cartethyia 2.5.3 → 2.5.6

package/src/protocol/response/dsml.ts

@@ -1,15 +1,17 @@
 /**
- * DeepSeek sometimes emits its native tool markup as assistant text when the
- * structured tool channel was dropped in transit. A complete, well-formed block
- * becomes ordinary tool calls; anything incomplete stays text.
+ * CodeBuddy-family DeepSeek sometimes emits native tool markup as assistant text.
+ * Complete declared calls are recovered; incomplete and undeclared blocks stay text.
  */
-
-const PIPE = "\uFF5C\uFF5C";
-const CALLS = new RegExp(`<${PIPE}DSML${PIPE}\\s+calls>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+calls>`, "i");
-const INVOKE = new RegExp(`<${PIPE}DSML${PIPE}\\s+invoke\\s+name=["']([^"']+)["']>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+invoke>`, "gi");
-const PARAMETER = new RegExp(`<${PIPE}DSML${PIPE}\\s+parameter\\s+name=["']([^"']+)["'][^>]*>([\\s\\S]*?)</${PIPE}DSML${PIPE}\\s+parameter>`, "gi");
+const SEPARATORS = ["｜｜", "｜", "|"] as const;
+const BLOCK_NAMES = ["calls", "function_calls"] as const;
+const OPENERS = SEPARATORS.flatMap((separator) => BLOCK_NAMES.map((name) => `<${separator}DSML${separator} ${name}>`));
 const TOOL_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,63}$/;
 
+/** Escapes regex metacharacters so a `|` separator is literal, not alternation. */
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 export interface DsmlToolCall {
   readonly id: string;
   readonly name: string;
@@ -21,27 +23,137 @@ export interface DsmlRecovery {
   readonly calls: readonly DsmlToolCall[];
 }
 
-export function parseDsmlToolCalls(text: string): DsmlRecovery | undefined {
+export class DsmlToolCallParser {
+  readonly #allowedNames: ReadonlySet<string>;
+  #pending = "";
+  #callSequence = 0;
+
+  constructor(allowedNames: ReadonlySet<string>) {
+    this.#allowedNames = allowedNames;
+  }
+
+  push(chunk: string): DsmlRecovery {
+    this.#pending += chunk;
+    let cursor = 0;
+    let visible = "";
+    const calls: DsmlToolCall[] = [];
+    for (;;) {
+      let openIndex = -1;
+      let opener = "";
+      for (const candidate of OPENERS) {
+        const index = this.#pending.indexOf(candidate, cursor);
+        if (index >= 0 && (openIndex < 0 || index < openIndex)) {
+          openIndex = index;
+          opener = candidate;
+        }
+      }
+      if (openIndex < 0) {
+        const safeEnd = this.#settledEnd(cursor);
+        visible += this.#pending.slice(cursor, safeEnd);
+        cursor = safeEnd;
+        break;
+      }
+      visible += this.#pending.slice(cursor, openIndex);
+      const separator = SEPARATORS.find((value) => opener.startsWith(`<${value}DSML`));
+      const blockName = BLOCK_NAMES.find((value) => opener.endsWith(` ${value}>`));
+      if (separator === undefined || blockName === undefined) {
+        visible += "<";
+        cursor = openIndex + 1;
+        continue;
+      }
+      const close = `</${separator}DSML${separator} ${blockName}>`;
+      const closeIndex = this.#pending.indexOf(close, openIndex + opener.length);
+      if (closeIndex < 0) {
+        cursor = openIndex;
+        break;
+      }
+      const end = closeIndex + close.length;
+      const block = this.#pending.slice(openIndex, end);
+      const parsed = parseBlock(block, opener, close, separator, this.#allowedNames);
+      if (parsed === undefined) visible += block;
+      else {
+        for (const call of parsed) calls.push({ ...call, id: `call_dsml_${this.#callSequence++}_${call.name}` });
+      }
+      cursor = end;
+    }
+    this.#pending = this.#pending.slice(cursor);
+    return { text: visible, calls };
+  }
+
+  flush(): DsmlRecovery {
+    const text = this.#pending;
+    this.#pending = "";
+    return { text, calls: [] };
+  }
+
+  #settledEnd(start: number): number {
+    const remaining = this.#pending.slice(start);
+    for (let length = Math.min(OPENERS.reduce((max, opener) => Math.max(max, opener.length - 1), 0), remaining.length); length > 0; length -= 1) {
+      const suffix = remaining.slice(-length);
+      if (OPENERS.some((opener) => opener.startsWith(suffix))) return this.#pending.length - length;
+    }
+    return this.#pending.length;
+  }
+}
+
+export function parseDsmlToolCalls(
+  text: string,
+  allowedNames: ReadonlySet<string> = new Set(),
+): DsmlRecovery | undefined {
   if (!text.includes("DSML")) return undefined;
-  const block = CALLS.exec(text);
-  if (block === null || block[1] === undefined || block.index === undefined) return undefined;
-  const calls: DsmlToolCall[] = [];
-  for (const invoke of block[1].matchAll(INVOKE)) {
-    const name = invoke[1]?.trim() ?? "";
-    if (!TOOL_NAME.test(name)) return undefined;
-    const args: Record<string, string> = {};
-    for (const parameter of (invoke[2] ?? "").matchAll(PARAMETER)) {
-      const key = parameter[1]?.trim();
-      if (key === undefined || key.length === 0) return undefined;
-      args[key] = (parameter[2] ?? "").trim();
+  const parser = new DsmlToolCallParser(allowedNames);
+  const first = parser.push(text);
+  const last = parser.flush();
+  const recovered = [...first.calls, ...last.calls];
+  return recovered.length === 0 ? undefined : { text: `${first.text}${last.text}`.trim(), calls: recovered };
+}
+
+function parseBlock(
+  block: string,
+  opener: string,
+  close: string,
+  separator: string,
+  allowedNames: ReadonlySet<string>,
+): Omit<DsmlToolCall, "id">[] | undefined {
+  const inner = block.slice(opener.length, -close.length);
+  const pipe = escapeRegExp(separator);
+  const invokePattern = new RegExp(`<${pipe}DSML${pipe}\\s+invoke\\s+name="([^"]*)"\\s*>`, "g");
+  const calls: Omit<DsmlToolCall, "id">[] = [];
+  // The allowlist is strict only when the caller knows the declared tools: a
+  // caller without one (a direct parse) keeps the generic name rule, while a
+  // dispatch that declared its tools must never execute a name it did not offer.
+  const strict = allowedNames.size > 0;
+  let cursor = 0;
+  for (const invoke of inner.matchAll(invokePattern)) {
+    const name = invoke[1] ?? "";
+    if (!TOOL_NAME.test(name) || (strict && !allowedNames.has(name)) || invoke.index === undefined) return undefined;
+    if (inner.slice(cursor, invoke.index).trim().length > 0) return undefined;
+    const bodyStart = invoke.index + invoke[0].length;
+    const invokeClose = `</${separator}DSML${separator} invoke>`;
+    const invokeEnd = inner.indexOf(invokeClose, bodyStart);
+    if (invokeEnd < 0) return undefined;
+    const parameterPattern = new RegExp(`<${pipe}DSML${pipe}\\s+parameter\\s+name="([^"]*)"(?:\\s+string="(true|false)")?\\s*>`, "g");
+    const body = inner.slice(bodyStart, invokeEnd);
+    const args: Record<string, unknown> = {};
+    let parameterCursor = 0;
+    for (const parameter of body.matchAll(parameterPattern)) {
+      const key = parameter[1] ?? "";
+      if (key.length === 0 || parameter.index === undefined || body.slice(parameterCursor, parameter.index).trim().length > 0) return undefined;
+      const valueStart = parameter.index + parameter[0].length;
+      const parameterClose = `</${separator}DSML${separator} parameter>`;
+      const valueEnd = body.indexOf(parameterClose, valueStart);
+      if (valueEnd < 0) return undefined;
+      const raw = body.slice(valueStart, valueEnd);
+      if (parameter[2] === "true") args[key] = raw;
+      else {
+        try { args[key] = JSON.parse(raw); }
+        catch { args[key] = raw; }
+      }
+      parameterCursor = valueEnd + parameterClose.length;
     }
-    calls.push({
-      id: `call_dsml_${calls.length}_${name}`,
-      name,
-      arguments: JSON.stringify(args),
-    });
+    if (body.slice(parameterCursor).trim().length > 0) return undefined;
+    calls.push({ name, arguments: JSON.stringify(args) });
+    cursor = invokeEnd + invokeClose.length;
   }
-  if (calls.length === 0) return undefined;
-  const visible = `${text.slice(0, block.index)}${text.slice(block.index + block[0].length)}`.trim();
-  return { text: visible, calls };
+  return calls.length > 0 && inner.slice(cursor).trim().length === 0 ? calls : undefined;
 }

package/src/protocol/response/responses.ts

@@ -182,7 +182,10 @@ export function parseResponsesResponseToEvents(
                 }
               : { payload: text }),
             ...(position === 0 && encryptedContent !== undefined
-              ? { encrypted_content: encryptedContent }
+              ? {
+                  encrypted_content: encryptedContent,
+                  ...(itemId === undefined ? {} : { item_id: itemId }),
+                }
               : {}),
           },
         });
@@ -342,9 +345,9 @@ export async function* decodeResponsesSseStream(
     const eventType = event["type"];
     // An explicit failure inside a 200 OK. Two shapes carry one: a top-level
     // `type: "error"` frame (the error object itself), and a `response.failed`
-    // terminal whose `response.error` explains why. Both used to be recorded
-    // only as a `failed` terminal, so the client got no code and telemetry got
-    // `unknown_error`; the Claude and Gemini decoders already raised.
+    // terminal whose `response.error` explains why. Recording either only as a
+    // `failed` terminal would leave the client with no code and telemetry with
+    // `unknown_error`; the Claude and Gemini decoders already raise.
     const failedResponse = eventType === "response.failed" && isRecord(event["response"]) ? event["response"] : undefined;
     const streamError = gatewayErrorFromStreamError(
       eventType === "error" ? event : failedResponse?.["error"],
@@ -566,7 +569,10 @@ export async function* decodeResponsesSseStream(
                     ? { payload: null, summary: text, summary_index: reasoningPart.index }
                     : { payload: text }),
                   ...(position === 0 && encryptedContent !== undefined
-                    ? { encrypted_content: encryptedContent }
+                    ? {
+                        encrypted_content: encryptedContent,
+                        ...(itemId === undefined ? {} : { item_id: itemId }),
+                      }
                     : {}),
                 },
               } as CanonicalEvent;

package/src/protocol/stream-error-frames.ts

@@ -2,11 +2,10 @@
  * OpenAI-family in-stream error frames → typed `GatewayError`.
  *
  * A `200 OK` whose SSE body carries an explicit error envelope is an upstream
- * failure that arrived *after* the status line. The chat, responses, and codex
- * decoders used to record it only as a terminal `state: "failed"`, which left
- * the client with no `error.code`, no message, and telemetry with the
- * `unknown_error` category — while the Claude (`messages.ts`) and Gemini
- * decoders already threw for the identical event. This module is the one
+ * failure that arrived *after* the status line. Recording it only as a terminal
+ * `state: "failed"` leaves the client with no `error.code`, no message, and
+ * telemetry with the `unknown_error` category — while the Claude (`messages.ts`)
+ * and Gemini decoders throw for the identical event. This module is the one
  * classifier those surfaces share.
  *
  * Classification reads **structured identifiers only** (`error.type`,

package/src/providers/adapters/compatible-adapter.ts

@@ -207,6 +207,9 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
       ...(this.config.chat_token_limit_field === undefined
         ? {}
         : { chatTokenLimitField: this.config.chat_token_limit_field }),
+      ...(context.image_clamp_max_bytes === undefined
+        ? {}
+        : { maxBytesOverride: context.image_clamp_max_bytes }),
     });
     if (
       wireFamily !== "messages" &&

package/src/providers/authentication/jwt-validator.ts

@@ -236,14 +236,13 @@ function jsonResponse(body: unknown): Response {
  *
  * Key fetching, caching, in-flight deduplication, the minimum refresh interval
  * on an unknown `kid`, and `kid`-rotation pickup are all delegated to
- * `jose`'s `createRemoteJWKSet` — the same algorithm this class used to
- * reimplement by hand. `jose` additionally honours each JWK's `use` and
- * `key_ops`, so an encryption key published alongside the signing keys cannot
- * be selected for verification.
+ * `jose`'s `createRemoteJWKSet`. `jose` additionally honours each JWK's `use`
+ * and `key_ops`, so an encryption key published alongside the signing keys
+ * cannot be selected for verification.
  *
  * The algorithm is checked against `SUPPORTED_ALGORITHMS` *before* any key is
- * resolved, so the asymmetric-only allowlist (no `none`, no HMAC) is
- * unchanged by the migration.
+ * resolved, so the asymmetric-only allowlist (no `none`, no HMAC) holds
+ * regardless of what the JWKS publishes.
  */
 export class JwksVerifier {
   readonly #keys: RemoteJWKSet;
@@ -317,10 +316,10 @@ export class JwksVerifier {
 /**
  * One verifier per URL, bounded and time-limited.
  *
- * The registry used to be an unbounded, never-evicted `Map`: every JWKS URL
- * ever seen pinned its verifier — and its key cache — for the process
- * lifetime. A TTL plus a hard entry cap keeps a fleet of issuers from growing
- * it without limit while still sharing a verifier's key cache across calls.
+ * An unbounded, never-evicted registry would pin every JWKS URL ever seen —
+ * and its verifier's key cache — for the process lifetime. A TTL plus a hard
+ * entry cap keeps a fleet of issuers from growing it without limit while still
+ * sharing a verifier's key cache across calls.
  */
 const JWKS_VERIFIER_TTL_MS = 5 * 60 * 1_000;
 const JWKS_VERIFIER_MAX_ENTRIES = 64;

package/src/providers/authentication/oauth-refresh-service.ts

@@ -23,6 +23,7 @@
 import { randomUUID } from "node:crypto";
 import { and, eq, inArray, isNull, lt, or, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { sleep } from "../../shared/sleep";
 import { providerAccounts, providerOauthStates } from "../../persistence/schema";
 import { decryptCredentialToString, encryptCredential } from "../../security/crypto";
 import { invalidateCredentialCache } from "../operations/provider-credential-service";
@@ -258,6 +259,7 @@ async function disableAccount(
       )
       .returning({ id: providerOauthStates.providerAccountId });
     if (leaseRows.length === 0) return;
+    const disabledRecoveryMs = resolveAccountDisabledRecoveryMs();
     await tx
       .update(providerAccounts)
       .set({
@@ -271,13 +273,13 @@ async function disableAccount(
         lastErrorCategory: "auth_invalidated",
         lastErrorAt: new Date(),
         // Carries a recovery deadline so `sweepExpiredCooldowns` can bring this
-        // account back once it elapses. `disabled` used to be terminal, which
-        // parked a credential for good on one definitive rejection; the deadline
-        // is also what distinguishes this (machine-disabled) from an operator's
-        // own disable, which leaves `cooldownUntil` null and is therefore never
-        // swept. See `resolveAccountDisabledRecoveryMs`.
-        ...(resolveAccountDisabledRecoveryMs() > 0
-          ? { cooldownUntil: new Date(Date.now() + resolveAccountDisabledRecoveryMs()) }
+        // account back once it elapses; without one, one definitive rejection
+        // parks the credential for good. The deadline is also what distinguishes
+        // this (machine-disabled) from an operator's own disable, which leaves
+        // `cooldownUntil` null and is therefore never swept. See
+        // `resolveAccountDisabledRecoveryMs`.
+        ...(disabledRecoveryMs > 0
+          ? { cooldownUntil: new Date(Date.now() + disabledRecoveryMs) }
           : {}),
       })
       .where(eq(providerAccounts.id, accountId));
@@ -311,10 +313,6 @@ async function markStaticToken(db: CartethyiaDatabase, accountId: string): Promi
     .where(eq(providerAccounts.id, accountId));
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 function failureMessage(error: unknown): string {
   if (error instanceof Error) return error.message;
   return String(error);

package/src/providers/bundled-discovery-providers.ts

@@ -1,119 +1,122 @@
-import type { ProviderModule } from "./provider-registry";
-import {
-  GENERIC_API_KEY_SPECS,
-  VERSIONED_ROOT_API_KEY_SPECS,
-} from "./configured-openai-providers";
-import { createApiKeyAdapter, type ApiKeyProviderSpec } from "./configured-provider";
-
-/**
- * Providers whose adapter and catalog discovery are the same bearer-auth
- * OpenAI-compatible contract. Providers with static catalogs or additional
- * upstream behavior remain declared beside their special handling.
- */
-export const DISCOVERY_BACKED_PROVIDER_IDS = [
-  "groq",
-  "together",
-  "deepinfra",
-  "siliconflow",
-  "siliconflowcn",
-  "novita",
-  "venice",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "firepass",
-  "zhipucoding",
-  "dashscope",
-  "qianfan",
-] as const;
-
-export type DiscoveryBackedProviderId = (typeof DISCOVERY_BACKED_PROVIDER_IDS)[number];
-
-type DiscoveryBackedCapabilities = Pick<
-  ProviderModule,
-  "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
->;
-
-type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
-type OpenAIModelDiscoveryFactory = (
-  providerId: string,
-  options?: {
-    readonly headers?: (credential: string) => Readonly<Record<string, string>>;
-  },
-) => ModelDiscoveryFactory;
-
-const DISCOVERY_BACKED_PROVIDER_SPECS = {
-  groq: VERSIONED_ROOT_API_KEY_SPECS.groq,
-  together: GENERIC_API_KEY_SPECS.together,
-  deepinfra: VERSIONED_ROOT_API_KEY_SPECS.deepinfra,
-  siliconflow: GENERIC_API_KEY_SPECS.siliconflow,
-  siliconflowcn: GENERIC_API_KEY_SPECS.siliconflowcn,
-  novita: VERSIONED_ROOT_API_KEY_SPECS.novita,
-  venice: VERSIONED_ROOT_API_KEY_SPECS.venice,
-  nanogpt: GENERIC_API_KEY_SPECS.nanogpt,
-  baseten: GENERIC_API_KEY_SPECS.baseten,
-  synthetic: GENERIC_API_KEY_SPECS.synthetic,
-  stepfun: GENERIC_API_KEY_SPECS.stepfun,
-  sakana: GENERIC_API_KEY_SPECS.sakana,
-  helmcode: GENERIC_API_KEY_SPECS.helmcode,
-  coralbricks: GENERIC_API_KEY_SPECS.coralbricks,
-  aiand: GENERIC_API_KEY_SPECS.aiand,
-  wafer: GENERIC_API_KEY_SPECS.wafer,
-  firepass: VERSIONED_ROOT_API_KEY_SPECS.firepass,
-  zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
-  dashscope: GENERIC_API_KEY_SPECS.dashscope,
-  qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
-} satisfies Readonly<Record<DiscoveryBackedProviderId, ApiKeyProviderSpec>>;
-
-function discoveryBackedCapabilities(
-  providerId: DiscoveryBackedProviderId,
-  spec: ApiKeyProviderSpec,
-  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
-): DiscoveryBackedCapabilities {
-  return {
-    ...(spec.endpoint_paths_by_wire_family === undefined
-      ? {}
-      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
-    loadAdapter: async () => createApiKeyAdapter(spec),
-    loadModelDiscovery: openAIModelDiscovery(providerId, {
-      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
-    }),
-  };
-}
-
-/**
- * Creates the standard provider capability table using the registry's shared
- * discovery loader, keeping its lazy import and authentication behavior intact.
- */
-export function createDiscoveryBackedProviderCapabilities(
-  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
-): Readonly<Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>> {
-  return {
-    groq: discoveryBackedCapabilities("groq", DISCOVERY_BACKED_PROVIDER_SPECS.groq, openAIModelDiscovery),
-    together: discoveryBackedCapabilities("together", DISCOVERY_BACKED_PROVIDER_SPECS.together, openAIModelDiscovery),
-    deepinfra: discoveryBackedCapabilities("deepinfra", DISCOVERY_BACKED_PROVIDER_SPECS.deepinfra, openAIModelDiscovery),
-    siliconflow: discoveryBackedCapabilities("siliconflow", DISCOVERY_BACKED_PROVIDER_SPECS.siliconflow, openAIModelDiscovery),
-    siliconflowcn: discoveryBackedCapabilities("siliconflowcn", DISCOVERY_BACKED_PROVIDER_SPECS.siliconflowcn, openAIModelDiscovery),
-    novita: discoveryBackedCapabilities("novita", DISCOVERY_BACKED_PROVIDER_SPECS.novita, openAIModelDiscovery),
-    venice: discoveryBackedCapabilities("venice", DISCOVERY_BACKED_PROVIDER_SPECS.venice, openAIModelDiscovery),
-    nanogpt: discoveryBackedCapabilities("nanogpt", DISCOVERY_BACKED_PROVIDER_SPECS.nanogpt, openAIModelDiscovery),
-    baseten: discoveryBackedCapabilities("baseten", DISCOVERY_BACKED_PROVIDER_SPECS.baseten, openAIModelDiscovery),
-    synthetic: discoveryBackedCapabilities("synthetic", DISCOVERY_BACKED_PROVIDER_SPECS.synthetic, openAIModelDiscovery),
-    stepfun: discoveryBackedCapabilities("stepfun", DISCOVERY_BACKED_PROVIDER_SPECS.stepfun, openAIModelDiscovery),
-    sakana: discoveryBackedCapabilities("sakana", DISCOVERY_BACKED_PROVIDER_SPECS.sakana, openAIModelDiscovery),
-    helmcode: discoveryBackedCapabilities("helmcode", DISCOVERY_BACKED_PROVIDER_SPECS.helmcode, openAIModelDiscovery),
-    coralbricks: discoveryBackedCapabilities("coralbricks", DISCOVERY_BACKED_PROVIDER_SPECS.coralbricks, openAIModelDiscovery),
-    aiand: discoveryBackedCapabilities("aiand", DISCOVERY_BACKED_PROVIDER_SPECS.aiand, openAIModelDiscovery),
-    wafer: discoveryBackedCapabilities("wafer", DISCOVERY_BACKED_PROVIDER_SPECS.wafer, openAIModelDiscovery),
-    firepass: discoveryBackedCapabilities("firepass", DISCOVERY_BACKED_PROVIDER_SPECS.firepass, openAIModelDiscovery),
-    zhipucoding: discoveryBackedCapabilities("zhipucoding", DISCOVERY_BACKED_PROVIDER_SPECS.zhipucoding, openAIModelDiscovery),
-    dashscope: discoveryBackedCapabilities("dashscope", DISCOVERY_BACKED_PROVIDER_SPECS.dashscope, openAIModelDiscovery),
-    qianfan: discoveryBackedCapabilities("qianfan", DISCOVERY_BACKED_PROVIDER_SPECS.qianfan, openAIModelDiscovery),
-  };
-}
+import type { ProviderModule } from "./provider-registry";
+import {
+  GENERIC_API_KEY_SPECS,
+  VERSIONED_ROOT_API_KEY_SPECS,
+} from "./configured-openai-providers";
+import { createApiKeyAdapter, type ApiKeyProviderSpec } from "./configured-provider";
+
+/**
+ * Providers whose adapter and catalog discovery are the same bearer-auth
+ * OpenAI-compatible contract. Providers with static catalogs or additional
+ * upstream behavior remain declared beside their special handling.
+ */
+export const DISCOVERY_BACKED_PROVIDER_IDS = [
+  "groq",
+  "together",
+  "deepinfra",
+  "siliconflow",
+  "siliconflowcn",
+  "novita",
+  "larprouter",
+  "venice",
+  "nanogpt",
+  "baseten",
+  "synthetic",
+  "stepfun",
+  "sakana",
+  "helmcode",
+  "coralbricks",
+  "aiand",
+  "wafer",
+  "firepass",
+  "zhipucoding",
+  "dashscope",
+  "qianfan",
+] as const;
+
+export type DiscoveryBackedProviderId = (typeof DISCOVERY_BACKED_PROVIDER_IDS)[number];
+
+type DiscoveryBackedCapabilities = Pick<
+  ProviderModule,
+  "endpointPathsByWireFamily" | "loadAdapter" | "loadModelDiscovery"
+>;
+
+type ModelDiscoveryFactory = NonNullable<ProviderModule["loadModelDiscovery"]>;
+type OpenAIModelDiscoveryFactory = (
+  providerId: string,
+  options?: {
+    readonly headers?: (credential: string) => Readonly<Record<string, string>>;
+  },
+) => ModelDiscoveryFactory;
+
+const DISCOVERY_BACKED_PROVIDER_SPECS = {
+  groq: VERSIONED_ROOT_API_KEY_SPECS.groq,
+  larprouter: GENERIC_API_KEY_SPECS.larprouter,
+  together: GENERIC_API_KEY_SPECS.together,
+  deepinfra: VERSIONED_ROOT_API_KEY_SPECS.deepinfra,
+  siliconflow: GENERIC_API_KEY_SPECS.siliconflow,
+  siliconflowcn: GENERIC_API_KEY_SPECS.siliconflowcn,
+  novita: VERSIONED_ROOT_API_KEY_SPECS.novita,
+  venice: VERSIONED_ROOT_API_KEY_SPECS.venice,
+  nanogpt: GENERIC_API_KEY_SPECS.nanogpt,
+  baseten: GENERIC_API_KEY_SPECS.baseten,
+  synthetic: GENERIC_API_KEY_SPECS.synthetic,
+  stepfun: GENERIC_API_KEY_SPECS.stepfun,
+  sakana: GENERIC_API_KEY_SPECS.sakana,
+  helmcode: GENERIC_API_KEY_SPECS.helmcode,
+  coralbricks: GENERIC_API_KEY_SPECS.coralbricks,
+  aiand: GENERIC_API_KEY_SPECS.aiand,
+  wafer: GENERIC_API_KEY_SPECS.wafer,
+  firepass: VERSIONED_ROOT_API_KEY_SPECS.firepass,
+  zhipucoding: VERSIONED_ROOT_API_KEY_SPECS.zhipucoding,
+  dashscope: GENERIC_API_KEY_SPECS.dashscope,
+  qianfan: VERSIONED_ROOT_API_KEY_SPECS.qianfan,
+} satisfies Readonly<Record<DiscoveryBackedProviderId, ApiKeyProviderSpec>>;
+
+function discoveryBackedCapabilities(
+  providerId: DiscoveryBackedProviderId,
+  spec: ApiKeyProviderSpec,
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): DiscoveryBackedCapabilities {
+  return {
+    ...(spec.endpoint_paths_by_wire_family === undefined
+      ? {}
+      : { endpointPathsByWireFamily: spec.endpoint_paths_by_wire_family }),
+    loadAdapter: async () => createApiKeyAdapter(spec),
+    loadModelDiscovery: openAIModelDiscovery(providerId, {
+      headers: (credential) => ({ authorization: `Bearer ${credential}` }),
+    }),
+  };
+}
+
+/**
+ * Creates the standard provider capability table using the registry's shared
+ * discovery loader, keeping its lazy import and authentication behavior intact.
+ */
+export function createDiscoveryBackedProviderCapabilities(
+  openAIModelDiscovery: OpenAIModelDiscoveryFactory,
+): Readonly<Record<DiscoveryBackedProviderId, DiscoveryBackedCapabilities>> {
+  return {
+    groq: discoveryBackedCapabilities("groq", DISCOVERY_BACKED_PROVIDER_SPECS.groq, openAIModelDiscovery),
+    together: discoveryBackedCapabilities("together", DISCOVERY_BACKED_PROVIDER_SPECS.together, openAIModelDiscovery),
+    deepinfra: discoveryBackedCapabilities("deepinfra", DISCOVERY_BACKED_PROVIDER_SPECS.deepinfra, openAIModelDiscovery),
+    siliconflow: discoveryBackedCapabilities("siliconflow", DISCOVERY_BACKED_PROVIDER_SPECS.siliconflow, openAIModelDiscovery),
+    siliconflowcn: discoveryBackedCapabilities("siliconflowcn", DISCOVERY_BACKED_PROVIDER_SPECS.siliconflowcn, openAIModelDiscovery),
+    novita: discoveryBackedCapabilities("novita", DISCOVERY_BACKED_PROVIDER_SPECS.novita, openAIModelDiscovery),
+    larprouter: discoveryBackedCapabilities("larprouter", DISCOVERY_BACKED_PROVIDER_SPECS.larprouter, openAIModelDiscovery),
+    venice: discoveryBackedCapabilities("venice", DISCOVERY_BACKED_PROVIDER_SPECS.venice, openAIModelDiscovery),
+    nanogpt: discoveryBackedCapabilities("nanogpt", DISCOVERY_BACKED_PROVIDER_SPECS.nanogpt, openAIModelDiscovery),
+    baseten: discoveryBackedCapabilities("baseten", DISCOVERY_BACKED_PROVIDER_SPECS.baseten, openAIModelDiscovery),
+    synthetic: discoveryBackedCapabilities("synthetic", DISCOVERY_BACKED_PROVIDER_SPECS.synthetic, openAIModelDiscovery),
+    stepfun: discoveryBackedCapabilities("stepfun", DISCOVERY_BACKED_PROVIDER_SPECS.stepfun, openAIModelDiscovery),
+    sakana: discoveryBackedCapabilities("sakana", DISCOVERY_BACKED_PROVIDER_SPECS.sakana, openAIModelDiscovery),
+    helmcode: discoveryBackedCapabilities("helmcode", DISCOVERY_BACKED_PROVIDER_SPECS.helmcode, openAIModelDiscovery),
+    coralbricks: discoveryBackedCapabilities("coralbricks", DISCOVERY_BACKED_PROVIDER_SPECS.coralbricks, openAIModelDiscovery),
+    aiand: discoveryBackedCapabilities("aiand", DISCOVERY_BACKED_PROVIDER_SPECS.aiand, openAIModelDiscovery),
+    wafer: discoveryBackedCapabilities("wafer", DISCOVERY_BACKED_PROVIDER_SPECS.wafer, openAIModelDiscovery),
+    firepass: discoveryBackedCapabilities("firepass", DISCOVERY_BACKED_PROVIDER_SPECS.firepass, openAIModelDiscovery),
+    zhipucoding: discoveryBackedCapabilities("zhipucoding", DISCOVERY_BACKED_PROVIDER_SPECS.zhipucoding, openAIModelDiscovery),
+    dashscope: discoveryBackedCapabilities("dashscope", DISCOVERY_BACKED_PROVIDER_SPECS.dashscope, openAIModelDiscovery),
+    qianfan: discoveryBackedCapabilities("qianfan", DISCOVERY_BACKED_PROVIDER_SPECS.qianfan, openAIModelDiscovery),
+  };
+}

package/src/providers/configured-openai-providers.ts

@@ -16,6 +16,7 @@ import type { ProviderId } from "./provider-contracts";
  * pairs this spec with `openAIModelDiscovery`.
  */
 export const GENERIC_API_KEY_PROVIDER_IDS = [
+  "larprouter",
   "mistral",
   "fireworks",
   "nvidia",
@@ -104,14 +105,13 @@ export type GenericApiKeyProviderId = (typeof GENERIC_API_KEY_PROVIDER_IDS)[numb
 
 function genericApiKeySpec(providerId: GenericApiKeyProviderId): ApiKeyProviderSpec {
   // These roots are *not* bare hosts — every one of them already ends at `/v1`
-  // — so the path is declared below that root. It used to be pinned from
-  // `BARE_ROOT_ENDPOINTS` and silently corrected at dispatch, which meant the
-  // declared path was wrong for all of them and nothing said so. Both spec
-  // shapes now declare the same thing, so this is the one implementation.
+  // — so the path is declared below that root. Both spec shapes declare the same
+  // thing, so this is the one implementation.
   return versionedRootApiKeySpec(providerId);
 }
 
 export const GENERIC_API_KEY_SPECS = {
+  larprouter: genericApiKeySpec("larprouter"),
   mistral: genericApiKeySpec("mistral"),
   fireworks: genericApiKeySpec("fireworks"),
   nvidia: genericApiKeySpec("nvidia"),