llm-relay 0.9.0 → 0.11.0

package/README.md

@@ -8,7 +8,7 @@ A standalone, **loopback** Anthropic-Messages-API reverse proxy. It forwards `/v
 
 - **Transparent passthrough** — forwards streaming and non-streaming `/v1/messages` byte-for-byte.
 - **`detect` mode** — deterministic tool_use validation (Ajv2020) with metadata-only logging of pass/fail/uncheckable. Behavior is unchanged; it only observes.
-- **`repair` mode** — on a validation failure, a cheap reshaper model corrects the call, the result is **re-validated**, and the corrected response is re-emitted (JSON or freshly-serialized SSE). Destructive-tool calls are **refused, never fabricated**; unrepairable calls **fail-clean** (502). Valid calls pass through untouched.
+- **`repair` mode** — on a validation failure, a cheap reshaper model corrects the call, the result is **re-validated**, and the corrected response is re-emitted (JSON or freshly-serialized SSE). Destructive-tool calls are **refused, never fabricated**; unrepairable calls **fail-clean** (502). Valid calls pass through untouched. The refusal matches the tool **name exactly** (case-insensitively) — see [Destructive-tool refusal](#destructive-tool-refusal-repairdestructivetools) for which tools that now covers.
 - **OpenAI-compatible backends** (`backend.kind:"openai"`) — front NIM / vLLM / OpenRouter / LM Studio. Requests are translated Anthropic→OpenAI and responses back (streaming SSE + non-streaming) via [`llm-bridge`](https://github.com/supermemoryai/llm-bridge) (zero-dep). The validate/repair layer always sees Anthropic Messages, regardless of backend. Verified live end-to-end.
 - **Streaming repair** — text-block SSE frames stream to the client **as they arrive**; the proxy only withholds from the first `tool_use` block. A pure-text response is byte-for-byte passthrough with zero added latency; a valid tool call flushes the withheld frames verbatim; an invalid one is repaired with only the corrected trailing blocks re-emitted (`message_start` + leading text already delivered). A mid-stream repair failure surfaces as an SSE `error` event, never a fabricated call. Handles LF and CRLF frame delimiters and multibyte UTF-8 across chunk boundaries.
 
@@ -66,8 +66,9 @@ llm-relay
 - **Subagent offload** (`routing.offload` + `routing.subagents`): route Claude Code *subagents* to other providers while the human's own conversation stays on passthrough — with no agent files and no model ids in the prompt. **Off by default**; `llm-relay offload on` flips it without a restart, `llm-relay candidates` shows what to point it at. See below.
 
 ### 3. Prompt Token & Context Length Guardrails
-- Automatically estimates request prompt token count (`estimateRequestTokens`) against target model context limits (`getModelMetadata`).
-- Rejects oversized requests before network transmission with an HTTP 400 error (`request prompt estimated tokens exceeds model context limit`), protecting backends from context window overflow.
+- Estimates the request's prompt token count (`estimateRequestTokens`) against the target model's context limit, read from the warm catalog cache (`cachedLimits()` — it never fetches, so a cold cache costs no round-trip on the request path).
+- Rejects an oversized request before network transmission with an HTTP 400 (`request prompt estimated tokens … exceeds the context limit …`), protecting backends from context-window overflow.
+- ⚠ **It only fires against a limit the *serving* provider published.** If that provider publishes no limit (NIM publishes none), there is no guardrail: the request goes upstream and the backend returns its own authoritative error. llm-relay will not reject a request against a number it guessed — see the per-(provider, model) note under [Choosing where to offload](#choosing-where-to-offload-llm-relay-candidates).
 
 ### 4. Background Adaptive Health Monitoring & Persistent Caching
 - **Adaptive Cadence Loop**: Background `PingLoop` dynamically adjusts probe frequency across 4 operational modes: `speed` (2s interval at startup/activity), `normal` (10s), `slow` (30s after 5m idle), and `forced` (4s).
@@ -86,7 +87,8 @@ llm-relay
   the prompt.
 
 ### 6. Programmatic Telemetry & Quota Access for Claude
-- **HTTP Endpoints**: `GET /telemetry` (live JSON metrics), `GET /registry` (full provider/routing/model catalog with quality scores), `GET /ping` (trigger health probe pass & mode summary), `GET /health` (diagnostic status).
+- **Read-only HTTP endpoints**: `GET /telemetry` (live JSON metrics), `GET /registry` (full provider/routing/model catalog with quality scores), `GET /ping` (trigger health probe pass & mode summary), `GET /health` (diagnostic status), `GET /candidates` (the un-blended offload decision table).
+- **Mutating HTTP endpoints**: `GET|POST /offload` (read/flip the subagent-offload switch), `GET|POST /dispatch` (the dispatch ladder). ⚠ **Loopback is not authorization** — any page you visit can POST cross-origin to a loopback listener without a preflight, and these two write your `config.json` and steer lane order. They therefore reject a present-but-non-loopback `Origin` with 403, require `content-type: application/json` on a mutating request, and require a loopback `Host` (closing DNS rebinding). An **absent** `Origin` is allowed on purpose — that is what a CLI sends, and it is what keeps `llm-relay offload on` working against a running proxy with no restart.
 - **CLI Commands**: `llm-relay telemetry` outputs live telemetry metrics; `llm-relay models` lists live model catalogs with SWE-bench & quality scores; `llm-relay ping` performs live health & latency probes.
 - **Response Headers**: Proxy responses include `x-llm-relay-quota-percent`, `x-llm-relay-stability-score`, and `x-llm-relay-target`.
 
@@ -100,10 +102,14 @@ llm-relay
 | `llm-relay onboard` | Run guided setup wizard for 100%-free providers & subscription keys |
 | `llm-relay setup claude-desktop` (or `desktop`) | Auto-patch `claude_desktop_config.json` for Claude Desktop |
 | `llm-relay setup claude-cli` | Display & verify Claude CLI wrapper configuration |
-| `llm-relay keys` (or `check-keys`) | Validate provider API keys and display signup URLs & quota |
+| `llm-relay keys` (or `check-keys`) | Validate provider API **credentials** (escalates past a public `/models` to an authenticated probe) |
+| `llm-relay pools [--probe]` | List pool members; `--probe` sends a real completion to each — the only check that catches a listed-but-dead **model** |
 | `llm-relay telemetry` | Output live JSON telemetry, stability scores, and quota metrics |
 | `llm-relay models [-p <name>] [-r]` | Query live `/models` catalog per provider (`-p` filter, `-r` force refresh) |
 | `llm-relay ping [-p <name>]` | Perform live health, latency & quota probe across providers |
+| `llm-relay offload [on\|off\|status]` | Read or flip the subagent-offload switch — applies to the next request, no restart |
+| `llm-relay candidates [-p <name>]` | The un-blended offload decision table (capability, cost, live health, quota, breaker state) |
+| `llm-relay dispatch [lane] [-t <task>]` | Which lane to hand a whole delegated task to next; it returns the command, **you** run it (`-x <lane>` reports one spent) |
 
 ---
 
@@ -123,8 +129,34 @@ llm-relay
 
 # Check key status & signup URLs:
 llm-relay keys
+
+# Check that every model in your pools actually answers:
+llm-relay pools --probe
 ```
 
+**New here?** [docs/QUICKSTART.md](docs/QUICKSTART.md) is a staged setup guide written to be
+handed straight to an AI assistant ("set this up for me"), covering free providers, the offload
+switch, local models, and using your other CLI subscriptions as fallback lanes.
+
+### Verifying a setup — two checks, two different questions
+
+`keys` answers *are my credentials good?* `pools --probe` answers *will the models I configured
+actually answer?* Both are needed, and the cheap one can be confidently wrong in either
+direction:
+
+- A 200 from a provider's `/models` proves nothing when that endpoint is **public** — a revoked
+  key still returns the full catalogue. `keys` now re-probes anonymously and escalates to an
+  authenticated completion when it must.
+- A 401/403 on that probe does **not** prove the key is bad — free-tier rosters list premium
+  models a valid key cannot touch. The probe is compared against the same request sent with no
+  credentials: a different status means the key authenticated; an identical one means nothing
+  could be concluded, reported as `UNVERIFIED` rather than as a bad key.
+- Neither of those can see a model that is configured, catalogued, and dead. Only
+  `pools --probe` can.
+
+Keys are read from the environment and, if present, from `~/.llm-relay/.env` (one `KEY=value`
+per line). **A variable already set in the environment always wins over the file.**
+
 A global install also drops a **Claude Code skill** at `~/.claude/skills/llm-relay/SKILL.md` — an
 operating guide (addressing pools/models, the offload switch, `@relay:` directives, reading the
 candidates table, failure modes) that Claude loads on demand. It refreshes automatically on every
@@ -235,7 +267,8 @@ a `routing` block that maps each request's `model` to one provider + backend mod
     }
   },
   "mode": "repair",                          // detect | repair (strict accepted, aliases detect)
-  "repair": { "maxAttempts": 2, "destructiveTools": ["rm","delete","push","force","overwrite","drop","reset"] },
+  // Omit `destructiveTools` to get exactly this default list. Names are matched EXACTLY.
+  "repair": { "maxAttempts": 2, "destructiveTools": ["Bash","BashOutput","Write","Edit","MultiEdit","NotebookEdit","rm","delete","delete_file","remove","overwrite","drop","reset","force_push"] },
   "log": { "level": "metadata", "file": null }  // metadata-only; NEVER logs headers/bodies
 }
 ```
@@ -259,6 +292,33 @@ Claude Code subagent frontmatter (`model:`), which accepts a full model id but n
 list. A pool is the indirection that gives those callers ranking and failover. `pool` is a
 reserved provider name; configuring a provider called `pool` fails at load.
 
+### Destructive-tool refusal (`repair.destructiveTools`)
+
+A repaired tool call may run under `--dangerously-skip-permissions`, so llm-relay refuses to emit
+one that names a destructive tool — it never guesses arguments for it. Two things about the list
+are worth knowing before you configure it:
+
+- **Matching is exact on the tool name, case-insensitively** — not substring. A pattern ending in
+  `*` is an opt-in prefix form (`"git_*"` covers `git_push` and `git_reset_hard` but not
+  `gitlab_read`); a bare `"*"` matches nothing.
+- **The default list leads with the harness's own write/execute tools** — `Bash`, `BashOutput`,
+  `Write`, `Edit`, `MultiEdit`, `NotebookEdit` — then the conventional MCP-style names (`rm`,
+  `delete`, `delete_file`, `remove`, `overwrite`, `drop`, `reset`, `force_push`).
+
+Both of those changed, and both are visible in behaviour. Refusal used to be substring matching
+over fragments like `rm`/`delete`/`push`, which was wrong in **both** directions at once: none of
+those fragments occur in `Bash`/`Write`/`Edit`, so the tools that can actually destroy something
+were never guarded — while `push` matched `PushNotification` and `reset` matched `ResetZoom`,
+refusing safe calls. So:
+
+- a malformed `Bash`/`Write`/`Edit`/`MultiEdit`/`NotebookEdit`/`BashOutput` call that used to be
+  repaired is now **refused** (logged as `repair: "refused_destructive"`; the request fails clean
+  instead of emitting a call the model did not correctly produce);
+- a call named `PushNotification`, `ResetZoom` or `ForceRefresh` is now **permitted**.
+
+There is no built-in list inside the proxy: an empty `repair.destructiveTools` refuses nothing, so
+coverage is always traceable to your config.
+
 ### Subagent offload (`routing.offload` + `routing.subagents`)
 
 Send Claude Code **subagents** to other providers while the human's own conversation stays on the
@@ -389,6 +449,11 @@ candidates and fails over on transport errors. A **refusal** is never retried on
 candidate — a reshaper declining to guess is a real judgement, and retrying it elsewhere is
 shopping for a more compliant answer, which is how a fabricated tool call gets through.
 
+If **every** candidate fails at the transport level, that is a total outage, not a judgement: the
+turn fails clean and is logged `repair: "failed"` (nothing was reachable), never `"refused"` (a
+model declined). The two are kept distinguishable in the log because they call for opposite
+responses — one is an infrastructure problem, the other is the safety boundary working.
+
 Anthropic-kind entries in the pool are skipped (they cannot reshape); a pool with no usable
 target is a loud startup error, never a silently absent reshaper.
 
@@ -449,11 +514,15 @@ default, and dispatcher-style usage is just "send namespaced ids + read `/regist
 
 ### Model tiers from leaderboards (never a hand-maintained table)
 
-`npm run sync:tiers` snapshots capability rankings from **BFCL** (Berkeley Function-Calling
-Leaderboard — tool-use accuracy, the primary signal for a tool-call proxy, incl. its
-Irrelevance-Detection metric = the malformed-call proxy) and **LMArena** (general capability)
-into `docs/tier-data.json`, and prints the top tool-callers so you can pick tier targets from
-real data. Both sources are synced-not-forked; a leaderboard schema change fails the sync loudly.
+`npm run sync:tiers` snapshots capability rankings into `docs/tier-data.json` from **four** sources
+— **OpenRouter** (Artificial Analysis intelligence / coding / agentic indices, Design Arena Elo,
+context length, pricing, tool support), **BFCL** (Berkeley Function-Calling Leaderboard — tool-use
+accuracy, the primary signal for a tool-call proxy, incl. its Irrelevance-Detection metric = the
+malformed-call proxy), **LMArena** (general capability) and **Aider** (polyglot edit benchmark) —
+and prints the top tool-callers so you can pick tier targets from real data. Every source is
+synced-not-forked, and each is independently failable so one dead endpoint does not cost the
+others; a **schema change inside** a source still fails the sync loudly, because a renamed column
+is corruption rather than absence. Zero working sources is fatal.
 
 The reshaper also takes `"kind": "openai"` — so `repair` mode can run entirely on an OpenAI-compatible provider (e.g. NIM) with no Anthropic key. The reshaper is asked only for the **corrected arguments per tool-call id** (not the full message envelope), which is far more reliable on weaker models; the proxy reconstructs the message and re-validates it.
 
@@ -466,10 +535,14 @@ Then point a `claude` CLI at it (see "Install & run" above) and inspect the log
 
 ## What it logs (per request, metadata only)
 
-`{ ts, path, backendModel, hadTools, streamed, backendStatus, validated: pass|fail|uncheckable|skipped, toolUseCount, uncheckableCount, errorKinds[], latencyMs }`
+`{ ts, path, backendModel, servedProvider, servedModel, hadTools, streamed, backendStatus, validated: pass|fail|uncheckable|skipped, toolUseCount, uncheckableCount, errorKinds[], repair: none|fixed|failed|refused|refused_destructive, latencyMs }`
+
+That list is an **allow-list applied at the sink**, not a convention: the writer projects every record through it, so a caller that hands over a wider object cannot leak a header, a body or an error string carrying a key — and a new field starts being logged only when someone deliberately adds it to the list. `path` is passed through `logSafePath()`, which keeps the route and each query parameter's *name* and replaces its value with the value's length, because a `?task=` value is user prose, not metadata. A failed log write is swallowed to stderr: a full disk is a logging problem, never a request failure.
 
 `uncheckable` = a declared tool with no `input_schema` (built-in `bash`/`text_editor`/…) or a schema that wouldn't compile — surfaced distinctly so an unvalidatable call is never miscounted as a clean pass.
 
+⚠ `backendModel` is the model the **client asked for**, which for a tier or pool spec is routinely not the one that answered; `servedProvider`/`servedModel` are the deployment that actually served it. Draw "which model trips the validator" conclusions from the served fields. (`backendModel` is deprecated and on its way out; the served fields are absent — not `null` — on call sites not yet migrated, so an unmigrated call site can never be mistaken for a request nothing served.)
+
 This is the dataset for deciding which backend models are *format-broken* (reshapeable later) vs pass cleanly. Run in `detect` first, measure, then decide on repair.
 
 ### Trip-rate dataset
@@ -533,6 +606,15 @@ Consumers (audit-tools dispatch, plain `claude` CLI) point `ANTHROPIC_BASE_URL`
 ## Dev
 
 ```bash
-npm run typecheck   # tsc --noEmit
+npm run check       # typecheck + suite — the one gate, and exactly what CI runs
+npm run typecheck   # tsc --noEmit, src/ only
 npm test            # vitest (validator, SSE reconstruction, e2e transparency+detection)
+npm run build       # tsc -> dist/  (scripts/*.mjs read dist/, so rebuild before running them)
 ```
+
+`.github/workflows/ci.yml` runs `npm run check` on every push to `main` and every pull request.
+
+⚠ **Nothing type-checks `test/`.** `tsconfig.json` compiles `src/` only and excludes `**/*.test.ts`,
+and vitest transpiles tests without type-checking them (no `typecheck` block in
+`vitest.config.ts`). A `@ts-expect-error` inside a test file is therefore never evaluated and
+proves nothing — assert at runtime instead.

package/config.example.json

@@ -89,13 +89,20 @@
   "repair": {
     "maxAttempts": 2,
     "destructiveTools": [
+      "Bash",
+      "BashOutput",
+      "Write",
+      "Edit",
+      "MultiEdit",
+      "NotebookEdit",
       "rm",
       "delete",
-      "push",
-      "force",
+      "delete_file",
+      "remove",
       "overwrite",
       "drop",
-      "reset"
+      "reset",
+      "force_push"
     ]
   },
   "log": {

package/dist/anthropic.d.ts

@@ -28,10 +28,30 @@ export interface OpaqueBlock {
 }
 export type ContentBlock = TextBlock | ToolUseBlock | OpaqueBlock;
 export type StopReason = "end_turn" | "max_tokens" | "stop_sequence" | "tool_use" | string | null;
-/** The assistant message the proxy validates (from JSON body or reconstructed from SSE). */
+/**
+ * The assistant message the proxy validates (from JSON body or reconstructed from SSE).
+ *
+ * `id` / `model` / `stop_sequence` exist only because a repaired response has to be
+ * re-serialized and the backend's own identity has to survive that (DAT-27df2443): the
+ * shape previously carried neither, so `emitSse` had nowhere to read an id from and fell
+ * back to the constant `msg_repair` for every repaired turn — every repair looked like
+ * the same message. They are all `undefined` when the source response did not carry them,
+ * which is deliberately distinguishable from a captured value; nothing here invents one.
+ * This is still not an SDK model — do not add a field without a finding that needs it AND
+ * a consumer that actually threads it through.
+ */
 export interface AssistantMessage {
+    /** The backend's own message id, when the response carried one. */
+    id?: string | undefined;
+    /** The model the backend reported serving, when the response carried one. */
+    model?: string | undefined;
     content: ContentBlock[];
     stop_reason: StopReason;
+    stop_sequence?: string | null | undefined;
+    /**
+     * Token usage as the backend reported it. An ABSENT field means "the backend did not
+     * tell us", which is not the same claim as `0`; callers must not fill it with a zero.
+     */
     usage?: {
         input_tokens?: number;
         output_tokens?: number;

package/dist/anthropic.js.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../src/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8CH,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,WAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAE,WAAmC,CAAC,KAAK,CAAC,EACzD,CAAC;QACD,KAAK,MAAM,CAAC,IAAK,WAAoC,CAAC,KAAK,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,MAAM,SAAS,GAAI,CAAgC,CAAC,YAAY,CAAC;gBACjE,MAAM,MAAM,GACV,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;oBACjD,CAAC,CAAE,SAAwB;oBAC3B,CAAC,CAAC,IAAI,CAAC;gBACX,GAAG,CAAC,GAAG,CAAE,CAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../src/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkEH,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,WAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,OAAO,CAAE,WAAmC,CAAC,KAAK,CAAC,EACzD,CAAC;QACD,KAAK,MAAM,CAAC,IAAK,WAAoC,CAAC,KAAK,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,MAAM,SAAS,GAAI,CAAgC,CAAC,YAAY,CAAC;gBACjE,MAAM,MAAM,GACV,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;oBACjD,CAAC,CAAE,SAAwB;oBAC3B,CAAC,CAAC,IAAI,CAAC;gBACX,GAAG,CAAC,GAAG,CAAE,CAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/authEnv.d.ts

@@ -25,6 +25,75 @@ export interface AuthEnvResolution {
     /** Every name that was considered, for diagnostics. */
     candidates: string[];
 }
+/**
+ * Whether a credential value counts as PRESENT. The single predicate — three
+ * call sites used to disagree (config.ts tested Boolean() with no trim while
+ * server.ts and candidates.ts trimmed), so a whitespace-only key read present
+ * to the active-key filter and absent to header construction. That gap is how a
+ * blank credential slipped past containment entirely.
+ */
+export declare function keyIsPresent(value: string | undefined): boolean;
+/**
+ * Whether a provider's credential handling is DECLARED, and if so whether the
+ * key is actually there.
+ *
+ * ⚠ Derived from the config DECLARATION, never from `resolveAuthEnv` having
+ * returned a name. Those are different questions: the alias list for anthropic
+ * includes ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN, so a provider with NO
+ * declared authEnv — an intentional passthrough — still resolves to a name
+ * whenever either variable happens to be set in the environment. Deriving state
+ * from the name would classify that passthrough as `declared-present`, making it
+ * inject a key and strip the caller's own token: the exact inversion of the one
+ * behaviour a passthrough exists to provide.
+ */
+export type CredentialState = "not-declared" | "declared-present" | "declared-missing";
+export declare function credentialState(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv): CredentialState;
+/**
+ * Read a declared provider credential, normalised.
+ *
+ * Returns the trimmed value when the credential is PRESENT (per `keyIsPresent`) and
+ * `undefined` otherwise, so a caller cannot accidentally hold a whitespace-only
+ * string that is truthy to `if (key)` but blank on the wire. Every credential read
+ * should go through here rather than open-coding `env[name]?.trim()` — that
+ * open-coding is what let the presence predicate drift between call sites.
+ */
+export declare function readCredential(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Which header a provider's credential is injected into.
+ *
+ * Structurally identical to `AuthHeader` in `config.ts` and freely assignable in
+ * both directions. It is redeclared here rather than imported so this module keeps
+ * ZERO dependency on `config.ts` — `config.ts` imports this one, and `tier-data.ts`
+ * already exists as a separate module for exactly that reason.
+ */
+export type AuthHeaderName = "x-api-key" | "authorization";
+/**
+ * THE construction site for a provider credential header.
+ *
+ * Returns `{}` when the credential is absent, so the builder — not each caller —
+ * is what guarantees a blank key never reaches the wire as an empty `x-api-key` or
+ * a bare `Bearer`. Callers merge the result; they must not test the key themselves.
+ *
+ * Two normalisations, both deliberate:
+ * - The value is trimmed. A key pasted into `~/.llm-relay/.env` with a trailing
+ *   newline is a valid key that 401s, which reads as "my key is bad".
+ * - `Bearer ` prefixing is idempotent. Three of the existing sites already accept a
+ *   value that carries its own `Bearer ` prefix; double-prefixing it would break
+ *   them on migration.
+ *
+ * ⚠ It obeys the DECLARED `authHeader` and never consults `provider.kind`. Three
+ * current sites (`key-checker.ts`, `ping/ping.ts`, `pool-health.ts`) additionally
+ * force `x-api-key` on any `kind: "anthropic"` provider, which silently discards an
+ * explicit `authHeader: "authorization"`. `config.ts` already defaults an
+ * anthropic-kind provider's `authHeader` to `x-api-key`, so migrating those sites is
+ * behaviour-preserving in every case EXCEPT that explicit override — where honouring
+ * the config is the correct answer. It is called out rather than encoded so the
+ * change is a visible decision, not a silent one.
+ *
+ * Non-credential companions (`anthropic-version`, `Content-Type`) stay with the
+ * caller: this function builds the auth header and nothing else.
+ */
+export declare function buildAuthHeaders(key: string | undefined, authHeader: AuthHeaderName): Record<string, string>;
 /**
  * Pick the env-var name this provider's key actually lives under. Falls back to the
  * declared name when nothing is set, so "missing key" diagnostics still name the

package/dist/authEnv.js

@@ -48,6 +48,71 @@ export function candidateEnvNames(providerName, declared) {
     ];
     return [...new Set(ordered)];
 }
+/**
+ * Whether a credential value counts as PRESENT. The single predicate — three
+ * call sites used to disagree (config.ts tested Boolean() with no trim while
+ * server.ts and candidates.ts trimmed), so a whitespace-only key read present
+ * to the active-key filter and absent to header construction. That gap is how a
+ * blank credential slipped past containment entirely.
+ */
+export function keyIsPresent(value) {
+    return (value ?? "").trim().length > 0;
+}
+export function credentialState(declaredAuthEnv, env = process.env) {
+    if (!declaredAuthEnv)
+        return "not-declared";
+    return keyIsPresent(env[declaredAuthEnv]) ? "declared-present" : "declared-missing";
+}
+/**
+ * Read a declared provider credential, normalised.
+ *
+ * Returns the trimmed value when the credential is PRESENT (per `keyIsPresent`) and
+ * `undefined` otherwise, so a caller cannot accidentally hold a whitespace-only
+ * string that is truthy to `if (key)` but blank on the wire. Every credential read
+ * should go through here rather than open-coding `env[name]?.trim()` — that
+ * open-coding is what let the presence predicate drift between call sites.
+ */
+export function readCredential(declaredAuthEnv, env = process.env) {
+    if (!declaredAuthEnv)
+        return undefined;
+    const raw = env[declaredAuthEnv];
+    return keyIsPresent(raw) ? raw.trim() : undefined;
+}
+/**
+ * THE construction site for a provider credential header.
+ *
+ * Returns `{}` when the credential is absent, so the builder — not each caller —
+ * is what guarantees a blank key never reaches the wire as an empty `x-api-key` or
+ * a bare `Bearer`. Callers merge the result; they must not test the key themselves.
+ *
+ * Two normalisations, both deliberate:
+ * - The value is trimmed. A key pasted into `~/.llm-relay/.env` with a trailing
+ *   newline is a valid key that 401s, which reads as "my key is bad".
+ * - `Bearer ` prefixing is idempotent. Three of the existing sites already accept a
+ *   value that carries its own `Bearer ` prefix; double-prefixing it would break
+ *   them on migration.
+ *
+ * ⚠ It obeys the DECLARED `authHeader` and never consults `provider.kind`. Three
+ * current sites (`key-checker.ts`, `ping/ping.ts`, `pool-health.ts`) additionally
+ * force `x-api-key` on any `kind: "anthropic"` provider, which silently discards an
+ * explicit `authHeader: "authorization"`. `config.ts` already defaults an
+ * anthropic-kind provider's `authHeader` to `x-api-key`, so migrating those sites is
+ * behaviour-preserving in every case EXCEPT that explicit override — where honouring
+ * the config is the correct answer. It is called out rather than encoded so the
+ * change is a visible decision, not a silent one.
+ *
+ * Non-credential companions (`anthropic-version`, `Content-Type`) stay with the
+ * caller: this function builds the auth header and nothing else.
+ */
+export function buildAuthHeaders(key, authHeader) {
+    if (!keyIsPresent(key))
+        return {};
+    const value = key.trim();
+    if (authHeader === "authorization") {
+        return { authorization: value.startsWith("Bearer ") ? value : `Bearer ${value}` };
+    }
+    return { "x-api-key": value };
+}
 /**
  * Pick the env-var name this provider's key actually lives under. Falls back to the
  * declared name when nothing is set, so "missing key" diagnostics still name the
@@ -55,7 +120,7 @@ export function candidateEnvNames(providerName, declared) {
  */
 export function resolveAuthEnv(providerName, declared, env = process.env) {
     const candidates = candidateEnvNames(providerName, declared);
-    const found = candidates.find((n) => (env[n] ?? "").trim().length > 0);
+    const found = candidates.find((n) => keyIsPresent(env[n]));
     return {
         name: found ?? declared,
         viaAlias: Boolean(found && found !== declared),

package/dist/authEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"authEnv.js","sourceRoot":"","sources":["../src/authEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4FAA4F;AAC5F,MAAM,oBAAoB,GAA6B;IACrD,MAAM,EAAE;QACN,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;KACjB;IACD,GAAG,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;IAC5D,UAAU,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IACzD,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACjD,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,SAAS,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;CACzD,CAAC;AAEF,4FAA4F;AAC5F,SAAS,IAAI,CAAC,YAAoB;IAChC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAiB;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,QAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,CAAC;QAC9C,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authEnv.js","sourceRoot":"","sources":["../src/authEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4FAA4F;AAC5F,MAAM,oBAAoB,GAA6B;IACrD,MAAM,EAAE;QACN,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;KACjB;IACD,GAAG,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;IAC5D,UAAU,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IACzD,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACjD,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,SAAS,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;CACzD,CAAC;AAEF,4FAA4F;AAC5F,SAAS,IAAI,CAAC,YAAoB;IAChC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAiB;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACzC,CAAC;AAiBD,MAAM,UAAU,eAAe,CAC7B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,eAAe;QAAE,OAAO,cAAc,CAAC;IAC5C,OAAO,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACjC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,UAA0B;IAE1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,QAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,CAAC;QAC9C,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/backend.d.ts

@@ -1,4 +1,18 @@
 import { type ResolvedTarget } from "./config.js";
+/**
+ * Response header stating who produced an error status: the provider, or this proxy.
+ *
+ * Every failure out of `fetchBackend` is a synthesized `Response` — a refused document, a
+ * translation bug and a genuinely dead provider all arrived as a bare status code, so a
+ * caller counting backend failures (the circuit breaker) charged our own local bugs to the
+ * provider and failed over to a second provider that would have failed identically. The
+ * marker is what makes them separable; `fetchBackend` states it, the caller decides.
+ */
+export declare const ERROR_ORIGIN_HEADER = "x-llm-relay-error-origin";
+/** `upstream` = the provider answered with this status. `local` = the proxy produced it without asking. */
+export type ErrorOrigin = "upstream" | "local";
+/** Read the origin marker off a Response, when it carries one. */
+export declare function errorOrigin(res: Response): ErrorOrigin | null;
 /**
  * Fetch the resolved provider target and return an ANTHROPIC-shaped `Response`,
  * regardless of the backend's native wire format. For kind="anthropic" this is a

package/dist/backend.js

@@ -1,5 +1,20 @@
 import { translateBetweenProviders, handleUniversalStreamRequest } from "llm-bridge";
 import { DocumentError, transcodeDocuments } from "./documents.js";
+/**
+ * Response header stating who produced an error status: the provider, or this proxy.
+ *
+ * Every failure out of `fetchBackend` is a synthesized `Response` — a refused document, a
+ * translation bug and a genuinely dead provider all arrived as a bare status code, so a
+ * caller counting backend failures (the circuit breaker) charged our own local bugs to the
+ * provider and failed over to a second provider that would have failed identically. The
+ * marker is what makes them separable; `fetchBackend` states it, the caller decides.
+ */
+export const ERROR_ORIGIN_HEADER = "x-llm-relay-error-origin";
+/** Read the origin marker off a Response, when it carries one. */
+export function errorOrigin(res) {
+    const v = res.headers.get(ERROR_ORIGIN_HEADER);
+    return v === "upstream" || v === "local" ? v : null;
+}
 /**
  * Fetch the resolved provider target and return an ANTHROPIC-shaped `Response`,
  * regardless of the backend's native wire format. For kind="anthropic" this is a
@@ -23,16 +38,18 @@ export async function fetchBackend(target, args, fetchFn = fetch) {
         reqJson = await transcodeDocuments(reqJson);
     }
     catch (e) {
+        // Local, both of them: the provider was never asked. Charging these to the provider's
+        // failure budget fails over to a second provider that would refuse the same document.
         if (e instanceof DocumentError)
-            return anthropicError(400, `llm-relay: ${e.message}`);
-        return anthropicError(502, `document conversion failed: ${e.message}`);
+            return anthropicError(400, `llm-relay: ${e.message}`, "local");
+        return anthropicError(502, `document conversion failed: ${e.message}`, "local");
     }
     let openaiBody;
     try {
         openaiBody = translateBetweenProviders("anthropic", "openai", (reqJson ?? {}));
     }
     catch (e) {
-        return anthropicError(502, `request translation failed: ${e.message}`);
+        return anthropicError(502, `request translation failed: ${e.message}`, "local");
     }
     openaiBody.model = target.model;
     openaiBody.stream = args.wantsStream;
@@ -70,7 +87,8 @@ export async function fetchBackend(target, args, fetchFn = fetch) {
         const hint = res.status === 404
             ? ` — model "${target.model}" is not served by provider "${target.provider}" (a model can be listed in /models and still 404 here)`
             : "";
-        return anthropicError(res.status, `openai backend HTTP ${res.status}${hint}: ${body.slice(0, 300)}`);
+        // The provider really answered with this status — the body is reworded, the origin is not.
+        return anthropicError(res.status, `openai backend HTTP ${res.status}${hint}: ${body.slice(0, 300)}`, "upstream");
     }
     if (args.wantsStream && res.body) {
         const anthStream = handleUniversalStreamRequest(res.body, "openai", "anthropic");
@@ -81,7 +99,9 @@ export async function fetchBackend(target, args, fetchFn = fetch) {
         anthropicJson = openAiResponseToAnthropic((await res.json()), target.model ?? "");
     }
     catch (e) {
-        return anthropicError(502, `response translation failed: ${e.message}`);
+        // The provider answered 200; this 502 is ours. Marked local so it is not mistaken
+        // for the provider being down — it is our mapper being wrong about a healthy one.
+        return anthropicError(502, `response translation failed: ${e.message}`, "local");
     }
     return new Response(JSON.stringify(anthropicJson), { status: 200, headers: { "content-type": "application/json" } });
 }
@@ -118,16 +138,16 @@ export function openAiResponseToAnthropic(j, model) {
         usage: { input_tokens: usage.prompt_tokens ?? 0, output_tokens: usage.completion_tokens ?? 0 },
     };
 }
-function anthropicError(status, message) {
+function anthropicError(status, message, origin) {
     return new Response(JSON.stringify({ type: "error", error: { type: "api_error", message } }), {
         status,
-        headers: { "content-type": "application/json" },
+        headers: { "content-type": "application/json", [ERROR_ORIGIN_HEADER]: origin },
     });
 }
-function openaiError(status, message) {
+function openaiError(status, message, origin) {
     return new Response(JSON.stringify({ error: { message, type: "invalid_request_error" } }), {
         status,
-        headers: { "content-type": "application/json" },
+        headers: { "content-type": "application/json", [ERROR_ORIGIN_HEADER]: origin },
     });
 }
 /**
@@ -143,7 +163,7 @@ function openaiError(status, message) {
  */
 export async function fetchOpenAiFront(target, args, fetchFn = fetch) {
     if (target.kind !== "openai") {
-        return openaiError(400, `llm-relay: OpenAI front requires an openai-kind provider; "${target.provider}" is ${target.kind}`);
+        return openaiError(400, `llm-relay: OpenAI front requires an openai-kind provider; "${target.provider}" is ${target.kind}`, "local");
     }
     const base = (args.reqJson ?? {});
     const body = { ...base, model: target.model, stream: args.wantsStream };

package/dist/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB,EACtB,IAQC,EACD,UAAwB,KAAK;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,oBAAoB;IACpB,sFAAsF;IACtF,sFAAsF;IACtF,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,aAAa;YAAE,OAAO,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO,cAAc,CAAC,GAAG,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,UAAmC,CAAC;IACxC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,OAAO,IAAI,EAAE,CAAU,CAA4B,CAAC;IACrH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,cAAc,CAAC,GAAG,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,sFAAsF;IACtF,qFAAqF;IACrF,mFAAmF;IACnF,IAAI,IAAI,CAAC,WAAW;QAAE,UAAU,CAAC,cAAc,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAE1E,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;;YACjF,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE,CAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,mBAAmB,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEL,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IAEjC,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,GAAG,UAAU,CAAC;QAC9D,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,CAAC,aAAa,MAAM,CAAC,KAAK,gCAAgC,MAAM,CAAC,QAAQ,yDAAyD;YACnI,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,yBAAyB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,cAAc,CAAC,GAAG,EAAE,gCAAiC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,CAA0B,EAAE,KAAa;IACjF,MAAM,MAAM,GAAI,CAAC,CAAC,OAAsD,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,MAAM,GAAG,GAAI,MAAM,CAAC,OAA+C,IAAI,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAI,GAAG,CAAC,UAAyD,IAAI,EAAE,CAAC;IACvF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAI,EAAE,CAAC,QAAgD,IAAI,EAAE,CAAC;QACtE,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,EAAE,CAAC,SAAoB,IAAI,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;QAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAG,EAAE,CAAC,EAAa,IAAI,IAAI,EAAE,IAAI,EAAG,EAAE,CAAC,IAAe,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAmC,CAAC;IAC1D,MAAM,UAAU,GACd,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC;IACjI,MAAM,KAAK,GAAI,CAAC,CAAC,KAA4C,IAAI,EAAE,CAAC;IACpE,OAAO;QACL,EAAE,EAAG,CAAC,CAAC,EAAa,IAAI,gBAAgB;QACxC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,KAAK,IAAI,CAAE,CAAC,CAAC,KAAgB,IAAI,EAAE,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAAE;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACrD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;QAC5F,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC,EAAE;QACzF,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,IAAqE,EACrE,UAAwB,KAAK;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,GAAG,EAAE,8DAA8D,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;;YACjF,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,mBAAmB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAK9D,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,GAAa;IACvC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAsB,EACtB,IAQC,EACD,UAAwB,KAAK;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,oBAAoB;IACpB,sFAAsF;IACtF,sFAAsF;IACtF,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,CAAC,YAAY,aAAa;YAAE,OAAO,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,OAAO,cAAc,CAAC,GAAG,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,UAAmC,CAAC;IACxC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,OAAO,IAAI,EAAE,CAAU,CAA4B,CAAC;IACrH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,cAAc,CAAC,GAAG,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7F,CAAC;IACD,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,sFAAsF;IACtF,qFAAqF;IACrF,mFAAmF;IACnF,IAAI,IAAI,CAAC,WAAW;QAAE,UAAU,CAAC,cAAc,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAE1E,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;;YACjF,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE,CAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,mBAAmB,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEL,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IAEjC,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,GAAG,UAAU,CAAC;QAC9D,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,CAAC,aAAa,MAAM,CAAC,KAAK,gCAAgC,MAAM,CAAC,QAAQ,yDAAyD;YACnI,CAAC,CAAC,EAAE,CAAC;QACT,2FAA2F;QAC3F,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACnH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,yBAAyB,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,kFAAkF;QAClF,kFAAkF;QAClF,OAAO,cAAc,CAAC,GAAG,EAAE,gCAAiC,CAAW,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,CAA0B,EAAE,KAAa;IACjF,MAAM,MAAM,GAAI,CAAC,CAAC,OAAsD,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,MAAM,GAAG,GAAI,MAAM,CAAC,OAA+C,IAAI,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAI,GAAG,CAAC,UAAyD,IAAI,EAAE,CAAC;IACvF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAI,EAAE,CAAC,QAAgD,IAAI,EAAE,CAAC;QACtE,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,EAAE,CAAC,SAAoB,IAAI,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;QAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAG,EAAE,CAAC,EAAa,IAAI,IAAI,EAAE,IAAI,EAAG,EAAE,CAAC,IAAe,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAmC,CAAC;IAC1D,MAAM,UAAU,GACd,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC;IACjI,MAAM,KAAK,GAAI,CAAC,CAAC,KAA4C,IAAI,EAAE,CAAC;IACpE,OAAO;QACL,EAAE,EAAG,CAAC,CAAC,EAAa,IAAI,gBAAgB;QACxC,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,KAAK,IAAI,CAAE,CAAC,CAAC,KAAgB,IAAI,EAAE,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAAE;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe,EAAE,MAAmB;IAC1E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;QAC5F,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe,EAAE,MAAmB;IACvE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC,EAAE;QACzF,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE;KAC/E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,IAAqE,EACrE,UAAwB,KAAK;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,WAAW,CAChB,GAAG,EACH,8DAA8D,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,IAAI,EAAE,EAClG,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;;YACjF,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,mBAAmB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/benchmarks.d.ts

@@ -32,8 +32,30 @@ export interface Strength {
 export declare function getStrength(spec: string, opts?: {
     telemetryPath?: string;
 }): Strength;
+/** One target with the strength that ranked it, and the provenance of that strength. */
+export interface RankedTarget {
+    target: ResolvedTarget;
+    spec: string;
+    strength: Strength;
+}
+export declare function specOfTarget(t: ResolvedTarget): string;
 /**
- * Rank targets strongest-first. Ties are left in config order (`sort` is stable), which is what
- * makes a pool's declared order the tie-breaker when nothing distinguishes two candidates.
+ * Rank targets strongest-first, KEEPING the provenance that produced each position.
+ *
+ * ⚠ The comparator used to read `getStrength(spec).score` and throw the rest away, which made a
+ * `neutral` 50 — "nobody publishes anything about this model" — indistinguishable from a `snapshot`
+ * 50 measured across five leaderboards (`ARC-31833353`). A provenance-free number was deciding
+ * which backend serves a request, the one thing this module exists to prevent.
+ *
+ * Resolution order:
+ *  1. score, highest first — the actual capability estimate, unchanged and never adjusted by basis;
+ *  2. on an exact tie, the better-evidenced basis (snapshot > telemetry > neutral);
+ *  3. still tied, the larger signal count — a 5-source consensus over a 1-source guess;
+ *  4. still tied, config order (`sort` is stable), so a pool's declared order is the last word.
+ *
+ * Steps 2–3 are tie-breaks, never score adjustments: a model is not penalised for signals nobody
+ * publishes, it just loses a coin-flip to one we actually know something about.
  */
+export declare function rankTargetsWithProvenance(targets: ResolvedTarget[]): RankedTarget[];
+/** Ranked targets only. Use `rankTargetsWithProvenance` when the caller can report WHY. */
 export declare function rankTargetsByBenchmark(targets: ResolvedTarget[]): ResolvedTarget[];