (deadline > now()) {
+                if (signal?.aborted === true)
+                    throw aborted(signal);
+                const remaining = deadline - now();
+                await sleep(Math.min(sliceMs, remaining));
+            }
+        },
+        trip(pauseMs) {
+            const clamped = Math.max(0, Math.min(pauseMs, RETRY_AFTER_FAIL_CAP_MS));
+            deadline = Math.max(deadline, now() + clamped);
+        },
+        clear() {
+            deadline = 0;
+        },
+        until() {
+            return deadline;
+        },
+    };
+}
+//# sourceMappingURL=rate-pause.js.map

package/dist/rate-pause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-pause.js","sourceRoot":"","sources":["../src/rate-pause.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,sEAAsE;AACtE,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,yBAAyB;AACzB,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AACxC,6EAA6E;AAC7E,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,+CAA+C;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;6CAE6C;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAwB5C,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAA4B,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACvD,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,CAAC,MAAmB,EAAS,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3E,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAoB;YAC7B,OAAO,QAAQ,GAAG,GAAG,EAAE,EAAE,CAAC;gBACxB,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpD,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;gBACnC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAe;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC;YACxE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,KAAK;YACH,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;QACD,KAAK;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,142 @@
+import type { ProviderProfile, ReasoningEffort, ReasoningFormat, WindowMode } from "./config.js";
+import type { ProtocolId } from "./persona/types.js";
+import { type ModelPrices } from "./pricing.js";
+/** One catalog entry: a model name plus its optional context window and
+ *  (借鉴弧 B1) its optional doc-verified prices — the catalog face the cache
+ *  economics ratio derives from. A pin exists ONLY where the number comes
+ *  from the provider's own docs (same policy as contextLength). */
+export interface ProviderModelEntry {
+    readonly name: string;
+    readonly contextLength?: number;
+    readonly prices?: ModelPrices;
+}
+/** The user-facing slice of a profile (registry file shape). Every field is
+ *  optional; unknown fields are ignored for forward compatibility. */
+export interface UserProviderConfig {
+    readonly label?: string;
+    readonly baseUrl?: string;
+    readonly defaultModel?: string;
+    readonly reasoningFormat?: ReasoningFormat;
+    readonly windowMode?: WindowMode;
+    readonly defaultContextLength?: number;
+    readonly models?: readonly ProviderModelEntry[];
+    readonly thinkingLevelMap?: ProviderProfile["thinkingLevelMap"];
+    readonly supportsReasoningEffort?: boolean;
+    readonly acceptsReasoningOnlyFinish?: boolean;
+    readonly requiresBaseUrl?: boolean;
+    /** SDD 2026-08-23 persona Task 4 — the per-provider persona binding, a
+     *  THREE-STATE column (spec §2): key absent = follow the global default;
+     *  a non-empty string = bound persona id; explicit null = forced none.
+     *  Deliberately NOT part of EffectiveProfile — it is binding-chain data
+     *  (read by the CLI's readProviderPersonaBinding), never a profile fact,
+     *  so the effectiveProfiles merge never touches it. */
+    readonly persona?: string | null;
+    /** SDD 2026-08-24 reg-headers Task 1 (92 §3.4-1); ω99-64 on the wire —
+     *  per-provider extra request headers (the enterprise-gateway baseline).
+     *  CONTROLLER RULING (ω99-64): the old "deliberately never an
+     *  EffectiveProfile fact" stance is REVERSED. Unlike `persona` (binding-
+     *  chain data with its own lifecycle, still profile-external), headers are
+     *  a TRANSPORT-LAYER fact of the endpoint — the same class as baseUrl /
+     *  wire / balanceUrl (gateway-fronting facts). They fold through the
+     *  effectiveProfiles overlay merge (overlay-beats-builtin for free) and
+     *  ride to request construction as ProviderConfig.extraHeaders, spread
+     *  behind adapter auth and ahead of persona wire.headers. FORBIDDEN keys
+     *  (auth/transport-control, single source persona/schema) refuse the row
+     *  at save AND load — a registry row can structurally never override the
+     *  adapter's credentials or transport headers. */
+    readonly headers?: Readonly<Record<string, string>>;
+    /** 0.3.13 (#215, user trial feedback): the PROTOCOL this row speaks —
+     *  "openai-chat" | "anthropic" | "responses". Absent = the dispatch
+     *  default (openai-chat), byte-identical to the historical shape. Unlike
+     *  persona/headers this IS a profile fact: the effectiveProfiles merge
+     *  folds it into EffectiveProfile.wire, where resolveProviderConfigResult
+     *  already consults it (selection.wire > env > profile.wire) — so a
+     *  custom Anthropic-protocol provider needs NO WUDAO_WIRE once saved. */
+    readonly wire?: ProtocolId;
+    /** P0-4 (96 队列): the row's wallet-balance endpoint. A profile fact like
+     *  wire: an explicit overlay value beats the builtin's compiled-in pin,
+     *  and a custom's own value rides through — the /cost all wallet face
+     *  resolves it from the effective profile view. */
+    readonly balanceUrl?: string;
+    /** 2026-08-28 推理档三级配置 S1 — the per-provider reasoning-effort
+     *  binding, a THREE-STATE column mirroring `persona`: key absent = follow
+     *  the global default (model.defaultEffort); a string = bound level (a
+     *  REASONING_EFFORTS member); explicit null = don't send the param at all
+     *  (distinct from the literal "none" level, which IS a wire value). Like
+     *  persona, deliberately never an EffectiveProfile fact — the CLI's
+     *  effort resolution chain reads it (readProviderEffortBinding). */
+    readonly effort?: string | null;
+    /** ω99-245: #5 — the capability-catalog OVERRIDE column: what THIS
+     *  endpoint accepts, wholesale-replacing the compiled-in family set (and
+     *  its model pins) in supportedEfforts. The user's escape hatch for a new
+     *  model or an outdated catalog pin — fail-closed but never bricked. A
+     *  non-empty array of REASONING_EFFORTS members (validated fail-visibly:
+     *  junk must never silently widen the gate). Unlike `effort` above this IS
+     *  an EffectiveProfile fact (like headers/wire), read through the
+     *  effective view. */
+    readonly efforts?: readonly ReasoningEffort[];
+}
+/** The registry file: version-gated from v1, malformed files load as empty. */
+export interface ProviderRegistryFile {
+    readonly version: 1;
+    readonly providers: Record<string, UserProviderConfig>;
+}
+/** A load outcome: the entries that validated, plus one row per entry that
+ *  did not (fail-visible — the UI lists them; boot never blocks on them). */
+export interface RegistryLoadResult {
+    readonly entries: ReadonlyMap<string, UserProviderConfig>;
+    readonly invalid: readonly {
+        id: string;
+        reason: string;
+    }[];
+}
+/** A ProviderProfile extended with the registry-only facts: the per-model
+ *  catalog (empty for builtins unless an overlay supplies one — the builtin
+ *  defaultModel never joins it), the provider-level context-window default,
+ *  whether the id is user-registered (custom) or compiled in, and (ω99-245)
+ *  the optional capability-catalog override the effort preflight reads. */
+export type EffectiveProfile = ProviderProfile & {
+    readonly models: readonly ProviderModelEntry[];
+    readonly defaultContextLength?: number;
+    readonly custom: boolean;
+    /** The supported-efforts override (see UserProviderConfig.efforts).
+     *  Absent on every builtin; present exactly when a registry row declares it. */
+    readonly efforts?: readonly ReasoningEffort[];
+};
+/** Where the registry lives. Mirrors the CLI's global-home resolution so
+ *  tests/CI isolate the whole ~/.wudao tier with one env var. */
+export declare function defaultProviderRegistryPath(env?: NodeJS.ProcessEnv): string;
+/** Validate one registry entry. Returns the SANITIZED config (unknown fields
+ *  dropped) or the reason it was refused. A builtin id may overlay without a
+ *  baseUrl; a custom id must carry one — it IS the provider. */
+export declare function validateUserProviderEntry(id: string, cfg: unknown): {
+    ok: true;
+    value: UserProviderConfig;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Read + validate the registry. Fault-tolerant by contract: a missing file
+ *  is an empty registry; a malformed file (bad JSON, wrong version, wrong
+ *  shape) demotes to empty entries with ONE file-level invalid row; a bad
+ *  ENTRY costs only that entry. Never throws. */
+export declare function readProviderRegistrySync(path?: string): RegistryLoadResult;
+/** Atomically write the registry (tmp + rename, 0600 — same shape as the
+ *  global settings writer). Creates the parent directory when missing. */
+export declare function writeProviderRegistrySync(path: string, file: ProviderRegistryFile): void;
+/** Merge validated user entries onto the compiled-in profiles:
+ *  - builtin ids always present; an entry for one overlays field-by-field
+ *    (`overlay ?? base`, the FULL profile surface — reasoning fields included);
+ *  - other ids become customs (requiresBaseUrl pinned true; the entry's
+ *    baseUrl becomes defaultBaseUrl; reasoningFormat defaults to "none").
+ *  `models` on an overlay REPLACES the builtin catalog wholesale (the
+ *  builtins' own doc-verified context pins included); the builtin
+ *  defaultModel never joins it. A custom entry without a baseUrl
+ *  is defensively skipped — read-time validation is what reports it. */
+export declare function effectiveProfiles(userEntries: ReadonlyMap<string, UserProviderConfig>): ReadonlyMap<string, EffectiveProfile>;
+/** The context-window resolution chain (§7): the model's registered
+ *  contextLength, else the provider's default, else the caller-supplied env
+ *  value (already resolved: WUDAO_CONTEXT_WINDOW ?? 200_000). Pure — no fs, no
+ *  env reads of its own. */
+export declare function resolveContextWindowTokens(profiles: ReadonlyMap<string, EffectiveProfile>, providerId: string, model: string, envValue: number): number;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAuB,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAU/D;;;mEAGmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;sEACsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;2DAKuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;;;;;;;;;sDAYkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;;;;6EAMyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B;;;uDAGmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;wEAMoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;;;0BAOsB;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACxD;AAED;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7D;AAED;;;;2EAI2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;oFACgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C,CAAC;AAEF;iEACiE;AACjE,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIxF;AAWD;;gEAEgE;AAChE,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CA2OzE;AAED;;;iDAGiD;AACjD,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,MAAsC,GAAG,kBAAkB,CAoCzG;AAED;0EAC0E;AAC1E,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAKxF;AA8BD;;;;;;;;wEAQwE;AACxE,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACnD,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CA0FvC;AAED;;;4BAG4B;AAC5B,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC/C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,MAAM,CAYR"}