nexus-agents 10.1.0 → 10.2.0

package/dist/chunk-KLSNDPU6.js

@@ -0,0 +1,2412 @@
+import {
+  assertCustomApiHostResolvesPublic,
+  hostnameOf,
+  redactGatewaySecrets,
+  validateCustomApiBaseUrl
+} from "./chunk-KASBBKAQ.js";
+import {
+  REDACTED_KEY_PLACEHOLDER,
+  sanitizeErrorDetails
+} from "./chunk-QM5W3T3O.js";
+import {
+  CUSTOM_API_ALLOW_PRIVATE_ENV,
+  ConfigError,
+  DEFAULT_OPENAI_COMPAT_ENDPOINT,
+  ErrorCode,
+  ModelCapability,
+  ModelError,
+  NexusError,
+  OPENAI_COMPAT_ENDPOINT_ENV,
+  OPENAI_COMPAT_KEY_ENV,
+  OPENAI_COMPAT_MODELS_ENV,
+  OPENAI_COMPAT_URL_ENV,
+  RETRY_AFTER_CONTEXT_KEY,
+  TimeoutError,
+  createLogger,
+  err,
+  gatewayCostDetail,
+  gatewayEndpointRejection,
+  getCliModelName,
+  getErrorMessage,
+  getTimeProvider,
+  getTokenEstimator,
+  isEndpointArmId,
+  isRateLimitLikeError,
+  lookupInTreeCapability,
+  ok,
+  readModelAllowlist,
+  recordUsageEvent,
+  refineGatewayCatalog,
+  resolveRetryAfterMs
+} from "./chunk-WKFPKPEM.js";
+
+// src/adapters/openai-compat-adapter.ts
+import OpenAI2 from "openai";
+
+// src/adapters/gateway-host-status.ts
+var GATEWAY_HOST_LOOKUP_TIMED_OUT = "gateway host check timed out; the gateway is not wired this attempt, will retry";
+var REMEDY = `Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 if the gateway runs on a trusted internal host, then restart the server.`;
+async function checkGatewayHost(baseUrl, options = {}) {
+  const host = hostnameOf(baseUrl);
+  const guard = await withLookupTimeout(
+    assertCustomApiHostResolvesPublic(host),
+    options.lookupTimeoutMs ?? GATEWAY_HOST_LOOKUP_TIMEOUT_MS
+  );
+  if (guard === "timed_out") return { state: "lookup_timed_out", host };
+  if (guard.ok) return { state: "allowed", host };
+  return { state: "refused_private_host", host, reason: guard.error.message, remedy: REMEDY };
+}
+var GATEWAY_HOST_LOOKUP_TIMEOUT_MS = 5e3;
+async function withLookupTimeout(work, ms) {
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      resolve("timed_out");
+    }, ms);
+    timer.unref();
+  });
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var GatewayHostRefusedError = class extends ConfigError {
+  status;
+  constructor(status) {
+    super(`Gateway URL rejected: ${status.reason}`);
+    this.name = "GatewayHostRefusedError";
+    this.status = status;
+  }
+};
+
+// src/adapters/openai-adapter.ts
+import OpenAI, { APIError } from "openai";
+
+// src/adapters/base-adapter.ts
+var AdapterModelError = class extends ModelError {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ModelError";
+  }
+};
+function isApiKeyMissing(apiKey) {
+  return apiKey === void 0 || apiKey === "" || apiKey.trim() === "";
+}
+function requireApiKey(apiKey, providerName, modelId) {
+  if (isApiKeyMissing(apiKey)) {
+    throw new ConfigError(`${providerName} API key is required`, {
+      context: { providerId: providerName.toLowerCase(), modelId }
+    });
+  }
+}
+function validateApiKeyPresence(apiKey, providerId, modelId) {
+  if (isApiKeyMissing(apiKey)) {
+    return err(
+      new ConfigError(`${providerId} API key is required`, {
+        context: { providerId, modelId }
+      })
+    );
+  }
+  return ok(void 0);
+}
+var BaseAdapter = class {
+  providerId;
+  modelId;
+  capabilities;
+  /** Logger for request/response logging */
+  logger;
+  /** Configuration for the adapter */
+  config;
+  /**
+   * Creates a new BaseAdapter instance.
+   *
+   * @param config - Adapter configuration
+   */
+  constructor(config) {
+    this.providerId = config.providerId;
+    this.modelId = config.modelId;
+    this.capabilities = config.capabilities;
+    this.config = config;
+    this.logger = config.logger ?? createLogger({
+      adapter: config.providerId,
+      model: config.modelId
+    });
+  }
+  /**
+   * Count tokens in text using the unified TokenEstimator.
+   *
+   * This provides a reasonable estimate for most use cases.
+   * Concrete adapters may override this with provider-specific tokenizers.
+   *
+   * @param text - Text to count tokens for
+   * @returns Approximate token count
+   */
+  countTokens(text) {
+    return Promise.resolve(getTokenEstimator().estimateText(text));
+  }
+  /**
+   * Validate adapter configuration.
+   *
+   * Checks that required configuration fields are present and valid.
+   * Concrete adapters may override to add provider-specific validation.
+   *
+   * @returns Ok if valid, ConfigError if invalid
+   */
+  validateConfig() {
+    const errors = [];
+    if (!this.providerId || this.providerId.trim() === "") {
+      errors.push("Provider ID is required");
+    }
+    if (!this.modelId || this.modelId.trim() === "") {
+      errors.push("Model ID is required");
+    }
+    if (this.config.timeout !== void 0 && this.config.timeout <= 0) {
+      errors.push("Timeout must be positive");
+    }
+    if (this.config.maxRetries !== void 0 && this.config.maxRetries < 0) {
+      errors.push("Max retries cannot be negative");
+    }
+    if (errors.length > 0) {
+      return err(
+        new ConfigError(`Invalid adapter configuration: ${errors.join("; ")}`, {
+          context: {
+            providerId: this.providerId,
+            modelId: this.modelId,
+            errors
+          }
+        })
+      );
+    }
+    return ok(void 0);
+  }
+  /**
+   * Check if this adapter supports a specific capability.
+   *
+   * @param capability - The capability to check for
+   * @returns True if the capability is supported
+   */
+  hasCapability(capability) {
+    return this.capabilities.includes(capability);
+  }
+  /**
+   * Log details about an outgoing request.
+   * Sanitizes sensitive information before logging.
+   *
+   * @param request - The completion request to log
+   */
+  logRequest(request) {
+    const messageCount = request.messages.length;
+    const hasTools = request.tools !== void 0 && request.tools.length > 0;
+    const toolCount = request.tools?.length ?? 0;
+    this.logger.debug("Sending completion request", {
+      messageCount,
+      hasSystemPrompt: request.systemPrompt !== void 0,
+      temperature: request.temperature,
+      maxTokens: request.maxTokens,
+      hasTools,
+      toolCount,
+      responseFormat: request.responseFormat?.type,
+      stopSequences: request.stop?.length ?? 0
+    });
+  }
+  /**
+   * Log details about a received response.
+   *
+   * @param response - The completion response to log
+   */
+  logResponse(response) {
+    this.logger.debug("Received completion response", {
+      contentBlocks: response.content.length,
+      stopReason: response.stopReason,
+      inputTokens: response.usage?.inputTokens ?? 0,
+      outputTokens: response.usage?.outputTokens ?? 0,
+      totalTokens: response.usage?.totalTokens ?? 0,
+      model: response.model
+    });
+  }
+  /**
+   * Transform a provider-specific error into a standardized ModelError.
+   *
+   * Maps common error patterns to appropriate error codes:
+   * - Rate limiting (429, quota exceeded)
+   * - Timeouts (ETIMEDOUT, ESOCKETTIMEDOUT)
+   * - Authentication (401, 403)
+   * - Model unavailable (503, 502)
+   *
+   * @param error - The original error from the provider
+   * @returns A standardized ModelError
+   */
+  transformError(error) {
+    if (error instanceof ModelError) {
+      return error;
+    }
+    const errorMessage = getErrorMessage(error);
+    const errorCode = this.determineErrorCode(error);
+    const param = errorCode === ErrorCode.MODEL_PARAMETER_UNSUPPORTED ? this.extractErrorParam(error) : void 0;
+    const retryAfterMs = errorCode === ErrorCode.MODEL_RATE_LIMITED ? resolveRetryAfterMs(error, errorMessage) : void 0;
+    const modelError = this.createModelError(errorMessage, errorCode, error, param, retryAfterMs);
+    this.logger.error("Model adapter error", modelError, {
+      errorCode,
+      providerId: this.providerId,
+      modelId: this.modelId
+    });
+    return modelError;
+  }
+  /**
+   * Create a ModelError with appropriate error code.
+   */
+  createModelError(message, errorCode, originalError, param, retryAfterMs) {
+    const fullMessage = `${this.providerId}/${this.modelId}: ${message}`;
+    const context = {
+      providerId: this.providerId,
+      modelId: this.modelId
+    };
+    if (param !== void 0) {
+      context.param = param;
+    }
+    if (retryAfterMs !== void 0) {
+      context[RETRY_AFTER_CONTEXT_KEY] = retryAfterMs;
+    }
+    const options = {
+      code: errorCode,
+      context
+    };
+    if (originalError instanceof Error) {
+      options.cause = originalError;
+    }
+    return new AdapterModelError(fullMessage, options);
+  }
+  /**
+   * Determine the appropriate error code based on error characteristics.
+   */
+  determineErrorCode(error) {
+    if (!(error instanceof Error)) {
+      return ErrorCode.MODEL_ERROR;
+    }
+    const message = error.message.toLowerCase();
+    const errorObj = error;
+    if (isRateLimitLikeError(error)) {
+      return ErrorCode.MODEL_RATE_LIMITED;
+    }
+    if (this.isTimeoutError(message, errorObj)) {
+      return ErrorCode.MODEL_TIMEOUT;
+    }
+    if (this.isModelNotFoundError(message, errorObj)) {
+      return ErrorCode.MODEL_NOT_FOUND;
+    }
+    if (this.isUnavailableError(message, errorObj)) {
+      return ErrorCode.MODEL_UNAVAILABLE;
+    }
+    if (this.extractErrorParam(error) !== void 0) {
+      return ErrorCode.MODEL_PARAMETER_UNSUPPORTED;
+    }
+    return ErrorCode.MODEL_ERROR;
+  }
+  /**
+   * Extract the offending parameter name from a param-naming 400 (#4069).
+   *
+   * Returns the param only when the error is a 400 AND carries a non-empty `param`
+   * field (the OpenAI SDK / OpenAI-compatible gateways set this on a rejected
+   * parameter; the OpenAI adapter threads it onto the classification probe).
+   * Returns undefined otherwise, so non-400s and param-less 400s are untouched.
+   */
+  extractErrorParam(error) {
+    if (!(error instanceof Error)) {
+      return void 0;
+    }
+    const errorObj = error;
+    if (errorObj.status !== 400) {
+      return void 0;
+    }
+    return typeof errorObj.param === "string" && errorObj.param !== "" ? errorObj.param : void 0;
+  }
+  /**
+   * (#2540 PR 8) Detect model-retirement errors. Distinct from transient
+   * 502/503: 404 + vendor messages indicating the model id is gone.
+   */
+  isModelNotFoundError(message, errorObj) {
+    if (errorObj.status === 404) return true;
+    const patterns = [
+      "model not found",
+      "model_not_found",
+      "no such model",
+      "model is deprecated",
+      "model has been deprecated",
+      "model is no longer available"
+    ];
+    return patterns.some((p) => message.includes(p));
+  }
+  /**
+   * Check if error indicates a timeout.
+   */
+  isTimeoutError(message, errorObj) {
+    const timeoutPatterns = ["timeout", "etimedout", "esockettimedout"];
+    return errorObj.code === "ETIMEDOUT" || errorObj.code === "ESOCKETTIMEDOUT" || timeoutPatterns.some((pattern) => message.includes(pattern));
+  }
+  /**
+   * Check if error indicates model unavailability.
+   */
+  isUnavailableError(message, errorObj) {
+    const unavailablePatterns = ["unavailable", "service unavailable", "overloaded"];
+    return errorObj.status === 502 || errorObj.status === 503 || unavailablePatterns.some((pattern) => message.includes(pattern));
+  }
+};
+
+// src/adapters/streaming-types.ts
+var StreamError = class extends NexusError {
+  constructor(message, options) {
+    super(message, { code: ErrorCode.INTERNAL_ERROR, ...options });
+    this.name = "StreamError";
+  }
+};
+var StreamCancelledError = class extends NexusError {
+  constructor(reason) {
+    super(reason ?? "Stream was cancelled", { code: ErrorCode.INTERNAL_ERROR });
+    this.name = "StreamCancelledError";
+  }
+};
+var StreamController = class {
+  chunks = [];
+  waiters = [];
+  _state = "idle";
+  _error;
+  maxBufferSize;
+  abortHandler;
+  abortSignal;
+  /**
+   * Creates a new StreamController.
+   * @param options - Stream creation options
+   */
+  constructor(options = {}) {
+    this.maxBufferSize = options.maxBufferSize ?? 100;
+    if (options.signal) {
+      this.abortSignal = options.signal;
+      this.abortHandler = () => {
+        this.cancel("AbortSignal triggered");
+      };
+      options.signal.addEventListener("abort", this.abortHandler);
+    }
+  }
+  /**
+   * Current state of the stream.
+   */
+  get state() {
+    return this._state;
+  }
+  /**
+   * Whether the stream is still active (can receive chunks).
+   */
+  get isActive() {
+    return this._state === "idle" || this._state === "streaming" || this._state === "paused";
+  }
+  /**
+   * Current buffer size.
+   */
+  get bufferSize() {
+    return this.chunks.length;
+  }
+  /**
+   * Push a chunk to the stream.
+   * @param chunk - The chunk to push
+   * @returns Result indicating success or backpressure
+   */
+  push(chunk) {
+    if (!this.isActive) {
+      return err(new StreamError(`Cannot push to stream in state: ${this._state}`));
+    }
+    if (this._state === "idle") {
+      this._state = "streaming";
+    }
+    const waiter = this.waiters.shift();
+    if (waiter) {
+      waiter.resolve({ done: false, value: chunk });
+      return ok(void 0);
+    }
+    if (this.chunks.length >= this.maxBufferSize) {
+      this._state = "paused";
+      return err(
+        new StreamError("Buffer full - backpressure applied", {
+          context: { bufferSize: this.chunks.length, maxBufferSize: this.maxBufferSize }
+        })
+      );
+    }
+    this.chunks.push(chunk);
+    return ok(void 0);
+  }
+  /**
+   * Complete the stream successfully.
+   */
+  complete() {
+    if (!this.isActive) {
+      return;
+    }
+    this._state = "completed";
+    this.removeAbortListener();
+    this.resolveAllWaiters();
+  }
+  /**
+   * Complete the stream with an error.
+   * @param error - The error that occurred
+   */
+  error(error) {
+    if (!this.isActive) {
+      return;
+    }
+    this._state = "error";
+    this._error = error;
+    this.removeAbortListener();
+    this.rejectAllWaiters(error);
+  }
+  /**
+   * Cancel the stream.
+   * @param reason - Optional reason for cancellation
+   */
+  cancel(reason) {
+    if (!this.isActive) {
+      return;
+    }
+    this._state = "cancelled";
+    this._error = new StreamCancelledError(reason);
+    this.removeAbortListener();
+    this.rejectAllWaiters(this._error);
+  }
+  /**
+   * Get the AsyncIterable for consuming the stream.
+   */
+  getIterable() {
+    const nextChunk = () => this.nextChunk();
+    const cancel = (reason) => {
+      this.cancel(reason);
+    };
+    return {
+      [Symbol.asyncIterator]() {
+        return {
+          async next() {
+            return nextChunk();
+          },
+          return() {
+            cancel("Iterator returned");
+            return Promise.resolve({ done: true, value: void 0 });
+          }
+        };
+      }
+    };
+  }
+  async nextChunk() {
+    const chunk = this.chunks.shift();
+    if (chunk !== void 0) {
+      if (this._state === "paused" && this.chunks.length < this.maxBufferSize / 2) {
+        this._state = "streaming";
+      }
+      return { done: false, value: chunk };
+    }
+    if (this._state === "completed") {
+      return { done: true, value: void 0 };
+    }
+    if (this._state === "cancelled" || this._state === "error") {
+      throw this._error ?? new StreamCancelledError();
+    }
+    return new Promise((resolve, reject) => {
+      this.waiters.push({ resolve, reject });
+    });
+  }
+  removeAbortListener() {
+    if (this.abortSignal && this.abortHandler) {
+      this.abortSignal.removeEventListener("abort", this.abortHandler);
+    }
+  }
+  resolveAllWaiters() {
+    for (const waiter of this.waiters) {
+      waiter.resolve({ done: true, value: void 0 });
+    }
+    this.waiters.length = 0;
+  }
+  rejectAllWaiters(error) {
+    for (const waiter of this.waiters) {
+      waiter.reject(error);
+    }
+    this.waiters.length = 0;
+  }
+};
+function createStream(options = {}) {
+  const controller = new StreamController(options);
+  return [controller, controller.getIterable()];
+}
+
+// src/adapters/stream-operators-helpers.ts
+async function* take(stream, count, options = {}) {
+  if (count <= 0) {
+    return;
+  }
+  let taken = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("take aborted");
+    }
+    yield chunk;
+    taken++;
+    if (taken >= count) {
+      return;
+    }
+  }
+}
+async function* skip(stream, count, options = {}) {
+  let skipped = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("skip aborted");
+    }
+    if (skipped < count) {
+      skipped++;
+      continue;
+    }
+    yield chunk;
+  }
+}
+async function* concatStreams(streams, options = {}) {
+  for (const stream of streams) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("concat aborted");
+    }
+    yield* stream;
+  }
+}
+async function* fromArray(values, options = {}) {
+  for (const value of values) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("fromArray aborted");
+    }
+    if (options.delayMs !== void 0 && options.delayMs > 0) {
+      await new Promise((resolve) => setTimeout(resolve, options.delayMs));
+    }
+    yield value;
+  }
+}
+async function* tapStream(stream, fn, options = {}) {
+  let index = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("tap aborted");
+    }
+    await fn(chunk, index);
+    yield chunk;
+    index++;
+  }
+}
+async function reduceStream(stream, reducer, initialValue, options = {}) {
+  let accumulator = initialValue;
+  let index = 0;
+  try {
+    for await (const chunk of stream) {
+      if (options.signal?.aborted === true) {
+        return err(new StreamError("Reduce aborted"));
+      }
+      accumulator = await reducer(accumulator, chunk, index);
+      index++;
+    }
+    return ok(accumulator);
+  } catch (error) {
+    return err(
+      new StreamError("Failed to reduce stream", {
+        cause: error instanceof Error ? error : new Error(String(error))
+      })
+    );
+  }
+}
+
+// src/adapters/stream-operators.ts
+async function* transformStream(stream, fn, options = {}) {
+  let index = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("Transform aborted");
+    }
+    yield await fn(chunk, index);
+    index++;
+  }
+}
+async function* mergeStreams(streams, options = {}) {
+  if (streams.length === 0) {
+    return;
+  }
+  const streamOptions = {};
+  if (options.signal) {
+    streamOptions.signal = options.signal;
+  }
+  const [controller, merged] = createStream(streamOptions);
+  let activeCount = streams.length;
+  const consumers = streams.map(async (stream, streamIndex) => {
+    try {
+      for await (const chunk of stream) {
+        if (options.signal?.aborted === true) {
+          break;
+        }
+        controller.push(chunk);
+      }
+    } catch (error) {
+      if (error instanceof StreamCancelledError) {
+        controller.cancel(`Stream ${String(streamIndex)} was cancelled`);
+        return;
+      }
+      controller.error(error instanceof Error ? error : new Error(String(error)));
+      return;
+    } finally {
+      activeCount--;
+      if (activeCount === 0) {
+        controller.complete();
+      }
+    }
+  });
+  Promise.all(consumers).catch((error) => {
+    controller.error(error instanceof Error ? error : new StreamError(String(error)));
+  });
+  yield* merged;
+}
+async function* takeUntil(stream, predicate, options = {}) {
+  let index = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("takeUntil aborted");
+    }
+    const shouldStop = await predicate(chunk, index);
+    if (shouldStop) {
+      if (options.inclusive === true) {
+        yield chunk;
+      }
+      return;
+    }
+    yield chunk;
+    index++;
+  }
+}
+async function* filterStream(stream, predicate, options = {}) {
+  let index = 0;
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("filter aborted");
+    }
+    if (await predicate(chunk, index)) {
+      yield chunk;
+    }
+    index++;
+  }
+}
+async function* withTimeout(stream, timeoutMs, options = {}) {
+  const iterator = stream[Symbol.asyncIterator]();
+  try {
+    let running = true;
+    while (running) {
+      if (options.signal?.aborted === true) {
+        throw new StreamCancelledError("withTimeout aborted");
+      }
+      let timeoutId;
+      try {
+        const result = await Promise.race([
+          iterator.next().then((res) => {
+            if (timeoutId !== void 0) {
+              clearTimeout(timeoutId);
+            }
+            return res;
+          }),
+          new Promise((_, reject) => {
+            timeoutId = setTimeout(() => {
+              reject(
+                new TimeoutError(`Stream timed out after ${String(timeoutMs)}ms`, {
+                  context: { timeoutMs }
+                })
+              );
+            }, timeoutMs);
+          })
+        ]);
+        if (result.done === true) {
+          running = false;
+        } else {
+          yield result.value;
+        }
+      } finally {
+        if (timeoutId !== void 0) {
+          clearTimeout(timeoutId);
+        }
+      }
+    }
+  } finally {
+    if (iterator.return !== void 0) {
+      await iterator.return();
+    }
+  }
+}
+async function* bufferStream(stream, size, options = {}) {
+  if (size <= 0) {
+    throw new StreamError("Buffer size must be positive");
+  }
+  let buffer = [];
+  for await (const chunk of stream) {
+    if (options.signal?.aborted === true) {
+      throw new StreamCancelledError("buffer aborted");
+    }
+    buffer.push(chunk);
+    if (buffer.length >= size) {
+      yield buffer;
+      buffer = [];
+    }
+  }
+  if (buffer.length > 0) {
+    yield buffer;
+  }
+}
+
+// src/adapters/streaming.ts
+var DEFAULT_COLLECT_STREAM_MAX_CHUNKS = 1e5;
+async function collectStream(stream, options = {}) {
+  const chunks = [];
+  const maxChunks = options.maxChunks ?? DEFAULT_COLLECT_STREAM_MAX_CHUNKS;
+  try {
+    for await (const chunk of stream) {
+      if (options.signal?.aborted === true) {
+        return err(new StreamError("Collection aborted"));
+      }
+      chunks.push(chunk);
+      if (chunks.length >= maxChunks) {
+        break;
+      }
+    }
+    return ok(chunks);
+  } catch (error) {
+    if (error instanceof StreamCancelledError) {
+      return err(new StreamError("Stream was cancelled during collection", { cause: error }));
+    }
+    return err(
+      new StreamError("Failed to collect stream", {
+        cause: error instanceof Error ? error : new Error(String(error))
+      })
+    );
+  }
+}
+
+// src/adapters/openai-types.ts
+var OPENAI_MODELS = {
+  GPT_5_2: "gpt-5.2",
+  GPT_5_2_INSTANT: "gpt-5.2-chat-latest",
+  GPT_5_2_PRO: "gpt-5.2-pro",
+  /**
+   * Registry-derived: resolves to `codex-5.2`'s `cliModelName`, which since
+   * 2026-09-23 is `gpt-5.6-luna`, not a "5.2" model. The key name lags its
+   * value; renaming it is a public-API change tracked in #5489.
+   */
+  GPT_5_2_CODEX: getCliModelName("codex-5.2"),
+  GPT_4O: "gpt-4o-2024-11-20",
+  GPT_4O_MINI: "gpt-4o-mini-2024-07-18",
+  GPT_4_TURBO: "gpt-4-turbo-2024-04-09",
+  GPT_35_TURBO: "gpt-3.5-turbo-0125"
+};
+var OPENAI_MODEL_ALIASES = {
+  "gpt-5.2-instant": OPENAI_MODELS.GPT_5_2_INSTANT,
+  "gpt-4o": OPENAI_MODELS.GPT_4O,
+  "gpt-4o-mini": OPENAI_MODELS.GPT_4O_MINI,
+  "gpt-4-turbo": OPENAI_MODELS.GPT_4_TURBO,
+  "gpt-3.5-turbo": OPENAI_MODELS.GPT_35_TURBO
+};
+var DEFAULT_MAX_TOKENS = 4096;
+function isFunctionToolCall(toolCall) {
+  if (typeof toolCall !== "object" || toolCall === null) {
+    return false;
+  }
+  const tc = toolCall;
+  return tc["type"] === "function" && typeof tc["function"] === "object" && tc["function"] !== null;
+}
+function resolveModelId(modelId) {
+  return OPENAI_MODEL_ALIASES[modelId] ?? modelId;
+}
+function getModelCapabilities(modelId) {
+  const capabilities = [ModelCapability.COMPLETION, ModelCapability.STREAMING, ModelCapability.TOOL_USE];
+  const resolvedId = resolveModelId(modelId);
+  if (resolvedId.includes("gpt-4o") || resolvedId.includes("gpt-4-turbo") || resolvedId.includes("gpt-5.2")) {
+    capabilities.push(ModelCapability.VISION);
+  }
+  if (resolvedId.includes("gpt-5.2")) {
+    capabilities.push(ModelCapability.EXTENDED_THINKING);
+  }
+  return capabilities;
+}
+
+// src/config/model-parameter-support.ts
+function parseClaudeMajorMinor(bareId) {
+  const undated = bareId.replace(/[-_]\d{6,}$/, "");
+  const match = /(\d+)(?:[-_.](\d+))?/.exec(undated);
+  if (match === null) return null;
+  const major = Number.parseInt(match[1], 10);
+  const minor = match[2] !== void 0 ? Number.parseInt(match[2], 10) : 0;
+  if (Number.isNaN(major) || Number.isNaN(minor)) return null;
+  return { major, minor };
+}
+var LEGACY_TEMPERATURE_SUPPORTING = /claude[-_](?:instant|1|2|3)(?:[-_.]|$)/;
+function claudeTemperatureUnsupported(bare) {
+  const version = parseClaudeMajorMinor(bare);
+  if (version !== null) {
+    return version.major > 4 || version.major === 4 && version.minor >= 7;
+  }
+  if (LEGACY_TEMPERATURE_SUPPORTING.test(bare)) return false;
+  return true;
+}
+function openAiReasoning(id) {
+  const segment = id.includes("/") ? id.slice(id.lastIndexOf("/") + 1) : id;
+  if (/^o[0-9]/.test(segment)) return true;
+  if (segment.includes("codex")) return true;
+  if (/gpt-?5(?![0-9])/.test(segment) && !segment.includes("gpt-5-chat")) return true;
+  return false;
+}
+function regexRejectsTemperature(modelId) {
+  const id = modelId.toLowerCase();
+  const claudeAt = id.indexOf("claude");
+  if (claudeAt !== -1) {
+    return claudeTemperatureUnsupported(id.slice(claudeAt));
+  }
+  return openAiReasoning(id);
+}
+function regexIsOpenAiReasoning(modelId) {
+  const id = modelId.toLowerCase();
+  if (id.includes("claude")) return false;
+  return openAiReasoning(id);
+}
+function unsupportedParametersForModel(modelId) {
+  const cap = lookupInTreeCapability(modelId);
+  if (cap?.unsupportedParameters !== void 0) return cap.unsupportedParameters;
+  return regexRejectsTemperature(modelId) ? ["temperature"] : [];
+}
+function modelSupportsParameter(modelId, param) {
+  return !unsupportedParametersForModel(modelId).includes(param);
+}
+function getMaxTokensParamForModel(modelId) {
+  const cap = lookupInTreeCapability(modelId);
+  if (cap?.maxTokensParam !== void 0) return cap.maxTokensParam;
+  return regexIsOpenAiReasoning(modelId) ? "max_completion_tokens" : "max_tokens";
+}
+
+// src/config/temperature-support.ts
+var logger = createLogger({ component: "temperature-support" });
+var warnedDroppedModels = /* @__PURE__ */ new Set();
+function warnTemperatureDropped(modelId) {
+  if (warnedDroppedModels.has(modelId)) {
+    logger.debug("Omitted unsupported temperature (already warned for this model)", {
+      modelId,
+      parameter: "temperature"
+    });
+    return;
+  }
+  warnedDroppedModels.add(modelId);
+  logger.warn(
+    `Model "${modelId}" does not support a custom \`temperature\` (the provider rejects non-default values with a 400). nexus-agents omitted it; the request runs at the provider default. Any determinism/consistency you expected from temperature has NO effect on this model.`,
+    { modelId, parameter: "temperature", severity: "behavioral" }
+  );
+}
+
+// src/adapters/optional-params.ts
+var BEHAVIORAL_PARAMS = /* @__PURE__ */ new Set(["temperature", "seed", "top_p"]);
+function parameterSeverity(param) {
+  return BEHAVIORAL_PARAMS.has(param) ? "behavioral" : "cosmetic";
+}
+function planOptionalParams(request, modelId) {
+  const dropped = [];
+  let temperature;
+  if (request.temperature !== void 0) {
+    if (modelSupportsParameter(modelId, "temperature")) {
+      temperature = request.temperature;
+    } else {
+      warnTemperatureDropped(modelId);
+      dropped.push({
+        param: "temperature",
+        reason: `model_rejects:${modelId}`,
+        severity: parameterSeverity("temperature")
+      });
+    }
+  }
+  return { ...temperature !== void 0 ? { temperature } : {}, dropped };
+}
+
+// src/adapters/openai-mappers.ts
+function mapStopReason(openaiReason) {
+  switch (openaiReason) {
+    case "stop":
+      return "end_turn";
+    case "length":
+      return "max_tokens";
+    case "tool_calls":
+    case "function_call":
+      return "tool_use";
+    // `content_filter` is never mapped as a finish: the adapter turns it into an
+    // error before a response is built (#6607, see detectNonAnswer), because
+    // every consumer reads a mapped response as an answer.
+    default:
+      return "end_turn";
+  }
+}
+var CONTENT_FILTERED = {
+  reason: "content_filter",
+  detail: "the reply was blocked by a content filter"
+};
+function detectNonAnswer(choice, usage, reasoningFamily) {
+  if (choice.finish_reason === "content_filter") return CONTENT_FILTERED;
+  if (choice.finish_reason !== "length" || hasVisibleOutput(choice)) return void 0;
+  const reasoningTokens = usage?.completion_tokens_details?.reasoning_tokens;
+  if (!reasoningFamily && !(reasoningTokens !== void 0 && reasoningTokens > 0)) {
+    return void 0;
+  }
+  return {
+    reason: "reasoning_truncated",
+    detail: "the completion budget was spent on reasoning before any output (empty reply, finish length)",
+    ...reasoningTokens !== void 0 ? { reasoningTokens } : {}
+  };
+}
+function hasVisibleOutput(choice) {
+  const text = choice.message.content;
+  if (text !== null && text !== "") return true;
+  return (choice.message.tool_calls?.length ?? 0) > 0;
+}
+function parseToolArguments(args) {
+  try {
+    return JSON.parse(args);
+  } catch {
+    return { _raw: args };
+  }
+}
+function mapChoiceToContentBlocks(choice) {
+  const blocks = [];
+  const message = choice.message;
+  if (message.content !== null && message.content !== "") {
+    blocks.push({ type: "text", text: message.content });
+  }
+  if (message.tool_calls !== void 0 && message.tool_calls.length > 0) {
+    for (const toolCall of message.tool_calls) {
+      if (isFunctionToolCall(toolCall)) {
+        blocks.push({
+          type: "tool_use",
+          id: toolCall.id,
+          name: toolCall.function.name,
+          input: parseToolArguments(toolCall.function.arguments)
+        });
+      }
+    }
+  }
+  if (blocks.length === 0) {
+    blocks.push({ type: "text", text: "" });
+  }
+  return blocks;
+}
+function mapMessage(message) {
+  if (message.role === "system") {
+    return [mapSystemMessage(message)];
+  }
+  if (message.role === "user") {
+    return mapUserMessage(message);
+  }
+  return [mapAssistantMessage(message)];
+}
+function mapSystemMessage(message) {
+  const content = typeof message.content === "string" ? message.content : message.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+  return { role: "system", content };
+}
+function mapUserMessage(message) {
+  if (typeof message.content === "string") {
+    return [{ role: "user", content: message.content }];
+  }
+  const toolResults = message.content.filter(
+    (b) => b.type === "tool_result"
+  );
+  if (toolResults.length > 0) {
+    return toolResults.map((result) => ({
+      role: "tool",
+      tool_call_id: result.tool_use_id,
+      content: result.content
+    }));
+  }
+  const content = message.content.map((block) => {
+    if (block.type === "text") {
+      return { type: "text", text: block.text };
+    }
+    if (block.type === "image") {
+      return {
+        type: "image_url",
+        image_url: {
+          url: `data:${block.source.media_type};base64,${block.source.data}`
+        }
+      };
+    }
+    return { type: "text", text: "" };
+  });
+  return [{ role: "user", content }];
+}
+function mapAssistantMessage(message) {
+  if (typeof message.content === "string") {
+    return { role: "assistant", content: message.content };
+  }
+  const toolUses = message.content.filter(
+    (b) => b.type === "tool_use"
+  );
+  const textContent = message.content.filter((b) => b.type === "text").map((b) => b.text).join("");
+  if (toolUses.length > 0) {
+    const assistantMessage = {
+      role: "assistant",
+      content: textContent !== "" ? textContent : null,
+      tool_calls: toolUses.map((tool) => ({
+        id: tool.id,
+        type: "function",
+        function: {
+          name: tool.name,
+          arguments: JSON.stringify(tool.input)
+        }
+      }))
+    };
+    return assistantMessage;
+  }
+  return { role: "assistant", content: textContent };
+}
+function mapTool(tool) {
+  return {
+    type: "function",
+    function: {
+      name: tool.name,
+      description: tool.description,
+      parameters: tool.inputSchema
+    }
+  };
+}
+function mapResponseUsage(response) {
+  const u = response.usage;
+  if (u === void 0) return void 0;
+  const cached = u.prompt_tokens_details?.cached_tokens;
+  return {
+    inputTokens: u.prompt_tokens,
+    outputTokens: u.completion_tokens,
+    totalTokens: u.total_tokens,
+    ...cached !== void 0 ? { cachedInputTokens: cached } : {}
+  };
+}
+function mapContentDelta(delta, currentIndex, hasStarted) {
+  const chunks = [];
+  if (delta.content !== void 0 && delta.content !== null && delta.content !== "") {
+    if (currentIndex === 0 && !hasStarted) {
+      chunks.push({
+        type: "content_block_start",
+        index: 0,
+        contentBlock: { type: "text", text: "" }
+      });
+    }
+    chunks.push({
+      type: "content_block_delta",
+      index: currentIndex,
+      delta: { type: "text_delta", text: delta.content }
+    });
+  }
+  return chunks;
+}
+function createStreamToolCallState() {
+  return { calls: /* @__PURE__ */ new Map() };
+}
+function accumulateToolCallsDelta(delta, state) {
+  for (const toolCall of delta.tool_calls ?? []) {
+    const entry = state.calls.get(toolCall.index) ?? { id: "", name: "", args: "" };
+    if (toolCall.id !== void 0) entry.id = toolCall.id;
+    if (toolCall.function?.name !== void 0) entry.name = toolCall.function.name;
+    if (toolCall.function?.arguments !== void 0) entry.args += toolCall.function.arguments;
+    state.calls.set(toolCall.index, entry);
+  }
+}
+function flushToolCalls(state) {
+  const chunks = [...state.calls.entries()].sort(([a], [b]) => a - b).map(([index, call]) => ({
+    type: "content_block_start",
+    index,
+    contentBlock: {
+      type: "tool_use",
+      id: call.id,
+      name: call.name,
+      input: call.args === "" ? {} : parseToolArguments(call.args)
+    }
+  }));
+  state.calls.clear();
+  return chunks;
+}
+function mapFinishChunks(choice, chunk, currentIndex, toolCalls) {
+  const chunks = [];
+  if (choice.finish_reason !== null) {
+    chunks.push(...flushToolCalls(toolCalls));
+    chunks.push({
+      type: "content_block_stop",
+      index: currentIndex
+    });
+    chunks.push({
+      type: "message_delta",
+      delta: { stop_reason: mapStopReason(choice.finish_reason) },
+      // A stream whose usage IS reported keeps it — when `include_usage` is
+      // wired, this is the branch that carries a real measurement.
+      ...chunk.usage !== void 0 && chunk.usage !== null ? {
+        usage: {
+          // OpenAI still omits prompt_tokens on the final chunk (#4835).
+          inputTokens: 0,
+          inputTokensMeasured: false,
+          outputTokens: chunk.usage.completion_tokens,
+          totalTokens: chunk.usage.total_tokens
+        }
+      } : {}
+    });
+    chunks.push({ type: "message_stop" });
+  }
+  return chunks;
+}
+function mapStreamChunk(chunk, currentIndex, hasStarted, toolCalls) {
+  const chunks = [];
+  const choice = chunk.choices[0];
+  if (!hasStarted) {
+    chunks.push({
+      type: "message_start",
+      message: { model: chunk.model }
+    });
+  }
+  if (choice === void 0) {
+    return chunks;
+  }
+  const delta = choice.delta;
+  chunks.push(...mapContentDelta(delta, currentIndex, hasStarted));
+  accumulateToolCallsDelta(delta, toolCalls);
+  chunks.push(...mapFinishChunks(choice, chunk, currentIndex, toolCalls));
+  return chunks;
+}
+
+// src/adapters/openai-responses.ts
+async function completeResponses(client, plan, signal) {
+  const response = await client.responses.create(buildResponsesParams(plan.params), {
+    signal
+  });
+  const dropped = plan.params.stop === void 0 ? plan.dropped : [
+    ...plan.dropped,
+    {
+      param: "stop",
+      reason: "The Responses API does not support stop sequences; omitted.",
+      severity: "behavioral"
+    }
+  ];
+  return { response: responsesToChatCompletion(response), dropped };
+}
+function buildResponsesParams(chat) {
+  const params = {
+    model: chat.model,
+    input: chat.messages.flatMap(mapInputMessage),
+    ...chat.max_completion_tokens !== void 0 && {
+      max_output_tokens: chat.max_completion_tokens
+    },
+    ...chat.temperature !== void 0 && { temperature: chat.temperature }
+  };
+  if (chat.tools !== void 0) {
+    params.tools = chat.tools.flatMap(
+      (tool) => tool.type === "function" ? [
+        {
+          type: "function",
+          name: tool.function.name,
+          parameters: tool.function.parameters ?? {},
+          strict: tool.function.strict ?? false,
+          ...tool.function.description !== void 0 && {
+            description: tool.function.description
+          }
+        }
+      ] : []
+    );
+  }
+  if (chat.response_format?.type === "json_object") {
+    params.text = { format: { type: "json_object" } };
+  } else if (chat.response_format?.type === "json_schema") {
+    params.text = {
+      format: {
+        type: "json_schema",
+        name: chat.response_format.json_schema.name,
+        schema: chat.response_format.json_schema.schema ?? {},
+        ...chat.response_format.json_schema.strict !== void 0 && {
+          strict: chat.response_format.json_schema.strict
+        }
+      }
+    };
+  }
+  return params;
+}
+function mapInputMessage(message) {
+  if (message.role === "tool")
+    return [
+      {
+        type: "function_call_output",
+        call_id: message.tool_call_id,
+        output: typeof message.content === "string" ? message.content : JSON.stringify(message.content)
+      }
+    ];
+  if (message.role === "function") return [];
+  const items = [];
+  if (message.content !== null && message.content !== void 0) {
+    items.push({
+      role: message.role,
+      content: typeof message.content === "string" ? [{ type: "input_text", text: message.content }] : message.content.flatMap(mapInputContent)
+    });
+  }
+  items.push(...mapInputToolCalls(message));
+  return items;
+}
+function mapInputToolCalls(message) {
+  if (message.role !== "assistant") return [];
+  return (message.tool_calls ?? []).flatMap(
+    (call) => call.type === "function" ? [
+      {
+        type: "function_call",
+        call_id: call.id,
+        name: call.function.name,
+        arguments: call.function.arguments
+      }
+    ] : []
+  );
+}
+function mapInputContent(part) {
+  if (part.type === "text") return [{ type: "input_text", text: part.text }];
+  if (part.type === "image_url")
+    return [
+      {
+        type: "input_image",
+        image_url: part.image_url.url,
+        detail: part.image_url.detail ?? "auto"
+      }
+    ];
+  return [];
+}
+function responsesToChatCompletion(response) {
+  if (response.status === "failed" || response.status === "cancelled") {
+    throw new ModelError(response.error?.message ?? `Responses request ${response.status}`, {
+      code: ErrorCode.MODEL_ERROR,
+      context: { reason: response.status }
+    });
+  }
+  const usage = responseUsage(response.usage);
+  return {
+    id: response.id,
+    model: response.model,
+    object: "chat.completion",
+    created: response.created_at,
+    choices: responseChoices(response),
+    ...usage !== void 0 && { usage }
+  };
+}
+function responseText(response) {
+  return response.output.flatMap(
+    (item) => item.type === "message" ? item.content.filter((part) => part.type === "output_text").map((part) => part.text) : []
+  ).join("");
+}
+function responseToolCalls(response) {
+  return response.output.flatMap(
+    (item) => item.type === "function_call" ? [
+      {
+        id: item.call_id,
+        type: "function",
+        function: { name: item.name, arguments: item.arguments }
+      }
+    ] : []
+  );
+}
+function responseChoices(response) {
+  const text = responseText(response);
+  const calls = responseToolCalls(response);
+  const refused = responseRefused(response);
+  const finishReason = refused ? "content_filter" : response.status === "incomplete" ? "length" : calls.length > 0 ? "tool_calls" : "stop";
+  if (text === "" && calls.length === 0 && !refused && finishReason !== "length") return [];
+  return [
+    {
+      index: 0,
+      finish_reason: finishReason,
+      logprobs: null,
+      message: {
+        role: "assistant",
+        content: text,
+        refusal: null,
+        ...calls.length > 0 && { tool_calls: calls }
+      }
+    }
+  ];
+}
+function responseRefused(response) {
+  return response.incomplete_details?.reason === "content_filter" || response.output.some(
+    (item) => item.type === "message" && item.content.some((part) => part.type === "refusal")
+  );
+}
+function responseUsage(usage) {
+  if (usage === void 0 || usage === null || typeof usage.input_tokens !== "number" || typeof usage.output_tokens !== "number" || typeof usage.total_tokens !== "number")
+    return void 0;
+  return {
+    prompt_tokens: usage.input_tokens,
+    completion_tokens: usage.output_tokens,
+    total_tokens: usage.total_tokens,
+    ...usage.input_tokens_details !== void 0 && {
+      prompt_tokens_details: { cached_tokens: usage.input_tokens_details.cached_tokens }
+    },
+    ...usage.output_tokens_details !== void 0 && {
+      completion_tokens_details: { reasoning_tokens: usage.output_tokens_details.reasoning_tokens }
+    }
+  };
+}
+
+// src/adapters/openai-responses-stream.ts
+async function* mapResponsesStream(events, mapResponse) {
+  const blocks = /* @__PURE__ */ new Map();
+  let completed = false;
+  for await (const event of events) {
+    assertStreamEvent(event);
+    if (event.type === "response.completed" || event.type === "response.incomplete") {
+      const response = mapResponse(event.response);
+      yield {
+        type: "message_delta",
+        delta: { stop_reason: response.stopReason },
+        ...response.usage !== void 0 && { usage: response.usage }
+      };
+      yield { type: "message_stop" };
+      completed = true;
+    } else {
+      yield* mapContentEvent(event, blocks);
+    }
+  }
+  if (!completed)
+    throw new ModelError("Responses stream ended without a terminal response", {
+      code: ErrorCode.MODEL_ERROR
+    });
+}
+function assertStreamEvent(event) {
+  if (event.type === "response.failed")
+    throw new ModelError(event.response.error?.message ?? "Responses stream failed", {
+      code: ErrorCode.MODEL_ERROR
+    });
+  if (event.type === "error") throw new ModelError(event.message, { code: ErrorCode.MODEL_ERROR });
+  if (event.type === "response.refusal.delta" || event.type === "response.refusal.done") {
+    throw new ModelError("Responses reply was refused", { code: ErrorCode.MODEL_ERROR });
+  }
+}
+function mapContentEvent(event, blocks) {
+  switch (event.type) {
+    case "response.created":
+      return [{ type: "message_start", message: { model: event.response.model } }];
+    case "response.output_text.delta":
+      return textDeltaChunks(event, blocks);
+    case "response.output_text.done": {
+      const index = blocks.get(textBlockKey(event));
+      return index === void 0 ? [] : [{ type: "content_block_stop", index }];
+    }
+    case "response.output_item.done": {
+      if (event.item.type !== "function_call") return [];
+      const index = blocks.size;
+      blocks.set(`tool:${String(event.output_index)}`, index);
+      return [
+        {
+          type: "content_block_start",
+          index,
+          contentBlock: {
+            type: "tool_use",
+            id: event.item.call_id,
+            name: event.item.name,
+            input: parseArguments(event.item.arguments)
+          }
+        },
+        { type: "content_block_stop", index }
+      ];
+    }
+    default:
+      return [];
+  }
+}
+function textBlockKey(event) {
+  return `${String(event.output_index)}:${String(event.content_index)}`;
+}
+function textDeltaChunks(event, blocks) {
+  const key = textBlockKey(event);
+  const chunks = [];
+  let index = blocks.get(key);
+  if (index === void 0) {
+    index = blocks.size;
+    blocks.set(key, index);
+    chunks.push({ type: "content_block_start", index, contentBlock: { type: "text", text: "" } });
+  }
+  chunks.push({
+    type: "content_block_delta",
+    index,
+    delta: { type: "text_delta", text: event.delta }
+  });
+  return chunks;
+}
+function parseArguments(argumentsText) {
+  try {
+    return JSON.parse(argumentsText);
+  } catch {
+    return { _raw: argumentsText };
+  }
+}
+
+// src/adapters/openai-adapter.ts
+function kvTag(key, val) {
+  return val === null || val === void 0 || val === "" ? "" : `${key}=${String(val)}`;
+}
+function redactErrorText(text, secrets) {
+  return sanitizeErrorDetails(
+    redactGatewaySecrets(text, secrets, REDACTED_KEY_PLACEHOLDER),
+    secrets.apiKey
+  );
+}
+function describeOpenAIApiError(v, secrets) {
+  const tags = [
+    `HTTP ${String(v.status ?? "unknown")}`,
+    kvTag("type", v.type),
+    kvTag("code", v.code),
+    kvTag("param", v.param),
+    kvTag("request_id", v.requestID)
+  ].filter((t) => t !== "");
+  let body = "";
+  if (v.error !== void 0 && v.error !== null) {
+    try {
+      const raw = JSON.stringify(v.error);
+      body = ` body=${raw.length > MAX_ERROR_BODY_CHARS ? `${raw.slice(0, MAX_ERROR_BODY_CHARS)}\u2026` : raw}`;
+    } catch {
+      body = " body=<unserializable>";
+    }
+  }
+  return redactErrorText(`${tags.join(" ")}: ${v.message ?? ""}${body}`, secrets);
+}
+var MAX_ERROR_BODY_CHARS = 600;
+var OpenAIAdapter = class extends BaseAdapter {
+  client;
+  resolvedModelId;
+  apiSurface;
+  omitDefaultTokenCap;
+  apiKey;
+  /** Headers sent on every request; each value is redacted from error text. */
+  headers;
+  /**
+   * Creates a new OpenAIAdapter instance.
+   *
+   * @param config - OpenAI adapter configuration
+   * @throws {ConfigError} If API key is missing
+   */
+  constructor(config) {
+    const resolvedModelId = config.verbatimModelId === true ? config.modelId : resolveModelId(config.modelId);
+    const baseConfig = {
+      providerId: "openai",
+      modelId: resolvedModelId,
+      capabilities: getModelCapabilities(config.modelId),
+      apiKey: config.apiKey,
+      ...config.logger !== void 0 && { logger: config.logger }
+    };
+    if (config.baseUrl !== void 0) {
+      baseConfig.baseUrl = config.baseUrl;
+    }
+    if (config.timeout !== void 0) {
+      baseConfig.timeout = config.timeout;
+    }
+    if (config.maxRetries !== void 0) {
+      baseConfig.maxRetries = config.maxRetries;
+    }
+    super(baseConfig);
+    this.apiKey = config.apiKey;
+    this.headers = config.defaultHeaders;
+    this.resolvedModelId = resolvedModelId;
+    this.apiSurface = config.apiSurface ?? "chat";
+    this.omitDefaultTokenCap = config.omitDefaultTokenCap ?? false;
+    requireApiKey(config.apiKey, "OpenAI", config.modelId);
+    this.client = this.createClient(config);
+  }
+  /**
+   * Creates the OpenAI client with configuration.
+   */
+  createClient(config) {
+    const clientOptions = {
+      apiKey: config.apiKey,
+      maxRetries: config.maxRetries ?? 2
+    };
+    if (config.baseUrl !== void 0) {
+      clientOptions.baseURL = config.baseUrl;
+    }
+    if (config.timeout !== void 0) {
+      clientOptions.timeout = config.timeout;
+    }
+    if (config.organization !== void 0) {
+      clientOptions.organization = config.organization;
+    }
+    if (config.defaultHeaders !== void 0) {
+      clientOptions.defaultHeaders = config.defaultHeaders;
+    }
+    if (config.fetchOptions !== void 0) {
+      clientOptions.fetchOptions = config.fetchOptions;
+    }
+    clientOptions.fetch = config.fetch;
+    return new OpenAI(clientOptions);
+  }
+  /**
+   * Validates adapter configuration.
+   * Extends base validation with OpenAI-specific checks.
+   */
+  validateConfig() {
+    const baseResult = super.validateConfig();
+    if (!baseResult.ok) {
+      return baseResult;
+    }
+    const keyResult = validateApiKeyPresence(this.config.apiKey, this.providerId, this.modelId);
+    if (!keyResult.ok) return keyResult;
+    return ok(void 0);
+  }
+  /**
+   * Send a completion request to OpenAI.
+   *
+   * @param request - The completion request
+   * @returns Result with response or ModelError
+   */
+  async complete(request) {
+    this.logRequest(request);
+    try {
+      const response = await this.executeCompletion(request);
+      this.logResponse(response);
+      return ok(response);
+    } catch (error) {
+      return err(this.transformError(error));
+    }
+  }
+  /**
+   * Surface an OpenAI / OpenAI-compatible gateway's REAL HTTP status + response
+   * body in the error (#4047). The OpenAI SDK's default message collapses a
+   * gateway rejection to e.g. `"400 status code (no body)"`, which hides WHY a
+   * litellm-style gateway rejected a request — exactly the wall hit when
+   * diagnosing degraded voter panels on a custom gateway. We re-message with the
+   * status/type/code/param/request-id/body. Error-code routing is unchanged: we
+   * classify on the ORIGINAL signal (`status`/`code`/`message`) via a clean probe
+   * error, so the diagnostic `request_id`/`body` can't pollute the message-
+   * substring classifier, then re-message the result with the full detail.
+   * Applies to direct OpenAI and the compat gateway alike.
+   */
+  transformError(error) {
+    const secrets = { apiKey: this.apiKey, headers: this.headers };
+    if (error instanceof APIError) {
+      if (error.cause instanceof ConfigError) {
+        const message = redactErrorText(error.cause.message, secrets);
+        return new ModelError(message, { code: error.cause.code, cause: error.cause });
+      }
+      const v = error;
+      const probe = new Error(typeof v.message === "string" ? v.message : "");
+      probe.status = typeof v.status === "number" ? v.status : void 0;
+      probe.code = v.code ?? void 0;
+      probe.param = typeof v.param === "string" && v.param !== "" ? v.param : void 0;
+      probe.cause = error;
+      const classified = super.transformError(probe);
+      classified.message = `${this.providerId}/${this.modelId}: ${describeOpenAIApiError(v, secrets)}`;
+      return classified;
+    }
+    const err2 = super.transformError(error);
+    err2.message = redactErrorText(err2.message, secrets);
+    return err2;
+  }
+  /**
+   * Stream a completion request from OpenAI.
+   *
+   * @param request - The completion request
+   * @yields StreamChunk objects as they arrive
+   */
+  async *stream(request) {
+    this.logRequest(request);
+    const [controller, iterable] = createStream();
+    this.executeStream(request, controller).catch((error) => {
+      const modelError = this.transformError(error);
+      controller.error(modelError);
+    });
+    yield* iterable;
+  }
+  /**
+   * Count tokens in text using OpenAI-specific estimation.
+   *
+   * @param text - Text to count tokens for
+   * @returns Approximate token count
+   */
+  countTokens(text) {
+    return Promise.resolve(getTokenEstimator().estimateText(text, "openai"));
+  }
+  /**
+   * Executes the completion request against the OpenAI API.
+   */
+  async executeCompletion(request) {
+    const { params, dropped } = this.buildRequestParams(request);
+    if (this.apiSurface === "responses") {
+      const result = await completeResponses(this.client, { params, dropped }, request.signal);
+      return this.mapResponse(result.response, result.dropped);
+    }
+    const response = request.signal !== void 0 ? await this.client.chat.completions.create(params, { signal: request.signal }) : await this.client.chat.completions.create(params);
+    return this.mapResponse(response, dropped);
+  }
+  /**
+   * Executes streaming completion and pushes chunks to the controller.
+   */
+  async executeStream(request, controller) {
+    try {
+      const { params } = this.buildRequestParams(request);
+      if (this.apiSurface === "responses") {
+        const stream2 = await this.client.responses.create(
+          { ...buildResponsesParams(params), stream: true },
+          { signal: request.signal }
+        );
+        for await (const chunk of mapResponsesStream(
+          stream2,
+          (response) => this.mapResponse(responsesToChatCompletion(response))
+        ))
+          controller.push(chunk);
+        controller.complete();
+        return;
+      }
+      const stream = await this.client.chat.completions.create({ ...params, stream: true });
+      let contentIndex = 0;
+      let hasStarted = false;
+      const toolCalls = createStreamToolCallState();
+      for await (const chunk of stream) {
+        if (chunk.choices[0]?.finish_reason === "content_filter") {
+          throw nonAnswerError(`${this.providerId}/${this.modelId}`, CONTENT_FILTERED, chunk.model);
+        }
+        const mappedChunks = mapStreamChunk(chunk, contentIndex, hasStarted, toolCalls);
+        for (const mappedChunk of mappedChunks) {
+          if (mappedChunk.type === "message_start") {
+            hasStarted = true;
+          }
+          if (mappedChunk.type === "content_block_start") {
+            contentIndex++;
+          }
+          controller.push(mappedChunk);
+        }
+      }
+      controller.complete();
+    } catch (error) {
+      const modelError = this.transformError(error);
+      controller.error(modelError);
+    }
+  }
+  /**
+   * Builds OpenAI API request parameters from our CompletionRequest.
+   */
+  buildRequestParams(request) {
+    const messages = this.buildMessages(request);
+    const params = {
+      model: this.resolvedModelId,
+      messages,
+      ...request.maxTokens !== void 0 || !this.omitDefaultTokenCap ? { max_completion_tokens: request.maxTokens ?? this.defaultMaxCompletionTokens() } : {}
+    };
+    const dropped = this.addOptionalParams(params, request);
+    return { params, dropped };
+  }
+  /**
+   * Builds the messages array for the request.
+   */
+  buildMessages(request) {
+    const messages = [];
+    if (request.systemPrompt !== void 0 && request.systemPrompt !== "") {
+      messages.push({ role: "system", content: request.systemPrompt });
+    }
+    for (const msg of request.messages) {
+      if (msg.role === "system" && request.systemPrompt !== void 0) {
+        continue;
+      }
+      messages.push(...mapMessage(msg));
+    }
+    return messages;
+  }
+  /**
+   * Adds optional parameters to the request.
+   */
+  addOptionalParams(params, request) {
+    const plan = planOptionalParams(request, this.resolvedModelId);
+    if (plan.temperature !== void 0) {
+      params.temperature = plan.temperature;
+    }
+    if (request.stop !== void 0 && request.stop.length > 0) {
+      params.stop = request.stop;
+    }
+    if (request.tools !== void 0 && request.tools.length > 0) {
+      params.tools = request.tools.map(mapTool);
+    }
+    this.addResponseFormat(params, request);
+    return plan.dropped;
+  }
+  /**
+   * Adds response format to the request if specified.
+   */
+  addResponseFormat(params, request) {
+    if (request.responseFormat === void 0) {
+      return;
+    }
+    if (request.responseFormat.type === "json_object") {
+      params.response_format = { type: "json_object" };
+    } else if (request.responseFormat.type === "json_schema") {
+      params.response_format = {
+        type: "json_schema",
+        json_schema: {
+          name: "response",
+          schema: request.responseFormat.schema
+        }
+      };
+    }
+  }
+  /**
+   * Maps OpenAI API response to our CompletionResponse format.
+   */
+  mapResponse(response, dropped = []) {
+    const firstChoice = response.choices[0];
+    if (firstChoice === void 0) {
+      throw nonAnswerError(
+        `${this.providerId}/${this.modelId}`,
+        { reason: "no_choices", detail: "the response contained no choices" },
+        response.model
+      );
+    }
+    const nonAnswer = detectNonAnswer(firstChoice, response.usage, this.isReasoningFamily());
+    if (nonAnswer !== void 0)
+      throw nonAnswerError(`${this.providerId}/${this.modelId}`, nonAnswer, response.model);
+    const content = mapChoiceToContentBlocks(firstChoice);
+    const usage = mapResponseUsage(response);
+    return {
+      content,
+      ...usage !== void 0 ? { usage } : {},
+      stopReason: mapStopReason(firstChoice.finish_reason),
+      model: response.model,
+      // #4069: surface dropped params (e.g. an omitted temperature). Omitted
+      // entirely when nothing was dropped (exactOptionalPropertyTypes).
+      ...dropped.length > 0 ? { warnings: dropped } : {}
+    };
+  }
+  /**
+   * Reasoning families are the models that take `max_completion_tokens`
+   * (o-series, gpt-5, codex); the registry answers first, a regex second.
+   */
+  isReasoningFamily() {
+    return getMaxTokensParamForModel(this.resolvedModelId) === "max_completion_tokens";
+  }
+  /**
+   * Default completion cap when the request sets none (#6607). On a reasoning
+   * model the cap covers hidden reasoning tokens AND the visible reply, and
+   * 4,096 can be spent entirely on reasoning, leaving an empty reply. OpenAI's
+   * reasoning guide recommends reserving at least 25,000 tokens for reasoning
+   * and output when starting out, so that is the reasoning default. It is a
+   * ceiling, not a spend: a reply that finishes early is billed for what it
+   * used. Other models keep `DEFAULT_MAX_TOKENS`.
+   */
+  defaultMaxCompletionTokens() {
+    return this.isReasoningFamily() ? REASONING_DEFAULT_MAX_COMPLETION_TOKENS : DEFAULT_MAX_TOKENS;
+  }
+  /**
+   * (#2529) List models served by this OpenAI-compatible endpoint.
+   *
+   * Wraps `GET /v1/models`. Result is cached for `LIST_MODELS_TTL_MS`
+   * so identity resolution doesn't round-trip on every adapter.
+   * Concurrent callers share the in-flight promise.
+   *
+   * Throws on non-2xx so the harness-side identity resolver knows to
+   * fall back to modelId parsing — silent empty-list returns would be
+   * indistinguishable from "this gateway has no models", which a
+   * misconfigured endpoint shouldn't be allowed to claim.
+   */
+  async listModels() {
+    const now = Date.now();
+    if (this.modelsCache !== null && now - this.modelsCache.fetchedAt < LIST_MODELS_TTL_MS) {
+      return this.modelsCache.value;
+    }
+    if (this.modelsInFlight !== null) {
+      return this.modelsInFlight;
+    }
+    const inFlight = this.fetchModels();
+    this.modelsInFlight = inFlight;
+    try {
+      const value = await inFlight;
+      this.modelsCache = { value, fetchedAt: Date.now() };
+      return value;
+    } finally {
+      this.modelsInFlight = null;
+    }
+  }
+  modelsCache = null;
+  modelsInFlight = null;
+  async fetchModels() {
+    const list = await this.client.models.list();
+    return list.data.map((m) => {
+      const meta = { id: m.id };
+      if (typeof m.owned_by === "string") {
+        return { ...meta, ownedBy: m.owned_by, createdAt: m.created };
+      }
+      if (typeof m.created === "number") {
+        return { ...meta, createdAt: m.created };
+      }
+      return meta;
+    });
+  }
+};
+var LIST_MODELS_TTL_MS = 5 * 60 * 1e3;
+var REASONING_DEFAULT_MAX_COMPLETION_TOKENS = 25e3;
+function nonAnswerError(source, nonAnswer, servedModel) {
+  return new ModelError(`${source}: ${nonAnswer.detail}`, {
+    code: ErrorCode.MODEL_ERROR,
+    context: {
+      reason: nonAnswer.reason,
+      ...servedModel !== void 0 ? { servedModel } : {},
+      ...nonAnswer.reasoningTokens !== void 0 ? { reasoningTokens: nonAnswer.reasoningTokens } : {}
+    }
+  });
+}
+function createOpenAIAdapter(config) {
+  return new OpenAIAdapter(config);
+}
+
+// src/adapters/gateway-usage-recording.ts
+var recordingSources = /* @__PURE__ */ new WeakMap();
+function withGatewayUsageRecording(inner, gatewayArm, modelVerified, providerId) {
+  inner = recordingSources.get(inner) ?? inner;
+  const recordedProviderId = providerId ?? inner.providerId;
+  const wrapped = {
+    gatewayArm,
+    providerId: recordedProviderId,
+    modelId: inner.modelId,
+    capabilities: inner.capabilities,
+    countTokens: (text) => inner.countTokens(text),
+    validateConfig: () => inner.validateConfig(),
+    stream: (request) => inner.stream(request),
+    async complete(request) {
+      const start = getTimeProvider().now();
+      const result = await inner.complete(request);
+      const latencyMs = getTimeProvider().now() - start;
+      try {
+        if (result.ok) {
+          const u = result.value.usage;
+          if (u === void 0) return result;
+          const cost = gatewayCostDetail(gatewayArm, inner.modelId, u.inputTokens, u.outputTokens);
+          recordUsageEvent({
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            modelId: inner.modelId,
+            providerId: recordedProviderId,
+            inputTokens: u.inputTokens,
+            outputTokens: u.outputTokens,
+            usdCost: cost.costUsd,
+            latencyMs,
+            success: true,
+            priced: cost.priced,
+            ...modelVerified !== void 0 && { modelVerified },
+            ...cost.priced ? { priceSource: cost.resolvedId } : {}
+          });
+        } else {
+          recordFailedCall(inner, latencyMs, result.error.code, modelVerified, recordedProviderId);
+        }
+      } catch {
+      }
+      return result;
+    }
+  };
+  recordingSources.set(wrapped, inner);
+  attachListModels(wrapped, inner);
+  return wrapped;
+}
+function recordFailedCall(inner, latencyMs, errorCode, modelVerified, providerId) {
+  recordUsageEvent({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    modelId: inner.modelId,
+    providerId,
+    inputTokens: 0,
+    outputTokens: 0,
+    usdCost: 0,
+    latencyMs,
+    success: false,
+    errorCode,
+    ...modelVerified !== void 0 && { modelVerified }
+  });
+}
+function attachListModels(wrapped, inner) {
+  const list = inner.listModels?.bind(inner);
+  if (list === void 0) return;
+  wrapped.listModels = () => list();
+}
+
+// src/config/opencode-bridge.ts
+import { readFileSync } from "node:fs";
+var defaultLogger = createLogger({ component: "opencode-bridge" });
+function readOpencodeGateway(path, logger2 = defaultLogger) {
+  const raw = readFileOrNull(path, logger2);
+  if (raw === null) return null;
+  const parsed = parseJsonOrNull(raw, path, logger2);
+  if (parsed === null) return null;
+  const options = extractOpenAICompatOptions(parsed);
+  if (options === null) {
+    logger2.debug("opencode.json has no providers.openai-compat.options block", { path });
+    return null;
+  }
+  const baseURL = typeof options.baseURL === "string" ? options.baseURL.trim() : "";
+  const apiKeyRaw = typeof options.apiKey === "string" ? options.apiKey.trim() : "";
+  if (baseURL === "" || apiKeyRaw === "") {
+    logger2.warn("opencode.json providers.openai-compat missing baseURL or apiKey", { path });
+    return null;
+  }
+  const apiKey = resolveEnvInterpolation(apiKeyRaw);
+  if (apiKey === null) {
+    logger2.warn(
+      "opencode.json apiKey references an env var that is not set; gateway not configured",
+      { path }
+    );
+    return null;
+  }
+  logger2.info("Gateway config sourced from opencode.json", { host: hostnameOf(baseURL), path });
+  return { baseURL, apiKey };
+}
+function readFileOrNull(path, logger2) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
+    logger2.debug("Could not read opencode.json", { path, error: msg });
+    return null;
+  }
+}
+function parseJsonOrNull(raw, path, logger2) {
+  try {
+    return JSON.parse(raw);
+  } catch (err2) {
+    const name = err2 instanceof Error ? err2.name : "unknown error";
+    logger2.warn("opencode.json is not valid JSON; ignoring", { path, error: name });
+    return null;
+  }
+}
+function extractOpenAICompatOptions(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const root = parsed;
+  const providers = root.providers;
+  if (typeof providers !== "object" || providers === null) return null;
+  const provider = providers["openai-compat"];
+  if (typeof provider !== "object" || provider === null) return null;
+  const options = provider.options;
+  if (typeof options !== "object" || options === null) return null;
+  return options;
+}
+function resolveEnvInterpolation(value) {
+  const match = /^\{env:([A-Z0-9_]+)\}$/.exec(value);
+  if (match === null) return value;
+  const envName = match[1];
+  if (envName === void 0) return null;
+  const resolved = process.env[envName];
+  if (resolved === void 0 || resolved === "") return null;
+  return resolved;
+}
+
+// src/adapters/gateway-client-guard.ts
+function validateOpenAICompatBaseUrl(baseUrl) {
+  const validated = validateCustomApiBaseUrl(baseUrl);
+  if (!validated.ok) throw validated.error;
+  return validated.value.toString();
+}
+function guardedGatewayFetch(baseUrl) {
+  let allowed;
+  const check = async () => {
+    const status = await checkGatewayHost(baseUrl);
+    if (status.state === "refused_private_host") throw new GatewayHostRefusedError(status);
+    if (status.state === "lookup_timed_out") {
+      throw new ConfigError(`${GATEWAY_HOST_LOOKUP_TIMED_OUT} (host ${status.host})`);
+    }
+  };
+  return async (input, init) => {
+    allowed ??= check();
+    try {
+      await allowed;
+    } catch (error) {
+      allowed = void 0;
+      throw error;
+    }
+    return fetch(input, init);
+  };
+}
+
+// src/adapters/gateway-http.ts
+import { BlockList, isIP } from "node:net";
+import { ProxyAgent } from "undici";
+var OPENAI_COMPAT_AUTH_HEADER_ENV = "NEXUS_OPENAI_COMPAT_AUTH_HEADER";
+var OPENAI_COMPAT_EXTRA_HEADERS_ENV = "NEXUS_OPENAI_COMPAT_EXTRA_HEADERS";
+var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+function parseGatewayExtraHeaders(raw) {
+  const headers = {};
+  if (raw === void 0 || raw.trim() === "") return { ok: true, headers };
+  if (/[\r\n]/.test(raw)) return { ok: false, reason: "contains a newline" };
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, entry] of raw.split(",").entries()) {
+    if (entry.trim() === "") continue;
+    const at = `entry ${String(index + 1)}`;
+    const parsed = parseHeaderEntry(entry, at);
+    if ("reason" in parsed) return { ok: false, reason: parsed.reason };
+    const key = parsed.name.toLowerCase();
+    if (seen.has(key)) return { ok: false, reason: `${at} is a duplicate header name` };
+    seen.add(key);
+    headers[parsed.name] = parsed.value;
+  }
+  return { ok: true, headers };
+}
+function parseHeaderEntry(entry, at) {
+  const eq = entry.indexOf("=");
+  if (eq < 0) return { reason: `${at} has no '='` };
+  const name = entry.slice(0, eq).trim();
+  const value = entry.slice(eq + 1).trim();
+  if (!HEADER_NAME.test(name)) return { reason: `${at} has an illegal header name` };
+  if (CONTROL_CHARS.test(value)) return { reason: `${at} value contains a control character` };
+  if (name.toLowerCase() === "authorization") {
+    return { reason: `${at} sets Authorization; use ${OPENAI_COMPAT_AUTH_HEADER_ENV}` };
+  }
+  return { name, value };
+}
+function authHeaderRejection(raw) {
+  return HEADER_NAME.test(raw) ? void 0 : "not a legal header name";
+}
+function firstSet(env, names) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value !== void 0 && value !== "") return value;
+  }
+  return void 0;
+}
+function splitNoProxyEntry(entry) {
+  const bracketed = /^\[([^\]]+)\](?::(\d+))?$/.exec(entry);
+  if (bracketed !== null) return { host: bracketed[1] ?? "", port: bracketed[2] };
+  const parts = entry.split(":");
+  if (parts.length === 2 && /^\d+$/.test(parts[1] ?? "")) {
+    return { host: parts[0] ?? "", port: parts[1] };
+  }
+  return { host: entry, port: void 0 };
+}
+function matchesNoProxy(url, noProxy) {
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const port = url.port !== "" ? url.port : url.protocol === "https:" ? "443" : "80";
+  return noProxy.split(/[\s,]+/).some((raw) => noProxyEntryMatches(raw.trim().toLowerCase(), host, port));
+}
+function noProxyEntryMatches(entry, host, port) {
+  if (entry === "") return false;
+  if (entry === "*") return true;
+  const parsed = splitNoProxyEntry(entry);
+  if (parsed.port !== void 0 && parsed.port !== port) return false;
+  const hostFamily = isIP(host);
+  if (hostFamily === 4 || hostFamily === 6) {
+    return ipEntryMatches(parsed.host, host, hostFamily);
+  }
+  const suffix = parsed.host.replace(/^\*?\./, "");
+  return suffix !== "" && (host === suffix || host.endsWith(`.${suffix}`));
+}
+function ipEntryMatches(entry, host, family) {
+  const type = family === 4 ? "ipv4" : "ipv6";
+  const slash = entry.indexOf("/");
+  const address = slash === -1 ? entry : entry.slice(0, slash);
+  if (isIP(address) !== family) return false;
+  const range = new BlockList();
+  if (slash === -1) {
+    range.addAddress(address, type);
+    return range.check(host, type);
+  }
+  const prefixText = entry.slice(slash + 1);
+  const prefix = Number(prefixText);
+  if (!/^\d{1,3}$/.test(prefixText) || prefix > (family === 4 ? 32 : 128)) return false;
+  range.addSubnet(address, prefix, type);
+  return range.check(host, type);
+}
+function gatewayProxyUrl(baseUrl, env) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return void 0;
+  }
+  const names = url.protocol === "https:" ? ["https_proxy", "HTTPS_PROXY"] : url.protocol === "http:" ? ["http_proxy", "HTTP_PROXY"] : [];
+  const proxy = firstSet(env, names);
+  if (proxy === void 0) return void 0;
+  const noProxy = firstSet(env, ["no_proxy", "NO_PROXY"]);
+  return noProxy !== void 0 && matchesNoProxy(url, noProxy) ? void 0 : proxy;
+}
+function proxyRejection(proxy) {
+  try {
+    const { protocol } = new URL(proxy);
+    return protocol === "http:" || protocol === "https:" ? void 0 : "only http:// and https:// proxies are supported";
+  } catch {
+    return "not a valid URL";
+  }
+}
+function readAuthHeader(env, logger2) {
+  const raw = env[OPENAI_COMPAT_AUTH_HEADER_ENV]?.trim();
+  if (raw === void 0 || raw === "") return void 0;
+  const reason = authHeaderRejection(raw);
+  if (reason !== void 0) {
+    logger2.warn(
+      `${OPENAI_COMPAT_AUTH_HEADER_ENV} ignored (${reason}); the key is sent as a bearer token`,
+      {
+        env: OPENAI_COMPAT_AUTH_HEADER_ENV,
+        reason
+      }
+    );
+    return void 0;
+  }
+  return raw.toLowerCase() === "authorization" ? void 0 : raw;
+}
+function readExtraHeaders(env, authHeader, logger2) {
+  const parsed = parseGatewayExtraHeaders(env[OPENAI_COMPAT_EXTRA_HEADERS_ENV]);
+  let reason = parsed.ok ? void 0 : parsed.reason;
+  if (parsed.ok && authHeader !== void 0) {
+    const clash = Object.keys(parsed.headers).some(
+      (name) => name.toLowerCase() === authHeader.toLowerCase()
+    );
+    if (clash) reason = `sets ${OPENAI_COMPAT_AUTH_HEADER_ENV}'s header, which carries the key`;
+  }
+  if (reason !== void 0) {
+    logger2.warn(
+      `${OPENAI_COMPAT_EXTRA_HEADERS_ENV} ignored (${reason}); no extra headers are sent`,
+      {
+        env: OPENAI_COMPAT_EXTRA_HEADERS_ENV,
+        reason
+      }
+    );
+    return void 0;
+  }
+  return parsed.ok && Object.keys(parsed.headers).length > 0 ? parsed.headers : void 0;
+}
+function readProxy(baseUrl, env, logger2) {
+  const proxy = gatewayProxyUrl(baseUrl, env);
+  if (proxy === void 0) return void 0;
+  const reason = proxyRejection(proxy);
+  if (reason === void 0) return proxy;
+  const variable = baseUrl.startsWith("https:") ? "HTTPS_PROXY" : "HTTP_PROXY";
+  logger2.warn(`${variable} ignored for the gateway (${reason}); gateway calls go direct`, {
+    env: variable,
+    reason
+  });
+  return void 0;
+}
+function readGatewayTransport(baseUrl, env, logger2) {
+  const authHeader = readAuthHeader(env, logger2);
+  const extraHeaders = readExtraHeaders(env, authHeader, logger2);
+  const proxyUrl = readProxy(baseUrl, env, logger2);
+  return {
+    ...authHeader !== void 0 && { authHeader },
+    ...extraHeaders !== void 0 && { extraHeaders },
+    ...proxyUrl !== void 0 && { proxyUrl }
+  };
+}
+var proxyAgents = /* @__PURE__ */ new Map();
+function proxyAgentFor(proxyUrl) {
+  const existing = proxyAgents.get(proxyUrl);
+  const agent = existing ?? new ProxyAgent(proxyUrl);
+  if (existing === void 0) proxyAgents.set(proxyUrl, agent);
+  return agent;
+}
+function gatewayClientOptions(transport) {
+  const headers = gatewayHeaders(transport);
+  return {
+    ...transport.apiSurface !== void 0 && { apiSurface: transport.apiSurface },
+    ...Object.keys(headers).length > 0 && { defaultHeaders: headers },
+    ...transport.proxyUrl !== void 0 && {
+      fetchOptions: { dispatcher: proxyAgentFor(transport.proxyUrl) }
+    }
+  };
+}
+function gatewayHeaders(transport) {
+  const headers = { ...transport.extraHeaders };
+  if (transport.authHeader !== void 0) {
+    headers["Authorization"] = null;
+    headers[transport.authHeader] = transport.apiKey;
+  }
+  return headers;
+}
+
+// src/adapters/openai-compat-adapter.ts
+function isGatewayModelAdapter(adapter) {
+  const arm = adapter.gatewayArm;
+  return typeof arm === "string" && isEndpointArmId(arm);
+}
+function readOpenAICompatEnv() {
+  const fromEnv = readGatewayFromEnv();
+  if (fromEnv !== null) return fromEnv;
+  return readGatewayFromOpencode();
+}
+function readGatewayFromEnv() {
+  const envUrl = process.env[OPENAI_COMPAT_URL_ENV]?.trim();
+  const envKey = process.env[OPENAI_COMPAT_KEY_ENV]?.trim();
+  if (envUrl === void 0 || envUrl === "") return null;
+  if (envKey === void 0 || envKey === "") return null;
+  return {
+    baseUrl: envUrl,
+    apiKey: envKey,
+    endpoint: readOpenAICompatEndpoint(),
+    modelAllowlist: readModelAllowlist(),
+    ...readGatewayTransport(envUrl, process.env, endpointLogger)
+  };
+}
+function readGatewayFromOpencode() {
+  const opencodePath = process.env["NEXUS_OPENCODE_CONFIG"]?.trim();
+  if (opencodePath === void 0 || opencodePath === "") return null;
+  const fromFile = readOpencodeGateway(opencodePath);
+  if (fromFile === null) return null;
+  return {
+    baseUrl: fromFile.baseURL,
+    apiKey: fromFile.apiKey,
+    endpoint: readOpenAICompatEndpoint(),
+    modelAllowlist: readModelAllowlist(),
+    ...readGatewayTransport(fromFile.baseURL, process.env, endpointLogger)
+  };
+}
+var endpointLogger = createLogger({ component: "openai-compat-adapter" });
+function readOpenAICompatEndpoint(env = process.env, logger2 = endpointLogger) {
+  const raw = env[OPENAI_COMPAT_ENDPOINT_ENV]?.trim();
+  if (raw === void 0 || raw === "") return DEFAULT_OPENAI_COMPAT_ENDPOINT;
+  const reason = gatewayEndpointRejection(raw);
+  if (reason === void 0) return raw;
+  logger2.warn(
+    `${OPENAI_COMPAT_ENDPOINT_ENV} ignored (${reason}); the gateway registers as api:${DEFAULT_OPENAI_COMPAT_ENDPOINT}`,
+    { env: OPENAI_COMPAT_ENDPOINT_ENV, reason, value: "<redacted>" }
+  );
+  return DEFAULT_OPENAI_COMPAT_ENDPOINT;
+}
+var MAX_DISCOVERED_MODELS = 256;
+var MODEL_DISCOVERY_TIMEOUT_MS = 1e4;
+var MODEL_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+function keepValidModelIds(models, logger2) {
+  const kept = models.filter((m) => MODEL_ID_PATTERN.test(m.id));
+  const dropped = models.length - kept.length;
+  if (dropped > 0) {
+    logger2?.warn(
+      `Dropped ${String(dropped)} gateway model id(s) that are not a valid model id shape (whitespace, control characters, or over 128 chars)`,
+      { dropped, kept: kept.length }
+    );
+  }
+  return kept;
+}
+async function discoverModels(config, logger2) {
+  const catalog = await discoverGatewayCatalog(config, logger2);
+  return catalog.ok ? ok(catalog.value.models) : catalog;
+}
+async function discoverGatewayCatalog(config, logger2) {
+  const hostCheck = await checkGatewayHost(config.baseUrl);
+  if (hostCheck.state === "refused_private_host") {
+    return err(new GatewayHostRefusedError(hostCheck));
+  }
+  if (hostCheck.state === "lookup_timed_out") {
+    return err(new ConfigError(`${GATEWAY_HOST_LOOKUP_TIMED_OUT} (host ${hostCheck.host})`));
+  }
+  try {
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey,
+      // Discovery runs during server bootstrap, so an unresponsive gateway must
+      // not stall startup indefinitely. The SDK's own default is far longer.
+      timeout: MODEL_DISCOVERY_TIMEOUT_MS,
+      maxRetries: 1,
+      // Auth header, extra headers and proxy (#6608) — the same options every
+      // per-model adapter gets, so discovery cannot pass where completions fail.
+      ...gatewayClientOptions(config)
+    });
+    const list = await client.models.list();
+    const listed = list.data.map((m) => ({ id: m.id, listing: m, model: m }));
+    const allowlist = config.modelAllowlist ?? [];
+    const refined = refineGatewayCatalog(keepValidModelIds(listed, logger2), allowlist, logger2);
+    if (refined.length > MAX_DISCOVERED_MODELS) {
+      return err(overCapError(config, list.data.length, refined.length, allowlist.length > 0));
+    }
+    return ok({
+      listedCount: list.data.length,
+      models: refined.map(({ model: m }) => ({
+        id: m.id,
+        created: m.created,
+        ownedBy: m.owned_by
+      }))
+    });
+  } catch (e) {
+    return err(
+      new ConfigError(
+        `Failed to discover models from ${hostnameOf(config.baseUrl)}: ${redactGatewaySecrets(getErrorMessage(e), { apiKey: config.apiKey, headers: config.extraHeaders })}. Verify ${OPENAI_COMPAT_URL_ENV} and ${OPENAI_COMPAT_KEY_ENV}, then retry.`
+      )
+    );
+  }
+}
+function overCapError(config, listed, refined, allowlisted) {
+  const cap = String(MAX_DISCOVERED_MODELS);
+  const host = hostnameOf(config.baseUrl);
+  const detail = allowlisted ? `${OPENAI_COMPAT_MODELS_ENV} matched ${String(refined)} of its ${String(listed)} listed models` : `it listed ${String(listed)} models (${String(refined)} chat models)`;
+  return new ConfigError(
+    `Gateway ${host}: ${detail}, above the ${cap} cap. Refusing to build an adapter per model. Set ${OPENAI_COMPAT_MODELS_ENV} to a comma-separated allowlist of model ids (\`*\` is a wildcard) naming at most ${cap} models.`
+  );
+}
+function createOpenAICompatAdapter(modelId, config, created) {
+  const inner = createOpenAICompatClient(modelId, config);
+  const wrapped = withGatewayUsageRecording(
+    inner,
+    `api:${config.endpoint ?? DEFAULT_OPENAI_COMPAT_ENDPOINT}`,
+    config.modelVerified
+  );
+  return created === void 0 ? wrapped : Object.assign(wrapped, { created });
+}
+function createOpenAICompatClient(modelId, config) {
+  const baseUrl = validateOpenAICompatBaseUrl(config.baseUrl);
+  return new OpenAIAdapter({
+    modelId,
+    apiKey: config.apiKey,
+    baseUrl,
+    verbatimModelId: true,
+    ...config.omitDefaultTokenCap !== void 0 && {
+      omitDefaultTokenCap: config.omitDefaultTokenCap
+    },
+    ...gatewayClientOptions(config),
+    fetch: guardedGatewayFetch(baseUrl),
+    ...config.logger !== void 0 && { logger: config.logger },
+    ...config.timeout !== void 0 && { timeout: config.timeout },
+    ...config.maxRetries !== void 0 && { maxRetries: config.maxRetries }
+  });
+}
+async function buildOpenAICompatAdapters(logger2) {
+  const config = readOpenAICompatEnv();
+  if (config === null) return null;
+  const discovered = await discoverModels(config, logger2);
+  if (!discovered.ok) return discovered;
+  return ok(
+    discovered.value.map(
+      (m) => createOpenAICompatAdapter(m.id, { ...config, modelVerified: true }, m.created)
+    )
+  );
+}
+
+export {
+  AdapterModelError,
+  requireApiKey,
+  validateApiKeyPresence,
+  BaseAdapter,
+  StreamError,
+  StreamCancelledError,
+  StreamController,
+  createStream,
+  take,
+  skip,
+  concatStreams,
+  fromArray,
+  tapStream,
+  reduceStream,
+  transformStream,
+  mergeStreams,
+  takeUntil,
+  filterStream,
+  withTimeout,
+  bufferStream,
+  DEFAULT_COLLECT_STREAM_MAX_CHUNKS,
+  collectStream,
+  planOptionalParams,
+  parseGatewayExtraHeaders,
+  gatewayProxyUrl,
+  readGatewayTransport,
+  GATEWAY_HOST_LOOKUP_TIMED_OUT,
+  checkGatewayHost,
+  GatewayHostRefusedError,
+  OPENAI_MODELS,
+  OPENAI_MODEL_ALIASES,
+  OpenAIAdapter,
+  createOpenAIAdapter,
+  withGatewayUsageRecording,
+  readOpencodeGateway,
+  validateOpenAICompatBaseUrl,
+  isGatewayModelAdapter,
+  readOpenAICompatEnv,
+  readOpenAICompatEndpoint,
+  discoverModels,
+  discoverGatewayCatalog,
+  createOpenAICompatAdapter,
+  createOpenAICompatClient,
+  buildOpenAICompatAdapters
+};
+//# sourceMappingURL=chunk-KLSNDPU6.js.map