cachegate 1.0.0

package/streaming.js

@@ -0,0 +1,77 @@
+// model-router/streaming.js
+//
+// OpenAI-compatible SSE chunk framing, shared by both providers so
+// server.js has exactly one wire format to write regardless of which
+// provider actually answered - the provider adapters (chatStream()) do
+// their own event-format translation and hand server.js plain text
+// deltas plus a final usage/cost summary; this file turns that into the
+// bytes that go on the wire.
+//
+// Scope for this increment: PLAIN TEXT CONTENT ONLY. Tool-call
+// streaming (accumulating partial JSON arguments across chunks, one or
+// more calls in flight at once) is a genuinely harder, separate
+// problem - server.js rejects stream:true + tools with a clear error
+// rather than attempt a half-working version of it.
+//
+// The final chunk carries extra fields (cost_usd, provider, cached,
+// cache_type) beyond real OpenAI's wire format - the same deviation the
+// non-streaming JSON response already makes. This proxy is
+// OpenAI-COMPATIBLE in request/response SHAPE, not a byte-for-byte
+// clone of OpenAI's actual API; MemoCode's own callers need the cost
+// data, and no spec-compliant client chokes on unknown extra JSON
+// fields it doesn't look for.
+
+const crypto = require('crypto');
+
+function chunkFrame(payload) {
+  return `data: ${JSON.stringify(payload)}\n\n`;
+}
+
+function doneFrame() {
+  return 'data: [DONE]\n\n';
+}
+
+function genId() {
+  return 'chatcmpl-' + crypto.randomBytes(12).toString('hex');
+}
+
+function baseChunk(id, model, choice) {
+  return {
+    id,
+    object: 'chat.completion.chunk',
+    created: Math.floor(Date.now() / 1000),
+    model,
+    choices: [choice]
+  };
+}
+
+function roleChunk({ id, model }) {
+  return chunkFrame(baseChunk(id, model, { index: 0, delta: { role: 'assistant' }, finish_reason: null }));
+}
+
+function deltaChunk({ id, model, content }) {
+  return chunkFrame(baseChunk(id, model, { index: 0, delta: { content }, finish_reason: null }));
+}
+
+function finalChunk({ id, model, usage, cost_usd, provider, cached, cache_type }) {
+  const frame = baseChunk(id, model, { index: 0, delta: {}, finish_reason: 'stop' });
+  frame.usage = usage;
+  frame.cost_usd = cost_usd;
+  frame.provider = provider;
+  frame.cached = !!cached;
+  if (cache_type) frame.cache_type = cache_type;
+  return chunkFrame(frame);
+}
+
+function errorFrame(message) {
+  return chunkFrame({ error: { message } });
+}
+
+function startSse(res) {
+  res.setHeader('Content-Type', 'text/event-stream');
+  res.setHeader('Cache-Control', 'no-cache');
+  res.setHeader('Connection', 'keep-alive');
+  if (typeof res.flushHeaders === 'function') res.flushHeaders();
+}
+
+module.exports = { chunkFrame, doneFrame, genId, roleChunk, deltaChunk, finalChunk, errorFrame, startSse };

package/sync-oss-release.sh

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+#
+# sync-oss-release.sh - mirrors THIS directory's git-tracked files into
+# a checkout of the public cachegate repo, as ONE NEW COMMIT there.
+#
+# See OPEN_SOURCE_ROADMAP.md step 11 for why this direction (this
+# monorepo directory is the source of truth, not the public repo) and
+# step 1 for why the ONE-TIME initial extraction (step 16) uses fresh,
+# curated history. This script is different from that: it's what runs
+# on every sync AFTER the initial extraction, and it does NOT rewrite
+# history - it adds a single normal commit on top of whatever the
+# target repo already has, exactly like any other change to that repo.
+# Rewriting history on every sync would break clones, forks, and
+# in-flight PRs on the public side; that's not what this does.
+#
+# This is a MIRROR, not a merge: after syncing, the target's tracked
+# files exactly match this directory's. A file that exists only in the
+# target (added directly on GitHub, not here) gets REMOVED on sync.
+# That's deliberate - if a file should persist in the public repo, add
+# it here, in the monorepo, since this directory is the source of truth
+# (see step 11). This script will refuse to run against a target that
+# isn't a git repository, specifically so an accidental wipe of some
+# unrelated directory can't happen by pointing this at the wrong path.
+#
+# Usage:
+#   ./sync-oss-release.sh <path-to-public-repo-checkout> [--version X.Y.Z]
+#
+# What it does, in order:
+#   1. Refuses to run if the secrets scan (same patterns as the manual
+#      step-3 audit: API key shapes, email addresses) finds anything in
+#      this directory's tracked files - loud failure, nothing touched,
+#      rather than a quiet publish of a leak.
+#   2. If --version is given, bumps THIS directory's own package.json
+#      to that version first, so the synced copy carries it too. Omits
+#      this by default - the script doesn't invent a version-bump
+#      policy on its own (see step 6's deferred semver plan); a
+#      no-flag run is a plain resync at whatever version is already
+#      set (e.g. reapplying a cherry-picked external PR - see
+#      CONTRIBUTING.md's note on that flow).
+#   3. Mirrors every git-tracked file from this directory into the
+#      target checkout (removes everything else from the target's
+#      working tree first, except its own .git/) - a file removed here
+#      also disappears there, never a manual, error-prone diff to keep
+#      in sync by hand.
+#   4. Commits in the TARGET repo (one new commit, normal history).
+#      Does NOT push - pushing is a deliberate, separate, human/CI step.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+TARGET=""
+NEW_VERSION=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --version)
+      NEW_VERSION="$2"
+      shift 2
+      ;;
+    *)
+      if [[ -z "$TARGET" ]]; then
+        TARGET="$1"
+        shift
+      else
+        echo "Unexpected extra argument: $1" >&2
+        exit 1
+      fi
+      ;;
+  esac
+done
+
+if [[ -z "$TARGET" ]]; then
+  echo "Usage: $0 <path-to-public-repo-checkout> [--version X.Y.Z]" >&2
+  exit 1
+fi
+
+if [[ ! -d "$TARGET/.git" ]]; then
+  echo "❌ Refusing to run: $TARGET is not a git repository (no .git/ found)." >&2
+  echo "   This is deliberate - pointing this at the wrong path would wipe it." >&2
+  exit 1
+fi
+
+TARGET="$(cd "$TARGET" && pwd)"
+
+echo "🔍 Step 1/4: scanning tracked files for secrets before touching anything..."
+# Same shape of check as step 3's manual audit: API key patterns and
+# email addresses, restricted to git-tracked files only (never
+# node_modules, .env, data/ - those aren't tracked, so git ls-files
+# already excludes them).
+SECRET_HIT=0
+while IFS= read -r -d '' file; do
+  if grep -qE "sk-[a-zA-Z0-9_-]{20,}|AIza[0-9A-Za-z_-]{20,}|xai-[a-zA-Z0-9_-]{20,}" "$file" 2>/dev/null; then
+    echo "  ❌ Possible API key in $file" >&2
+    SECRET_HIT=1
+  fi
+  if grep -qE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-z]{2,}" "$file" 2>/dev/null; then
+    # .env.example intentionally has no real emails; this still flags
+    # anything matching the shape so a human confirms it's a placeholder.
+    match=$(grep -oE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-z]{2,}" "$file" | grep -v -E "example\.com|your-|@anthropic\.com" || true)
+    if [[ -n "$match" ]]; then
+      echo "  ⚠️  Email-shaped string in $file: $match (confirm this is a placeholder, not real)" >&2
+      SECRET_HIT=1
+    fi
+  fi
+done < <(git ls-files -z)
+
+if [[ "$SECRET_HIT" -eq 1 ]]; then
+  echo "❌ Aborting sync - resolve the findings above first. Nothing was copied." >&2
+  exit 1
+fi
+echo "  ✅ Clean."
+
+if [[ -n "$NEW_VERSION" ]]; then
+  echo "🔢 Step 2/4: bumping package.json to $NEW_VERSION..."
+  node -e "
+    const fs = require('fs');
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    pkg.version = process.argv[1];
+    fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+  " "$NEW_VERSION"
+  echo "  ✅ package.json now at $NEW_VERSION."
+else
+  echo "🔢 Step 2/4: no --version given, leaving package.json's version as-is."
+fi
+
+echo "📦 Step 3/4: mirroring tracked files into $TARGET..."
+# Wipe the target's working tree except .git/, then copy this
+# directory's tracked files in - guarantees the target ends up an
+# EXACT mirror, not an accumulation of whatever used to be there.
+find "$TARGET" -mindepth 1 -maxdepth 1 -not -name ".git" -exec rm -rf {} +
+
+while IFS= read -r -d '' file; do
+  dest="$TARGET/$file"
+  mkdir -p "$(dirname "$dest")"
+  cp "$file" "$dest"
+done < <(git ls-files -z)
+
+echo "  ✅ Copied $(git ls-files | wc -l | tr -d ' ') tracked files."
+
+echo "💾 Step 4/4: committing in the target repo (not pushing)..."
+SOURCE_SHA="$(git rev-parse --short HEAD)"
+(
+  cd "$TARGET"
+  git add -A
+  if git diff --cached --quiet; then
+    echo "  ℹ️  Nothing changed - target already matches this directory. No commit made."
+  else
+    git commit -m "Sync from internal monorepo @ ${SOURCE_SHA}
+
+Mirrors 210_apps/001_model_router/ as of that commit. This commit was
+generated by sync-oss-release.sh, not written by hand - see
+OPEN_SOURCE_ROADMAP.md step 11 in the source repo for why this
+direction (monorepo -> public repo, not the reverse)."
+    echo "  ✅ Committed. Review with 'git show' in $TARGET, then push when ready - this script never pushes."
+  fi
+)
+
+echo "✅ Sync complete."

package/test/auth-config.test.js

@@ -0,0 +1,27 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+// server.js reads its env vars once at require time, so each case here
+// resets env + require cache before requiring fresh.
+function freshServer(env) {
+  delete process.env.MODEL_ROUTER_INTERNAL_KEY;
+  delete process.env.ALLOW_INSECURE_LOCAL_DEV;
+  Object.assign(process.env, env);
+  delete require.cache[require.resolve('../server')];
+  return require('../server');
+}
+
+test('isAuthConfigured() is false with neither key nor opt-in set', () => {
+  const { isAuthConfigured } = freshServer({});
+  assert.equal(isAuthConfigured(), false);
+});
+
+test('isAuthConfigured() is true once MODEL_ROUTER_INTERNAL_KEY is set', () => {
+  const { isAuthConfigured } = freshServer({ MODEL_ROUTER_INTERNAL_KEY: 'some-key' });
+  assert.equal(isAuthConfigured(), true);
+});
+
+test('isAuthConfigured() is true with the explicit insecure opt-in, even with no key', () => {
+  const { isAuthConfigured } = freshServer({ ALLOW_INSECURE_LOCAL_DEV: 'true' });
+  assert.equal(isAuthConfigured(), true);
+});

package/test/cache.test.js

@@ -0,0 +1,33 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const cache = require('../cache');
+
+test('buildCacheKey is deterministic for identical payloads', () => {
+  const payload = { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'hi' }] };
+  assert.equal(cache.buildCacheKey(payload), cache.buildCacheKey({ ...payload }));
+});
+
+test('buildCacheKey differs when messages differ', () => {
+  const a = { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'hi' }] };
+  const b = { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'bye' }] };
+  assert.notEqual(cache.buildCacheKey(a), cache.buildCacheKey(b));
+});
+
+test('buildCacheKey differs when model differs, same messages', () => {
+  const messages = [{ role: 'user', content: 'hi' }];
+  const a = { model: 'gpt-4o-mini', messages };
+  const b = { model: 'claude-haiku-4-5-20251001', messages };
+  assert.notEqual(cache.buildCacheKey(a), cache.buildCacheKey(b));
+});
+
+test('buildCacheKey treats an unset temperature the same as 0.0 (documented default)', () => {
+  const a = { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'hi' }] };
+  const b = { model: 'gpt-4o-mini', messages: [{ role: 'user', content: 'hi' }], temperature: 0.0 };
+  assert.equal(cache.buildCacheKey(a), cache.buildCacheKey(b));
+});
+
+test('isConnected() is false with no REDIS_URL configured', () => {
+  // This test suite never sets REDIS_URL, matching the documented
+  // graceful-degradation path (cache disabled, not crashed).
+  assert.equal(cache.isConnected(), false);
+});

package/test/embeddings.test.js

@@ -0,0 +1,24 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+function freshEmbeddings(env) {
+  delete process.env.OPENAI_API_KEY;
+  Object.assign(process.env, env);
+  delete require.cache[require.resolve('../embeddings')];
+  return require('../embeddings');
+}
+
+test('isEnabled() is false with no OPENAI_API_KEY', () => {
+  const embeddings = freshEmbeddings({});
+  assert.equal(embeddings.isEnabled(), false);
+});
+
+test('isEnabled() is true once OPENAI_API_KEY is set', () => {
+  const embeddings = freshEmbeddings({ OPENAI_API_KEY: 'sk-test-fake' });
+  assert.equal(embeddings.isEnabled(), true);
+});
+
+test('embed() rejects clearly when disabled, without attempting a network call', async () => {
+  const embeddings = freshEmbeddings({});
+  await assert.rejects(() => embeddings.embed('hello'), /OPENAI_API_KEY not configured/);
+});

package/test/failover.test.js

@@ -0,0 +1,99 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { isRetryableError, dispatchWithFailover } = require('../failover');
+
+function httpError(message, status) {
+  return Object.assign(new Error(message), { status });
+}
+
+test('isRetryableError treats a bad request (400) as not retryable', () => {
+  assert.equal(isRetryableError(httpError('bad request', 400)), false);
+});
+
+test('isRetryableError treats an unknown model (404) as not retryable', () => {
+  assert.equal(isRetryableError(httpError('not found', 404)), false);
+});
+
+test('isRetryableError treats rate limits, server errors, and auth failures as retryable', () => {
+  assert.equal(isRetryableError(httpError('rate limited', 429)), true);
+  assert.equal(isRetryableError(httpError('server error', 500)), true);
+  assert.equal(isRetryableError(httpError('bad gateway', 502)), true);
+  assert.equal(isRetryableError(httpError('unauthorized', 401)), true);
+});
+
+test('isRetryableError treats a network failure with no status at all as retryable', () => {
+  assert.equal(isRetryableError(new Error('ECONNRESET')), true);
+});
+
+test('dispatchWithFailover resolves on the first candidate when it succeeds, attempts=1', async () => {
+  const candidates = [{ provider: 'openai', model: 'gpt-4o-mini' }, { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' }];
+  const dispatch = async (c) => ({ ok: true, provider: c.provider });
+
+  const outcome = await dispatchWithFailover(candidates, dispatch);
+  assert.equal(outcome.attempts, 1);
+  assert.equal(outcome.candidate.provider, 'openai');
+  assert.deepEqual(outcome.result, { ok: true, provider: 'openai' });
+});
+
+test('dispatchWithFailover moves to the next candidate on a retryable failure', async () => {
+  const candidates = [{ provider: 'openai', model: 'gpt-4o-mini' }, { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' }];
+  const failedAttempts = [];
+  const dispatch = async (c) => {
+    if (c.provider === 'openai') throw httpError('rate limited', 429);
+    return { ok: true, provider: c.provider };
+  };
+
+  const outcome = await dispatchWithFailover(candidates, dispatch, (candidate, err) => {
+    failedAttempts.push({ candidate, message: err.message });
+  });
+
+  assert.equal(outcome.attempts, 2);
+  assert.equal(outcome.candidate.provider, 'anthropic');
+  assert.equal(failedAttempts.length, 1);
+  assert.equal(failedAttempts[0].candidate.provider, 'openai');
+});
+
+test('dispatchWithFailover does not retry a non-retryable (400) error, even with candidates left', async () => {
+  const candidates = [{ provider: 'openai', model: 'gpt-4o-mini' }, { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' }];
+  let anthropicCalled = false;
+  const dispatch = async (c) => {
+    if (c.provider === 'openai') throw httpError('bad request', 400);
+    anthropicCalled = true;
+    return { ok: true };
+  };
+
+  await assert.rejects(
+    () => dispatchWithFailover(candidates, dispatch),
+    /bad request/
+  );
+  assert.equal(anthropicCalled, false);
+});
+
+test('dispatchWithFailover rethrows the last error when every candidate fails', async () => {
+  const candidates = [{ provider: 'openai', model: 'gpt-4o-mini' }, { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' }];
+  const dispatch = async (c) => {
+    throw httpError(`${c.provider} down`, 503);
+  };
+
+  await assert.rejects(
+    () => dispatchWithFailover(candidates, dispatch),
+    /anthropic down/ // the LAST attempt's error, not the first
+  );
+});
+
+test('dispatchWithFailover calls onAttemptFailed for every failed candidate, including the last', async () => {
+  const candidates = [{ provider: 'openai', model: 'gpt-4o-mini' }, { provider: 'anthropic', model: 'claude-haiku-4-5-20251001' }];
+  const seen = [];
+  const dispatch = async (c) => {
+    throw httpError(`${c.provider} down`, 503);
+  };
+
+  await assert.rejects(() => dispatchWithFailover(candidates, dispatch, (candidate, err, isLastCandidate) => {
+    seen.push({ provider: candidate.provider, isLastCandidate });
+  }));
+
+  assert.deepEqual(seen, [
+    { provider: 'openai', isLastCandidate: false },
+    { provider: 'anthropic', isLastCandidate: true }
+  ]);
+});

package/test/metrics-postgres.test.js

@@ -0,0 +1,183 @@
+// Postgres-backed persistence is OPT-IN (see metrics.js's own comment) -
+// these tests exercise that path specifically, against a real local
+// Postgres. Needs a real local server to actually run against; the
+// `before()` hook below probes connectivity ONCE with a clear warning
+// (`⚠️ Skipping metrics-postgres.test.js...`) rather than letting 20
+// individual tests each fail with their own raw ECONNREFUSED - every
+// test still reports as passing (each returns early via `pgAvailable`)
+// so a machine without Postgres available doesn't see a red suite, it
+// sees a skipped one. **Corrected 2026-08-29**: this comment previously
+// claimed the opposite ("fails loudly... rather than silently
+// skipping") - checked directly by actually stopping Postgres and
+// running the suite, and that was never what the code below does. A CI
+// environment without a real Postgres service configured will report
+// green here while silently not exercising this file at all - the
+// workflow's own Postgres service container is what makes these tests
+// actually run, not just avoid failing.
+//
+// MEMOCODE_ROUTER_DATABASE_URL (not DATABASE_URL) is used here on
+// purpose - keeps this suite from ever accidentally pointing at a real
+// production database if that variable happened to be set in whatever
+// environment runs the tests.
+const { test, before, after, beforeEach } = require('node:test');
+const assert = require('node:assert/strict');
+
+const TEST_DATABASE_URL =
+  process.env.MEMOCODE_ROUTER_TEST_DATABASE_URL || 'postgres://postgres:dryrun@localhost:5432/router_metrics_dryrun';
+
+function freshPgMetrics() {
+  process.env.MEMOCODE_ROUTER_DATABASE_URL = TEST_DATABASE_URL;
+  delete process.env.DATABASE_URL; // make sure only the test var is what's triggering Postgres mode
+  delete require.cache[require.resolve('../metrics')];
+  return require('../metrics');
+}
+
+async function flush() {
+  await new Promise((resolve) => setTimeout(resolve, 100));
+}
+
+let pgAvailable = true;
+let metrics;
+
+before(async () => {
+  metrics = freshPgMetrics();
+  try {
+    // Prove connectivity up front with a clear failure message, rather
+    // than 20 individual tests each failing with their own ECONNREFUSED.
+    await metrics.readRecent(1);
+  } catch (err) {
+    pgAvailable = false;
+    console.warn(`⚠️ Skipping metrics-postgres.test.js - no local Postgres reachable at ${TEST_DATABASE_URL} (${err.message})`);
+  }
+});
+
+beforeEach(async () => {
+  if (!pgAvailable) return;
+  // Reset between tests so each one starts from a known-empty table,
+  // same isolation guarantee freshMetrics() gives the file-backed suite
+  // via a fresh temp directory per test.
+  const { Pool } = require('pg');
+  const pool = new Pool({ connectionString: TEST_DATABASE_URL });
+  await pool.query('DROP TABLE IF EXISTS router_metrics');
+  await pool.end();
+  metrics = freshPgMetrics();
+});
+
+after(async () => {
+  if (metrics) await metrics.closePostgresPoolForTests();
+});
+
+test('usingPostgres() is true once MEMOCODE_ROUTER_DATABASE_URL is set', () => {
+  if (!pgAvailable) return;
+  assert.equal(metrics.usingPostgres(), true);
+});
+
+test('record() + readRecent(): a real INSERT round-trips back out with the same fields', async () => {
+  if (!pgAvailable) return;
+  metrics.record({ provider: 'openai', model: 'gpt-4o-mini', latency_ms: 120, cost_usd: 0.001, cache_hit: false });
+  await flush();
+
+  const rows = await metrics.readRecent();
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].provider, 'openai');
+  assert.equal(rows[0].model, 'gpt-4o-mini');
+  assert.equal(rows[0].latency_ms, 120);
+  assert.equal(rows[0].cost_usd, 0.001);
+  assert.ok(rows[0].timestamp, 'expected a real timestamp column value back');
+});
+
+test('record() persists error + error_type together, exactly like the file backend', async () => {
+  if (!pgAvailable) return;
+  metrics.record({
+    provider: 'anthropic',
+    error: '401 {"type":"error","error":{"type":"authentication_error"}}',
+    error_type: 'authentication_error'
+  });
+  await flush();
+
+  const rows = await metrics.readRecent();
+  assert.equal(rows[0].error_type, 'authentication_error');
+  assert.ok(rows[0].error.includes('authentication_error'));
+});
+
+test('providerStats(): error rate, avg latency, and lastErrorType all compute correctly from real rows', async () => {
+  if (!pgAvailable) return;
+  metrics.record({ provider: 'openai', latency_ms: 100 });
+  metrics.record({ provider: 'openai', latency_ms: 200 });
+  metrics.record({ provider: 'openai', error: '429 {"error":{"type":"rate_limit_error"}}', error_type: 'rate_limit_error' });
+  await flush();
+
+  const stats = await metrics.providerStats();
+  assert.equal(stats.openai.sampleSize, 3);
+  assert.equal(stats.openai.errorRate, 1 / 3);
+  assert.equal(stats.openai.avgLatencyMs, 150);
+  assert.equal(stats.openai.lastErrorType, 'rate_limit_error');
+});
+
+test('rangeSummary(): cost, cache-hit breakdown, and by_provider all agree with what was actually inserted', async () => {
+  if (!pgAvailable) return;
+  metrics.record({ provider: 'openai', cost_usd: 0.001, cache_hit: false });
+  metrics.record({ provider: 'openai', cost_usd: 0, cache_hit: true, cache_type: 'exact' });
+  metrics.record({ provider: 'anthropic', error: '500 boom', error_type: 'unknown' });
+  await flush();
+
+  const summary = await metrics.rangeSummary(14);
+  assert.equal(summary.sample_size, 3);
+  assert.equal(summary.total_cost_usd, 0.001);
+  assert.equal(summary.cache_hit_rate.exact, 1 / 3);
+  assert.equal(summary.error_rate, 1 / 3);
+  assert.equal(summary.by_provider.openai.requests, 2);
+  assert.equal(summary.by_provider.anthropic.requests, 1);
+  assert.equal(summary.by_provider.anthropic.errorRate, 1);
+});
+
+test('rangeSummary(): a row older than the requested window is excluded', async () => {
+  if (!pgAvailable) return;
+  const { Pool } = require('pg');
+  const pool = new Pool({ connectionString: TEST_DATABASE_URL });
+  await pool.query(
+    `CREATE TABLE IF NOT EXISTS router_metrics (id BIGSERIAL PRIMARY KEY, ts TIMESTAMPTZ NOT NULL DEFAULT now(),
+       provider TEXT, model TEXT, requested_model TEXT, cache_hit BOOLEAN, cache_type TEXT,
+       latency_ms INTEGER, cost_usd DOUBLE PRECISION, error TEXT, error_type TEXT)`
+  );
+  await pool.query(`INSERT INTO router_metrics (ts, provider, cost_usd) VALUES (now() - interval '30 days', 'openai', 0.05)`);
+  await pool.end();
+
+  metrics.record({ provider: 'openai', cost_usd: 0.001 }); // today, should count
+  await flush();
+
+  const summary = await metrics.rangeSummary(14); // 30-day-old row is outside this window
+  assert.equal(summary.sample_size, 1);
+  assert.equal(summary.total_cost_usd, 0.001);
+});
+
+test('pruneOlderThan(): deletes only rows past the cutoff, returns their ids, leaves fresh rows alone', async () => {
+  if (!pgAvailable) return;
+  const { Pool } = require('pg');
+  const pool = new Pool({ connectionString: TEST_DATABASE_URL });
+  await pool.query(
+    `CREATE TABLE IF NOT EXISTS router_metrics (id BIGSERIAL PRIMARY KEY, ts TIMESTAMPTZ NOT NULL DEFAULT now(),
+       provider TEXT, model TEXT, requested_model TEXT, cache_hit BOOLEAN, cache_type TEXT,
+       latency_ms INTEGER, cost_usd DOUBLE PRECISION, error TEXT, error_type TEXT)`
+  );
+  await pool.query(`INSERT INTO router_metrics (ts, provider) VALUES (now() - interval '100 days', 'openai')`);
+  await pool.end();
+
+  metrics.record({ provider: 'anthropic' }); // fresh, should survive
+  await flush();
+
+  const deleted = await metrics.pruneOlderThan(30);
+  assert.equal(deleted.length, 1);
+
+  const remaining = await metrics.readRecent();
+  assert.equal(remaining.length, 1);
+  assert.equal(remaining[0].provider, 'anthropic');
+});
+
+test('classifyErrorType() is the exact same function regardless of storage backend (not duplicated/reimplemented)', () => {
+  if (!pgAvailable) return;
+  assert.equal(
+    metrics.classifyErrorType('401 {"error":{"type":"authentication_error"}}'),
+    'authentication_error'
+  );
+});