@wudao-org/providers 0.0.0-stage → 0.4.21

package/dist/index.js

@@ -0,0 +1,110 @@
+// @wudao-org/providers — concrete ModelClient adapters. Depends on @wudao-org/core (the port).
+export { createOpenAICompatibleProvider, serializePrompt, withRetry, withRetryStream, isRetryableProviderError, backoffDelayMs, defaultMaxRetries, 
+// M47 §7: overload classification + branch.
+ProviderHttpError, OVERLOAD_BODY_SIGNATURES, sniffOverloadBody, isOverloadError, overloadBackoffDelayMs, 
+// M58 §A: context-overflow classification (413 reactive layer).
+ContextLengthError, CONTEXT_LENGTH_BODY_SIGNATURES, 
+// 120-b B2: the GLM/vLLM strict spelling (classify + trusted-parse, N>M).
+CONTEXT_LIMIT_INPUT_LENGTH_RE, matchContextLimitInputLength, sniffContextLengthBody, isContextLengthFailure, 
+// M58 §B / ω99-315: the dual-tier stream idle watchdog (soft warn / hard
+//  abort; the shared guard, budget resolver, and constants live in
+//  stream-idle.ts and are re-exported through openai-compatible.ts).
+StreamIdleError, DEFAULT_STREAM_IDLE_TIMEOUT_MS, MAX_STREAM_IDLE_TIMEOUT_MS, defaultStreamIdleTimeoutMs, DEFAULT_STREAM_IDLE_SOFT_MS, DEFAULT_STREAM_IDLE_HARD_MS, resolveStreamIdleBudget, 
+// r1b: the SSE line-buffer overflow cap (same ladder family as StreamIdleError).
+StreamOverflowError, 
+// ω99-44: the typed EOF-without-terminal abort (same ladder family — a clean
+// EOF that never spoke finish/stop semantics is a cut, never a completion).
+TruncatedStreamError, 
+// M70 §3: the foreground-only retry allowlist (background overload = bail).
+FOREGROUND_QUERY_SOURCES, isOverloadClassFailure, 
+// 124 项 2: network-outage grace window classifier + default knobs.
+isNetworkClassFailure, DEFAULT_NETWORK_GRACE_RETRY_MULTIPLIER, DEFAULT_NETWORK_GRACE_MAX_DELAY_MS, BackgroundOverloadError, 
+// M70 §4: max_tokens overflow self-repair (parseable 400 → retry once).
+parseMaxTokensOverflow, selfRepairMaxTokensValue, 
+// ω-2b (I1-a): the trusted context-limit body parse (classified overflow
+// bodies → the observed {promptTokens, windowTokens} pair).
+parseContextLimitBody, 
+// M48 §2: terminal-shape repair (one frozen replay per degenerate finish).
+terminalRepairKind, 
+// ω99-42: the typed mandatory-reasoning rejection (hermes f6bd1633f7 +
+// 63279301bc) — matcher + signatures alongside the class.
+ReasoningMandatoryError, isMandatoryReasoningRejection, MANDATORY_REASONING_BODY_SIGNATURES, 
+// M79 §2: the pre-I/O image capability/role gate + the tool-image note.
+assertImagesSupported, TOOL_IMAGE_NOTE, 
+// 113-B3: the account-quota park domain — identification, the trusted
+// reset parse, and the typed QuotaParkError (the CLI parks on it).
+QUOTA_BODY_SIGNATURES, sniffQuotaBody, parseQuotaResetAt, isQuotaParkFailure, tryQuotaParkError, QuotaParkError, } from "./openai-compatible.js";
+// Persona adapters (Task 4 / Task 9)
+export { createAnthropicProvider } from "./anthropic.js";
+export { createResponsesProvider } from "./responses.js";
+// r1a Task 3 (M62 §7): the ordered model-fallback chain, extracted from the
+// openai factory and shared by all three protocol factories.
+export { withModelFallback } from "./model-fallback.js";
+// wire-r2 follow-up ①: typed fail-closed conflict — the anthropic adapter
+// throws it when an explicit maxTokens (input or config) sits at/below the
+// thinking budget implied by reasoningEffort; the adapter's implicit default
+// cap keeps the historic budget+1024 raise.
+export { MaxTokensThinkingBudgetConflictError } from "./model-failure.js";
+// r1a Task 4: 429 Retry-After parsing — the retryAfterMs source the shared
+// ladder honors (deadline wait within the 60s fail cap).
+export { parseRetryAfterMs, RETRY_AFTER_FAIL_CAP_MS } from "./retry-after.js";
+// 波次 8 #42 (hermes #24): bounded error-body read — byte cap + wall clock +
+// cancel-on-abandon, so a stalled or huge error body can neither hang the
+// request nor buffer unbounded.
+export { readErrorBody, ERROR_BODY_MAX_BYTES, ERROR_BODY_DEADLINE_MS } from "./error-body.js";
+// Persona Phase B (design 93 §4.2-2): the single construction seam — dispatches
+// on config.wire to the protocol adapter (absent = openai-compatible engine).
+export { createProvider } from "./dispatcher.js";
+// M79 §3 — per-model input-modality metadata (catalog + resolution).
+export { modelInputModalities, resolveInputModalities, modelAcceptsImages, } from "./models.js";
+export { PROVIDER_PROFILES, REASONING_EFFORTS, REASONING_FORMATS, REASONING_REPLAYS, NO_KEY_REASON, parseApiKeyPool, isProviderName, 
+// Provider management R2: the closed builtin table narrows separately from
+// the widened ProviderName alias.
+isBuiltinProviderName, parseReasoningEffort, parseReasoningFormat, parseReasoningReplay, 
+// ω99-39: the probe-verified replay cap — shared by the resolution seam
+// and the CLI's provider-switch carry lane (one rule, both config faces).
+capClientReasoningReplay, parseWire, reasoningFormatBody, 
+// ω99-42: the repair body a mandatory-reasoning rejection re-sends with
+// (the matrix's explicit enable, map-stripped, medium default level).
+mandatoryRepairReasoningBody, reasoningResponseFields, pickReasoning, resolveReasoningContext, supportsReasoningEffort, resolveProviderConfig, resolveProviderConfigResult, 
+// M48 §2: the reasoning-only repair gate (profile-resolved).
+acceptsReasoningOnlyFinish, 
+// 夜移 022: the tool-turn reasoning-omission fact (profile-resolved).
+omitsReasoningOnToolTurns, 
+// 取证弧 0921: the output-limit ladder's escalation tier (profile-resolved).
+outputLimitEscalateFor, 
+// ω-2b (I1-c): the profile's window semantics (gates the admission clip).
+resolveWindowMode, } from "./config.js";
+// 夜移 011: the in-band <think> peel (vLLM chat-template lanes inline CoT
+// into content; the splitter routes a turn-initial block into reasoning).
+export { InbandThinkSplitter, resolveSplitInbandThinking } from "./split-inband-thinking.js";
+// Provider management §3/§7 — the runtime provider registry.
+export { defaultProviderRegistryPath, readProviderRegistrySync, writeProviderRegistrySync, effectiveProfiles, validateUserProviderEntry, resolveContextWindowTokens, } from "./registry.js";
+// 借鉴弧 B1（SoL-Pi C1）— 价目面：目录 schema + 缓存经济学 ratio 的自动推导
+//（catalog pin > WUDAO_PRICE env > 保守缺省，来源类型化；不暴露为用户配置）。
+export { deriveCachePricing, isModelPrices, catalogPricesFor } from "./pricing.js";
+// ω99-245: #6 — the reasoning capability catalog (data layer of the effort
+// preflight): family/model → supported effort set + reasoning_content flag.
+export { supportedEfforts, reasoningContentStreams, MODEL_EFFORT_PINS, } from "./effort-catalog.js";
+// P0-4 (96 队列) — the wallet-balance face (DeepSeek GET /user/balance;
+// unconfigured → undefined, never an error; amounts stay the API's strings).
+export { fetchProviderBalance, BALANCE_TIMEOUT_MS } from "./balance.js";
+// M56 §1: the multi-key pool (round-robin + per-key 429 cooldown).
+// createLiveKeyPool (2026-08-31 minimax-401 弧): the config-deriving twin
+// the session engine wires over its mutable config holder.
+export { createKeyPool, createLiveKeyPool, keyPoolFromEnv, cooldownClassForStatus, DEFAULT_KEY_COOLDOWN_MS, DEFAULT_AUTH_COOLDOWN_MS, } from "./key-pool.js";
+// 波次 7 #37 (CodeWhale C1)：provider 级 429 暂停窗 —— 三协议工厂同享、可注入。
+export { createRatePauseWindow, DEFAULT_RATE_PAUSE_MS, RATE_PAUSE_SLICE_MS } from "./rate-pause.js";
+// Persona layer exports (Task 5 / Task 6 / Task 7 / Task 8 / Task 9 / Task 11)
+export { validatePersonaDefinition, effectiveLayers, BODY_WHITELIST, PROTOCOL_IDS } from "./persona/schema.js";
+export { loadPersonaRegistry, lookupPersona } from "./persona/registry.js";
+// SDD 2026-08-23 persona Task 5 — the CRUD file helpers (spec §7: same
+// package as loadPersonaRegistry). The cli persona ops call these against
+// the global personas dir; savePersonaDefinition is the ONE write path.
+export { savePersonaDefinition, deletePersonaDefinition, personaIdsInDir } from "./persona/files.js";
+export { BUILTIN_PERSONAS } from "./persona/builtins.js";
+export { createPersonaRuntime, resolvePersona, parsePersonaSpec } from "./persona/runtime.js";
+export { applyWirePersona, mergeBodyOverlay, resolveTemplate, resolvePersonaHeaders } from "./persona/apply.js";
+export { withPersona } from "./persona/decorator.js";
+export const PACKAGE_NAME = "@wudao-org/providers";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,EACL,8BAA8B,EAC9B,eAAe,EACf,SAAS,EACT,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,iBAAiB;AACjB,4CAA4C;AAC5C,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,sBAAsB;AACtB,gEAAgE;AAChE,kBAAkB,EAClB,8BAA8B;AAC9B,0EAA0E;AAC1E,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,sBAAsB;AACtB,yEAAyE;AACzE,mEAAmE;AACnE,qEAAqE;AACrE,eAAe,EACf,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB;AAIvB,iFAAiF;AACjF,mBAAmB;AACnB,6EAA6E;AAC7E,4EAA4E;AAC5E,oBAAoB;AACpB,4EAA4E;AAC5E,wBAAwB,EACxB,sBAAsB;AACtB,mEAAmE;AACnE,qBAAqB,EACrB,sCAAsC,EACtC,kCAAkC,EAClC,uBAAuB;AACvB,wEAAwE;AACxE,sBAAsB,EACtB,wBAAwB;AACxB,yEAAyE;AACzE,4DAA4D;AAC5D,qBAAqB;AACrB,2EAA2E;AAC3E,kBAAkB;AAClB,uEAAuE;AACvE,0DAA0D;AAC1D,uBAAuB,EACvB,6BAA6B,EAC7B,mCAAmC;AACnC,wEAAwE;AACxE,qBAAqB,EACrB,eAAe;AACf,sEAAsE;AACtE,mEAAmE;AACnE,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,qCAAqC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,4EAA4E;AAC5E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,4CAA4C;AAC5C,OAAO,EAAE,oCAAoC,EAAE,MAAM,oBAAoB,CAAC;AAC1E,2EAA2E;AAC3E,yDAAyD;AACzD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,2EAA2E;AAC3E,0EAA0E;AAC1E,gCAAgC;AAChC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9F,gFAAgF;AAChF,8EAA8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,cAAc;AACd,2EAA2E;AAC3E,kCAAkC;AAClC,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB;AACpB,wEAAwE;AACxE,0EAA0E;AAC1E,wBAAwB,EACxB,SAAS,EACT,mBAAmB;AACnB,wEAAwE;AACxE,sEAAsE;AACtE,4BAA4B,EAC5B,uBAAuB,EACvB,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B;AAC3B,6DAA6D;AAC7D,0BAA0B;AAC1B,oEAAoE;AACpE,yBAAyB;AACzB,0EAA0E;AAC1E,sBAAsB;AACtB,0EAA0E;AAC1E,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,wEAAwE;AACxE,0EAA0E;AAC1E,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAiB7F,6DAA6D;AAC7D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAQvB,uDAAuD;AACvD,wDAAwD;AACxD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEnF,2EAA2E;AAC3E,4EAA4E;AAC5E,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,sEAAsE;AACtE,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAExE,mEAAmE;AACnE,yEAAyE;AACzE,2DAA2D;AAC3D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,6DAA6D;AAC7D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpG,+EAA+E;AAC/E,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3E,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhH,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAYrD,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC"}

package/dist/json-arguments.d.ts

@@ -0,0 +1,17 @@
+/** 波次 7 #33 (CodeWhale parse_json_with_repair + truncation salvage): the
+ *  deterministic repair ladder for streamed tool-call arguments. Torn SSE
+ *  fragments, literal control chars from local backends, and the 2M-cap
+ *  marker all poison the accumulated JSON — the old catch{} returned {}
+ *  SILENTLY (the tool ran with no arguments, or died on a misleading
+ *  "missing required field" validation error). Ladder, cheapest first:
+ *    1. strict parse (zero-change fast path)
+ *    2. ```json fence strip (CodeWhale: only when BOTH fence ends present)
+ *    3. first balanced object payload in prose (CodeWhale, ≤64 starts)
+ *    4. escape literal C0 controls inside strings (wudao extension — the
+ *       local-backend trigger)
+ *    5. truncation salvage: close an open string + the bracket stack, then
+ *       a second pass that drops the trailing partial member first
+ *  Anything unsalvageable falls back to `_unparsed` — the SAME visible
+ *  convention as anthropic.ts and responses.ts, never a silent {}. */
+export declare function parseToolCallArguments(raw: string): Record<string, unknown>;
+//# sourceMappingURL=json-arguments.d.ts.map

package/dist/json-arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-arguments.d.ts","sourceRoot":"","sources":["../src/json-arguments.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;sEAcsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsB3E"}

package/dist/json-arguments.js

@@ -0,0 +1,227 @@
+// 拆分运动 C：从 openai-compatible.ts 原样外提的流式 tool-call 参数 JSON 修复梯子
+//（波次 7 #33，CodeWhale parse_json_with_repair）。纯函数模块，零依赖。
+/** 波次 7 #33 (CodeWhale parse_json_with_repair + truncation salvage): the
+ *  deterministic repair ladder for streamed tool-call arguments. Torn SSE
+ *  fragments, literal control chars from local backends, and the 2M-cap
+ *  marker all poison the accumulated JSON — the old catch{} returned {}
+ *  SILENTLY (the tool ran with no arguments, or died on a misleading
+ *  "missing required field" validation error). Ladder, cheapest first:
+ *    1. strict parse (zero-change fast path)
+ *    2. ```json fence strip (CodeWhale: only when BOTH fence ends present)
+ *    3. first balanced object payload in prose (CodeWhale, ≤64 starts)
+ *    4. escape literal C0 controls inside strings (wudao extension — the
+ *       local-backend trigger)
+ *    5. truncation salvage: close an open string + the bracket stack, then
+ *       a second pass that drops the trailing partial member first
+ *  Anything unsalvageable falls back to `_unparsed` — the SAME visible
+ *  convention as anthropic.ts and responses.ts, never a silent {}. */
+export function parseToolCallArguments(raw) {
+    // Empty/whitespace args are a NORMAL stream edge (a no-arg tool, or the
+    // fragment stream not started) — not damage; keep the legacy {}.
+    if (raw.trim() === "")
+        return {};
+    const direct = tryParseObject(raw);
+    if (direct !== undefined)
+        return direct;
+    const unfenced = stripCodeFence(raw);
+    if (unfenced !== raw) {
+        const p = tryParseObject(unfenced);
+        if (p !== undefined)
+            return p;
+    }
+    const extracted = firstBalancedObjectPayload(unfenced);
+    if (extracted !== undefined) {
+        const p = tryParseObject(extracted);
+        if (p !== undefined)
+            return p;
+    }
+    const base = escapeControlChars(extracted ?? unfenced);
+    const closed = tryParseObject(closeTruncatedJson(base));
+    if (closed !== undefined)
+        return closed;
+    const trimmed = tryParseObject(closeTruncatedJson(trimPartialMember(base)));
+    if (trimmed !== undefined)
+        return trimmed;
+    return { _unparsed: raw };
+}
+/** Strict parse that accepts only object-shaped results (the legacy
+ *  predicate — arrays pass through as the record cast, matching the old
+ *  parseArguments behavior). */
+function tryParseObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** CodeWhale repair_json_text_once: strip a ```json / ``` fence — only when
+ *  BOTH the prefix and the closing fence are present; anything else is
+ *  returned trimmed, untouched. */
+function stripCodeFence(raw) {
+    const trimmed = raw.trim();
+    const afterPrefix = trimmed.startsWith("```json") ? trimmed.slice(6)
+        : trimmed.startsWith("```") ? trimmed.slice(3)
+            : null;
+    if (afterPrefix === null)
+        return trimmed;
+    if (!afterPrefix.endsWith("```"))
+        return trimmed;
+    return afterPrefix.slice(0, -3).trim();
+}
+// Repair scans untrusted model text once per possible container start; keep
+// the fallback bounded when malformed output contains a delimiter flood.
+const JSON_REPAIR_CANDIDATE_LIMIT = 64;
+/** CodeWhale first_valid_json_payload: the first `{`/`[` start whose payload
+ *  is balanced AND parses as an object. Skips balanced-but-poisoned
+ *  candidates (their content may still be recovered by stage 4 via the
+ *  unfenced fallback — that is exactly CodeWhale's unwrap_or shape). */
+function firstBalancedObjectPayload(raw) {
+    let attempted = 0;
+    for (let start = 0; start < raw.length; start += 1) {
+        const open = raw[start];
+        if (open !== "{" && open !== "[")
+            continue;
+        attempted += 1;
+        if (attempted > JSON_REPAIR_CANDIDATE_LIMIT)
+            break;
+        const end = balancedJsonEnd(raw, start);
+        if (end === undefined)
+            continue;
+        const candidate = raw.slice(start, end);
+        if (tryParseObject(candidate) !== undefined)
+            return candidate;
+    }
+    return undefined;
+}
+/** String/escape-aware balanced scan: index AFTER the closer matching the
+ *  opener at `start`, or undefined when the payload is torn or mismatched. */
+function balancedJsonEnd(raw, start) {
+    const stack = [];
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < raw.length; i += 1) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{" || ch === "[")
+            stack.push(ch);
+        else if (ch === "}" || ch === "]") {
+            const opener = stack.pop();
+            if (opener === undefined)
+                return undefined;
+            if ((opener === "{") !== (ch === "}"))
+                return undefined;
+            if (stack.length === 0)
+                return i + 1;
+        }
+    }
+    return undefined;
+}
+/** String-aware C0 escape (wudao extension): raw control characters inside
+ *  strings are invalid JSON that local backends emit literally. \n \r \t
+ *  get named escapes, the rest \\u00XX. */
+function escapeControlChars(text) {
+    let out = "";
+    let inString = false;
+    let escaped = false;
+    for (const ch of text) {
+        if (inString) {
+            if (escaped) {
+                out += ch;
+                escaped = false;
+                continue;
+            }
+            if (ch === "\\") {
+                out += ch;
+                escaped = true;
+                continue;
+            }
+            if (ch === '"') {
+                out += ch;
+                inString = false;
+                continue;
+            }
+            if (ch < " ") {
+                out += ch === "\n" ? "\\n" : ch === "\r" ? "\\r" : ch === "\t" ? "\\t" : `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`;
+                continue;
+            }
+            out += ch;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+/** Truncation salvage pass 1: close an open string (dropping a dangling
+ *  escape backslash so it cannot eat the closer) and append the bracket
+ *  closers in reverse stack order. */
+function closeTruncatedJson(text) {
+    const stack = [];
+    let inString = false;
+    let escaped = false;
+    for (const ch of text) {
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{" || ch === "[")
+            stack.push(ch);
+        else if (ch === "}" || ch === "]")
+            stack.pop();
+    }
+    let out = inString && escaped ? text.slice(0, -1) : text;
+    if (inString)
+        out += '"';
+    for (let i = stack.length - 1; i >= 0; i -= 1)
+        out += stack[i] === "{" ? "}" : "]";
+    return out;
+}
+/** Truncation salvage pass 2: cut back to the last member boundary outside
+ *  strings (`,` `:` `{` `[`) so a dangling partial member does not poison
+ *  the closure. */
+function trimPartialMember(text) {
+    let lastBoundary = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "," || ch === ":" || ch === "{" || ch === "[")
+            lastBoundary = i;
+    }
+    return lastBoundary === -1 ? text : text.slice(0, lastBoundary);
+}
+//# sourceMappingURL=json-arguments.js.map

package/dist/json-arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-arguments.js","sourceRoot":"","sources":["../src/json-arguments.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,wDAAwD;AACxD;;;;;;;;;;;;;;sEAcsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;gCAEgC;AAChC,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;mCAEmC;AACnC,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACjD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC;;;wEAGwE;AACxE,SAAS,0BAA0B,CAAC,GAAW;IAC7C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3C,SAAS,IAAI,CAAC,CAAC;QACf,IAAI,SAAS,GAAG,2BAA2B;YAAE,MAAM;QACnD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;8EAC8E;AAC9E,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aAC7C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;2CAE2C;AAC3C,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO,EAAE,CAAC;gBAAC,GAAG,IAAI,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,GAAG,IAAI,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,GAAG,IAAI,EAAE,CAAC;gBAAC,QAAQ,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1D,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;gBACb,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChI,SAAS;YACX,CAAC;YACD,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,GAAG,IAAI,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACzD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;sCAEsC;AACtC,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aAC7C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,QAAQ;QAAE,GAAG,IAAI,GAAG,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;mBAEmB;AACnB,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,YAAY,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC"}

package/dist/key-pool.d.ts

@@ -0,0 +1,66 @@
+/** The /status + statusline shape: `keys n/m`. */
+export interface KeyPoolSnapshot {
+    readonly total: number;
+    readonly available: number;
+    readonly cooling: number;
+}
+/**
+ * 夜移 007 (hermes credential-pool port): cooldowns are keyed by HTTP status
+ * class, not "was it a 429". `auth` (401/403 — the credential is dead) cools
+ * LONG so a revoked key stops re-entering rotation; `rate` (429) keeps the M56
+ * 60s contract; provider-side failures cool NOTHING (penalizing keys over the
+ * provider's own outage starves the pool for no gain).
+ */
+export type CooldownClass = "auth" | "rate";
+/** 401/403 → auth; 429 → rate; everything else → null (never cool the key). */
+export declare function cooldownClassForStatus(status: number): CooldownClass | null;
+export interface KeyPool {
+    /** The key for the next request (round-robin, cooldown-aware). */
+    select(): string;
+    /** Put a key into cooldown (no-op for unknown keys). Without a class the
+     *  M56 rate contract applies — existing call sites keep their behavior. */
+    markCooldown(key: string, cls?: CooldownClass): void;
+    /** Live counts for /status and the statusline. */
+    snapshot(): KeyPoolSnapshot;
+    readonly size: number;
+}
+export interface KeyPoolOptions {
+    /** Cooldown after a 429; default 60s (WUDAO key cooldown contract). */
+    readonly cooldownMs?: number;
+    /** Cooldown after a 401/403 (dead credential); default 15min. */
+    readonly authCooldownMs?: number;
+    /** Injectable clock (tests); default Date.now. */
+    readonly now?: () => number;
+}
+export declare const DEFAULT_KEY_COOLDOWN_MS = 60000;
+export declare const DEFAULT_AUTH_COOLDOWN_MS = 900000;
+/** Build a pool from raw keys (deduped, order-preserving). Throws on empty —
+ *  a pool with no key is a configuration error, not a runtime state. */
+export declare function createKeyPool(rawKeys: readonly string[], options?: KeyPoolOptions): KeyPool;
+/** Convenience: the env's pool, as `createKeyPool` wants it (may be empty —
+ *  resolution is the caller's failure to explain). */
+export declare function keyPoolFromEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * The LIVE pool — keys read from `getKeys` on EVERY select/snapshot, not
+ * captured at construction (2026-08-31 minimax-401 弧).
+ *
+ * The session engine used to build ONE static `createKeyPool` at boot and
+ * hand that object to every client rebuilt at a `/provider` switch; the
+ * adapters treat an explicit pool as authoritative (`options.keyPool ??
+ * own-config pool`), so a switched provider authenticated with the BOOT
+ * provider's key — `401 login fail` on every retry. The bug's class: key
+ * state derived once from the boot config and surviving config changes —
+ * a SECOND key store that can silently disagree with the config that built
+ * the current client.
+ *
+ * The fix is structural, not disciplinary (no "remember to reseed" at every
+ * future build site): the live pool HAS no independent key list. Wired to
+ * the engine's ONE mutable config holder (the S2b doctrine — the switch
+ * seam syncs it in place before every rebuild), it structurally cannot
+ * serve a key the current config does not carry. Rotation/cooldown
+ * semantics are the static pool's; cooldowns stay keyed by key VALUE, so
+ * a key that survives a config change keeps its cooldown, and a key that
+ * leaves the config takes its cooldown with it.
+ */
+export declare function createLiveKeyPool(getKeys: () => readonly string[], options?: KeyPoolOptions): KeyPool;
+//# sourceMappingURL=key-pool.d.ts.map

package/dist/key-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pool.d.ts","sourceRoot":"","sources":["../src/key-pool.ts"],"names":[],"mappings":"AA6BA,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAI3E;AAED,MAAM,WAAW,OAAO;IACtB,kEAAkE;IAClE,MAAM,IAAI,MAAM,CAAC;IACjB;+EAC2E;IAC3E,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrD,kDAAkD;IAClD,QAAQ,IAAI,eAAe,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD;wEACwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAwD/F;AAED;sDACsD;AACtD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAE7E;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,SAAS,MAAM,EAAE,EAChC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAiET"}

package/dist/key-pool.js

@@ -0,0 +1,207 @@
+// M56 §1 (hive llm/key_pool.py) — the multi-key pool. Domestic providers
+// rate-limit PER KEY (RPM quotas per credential), so a harness aimed at them
+// pools N keys and rotates. Semantics (the hive contract, pinned by tests):
+//
+//   round-robin   selection advances a cursor over the deduped key list;
+//   cooldown      a key that just took a KEY-SIDE failure is skipped — 夜移 007
+//                 (hermes port) keys this by HTTP status class: 401/403 = the
+//                 credential is dead → `authCooldownMs` (default 15min, it
+//                 must stop re-entering rotation); 429 = rate/fleet limit →
+//                 `cooldownMs` (default 60s, the M56 contract); provider-side
+//                 statuses (5xx…) cool NOTHING — penalizing keys over the
+//                 provider's own outage starves the pool for no gain;
+//   soonest-expiring fallback
+//                 when EVERY key is cooling, selection returns the key whose
+//                 cooldown expires soonest — "so the caller can proceed with
+//                 minimal delay... no sleep required". The retry ladder's
+//                 backoff absorbs the wait; a single-key pool therefore keeps
+//                 the historical single-key behavior exactly (same key, same
+//                 ladder). A dead key in a one-key pool thus fails every
+//                 request — correct: the retry ladder deliberately does NOT
+//                 retry 401/403 (a wrong key is a config problem, not a
+//                 transient; fail fast, diverging from hermes's rotate-on-auth
+//                 on purpose).
+//
+// Key selection happens per REQUEST (inside each HTTP attempt): the key rides
+// only the Authorization header, never the body, so rotating mid-session or
+// mid-retry cannot disturb the prompt prefix (M24 cache invariant).
+import { parseApiKeyPool } from "./config.js";
+/** 401/403 → auth; 429 → rate; everything else → null (never cool the key). */
+export function cooldownClassForStatus(status) {
+    if (status === 401 || status === 403)
+        return "auth";
+    if (status === 429)
+        return "rate";
+    return null;
+}
+export const DEFAULT_KEY_COOLDOWN_MS = 60_000;
+export const DEFAULT_AUTH_COOLDOWN_MS = 900_000;
+/** Build a pool from raw keys (deduped, order-preserving). Throws on empty —
+ *  a pool with no key is a configuration error, not a runtime state. */
+export function createKeyPool(rawKeys, options = {}) {
+    const keys = canonicalKeys(rawKeys);
+    if (keys.length === 0)
+        throw new Error("key pool needs at least one API key");
+    const cooldownMs = options.cooldownMs ?? DEFAULT_KEY_COOLDOWN_MS;
+    const authCooldownMs = options.authCooldownMs ?? DEFAULT_AUTH_COOLDOWN_MS;
+    const now = options.now ?? Date.now;
+    /** key → epoch-ms when its cooldown lapses. */
+    const coolingUntil = new Map();
+    let cursor = 0;
+    const isCooling = (key, t) => (coolingUntil.get(key) ?? 0) > t;
+    return {
+        get size() {
+            return keys.length;
+        },
+        select() {
+            const t = now();
+            // First available key at/after the cursor (wrap-around included).
+            for (let i = 0; i < keys.length; i += 1) {
+                const idx = (cursor + i) % keys.length;
+                const key = keys[idx];
+                if (!isCooling(key, t)) {
+                    cursor = (idx + 1) % keys.length;
+                    return key;
+                }
+            }
+            // All cooling: the soonest-expiring key — minimal delay, no sleep.
+            let best = keys[0];
+            let bestUntil = coolingUntil.get(best) ?? 0;
+            for (const key of keys) {
+                const until = coolingUntil.get(key) ?? 0;
+                if (until < bestUntil) {
+                    best = key;
+                    bestUntil = until;
+                }
+            }
+            const idx = keys.indexOf(best);
+            cursor = (idx + 1) % keys.length;
+            return best;
+        },
+        markCooldown(key, cls = "rate") {
+            if (!keys.includes(key))
+                return;
+            const until = now() + (cls === "auth" ? authCooldownMs : cooldownMs);
+            // Never SHORTEN an existing cooldown (the max wins on repeat hits —
+            // including cross-class: a 429 on an auth-cooling key extends nothing).
+            if (until > (coolingUntil.get(key) ?? 0))
+                coolingUntil.set(key, until);
+        },
+        snapshot() {
+            const t = now();
+            let cooling = 0;
+            for (const key of keys)
+                if (isCooling(key, t))
+                    cooling += 1;
+            return { total: keys.length, available: keys.length - cooling, cooling };
+        },
+    };
+}
+/** Convenience: the env's pool, as `createKeyPool` wants it (may be empty —
+ *  resolution is the caller's failure to explain). */
+export function keyPoolFromEnv(env = process.env) {
+    return parseApiKeyPool(env);
+}
+/** Trim + dedup (order-preserving) — the pool's canonicalization of a raw
+ *  key list, shared by the static and live factories. */
+function canonicalKeys(rawKeys) {
+    const keys = [];
+    for (const k of rawKeys) {
+        const trimmed = k.trim();
+        if (trimmed !== "" && !keys.includes(trimmed))
+            keys.push(trimmed);
+    }
+    return keys;
+}
+/**
+ * The LIVE pool — keys read from `getKeys` on EVERY select/snapshot, not
+ * captured at construction (2026-08-31 minimax-401 弧).
+ *
+ * The session engine used to build ONE static `createKeyPool` at boot and
+ * hand that object to every client rebuilt at a `/provider` switch; the
+ * adapters treat an explicit pool as authoritative (`options.keyPool ??
+ * own-config pool`), so a switched provider authenticated with the BOOT
+ * provider's key — `401 login fail` on every retry. The bug's class: key
+ * state derived once from the boot config and surviving config changes —
+ * a SECOND key store that can silently disagree with the config that built
+ * the current client.
+ *
+ * The fix is structural, not disciplinary (no "remember to reseed" at every
+ * future build site): the live pool HAS no independent key list. Wired to
+ * the engine's ONE mutable config holder (the S2b doctrine — the switch
+ * seam syncs it in place before every rebuild), it structurally cannot
+ * serve a key the current config does not carry. Rotation/cooldown
+ * semantics are the static pool's; cooldowns stay keyed by key VALUE, so
+ * a key that survives a config change keeps its cooldown, and a key that
+ * leaves the config takes its cooldown with it.
+ */
+export function createLiveKeyPool(getKeys, options = {}) {
+    // Fail-fast at construction, exactly like the static pool: a getter that
+    // yields nothing is a configuration error, not a runtime state.
+    if (canonicalKeys(getKeys()).length === 0)
+        throw new Error("key pool needs at least one API key");
+    const cooldownMs = options.cooldownMs ?? DEFAULT_KEY_COOLDOWN_MS;
+    const authCooldownMs = options.authCooldownMs ?? DEFAULT_AUTH_COOLDOWN_MS;
+    const now = options.now ?? Date.now;
+    /** key → epoch-ms when its cooldown lapses (values only — config-proof). */
+    const coolingUntil = new Map();
+    let cursor = 0;
+    const isCooling = (key, t) => (coolingUntil.get(key) ?? 0) > t;
+    return {
+        get size() {
+            return canonicalKeys(getKeys()).length;
+        },
+        select() {
+            const keys = canonicalKeys(getKeys());
+            // The holder mutated to empty mid-session (nothing upstream validates
+            // it): fail LOUD here rather than silently serving a stale key — that
+            // silence is exactly the 401 this pool exists to make impossible.
+            if (keys.length === 0)
+                throw new Error("key pool needs at least one API key");
+            const t = now();
+            // First available key at/after the cursor (wrap-around included) —
+            // modulo the CURRENT length, so a list that shrank or grew never
+            // indexes out of range or pins a dead position.
+            for (let i = 0; i < keys.length; i += 1) {
+                const idx = (cursor + i) % keys.length;
+                const key = keys[idx];
+                if (!isCooling(key, t)) {
+                    cursor = (idx + 1) % keys.length;
+                    return key;
+                }
+            }
+            // All cooling: the soonest-expiring CURRENT key (same contract).
+            let best = keys[0];
+            let bestUntil = coolingUntil.get(best) ?? 0;
+            for (const key of keys) {
+                const until = coolingUntil.get(key) ?? 0;
+                if (until < bestUntil) {
+                    best = key;
+                    bestUntil = until;
+                }
+            }
+            const idx = keys.indexOf(best);
+            cursor = (idx + 1) % keys.length;
+            return best;
+        },
+        markCooldown(key, cls = "rate") {
+            if (!canonicalKeys(getKeys()).includes(key))
+                return;
+            const until = now() + (cls === "auth" ? authCooldownMs : cooldownMs);
+            // Never SHORTEN an existing cooldown (the max wins on repeat hits —
+            // including cross-class: a 429 on an auth-cooling key extends nothing).
+            if (until > (coolingUntil.get(key) ?? 0))
+                coolingUntil.set(key, until);
+        },
+        snapshot() {
+            const keys = canonicalKeys(getKeys());
+            const t = now();
+            let cooling = 0;
+            for (const key of keys)
+                if (isCooling(key, t))
+                    cooling += 1;
+            return { total: keys.length, available: keys.length - cooling, cooling };
+        },
+    };
+}
+//# sourceMappingURL=key-pool.js.map