ghc-proxy 0.9.0 → 0.9.2

package/dist/main.mjs

@@ -8,7 +8,7 @@ import fs, { mkdir, readdir, unlink, writeFile } from "node:fs/promises";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
-import nodeHTTP from "node:http";
+import nodeHTTP, { createServer } from "node:http";
 import { PassThrough, Readable } from "node:stream";
 import nodeHTTP2 from "node:http2";
 import nodeHTTPS from "node:https";
@@ -5769,7 +5769,9 @@ const configFileSchema = object({
 		to: string()
 	})).optional(),
 	upstreamQueueConcurrency: number().int().positive().optional(),
-	upstreamQueueMaxRetries: number().int().nonnegative().optional(),
+	upstreamQueueMaxRetries: number().int().min(0).max(2).optional(),
+	upstreamRecoveryBudgetSeconds: number().int().min(1).max(120).optional(),
+	overloadFallbacks: record(string(), string()).optional(),
 	upstreamQueueBaseDelaySeconds: number().int().nonnegative().optional(),
 	upstreamQueueMaxDelaySeconds: number().int().positive().optional(),
 	gheDomain: string().optional()
@@ -5798,12 +5800,12 @@ async function readConfig() {
 				const fieldResult = schema.safeParse(rawObj[key]);
 				if (fieldResult.success) partial[key] = fieldResult.data;
 			}
-			cachedConfig = partial;
+			cachedConfig = sanitizeConfig(partial);
 			return cachedConfig;
 		}
 		const unknownKeys = Object.keys(raw).filter((key) => !KNOWN_CONFIG_KEYS.has(key));
 		if (unknownKeys.length > 0) consola.warn(`config.json contains unknown fields: ${unknownKeys.join(", ")}`);
-		cachedConfig = result.data;
+		cachedConfig = sanitizeConfig(result.data);
 		return cachedConfig;
 	} catch (error) {
 		if (error.code === "ENOENT") {
@@ -5815,6 +5817,33 @@ async function readConfig() {
 		return {};
 	}
 }
+function sanitizeConfig(config) {
+	if (!config.overloadFallbacks) return config;
+	const normalizedFallbacks = {};
+	const invalidSources = [];
+	for (const [source, target] of Object.entries(config.overloadFallbacks)) {
+		const normalizedSource = source.trim();
+		const normalizedTarget = target.trim();
+		if (!normalizedSource || !normalizedTarget || normalizedSource === normalizedTarget) {
+			invalidSources.push(source || "<blank>");
+			continue;
+		}
+		normalizedFallbacks[normalizedSource] = normalizedTarget;
+	}
+	const overloadFallbacks = {};
+	for (const [source, target] of Object.entries(normalizedFallbacks)) {
+		if (normalizedFallbacks[target] === source) {
+			invalidSources.push(source);
+			continue;
+		}
+		overloadFallbacks[source] = target;
+	}
+	if (invalidSources.length > 0) consola.warn(`config.json contains invalid overloadFallbacks entries: ${invalidSources.join(", ")}. Ignoring those entries.`);
+	return {
+		...config,
+		overloadFallbacks
+	};
+}
 function getCachedConfig() {
 	return cachedConfig;
 }
@@ -5898,6 +5927,12 @@ var ConfigStore = class {
 	getModelFallback() {
 		return getCachedConfig().modelFallback;
 	}
+	getOverloadFallback(sourceModel) {
+		return getCachedConfig().overloadFallbacks?.[sourceModel];
+	}
+	hasOverloadFallbacks() {
+		return Object.keys(getCachedConfig().overloadFallbacks ?? {}).length > 0;
+	}
 };
 const configStore = new ConfigStore();
 //#endregion
@@ -5996,18 +6031,80 @@ var TranslationFailure = class extends Error {
 	}
 };
 //#endregion
+//#region src/lib/timeout-error.ts
+/**
+* Whether an error represents a request that timed out or was aborted.
+*
+* The shape differs by runtime, so the check is structural rather than a
+* single `name` comparison:
+* - Bun rejects with a flat `DOMException` named `TimeoutError` (its ~300s
+*   `fetch` ceiling, `AbortSignal.timeout`) or `AbortError`.
+* - Node rejects with `TypeError('fetch failed' | 'terminated')` and puts the
+*   real undici error on `.cause` (`HeadersTimeoutError`, `BodyTimeoutError`,
+*   `ConnectTimeoutError`), so the top-level error carries no signal at all —
+*   `TypeError('fetch failed')` is also what `ECONNREFUSED` and DNS failures
+*   look like. The discriminator is the cause's `name`/`code`.
+*
+* Both runtimes enforce a ~300s upstream ceiling by default (Node's is
+* undici's `headersTimeout`/`bodyTimeout` default of `300e3`). It is an
+* **idle** timer on both, not a total-duration cap: it resets on every byte, so
+* it fires on a stalled stream well before the configured `--upstream-timeout`
+* of 1800s, and never on one that keeps streaming. See
+* `docs/design/streaming.md`.
+*
+* Kept in one place because the rule is checked on both sides of the stream
+* boundary: `src/server.ts` maps it to a 504 before the first byte, and the
+* Anthropic stream transducer maps it to an SSE error frame after. Two
+* implementations of "what counts as a timeout" is how one of them ends up
+* recognizing only half the errors.
+*/
+const TIMEOUT_ERROR_NAMES = new Set([
+	"AbortError",
+	"TimeoutError",
+	"ConnectTimeoutError",
+	"HeadersTimeoutError",
+	"BodyTimeoutError"
+]);
+const TIMEOUT_ERROR_CODES = new Set([
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT",
+	"ETIMEDOUT"
+]);
+const MAX_CAUSE_DEPTH = 5;
+function errorCauseChainSome(value, predicate, depth = 0) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	if (predicate(candidate)) return true;
+	if (depth >= MAX_CAUSE_DEPTH) return false;
+	if (errorCauseChainSome(candidate.cause, predicate, depth + 1)) return true;
+	return Array.isArray(candidate.errors) && candidate.errors.some((inner) => errorCauseChainSome(inner, predicate, depth + 1));
+}
+function isTimeoutLikeError(error) {
+	try {
+		return errorCauseChainSome(error, (candidate) => typeof candidate.name === "string" && TIMEOUT_ERROR_NAMES.has(candidate.name) || typeof candidate.code === "string" && TIMEOUT_ERROR_CODES.has(candidate.code));
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/lib/error.ts
 var HTTPError = class extends Error {
 	status;
 	body;
-	constructor(status, body) {
+	headers;
+	constructor(status, body, options = {}) {
 		super(body.error.message);
 		this.name = "HTTPError";
 		this.status = status;
 		this.body = body;
+		this.headers = new Headers(options.headers);
 	}
 	toResponse() {
-		return Response.json(this.body, { status: this.status });
+		return Response.json(this.body, {
+			status: this.status,
+			headers: this.headers
+		});
 	}
 };
 const TRANSIENT_UPSTREAM_STATUSES = new Set([
@@ -6027,13 +6124,29 @@ const TRANSIENT_UPSTREAM_STATUSES = new Set([
 function isTransientUpstreamStatus(status) {
 	return TRANSIENT_UPSTREAM_STATUSES.has(status);
 }
-/**
-* Capacity signals that apply to the whole account or service rather than one
-* request. Only these warrant global back-pressure — applying a queue-wide
-* cooldown to a request-scoped 5xx turns one bad request into a proxy stall.
-*/
-function isCapacityLimitStatus(status) {
-	return status === 429 || status === 529;
+function resolveCapacityCooldownScope(status, effectiveModel) {
+	if (status === 429) return "account";
+	if (status === 529) return effectiveModel ? "model" : "request";
+}
+const CONNECTION_ESTABLISHMENT_CODES = {
+	ENOTFOUND: "dns",
+	EAI_AGAIN: "dns",
+	ECONNREFUSED: "connection-refused",
+	ConnectionRefused: "connection-refused"
+};
+function isRetryableConnectionEstablishmentError(error) {
+	if (isTimeoutLikeError(error)) return void 0;
+	let connectionClass;
+	try {
+		errorCauseChainSome(error, (candidate) => {
+			if (typeof candidate.code !== "string") return false;
+			connectionClass = CONNECTION_ESTABLISHMENT_CODES[candidate.code];
+			return connectionClass !== void 0;
+		});
+	} catch {
+		return;
+	}
+	return connectionClass;
 }
 /**
 * Reject a request locally with a 400.
@@ -6133,7 +6246,8 @@ async function throwUpstreamError(message, response) {
 		rawBody: rawText ? previewBody(rawText) : "<empty>",
 		headers: getDiagnosticHeaders(response)
 	});
-	throw new HTTPError(response.status, body);
+	const retryAfter = response.headers.get("retry-after");
+	throw new HTTPError(response.status, body, retryAfter ? { headers: { "retry-after": retryAfter } } : void 0);
 }
 //#endregion
 //#region src/util/sleep.ts
@@ -6579,17 +6693,896 @@ const GITHUB_BASE_URL = "https://github.com";
 const GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98";
 const GITHUB_APP_SCOPES = ["read:user"].join(" ");
 //#endregion
+//#region src/util/duration.ts
+/**
+* Formats a millisecond duration as a compact human-readable string:
+* `<n>ms` under one second, otherwise `<n>s` rounded to whole seconds.
+*/
+function formatDurationMs(ms) {
+	return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
+}
+//#endregion
+//#region src/lib/request-logger.ts
+/**
+* Per-request model mapping store.
+* Route handlers write to this; the after-response hook reads from it.
+* Uses WeakMap so entries are GC'd when the Request is collected.
+*/
+const requestModelMapping = /* @__PURE__ */ new WeakMap();
+const requestCorrelation = /* @__PURE__ */ new WeakMap();
+/**
+* Per-request start timestamp for the access log.
+*
+* Keyed on the `Request` the same way `requestCorrelation` is, so entries are
+* GC'd with it. This lives here rather than in `derive()` because `derive` does
+* not run on a route Elysia never matched — `onRequest` does, and it preserves
+* `Request` identity through to `onAfterResponse`. Reading a missing `derive`
+* value is what rendered every unmatched route's duration as the literal string
+* `NaNs`.
+*
+* That lifecycle behavior was measured once by hand on Bun 1.3.14 and on Node
+* 24.18 via `@elysiajs/node`. **The automated suite runs only under Bun**, so
+* the Node half is a point-in-time observation rather than standing coverage —
+* see `docs/solutions/testing/green-suite-is-evidence-about-one-runtime.md`. If
+* the Node adapter ever stops firing `onRequest` on an unmatched path, or
+* re-wraps the `Request` between hooks, the lookup misses and the duration
+* silently degrades to `-` on that runtime with a green suite.
+*/
+const requestStartTimes = /* @__PURE__ */ new WeakMap();
+/**
+* Record when a request arrived. Called from `onRequest`, which fires on every
+* path including ones no route matches.
+*
+* The `void` return type is load-bearing, not decoration. `WeakMap.set` returns
+* the WeakMap, and Elysia turns any non-undefined `onRequest` return into the
+* response body — a setter written as a concise arrow over `.set()` makes every
+* response in the proxy the string `[object WeakMap]`. `tsc` does not catch it.
+*/
+function markRequestStart(request) {
+	requestStartTimes.set(request, Date.now());
+}
+function getRequestStart(request) {
+	return requestStartTimes.get(request);
+}
+function getOrCreateRequestCorrelation(request) {
+	const existing = requestCorrelation.get(request);
+	if (existing) return existing;
+	const requestId = crypto.randomUUID();
+	const callerRequestId = request.headers.get("x-request-id") ?? void 0;
+	const correlation = {
+		requestId,
+		...callerRequestId ? { callerRequestId } : {},
+		responseRequestId: callerRequestId ?? requestId
+	};
+	requestCorrelation.set(request, correlation);
+	return correlation;
+}
+const MAX_LOGGED_CALLER_REQUEST_ID_LENGTH = 128;
+const UNSAFE_CALLER_REQUEST_ID_CHARACTERS = /[^\w.:@/-]/g;
+function sanitizeCallerRequestId(value) {
+	return value ? value.replace(UNSAFE_CALLER_REQUEST_ID_CHARACTERS, "_").slice(0, MAX_LOGGED_CALLER_REQUEST_ID_LENGTH) : void 0;
+}
+const RECOVERY_EVENT_OPTIONAL_FIELDS = [
+	"retryCount",
+	"status",
+	"connectionClass",
+	"effectiveModel",
+	"scope",
+	"activeSlots",
+	"maxSlots",
+	"pendingDepth",
+	"maxPendingDepth",
+	"queueWaitMs",
+	"delaySource",
+	"delayMs",
+	"elapsedMs",
+	"remainingBudgetMs",
+	"nextRetryAt",
+	"decision"
+];
+function logRecoveryEvent(input, logger = consola) {
+	const callerRequestId = sanitizeCallerRequestId(input.callerRequestId);
+	const fields = {
+		requestId: input.requestId,
+		...callerRequestId ? { callerRequestId } : {},
+		event: input.event
+	};
+	for (const key of RECOVERY_EVENT_OPTIONAL_FIELDS) if (input[key] !== void 0) Object.assign(fields, { [key]: input[key] });
+	logger.info("Upstream recovery", fields);
+}
+function setRequestModelMapping(request, info) {
+	requestModelMapping.set(request, info);
+}
+function getRequestModelMapping(request) {
+	return requestModelMapping.get(request);
+}
+/**
+* Format how long a request took, given the timestamp recorded at arrival.
+*
+* Renders `-` rather than a number when the start is missing or the arithmetic
+* is not finite. The caller is expected to supply a real start (see
+* {@link markRequestStart}); this is the shared-formatter backstop, so a future
+* code path that skips the `onRequest` hook degrades to an honest `-` instead
+* of printing `NaNs`.
+*/
+function formatElapsed(start) {
+	if (start === void 0) return "-";
+	const elapsed = Date.now() - start;
+	return Number.isFinite(elapsed) ? formatDurationMs(elapsed) : "-";
+}
+function formatPath(rawUrl) {
+	try {
+		const url = new URL(rawUrl);
+		return `${url.pathname}${url.search}`;
+	} catch {
+		return rawUrl;
+	}
+}
+function colorizeStatus(status) {
+	if (status >= 500) return colorize("red", status);
+	if (status >= 400) return colorize("yellow", status);
+	if (status >= 300) return colorize("cyan", status);
+	return colorize("green", status);
+}
+const methodColors = {
+	GET: "cyan",
+	POST: "magenta",
+	PUT: "yellow",
+	PATCH: "yellow",
+	DELETE: "red"
+};
+function colorizeMethod(method) {
+	return colorize(methodColors[method] ?? "white", method);
+}
+function getEffectiveModel(info) {
+	return info.steps.length > 0 ? info.steps.at(-1).to : info.originalModel ?? "-";
+}
+/**
+* Mutate `modelMapping` in place by appending a transform step.
+* Strategy contexts hold a reference to the same `modelMapping`,
+* so steps are pushed directly rather than returning a new object.
+*/
+function appendModelStepInPlace(info, tag, newModel) {
+	const current = getEffectiveModel(info);
+	if (newModel !== current) info.steps.push({
+		tag,
+		from: current,
+		to: newModel
+	});
+}
+function formatModelMapping(info) {
+	if (!info) return "";
+	const { originalModel, steps } = info;
+	if (!originalModel && steps.length === 0) return "";
+	const parts = [colorize("blueBright", originalModel ?? "-")];
+	for (let i = 0; i < steps.length; i++) {
+		const step = steps[i];
+		const isLast = i === steps.length - 1;
+		parts.push(colorize("dim", `-[${step.tag}]->`));
+		parts.push(colorize(isLast ? "greenBright" : "cyanBright", step.to));
+	}
+	return ` ${colorize("dim", "model=")}${parts.join(" ")}`;
+}
+/**
+* Request logging function.
+* Logs a formatted request line with method, path, status, elapsed time,
+* and optional model mapping info.
+*/
+function logRequest(method, url, status, elapsed, modelInfo, requestId, callerRequestId) {
+	const path = formatPath(url);
+	const line = [
+		colorize("dim", "<-"),
+		colorizeMethod(method),
+		colorize("white", path),
+		colorizeStatus(status),
+		colorize("dim", elapsed)
+	].join(" ");
+	const rid = requestId ? ` ${colorize("dim", `rid=${requestId.slice(0, 8)}`)}` : "";
+	const safeCallerRequestId = sanitizeCallerRequestId(callerRequestId);
+	const callerRid = safeCallerRequestId ? ` ${colorize("dim", `callerRid=${safeCallerRequestId}`)}` : "";
+	console.log(`${line}${formatModelMapping(modelInfo)}${rid}${callerRid}`);
+}
+//#endregion
+//#region src/clients/upstream-queue.ts
+const DEFAULT_UPSTREAM_QUEUE_OPTIONS = {
+	concurrency: 10,
+	maxRetries: 1,
+	baseDelayMs: 2e3,
+	maxDelayMs: 6e4,
+	maxQueueDepth: 1e3,
+	recoveryBudgetMs: 60 * 1e3
+};
+const MAX_TIMER_DELAY_MS = 2147483647;
+const RETRY_AFTER_SECONDS_RE = /^\d+(?:\.\d+)?$/;
+const RETRY_AFTER_HTTP_DATE_RE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+var TerminalUpstreamRecoveryError = class extends HTTPError {
+	recovery;
+	fallbackClaimed = false;
+	constructor(source, recovery) {
+		super(source.status, source.body, { headers: source.headers });
+		this.name = "TerminalUpstreamRecoveryError";
+		this.recovery = recovery;
+	}
+	claimFallback() {
+		if (this.fallbackClaimed) return false;
+		this.fallbackClaimed = true;
+		return true;
+	}
+};
+var LocalModelCooldownError = class extends TerminalUpstreamRecoveryError {
+	constructor(recovery, retryAfter) {
+		super(new HTTPError(529, { error: {
+			message: "The selected upstream model is temporarily overloaded.",
+			type: "overloaded_error"
+		} }, { headers: { "retry-after": retryAfter } }), recovery);
+		this.name = "LocalModelCooldownError";
+	}
+};
+var FallbackCooldownError = class extends Error {
+	scope;
+	effectiveModel;
+	constructor(cooldown) {
+		super("Fallback target is locally cooled");
+		this.name = "FallbackCooldownError";
+		this.scope = cooldown.scope;
+		this.effectiveModel = cooldown.effectiveModel;
+	}
+};
+var UpstreamRequestQueue = class {
+	sleep;
+	now;
+	wallNow;
+	random;
+	logger;
+	setTimer;
+	clearTimer;
+	options;
+	active = 0;
+	accountNotBefore = 0;
+	modelNotBefore = /* @__PURE__ */ new Map();
+	drainTimer;
+	drainTimerAt;
+	waiters = [];
+	terminalRecoveries = /* @__PURE__ */ new WeakSet();
+	constructor(options = {}, deps = {}) {
+		this.options = normalizeOptions(options);
+		this.sleep = deps.sleep;
+		this.now = deps.now ?? (() => performance.now());
+		this.wallNow = deps.wallNow ?? Date.now;
+		this.random = deps.random ?? Math.random;
+		this.logger = deps.logger ?? consola;
+		this.setTimer = deps.setTimeout ?? globalThis.setTimeout;
+		this.clearTimer = deps.clearTimeout ?? globalThis.clearTimeout;
+	}
+	updateOptions(options) {
+		this.options = normalizeOptions(mergeDefinedOptions(this.options, options));
+		this.drain();
+	}
+	async dispatch(fetcher, inputContext, signal) {
+		const recovery = inputContext.recovery ?? {
+			requestId: crypto.randomUUID(),
+			...signal ? { callerSignal: signal } : {},
+			retryCount: 0
+		};
+		const context = {
+			...inputContext,
+			recovery
+		};
+		recovery.sourceModel ??= context.effectiveModel;
+		signal?.throwIfAborted();
+		this.throwIfFallbackCooled(context);
+		const localCooldown = this.getActiveCooldown(context.effectiveModel);
+		if ((typeof context.offerLocalModelCooldown === "function" ? Boolean(context.effectiveModel && context.offerLocalModelCooldown(context.effectiveModel)) : context.offerLocalModelCooldown) && localCooldown?.scope === "model" && localCooldown.notBeforeMonotonicMs > this.now()) {
+			this.startRecovery(recovery);
+			this.setRecoveryCooldown(recovery, localCooldown);
+			const retryAfter = formatRetryAfter(localCooldown.notBeforeMonotonicMs - this.now());
+			recovery.publicError = {
+				status: 529,
+				retryAfter
+			};
+			this.emitTerminal("retry", context, {
+				retryCount: recovery.retryCount,
+				status: 529,
+				scope: "model",
+				decision: "local-cooldown"
+			});
+			throw new LocalModelCooldownError(recovery, retryAfter);
+		}
+		try {
+			return await this.runDispatch(fetcher, context, signal);
+		} catch (error) {
+			const connectionClass = isRetryableConnectionEstablishmentError(error);
+			if (recovery.callerSignal?.aborted) this.emitTerminal(recovery.startedAtMonotonicMs === void 0 ? "admission" : "retry", context, {
+				retryCount: recovery.retryCount,
+				decision: "cancelled"
+			});
+			else if (signal?.aborted) this.emitTerminal("budget", context, {
+				retryCount: recovery.retryCount,
+				status: 504,
+				decision: "deadline-exceeded"
+			});
+			else if (error instanceof HTTPError && error.status === 504 || this.remainingBudget(recovery) === 0) this.emitTerminal("budget", context, {
+				retryCount: recovery.retryCount,
+				status: error instanceof HTTPError ? error.status : void 0,
+				decision: "deadline-exceeded"
+			});
+			else if (connectionClass && !this.canRetry(recovery)) this.emitTerminal("retry", context, {
+				retryCount: recovery.retryCount,
+				connectionClass,
+				decision: "retry-exhausted"
+			});
+			else if (recovery.startedAtMonotonicMs !== void 0) this.emitTerminal("retry", context, {
+				retryCount: recovery.retryCount,
+				status: error instanceof HTTPError ? error.status : void 0,
+				connectionClass,
+				decision: "failed"
+			});
+			throw error;
+		}
+	}
+	async runDispatch(fetcher, context, signal) {
+		const { recovery } = context;
+		let lastConnectionError;
+		for (;;) {
+			signal?.throwIfAborted();
+			this.throwIfRecoveryExpired(recovery, lastConnectionError);
+			const lease = await this.acquire(context, signal, lastConnectionError);
+			let response;
+			try {
+				this.throwIfRecoveryExpired(recovery, lastConnectionError);
+				if (context.fallbackAttempt) recovery.fallbackFetchStarted = true;
+				response = await this.fetchBeforeDeadline(fetcher, signal, recovery, lastConnectionError);
+				lastConnectionError = void 0;
+			} catch (error) {
+				lease.release();
+				if (signal?.aborted) throw signal.reason;
+				if (error instanceof RecoveryBudgetError) throw error.cause ?? error;
+				const connectionClass = isRetryableConnectionEstablishmentError(error);
+				if (!connectionClass || !context.retryable) throw error;
+				this.startRecovery(recovery);
+				if (!this.canRetry(recovery)) throw error;
+				lastConnectionError = error;
+				const delay = this.getBackoffDelay(recovery.retryCount, this.remainingBudget(recovery));
+				recovery.retryCount++;
+				this.emit("retry", context, {
+					retryCount: recovery.retryCount,
+					connectionClass,
+					delaySource: "backoff",
+					delayMs: delay,
+					decision: "retry"
+				});
+				await this.waitForRecovery(delay, signal, recovery, error);
+				continue;
+			}
+			try {
+				const status = response.status;
+				const scope = resolveCapacityCooldownScope(status, context.effectiveModel);
+				const capacity = scope !== void 0;
+				const mayReplay = context.retryable === "capacity" ? capacity : context.retryable === true && isTransientUpstreamStatus(status);
+				let retryDelay;
+				if (capacity) {
+					this.startRecovery(recovery);
+					retryDelay = this.getRetryDelay(response, recovery.retryCount, recovery);
+					this.installCooldown(scope, context.effectiveModel, retryDelay.delayMs, context);
+					recovery.publicError = {
+						status,
+						retryAfter: retryDelay.retryAfter ?? formatRetryAfter(retryDelay.delayMs)
+					};
+				}
+				if (!mayReplay) return this.committed(response, lease, context, capacity ? retryDelay : void 0, capacity ? "capacity-terminal" : "upstream-terminal");
+				this.startRecovery(recovery);
+				if (!capacity) recovery.publicError = { status };
+				retryDelay ??= this.getRetryDelay(response, recovery.retryCount, recovery);
+				const remaining = this.remainingBudget(recovery);
+				const serverMinimumDoesNotFit = retryDelay.source === "retry-after" && retryDelay.delayMs >= remaining;
+				if (!this.canRetry(recovery) || serverMinimumDoesNotFit) {
+					const decision = serverMinimumDoesNotFit ? "server-delay-exceeds-budget" : "retry-limit";
+					this.emitTerminal("budget", context, {
+						retryCount: recovery.retryCount,
+						status,
+						scope,
+						delaySource: retryDelay.source,
+						delayMs: retryDelay.delayMs,
+						remainingBudgetMs: remaining,
+						decision
+					});
+					return this.committed(response, lease, context, capacity ? retryDelay : void 0, decision);
+				}
+				discardResponse(response);
+				lease.release();
+				recovery.retryCount++;
+				this.logger.warn([
+					`Upstream ${status};`,
+					`retrying ${formatRequestContext(context)}`,
+					`in ${formatDurationMs(retryDelay.delayMs)}`,
+					`(attempt ${recovery.retryCount}/${recovery.retryLimit})`
+				].join(" "));
+				this.emit("retry", context, {
+					retryCount: recovery.retryCount,
+					status,
+					scope,
+					delaySource: retryDelay.source,
+					delayMs: retryDelay.delayMs,
+					decision: "retry"
+				});
+				await this.waitForRecovery(retryDelay.delayMs, signal, recovery);
+			} catch (error) {
+				discardResponse(response);
+				lease.release();
+				throw error;
+			}
+		}
+	}
+	async acquire(context, signal, causalError) {
+		signal?.throwIfAborted();
+		this.throwIfFallbackCooled(context);
+		this.prepareCooldownWait(context);
+		this.throwIfRecoveryExpired(context.recovery, causalError);
+		const eligible = this.isEligible(context);
+		if (this.active < this.options.concurrency && (eligible || this.drainTimerAt !== void 0 && this.drainTimerAt <= this.now())) {
+			this.drain();
+			if (eligible && this.active < this.options.concurrency) return this.grant(context, 0);
+		}
+		if (this.waiters.length >= this.options.maxQueueDepth) this.drain();
+		if (this.waiters.length >= this.options.maxQueueDepth) {
+			this.emit("admission", context, { decision: "queue-full" });
+			throw new HTTPError(503, { error: {
+				message: "Upstream queue full",
+				type: "overloaded_error"
+			} });
+		}
+		return new Promise((resolve, reject) => {
+			const waiter = {
+				context,
+				causalError,
+				enqueuedAt: this.now(),
+				resolve,
+				reject,
+				signal
+			};
+			if (signal) {
+				waiter.onAbort = () => {
+					const index = this.waiters.indexOf(waiter);
+					if (index === -1) return;
+					this.waiters.splice(index, 1);
+					reject(signal.reason);
+					if (waiter.wakeAt === this.drainTimerAt && !this.waiters.some((candidate) => candidate.wakeAt === waiter.wakeAt)) this.scheduleNextWake();
+				};
+				signal.addEventListener("abort", waiter.onAbort, { once: true });
+			}
+			this.waiters.push(waiter);
+			this.emit("admission", context, { decision: "queued" });
+			this.scheduleNextWake(waiter);
+		});
+	}
+	prepareCooldownWait(context) {
+		const cooldown = this.getActiveCooldown(context.effectiveModel);
+		if (!cooldown) return;
+		this.startRecovery(context.recovery);
+		this.setRecoveryCooldown(context.recovery, cooldown);
+		const status = cooldown.scope === "account" ? 429 : 529;
+		context.recovery.publicError = {
+			status,
+			retryAfter: formatRetryAfter(cooldown.notBeforeMonotonicMs - this.now())
+		};
+		if (cooldown.notBeforeMonotonicMs > context.recovery.deadlineMonotonicMs) throw createLocalCapacityError(context.recovery);
+	}
+	drain() {
+		this.clearExpiredModels();
+		for (let index = this.waiters.length - 1; index >= 0; index--) {
+			const waiter = this.waiters[index];
+			const fallbackCooldown = waiter.context.fallbackAttempt ? this.getActiveCooldown(waiter.context.effectiveModel) : void 0;
+			if (fallbackCooldown) {
+				this.waiters.splice(index, 1);
+				this.cleanupWaiter(waiter);
+				this.emit("admission", waiter.context, {
+					scope: fallbackCooldown.scope,
+					decision: "fallback-cooldown"
+				});
+				waiter.reject(new FallbackCooldownError(fallbackCooldown));
+				continue;
+			}
+			const deadline = waiter.context.recovery.deadlineMonotonicMs;
+			if (deadline !== void 0 && this.now() >= deadline) {
+				this.waiters.splice(index, 1);
+				this.cleanupWaiter(waiter);
+				waiter.reject(waiter.causalError ?? createLocalCapacityError(waiter.context.recovery));
+			}
+		}
+		while (this.active < this.options.concurrency) {
+			const index = this.waiters.findIndex((waiter) => this.isEligible(waiter.context));
+			if (index === -1) break;
+			const waiter = this.waiters.splice(index, 1)[0];
+			this.cleanupWaiter(waiter);
+			waiter.resolve(this.grant(waiter.context, this.now() - waiter.enqueuedAt));
+		}
+		this.scheduleNextWake();
+	}
+	scheduleNextWake(addedWaiter) {
+		const now = this.now();
+		if (addedWaiter) {
+			const wakeAt = this.getWaiterWakeAt(addedWaiter, now);
+			addedWaiter.wakeAt = wakeAt;
+			if (wakeAt === void 0 || this.drainTimerAt !== void 0 && wakeAt >= this.drainTimerAt) return;
+			this.replaceDrainTimer(wakeAt, now);
+			return;
+		}
+		let wakeAt;
+		for (const waiter of this.waiters) {
+			waiter.wakeAt = this.getWaiterWakeAt(waiter, now);
+			if (waiter.wakeAt !== void 0) wakeAt = Math.min(wakeAt ?? Number.POSITIVE_INFINITY, waiter.wakeAt);
+		}
+		this.replaceDrainTimer(wakeAt, now);
+	}
+	getWaiterWakeAt(waiter, now) {
+		let wakeAt;
+		const cooldown = this.getActiveCooldown(waiter.context.effectiveModel);
+		if (cooldown && cooldown.notBeforeMonotonicMs > now) wakeAt = cooldown.notBeforeMonotonicMs;
+		const deadline = waiter.context.recovery.deadlineMonotonicMs;
+		if (deadline !== void 0 && deadline > now) wakeAt = Math.min(wakeAt ?? Number.POSITIVE_INFINITY, deadline);
+		return wakeAt;
+	}
+	replaceDrainTimer(wakeAt, now) {
+		if (wakeAt === this.drainTimerAt) return;
+		if (this.drainTimer) {
+			this.clearTimer(this.drainTimer);
+			this.drainTimer = void 0;
+			this.drainTimerAt = void 0;
+		}
+		if (wakeAt === void 0) return;
+		this.drainTimerAt = wakeAt;
+		this.drainTimer = this.setTimer(() => {
+			this.drainTimer = void 0;
+			this.drainTimerAt = void 0;
+			this.drain();
+		}, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, wakeAt - now)));
+	}
+	grant(context, queueWaitMs) {
+		let released = false;
+		this.active++;
+		this.emit("grant", context, {
+			queueWaitMs,
+			decision: "granted"
+		});
+		return { release: () => {
+			if (released) return;
+			released = true;
+			this.active--;
+			this.drain();
+		} };
+	}
+	isEligible(context) {
+		return this.getActiveCooldown(context.effectiveModel) === void 0;
+	}
+	throwIfFallbackCooled(context) {
+		if (!context.fallbackAttempt) return;
+		const cooldown = this.getActiveCooldown(context.effectiveModel);
+		if (cooldown) throw new FallbackCooldownError(cooldown);
+	}
+	getActiveCooldown(effectiveModel) {
+		const now = this.now();
+		if (this.accountNotBefore > now) return {
+			scope: "account",
+			notBeforeMonotonicMs: this.accountNotBefore
+		};
+		if (!effectiveModel) return void 0;
+		const modelDeadline = this.modelNotBefore.get(effectiveModel);
+		if (modelDeadline === void 0) return void 0;
+		if (modelDeadline <= now) {
+			this.modelNotBefore.delete(effectiveModel);
+			return;
+		}
+		return {
+			scope: "model",
+			notBeforeMonotonicMs: modelDeadline,
+			effectiveModel
+		};
+	}
+	clearExpiredModels() {
+		const now = this.now();
+		for (const [model, deadline] of this.modelNotBefore) if (deadline <= now) this.modelNotBefore.delete(model);
+	}
+	installCooldown(scope, effectiveModel, delayMs, context) {
+		const deadline = this.now() + delayMs;
+		let stored = deadline;
+		if (scope === "account") {
+			this.accountNotBefore = Math.max(this.accountNotBefore, deadline);
+			stored = this.accountNotBefore;
+		} else if (scope === "model" && effectiveModel) {
+			stored = Math.max(this.modelNotBefore.get(effectiveModel) ?? 0, deadline);
+			this.modelNotBefore.set(effectiveModel, stored);
+		}
+		this.setRecoveryCooldown(context.recovery, {
+			scope,
+			notBeforeMonotonicMs: stored,
+			...effectiveModel && scope === "model" ? { effectiveModel } : {}
+		});
+		this.emit("cooldown", context, {
+			scope,
+			delayMs,
+			nextRetryAt: formatNextRetryAt(this.wallNow() + delayMs),
+			decision: scope === "request" ? "request-local" : "installed"
+		});
+		this.drain();
+	}
+	startRecovery(recovery) {
+		if (recovery.deadlineMonotonicMs !== void 0) return;
+		const startedAt = this.now();
+		recovery.startedAtMonotonicMs = startedAt;
+		recovery.deadlineMonotonicMs = startedAt + this.options.recoveryBudgetMs;
+		recovery.retryLimit ??= this.options.maxRetries;
+	}
+	setRecoveryCooldown(recovery, cooldown) {
+		if (!recovery.cooldown || cooldown.notBeforeMonotonicMs >= recovery.cooldown.notBeforeMonotonicMs) recovery.cooldown = cooldown;
+	}
+	canRetry(recovery) {
+		return recovery.retryCount < (recovery.retryLimit ?? this.options.maxRetries);
+	}
+	remainingBudget(recovery) {
+		return recovery.deadlineMonotonicMs === void 0 ? this.options.recoveryBudgetMs : Math.max(0, recovery.deadlineMonotonicMs - this.now());
+	}
+	throwIfRecoveryExpired(recovery, lastConnectionError) {
+		if (recovery.deadlineMonotonicMs !== void 0 && this.now() >= recovery.deadlineMonotonicMs) throw lastConnectionError ?? createLocalCapacityError(recovery);
+	}
+	getRetryDelay(response, attempt, recovery) {
+		const retryAfterMs = parseRetryAfterMs(response.headers, this.wallNow());
+		const retryAfter = response.headers.get("retry-after") ?? void 0;
+		if (retryAfterMs !== void 0) return {
+			delayMs: retryAfterMs,
+			source: "retry-after",
+			retryAfter
+		};
+		return {
+			delayMs: this.getBackoffDelay(attempt, this.remainingBudget(recovery)),
+			source: "backoff"
+		};
+	}
+	getBackoffDelay(attempt, remainingBudgetMs) {
+		const cap = Math.min(this.options.baseDelayMs * 2 ** attempt, this.options.maxDelayMs, Math.max(0, remainingBudgetMs));
+		const random = Math.min(1, Math.max(0, this.random()));
+		return Math.floor(cap * random);
+	}
+	async waitForRecovery(delayMs, signal, recovery, lastConnectionError) {
+		const remaining = this.remainingBudget(recovery);
+		if (delayMs > remaining) throw lastConnectionError ?? createLocalCapacityError(recovery);
+		const deadline = createDeadlineSignal(signal, remaining, this.setTimer, this.clearTimer);
+		try {
+			await abortableSleep(this.sleep, delayMs, deadline.signal, this.setTimer, this.clearTimer);
+		} catch (error) {
+			if (signal?.aborted) throw signal.reason;
+			if (deadline.timedOut()) throw lastConnectionError ?? createLocalCapacityError(recovery);
+			throw error;
+		} finally {
+			deadline.cleanup();
+		}
+		this.throwIfRecoveryExpired(recovery, lastConnectionError);
+	}
+	async fetchBeforeDeadline(fetcher, signal, recovery, lastConnectionError) {
+		if (recovery.deadlineMonotonicMs === void 0) return fetcher(signal);
+		const deadline = createDeadlineSignal(signal, this.remainingBudget(recovery), this.setTimer, this.clearTimer);
+		try {
+			const response = await fetcher(deadline.signal);
+			if (this.now() >= recovery.deadlineMonotonicMs) {
+				discardResponse(response);
+				throw new RecoveryBudgetError(recovery.fallbackFetchStarted ? createRecoveryTimeoutError() : lastConnectionError ?? createLocalCapacityError(recovery));
+			}
+			return response;
+		} catch (error) {
+			if (signal?.aborted) throw signal.reason;
+			if (deadline.timedOut()) throw new RecoveryBudgetError(recovery.fallbackFetchStarted ? createRecoveryTimeoutError() : lastConnectionError ?? createLocalCapacityError(recovery));
+			throw error;
+		} finally {
+			deadline.cleanup();
+		}
+	}
+	committed(response, lease, context, retryDelay, terminalDecision = "upstream-terminal") {
+		const { recovery } = context;
+		if (recovery.startedAtMonotonicMs !== void 0) this.emitTerminal("retry", context, {
+			retryCount: recovery.retryCount,
+			status: response.status,
+			scope: resolveCapacityCooldownScope(response.status, context.effectiveModel),
+			decision: response.ok ? "recovered" : terminalDecision
+		});
+		return {
+			response: retryDelay ? ensureRetryAfter(response, retryDelay.retryAfter ?? formatRetryAfter(retryDelay.delayMs)) : response,
+			release: lease.release,
+			recovery
+		};
+	}
+	emit(event, context, fields) {
+		const recovery = context.recovery;
+		recovery.queueMetrics = {
+			activeSlots: this.active,
+			maxSlots: this.options.concurrency,
+			pendingDepth: this.waiters.length,
+			maxPendingDepth: this.options.maxQueueDepth
+		};
+		if (!this.logger.info) return;
+		logRecoveryEvent({
+			requestId: recovery.requestId,
+			callerRequestId: recovery.callerRequestId,
+			event,
+			effectiveModel: context.effectiveModel,
+			...recovery.queueMetrics,
+			...recovery.startedAtMonotonicMs !== void 0 ? {
+				elapsedMs: Math.max(0, this.now() - recovery.startedAtMonotonicMs),
+				remainingBudgetMs: this.remainingBudget(recovery)
+			} : {},
+			...fields
+		}, { info: this.logger.info.bind(this.logger) });
+	}
+	emitTerminal(event, context, fields) {
+		if (this.terminalRecoveries.has(context.recovery)) return;
+		this.terminalRecoveries.add(context.recovery);
+		this.emit(event, context, fields);
+	}
+	cleanupWaiter(waiter) {
+		if (waiter.signal && waiter.onAbort) waiter.signal.removeEventListener("abort", waiter.onAbort);
+	}
+};
+function createDefaultUpstreamRequestQueue() {
+	return new UpstreamRequestQueue(DEFAULT_UPSTREAM_QUEUE_OPTIONS);
+}
+function parseRetryAfterMs(headers, now = Date.now()) {
+	const value = headers.get("retry-after");
+	if (!value) return void 0;
+	if (RETRY_AFTER_SECONDS_RE.test(value)) {
+		const milliseconds = Number(value) * 1e3;
+		return Number.isFinite(milliseconds) ? Math.ceil(milliseconds) : void 0;
+	}
+	if (!RETRY_AFTER_HTTP_DATE_RE.test(value)) return void 0;
+	const retryAt = Date.parse(value);
+	if (Number.isNaN(retryAt)) return void 0;
+	const serverDate = headers.get("date");
+	const parsedServerDate = serverDate ? Date.parse(serverDate) : NaN;
+	return Math.max(0, retryAt - (Number.isNaN(parsedServerDate) ? now : parsedServerDate));
+}
+function finiteOr(value, fallback) {
+	return value !== void 0 && Number.isFinite(value) ? value : fallback;
+}
+function normalizeOptions(options) {
+	return {
+		concurrency: Math.max(1, Math.floor(finiteOr(options.concurrency, DEFAULT_UPSTREAM_QUEUE_OPTIONS.concurrency))),
+		maxRetries: Math.min(2, Math.max(0, Math.floor(finiteOr(options.maxRetries, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxRetries)))),
+		baseDelayMs: Math.max(0, Math.floor(finiteOr(options.baseDelayMs, DEFAULT_UPSTREAM_QUEUE_OPTIONS.baseDelayMs))),
+		maxDelayMs: Math.max(1, Math.floor(finiteOr(options.maxDelayMs, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxDelayMs))),
+		maxQueueDepth: Math.max(1, Math.floor(finiteOr(options.maxQueueDepth, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxQueueDepth))),
+		recoveryBudgetMs: Math.min(120 * 1e3, Math.max(1 * 1e3, Math.floor(finiteOr(options.recoveryBudgetMs, DEFAULT_UPSTREAM_QUEUE_OPTIONS.recoveryBudgetMs))))
+	};
+}
+function mergeDefinedOptions(current, next) {
+	return {
+		concurrency: next.concurrency ?? current.concurrency,
+		maxRetries: next.maxRetries ?? current.maxRetries,
+		baseDelayMs: next.baseDelayMs ?? current.baseDelayMs,
+		maxDelayMs: next.maxDelayMs ?? current.maxDelayMs,
+		maxQueueDepth: next.maxQueueDepth ?? current.maxQueueDepth,
+		recoveryBudgetMs: next.recoveryBudgetMs ?? current.recoveryBudgetMs
+	};
+}
+function discardResponse(response) {
+	try {
+		response.body?.cancel().catch(() => {});
+	} catch {}
+}
+function ensureRetryAfter(response, retryAfter) {
+	if (response.headers.get("retry-after") === retryAfter) return response;
+	const headers = new Headers(response.headers);
+	headers.set("retry-after", retryAfter);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function formatRetryAfter(delayMs) {
+	return String(Math.max(0, Math.ceil(delayMs / 1e3)));
+}
+function formatNextRetryAt(timestampMs) {
+	const retryAt = new Date(timestampMs);
+	return Number.isNaN(retryAt.getTime()) ? void 0 : retryAt.toISOString();
+}
+function formatRequestContext(context) {
+	try {
+		const url = new URL(context.url);
+		return `${context.method ?? "GET"} ${url.pathname}`;
+	} catch {
+		return `${context.method ?? "GET"} ${context.url}`;
+	}
+}
+function abortableSleep(sleep, ms, signal, setTimer = globalThis.setTimeout, clearTimer = globalThis.clearTimeout) {
+	if (sleep && !signal) return sleep(ms);
+	signal?.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		let timer;
+		function cleanup() {
+			if (timer !== void 0) clearTimer(timer);
+			signal?.removeEventListener("abort", onAbort);
+		}
+		function onAbort() {
+			cleanup();
+			reject(signal?.reason);
+		}
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (!sleep) {
+			timer = setTimer(() => {
+				cleanup();
+				resolve();
+			}, ms);
+			return;
+		}
+		sleep(ms).then(() => {
+			cleanup();
+			resolve();
+		}, (error) => {
+			cleanup();
+			reject(error);
+		});
+	});
+}
+function createDeadlineSignal(parent, delayMs, setTimer, clearTimer) {
+	const controller = new AbortController();
+	let didTimeOut = false;
+	const timer = setTimer(() => {
+		didTimeOut = true;
+		controller.abort(new DOMException("Recovery deadline exceeded", "TimeoutError"));
+	}, Math.max(0, delayMs));
+	return {
+		signal: parent ? AbortSignal.any([parent, controller.signal]) : controller.signal,
+		timedOut: () => didTimeOut,
+		cleanup: () => clearTimer(timer)
+	};
+}
+var RecoveryBudgetError = class extends Error {
+	cause;
+	constructor(cause) {
+		super("Upstream recovery deadline exceeded");
+		this.name = "RecoveryBudgetError";
+		this.cause = cause;
+	}
+};
+function createRecoveryTimeoutError() {
+	return new HTTPError(504, { error: {
+		message: localCapacityErrorMessage(504),
+		type: "timeout_error"
+	} });
+}
+function createLocalCapacityError(recovery) {
+	const status = recovery.publicError?.status ?? 504;
+	const retryAfter = recovery.publicError?.retryAfter ?? (recovery.cooldown ? formatRetryAfter(recovery.cooldown.notBeforeMonotonicMs - (recovery.deadlineMonotonicMs ?? 0)) : void 0);
+	const errorType = status === 504 ? "timeout_error" : upstreamErrorType(status);
+	const error = new HTTPError(status, { error: {
+		message: localCapacityErrorMessage(status),
+		type: errorType
+	} }, retryAfter ? { headers: { "retry-after": retryAfter } } : void 0);
+	return status === 529 ? new TerminalUpstreamRecoveryError(error, recovery) : error;
+}
+function localCapacityErrorMessage(status) {
+	switch (status) {
+		case 429: return "The upstream account is temporarily rate limited.";
+		case 529: return "The selected upstream model is temporarily overloaded.";
+		case 504: return "The upstream recovery budget was exhausted.";
+		default: return `The last upstream attempt failed with status ${status}.`;
+	}
+}
+//#endregion
 //#region src/clients/copilot-client.ts
 var CopilotClient = class {
 	auth;
 	config;
 	fetchImpl;
 	requestQueue;
+	recovery;
+	offerLocalModelCooldown;
+	fallbackAttempt;
 	constructor(auth, config, deps) {
 		this.auth = auth;
 		this.config = config;
 		this.fetchImpl = deps?.fetch ?? fetch;
 		this.requestQueue = deps?.requestQueue;
+		this.recovery = deps?.recovery;
+		this.offerLocalModelCooldown = deps?.offerLocalModelCooldown ?? false;
+		this.fallbackAttempt = deps?.fallbackAttempt ?? false;
 	}
 	requireToken() {
 		if (!this.auth.copilotToken) throw new Error("Copilot token not found");
@@ -6610,10 +7603,13 @@ var CopilotClient = class {
 				signal: options.signal
 			}
 		};
-		const queuedResponse = await this.fetchWithQueue(request, options.retryable);
+		const queuedResponse = await this.fetchWithQueue(request, options.retryable, options.effectiveModel);
 		const { response } = queuedResponse;
 		if (!response.ok) try {
 			await throwUpstreamError(errorMessage, response);
+		} catch (error) {
+			if (error instanceof HTTPError && response.status === 529 && queuedResponse.recovery) throw new TerminalUpstreamRecoveryError(error, queuedResponse.recovery);
+			throw error;
 		} finally {
 			queuedResponse.release();
 		}
@@ -6634,6 +7630,7 @@ var CopilotClient = class {
 			method: "POST",
 			body: JSON.stringify(payload),
 			retryable: "capacity",
+			effectiveModel: typeof payload.model === "string" ? payload.model : void 0,
 			...options
 		});
 		if (payload.stream) return withRelease(events(response), release);
@@ -6643,16 +7640,28 @@ var CopilotClient = class {
 			release();
 		}
 	}
-	async fetchWithQueue(request, retryable) {
-		const fetcher = () => this.fetchImpl(request.url, request.init);
+	async fetchWithQueue(request, retryable, effectiveModel) {
+		const fetcher = (signal) => this.fetchImpl(request.url, {
+			...request.init,
+			signal: signal ?? request.init.signal
+		});
 		if (this.requestQueue) return this.requestQueue.dispatch(fetcher, {
 			method: request.init.method,
 			url: request.url,
-			retryable
+			retryable,
+			effectiveModel,
+			recovery: this.recovery,
+			offerLocalModelCooldown: this.offerLocalModelCooldown,
+			fallbackAttempt: this.fallbackAttempt
 		}, request.init.signal ?? void 0);
+		const recovery = this.recovery ?? {
+			requestId: crypto.randomUUID(),
+			retryCount: 0
+		};
 		return {
-			response: await fetcher(),
-			release: () => {}
+			response: await fetcher(request.init.signal ?? void 0),
+			release: () => {},
+			recovery
 		};
 	}
 	async createChatCompletions(payload, options) {
@@ -6672,6 +7681,7 @@ var CopilotClient = class {
 			method: "POST",
 			body: JSON.stringify(payload),
 			signal: options?.signal,
+			effectiveModel: payload.model,
 			retryable: true
 		});
 	}
@@ -6968,202 +7978,6 @@ function buildGitHubUrls(gheDomain) {
 	};
 }
 //#endregion
-//#region src/util/duration.ts
-/**
-* Formats a millisecond duration as a compact human-readable string:
-* `<n>ms` under one second, otherwise `<n>s` rounded to whole seconds.
-*/
-function formatDurationMs(ms) {
-	return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
-}
-//#endregion
-//#region src/clients/upstream-queue.ts
-const DEFAULT_UPSTREAM_QUEUE_OPTIONS = {
-	concurrency: 10,
-	maxRetries: 5,
-	baseDelayMs: 2e3,
-	maxDelayMs: 6e4,
-	maxQueueDepth: 1e3
-};
-var UpstreamRequestQueue = class {
-	sleep;
-	now;
-	logger;
-	setTimer;
-	clearTimer;
-	options;
-	active = 0;
-	cooldownUntil = 0;
-	drainTimer;
-	waiters = [];
-	constructor(options = {}, deps = {}) {
-		this.options = normalizeOptions(options);
-		this.sleep = deps.sleep ?? sleep;
-		this.now = deps.now ?? Date.now;
-		this.logger = deps.logger ?? consola;
-		this.setTimer = deps.setTimeout ?? globalThis.setTimeout;
-		this.clearTimer = deps.clearTimeout ?? globalThis.clearTimeout;
-	}
-	updateOptions(options) {
-		this.options = normalizeOptions(mergeDefinedOptions(this.options, options));
-		this.drain();
-	}
-	async dispatch(fetcher, context, signal) {
-		let attempt = 0;
-		for (;;) {
-			signal?.throwIfAborted();
-			const lease = await this.acquire(signal);
-			let response;
-			try {
-				response = await fetcher();
-			} catch (error) {
-				lease.release();
-				throw error;
-			}
-			const { status } = response;
-			const isCapacityLimit = isCapacityLimitStatus(status);
-			if (!((context.retryable === "capacity" ? isCapacityLimit : context.retryable === true && isTransientUpstreamStatus(status)) && attempt < this.options.maxRetries)) {
-				if (isCapacityLimit) this.applyCooldown(this.getRetryDelayMs(response, 0));
-				return {
-					response,
-					release: lease.release
-				};
-			}
-			const delayMs = this.getRetryDelayMs(response, attempt);
-			await discardResponse(response);
-			if (isCapacityLimit) this.applyCooldown(delayMs);
-			lease.release();
-			this.logger.warn([
-				`Upstream ${status};`,
-				`retrying ${formatRequestContext(context)}`,
-				`in ${formatDurationMs(delayMs)}`,
-				`(attempt ${attempt + 1}/${this.options.maxRetries})`
-			].join(" "));
-			await abortableSleep(this.sleep, delayMs, signal);
-			attempt++;
-		}
-	}
-	acquire(signal) {
-		signal?.throwIfAborted();
-		if (this.waiters.length >= this.options.maxQueueDepth) return Promise.reject(new HTTPError(503, { error: {
-			message: "Upstream queue full",
-			type: "overloaded_error"
-		} }));
-		return new Promise((resolve, reject) => {
-			let resolved = false;
-			const waiter = (lease) => {
-				resolved = true;
-				resolve(lease);
-			};
-			this.waiters.push(waiter);
-			if (signal) signal.addEventListener("abort", () => {
-				if (resolved) return;
-				const idx = this.waiters.indexOf(waiter);
-				if (idx !== -1) this.waiters.splice(idx, 1);
-				reject(signal.reason);
-			}, { once: true });
-			this.drain();
-		});
-	}
-	drain() {
-		if (this.drainTimer) {
-			this.clearTimer(this.drainTimer);
-			this.drainTimer = void 0;
-		}
-		const cooldownMs = this.cooldownUntil - this.now();
-		if (cooldownMs > 0) {
-			this.drainTimer = this.setTimer(() => this.drain(), cooldownMs);
-			return;
-		}
-		while (this.active < this.options.concurrency && this.waiters.length > 0) {
-			const resolve = this.waiters.shift();
-			let released = false;
-			this.active++;
-			resolve({ release: () => {
-				if (released) return;
-				released = true;
-				this.active--;
-				this.drain();
-			} });
-		}
-	}
-	applyCooldown(delayMs) {
-		this.cooldownUntil = Math.max(this.cooldownUntil, this.now() + delayMs);
-		this.drain();
-	}
-	getRetryDelayMs(response, attempt) {
-		const retryAfterMs = parseRetryAfterMs(response.headers, this.now());
-		if (retryAfterMs !== void 0) return clampDelay(retryAfterMs, this.options.maxDelayMs);
-		return clampDelay(this.options.baseDelayMs * 2 ** attempt, this.options.maxDelayMs);
-	}
-};
-function createDefaultUpstreamRequestQueue() {
-	return new UpstreamRequestQueue(DEFAULT_UPSTREAM_QUEUE_OPTIONS);
-}
-function parseRetryAfterMs(headers, now = Date.now()) {
-	const retryAfter = headers.get("retry-after");
-	if (!retryAfter) return;
-	const retryAfterSeconds = Number.parseFloat(retryAfter);
-	if (Number.isFinite(retryAfterSeconds)) return Math.max(0, retryAfterSeconds * 1e3);
-	const retryAt = Date.parse(retryAfter);
-	if (Number.isNaN(retryAt)) return;
-	return Math.max(0, retryAt - now);
-}
-function finiteOr(value, fallback) {
-	return value !== void 0 && Number.isFinite(value) ? value : fallback;
-}
-function normalizeOptions(options) {
-	return {
-		concurrency: Math.max(1, Math.floor(finiteOr(options.concurrency, DEFAULT_UPSTREAM_QUEUE_OPTIONS.concurrency))),
-		maxRetries: Math.max(0, Math.floor(finiteOr(options.maxRetries, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxRetries))),
-		baseDelayMs: Math.max(0, Math.floor(finiteOr(options.baseDelayMs, DEFAULT_UPSTREAM_QUEUE_OPTIONS.baseDelayMs))),
-		maxDelayMs: Math.max(1, Math.floor(finiteOr(options.maxDelayMs, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxDelayMs))),
-		maxQueueDepth: Math.max(1, Math.floor(finiteOr(options.maxQueueDepth, DEFAULT_UPSTREAM_QUEUE_OPTIONS.maxQueueDepth)))
-	};
-}
-function mergeDefinedOptions(current, next) {
-	return {
-		concurrency: next.concurrency ?? current.concurrency,
-		maxRetries: next.maxRetries ?? current.maxRetries,
-		baseDelayMs: next.baseDelayMs ?? current.baseDelayMs,
-		maxDelayMs: next.maxDelayMs ?? current.maxDelayMs,
-		maxQueueDepth: next.maxQueueDepth ?? current.maxQueueDepth
-	};
-}
-function clampDelay(delayMs, maxDelayMs) {
-	return Math.min(Math.max(0, Math.ceil(delayMs)), maxDelayMs);
-}
-async function discardResponse(response) {
-	try {
-		await response.body?.cancel();
-	} catch {}
-}
-function formatRequestContext(context) {
-	try {
-		const url = new URL(context.url);
-		return `${context.method ?? "GET"} ${url.pathname}`;
-	} catch {
-		return `${context.method ?? "GET"} ${context.url}`;
-	}
-}
-function abortableSleep(sleep, ms, signal) {
-	if (!signal) return sleep(ms);
-	signal.throwIfAborted();
-	return new Promise((resolve, reject) => {
-		let done = false;
-		signal.addEventListener("abort", () => {
-			if (done) return;
-			done = true;
-			reject(signal.reason);
-		}, { once: true });
-		sleep(ms).then(() => {
-			if (done) return;
-			done = true;
-			resolve();
-		});
-	});
-}
-//#endregion
 //#region src/clients/factory.ts
 const upstreamRequestQueue = createDefaultUpstreamRequestQueue();
 function configureUpstreamRequestQueue(options) {
@@ -7179,8 +7993,12 @@ function getClientConfig() {
 		githubApiBaseUrl: apiBaseUrl
 	};
 }
-function createCopilotClient() {
-	return new CopilotClient(authStore, getClientConfig(), { requestQueue: upstreamRequestQueue });
+function createCopilotClient(recovery, options = {}) {
+	return new CopilotClient(authStore, getClientConfig(), {
+		requestQueue: upstreamRequestQueue,
+		recovery,
+		...options
+	});
 }
 async function cacheModels(client) {
 	const models = await (client ?? createCopilotClient()).getModels();
@@ -7419,7 +8237,7 @@ const checkUsage = defineCommand({
 });
 //#endregion
 //#region src/util/version.ts
-const VERSION = "0.9.0";
+const VERSION = "0.9.2";
 //#endregion
 //#region src/debug.ts
 function getRuntimeInfo() {
@@ -7495,336 +8313,6 @@ const debug = defineCommand({
 	}
 });
 //#endregion
-//#region src/lib/tokenizer.ts
-const ENCODING_MAP = {
-	o200k_base: () => import("./o200k_base-DXNwToXP.mjs"),
-	cl100k_base: () => import("./cl100k_base-ChJqEXhP.mjs"),
-	p50k_base: () => import("./p50k_base-Cab7w92R.mjs"),
-	p50k_edit: () => import("./p50k_edit-DkrRw_em.mjs"),
-	r50k_base: () => import("./r50k_base-1vVxWqTY.mjs")
-};
-const encodingCache = /* @__PURE__ */ new Map();
-const TOKENS_PER_MESSAGE = 3;
-const TOKENS_PER_NAME = 1;
-const REPLY_PRIMING_TOKENS = 3;
-const BASE_CONSTANTS = {
-	propertyInitOverhead: 3,
-	propertyKeyOverhead: 3,
-	enumOverhead: -3,
-	enumItemCost: 3,
-	functionEndOverhead: 12
-};
-/**
-* Calculate tokens for tool calls
-*/
-function calculateToolCallsTokens(toolCalls, encoder, constants) {
-	let tokens = 0;
-	for (const toolCall of toolCalls) {
-		tokens += constants.functionInitOverhead;
-		tokens += encoder.encode(JSON.stringify(toolCall)).length;
-	}
-	tokens += constants.functionEndOverhead;
-	return tokens;
-}
-/**
-* Calculate tokens for content parts
-*/
-function calculateContentPartsTokens(contentParts, encoder) {
-	let tokens = 0;
-	for (const part of contentParts) if (part.type === "image_url") tokens += encoder.encode(part.image_url.url).length + 85;
-	else if (part.text) tokens += encoder.encode(part.text).length;
-	return tokens;
-}
-/**
-* Calculate tokens for a single message
-*/
-function calculateMessageTokens(message, encoder, constants) {
-	let tokens = TOKENS_PER_MESSAGE;
-	for (const [key, value] of Object.entries(message)) {
-		if (typeof value === "string") tokens += encoder.encode(value).length;
-		if (key === "name") tokens += TOKENS_PER_NAME;
-		if (key === "tool_calls") tokens += calculateToolCallsTokens(value, encoder, constants);
-		if (key === "content" && Array.isArray(value)) tokens += calculateContentPartsTokens(value, encoder);
-	}
-	return tokens;
-}
-/**
-* Calculate tokens using custom algorithm
-*/
-function calculateTokens(messages, encoder, constants) {
-	if (messages.length === 0) return 0;
-	let numTokens = 0;
-	for (const message of messages) numTokens += calculateMessageTokens(message, encoder, constants);
-	numTokens += REPLY_PRIMING_TOKENS;
-	return numTokens;
-}
-/**
-* Get the corresponding encoder module based on encoding type
-*/
-async function getEncoder(encoding) {
-	const cached = encodingCache.get(encoding);
-	if (cached) return cached;
-	const supportedEncoding = encoding;
-	if (!(supportedEncoding in ENCODING_MAP)) {
-		const fallbackModule = await ENCODING_MAP.o200k_base();
-		encodingCache.set(encoding, fallbackModule);
-		return fallbackModule;
-	}
-	const encodingModule = await ENCODING_MAP[supportedEncoding]();
-	encodingCache.set(encoding, encodingModule);
-	return encodingModule;
-}
-/**
-* Get tokenizer type from model information
-*/
-function getTokenizerFromModel(model) {
-	return model.capabilities.tokenizer || "o200k_base";
-}
-/**
-* Get model-specific constants for token calculation
-*/
-function getModelConstants(model) {
-	const isLegacy = model.id === "gpt-3.5-turbo" || model.id === "gpt-4";
-	return {
-		...BASE_CONSTANTS,
-		functionInitOverhead: isLegacy ? 10 : 7
-	};
-}
-/**
-* Calculate tokens for a single parameter
-*/
-function calculateParameterTokens(key, prop, context) {
-	const { encoder, constants } = context;
-	let tokens = constants.propertyKeyOverhead;
-	if (typeof prop !== "object" || prop === null) return tokens;
-	const param = prop;
-	const paramName = key;
-	const paramType = param.type || "string";
-	let paramDesc = param.description || "";
-	if (param.enum && Array.isArray(param.enum)) {
-		tokens += constants.enumOverhead;
-		for (const item of param.enum) {
-			tokens += constants.enumItemCost;
-			tokens += encoder.encode(String(item)).length;
-		}
-	}
-	if (paramDesc.endsWith(".")) paramDesc = paramDesc.slice(0, -1);
-	const line = `${paramName}:${paramType}:${paramDesc}`;
-	tokens += encoder.encode(line).length;
-	const excludedKeys = new Set([
-		"type",
-		"description",
-		"enum"
-	]);
-	for (const propertyName of Object.keys(param)) if (!excludedKeys.has(propertyName)) {
-		const propertyValue = param[propertyName];
-		const propertyText = typeof propertyValue === "string" ? propertyValue : JSON.stringify(propertyValue);
-		tokens += encoder.encode(`${propertyName}:${propertyText}`).length;
-	}
-	return tokens;
-}
-/**
-* Calculate tokens for function parameters
-*/
-function calculateParametersTokens(parameters, encoder, constants) {
-	if (!parameters || typeof parameters !== "object") return 0;
-	const params = parameters;
-	let tokens = 0;
-	for (const [key, value] of Object.entries(params)) if (key === "properties") {
-		const properties = value;
-		if (Object.keys(properties).length > 0) {
-			tokens += constants.propertyInitOverhead;
-			for (const propKey of Object.keys(properties)) tokens += calculateParameterTokens(propKey, properties[propKey], {
-				encoder,
-				constants
-			});
-		}
-	} else {
-		const paramText = typeof value === "string" ? value : JSON.stringify(value);
-		tokens += encoder.encode(`${key}:${paramText}`).length;
-	}
-	return tokens;
-}
-/**
-* Calculate tokens for a single tool
-*/
-function calculateToolTokens(tool, encoder, constants) {
-	let tokens = constants.functionInitOverhead;
-	const func = tool.function;
-	const functionName = func.name;
-	let functionDescription = func.description || "";
-	if (functionDescription.endsWith(".")) functionDescription = functionDescription.slice(0, -1);
-	const line = `${functionName}:${functionDescription}`;
-	tokens += encoder.encode(line).length;
-	if (typeof func.parameters === "object" && func.parameters !== null) tokens += calculateParametersTokens(func.parameters, encoder, constants);
-	return tokens;
-}
-/**
-* Calculate token count for tools based on model
-*/
-function numTokensForTools(tools, encoder, constants) {
-	let toolTokenCount = 0;
-	for (const tool of tools) toolTokenCount += calculateToolTokens(tool, encoder, constants);
-	toolTokenCount += constants.functionEndOverhead;
-	return toolTokenCount;
-}
-/**
-* Calculate the token count of messages, supporting multiple GPT encoders
-*/
-async function getTokenCount(payload, model) {
-	const encoder = await getEncoder(getTokenizerFromModel(model));
-	const inputMessages = payload.messages.filter((msg) => msg.role !== "assistant");
-	const outputMessages = payload.messages.filter((msg) => msg.role === "assistant");
-	const constants = getModelConstants(model);
-	let inputTokens = calculateTokens(inputMessages, encoder, constants);
-	if (payload.tools && payload.tools.length > 0) inputTokens += numTokensForTools(payload.tools, encoder, constants);
-	const outputTokens = calculateTokens(outputMessages, encoder, constants);
-	return {
-		input: inputTokens,
-		output: outputTokens
-	};
-}
-async function estimateResponsesInputTokens(inputItems, model) {
-	return (await getEncoder(getTokenizerFromModel(model))).encode(JSON.stringify(inputItems)).length;
-}
-//#endregion
-//#region src/selfcheck.ts
-const PROBE_ENCODINGS = [
-	"o200k_base",
-	"cl100k_base",
-	"p50k_base",
-	"p50k_edit",
-	"r50k_base"
-];
-const PROBE_MESSAGE = "ghc-proxy selfcheck: probe text for tokenizer chunk load";
-async function probeEncoding(encoding) {
-	try {
-		const count = await getTokenCount({ messages: [{
-			role: "user",
-			content: PROBE_MESSAGE
-		}] }, {
-			id: `selfcheck-${encoding}`,
-			capabilities: { tokenizer: encoding }
-		});
-		if (count.input <= 0) throw new Error(`encoder for ${encoding} returned 0 tokens for non-empty input`);
-		return {
-			encoding,
-			ok: true,
-			tokenCount: count.input
-		};
-	} catch (error) {
-		return {
-			encoding,
-			ok: false,
-			error: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-async function runSelfCheck(options) {
-	const probes = await Promise.all(PROBE_ENCODINGS.map(probeEncoding));
-	const failed = probes.filter((p) => !p.ok);
-	const result = {
-		ok: failed.length === 0,
-		probes,
-		failedCount: failed.length
-	};
-	if (options.json) process$1.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-	else {
-		process$1.stdout.write(`ghc-proxy selfcheck — tokenizer dynamic-chunk load\n\n`);
-		for (const probe of probes) {
-			const mark = probe.ok ? "ok " : "FAIL";
-			const detail = probe.ok ? `tokens=${probe.tokenCount}` : `error=${probe.error}`;
-			process$1.stdout.write(`  [${mark}] ${probe.encoding.padEnd(12)} ${detail}\n`);
-		}
-		process$1.stdout.write(`\n${result.ok ? "PASS" : "FAIL"} — ${probes.length - failed.length}/${probes.length} encodings loaded\n`);
-	}
-	if (!result.ok) process$1.exitCode = 1;
-}
-const selfcheck = defineCommand({
-	meta: {
-		name: "selfcheck",
-		description: "Probe the packaged bundle for runtime regressions (loads every gpt-tokenizer dynamic chunk and encodes a probe string)."
-	},
-	args: { json: {
-		type: "boolean",
-		default: false,
-		description: "Output probe results as JSON"
-	} },
-	run({ args }) {
-		return runSelfCheck({ json: args.json });
-	}
-});
-//#endregion
-//#region node_modules/proxy-from-env/index.js
-var DEFAULT_PORTS = {
-	ftp: 21,
-	gopher: 70,
-	http: 80,
-	https: 443,
-	ws: 80,
-	wss: 443
-};
-function parseUrl(urlString) {
-	try {
-		return new URL(urlString);
-	} catch {
-		return null;
-	}
-}
-/**
-* @param {string|object|URL} url - The URL as a string or URL instance, or a
-*   compatible object (such as the result from legacy url.parse).
-* @return {string} The URL of the proxy that should handle the request to the
-*  given URL. If no proxy is set, this will be an empty string.
-*/
-function getProxyForUrl(url) {
-	var parsedUrl = (typeof url === "string" ? parseUrl(url) : url) || {};
-	var proto = parsedUrl.protocol;
-	var hostname = parsedUrl.host;
-	var port = parsedUrl.port;
-	if (typeof hostname !== "string" || !hostname || typeof proto !== "string") return "";
-	proto = proto.split(":", 1)[0];
-	hostname = hostname.replace(/:\d*$/, "");
-	port = parseInt(port) || DEFAULT_PORTS[proto] || 0;
-	if (!shouldProxy(hostname, port)) return "";
-	var proxy = getEnv(proto + "_proxy") || getEnv("all_proxy");
-	if (proxy && proxy.indexOf("://") === -1) proxy = proto + "://" + proxy;
-	return proxy;
-}
-/**
-* Determines whether a given URL should be proxied.
-*
-* @param {string} hostname - The host name of the URL.
-* @param {number} port - The effective port of the URL.
-* @returns {boolean} Whether the given URL should be proxied.
-* @private
-*/
-function shouldProxy(hostname, port) {
-	var NO_PROXY = getEnv("no_proxy").toLowerCase();
-	if (!NO_PROXY) return true;
-	if (NO_PROXY === "*") return false;
-	return NO_PROXY.split(/[,\s]/).every(function(proxy) {
-		if (!proxy) return true;
-		var parsedProxy = proxy.match(/^(.+):(\d+)$/);
-		var parsedProxyHostname = parsedProxy ? parsedProxy[1] : proxy;
-		var parsedProxyPort = parsedProxy ? parseInt(parsedProxy[2]) : 0;
-		if (parsedProxyPort && parsedProxyPort !== port) return true;
-		if (!/^[.*]/.test(parsedProxyHostname)) return hostname !== parsedProxyHostname;
-		if (parsedProxyHostname.charAt(0) === "*") parsedProxyHostname = parsedProxyHostname.slice(1);
-		return !hostname.endsWith(parsedProxyHostname);
-	});
-}
-/**
-* Get the value for an environment variable.
-*
-* @param {string} key - The name of the environment variable.
-* @return {string} The value of the environment variable.
-* @private
-*/
-function getEnv(key) {
-	return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || "";
-}
-//#endregion
 //#region node_modules/undici/lib/core/symbols.js
 var require_symbols = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	module.exports = {
@@ -29186,7 +29674,7 @@ var require_eventsource = /* @__PURE__ */ __commonJSMin$1(((exports, module) =>
 	};
 }));
 //#endregion
-//#region src/cli/proxy.ts
+//#region src/lib/tokenizer.ts
 var import_undici = (/* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	const Client = require_client();
 	const Dispatcher = require_dispatcher();
@@ -29353,6 +29841,524 @@ var import_undici = (/* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	}
 	module.exports.install = install;
 })))();
+const ENCODING_MAP = {
+	o200k_base: () => import("./o200k_base-DXNwToXP.mjs"),
+	cl100k_base: () => import("./cl100k_base-ChJqEXhP.mjs"),
+	p50k_base: () => import("./p50k_base-Cab7w92R.mjs"),
+	p50k_edit: () => import("./p50k_edit-DkrRw_em.mjs"),
+	r50k_base: () => import("./r50k_base-1vVxWqTY.mjs")
+};
+const encodingCache = /* @__PURE__ */ new Map();
+const TOKENS_PER_MESSAGE = 3;
+const TOKENS_PER_NAME = 1;
+const REPLY_PRIMING_TOKENS = 3;
+const BASE_CONSTANTS = {
+	propertyInitOverhead: 3,
+	propertyKeyOverhead: 3,
+	enumOverhead: -3,
+	enumItemCost: 3,
+	functionEndOverhead: 12
+};
+/**
+* Calculate tokens for tool calls
+*/
+function calculateToolCallsTokens(toolCalls, encoder, constants) {
+	let tokens = 0;
+	for (const toolCall of toolCalls) {
+		tokens += constants.functionInitOverhead;
+		tokens += encoder.encode(JSON.stringify(toolCall)).length;
+	}
+	tokens += constants.functionEndOverhead;
+	return tokens;
+}
+/**
+* Calculate tokens for content parts
+*/
+function calculateContentPartsTokens(contentParts, encoder) {
+	let tokens = 0;
+	for (const part of contentParts) if (part.type === "image_url") tokens += encoder.encode(part.image_url.url).length + 85;
+	else if (part.text) tokens += encoder.encode(part.text).length;
+	return tokens;
+}
+/**
+* Calculate tokens for a single message
+*/
+function calculateMessageTokens(message, encoder, constants) {
+	let tokens = TOKENS_PER_MESSAGE;
+	for (const [key, value] of Object.entries(message)) {
+		if (typeof value === "string") tokens += encoder.encode(value).length;
+		if (key === "name") tokens += TOKENS_PER_NAME;
+		if (key === "tool_calls") tokens += calculateToolCallsTokens(value, encoder, constants);
+		if (key === "content" && Array.isArray(value)) tokens += calculateContentPartsTokens(value, encoder);
+	}
+	return tokens;
+}
+/**
+* Calculate tokens using custom algorithm
+*/
+function calculateTokens(messages, encoder, constants) {
+	if (messages.length === 0) return 0;
+	let numTokens = 0;
+	for (const message of messages) numTokens += calculateMessageTokens(message, encoder, constants);
+	numTokens += REPLY_PRIMING_TOKENS;
+	return numTokens;
+}
+/**
+* Get the corresponding encoder module based on encoding type
+*/
+async function getEncoder(encoding) {
+	const cached = encodingCache.get(encoding);
+	if (cached) return cached;
+	const supportedEncoding = encoding;
+	if (!(supportedEncoding in ENCODING_MAP)) {
+		const fallbackModule = await ENCODING_MAP.o200k_base();
+		encodingCache.set(encoding, fallbackModule);
+		return fallbackModule;
+	}
+	const encodingModule = await ENCODING_MAP[supportedEncoding]();
+	encodingCache.set(encoding, encodingModule);
+	return encodingModule;
+}
+/**
+* Get tokenizer type from model information
+*/
+function getTokenizerFromModel(model) {
+	return model.capabilities.tokenizer || "o200k_base";
+}
+/**
+* Get model-specific constants for token calculation
+*/
+function getModelConstants(model) {
+	const isLegacy = model.id === "gpt-3.5-turbo" || model.id === "gpt-4";
+	return {
+		...BASE_CONSTANTS,
+		functionInitOverhead: isLegacy ? 10 : 7
+	};
+}
+/**
+* Calculate tokens for a single parameter
+*/
+function calculateParameterTokens(key, prop, context) {
+	const { encoder, constants } = context;
+	let tokens = constants.propertyKeyOverhead;
+	if (typeof prop !== "object" || prop === null) return tokens;
+	const param = prop;
+	const paramName = key;
+	const paramType = param.type || "string";
+	let paramDesc = param.description || "";
+	if (param.enum && Array.isArray(param.enum)) {
+		tokens += constants.enumOverhead;
+		for (const item of param.enum) {
+			tokens += constants.enumItemCost;
+			tokens += encoder.encode(String(item)).length;
+		}
+	}
+	if (paramDesc.endsWith(".")) paramDesc = paramDesc.slice(0, -1);
+	const line = `${paramName}:${paramType}:${paramDesc}`;
+	tokens += encoder.encode(line).length;
+	const excludedKeys = new Set([
+		"type",
+		"description",
+		"enum"
+	]);
+	for (const propertyName of Object.keys(param)) if (!excludedKeys.has(propertyName)) {
+		const propertyValue = param[propertyName];
+		const propertyText = typeof propertyValue === "string" ? propertyValue : JSON.stringify(propertyValue);
+		tokens += encoder.encode(`${propertyName}:${propertyText}`).length;
+	}
+	return tokens;
+}
+/**
+* Calculate tokens for function parameters
+*/
+function calculateParametersTokens(parameters, encoder, constants) {
+	if (!parameters || typeof parameters !== "object") return 0;
+	const params = parameters;
+	let tokens = 0;
+	for (const [key, value] of Object.entries(params)) if (key === "properties") {
+		const properties = value;
+		if (Object.keys(properties).length > 0) {
+			tokens += constants.propertyInitOverhead;
+			for (const propKey of Object.keys(properties)) tokens += calculateParameterTokens(propKey, properties[propKey], {
+				encoder,
+				constants
+			});
+		}
+	} else {
+		const paramText = typeof value === "string" ? value : JSON.stringify(value);
+		tokens += encoder.encode(`${key}:${paramText}`).length;
+	}
+	return tokens;
+}
+/**
+* Calculate tokens for a single tool
+*/
+function calculateToolTokens(tool, encoder, constants) {
+	let tokens = constants.functionInitOverhead;
+	const func = tool.function;
+	const functionName = func.name;
+	let functionDescription = func.description || "";
+	if (functionDescription.endsWith(".")) functionDescription = functionDescription.slice(0, -1);
+	const line = `${functionName}:${functionDescription}`;
+	tokens += encoder.encode(line).length;
+	if (typeof func.parameters === "object" && func.parameters !== null) tokens += calculateParametersTokens(func.parameters, encoder, constants);
+	return tokens;
+}
+/**
+* Calculate token count for tools based on model
+*/
+function numTokensForTools(tools, encoder, constants) {
+	let toolTokenCount = 0;
+	for (const tool of tools) toolTokenCount += calculateToolTokens(tool, encoder, constants);
+	toolTokenCount += constants.functionEndOverhead;
+	return toolTokenCount;
+}
+/**
+* Calculate the token count of messages, supporting multiple GPT encoders
+*/
+async function getTokenCount(payload, model) {
+	const encoder = await getEncoder(getTokenizerFromModel(model));
+	const inputMessages = payload.messages.filter((msg) => msg.role !== "assistant");
+	const outputMessages = payload.messages.filter((msg) => msg.role === "assistant");
+	const constants = getModelConstants(model);
+	let inputTokens = calculateTokens(inputMessages, encoder, constants);
+	if (payload.tools && payload.tools.length > 0) inputTokens += numTokensForTools(payload.tools, encoder, constants);
+	const outputTokens = calculateTokens(outputMessages, encoder, constants);
+	return {
+		input: inputTokens,
+		output: outputTokens
+	};
+}
+async function estimateResponsesInputTokens(inputItems, model) {
+	return (await getEncoder(getTokenizerFromModel(model))).encode(JSON.stringify(inputItems)).length;
+}
+//#endregion
+//#region src/selfcheck.ts
+const PROBE_ENCODINGS = [
+	"o200k_base",
+	"cl100k_base",
+	"p50k_base",
+	"p50k_edit",
+	"r50k_base"
+];
+const PROBE_MESSAGE = "ghc-proxy selfcheck: probe text for tokenizer chunk load";
+const RUNTIME_PROBES = [
+	["http-error-response-contract", probeHttpErrorResponseContract],
+	["connection-error-classification", probeConnectionErrorClassification],
+	["response-body-cancellation", probeResponseBodyCancellation],
+	["response-commit-boundary", probeResponseCommitBoundary],
+	["caller-cancellation", probeCallerCancellation],
+	["protocol-payload-contract", probeProtocolPayloadContract]
+];
+async function probeEncoding(encoding) {
+	try {
+		const count = await getTokenCount({ messages: [{
+			role: "user",
+			content: PROBE_MESSAGE
+		}] }, {
+			id: `selfcheck-${encoding}`,
+			capabilities: { tokenizer: encoding }
+		});
+		if (count.input <= 0) throw new Error(`encoder for ${encoding} returned 0 tokens for non-empty input`);
+		return {
+			encoding,
+			ok: true,
+			tokenCount: count.input
+		};
+	} catch (error) {
+		return {
+			encoding,
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+async function runRuntimeProbe(name, probe) {
+	try {
+		await probe();
+		return {
+			name,
+			ok: true
+		};
+	} catch (error) {
+		return {
+			name,
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+async function probeHttpErrorResponseContract() {
+	const response = new HTTPError(529, { error: {
+		message: "upstream overloaded",
+		type: "overloaded_error"
+	} }, { headers: { "retry-after": "17" } }).toResponse();
+	assertProbe(response.status === 529, `expected status 529, received ${response.status}`);
+	assertProbe(response.headers.get("retry-after") === "17", "Retry-After was not preserved");
+	assertProbe((await response.json()).error?.type === "overloaded_error", "error payload changed during toResponse()");
+}
+function probeConnectionErrorClassification() {
+	assertProbe(isRetryableConnectionEstablishmentError({ code: "ConnectionRefused" }) === "connection-refused", "Bun ConnectionRefused was not classified");
+	assertProbe(isRetryableConnectionEstablishmentError(new TypeError("fetch failed", { cause: { code: "ECONNREFUSED" } })) === "connection-refused", "Node ECONNREFUSED was not classified");
+	assertProbe(isRetryableConnectionEstablishmentError(new TypeError("fetch failed", { cause: { code: "ENOTFOUND" } })) === "dns", "Node ENOTFOUND was not classified");
+	assertProbe(isRetryableConnectionEstablishmentError({
+		name: "TimeoutError",
+		code: "ECONNREFUSED"
+	}) === void 0, "timeout-shaped error was classified as a connection-establishment failure");
+}
+async function probeResponseBodyCancellation() {
+	const queue = createRuntimeProbeQueue({ maxRetries: 1 });
+	const dispatcher = process$1.versions.bun ? void 0 : new import_undici.Agent({ connections: 1 });
+	const sockets = /* @__PURE__ */ new Set();
+	let requests = 0;
+	let firstResponseClosed = false;
+	const server = createServer((_request, response) => {
+		requests++;
+		if (requests === 1) {
+			response.once("close", () => {
+				firstResponseClosed = true;
+			});
+			response.writeHead(529, { "retry-after": "0" });
+			response.write("retryable response remains open");
+			return;
+		}
+		response.end("ok");
+	});
+	server.on("connection", (socket) => {
+		sockets.add(socket);
+		socket.once("close", () => sockets.delete(socket));
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	try {
+		const address = server.address();
+		assertProbe(address !== null && typeof address === "object", "loopback server has no address");
+		const url = `http://127.0.0.1:${address.port}/retry`;
+		const result = await queue.dispatch((signal) => fetch(url, {
+			signal,
+			...dispatcher ? { dispatcher } : {}
+		}), {
+			url,
+			retryable: "capacity"
+		});
+		try {
+			assertProbe(result.response.status === 200, `expected retry status 200, received ${result.response.status}`);
+			assertProbe(await result.response.text() === "ok", "retry response body changed");
+		} finally {
+			result.release();
+		}
+		assertProbe(requests === 2, `expected one retry, observed ${requests - 1}`);
+		if (!process$1.versions.bun) assertProbe(firstResponseClosed, "retryable response did not release its transport");
+	} finally {
+		for (const socket of sockets) socket.destroy();
+		await new Promise((resolve) => server.close(() => resolve()));
+		await dispatcher?.close();
+	}
+}
+async function probeResponseCommitBoundary() {
+	const queue = createRuntimeProbeQueue({ maxRetries: 1 });
+	let attempts = 0;
+	const result = await queue.dispatch(async () => {
+		attempts++;
+		return new Response(new ReadableStream({ start(controller) {
+			controller.error(/* @__PURE__ */ new Error("probe stream failure"));
+		} }));
+	}, {
+		url: "https://example.invalid/v1/messages",
+		retryable: "capacity"
+	});
+	let bodyFailed = false;
+	try {
+		await result.response.text();
+	} catch {
+		bodyFailed = true;
+	} finally {
+		result.release();
+	}
+	assertProbe(bodyFailed, "probe stream did not fail during body consumption");
+	assertProbe(attempts === 1, `committed response was replayed ${attempts - 1} time(s)`);
+}
+async function probeCallerCancellation() {
+	const queue = createRuntimeProbeQueue();
+	const controller = new AbortController();
+	const reason = /* @__PURE__ */ new Error("selfcheck caller cancellation");
+	let observedSignal;
+	const pending = queue.dispatch(async (signal) => {
+		observedSignal = signal;
+		return new Promise((_resolve, reject) => {
+			if (!signal) {
+				reject(/* @__PURE__ */ new Error("queue did not pass the caller signal to fetch"));
+				return;
+			}
+			signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+		});
+	}, {
+		url: "https://example.invalid/v1/messages",
+		retryable: "capacity"
+	}, controller.signal);
+	await Promise.resolve();
+	await Promise.resolve();
+	controller.abort(reason);
+	let rejection;
+	try {
+		await pending;
+	} catch (error) {
+		rejection = error;
+	}
+	assertProbe(observedSignal === controller.signal, "fetch did not receive the caller signal");
+	assertProbe(rejection === reason, "caller abort reason was not preserved");
+}
+async function probeProtocolPayloadContract() {
+	const response = new HTTPError(429, { error: {
+		message: "rate limited",
+		type: "rate_limit_error"
+	} }, { headers: { "retry-after": "5" } }).toResponse();
+	const payload = await response.json();
+	const error = payload.error;
+	assertProbe(Object.keys(payload).join(",") === "error", "public error payload gained a top-level extension");
+	assertProbe(error !== void 0 && Object.keys(error).sort().join(",") === "message,type", "public error object gained a recovery extension");
+	assertProbe([...response.headers.keys()].every((name) => !name.startsWith("x-ghc-")), "public response gained a non-standard recovery header");
+}
+function createRuntimeProbeQueue(options = {}) {
+	return new UpstreamRequestQueue({
+		concurrency: 1,
+		maxRetries: options.maxRetries ?? 0,
+		baseDelayMs: 0,
+		maxDelayMs: 1,
+		maxQueueDepth: 1,
+		recoveryBudgetMs: 1e3
+	}, {
+		sleep: async () => {},
+		random: () => 0,
+		logger: {
+			warn() {},
+			info() {}
+		}
+	});
+}
+function assertProbe(condition, message) {
+	if (!condition) throw new Error(message);
+}
+async function runSelfCheck(options) {
+	const probes = await Promise.all(PROBE_ENCODINGS.map(probeEncoding));
+	const runtimeProbes = await Promise.all(RUNTIME_PROBES.map(([name, probe]) => runRuntimeProbe(name, probe)));
+	const failed = [...probes, ...runtimeProbes].filter((p) => !p.ok);
+	const result = {
+		ok: failed.length === 0,
+		probes,
+		runtimeProbes,
+		failedCount: failed.length
+	};
+	if (options.json) process$1.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+	else {
+		process$1.stdout.write(`ghc-proxy selfcheck — tokenizer dynamic-chunk load\n\n`);
+		for (const probe of probes) {
+			const mark = probe.ok ? "ok " : "FAIL";
+			const detail = probe.ok ? `tokens=${probe.tokenCount}` : `error=${probe.error}`;
+			process$1.stdout.write(`  [${mark}] ${probe.encoding.padEnd(12)} ${detail}\n`);
+		}
+		process$1.stdout.write(`\nghc-proxy runtime probes\n\n`);
+		for (const probe of runtimeProbes) {
+			const mark = probe.ok ? "ok " : "FAIL";
+			const detail = probe.ok ? "" : ` error=${probe.error}`;
+			process$1.stdout.write(`  [${mark}] ${probe.name}${detail}\n`);
+		}
+		const passed = probes.length + runtimeProbes.length - failed.length;
+		process$1.stdout.write(`\n${result.ok ? "PASS" : "FAIL"} — ${passed}/${probes.length + runtimeProbes.length} probes passed\n`);
+	}
+	if (!result.ok) process$1.exitCode = 1;
+}
+const selfcheck = defineCommand({
+	meta: {
+		name: "selfcheck",
+		description: "Probe the packaged bundle for tokenizer and cross-runtime regressions."
+	},
+	args: { json: {
+		type: "boolean",
+		default: false,
+		description: "Output probe results as JSON"
+	} },
+	run({ args }) {
+		return runSelfCheck({ json: args.json });
+	}
+});
+//#endregion
+//#region node_modules/proxy-from-env/index.js
+var DEFAULT_PORTS = {
+	ftp: 21,
+	gopher: 70,
+	http: 80,
+	https: 443,
+	ws: 80,
+	wss: 443
+};
+function parseUrl(urlString) {
+	try {
+		return new URL(urlString);
+	} catch {
+		return null;
+	}
+}
+/**
+* @param {string|object|URL} url - The URL as a string or URL instance, or a
+*   compatible object (such as the result from legacy url.parse).
+* @return {string} The URL of the proxy that should handle the request to the
+*  given URL. If no proxy is set, this will be an empty string.
+*/
+function getProxyForUrl(url) {
+	var parsedUrl = (typeof url === "string" ? parseUrl(url) : url) || {};
+	var proto = parsedUrl.protocol;
+	var hostname = parsedUrl.host;
+	var port = parsedUrl.port;
+	if (typeof hostname !== "string" || !hostname || typeof proto !== "string") return "";
+	proto = proto.split(":", 1)[0];
+	hostname = hostname.replace(/:\d*$/, "");
+	port = parseInt(port) || DEFAULT_PORTS[proto] || 0;
+	if (!shouldProxy(hostname, port)) return "";
+	var proxy = getEnv(proto + "_proxy") || getEnv("all_proxy");
+	if (proxy && proxy.indexOf("://") === -1) proxy = proto + "://" + proxy;
+	return proxy;
+}
+/**
+* Determines whether a given URL should be proxied.
+*
+* @param {string} hostname - The host name of the URL.
+* @param {number} port - The effective port of the URL.
+* @returns {boolean} Whether the given URL should be proxied.
+* @private
+*/
+function shouldProxy(hostname, port) {
+	var NO_PROXY = getEnv("no_proxy").toLowerCase();
+	if (!NO_PROXY) return true;
+	if (NO_PROXY === "*") return false;
+	return NO_PROXY.split(/[,\s]/).every(function(proxy) {
+		if (!proxy) return true;
+		var parsedProxy = proxy.match(/^(.+):(\d+)$/);
+		var parsedProxyHostname = parsedProxy ? parsedProxy[1] : proxy;
+		var parsedProxyPort = parsedProxy ? parseInt(parsedProxy[2]) : 0;
+		if (parsedProxyPort && parsedProxyPort !== port) return true;
+		if (!/^[.*]/.test(parsedProxyHostname)) return hostname !== parsedProxyHostname;
+		if (parsedProxyHostname.charAt(0) === "*") parsedProxyHostname = parsedProxyHostname.slice(1);
+		return !hostname.endsWith(parsedProxyHostname);
+	});
+}
+/**
+* Get the value for an environment variable.
+*
+* @param {string} key - The name of the environment variable.
+* @return {string} The value of the environment variable.
+* @private
+*/
+function getEnv(key) {
+	return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || "";
+}
+//#endregion
+//#region src/cli/proxy.ts
 function initProxyFromEnv() {
 	if (typeof Bun !== "undefined") return;
 	try {
@@ -47781,93 +48787,6 @@ var node = () => {
 	};
 };
 //#endregion
-//#region src/lib/request-logger.ts
-/**
-* Per-request model mapping store.
-* Route handlers write to this; the after-response hook reads from it.
-* Uses WeakMap so entries are GC'd when the Request is collected.
-*/
-const requestModelMapping = /* @__PURE__ */ new WeakMap();
-function setRequestModelMapping(request, info) {
-	requestModelMapping.set(request, info);
-}
-function getRequestModelMapping(request) {
-	return requestModelMapping.get(request);
-}
-function formatElapsed(start) {
-	return formatDurationMs(Date.now() - start);
-}
-function formatPath(rawUrl) {
-	try {
-		const url = new URL(rawUrl);
-		return `${url.pathname}${url.search}`;
-	} catch {
-		return rawUrl;
-	}
-}
-function colorizeStatus(status) {
-	if (status >= 500) return colorize("red", status);
-	if (status >= 400) return colorize("yellow", status);
-	if (status >= 300) return colorize("cyan", status);
-	return colorize("green", status);
-}
-const methodColors = {
-	GET: "cyan",
-	POST: "magenta",
-	PUT: "yellow",
-	PATCH: "yellow",
-	DELETE: "red"
-};
-function colorizeMethod(method) {
-	return colorize(methodColors[method] ?? "white", method);
-}
-function getEffectiveModel(info) {
-	return info.steps.length > 0 ? info.steps.at(-1).to : info.originalModel ?? "-";
-}
-/**
-* Mutate `modelMapping` in place by appending a transform step.
-* Strategy contexts hold a reference to the same `modelMapping`,
-* so steps are pushed directly rather than returning a new object.
-*/
-function appendModelStepInPlace(info, tag, newModel) {
-	const current = getEffectiveModel(info);
-	if (newModel !== current) info.steps.push({
-		tag,
-		from: current,
-		to: newModel
-	});
-}
-function formatModelMapping(info) {
-	if (!info) return "";
-	const { originalModel, steps } = info;
-	if (!originalModel && steps.length === 0) return "";
-	const parts = [colorize("blueBright", originalModel ?? "-")];
-	for (let i = 0; i < steps.length; i++) {
-		const step = steps[i];
-		const isLast = i === steps.length - 1;
-		parts.push(colorize("dim", `-[${step.tag}]->`));
-		parts.push(colorize(isLast ? "greenBright" : "cyanBright", step.to));
-	}
-	return ` ${colorize("dim", "model=")}${parts.join(" ")}`;
-}
-/**
-* Request logging function.
-* Logs a formatted request line with method, path, status, elapsed time,
-* and optional model mapping info.
-*/
-function logRequest(method, url, status, elapsed, modelInfo, requestId) {
-	const path = formatPath(url);
-	const line = [
-		colorize("dim", "<-"),
-		colorizeMethod(method),
-		colorize("white", path),
-		colorizeStatus(status),
-		colorize("dim", elapsed)
-	].join(" ");
-	const rid = requestId ? ` ${colorize("dim", `rid=${requestId.slice(0, 8)}`)}` : "";
-	console.log(`${line}${formatModelMapping(modelInfo)}${rid}`);
-}
-//#endregion
 //#region src/lib/sse-adapter.ts
 /**
 * Serializes Anthropic stream events into SSE output items
@@ -49143,7 +50062,7 @@ const responsesToolSchema = union([object({
 	type: literal("function"),
 	name: string().min(1),
 	parameters: jsonObjectSchema.nullable().optional(),
-	strict: boolean().optional(),
+	strict: boolean().nullable().optional(),
 	description: string().nullable().optional()
 }).loose(), object({ type: string().min(1) }).catchall(unknown()).superRefine((tool, ctx) => {
 	if (tool.type === "function") ctx.addIssue({
@@ -49162,6 +50081,8 @@ const responsesToolChoiceSchema = union([
 	}).loose(),
 	object({ type: _enum([
 		"file_search",
+		"web_search",
+		"web_search_2025_08_26",
 		"web_search_preview",
 		"web_search_preview_2025_03_11",
 		"computer_use_preview",
@@ -49402,6 +50323,10 @@ protocolRegistry.register("embeddings", embeddingsProtocol);
 //#endregion
 //#region src/lib/upstream-signal.ts
 const DEFAULT_TIMEOUT_MS = 18e5;
+function createUpstreamDeadlineFromConfig(now = performance.now()) {
+	const timeoutMs = authStore.upstreamTimeoutSeconds !== void 0 ? authStore.upstreamTimeoutSeconds * 1e3 : DEFAULT_TIMEOUT_MS;
+	return timeoutMs > 0 ? now + timeoutMs : null;
+}
 function createUpstreamSignal(clientSignal, timeoutMs = DEFAULT_TIMEOUT_MS) {
 	const controller = new AbortController();
 	const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
@@ -49418,9 +50343,30 @@ function createUpstreamSignal(clientSignal, timeoutMs = DEFAULT_TIMEOUT_MS) {
 }
 /**
 * Convenience wrapper that reads the upstream timeout from runtime config.
+*
+* This signal is a *total-duration* limit. Both runtimes separately apply an
+* ~300s **idle** timeout to `fetch` — Bun's is built in, Node's is undici's
+* `headersTimeout` / `bodyTimeout` default of `300e3` — which resets on every
+* byte received. A response that keeps streaming therefore runs past 300s and
+* is bounded only by this signal; a stalled one is rejected at ~300s by the
+* runtime instead. `isTimeoutLikeError` recognizes both runtimes' shapes so
+* every path maps to a 504.
 */
-function createUpstreamSignalFromConfig(clientSignal) {
-	return createUpstreamSignal(clientSignal, authStore.upstreamTimeoutSeconds !== void 0 ? authStore.upstreamTimeoutSeconds * 1e3 : void 0);
+function createUpstreamSignalFromConfig(clientSignal, deadlineMonotonicMs = createUpstreamDeadlineFromConfig()) {
+	const remainingMs = deadlineMonotonicMs === null ? void 0 : deadlineMonotonicMs - performance.now();
+	return {
+		...remainingMs !== void 0 && remainingMs <= 0 ? createExpiredUpstreamSignal(clientSignal) : createUpstreamSignal(clientSignal, remainingMs ?? 0),
+		deadlineMonotonicMs
+	};
+}
+function createExpiredUpstreamSignal(clientSignal) {
+	const controller = new AbortController();
+	controller.abort();
+	return {
+		signal: controller.signal,
+		clientSignal,
+		cleanup: () => {}
+	};
 }
 //#endregion
 //#region src/transform/constants.ts
@@ -49576,6 +50522,8 @@ function resolveRequestModel({ payload, betaHeaders, applyPolicy }) {
 //#endregion
 //#region src/pipeline/runner.ts
 async function runPipeline(params, config) {
+	const upstreamDeadlineMonotonicMs = createUpstreamDeadlineFromConfig();
+	const recovery = createRecoveryRecord(params);
 	const ingested = protocolRegistry.ingest(config.protocol, params.body, params.headers);
 	const meta = ingested.meta;
 	const payload = config.afterIngest ? config.afterIngest({
@@ -49583,31 +50531,321 @@ async function runPipeline(params, config) {
 		meta,
 		headers: params.headers
 	}) : ingested.payload;
-	const { resolvedModel: selectedModel, modelMapping } = resolveRequestModel({
+	const baseSourceModel = resolveBaseModel(payload, meta, config);
+	const fallbackPossible = shouldPreservePristinePayload(config.protocol, baseSourceModel);
+	const pristinePayload = fallbackPossible ? structuredClone(payload) : payload;
+	const sourceAttempt = await prepareAttempt(payload, meta, params, config, recovery, upstreamDeadlineMonotonicMs, { offerLocalModelCooldown: (sourceModel) => fallbackPossible && validateFallback(config.protocol, pristinePayload, sourceModel).ok });
+	try {
+		return {
+			result: await sourceAttempt.execute(),
+			modelMapping: sourceAttempt.modelMapping
+		};
+	} catch (error) {
+		if (!(error instanceof TerminalUpstreamRecoveryError) || error.status !== 529) throw error;
+		const sourceModel = error.recovery.sourceModel;
+		if (!sourceModel) {
+			emitFallbackEvent(error.recovery, void 0, "missing-source-model", 529);
+			throw error;
+		}
+		const candidate = fallbackPossible ? validateFallback(config.protocol, pristinePayload, sourceModel) : {
+			ok: false,
+			reason: "not-configured"
+		};
+		if (!candidate.ok) {
+			emitFallbackEvent(error.recovery, sourceModel, candidate.reason, 529);
+			throw error;
+		}
+		if (sourceAttempt.baseModel !== resolveBaseModel(pristinePayload, meta, config) || getEffectiveModel(sourceAttempt.modelMapping) !== sourceModel) {
+			emitFallbackEvent(error.recovery, sourceModel, "source-resolution-changed", 529);
+			throw error;
+		}
+		params.signal.throwIfAborted();
+		if (!error.claimFallback()) throw error;
+		error.recovery.fallbackFetchStarted = false;
+		const fallbackMapping = {
+			originalModel: sourceAttempt.modelMapping.originalModel,
+			steps: [...sourceAttempt.modelMapping.steps]
+		};
+		appendModelStepInPlace(fallbackMapping, "OVERLOAD_FALLBACK", candidate.target.id);
+		let fallbackAttempt;
+		try {
+			fallbackAttempt = await prepareAttempt(structuredClone(pristinePayload), meta, params, config, error.recovery, upstreamDeadlineMonotonicMs, {
+				target: candidate.target,
+				modelMapping: fallbackMapping,
+				fallbackAttempt: true
+			});
+		} catch {
+			if (params.signal.aborted) throw params.signal.reason;
+			emitFallbackEvent(error.recovery, candidate.target.id, "preflight-rejected", 529);
+			throw error;
+		}
+		error.recovery.retryLimit = error.recovery.retryCount;
+		emitFallbackEvent(error.recovery, candidate.target.id, "selected", 529);
+		try {
+			const result = await fallbackAttempt.execute();
+			emitFallbackEvent(error.recovery, candidate.target.id, "succeeded");
+			return {
+				result: discloseActualModel(result, candidate.target.id),
+				modelMapping: fallbackMapping
+			};
+		} catch (fallbackError) {
+			if (params.signal.aborted) throw params.signal.reason;
+			if (fallbackError instanceof FallbackCooldownError) {
+				emitFallbackEvent(error.recovery, candidate.target.id, "target-cooldown", 529);
+				throw error;
+			}
+			if (!error.recovery.fallbackFetchStarted) {
+				emitFallbackEvent(error.recovery, candidate.target.id, "pre-fetch-failed", 529);
+				throw error;
+			}
+			emitFallbackEvent(error.recovery, candidate.target.id, "target-failed", fallbackError instanceof HTTPError ? fallbackError.status : void 0, isRetryableConnectionEstablishmentError(fallbackError));
+			throw fallbackError;
+		}
+	}
+}
+async function prepareAttempt(payload, meta, params, config, recovery, upstreamDeadlineMonotonicMs, options = {}) {
+	const resolved = resolveRequestModel({
 		payload,
 		betaHeaders: meta.betaHeaders,
 		applyPolicy: config.applyModelPolicy
 	});
+	const baseModel = resolved.model;
+	const selectedModel = options.target ?? resolved.resolvedModel;
+	const modelMapping = options.modelMapping ?? resolved.modelMapping;
+	if (options.target) payload.model = options.target.id;
 	if (config.afterTransform) await config.afterTransform({
 		payload,
 		meta,
 		headers: params.headers,
 		selectedModel
 	});
-	const upstreamSignal = createUpstreamSignalFromConfig(params.signal);
-	const copilotClient = createCopilotClient();
-	const ctx = config.buildStrategyContext({
-		payload,
-		meta,
-		headers: params.headers,
-		selectedModel,
-		copilotClient,
-		upstreamSignal,
-		modelMapping
+	params.signal.throwIfAborted();
+	const upstreamSignal = createUpstreamSignalFromConfig(params.signal, upstreamDeadlineMonotonicMs);
+	const copilotClient = createCopilotClient(recovery, {
+		offerLocalModelCooldown: options.offerLocalModelCooldown,
+		fallbackAttempt: options.fallbackAttempt
 	});
+	try {
+		const ctx = config.buildStrategyContext({
+			payload,
+			meta,
+			headers: params.headers,
+			selectedModel,
+			copilotClient,
+			upstreamSignal,
+			modelMapping,
+			recovery
+		});
+		const entry = config.strategyRegistry.select(selectedModel, ctx);
+		return {
+			baseModel,
+			modelMapping,
+			execute: async () => {
+				try {
+					params.signal.throwIfAborted();
+					return await entry.execute(ctx);
+				} catch (error) {
+					upstreamSignal.cleanup();
+					throw error;
+				}
+			}
+		};
+	} catch (error) {
+		upstreamSignal.cleanup();
+		throw error;
+	}
+}
+function resolveBaseModel(pristinePayload, meta, config) {
+	return resolveRequestModel({
+		payload: { ...pristinePayload },
+		betaHeaders: meta.betaHeaders,
+		applyPolicy: config.applyModelPolicy
+	}).model;
+}
+function shouldPreservePristinePayload(protocol, baseSourceModel) {
+	if (configStore.getOverloadFallback(baseSourceModel)?.trim()) return true;
+	if (protocol !== "anthropic-messages" || !configStore.hasOverloadFallbacks()) return false;
+	const model = modelCache.findById(baseSourceModel);
+	return !model || !modelCache.supportsEndpoint(model, "/v1/messages") && !modelCache.supportsEndpoint(model, "/responses");
+}
+function validateFallback(protocol, payload, sourceModel) {
+	const targetId = configStore.getOverloadFallback(sourceModel)?.trim();
+	if (!targetId) return {
+		ok: false,
+		reason: "not-configured"
+	};
+	if (targetId === sourceModel) return {
+		ok: false,
+		reason: "same-model"
+	};
+	const target = modelCache.findById(targetId);
+	if (!target) return {
+		ok: false,
+		reason: "unknown-target"
+	};
+	if (protocol === "responses" && !modelCache.supportsEndpoint(target, "/responses")) return {
+		ok: false,
+		reason: "unsupported-endpoint"
+	};
+	if (requestsTools(payload) && !modelCache.supportsToolCalls(target)) return {
+		ok: false,
+		reason: "unsupported-tools"
+	};
+	if (requestsParallelToolCalls(protocol, payload) && target.capabilities.supports.parallel_tool_calls !== true) return {
+		ok: false,
+		reason: "unsupported-parallel-tools"
+	};
+	if (requestsStreaming(payload) && target.capabilities.supports.streaming === false) return {
+		ok: false,
+		reason: "unsupported-streaming"
+	};
+	if (requestsVision(payload) && !modelCache.supportsVision(target)) return {
+		ok: false,
+		reason: "unsupported-vision"
+	};
+	if (requestsReasoningEffort(protocol, payload) && !modelCache.supportsReasoningEffort(target)) return {
+		ok: false,
+		reason: "unsupported-reasoning"
+	};
+	if (requestsThinking(protocol, payload) && !modelCache.supportsAdaptiveThinking(target) && !modelCache.supportsReasoningEffort(target)) return {
+		ok: false,
+		reason: "unsupported-thinking"
+	};
+	if (requestsStructuredOutput(protocol, payload) && !supportsStructuredOutput(protocol, target)) return {
+		ok: false,
+		reason: "unsupported-structured-output"
+	};
+	return {
+		ok: true,
+		target
+	};
+}
+function requestsTools(payload) {
+	const tools = asRecord(payload)?.tools;
+	return Array.isArray(tools) && tools.length > 0;
+}
+function requestsParallelToolCalls(protocol, payload) {
+	if (protocol === "anthropic-messages") return requestsTools(payload);
+	return asRecord(payload)?.parallel_tool_calls === true;
+}
+function requestsStreaming(payload) {
+	return asRecord(payload)?.stream === true;
+}
+function requestsVision(payload) {
+	return containsVisionPart(asRecord(payload)?.messages) || containsVisionPart(asRecord(payload)?.input);
+}
+function containsVisionPart(value) {
+	if (Array.isArray(value)) return value.some(containsVisionPart);
+	const record = asRecord(value);
+	if (!record) return false;
+	if (record.type === "image" || record.type === "image_url" || record.type === "input_image") return true;
+	return containsVisionPart(record.content);
+}
+function requestsReasoningEffort(protocol, payload) {
+	const record = asRecord(payload);
+	if (!record) return false;
+	const effort = protocol === "anthropic-messages" ? asRecord(record.output_config)?.effort : protocol === "responses" ? asRecord(record.reasoning)?.effort : record.reasoning_effort;
+	return effort !== void 0 && effort !== "none";
+}
+function requestsThinking(protocol, payload) {
+	const record = asRecord(payload);
+	if (!record) return false;
+	if (protocol === "anthropic-messages") {
+		const type = asRecord(record.thinking)?.type;
+		return type === "enabled" || type === "adaptive";
+	}
+	if (protocol === "openai-chat") return typeof record.thinking_budget === "number" && record.thinking_budget > 0;
+	return false;
+}
+function requestsStructuredOutput(protocol, payload) {
+	const record = asRecord(payload);
+	if (!record) return false;
+	if (protocol === "anthropic-messages") return asRecord(record.output_config)?.format !== void 0;
+	if (protocol === "responses") {
+		const type = asRecord(asRecord(record.text)?.format)?.type;
+		return type !== void 0 && type !== "text";
+	}
+	const responseFormat = asRecord(record.response_format);
+	return responseFormat?.type !== void 0 && responseFormat.type !== "text";
+}
+function supportsStructuredOutput(protocol, model) {
+	if (protocol === "anthropic-messages") return modelCache.supportsStructuredOutputs(model) || modelCache.supportsEndpoint(model, "/responses");
+	return model.capabilities.supports.structured_outputs ?? false;
+}
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function discloseActualModel(result, model) {
+	if (result.kind === "json") return {
+		kind: "json",
+		data: replaceKnownModelIdentity(result.data, model)
+	};
+	return {
+		kind: "stream",
+		generator: discloseStreamModel(result.generator, model)
+	};
+}
+async function* discloseStreamModel(generator, model) {
+	for await (const chunk of generator) {
+		if (!chunk.data || chunk.data === "[DONE]") {
+			yield chunk;
+			continue;
+		}
+		try {
+			const parsed = JSON.parse(chunk.data);
+			const replaced = replaceKnownModelIdentity(parsed, model);
+			yield replaced === parsed ? chunk : {
+				...chunk,
+				data: JSON.stringify(replaced)
+			};
+		} catch {
+			yield chunk;
+		}
+	}
+}
+function replaceKnownModelIdentity(value, model) {
+	const record = asRecord(value);
+	if (!record) return value;
+	let changed = false;
+	const next = { ...record };
+	if (typeof record.model === "string") {
+		next.model = model;
+		changed = true;
+	}
+	for (const key of ["message", "response"]) {
+		const nested = asRecord(record[key]);
+		if (nested && typeof nested.model === "string") {
+			next[key] = {
+				...nested,
+				model
+			};
+			changed = true;
+		}
+	}
+	return changed ? next : value;
+}
+function emitFallbackEvent(recovery, effectiveModel, decision, status, connectionClass) {
+	const now = performance.now();
+	logRecoveryEvent({
+		requestId: recovery.requestId,
+		callerRequestId: recovery.callerRequestId,
+		event: "fallback",
+		retryCount: recovery.retryCount,
+		effectiveModel,
+		status,
+		connectionClass,
+		...recovery.queueMetrics,
+		...recovery.startedAtMonotonicMs !== void 0 ? { elapsedMs: Math.max(0, now - recovery.startedAtMonotonicMs) } : {},
+		...recovery.deadlineMonotonicMs !== void 0 ? { remainingBudgetMs: Math.max(0, recovery.deadlineMonotonicMs - now) } : {},
+		decision
+	});
+}
+function createRecoveryRecord(request) {
 	return {
-		result: await config.strategyRegistry.select(selectedModel, ctx).execute(ctx),
-		modelMapping
+		requestId: request.requestId,
+		...request.callerRequestId ? { callerRequestId: request.callerRequestId } : {},
+		callerSignal: request.signal,
+		retryCount: 0
 	};
 }
 //#endregion
@@ -50465,14 +51703,9 @@ var AnthropicStreamTranslator = class {
 		this.state.messageStartSent = true;
 	}
 	getErrorMessage(error) {
-		if (this.isTimeoutError(error)) return "Upstream streaming request timed out. Please retry.";
+		if (isTimeoutLikeError(error)) return "Upstream streaming request timed out. Please retry.";
 		return "An unexpected error occurred during streaming.";
 	}
-	isTimeoutError(error) {
-		if (error instanceof DOMException) return error.name === "TimeoutError";
-		if (error instanceof Error) return error.name === "TimeoutError";
-		return false;
-	}
 	toConversationDeltas(chunk) {
 		if (chunk.choices.length === 0) return [];
 		const choice = chunk.choices.toSorted((left, right) => left.index - right.index)[0];
@@ -51092,11 +52325,13 @@ const chatCompletionsStrategyRegistry = new StrategyRegistry();
 chatCompletionsStrategyRegistry.register(chatCompletionsEntry$1);
 //#endregion
 //#region src/routes/chat-completions/handler.ts
-async function handleCompletionCore({ body, signal, headers }) {
+async function handleCompletionCore({ body, signal, headers, requestId, callerRequestId }) {
 	return runPipeline({
 		body,
 		signal,
-		headers
+		headers,
+		requestId,
+		callerRequestId
 	}, {
 		protocol: "openai-chat",
 		strategyRegistry: chatCompletionsStrategyRegistry,
@@ -51138,7 +52373,8 @@ function createCompletionRoutes() {
 		const { result, modelMapping } = await handleCompletionCore({
 			body,
 			signal: request.signal,
-			headers: request.headers
+			headers: request.headers,
+			...getOrCreateRequestCorrelation(request)
 		});
 		const delivery = deliverResult(request, result, modelMapping);
 		if (!delivery.streaming) return delivery.data;
@@ -51363,12 +52599,19 @@ function normalizeSchemaNode(node) {
 		}
 		normalized[key] = normalizeSchemaNode(value);
 	}
-	if (node.type === "object" || isRecord$2(normalized.properties)) {
-		normalized.required = isRecord$2(normalized.properties) ? Object.keys(normalized.properties) : [];
-		normalized.additionalProperties = false;
-	}
 	return normalized;
 }
+/**
+* Strip JSON Schema / OpenAPI annotations Copilot's function-schema validator
+* rejects, leaving the structural schema — including the caller's own
+* `required` array and `additionalProperties` — untouched.
+*
+* The annotation stripping is currently inert: probed 2026-08-06
+* (`scripts/probes/tool-strict.ts`), upstream accepts every annotation in the
+* list on every `/responses` model with `strict` omitted. It stays anyway — the
+* list was written against the upstream of 2026-04, and a probe result is a
+* dated snapshot rather than a permanent fact.
+*/
 function normalizeFunctionParametersSchemaForCopilot(schema) {
 	if (!schema) return schema;
 	return normalizeSchemaNode(schema);
@@ -51684,7 +52927,6 @@ function convertAnthropicTools(tools) {
 		type: "function",
 		name: tool.name,
 		parameters: normalizeFunctionParametersSchemaForCopilot(tool.input_schema),
-		strict: false,
 		...tool.description ? { description: tool.description } : {}
 	}));
 }
@@ -52559,34 +53801,45 @@ defaultStrategyRegistry.register(responsesApiEntry);
 defaultStrategyRegistry.register(chatCompletionsEntry);
 //#endregion
 //#region src/routes/messages/handler.ts
-async function handleMessagesCore({ body, signal, headers }) {
+async function handleMessagesCore({ body, signal, headers, requestId, callerRequestId }) {
 	let anthropicBetaHeader;
-	return runPipeline({
-		body,
-		signal,
-		headers
-	}, {
-		protocol: "anthropic-messages",
-		applyModelPolicy: true,
-		strategyRegistry: defaultStrategyRegistry,
-		afterIngest({ payload, headers: reqHeaders }) {
-			if (consola.level >= 4) consola.debug("Anthropic request payload:", JSON.stringify(payload));
-			anthropicBetaHeader = processAnthropicBetaHeader(reqHeaders.get("anthropic-beta"));
-			return payload;
-		},
-		buildStrategyContext({ payload, meta, headers: reqHeaders, selectedModel, copilotClient, upstreamSignal, modelMapping }) {
-			return {
-				copilotClient,
-				anthropicPayload: payload,
-				anthropicBetaHeader,
-				selectedModel,
-				upstreamSignal,
-				headers: reqHeaders,
-				requestContext: meta.requestContext ?? {},
-				modelMapping
-			};
-		}
-	});
+	try {
+		return await runPipeline({
+			body,
+			signal,
+			headers,
+			requestId,
+			callerRequestId
+		}, {
+			protocol: "anthropic-messages",
+			applyModelPolicy: true,
+			strategyRegistry: defaultStrategyRegistry,
+			afterIngest({ payload, headers: reqHeaders }) {
+				if (consola.level >= 4) consola.debug("Anthropic request payload:", JSON.stringify(payload));
+				anthropicBetaHeader = processAnthropicBetaHeader(reqHeaders.get("anthropic-beta"));
+				return payload;
+			},
+			buildStrategyContext({ payload, meta, headers: reqHeaders, selectedModel, copilotClient, upstreamSignal, modelMapping }) {
+				return {
+					copilotClient,
+					anthropicPayload: payload,
+					anthropicBetaHeader,
+					selectedModel,
+					upstreamSignal,
+					headers: reqHeaders,
+					requestContext: meta.requestContext ?? {},
+					modelMapping
+				};
+			}
+		});
+	} catch (error) {
+		if (!(error instanceof HTTPError)) throw error;
+		const body = "type" in error.body ? error.body : {
+			type: "error",
+			...error.body
+		};
+		throw new HTTPError(error.status, body, { headers: error.headers });
+	}
 }
 //#endregion
 //#region src/routes/messages/route.ts
@@ -52596,7 +53849,8 @@ function createMessageRoutes() {
 		const { result, modelMapping } = await handleMessagesCore({
 			body,
 			signal: request.signal,
-			headers: request.headers
+			headers: request.headers,
+			...getOrCreateRequestCorrelation(request)
 		});
 		const delivery = deliverResult(request, result, modelMapping);
 		if (!delivery.streaming) return delivery.data;
@@ -53008,14 +54262,16 @@ const HTTP_URL_RE = /^https?:\/\//i;
 * emulator request prep, tool/input policies, and context management applied
 * through the afterIngest / afterTransform lifecycle hooks.
 */
-async function handleResponsesCore({ body, signal, headers }) {
+async function handleResponsesCore({ body, signal, headers, requestId, callerRequestId }) {
 	const emulatorMode = configStore.isEmulatorEnabled();
 	let originalPayload;
 	let emulatorPrepared;
 	return await runPipeline({
 		body,
 		signal,
-		headers
+		headers,
+		requestId,
+		callerRequestId
 	}, {
 		protocol: "responses",
 		strategyRegistry: responsesStrategyRegistry,
@@ -53035,7 +54291,7 @@ async function handleResponsesCore({ body, signal, headers }) {
 			clampResponsesOutputTokens(payload);
 			clampResponsesReasoningEffort(payload, selectedModel);
 		},
-		buildStrategyContext({ payload, meta, copilotClient, upstreamSignal }) {
+		buildStrategyContext({ payload, meta, selectedModel, copilotClient, upstreamSignal }) {
 			const { vision, initiator } = getResponsesRequestOptions(payload);
 			const prepared = emulatorPrepared;
 			const requestPayload = originalPayload ?? payload;
@@ -53046,7 +54302,10 @@ async function handleResponsesCore({ body, signal, headers }) {
 				requestContext: meta.requestContext ?? {},
 				vision,
 				initiator,
-				decorateResponse: prepared ? (response) => decorateStoredResponse(response, requestPayload, prepared) : void 0,
+				decorateResponse: prepared ? (response) => decorateStoredResponse({
+					...response,
+					model: selectedModel?.id ?? response.model
+				}, requestPayload, prepared) : void 0,
 				onTerminalResponse: prepared ? (terminalResponse) => {
 					if (!prepared.shouldStore) return;
 					persistEmulatorResponse(terminalResponse, prepared.effectiveInputItems);
@@ -53058,16 +54317,16 @@ async function handleResponsesCore({ body, signal, headers }) {
 function applyResponsesToolTransforms(payload) {
 	applyFunctionApplyPatch(payload);
 	applyFunctionToolCompatibilityDefaults(payload);
-	rejectUnsupportedBuiltinTools(payload);
 }
 function applyFunctionToolCompatibilityDefaults(payload) {
 	if (!Array.isArray(payload.tools)) return;
 	payload.tools = payload.tools.map((tool) => {
 		if (!isResponseFunctionTool(tool)) return tool;
+		const { strict, ...rest } = tool;
 		return {
-			...tool,
+			...rest,
 			parameters: normalizeFunctionParametersSchemaForCopilot(tool.parameters),
-			strict: tool.strict ?? true
+			...strict != null ? { strict } : {}
 		};
 	});
 }
@@ -53094,11 +54353,6 @@ function applyFunctionApplyPatch(payload) {
 		return tool;
 	});
 }
-function rejectUnsupportedBuiltinTools(payload) {
-	if (payload.tool_choice && typeof payload.tool_choice === "object" && "type" in payload.tool_choice && (payload.tool_choice.type === "web_search_preview" || payload.tool_choice.type === "web_search_preview_2025_03_11")) throwInvalidRequestError("The selected Copilot endpoint does not support the Responses web_search tool.", "tool_choice", "unsupported_tool_web_search");
-	if (!Array.isArray(payload.tools)) return;
-	for (const tool of payload.tools) if (tool.type === "web_search") throwInvalidRequestError("The selected Copilot endpoint does not support the Responses web_search tool.", "tools", "unsupported_tool_web_search");
-}
 function applyResponsesInputPolicies(payload) {
 	payload.store = false;
 	stripUnresolvableInputItems(payload);
@@ -53280,7 +54534,8 @@ function createResponsesRoutes() {
 		const { result, modelMapping } = await handleResponsesCore({
 			body,
 			signal: request.signal,
-			headers: request.headers
+			headers: request.headers,
+			...getOrCreateRequestCorrelation(request)
 		});
 		const delivery = deliverResult(request, result, modelMapping);
 		if (!delivery.streaming) return delivery.data;
@@ -53344,37 +54599,122 @@ function createUsageRoute() {
 //#endregion
 //#region src/server.ts
 const isBun = typeof globalThis.Bun !== "undefined";
-function createServer(options) {
+/**
+* Smallest and largest status an error may claim for itself.
+*
+* An error that reports a 2xx/3xx — or a nonsense number — is not describing a
+* failure the client can act on, so it falls through to 500 rather than turning
+* a thrown exception into an apparent success.
+*/
+const MIN_ERROR_STATUS = 400;
+const MAX_ERROR_STATUS = 599;
+/**
+* The status a thrown value claims for itself, when it claims a plausible one.
+*
+* Elysia's built-in error classes (`NotFoundError`, `ParseError`,
+* `ValidationError`, `InternalServerError`) each declare `status: number` as
+* part of their public class contract, and this repo's own `TranslationFailure`
+* declares `status: 400 | 502`. Reading the property instead of mapping
+* `code` covers all of them, and covers whatever Elysia adds next.
+*
+* The read is wrapped because this runs inside the error handler: `status` may
+* be a getter and `error` may be a Proxy, either of which can throw. This
+* hardens this function only — Elysia itself does `set.status = error.status`
+* after `onError` returns (`elysia/dist/compose.mjs`), so a hostile getter
+* still escapes `app.handle()`. Measured on the pre-fix tree as well, so that
+* escape is Elysia's, not something reading the property here introduced.
+* `isTimeoutLikeError` guards its own traversal the same way.
+*/
+function claimedErrorStatus(error) {
+	if (typeof error !== "object" || error === null) return void 0;
+	let status;
+	try {
+		if (!("status" in error)) return void 0;
+		status = error.status;
+	} catch {
+		return;
+	}
+	return typeof status === "number" && Number.isInteger(status) && status >= MIN_ERROR_STATUS && status <= MAX_ERROR_STATUS ? status : void 0;
+}
+/**
+* Client-facing error `type` for a locally generated failure.
+*
+* The proxy's other error paths already classify by meaning
+* (`invalid_request_error`, `upstream_error`, `rate_limit_error`,
+* `timeout_error`), and `upstreamErrorType` in `src/lib/error.ts` states the
+* rule: a non-standard `type` at the proxy boundary breaks client error
+* handling. Honoring the thrown error's status made this branch reachable at
+* 404/400/422 rather than only 500, so it classifies too instead of labelling
+* every one of them `error`.
+*/
+function localErrorType(status) {
+	if (status === 404) return "not_found_error";
+	if (status >= 400 && status < 500) return "invalid_request_error";
+	return "error";
+}
+/**
+* Elysia's `NotFoundError` carries the bare string `NOT_FOUND` as its message.
+* That is an internal token, not something a client should be shown, so an
+* unmatched route gets a sentence instead.
+*/
+const NOT_FOUND_MESSAGE = "Unknown endpoint. Check the request path.";
+/**
+* Maps a thrown error to a client response.
+*
+* `set.status` is written on every branch because `onError` returns a fresh
+* `Response` instead of falling through Elysia's normal path — `set.status`
+* would otherwise still hold whatever it was before the throw, and the access
+* log in `onAfterResponse` reads it. Without the write-back, a 504 is logged
+* as a 500.
+*
+* Errors that carry their own plausible status keep it. Flattening every
+* non-HTTPError to 500 turned an unmatched route into `500 NaNs` on an
+* OpenAI-compatible surface where an unknown path owes the client a 404, and
+* hid `TranslationFailure`'s 502 behind a generic 500.
+*
+* Exported so tests exercise this mapping rather than a copy of it.
+*/
+function handleRouteError({ code, error, set }) {
+	if (code === "HTTP") return;
+	if (isTimeoutLikeError(error)) {
+		set.status = 504;
+		return Response.json({ error: {
+			message: "Upstream request timed out before a response was received.",
+			type: "timeout_error"
+		} }, { status: 504 });
+	}
+	const status = claimedErrorStatus(error) ?? 500;
+	const rawMessage = error instanceof Error ? error.message : String(error);
+	const message = code === "NOT_FOUND" ? NOT_FOUND_MESSAGE : rawMessage;
+	set.status = status;
+	return Response.json({ error: {
+		message,
+		type: localErrorType(status)
+	} }, { status });
+}
+function createServer$1(options) {
 	return new Elysia({
 		adapter: isBun ? void 0 : node(),
 		serve: options?.idleTimeout !== void 0 ? { idleTimeout: options.idleTimeout } : void 0
-	}).use(cors()).error({ HTTP: HTTPError }).derive(({ request }) => ({
-		requestStart: Date.now(),
-		requestId: request.headers.get("x-request-id") ?? crypto.randomUUID()
-	})).onBeforeHandle(({ body, request }) => {
+	}).use(cors()).error({ HTTP: HTTPError }).onRequest(({ request }) => {
+		markRequestStart(request);
+	}).derive(({ request }) => ({ ...getOrCreateRequestCorrelation(request) })).onBeforeHandle(({ body, request, responseRequestId, set }) => {
+		set.headers["x-request-id"] = responseRequestId;
 		if (request.method !== "POST") return;
 		const model = body && typeof body === "object" && "model" in body ? body.model : void 0;
 		if (typeof model === "string") setRequestModelMapping(request, {
 			originalModel: model,
 			steps: []
 		});
-	}).onAfterResponse(({ request, requestStart, requestId, set }) => {
-		set.headers["x-request-id"] = requestId;
-		const elapsed = formatElapsed(requestStart);
+	}).onAfterResponse(({ callerRequestId, request, requestId, set }) => {
+		const elapsed = formatElapsed(getRequestStart(request));
 		const status = typeof set.status === "number" ? set.status : 200;
-		logRequest(request.method, request.url, status, elapsed, getRequestModelMapping(request), requestId);
-	}).onError(({ code, error }) => {
-		if (code === "HTTP") return;
-		if (error instanceof Error && error.name === "AbortError") return Response.json({ error: {
-			message: "Upstream request was aborted",
-			type: "timeout_error"
-		} }, { status: 504 });
-		const message = error instanceof Error ? error.message : String(error);
-		return Response.json({ error: {
-			message,
-			type: "error"
-		} }, { status: 500 });
-	}).get("/", () => "Server running").get("/health", () => ({
+		logRequest(request.method, request.url, status, elapsed, getRequestModelMapping(request), requestId, callerRequestId);
+	}).onError(({ code, error, set }) => handleRouteError({
+		code,
+		error,
+		set
+	})).get("/", () => "Server running").get("/health", () => ({
 		status: "ok",
 		copilotToken: !!authStore.copilotToken,
 		modelsLoaded: !!modelCache.getModels(),
@@ -53432,11 +54772,13 @@ async function runServer(options) {
 	const cachedConfig = getCachedConfig();
 	const upstreamQueueConcurrency = options.upstreamQueueConcurrency ?? cachedConfig.upstreamQueueConcurrency;
 	const upstreamQueueMaxRetries = options.upstreamQueueMaxRetries ?? cachedConfig.upstreamQueueMaxRetries;
+	const upstreamRecoveryBudgetSeconds = options.upstreamRecoveryBudgetSeconds ?? cachedConfig.upstreamRecoveryBudgetSeconds;
 	const upstreamQueueBaseDelaySeconds = options.upstreamQueueBaseDelaySeconds ?? cachedConfig.upstreamQueueBaseDelaySeconds;
 	const upstreamQueueMaxDelaySeconds = options.upstreamQueueMaxDelaySeconds ?? cachedConfig.upstreamQueueMaxDelaySeconds;
 	configureUpstreamRequestQueue({
 		concurrency: upstreamQueueConcurrency,
 		maxRetries: upstreamQueueMaxRetries,
+		recoveryBudgetMs: secondsToMs(upstreamRecoveryBudgetSeconds),
 		baseDelayMs: secondsToMs(upstreamQueueBaseDelaySeconds),
 		maxDelayMs: secondsToMs(upstreamQueueMaxDelaySeconds)
 	});
@@ -53451,7 +54793,7 @@ async function runServer(options) {
 		await maybeCopyClaudeCodeCommand(serverUrl);
 	}
 	printStartupBanner(serverUrl);
-	const app = createServer({ idleTimeout: options.idleTimeoutSeconds });
+	const app = createServer$1({ idleTimeout: options.idleTimeoutSeconds });
 	app.listen(options.port);
 	const shutdown = async () => {
 		consola.info("Shutting down gracefully...");
@@ -53471,6 +54813,15 @@ function parseIntArg(raw, name, fallbackMsg) {
 	}
 	return n;
 }
+function parseBoundedIntArg(raw, name, fallbackMsg, min, max) {
+	if (raw === void 0) return void 0;
+	const value = Number(raw);
+	if (!raw.trim() || !Number.isInteger(value) || value < min || value > max) {
+		consola.warn(`Invalid --${name} value "${raw}". ${fallbackMsg}`);
+		return;
+	}
+	return value;
+}
 function secondsToMs(seconds) {
 	return seconds === void 0 ? void 0 : seconds * 1e3;
 }
@@ -53547,7 +54898,7 @@ const start = defineCommand({
 		"upstream-timeout": {
 			type: "string",
 			default: "1800",
-			description: "Upstream request timeout in seconds (0 to disable)"
+			description: "Upstream request timeout in seconds (0 to disable). Enforced as a total-duration limit; both runtimes additionally apply their own ~300s idle timeout to fetch, which a steadily streaming response does not trip."
 		},
 		"upstream-queue-concurrency": {
 			type: "string",
@@ -53555,7 +54906,11 @@ const start = defineCommand({
 		},
 		"upstream-queue-retries": {
 			type: "string",
-			description: "Maximum retries for transient upstream responses (default: 5)"
+			description: "Maximum retries for transient upstream responses (0-2, default: 1)"
+		},
+		"upstream-recovery-budget": {
+			type: "string",
+			description: "Recovery budget in seconds after the first retryable outcome (1-120, default: 60)"
 		},
 		"upstream-queue-base-delay": {
 			type: "string",
@@ -53582,7 +54937,8 @@ const start = defineCommand({
 		const idleTimeoutSeconds = parseIntArg(args["idle-timeout"], "idle-timeout", "Falling back to Bun default.");
 		const upstreamTimeoutSeconds = parseIntArg(args["upstream-timeout"], "upstream-timeout", "Falling back to default (300s).");
 		const upstreamQueueConcurrency = parseIntArg(args["upstream-queue-concurrency"], "upstream-queue-concurrency", "Using default upstream queue concurrency.");
-		const upstreamQueueMaxRetries = parseIntArg(args["upstream-queue-retries"], "upstream-queue-retries", "Using default upstream queue retry count.");
+		const upstreamQueueMaxRetries = parseBoundedIntArg(args["upstream-queue-retries"], "upstream-queue-retries", "Using default upstream queue retry count.", 0, 2);
+		const upstreamRecoveryBudgetSeconds = parseBoundedIntArg(args["upstream-recovery-budget"], "upstream-recovery-budget", "Using default upstream recovery budget.", 1, 120);
 		const upstreamQueueBaseDelaySeconds = parseIntArg(args["upstream-queue-base-delay"], "upstream-queue-base-delay", "Using default upstream queue base delay.");
 		const upstreamQueueMaxDelaySeconds = parseIntArg(args["upstream-queue-max-delay"], "upstream-queue-max-delay", "Using default upstream queue max delay.");
 		return runServer({
@@ -53600,6 +54956,7 @@ const start = defineCommand({
 			upstreamTimeoutSeconds,
 			upstreamQueueConcurrency,
 			upstreamQueueMaxRetries,
+			upstreamRecoveryBudgetSeconds,
 			upstreamQueueBaseDelaySeconds,
 			upstreamQueueMaxDelaySeconds,
 			gheDomain: args["ghe-domain"],