nexus-agents 8.103.1 → 8.103.3

package/dist/{ast-rule-runner-H2VFAOT4.js → ast-rule-runner-XJLYSAGE.js}

@@ -9,8 +9,8 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-5EFWZHUV.js";
-import "./chunk-X7BYCDQN.js";
+} from "./chunk-XEXQG3VV.js";
+import "./chunk-KGLMAIY3.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -26,4 +26,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-H2VFAOT4.js.map
+//# sourceMappingURL=ast-rule-runner-XJLYSAGE.js.map

package/dist/{child-mcp-config-Y3DPCM6L.js → child-mcp-config-U6SFHNXN.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-OITVVSWO.js";
 import {
   createLogger
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 import "./chunk-UE7A2XHM.js";
 import "./chunk-LWOX65CP.js";
 import "./chunk-PX6F3LHL.js";
@@ -56,4 +56,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-Y3DPCM6L.js.map
+//# sourceMappingURL=child-mcp-config-U6SFHNXN.js.map

package/dist/{chunk-W7HVGLPS.js → chunk-24XTED4P.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -610,4 +610,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-W7HVGLPS.js.map
+//# sourceMappingURL=chunk-24XTED4P.js.map

package/dist/{chunk-BGATTU3Z.js → chunk-3IZPJAIC.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-W654ME6B.js";
 import {
   resolveToken
-} from "./chunk-W76A3RPF.js";
+} from "./chunk-S6PDNDLL.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
@@ -11,10 +11,10 @@ import {
   loadTechniquesRegistry,
   resolveInsideRoot,
   savePapersRegistry
-} from "./chunk-SIPFKN6U.js";
+} from "./chunk-5LG5RMTM.js";
 import {
   getToolMemory
-} from "./chunk-46CXXIQ4.js";
+} from "./chunk-KKGN23Z5.js";
 import {
   capitalizeWords,
   tokenizeFiltered,
@@ -43,7 +43,7 @@ import {
   ok,
   registerPersistentDistillerFactory,
   sigmoidConfidence
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4275,4 +4275,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-BGATTU3Z.js.map
+//# sourceMappingURL=chunk-3IZPJAIC.js.map

package/dist/{chunk-SIPFKN6U.js → chunk-5LG5RMTM.js}

@@ -5,7 +5,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 import {
   findRepoRoot,
   getActiveWorkspaceRoot,
@@ -290,4 +290,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-SIPFKN6U.js.map
+//# sourceMappingURL=chunk-5LG5RMTM.js.map

package/dist/{chunk-LHI66BKG.js → chunk-6PB7JUNT.js}

@@ -7,12 +7,12 @@ import {
   readGatewayTransport,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-FAO37OT4.js";
+} from "./chunk-ZG6UJP6U.js";
 import {
   assertCustomApiHostResolvesPublic,
   hostnameOf,
   redactApiKey
-} from "./chunk-NZNPMI3W.js";
+} from "./chunk-K3QNYYJZ.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-2NDA4DHW.js";
@@ -40,19 +40,39 @@ import {
   readModelAllowlist,
   recordUsageEvent,
   refineGatewayCatalog
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 
 // src/adapters/openai-compat-adapter.ts
 import OpenAI2 from "openai";
 
 // src/adapters/gateway-host-status.ts
+var GATEWAY_HOST_LOOKUP_TIMED_OUT = "gateway host check timed out; the gateway is not wired this attempt, will retry";
 var REMEDY = `Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 if the gateway runs on a trusted internal host, then restart the server.`;
-async function checkGatewayHost(baseUrl) {
+async function checkGatewayHost(baseUrl, options = {}) {
   const host = hostnameOf(baseUrl);
-  const guard = await assertCustomApiHostResolvesPublic(host);
+  const guard = await withLookupTimeout(
+    assertCustomApiHostResolvesPublic(host),
+    options.lookupTimeoutMs ?? GATEWAY_HOST_LOOKUP_TIMEOUT_MS
+  );
+  if (guard === "timed_out") return { state: "lookup_timed_out", host };
   if (guard.ok) return { state: "allowed", host };
   return { state: "refused_private_host", host, reason: guard.error.message, remedy: REMEDY };
 }
+var GATEWAY_HOST_LOOKUP_TIMEOUT_MS = 5e3;
+async function withLookupTimeout(work, ms) {
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      resolve("timed_out");
+    }, ms);
+    timer.unref();
+  });
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var GatewayHostRefusedError = class extends ConfigError {
   status;
   constructor(status) {
@@ -874,6 +894,9 @@ async function discoverGatewayCatalog(config, logger) {
   if (hostCheck.state === "refused_private_host") {
     return err(new GatewayHostRefusedError(hostCheck));
   }
+  if (hostCheck.state === "lookup_timed_out") {
+    return err(new ConfigError(`${GATEWAY_HOST_LOOKUP_TIMED_OUT} (host ${hostCheck.host})`));
+  }
   try {
     const client = new OpenAI2({
       baseURL: config.baseUrl,
@@ -1003,6 +1026,7 @@ export {
   OPENAI_MODEL_ALIASES,
   OpenAIAdapter,
   createOpenAIAdapter,
+  GATEWAY_HOST_LOOKUP_TIMED_OUT,
   checkGatewayHost,
   GatewayHostRefusedError,
   readOpencodeGateway,
@@ -1014,4 +1038,4 @@ export {
   createOpenAICompatAdapter,
   buildOpenAICompatAdapters
 };
-//# sourceMappingURL=chunk-LHI66BKG.js.map
+//# sourceMappingURL=chunk-6PB7JUNT.js.map

package/dist/chunk-6PB7JUNT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/openai-compat-adapter.ts","../src/adapters/gateway-host-status.ts","../src/adapters/openai-adapter.ts","../src/adapters/openai-types.ts","../src/adapters/openai-mappers.ts","../src/config/opencode-bridge.ts"],"sourcesContent":["/**\n * OpenAI-compatible gateway adapter — talk to any HTTP gateway that exposes\n * the OpenAI Chat Completions API. The gateway may itself be a multi-model\n * router (Bedrock/Vertex/Azure proxy, OpenRouter, vLLM, etc.). nexus-agents\n * sees one adapter, the gateway exposes N models, and the existing routing\n * pipeline picks among them.\n *\n * Source: Issue #2468 (epic #2467 child).\n *\n * Configuration precedence (#2503, child 3 of epic #2500):\n *   1. NEXUS_OPENAI_COMPAT_URL + NEXUS_OPENAI_COMPAT_KEY env vars (both required)\n *   2. NEXUS_OPENCODE_CONFIG path → opencode.json → providers.openai-compat\n *   3. Unconfigured → adapter not built\n *\n * Models are discovered via GET {base}/models at first use, where {base} is\n * NEXUS_OPENAI_COMPAT_URL and already ends in `/v1` (the SDK appends only\n * `/models`, so a base without `/v1` probes the wrong path). Each model\n * the gateway exposes can be selected by ID; the adapter wraps the existing\n * `OpenAIAdapter` for the actual chat-completions request, so streaming +\n * tool use + the full IModelAdapter contract come for free.\n */\n\nimport OpenAI from 'openai';\nimport {\n  checkGatewayHost,\n  GATEWAY_HOST_LOOKUP_TIMED_OUT,\n  GatewayHostRefusedError,\n} from './gateway-host-status.js';\n\nimport type {\n  Result,\n  CompletionRequest,\n  CompletionResponse,\n  ILogger,\n  ModelError,\n  ModelMetadata,\n  IModelAdapter,\n} from '../core/index.js';\nimport {\n  ok,\n  err,\n  ConfigError,\n  createLogger,\n  getErrorMessage,\n  getTimeProvider,\n} from '../core/index.js';\nimport { OpenAIAdapter } from './openai-adapter.js';\nimport { recordUsageEvent } from '../learning/usage-log.js';\nimport { gatewayCostDetail } from '../cli-adapters/budget-arm-cost.js';\nimport { readOpencodeGateway } from '../config/opencode-bridge.js';\nimport { isEndpointArmId, type EndpointArmId } from '../cli-adapters/types-core.js';\nimport { gatewayEndpointRejection } from './sdk/gateway-cost.js';\nimport {\n  DEFAULT_OPENAI_COMPAT_ENDPOINT,\n  OPENAI_COMPAT_ENDPOINT_ENV,\n  OPENAI_COMPAT_KEY_ENV,\n  OPENAI_COMPAT_MODELS_ENV,\n  OPENAI_COMPAT_URL_ENV,\n} from './sdk/types.js';\nimport { hostnameOf, redactApiKey } from './sdk/gateway-env.js';\nimport { readModelAllowlist, refineGatewayCatalog } from './gateway-catalog-filter.js';\nimport {\n  gatewayClientOptions,\n  readGatewayTransport,\n  type GatewayTransport,\n} from './gateway-http.js';\n\nexport interface OpenAICompatConfig extends GatewayTransport {\n  /** Gateway base URL — ends in `/v1`; the SDK appends `/models` and `/chat/completions`. */\n  readonly baseUrl: string;\n  /** API key the gateway expects. */\n  readonly apiKey: string;\n  /**\n   * Endpoint identity the gateway registers as — the `<endpoint>` of its\n   * `api:<endpoint>` arm (#4392 increment 2, step 2). Always set by\n   * {@link readOpenAICompatEnv}; optional on the type so a hand-built config\n   * (tests, embedders) keeps working, with the default applying at\n   * registration. Never the URL.\n   */\n  readonly endpoint?: string;\n  /**\n   * Model-id allowlist (`NEXUS_OPENAI_COMPAT_MODELS`, #6600), applied before\n   * the adapter cap; `*` is a wildcard. Absent or empty means no allowlist.\n   */\n  readonly modelAllowlist?: readonly string[];\n}\n\n/**\n * A per-model gateway adapter, marked with the `api:<endpoint>` arm it\n * registers under (#4392 increment 2, step 4). The telemetry writers key on\n * this — the usage log here, the vote rollup in `decision-cost-recording` —\n * to price a call by the arm's `NEXUS_GATEWAY_COST` declaration instead of\n * by the model id alone. `providerId` stays `'openai'` on purpose:\n * `inFamilyFallback` and `authRemediation` take their inputs from it.\n * Reached through {@link isGatewayModelAdapter} (narrowing) and\n * {@link createOpenAICompatAdapter} (construction); not exported by name\n * because nothing outside this module needs to spell it.\n */\ninterface GatewayModelAdapter extends IModelAdapter {\n  readonly gatewayArm: EndpointArmId;\n  /**\n   * The `/models` `created` stamp (epoch seconds) discovery listed for this\n   * model, when it listed one. Read by the family-slot ranking (#6604).\n   */\n  readonly created?: number;\n}\n\n/**\n * True iff `adapter` carries a valid gateway arm id. Checked by shape, not\n * by construction site: a hand-built config can name an endpoint that is not\n * an endpoint id, and a marker that fails the id rule is no marker.\n */\nexport function isGatewayModelAdapter(adapter: IModelAdapter): adapter is GatewayModelAdapter {\n  const arm: unknown = (adapter as Partial<GatewayModelAdapter>).gatewayArm;\n  return typeof arm === 'string' && isEndpointArmId(arm);\n}\n\nexport interface DiscoveredModel {\n  readonly id: string;\n  /** Unix epoch seconds when the model was created (per OpenAI API). */\n  readonly created?: number;\n  /** Owning organization or upstream provider name. */\n  readonly ownedBy?: string;\n}\n\n/**\n * Read the gateway config with the precedence chain documented in the\n * module docstring: env vars > opencode.json > unconfigured.\n *\n * The env-var path (#2468) wins when both `NEXUS_OPENAI_COMPAT_URL` and\n * `NEXUS_OPENAI_COMPAT_KEY` are set. Otherwise, when `NEXUS_OPENCODE_CONFIG`\n * names a path, the opencode.json bridge tries to source the gateway from\n * `providers.openai-compat.options.{baseURL, apiKey}` (#2503). Returns\n * `null` when neither path yields a config — caller treats unset gateway\n * as \"no adapter from this source.\"\n */\nexport function readOpenAICompatEnv(): OpenAICompatConfig | null {\n  const fromEnv = readGatewayFromEnv();\n  if (fromEnv !== null) return fromEnv;\n  return readGatewayFromOpencode();\n}\n\n/**\n * Reads the NEW names only. The deprecated `NEXUS_CUSTOM_API_*` pair is an\n * alias for the single-model `custom-openai` reader (`sdk/gateway-env.ts`)\n * and deliberately not for this one (#4392 increment 3, panel option C):\n * renaming is what opts an operator into discovery, in-process voters and\n * the `api:<endpoint>` arm, so the legacy pair alone must leave this null.\n */\nfunction readGatewayFromEnv(): OpenAICompatConfig | null {\n  const envUrl = process.env[OPENAI_COMPAT_URL_ENV]?.trim();\n  const envKey = process.env[OPENAI_COMPAT_KEY_ENV]?.trim();\n  if (envUrl === undefined || envUrl === '') return null;\n  if (envKey === undefined || envKey === '') return null;\n  return {\n    baseUrl: envUrl,\n    apiKey: envKey,\n    endpoint: readOpenAICompatEndpoint(),\n    modelAllowlist: readModelAllowlist(),\n    ...readGatewayTransport(envUrl, process.env, endpointLogger),\n  };\n}\n\nfunction readGatewayFromOpencode(): OpenAICompatConfig | null {\n  const opencodePath = process.env['NEXUS_OPENCODE_CONFIG']?.trim();\n  if (opencodePath === undefined || opencodePath === '') return null;\n  const fromFile = readOpencodeGateway(opencodePath);\n  if (fromFile === null) return null;\n  return {\n    baseUrl: fromFile.baseURL,\n    apiKey: fromFile.apiKey,\n    endpoint: readOpenAICompatEndpoint(),\n    modelAllowlist: readModelAllowlist(),\n    ...readGatewayTransport(fromFile.baseURL, process.env, endpointLogger),\n  };\n}\n\nconst endpointLogger = createLogger({ component: 'openai-compat-adapter' });\n\n/**\n * The gateway's endpoint identity (#4392 increment 2, step 2):\n * `NEXUS_OPENAI_COMPAT_ENDPOINT` when `api:<value>` is a GATEWAY arm id, else\n * {@link DEFAULT_OPENAI_COMPAT_ENDPOINT}. The fallback is deliberate: the env\n * schema reports an invalid value at startup, and this reader must never turn\n * a pasted URL — or a credential inside one — into an arm id, telemetry key\n * or display string, nor register the gateway as a VENDOR arm (`api:openai`),\n * where its cost declaration is unreachable (#6409). The same rule decides\n * both (`gatewayEndpointRejection`), and the fallback is warned with the\n * reason, never the value. Both config paths (env, opencode.json) share it.\n */\nexport function readOpenAICompatEndpoint(\n  env: NodeJS.ProcessEnv = process.env,\n  logger: ILogger = endpointLogger\n): string {\n  const raw = env[OPENAI_COMPAT_ENDPOINT_ENV]?.trim();\n  if (raw === undefined || raw === '') return DEFAULT_OPENAI_COMPAT_ENDPOINT;\n  const reason = gatewayEndpointRejection(raw);\n  if (reason === undefined) return raw;\n  logger.warn(\n    `${OPENAI_COMPAT_ENDPOINT_ENV} ignored (${reason}); the gateway registers as api:${DEFAULT_OPENAI_COMPAT_ENDPOINT}`,\n    { env: OPENAI_COMPAT_ENDPOINT_ENV, reason, value: '<redacted>' }\n  );\n  return DEFAULT_OPENAI_COMPAT_ENDPOINT;\n}\n\n/**\n * Ceiling on how many models one gateway may contribute.\n *\n * `buildOpenAICompatAdapters` constructs one adapter per discovered model, so an\n * unbounded list becomes unbounded objects during bootstrap. Aggregators\n * legitimately serve hundreds — models.dev lists 339 for one and 620 for\n * another — so this is a sanity ceiling on adapter construction, not a claim\n * about what a gateway may offer. It is checked AFTER deduplication, the\n * non-chat filter and the operator allowlist (#6600), so a large catalogue is\n * served by allowlisting the models wanted rather than refused.\n */\nconst MAX_DISCOVERED_MODELS = 256;\n\n/** Bound on the discovery call. Bootstrap must not hang on a dead gateway. */\nconst MODEL_DISCOVERY_TIMEOUT_MS = 10_000;\n\n/**\n * Shape of a model id this adapter will dispatch to (#4392 increment 2, step\n * 2). A discovered id becomes a request field, a usage-log key and — through\n * the gateway catalogue — a pricing key, so whitespace and control characters\n * are refused; `/`, `:`, `.` and `_` are kept because aggregators use them\n * (`org/model:tag`). Length is capped at 128.\n */\nconst MODEL_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;\n\n/**\n * Keep the ids that satisfy {@link MODEL_ID_PATTERN}. Warns with the dropped\n * COUNT only — an offending id is exactly the string that must not reach a\n * log line, and the count is what tells an operator the gateway's listing\n * needs a look.\n */\nfunction keepValidModelIds<T extends { readonly id: string }>(\n  models: readonly T[],\n  logger: ILogger | undefined\n): readonly T[] {\n  const kept = models.filter((m) => MODEL_ID_PATTERN.test(m.id));\n  const dropped = models.length - kept.length;\n  if (dropped > 0) {\n    logger?.warn(\n      `Dropped ${String(dropped)} gateway model id(s) that are not a valid model id shape (whitespace, control characters, or over 128 chars)`,\n      { dropped, kept: kept.length }\n    );\n  }\n  return kept;\n}\n\n/**\n * Discover available models by calling `GET {baseUrl}/models` ({baseUrl} ends\n * in `/v1`). Uses the\n * official `openai` SDK's `client.models.list()` so we benefit from its\n * pagination + retry handling. The list is the strongly authoritative\n * source: nexus-agents won't try to dispatch to a model the gateway doesn't\n * expose.\n */\nexport async function discoverModels(\n  config: OpenAICompatConfig,\n  logger?: ILogger\n): Promise<Result<readonly DiscoveredModel[], ConfigError>> {\n  const catalog = await discoverGatewayCatalog(config, logger);\n  return catalog.ok ? ok(catalog.value.models) : catalog;\n}\n\n/**\n * {@link discoverModels} plus the raw listing size (#6609), so `doctor\n * --gateway` can report the count before and after the chat filter from the\n * same call the server makes. `listedCount` is the rows `GET /models`\n * returned, before deduplication, the chat filter and the allowlist; `models`\n * is what {@link discoverModels} returns.\n */\nexport async function discoverGatewayCatalog(\n  config: OpenAICompatConfig,\n  logger?: ILogger\n): Promise<\n  Result<{ readonly listedCount: number; readonly models: readonly DiscoveredModel[] }, ConfigError>\n> {\n  // Reuse the SDK path's DNS-resolve-time SSRF guard (#3426) rather than\n  // growing a second one. This path needs it at least as much: it can read its\n  // base URL from a FILE (`NEXUS_OPENCODE_CONFIG` -> opencode.json), not only\n  // from an env var, so the input is not always direct operator intent.\n  // The guard fails OPEN on transient resolver errors and rejects only a\n  // confirmed private/loopback/link-local resolution.\n  // #6608: the refusal is a typed error so the bootstrap can say which\n  // variable allows it and that the gateway is not in use.\n  const hostCheck = await checkGatewayHost(config.baseUrl);\n  if (hostCheck.state === 'refused_private_host') {\n    return err(new GatewayHostRefusedError(hostCheck));\n  }\n  if (hostCheck.state === 'lookup_timed_out') {\n    // Fail closed for this attempt (#6671 review): a plain ConfigError, so the\n    // bootstrap treats it as retryable and lazy re-discovery tries again.\n    return err(new ConfigError(`${GATEWAY_HOST_LOOKUP_TIMED_OUT} (host ${hostCheck.host})`));\n  }\n  try {\n    const client = new OpenAI({\n      baseURL: config.baseUrl,\n      apiKey: config.apiKey,\n      // Discovery runs during server bootstrap, so an unresponsive gateway must\n      // not stall startup indefinitely. The SDK's own default is far longer.\n      timeout: MODEL_DISCOVERY_TIMEOUT_MS,\n      maxRetries: 1,\n      // Auth header, extra headers and proxy (#6608) — the same options every\n      // per-model adapter gets, so discovery cannot pass where completions fail.\n      ...gatewayClientOptions(config),\n    });\n    const list = await client.models.list();\n    // `listing` is the raw row: gateways add fields beyond the SDK's `Model`\n    // type (`type`, `mode`, `architecture`) that say whether it can chat.\n    const listed = list.data.map((m) => ({ id: m.id, listing: m, model: m }));\n    const allowlist = config.modelAllowlist ?? [];\n    const refined = refineGatewayCatalog(keepValidModelIds(listed, logger), allowlist, logger);\n    if (refined.length > MAX_DISCOVERED_MODELS) {\n      return err(overCapError(config, list.data.length, refined.length, allowlist.length > 0));\n    }\n    return ok({\n      listedCount: list.data.length,\n      models: refined.map(({ model: m }) => ({\n        id: m.id,\n        created: m.created,\n        ownedBy: m.owned_by,\n      })),\n    });\n  } catch (e: unknown) {\n    // This message lands on cli-server-gateway's probe-failed warn line, so it\n    // names the host (a base URL can carry userinfo) and never the key: a\n    // gateway's 401 body may echo the bearer it rejected (#4392 increment 3).\n    return err(\n      new ConfigError(\n        `Failed to discover models from ${hostnameOf(config.baseUrl)}: ` +\n          `${redactApiKey(getErrorMessage(e), config.apiKey)}. ` +\n          `Verify ${OPENAI_COMPAT_URL_ENV} and ${OPENAI_COMPAT_KEY_ENV}, then retry.`\n      )\n    );\n  }\n}\n\n/**\n * The refusal for a catalogue still above the cap after refinement. It names\n * the allowlist variable, which is the operator's way through (#6600).\n */\nfunction overCapError(\n  config: OpenAICompatConfig,\n  listed: number,\n  refined: number,\n  allowlisted: boolean\n): ConfigError {\n  const cap = String(MAX_DISCOVERED_MODELS);\n  const host = hostnameOf(config.baseUrl);\n  const detail = allowlisted\n    ? `${OPENAI_COMPAT_MODELS_ENV} matched ${String(refined)} of its ${String(listed)} listed models`\n    : `it listed ${String(listed)} models (${String(refined)} chat models)`;\n  return new ConfigError(\n    `Gateway ${host}: ${detail}, above the ${cap} cap. Refusing to build an adapter per model. ` +\n      `Set ${OPENAI_COMPAT_MODELS_ENV} to a comma-separated allowlist of model ids ` +\n      `(\\`*\\` is a wildcard) naming at most ${cap} models.`\n  );\n}\n\n/**\n * Create an OpenAIAdapter pointed at the gateway for a specific model ID,\n * wrapped with usage recording so every completion appends a UsageEvent\n * to the JSONL log consumed by `nexus-agents usage`.\n *\n * The wrapper is transparent — same IModelAdapter contract, same fields,\n * same error handling — plus the {@link GatewayModelAdapter} arm marker,\n * `api:<config.endpoint>` (the default endpoint when a hand-built config\n * omits it, matching registration). Recording is best-effort (telemetry\n * never fails the user's call).\n *\n * When invoked via MCP, the host harness's model identifier is passed\n * through verbatim — nexus-agents doesn't second-guess what the host is\n * already routing.\n */\nexport function createOpenAICompatAdapter(\n  modelId: string,\n  config: OpenAICompatConfig,\n  created?: number\n): GatewayModelAdapter {\n  // Verbatim: the id goes to the gateway exactly as it listed it. The direct\n  // adapter's alias table (`gpt-4o` -> a dated snapshot) names models the\n  // gateway may not serve, and would make `NEXUS_VOTER_MODEL_*` pins miss\n  // (#6605).\n  const inner = new OpenAIAdapter({\n    modelId,\n    apiKey: config.apiKey,\n    baseUrl: config.baseUrl,\n    verbatimModelId: true,\n    ...gatewayClientOptions(config),\n  });\n  const wrapped = withUsageRecording(\n    inner,\n    `api:${config.endpoint ?? DEFAULT_OPENAI_COMPAT_ENDPOINT}`\n  );\n  return created === undefined ? wrapped : Object.assign(wrapped, { created });\n}\n\n/**\n * Wrap a gateway model adapter so that successful + failed `complete()`\n * calls append a UsageEvent to the on-disk usage log. Stream calls aren't\n * yet instrumented (a future PR can add streaming-aware recording).\n *\n * The returned object preserves the IModelAdapter contract identically;\n * downstream code can't tell the difference except that one extra JSONL\n * line gets written per call. The line is priced by `gatewayArm`'s\n * `NEXUS_GATEWAY_COST` declaration ({@link gatewayCostDetail}, #4392 step 4):\n * an undeclared gateway records `priced: false`, never the model id's vendor\n * list price.\n */\nfunction withUsageRecording(inner: IModelAdapter, gatewayArm: EndpointArmId): GatewayModelAdapter {\n  const wrapped: GatewayModelAdapter = {\n    gatewayArm,\n    providerId: inner.providerId,\n    modelId: inner.modelId,\n    capabilities: inner.capabilities,\n    countTokens: (text) => inner.countTokens(text),\n    validateConfig: () => inner.validateConfig(),\n    stream: (request) => inner.stream(request),\n    async complete(request: CompletionRequest): Promise<Result<CompletionResponse, ModelError>> {\n      const start = getTimeProvider().now();\n      const result = await inner.complete(request);\n      const latencyMs = getTimeProvider().now() - start;\n      try {\n        if (result.ok) {\n          const u = result.value.usage;\n          // No vendor usage ⇒ nothing to record. Zero-filling here would write\n          // a fabricated measurement into the usage log, which is the defect\n          // #4439 exists to remove — a lost latency datapoint is the cheaper\n          // loss than a false token count.\n          if (u === undefined) return result;\n          // Declaration-first pricing with provenance (#4165, #4392 step 4):\n          // `priced: false` marks the $0 as UNPRICED (unmeasured), not a real $0.\n          const cost = gatewayCostDetail(gatewayArm, inner.modelId, u.inputTokens, u.outputTokens);\n          recordUsageEvent({\n            timestamp: new Date().toISOString(),\n            modelId: inner.modelId,\n            providerId: inner.providerId,\n            inputTokens: u.inputTokens,\n            outputTokens: u.outputTokens,\n            usdCost: cost.costUsd,\n            latencyMs,\n            success: true,\n            priced: cost.priced,\n            ...(cost.priced ? { priceSource: cost.resolvedId } : {}),\n          });\n        } else {\n          recordFailedCall(inner, latencyMs, result.error.code);\n        }\n      } catch {\n        // Telemetry must not break user calls.\n      }\n      return result;\n    },\n  };\n  attachListModels(wrapped, inner);\n  return wrapped;\n}\n\n/** The usage line for a failed call: no tokens, no cost — the error code is the datum. */\nfunction recordFailedCall(inner: IModelAdapter, latencyMs: number, errorCode: string): void {\n  recordUsageEvent({\n    timestamp: new Date().toISOString(),\n    modelId: inner.modelId,\n    providerId: inner.providerId,\n    inputTokens: 0,\n    outputTokens: 0,\n    usdCost: 0,\n    latencyMs,\n    success: false,\n    errorCode,\n  });\n}\n\n/**\n * (#2540) Forward `listModels` through the wrapper when the inner adapter\n * exposes one. Only attach when defined so the wrapper's `listModels?:`\n * hint stays accurate for the resolver. The inner reference is captured\n * by closure so the forwarded call binds `this` to the inner adapter.\n */\nfunction attachListModels(wrapped: IModelAdapter, inner: IModelAdapter): void {\n  const list = inner.listModels?.bind(inner);\n  if (list === undefined) return;\n  wrapped.listModels = (): Promise<readonly ModelMetadata[]> => list();\n}\n\n/**\n * Convenience: read env, discover, return adapter instances for every\n * discovered model. Returns `null` (not an error) when env vars aren't set\n * — the caller treats unset gateway as \"no adapter from this source.\"\n *\n * Use case: the unified registry / factory calls this at startup; if the\n * operator has configured a gateway, every discovered model becomes a\n * dispatch target alongside the existing claude/codex/gemini/opencode\n * adapter slots.\n */\nexport async function buildOpenAICompatAdapters(\n  logger?: ILogger\n): Promise<Result<readonly IModelAdapter[], ConfigError> | null> {\n  const config = readOpenAICompatEnv();\n  if (config === null) return null;\n  const discovered = await discoverModels(config, logger);\n  if (!discovered.ok) return discovered;\n  return ok(discovered.value.map((m) => createOpenAICompatAdapter(m.id, config, m.created)));\n}\n","/**\n * Whether the private-address guard lets the gateway's host through (#6608\n * item 3), as a value a report surface can read.\n *\n * A corporate gateway commonly resolves to a 10.x address, which the SSRF\n * guard refuses unless `NEXUS_CUSTOM_API_ALLOW_PRIVATE=1`. Outside a sandbox\n * that used to surface as a generic \"probe failed\" warn line while the server\n * quietly fell back to CLI subprocesses. {@link checkGatewayHost} is the one\n * place the refusal and its remedy are phrased; discovery refuses with\n * {@link GatewayHostRefusedError}, the bootstrap reports it by name, and\n * `doctor` can call {@link checkGatewayHost} directly (#6609).\n *\n * @module adapters/gateway-host-status\n */\n\nimport { ConfigError } from '../core/index.js';\nimport { assertCustomApiHostResolvesPublic } from './sdk/custom-api-validation.js';\nimport { hostnameOf } from './sdk/gateway-env.js';\nimport { CUSTOM_API_ALLOW_PRIVATE_ENV } from './sdk/types.js';\n\n/** The guard refused the host: the gateway is not used. */\nexport interface GatewayHostRefused {\n  readonly state: 'refused_private_host';\n  readonly host: string;\n  /** The guard's classification (private, loopback, link-local, …). */\n  readonly reason: string;\n  /** What the operator sets to allow it; names the variable. */\n  readonly remedy: string;\n}\n\nexport type GatewayHostStatus =\n  | { readonly state: 'allowed'; readonly host: string }\n  | GatewayHostRefused\n  /**\n   * The guard's lookup did not answer in time. Unlike a DNS error (the\n   * connection could not resolve either), the connection's own lookup may\n   * still answer, with a private address, so the host is NOT allowed. Not a\n   * refusal: the next attempt runs the guard again.\n   */\n  | { readonly state: 'lookup_timed_out'; readonly host: string };\n\n/** The message discovery fails with on `lookup_timed_out`; lazy re-discovery retries it. */\nexport const GATEWAY_HOST_LOOKUP_TIMED_OUT =\n  'gateway host check timed out; the gateway is not wired this attempt, will retry';\n\nconst REMEDY =\n  `Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 if the gateway runs on a trusted internal host, ` +\n  'then restart the server.';\n\n/**\n * Run the private-address guard against `baseUrl`'s host. The guard fails\n * OPEN on a DNS error (a flaky resolver must not break a legitimate gateway),\n * so `allowed` means \"not refused\", not \"reachable\". It fails CLOSED on a\n * lookup that does not answer within the bound: `lookup_timed_out`.\n */\nexport async function checkGatewayHost(\n  baseUrl: string,\n  options: { readonly lookupTimeoutMs?: number } = {}\n): Promise<GatewayHostStatus> {\n  const host = hostnameOf(baseUrl);\n  const guard = await withLookupTimeout(\n    assertCustomApiHostResolvesPublic(host),\n    options.lookupTimeoutMs ?? GATEWAY_HOST_LOOKUP_TIMEOUT_MS\n  );\n  if (guard === 'timed_out') return { state: 'lookup_timed_out', host };\n  if (guard.ok) return { state: 'allowed', host };\n  return { state: 'refused_private_host', host, reason: guard.error.message, remedy: REMEDY };\n}\n\n/**\n * Upper bound on the guard's DNS lookup (#6671 review). `dns.lookup` has no\n * timeout of its own, and discovery (at boot and on lazy re-discovery) runs\n * the guard before its bounded HTTP request, so an unresponsive resolver\n * would otherwise hold discovery open indefinitely.\n */\nconst GATEWAY_HOST_LOOKUP_TIMEOUT_MS = 5_000;\n\nasync function withLookupTimeout<T>(work: Promise<T>, ms: number): Promise<T | 'timed_out'> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<'timed_out'>((resolve) => {\n    timer = setTimeout(() => {\n      resolve('timed_out');\n    }, ms);\n    timer.unref();\n  });\n  try {\n    return await Promise.race([work, timeout]);\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/** Discovery's refusal when {@link checkGatewayHost} says `refused_private_host`. */\nexport class GatewayHostRefusedError extends ConfigError {\n  readonly status: GatewayHostRefused;\n\n  constructor(status: GatewayHostRefused) {\n    super(`Gateway URL rejected: ${status.reason}`);\n    this.name = 'GatewayHostRefusedError';\n    this.status = status;\n  }\n}\n","/**\n * nexus-agents/adapters - OpenAI Model Adapter\n *\n * Adapter for OpenAI models (GPT-4o, GPT-4-turbo, GPT-3.5-turbo).\n * Implements the IModelAdapter interface with streaming support, rate limiting,\n * and proper error handling.\n *\n * Verified 2026-01-03: openai@6.15.0 is current stable\n * (Source: npm registry)\n */\n\nimport OpenAI, { APIError } from 'openai';\nimport type { ChatCompletionMessageParam, ChatCompletion } from 'openai/resources/chat/completions';\nimport type {\n  Result,\n  CompletionRequest,\n  CompletionResponse,\n  ModelMetadata,\n  StreamChunk,\n  TokenUsage,\n} from '../core/index.js';\nimport { ok, err, ModelError, ConfigError, ErrorCode, getTokenEstimator } from '../core/index.js';\nimport {\n  BaseAdapter,\n  type BaseAdapterConfig,\n  requireApiKey,\n  validateApiKeyPresence,\n} from './base-adapter.js';\nimport { createStream } from './streaming.js';\nimport {\n  DEFAULT_MAX_TOKENS,\n  resolveModelId,\n  getModelCapabilities,\n  type OpenAIAdapterConfig,\n} from './openai-types.js';\nimport { planOptionalParams, type DroppedParam } from './optional-params.js';\nimport { getMaxTokensParamForModel } from '../config/model-parameter-support.js';\nimport {\n  mapMessage,\n  mapTool,\n  mapStopReason,\n  mapChoiceToContentBlocks,\n  mapResponseUsage,\n  mapStreamChunk,\n  createStreamToolCallState,\n  detectNonAnswer,\n  CONTENT_FILTERED,\n  type NonAnswer,\n} from './openai-mappers.js';\nimport { sanitizeErrorDetails } from '../security/output-sanitizer.js';\n\n// Re-export types and constants for public API\nexport { OPENAI_MODELS, OPENAI_MODEL_ALIASES, type OpenAIAdapterConfig } from './openai-types.js';\n\n/**\n * OpenAI model adapter.\n *\n * Provides a unified interface for interacting with OpenAI's GPT models.\n * Supports completion, streaming, tool use, and vision capabilities.\n *\n * @example\n * ```typescript\n * const adapter = new OpenAIAdapter({\n *   modelId: 'gpt-4o',\n *   apiKey: process.env.OPENAI_API_KEY,\n * });\n *\n * const result = await adapter.complete({\n *   messages: [{ role: 'user', content: 'Hello!' }],\n *   maxTokens: 1024,\n * });\n *\n * if (result.ok) {\n *   console.log(result.value.content);\n * }\n * ```\n */\n\n/**\n * Compose a diagnostic string from an OpenAI SDK `APIError`'s real fields\n * (#4047). The SDK's `.message` alone can be as useless as\n * `\"400 status code (no body)\"` for an OpenAI-compatible gateway; this pulls the\n * HTTP status, structured error fields, and the raw body so the actual rejection\n * reason is visible.\n */\n/** Typed structural view of the OpenAI SDK `APIError` fields we read (the SDK's\n * generic `APIError<any,…>` otherwise leaks `any`). */\ninterface ApiErrorView {\n  readonly status?: number | null;\n  readonly type?: string | null;\n  readonly code?: string | null;\n  readonly param?: string | null;\n  readonly requestID?: string | null;\n  readonly error?: unknown;\n  readonly message?: string;\n}\n\n/** `key=value` tag, or `''` when the value is absent. */\nfunction kvTag(key: string, val: string | number | null | undefined): string {\n  return val === null || val === undefined || val === '' ? '' : `${key}=${String(val)}`;\n}\n\nfunction describeOpenAIApiError(v: ApiErrorView, apiKey?: string): string {\n  const tags = [\n    `HTTP ${String(v.status ?? 'unknown')}`,\n    kvTag('type', v.type),\n    kvTag('code', v.code),\n    kvTag('param', v.param),\n    kvTag('request_id', v.requestID),\n  ].filter((t) => t !== '');\n  let body = '';\n  if (v.error !== undefined && v.error !== null) {\n    try {\n      const raw = JSON.stringify(v.error);\n      body = ` body=${raw.length > MAX_ERROR_BODY_CHARS ? `${raw.slice(0, MAX_ERROR_BODY_CHARS)}…` : raw}`;\n    } catch {\n      body = ' body=<unserializable>';\n    }\n  }\n  return sanitizeErrorDetails(`${tags.join(' ')}: ${v.message ?? ''}${body}`, apiKey);\n}\n\n/** Cap the surfaced gateway error body so a huge response can't bloat logs/messages. */\nconst MAX_ERROR_BODY_CHARS = 600;\n\nexport class OpenAIAdapter extends BaseAdapter {\n  private readonly client: OpenAI;\n  private readonly resolvedModelId: string;\n  private readonly apiKey: string | undefined;\n\n  /**\n   * Creates a new OpenAIAdapter instance.\n   *\n   * @param config - OpenAI adapter configuration\n   * @throws {ConfigError} If API key is missing\n   */\n  constructor(config: OpenAIAdapterConfig) {\n    const resolvedModelId =\n      config.verbatimModelId === true ? config.modelId : resolveModelId(config.modelId);\n\n    // Build baseConfig conditionally to satisfy exactOptionalPropertyTypes\n    const baseConfig: BaseAdapterConfig = {\n      providerId: 'openai',\n      modelId: resolvedModelId,\n      capabilities: getModelCapabilities(config.modelId),\n      apiKey: config.apiKey,\n    };\n\n    // Only set optional properties if defined\n    if (config.baseUrl !== undefined) {\n      baseConfig.baseUrl = config.baseUrl;\n    }\n    if (config.timeout !== undefined) {\n      baseConfig.timeout = config.timeout;\n    }\n    if (config.maxRetries !== undefined) {\n      baseConfig.maxRetries = config.maxRetries;\n    }\n\n    super(baseConfig);\n\n    this.apiKey = config.apiKey;\n    this.resolvedModelId = resolvedModelId;\n\n    // Validate API key presence\n    requireApiKey(config.apiKey, 'OpenAI', config.modelId);\n\n    this.client = this.createClient(config);\n  }\n\n  /**\n   * Creates the OpenAI client with configuration.\n   */\n  private createClient(config: OpenAIAdapterConfig): OpenAI {\n    const clientOptions: ConstructorParameters<typeof OpenAI>[0] = {\n      apiKey: config.apiKey,\n      maxRetries: config.maxRetries ?? 2,\n    };\n\n    if (config.baseUrl !== undefined) {\n      clientOptions.baseURL = config.baseUrl;\n    }\n    if (config.timeout !== undefined) {\n      clientOptions.timeout = config.timeout;\n    }\n    if (config.organization !== undefined) {\n      clientOptions.organization = config.organization;\n    }\n    if (config.defaultHeaders !== undefined) {\n      clientOptions.defaultHeaders = config.defaultHeaders;\n    }\n    if (config.fetchOptions !== undefined) {\n      clientOptions.fetchOptions = config.fetchOptions;\n    }\n\n    return new OpenAI(clientOptions);\n  }\n\n  /**\n   * Validates adapter configuration.\n   * Extends base validation with OpenAI-specific checks.\n   */\n  override validateConfig(): Result<void, ConfigError> {\n    const baseResult = super.validateConfig();\n    if (!baseResult.ok) {\n      return baseResult;\n    }\n\n    // Validate API key is present\n    const keyResult = validateApiKeyPresence(this.config.apiKey, this.providerId, this.modelId);\n    if (!keyResult.ok) return keyResult;\n\n    return ok(undefined);\n  }\n\n  /**\n   * Send a completion request to OpenAI.\n   *\n   * @param request - The completion request\n   * @returns Result with response or ModelError\n   */\n  async complete(request: CompletionRequest): Promise<Result<CompletionResponse, ModelError>> {\n    this.logRequest(request);\n\n    try {\n      const response = await this.executeCompletion(request);\n      this.logResponse(response);\n      return ok(response);\n    } catch (error) {\n      return err(this.transformError(error));\n    }\n  }\n\n  /**\n   * Surface an OpenAI / OpenAI-compatible gateway's REAL HTTP status + response\n   * body in the error (#4047). The OpenAI SDK's default message collapses a\n   * gateway rejection to e.g. `\"400 status code (no body)\"`, which hides WHY a\n   * litellm-style gateway rejected a request — exactly the wall hit when\n   * diagnosing degraded voter panels on a custom gateway. We re-message with the\n   * status/type/code/param/request-id/body. Error-code routing is unchanged: we\n   * classify on the ORIGINAL signal (`status`/`code`/`message`) via a clean probe\n   * error, so the diagnostic `request_id`/`body` can't pollute the message-\n   * substring classifier, then re-message the result with the full detail.\n   * Applies to direct OpenAI and the compat gateway alike.\n   */\n  protected override transformError(error: unknown): ModelError {\n    if (error instanceof APIError) {\n      const v = error as ApiErrorView;\n      // Classify on the original SDK message + status/code/param only. #4069: thread\n      // `param` so a param-naming 400 classifies as MODEL_PARAMETER_UNSUPPORTED and\n      // the param name reaches the error context.\n      const probe: Error & {\n        status?: number | undefined;\n        code?: string | null | undefined;\n        param?: string | undefined;\n      } = new Error(typeof v.message === 'string' ? v.message : '');\n      probe.status = typeof v.status === 'number' ? v.status : undefined;\n      probe.code = v.code ?? undefined;\n      probe.param = typeof v.param === 'string' && v.param !== '' ? v.param : undefined;\n      probe.cause = error;\n      const classified = super.transformError(probe);\n      // Surface the full diagnostic detail in the final message (code/cause kept).\n      classified.message = `${this.providerId}/${this.modelId}: ${describeOpenAIApiError(v, this.apiKey)}`;\n      return classified;\n    }\n    const err = super.transformError(error);\n    err.message = sanitizeErrorDetails(err.message, this.apiKey);\n    return err;\n  }\n\n  /**\n   * Stream a completion request from OpenAI.\n   *\n   * @param request - The completion request\n   * @yields StreamChunk objects as they arrive\n   */\n  async *stream(request: CompletionRequest): AsyncIterable<StreamChunk> {\n    this.logRequest(request);\n\n    const [controller, iterable] = createStream<StreamChunk>();\n\n    // Start streaming in the background\n    this.executeStream(request, controller).catch((error: unknown) => {\n      const modelError = this.transformError(error);\n      controller.error(modelError);\n    });\n\n    yield* iterable;\n  }\n\n  /**\n   * Count tokens in text using OpenAI-specific estimation.\n   *\n   * @param text - Text to count tokens for\n   * @returns Approximate token count\n   */\n  override countTokens(text: string): Promise<number> {\n    // Use unified TokenEstimator with OpenAI-specific ratio (~4 chars/token)\n    return Promise.resolve(getTokenEstimator().estimateText(text, 'openai'));\n  }\n\n  /**\n   * Executes the completion request against the OpenAI API.\n   */\n  private async executeCompletion(request: CompletionRequest): Promise<CompletionResponse> {\n    const { params, dropped } = this.buildRequestParams(request);\n    // #3036: forward AbortSignal into the OpenAI SDK so withWatchdog\n    // timeouts cancel the HTTP request instead of leaking it past the\n    // Promise.race boundary. Branch on signal presence — vitest 4\n    // toHaveBeenCalledWith treats `(params, undefined)` as a distinct\n    // call shape from `(params)`.\n    const response =\n      request.signal !== undefined\n        ? await this.client.chat.completions.create(params, { signal: request.signal })\n        : await this.client.chat.completions.create(params);\n    // #4069: surface params dropped by the seam (e.g. temperature) as warnings.\n    return this.mapResponse(response, dropped);\n  }\n\n  /**\n   * Executes streaming completion and pushes chunks to the controller.\n   */\n  private async executeStream(\n    request: CompletionRequest,\n    controller: {\n      push: (chunk: StreamChunk) => Result<void, Error>;\n      complete: () => void;\n      error: (error: Error) => void;\n    }\n  ): Promise<void> {\n    try {\n      const { params } = this.buildRequestParams(request);\n      const stream = await this.client.chat.completions.create({ ...params, stream: true });\n\n      let contentIndex = 0;\n      let hasStarted = false;\n      const toolCalls = createStreamToolCallState();\n\n      for await (const chunk of stream) {\n        // #6607: a filtered stream is a refusal. Error the stream instead of\n        // finishing it normally over whatever partial text arrived.\n        if (chunk.choices[0]?.finish_reason === 'content_filter') {\n          throw nonAnswerError(`${this.providerId}/${this.modelId}`, CONTENT_FILTERED, chunk.model);\n        }\n        const mappedChunks = mapStreamChunk(chunk, contentIndex, hasStarted, toolCalls);\n\n        for (const mappedChunk of mappedChunks) {\n          if (mappedChunk.type === 'message_start') {\n            hasStarted = true;\n          }\n          if (mappedChunk.type === 'content_block_start') {\n            contentIndex++;\n          }\n          controller.push(mappedChunk);\n        }\n      }\n\n      controller.complete();\n    } catch (error) {\n      const modelError = this.transformError(error);\n      controller.error(modelError);\n    }\n  }\n\n  /**\n   * Builds OpenAI API request parameters from our CompletionRequest.\n   */\n  private buildRequestParams(request: CompletionRequest): {\n    params: OpenAI.Chat.ChatCompletionCreateParamsNonStreaming;\n    dropped: readonly DroppedParam[];\n  } {\n    const messages = this.buildMessages(request);\n\n    const params: OpenAI.Chat.ChatCompletionCreateParamsNonStreaming = {\n      model: this.resolvedModelId,\n      messages,\n      max_completion_tokens: request.maxTokens ?? this.defaultMaxCompletionTokens(),\n    };\n\n    const dropped = this.addOptionalParams(params, request);\n    return { params, dropped };\n  }\n\n  /**\n   * Builds the messages array for the request.\n   */\n  private buildMessages(request: CompletionRequest): ChatCompletionMessageParam[] {\n    const messages: ChatCompletionMessageParam[] = [];\n\n    // Add system prompt if provided explicitly\n    if (request.systemPrompt !== undefined && request.systemPrompt !== '') {\n      messages.push({ role: 'system', content: request.systemPrompt });\n    }\n\n    // Map and add all messages (filtering out system if already added via systemPrompt)\n    for (const msg of request.messages) {\n      if (msg.role === 'system' && request.systemPrompt !== undefined) {\n        continue;\n      }\n      messages.push(...mapMessage(msg));\n    }\n\n    return messages;\n  }\n\n  /**\n   * Adds optional parameters to the request.\n   */\n  private addOptionalParams(\n    params: OpenAI.Chat.ChatCompletionCreateParamsNonStreaming,\n    request: CompletionRequest\n  ): readonly DroppedParam[] {\n    // #4068: the temperature drop-decision (#4061: a gateway routing to a Claude\n    // model after Opus 4.6, or an OpenAI reasoning model, rejects a non-1.0\n    // temperature with a 400; omit it so a gateway-routed voter panel at the\n    // default 0.3 does not 400) is centralized in the shared planOptionalParams\n    // seam. NOTE: a gateway that injects its OWN default when the field is absent\n    // is outside our control — our contract is only to not SEND a rejected value.\n    const plan = planOptionalParams(request, this.resolvedModelId);\n    if (plan.temperature !== undefined) {\n      params.temperature = plan.temperature;\n    }\n\n    if (request.stop !== undefined && request.stop.length > 0) {\n      params.stop = request.stop;\n    }\n\n    if (request.tools !== undefined && request.tools.length > 0) {\n      params.tools = request.tools.map(mapTool);\n    }\n\n    this.addResponseFormat(params, request);\n\n    // #4069: report dropped params so mapResponse can surface them as warnings.\n    return plan.dropped;\n  }\n\n  /**\n   * Adds response format to the request if specified.\n   */\n  private addResponseFormat(\n    params: OpenAI.Chat.ChatCompletionCreateParamsNonStreaming,\n    request: CompletionRequest\n  ): void {\n    if (request.responseFormat === undefined) {\n      return;\n    }\n\n    if (request.responseFormat.type === 'json_object') {\n      params.response_format = { type: 'json_object' };\n    } else if (request.responseFormat.type === 'json_schema') {\n      params.response_format = {\n        type: 'json_schema',\n        json_schema: {\n          name: 'response',\n          schema: request.responseFormat.schema,\n        },\n      };\n    }\n  }\n\n  /**\n   * Maps OpenAI API response to our CompletionResponse format.\n   */\n  private mapResponse(\n    response: ChatCompletion,\n    dropped: readonly DroppedParam[] = []\n  ): CompletionResponse {\n    // #6607: a refusal, an empty `choices` array or a reasoning-exhausted reply\n    // is not an answer. Consumers (voters, experts, orchestrate) read any mapped\n    // response as one and never branch on `stopReason`, so the only signal they\n    // honour is an error.\n    const firstChoice = response.choices[0];\n    if (firstChoice === undefined) {\n      throw nonAnswerError(\n        `${this.providerId}/${this.modelId}`,\n        { reason: 'no_choices', detail: 'the response contained no choices' },\n        response.model\n      );\n    }\n    const nonAnswer = detectNonAnswer(firstChoice, response.usage, this.isReasoningFamily());\n    if (nonAnswer !== undefined)\n      throw nonAnswerError(`${this.providerId}/${this.modelId}`, nonAnswer, response.model);\n\n    const content = mapChoiceToContentBlocks(firstChoice);\n    const usage: TokenUsage | undefined = mapResponseUsage(response);\n\n    return {\n      content,\n      ...(usage !== undefined ? { usage } : {}),\n      stopReason: mapStopReason(firstChoice.finish_reason),\n      model: response.model,\n      // #4069: surface dropped params (e.g. an omitted temperature). Omitted\n      // entirely when nothing was dropped (exactOptionalPropertyTypes).\n      ...(dropped.length > 0 ? { warnings: dropped } : {}),\n    };\n  }\n\n  /**\n   * Reasoning families are the models that take `max_completion_tokens`\n   * (o-series, gpt-5, codex); the registry answers first, a regex second.\n   */\n  private isReasoningFamily(): boolean {\n    return getMaxTokensParamForModel(this.resolvedModelId) === 'max_completion_tokens';\n  }\n\n  /**\n   * Default completion cap when the request sets none (#6607). On a reasoning\n   * model the cap covers hidden reasoning tokens AND the visible reply, and\n   * 4,096 can be spent entirely on reasoning, leaving an empty reply. OpenAI's\n   * reasoning guide recommends reserving at least 25,000 tokens for reasoning\n   * and output when starting out, so that is the reasoning default. It is a\n   * ceiling, not a spend: a reply that finishes early is billed for what it\n   * used. Other models keep `DEFAULT_MAX_TOKENS`.\n   */\n  private defaultMaxCompletionTokens(): number {\n    return this.isReasoningFamily() ? REASONING_DEFAULT_MAX_COMPLETION_TOKENS : DEFAULT_MAX_TOKENS;\n  }\n\n  /**\n   * (#2529) List models served by this OpenAI-compatible endpoint.\n   *\n   * Wraps `GET /v1/models`. Result is cached for `LIST_MODELS_TTL_MS`\n   * so identity resolution doesn't round-trip on every adapter.\n   * Concurrent callers share the in-flight promise.\n   *\n   * Throws on non-2xx so the harness-side identity resolver knows to\n   * fall back to modelId parsing — silent empty-list returns would be\n   * indistinguishable from \"this gateway has no models\", which a\n   * misconfigured endpoint shouldn't be allowed to claim.\n   */\n  async listModels(): Promise<readonly ModelMetadata[]> {\n    const now = Date.now();\n    if (this.modelsCache !== null && now - this.modelsCache.fetchedAt < LIST_MODELS_TTL_MS) {\n      return this.modelsCache.value;\n    }\n    if (this.modelsInFlight !== null) {\n      return this.modelsInFlight;\n    }\n    const inFlight = this.fetchModels();\n    this.modelsInFlight = inFlight;\n    try {\n      const value = await inFlight;\n      this.modelsCache = { value, fetchedAt: Date.now() };\n      return value;\n    } finally {\n      this.modelsInFlight = null;\n    }\n  }\n\n  private modelsCache: { value: readonly ModelMetadata[]; fetchedAt: number } | null = null;\n  private modelsInFlight: Promise<readonly ModelMetadata[]> | null = null;\n\n  private async fetchModels(): Promise<readonly ModelMetadata[]> {\n    const list = await this.client.models.list();\n    return list.data.map((m): ModelMetadata => {\n      const meta: ModelMetadata = { id: m.id };\n      if (typeof m.owned_by === 'string') {\n        return { ...meta, ownedBy: m.owned_by, createdAt: m.created };\n      }\n      if (typeof m.created === 'number') {\n        return { ...meta, createdAt: m.created };\n      }\n      return meta;\n    });\n  }\n}\n\nconst LIST_MODELS_TTL_MS = 5 * 60 * 1000;\n\n/** See `defaultMaxCompletionTokens` for why 25,000 (#6607). */\nconst REASONING_DEFAULT_MAX_COMPLETION_TOKENS = 25_000;\n\n/**\n * A non-answer as a non-retryable `MODEL_ERROR` (#6607). `context.reason`\n * names which kind it was, so telemetry can tell a refusal from a\n * reasoning-exhausted budget. `source` is `provider/model`.\n *\n * Module-level rather than a private method: the API-surface snapshot follows\n * types named anywhere in an exported class, private members included.\n */\nfunction nonAnswerError(source: string, nonAnswer: NonAnswer, servedModel?: string): ModelError {\n  return new ModelError(`${source}: ${nonAnswer.detail}`, {\n    code: ErrorCode.MODEL_ERROR,\n    context: {\n      reason: nonAnswer.reason,\n      ...(servedModel !== undefined ? { servedModel } : {}),\n      ...(nonAnswer.reasoningTokens !== undefined\n        ? { reasoningTokens: nonAnswer.reasoningTokens }\n        : {}),\n    },\n  });\n}\n\n/**\n * Creates an OpenAIAdapter with the specified configuration.\n * Factory function for cleaner API.\n *\n * @param config - OpenAI adapter configuration\n * @returns A configured OpenAIAdapter instance\n *\n * @example\n * ```typescript\n * const adapter = createOpenAIAdapter({\n *   modelId: 'gpt-4o',\n *   apiKey: process.env.OPENAI_API_KEY!,\n * });\n * ```\n */\nexport function createOpenAIAdapter(config: OpenAIAdapterConfig): OpenAIAdapter {\n  return new OpenAIAdapter(config);\n}\n","/**\n * nexus-agents/adapters - OpenAI Type Helpers\n *\n * Type definitions and constants for the OpenAI direct-API SDK adapter.\n *\n * **Architectural boundary (#2200 Child 3):** these constants do NOT live\n * in `config/in-tree-data.ts`. The canonical registry's `cliName`\n * dimension targets CLI tools (`claude` / `gemini` / `codex` / `opencode`)\n * — there is no `openai` CLI binary. Adding `'openai'` to the CLI_NAMES\n * enum would force a fifth case in 4+ exhaustive switches across the\n * codebase, violating the semantic of \"CLI tool name.\"\n *\n * The OpenAI direct adapter is conceptually different from CLI adapters:\n * it talks to the OpenAI HTTPS API directly, not via a subprocess CLI.\n * Its model identifiers are OpenAI's own (`gpt-4o-2024-11-20`,\n * `gpt-3.5-turbo-0125`, etc.) — these are upstream API constants, not\n * versions WE chose. They drift only when OpenAI ships new dated releases.\n *\n * This file is the single source of truth for OpenAI direct-API model\n * identifiers. The model-string drift fitness-guard (#2199) treats it as\n * a documented architectural exception in the allowlist.\n */\n\nimport type { ModelCapability } from '../core/index.js';\nimport { ModelCapability as MC } from '../core/index.js';\nimport { getCliModelName } from '../config/model-config-helpers.js';\n\n/**\n * Supported OpenAI direct-API model identifiers (OpenAI's own dated names).\n *\n * GPT_5_2_CODEX derives from the canonical registry (codex-5.2's cliModelName)\n * because it overlaps with the Codex CLI; the rest are pure-API constants.\n * Since #5091 that entry has been repointed to whatever slug codex serves\n * (`gpt-5.6-luna` as of 2026-09-23), so the key's name lags its value; renaming\n * the key is a public-API change and is tracked separately.\n */\nexport const OPENAI_MODELS = {\n  GPT_5_2: 'gpt-5.2',\n  GPT_5_2_INSTANT: 'gpt-5.2-chat-latest',\n  GPT_5_2_PRO: 'gpt-5.2-pro',\n  /**\n   * Registry-derived: resolves to `codex-5.2`'s `cliModelName`, which since\n   * 2026-09-23 is `gpt-5.6-luna`, not a \"5.2\" model. The key name lags its\n   * value; renaming it is a public-API change tracked in #5489.\n   */\n  GPT_5_2_CODEX: getCliModelName('codex-5.2'),\n  GPT_4O: 'gpt-4o-2024-11-20',\n  GPT_4O_MINI: 'gpt-4o-mini-2024-07-18',\n  GPT_4_TURBO: 'gpt-4-turbo-2024-04-09',\n  GPT_35_TURBO: 'gpt-3.5-turbo-0125',\n} as const;\n\n/**\n * User-friendly OpenAI aliases → dated model identifiers.\n *\n * Identity-only mappings (e.g., `'gpt-5.2-pro' → 'gpt-5.2-pro'`) were\n * removed in #2200 Child 3 — `resolveModelId` already passes unknown ids\n * through unchanged via `?? modelId`. Only entries that translate a\n * shorthand into a dated version remain.\n */\nexport const OPENAI_MODEL_ALIASES: Record<string, string> = {\n  'gpt-5.2-instant': OPENAI_MODELS.GPT_5_2_INSTANT,\n  'gpt-4o': OPENAI_MODELS.GPT_4O,\n  'gpt-4o-mini': OPENAI_MODELS.GPT_4O_MINI,\n  'gpt-4-turbo': OPENAI_MODELS.GPT_4_TURBO,\n  'gpt-3.5-turbo': OPENAI_MODELS.GPT_35_TURBO,\n} as const;\n\n/**\n * Configuration specific to OpenAIAdapter.\n */\nexport interface OpenAIAdapterConfig {\n  /** Model ID (e.g., 'gpt-4o' or full model identifier) */\n  modelId: string;\n  /** API key for OpenAI API (required) */\n  apiKey: string;\n  /** Base URL for API (optional, defaults to OpenAI's API) */\n  baseUrl?: string;\n  /** Request timeout in milliseconds (optional) */\n  timeout?: number;\n  /** Maximum retries for failed requests (optional) */\n  maxRetries?: number;\n  /** Organization ID (optional) */\n  organization?: string;\n  /**\n   * Send `modelId` exactly as given, skipping {@link OPENAI_MODEL_ALIASES}\n   * (#6605). Set by the OpenAI-compatible gateway path, whose ids come from\n   * the gateway's own listing: rewriting `gpt-4o` to a dated OpenAI snapshot\n   * names a model that gateway may not serve. Default `false`.\n   */\n  verbatimModelId?: boolean;\n  /**\n   * Headers sent on every request; a `null` value removes a default header\n   * (`Authorization: null` drops the bearer). Set by the OpenAI-compatible\n   * gateway path for a custom auth header and extra static headers (#6608).\n   */\n  defaultHeaders?: Readonly<Record<string, string | null>>;\n  /**\n   * `fetch` options for every request — the gateway path sets a proxy\n   * `dispatcher` here when `HTTPS_PROXY` / `HTTP_PROXY` applies (#6608).\n   */\n  fetchOptions?: Pick<RequestInit, 'dispatcher'>;\n}\n\n// Note: Token estimation moved to core/token-estimator.ts (unified TokenEstimator)\n\n/**\n * Default maximum tokens for OpenAI models.\n */\nexport const DEFAULT_MAX_TOKENS = 4096;\n\n/**\n * Tool call type for extracting function info.\n */\nexport interface FunctionToolCall {\n  id: string;\n  type: 'function';\n  function: {\n    name: string;\n    arguments: string;\n  };\n}\n\n/**\n * Type guard for function tool calls.\n * Note: typeof null === 'object' is true, so we need to check tc !== null\n */\nexport function isFunctionToolCall(toolCall: unknown): toolCall is FunctionToolCall {\n  if (typeof toolCall !== 'object' || toolCall === null) {\n    return false;\n  }\n  const tc = toolCall as Record<string, unknown>;\n  return tc['type'] === 'function' && typeof tc['function'] === 'object' && tc['function'] !== null;\n}\n\n/**\n * Resolves model alias to full model identifier.\n */\nexport function resolveModelId(modelId: string): string {\n  return OPENAI_MODEL_ALIASES[modelId] ?? modelId;\n}\n\n/**\n * Determines capabilities based on model ID.\n */\nexport function getModelCapabilities(modelId: string): readonly ModelCapability[] {\n  const capabilities: ModelCapability[] = [MC.COMPLETION, MC.STREAMING, MC.TOOL_USE];\n\n  const resolvedId = resolveModelId(modelId);\n\n  // Vision is available on GPT-4o, GPT-4-turbo, and GPT-5.2 models\n  if (\n    resolvedId.includes('gpt-4o') ||\n    resolvedId.includes('gpt-4-turbo') ||\n    resolvedId.includes('gpt-5.2')\n  ) {\n    capabilities.push(MC.VISION);\n  }\n\n  // Extended thinking is available on GPT-5.2 models\n  if (resolvedId.includes('gpt-5.2')) {\n    capabilities.push(MC.EXTENDED_THINKING);\n  }\n\n  return capabilities;\n}\n","/**\n * nexus-agents/adapters - OpenAI Message Mappers\n *\n * Functions for mapping between Nexus and OpenAI message formats.\n */\n\nimport type OpenAI from 'openai';\nimport type {\n  ChatCompletionMessageParam,\n  ChatCompletionTool,\n  ChatCompletion,\n  ChatCompletionChunk,\n} from 'openai/resources/chat/completions';\nimport type {\n  ContentBlock,\n  Message,\n  ToolDefinition,\n  TokenUsage,\n  StopReason,\n  StreamChunk,\n} from '../core/index.js';\nimport { isFunctionToolCall } from './openai-types.js';\n\n/**\n * Maps OpenAI finish reasons to our StopReason type.\n */\nexport function mapStopReason(openaiReason: string | null | undefined): StopReason {\n  switch (openaiReason) {\n    case 'stop':\n      return 'end_turn';\n    case 'length':\n      return 'max_tokens';\n    case 'tool_calls':\n    case 'function_call':\n      return 'tool_use';\n    // `content_filter` is never mapped as a finish: the adapter turns it into an\n    // error before a response is built (#6607, see detectNonAnswer), because\n    // every consumer reads a mapped response as an answer.\n    default:\n      return 'end_turn';\n  }\n}\n\n/** A reply blocked by the provider's content filter, streamed or not (#6607). */\nexport const CONTENT_FILTERED: NonAnswer = {\n  reason: 'content_filter',\n  detail: 'the reply was blocked by a content filter',\n};\n\n/** A completion that must surface as an error, never as an empty success (#6607). */\nexport interface NonAnswer {\n  /** Why the completion carries no answer. */\n  readonly reason: 'content_filter' | 'no_choices' | 'reasoning_truncated';\n  readonly detail: string;\n  /** Reasoning tokens the vendor reported, when it reported them. */\n  readonly reasoningTokens?: number;\n}\n\n/**\n * Classify a completion choice that is not an answer (#6607). The third kind,\n * `no_choices` (an empty `choices` array, which some gateways return for a\n * blocked prompt), has no choice to classify and is raised by the adapter.\n *\n * - `content_filter`: the provider's safety layer blocked or cut the reply. Any\n *   partial text is not an answer either.\n * - `reasoning_truncated`: a reasoning model hit the completion cap with no\n *   visible output, so the whole budget went to reasoning. This is distinct\n *   from an ordinary `length` truncation, which still carries partial text.\n *   `reasoningFamily` comes from the model id; a reported non-zero\n *   `reasoning_tokens` count is evidence on its own for ids the regex misses.\n *\n * Returns `undefined` for every other completion.\n */\nexport function detectNonAnswer(\n  choice: ChatCompletion.Choice,\n  usage: ChatCompletion['usage'],\n  reasoningFamily: boolean\n): NonAnswer | undefined {\n  if (choice.finish_reason === 'content_filter') return CONTENT_FILTERED;\n  if (choice.finish_reason !== 'length' || hasVisibleOutput(choice)) return undefined;\n  const reasoningTokens = usage?.completion_tokens_details?.reasoning_tokens;\n  if (!reasoningFamily && !(reasoningTokens !== undefined && reasoningTokens > 0)) {\n    return undefined;\n  }\n  return {\n    reason: 'reasoning_truncated',\n    detail:\n      'the completion budget was spent on reasoning before any output (empty reply, finish length)',\n    ...(reasoningTokens !== undefined ? { reasoningTokens } : {}),\n  };\n}\n\nfunction hasVisibleOutput(choice: ChatCompletion.Choice): boolean {\n  const text = choice.message.content;\n  if (text !== null && text !== '') return true;\n  return (choice.message.tool_calls?.length ?? 0) > 0;\n}\n\n/**\n * Parse a tool call's JSON `arguments` string. Unparseable text is kept under\n * `_raw` rather than dropped, so the caller still sees what the model sent.\n */\nfunction parseToolArguments(args: string): unknown {\n  try {\n    return JSON.parse(args) as unknown;\n  } catch {\n    return { _raw: args };\n  }\n}\n\n/**\n * Maps OpenAI choice to our ContentBlock array.\n */\nexport function mapChoiceToContentBlocks(choice: ChatCompletion.Choice): ContentBlock[] {\n  const blocks: ContentBlock[] = [];\n  const message = choice.message;\n\n  // Add text content if present\n  if (message.content !== null && message.content !== '') {\n    blocks.push({ type: 'text', text: message.content });\n  }\n\n  // Add tool calls if present\n  if (message.tool_calls !== undefined && message.tool_calls.length > 0) {\n    for (const toolCall of message.tool_calls) {\n      if (isFunctionToolCall(toolCall)) {\n        blocks.push({\n          type: 'tool_use',\n          id: toolCall.id,\n          name: toolCall.function.name,\n          input: parseToolArguments(toolCall.function.arguments),\n        });\n      }\n    }\n  }\n\n  // If no content at all, return empty text block\n  if (blocks.length === 0) {\n    blocks.push({ type: 'text', text: '' });\n  }\n\n  return blocks;\n}\n\n/**\n * Maps our Message format to OpenAI's ChatCompletionMessageParam format.\n *\n * Returns an ARRAY: one user message holding several `tool_result` blocks\n * becomes one `tool` message per result (#6607). OpenAI requires a tool message\n * for every `tool_call_id` the assistant issued; sending only the first made\n * strict gateways reject the request with a 400.\n */\nexport function mapMessage(message: Message): ChatCompletionMessageParam[] {\n  if (message.role === 'system') {\n    return [mapSystemMessage(message)];\n  }\n  if (message.role === 'user') {\n    return mapUserMessage(message);\n  }\n  return [mapAssistantMessage(message)];\n}\n\n/**\n * Maps a system message.\n */\nfunction mapSystemMessage(message: Message): ChatCompletionMessageParam {\n  const content =\n    typeof message.content === 'string'\n      ? message.content\n      : message.content\n          .filter((b): b is { type: 'text'; text: string } => b.type === 'text')\n          .map((b) => b.text)\n          .join('\\n');\n  return { role: 'system', content };\n}\n\n/**\n * Maps a user message.\n */\nfunction mapUserMessage(message: Message): ChatCompletionMessageParam[] {\n  if (typeof message.content === 'string') {\n    return [{ role: 'user', content: message.content }];\n  }\n\n  // Tool results become one `tool` message each, in order (#6607).\n  const toolResults = message.content.filter(\n    (b): b is { type: 'tool_result'; tool_use_id: string; content: string; is_error?: boolean } =>\n      b.type === 'tool_result'\n  );\n\n  if (toolResults.length > 0) {\n    return toolResults.map((result) => ({\n      role: 'tool' as const,\n      tool_call_id: result.tool_use_id,\n      content: result.content,\n    }));\n  }\n\n  // Map to user message with content array\n  const content = message.content.map((block) => {\n    if (block.type === 'text') {\n      return { type: 'text' as const, text: block.text };\n    }\n    if (block.type === 'image') {\n      return {\n        type: 'image_url' as const,\n        image_url: {\n          url: `data:${block.source.media_type};base64,${block.source.data}`,\n        },\n      };\n    }\n    // Fallback for other types\n    return { type: 'text' as const, text: '' };\n  });\n\n  return [{ role: 'user', content }];\n}\n\n/**\n * Maps an assistant message.\n */\nfunction mapAssistantMessage(message: Message): ChatCompletionMessageParam {\n  if (typeof message.content === 'string') {\n    return { role: 'assistant', content: message.content };\n  }\n\n  // Check for tool uses in assistant message\n  const toolUses = message.content.filter(\n    (b): b is { type: 'tool_use'; id: string; name: string; input: unknown } =>\n      b.type === 'tool_use'\n  );\n\n  const textContent = message.content\n    .filter((b): b is { type: 'text'; text: string } => b.type === 'text')\n    .map((b) => b.text)\n    .join('');\n\n  if (toolUses.length > 0) {\n    const assistantMessage: ChatCompletionMessageParam = {\n      role: 'assistant',\n      content: textContent !== '' ? textContent : null,\n      tool_calls: toolUses.map((tool) => ({\n        id: tool.id,\n        type: 'function' as const,\n        function: {\n          name: tool.name,\n          arguments: JSON.stringify(tool.input),\n        },\n      })),\n    };\n    return assistantMessage;\n  }\n\n  return { role: 'assistant', content: textContent };\n}\n\n/**\n * Maps our ToolDefinition to OpenAI's tool format.\n */\nexport function mapTool(tool: ToolDefinition): ChatCompletionTool {\n  return {\n    type: 'function',\n    function: {\n      name: tool.name,\n      description: tool.description,\n      parameters: tool.inputSchema,\n    },\n  };\n}\n\n/**\n * Maps OpenAI API response to our CompletionResponse format.\n */\nexport function mapResponseUsage(response: ChatCompletion): TokenUsage | undefined {\n  const u = response.usage;\n  // #4439: `?? 0` here synthesised a measurement the vendor never sent. An\n  // absent usage block must stay absent so the decision-cost rollup can tell\n  // \"zero tokens\" from \"we do not know\".\n  if (u === undefined) return undefined;\n  const cached = u.prompt_tokens_details?.cached_tokens;\n  return {\n    inputTokens: u.prompt_tokens,\n    outputTokens: u.completion_tokens,\n    totalTokens: u.total_tokens,\n    ...(cached !== undefined ? { cachedInputTokens: cached } : {}),\n  };\n}\n\n/**\n * Maps content delta from stream chunk.\n */\nfunction mapContentDelta(\n  delta: OpenAI.Chat.ChatCompletionChunk.Choice.Delta,\n  currentIndex: number,\n  hasStarted: boolean\n): StreamChunk[] {\n  const chunks: StreamChunk[] = [];\n\n  if (delta.content !== undefined && delta.content !== null && delta.content !== '') {\n    // Start content block if this is the first content\n    if (currentIndex === 0 && !hasStarted) {\n      chunks.push({\n        type: 'content_block_start',\n        index: 0,\n        contentBlock: { type: 'text', text: '' },\n      });\n    }\n\n    chunks.push({\n      type: 'content_block_delta',\n      index: currentIndex,\n      delta: { type: 'text_delta', text: delta.content },\n    });\n  }\n\n  return chunks;\n}\n\n/**\n * Tool calls being assembled across a stream, keyed by the OpenAI tool index\n * (#6607). OpenAI sends the id and name in the first delta for a call and the\n * JSON `arguments` in fragments after it, so a call is only complete when the\n * choice finishes. Create one per stream with {@link createStreamToolCallState}.\n */\ninterface StreamToolCallState {\n  readonly calls: Map<number, { id: string; name: string; args: string }>;\n}\n\n/** A fresh accumulator for one stream (#6607). */\nexport function createStreamToolCallState(): StreamToolCallState {\n  return { calls: new Map() };\n}\n\n/**\n * Accumulates tool-call deltas. Emits nothing: the `tool_use` block is emitted\n * once, complete, at the finish chunk (see {@link flushToolCalls}). Emitting it\n * on the first delta, as this used to, fixed its `input` at `{}` (#6607).\n */\nfunction accumulateToolCallsDelta(\n  delta: OpenAI.Chat.ChatCompletionChunk.Choice.Delta,\n  state: StreamToolCallState\n): void {\n  for (const toolCall of delta.tool_calls ?? []) {\n    const entry = state.calls.get(toolCall.index) ?? { id: '', name: '', args: '' };\n    if (toolCall.id !== undefined) entry.id = toolCall.id;\n    if (toolCall.function?.name !== undefined) entry.name = toolCall.function.name;\n    if (toolCall.function?.arguments !== undefined) entry.args += toolCall.function.arguments;\n    state.calls.set(toolCall.index, entry);\n  }\n}\n\n/** Emit each assembled tool call as one complete `tool_use` block, in index order. */\nfunction flushToolCalls(state: StreamToolCallState): StreamChunk[] {\n  const chunks: StreamChunk[] = [...state.calls.entries()]\n    .sort(([a], [b]) => a - b)\n    .map(([index, call]) => ({\n      type: 'content_block_start' as const,\n      index,\n      contentBlock: {\n        type: 'tool_use' as const,\n        id: call.id,\n        name: call.name,\n        input: call.args === '' ? {} : parseToolArguments(call.args),\n      },\n    }));\n  state.calls.clear();\n  return chunks;\n}\n\n/**\n * Maps finish reason from stream chunk.\n */\nfunction mapFinishChunks(\n  choice: ChatCompletionChunk.Choice,\n  chunk: ChatCompletionChunk,\n  currentIndex: number,\n  toolCalls: StreamToolCallState\n): StreamChunk[] {\n  const chunks: StreamChunk[] = [];\n\n  if (choice.finish_reason !== null) {\n    chunks.push(...flushToolCalls(toolCalls));\n\n    // End current content block\n    chunks.push({\n      type: 'content_block_stop',\n      index: currentIndex,\n    });\n\n    // Emit message_delta with stop reason.\n    //\n    // NO `usage` on this path. OpenAI populates `chunk.usage` on a streaming\n    // response only when the request sets `stream_options: { include_usage:\n    // true }`, and nothing in this tree does — so both `??` fallbacks always\n    // took the `0` branch and every stream emitted\n    // `{inputTokens: 0, outputTokens: 0, totalTokens: 0}`: a usage block in\n    // which nothing whatsoever was measured.\n    //\n    // `inputTokensMeasured: false` covered only the first of those three. Its\n    // own contract is \"whether `inputTokens` is a measurement\", and there is no\n    // `outputTokensMeasured`, so a consumer honouring the flag correctly\n    // discounted `inputTokens` and then read `outputTokens: 0` as a measured\n    // zero. That is the #4439 policy this violated, stated on the field itself:\n    // \"Where NOTHING is known, prefer omitting `usage` entirely.\" The SDK\n    // adapter's stream path already does exactly that (#4835), for the same\n    // reason.\n    chunks.push({\n      type: 'message_delta',\n      delta: { stop_reason: mapStopReason(choice.finish_reason) },\n      // A stream whose usage IS reported keeps it — when `include_usage` is\n      // wired, this is the branch that carries a real measurement.\n      ...(chunk.usage !== undefined && chunk.usage !== null\n        ? {\n            usage: {\n              // OpenAI still omits prompt_tokens on the final chunk (#4835).\n              inputTokens: 0,\n              inputTokensMeasured: false,\n              outputTokens: chunk.usage.completion_tokens,\n              totalTokens: chunk.usage.total_tokens,\n            },\n          }\n        : {}),\n    });\n\n    // Emit message_stop\n    chunks.push({ type: 'message_stop' });\n  }\n\n  return chunks;\n}\n\n/**\n * Maps OpenAI stream chunks to our StreamChunk format.\n */\nexport function mapStreamChunk(\n  chunk: ChatCompletionChunk,\n  currentIndex: number,\n  hasStarted: boolean,\n  toolCalls: StreamToolCallState\n): StreamChunk[] {\n  const chunks: StreamChunk[] = [];\n  const choice = chunk.choices[0];\n\n  // Emit message_start on first chunk\n  if (!hasStarted) {\n    chunks.push({\n      type: 'message_start',\n      message: { model: chunk.model },\n    });\n  }\n\n  if (choice === undefined) {\n    return chunks;\n  }\n\n  const delta = choice.delta;\n\n  // Map content delta\n  chunks.push(...mapContentDelta(delta, currentIndex, hasStarted));\n\n  // Accumulate tool calls; they are emitted whole at the finish chunk.\n  accumulateToolCallsDelta(delta, toolCalls);\n\n  // Map finish reason\n  chunks.push(...mapFinishChunks(choice, chunk, currentIndex, toolCalls));\n\n  return chunks;\n}\n","/**\n * opencode.json gateway-config bridge (#2503, child 3 of epic #2500).\n *\n * When nexus-agents runs as an MCP loaded by OpenCode (typically inside a\n * Docker sandbox), OpenCode's `opencode.json` already declares the\n * OpenAI-compatible gateway the harness uses. Reading it from there saves\n * the operator from re-declaring the same `baseURL` + `apiKey` as\n * NEXUS_OPENAI_COMPAT_* env vars.\n *\n * Scope (per direction discussion 2026-05-09):\n *   - **Only** reads `providers.openai-compat.options.{baseURL, apiKey}`.\n *     Does NOT read OpenCode's MCP config, model list, logging, or other\n *     settings. nexus-agents' own behaviour stays driven by\n *     `nexus-agents.yaml` + `NEXUS_*` env vars.\n *   - Resolves OpenCode's `{env:VAR}` interpolation in the apiKey field.\n *   - Returns `null` on any failure path (missing file, parse error,\n *     missing fields, unset interpolated env var) — caller falls back to\n *     env-var precedence; we don't throw.\n *\n * Precedence (applied in `openai-compat-adapter.ts`):\n *   1. `NEXUS_OPENAI_COMPAT_URL` + `NEXUS_OPENAI_COMPAT_KEY` env vars (if both set)\n *   2. `NEXUS_OPENCODE_CONFIG` → `opencode.json` → `providers.openai-compat`\n *   3. Unconfigured → `null`, no adapter registered\n *\n * Sanitised logging (#4392 increment 3 tightened it): never log the resolved\n * apiKey, never log file contents — Node's JSON parse error embeds a source\n * snippet, so only the error NAME is logged — and log the gateway's hostname\n * rather than the baseURL, which can carry userinfo.\n *\n * @module config/opencode-bridge\n */\n\nimport { readFileSync } from 'node:fs';\n\nimport type { ILogger } from '../core/index.js';\nimport { createLogger } from '../core/index.js';\nimport { hostnameOf } from '../adapters/sdk/gateway-env.js';\n\nconst defaultLogger = createLogger({ component: 'opencode-bridge' });\n\nexport interface OpencodeGatewayConfig {\n  readonly baseURL: string;\n  readonly apiKey: string;\n}\n\n/**\n * Read `providers.openai-compat.options.{baseURL, apiKey}` from the given\n * opencode.json path. Returns `null` on any failure — the caller falls\n * back to env-var precedence.\n */\nexport function readOpencodeGateway(\n  path: string,\n  logger: ILogger = defaultLogger\n): OpencodeGatewayConfig | null {\n  const raw = readFileOrNull(path, logger);\n  if (raw === null) return null;\n\n  const parsed = parseJsonOrNull(raw, path, logger);\n  if (parsed === null) return null;\n\n  const options = extractOpenAICompatOptions(parsed);\n  if (options === null) {\n    logger.debug('opencode.json has no providers.openai-compat.options block', { path });\n    return null;\n  }\n\n  const baseURL = typeof options.baseURL === 'string' ? options.baseURL.trim() : '';\n  const apiKeyRaw = typeof options.apiKey === 'string' ? options.apiKey.trim() : '';\n  if (baseURL === '' || apiKeyRaw === '') {\n    logger.warn('opencode.json providers.openai-compat missing baseURL or apiKey', { path });\n    return null;\n  }\n\n  const apiKey = resolveEnvInterpolation(apiKeyRaw);\n  if (apiKey === null) {\n    logger.warn(\n      'opencode.json apiKey references an env var that is not set; gateway not configured',\n      { path }\n    );\n    return null;\n  }\n\n  logger.info('Gateway config sourced from opencode.json', { host: hostnameOf(baseURL), path });\n  return { baseURL, apiKey };\n}\n\nfunction readFileOrNull(path: string, logger: ILogger): string | null {\n  try {\n    return readFileSync(path, 'utf8');\n  } catch (err: unknown) {\n    const msg = err instanceof Error ? err.message : String(err);\n    logger.debug('Could not read opencode.json', { path, error: msg });\n    return null;\n  }\n}\n\n/**\n * Logs the error NAME only. On Node 22 a `SyntaxError` from `JSON.parse`\n * quotes the offending source (`... \"{\"apiKey\": sk-...\" is not valid JSON`),\n * so the message is a channel for the file's contents (#4392 increment 3).\n */\nfunction parseJsonOrNull(raw: string, path: string, logger: ILogger): unknown {\n  try {\n    return JSON.parse(raw);\n  } catch (err: unknown) {\n    const name = err instanceof Error ? err.name : 'unknown error';\n    logger.warn('opencode.json is not valid JSON; ignoring', { path, error: name });\n    return null;\n  }\n}\n\n/**\n * Pull `providers.openai-compat.options` out of the parsed JSON without\n * coupling to a Zod schema. OpenCode's config has many keys we don't\n * care about; we only navigate to the one we need.\n */\nfunction extractOpenAICompatOptions(\n  parsed: unknown\n): { baseURL?: unknown; apiKey?: unknown } | null {\n  if (typeof parsed !== 'object' || parsed === null) return null;\n  const root = parsed as { providers?: unknown };\n  const providers = root.providers;\n  if (typeof providers !== 'object' || providers === null) return null;\n  const provider = (providers as Record<string, unknown>)['openai-compat'];\n  if (typeof provider !== 'object' || provider === null) return null;\n  const options = (provider as { options?: unknown }).options;\n  if (typeof options !== 'object' || options === null) return null;\n  return options;\n}\n\n/**\n * Resolve OpenCode's `{env:VAR}` interpolation. Only the literal pattern\n * is supported (no shell expansion, no defaults). Returns the string as-is\n * when no interpolation is present; returns `null` when the referenced\n * env var is not set.\n */\nfunction resolveEnvInterpolation(value: string): string | null {\n  const match = /^\\{env:([A-Z0-9_]+)\\}$/.exec(value);\n  if (match === null) return value;\n  const envName = match[1];\n  if (envName === undefined) return null;\n  const resolved = process.env[envName];\n  if (resolved === undefined || resolved === '') return null;\n  return resolved;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,OAAOA,aAAY;;;ACoBZ,IAAM,gCACX;AAEF,IAAM,SACJ,OAAO,4BAA4B;AASrC,eAAsB,iBACpB,SACA,UAAiD,CAAC,GACtB;AAC5B,QAAM,OAAO,WAAW,OAAO;AAC/B,QAAM,QAAQ,MAAM;AAAA,IAClB,kCAAkC,IAAI;AAAA,IACtC,QAAQ,mBAAmB;AAAA,EAC7B;AACA,MAAI,UAAU,YAAa,QAAO,EAAE,OAAO,oBAAoB,KAAK;AACpE,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,WAAW,KAAK;AAC9C,SAAO,EAAE,OAAO,wBAAwB,MAAM,QAAQ,MAAM,MAAM,SAAS,QAAQ,OAAO;AAC5F;AAQA,IAAM,iCAAiC;AAEvC,eAAe,kBAAqB,MAAkB,IAAsC;AAC1F,MAAI;AACJ,QAAM,UAAU,IAAI,QAAqB,CAAC,YAAY;AACpD,YAAQ,WAAW,MAAM;AACvB,cAAQ,WAAW;AAAA,IACrB,GAAG,EAAE;AACL,UAAM,MAAM;AAAA,EACd,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC;AAAA,EAC3C,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAGO,IAAM,0BAAN,cAAsC,YAAY;AAAA,EAC9C;AAAA,EAET,YAAY,QAA4B;AACtC,UAAM,yBAAyB,OAAO,MAAM,EAAE;AAC9C,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;;;AC1FA,OAAO,UAAU,gBAAgB;;;ACyB1B,IAAM,gBAAgB;AAAA,EAC3B,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMb,eAAe,gBAAgB,WAAW;AAAA,EAC1C,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAChB;AAUO,IAAM,uBAA+C;AAAA,EAC1D,mBAAmB,cAAc;AAAA,EACjC,UAAU,cAAc;AAAA,EACxB,eAAe,cAAc;AAAA,EAC7B,eAAe,cAAc;AAAA,EAC7B,iBAAiB,cAAc;AACjC;AA2CO,IAAM,qBAAqB;AAkB3B,SAAS,mBAAmB,UAAiD;AAClF,MAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,WAAO;AAAA,EACT;AACA,QAAM,KAAK;AACX,SAAO,GAAG,MAAM,MAAM,cAAc,OAAO,GAAG,UAAU,MAAM,YAAY,GAAG,UAAU,MAAM;AAC/F;AAKO,SAAS,eAAe,SAAyB;AACtD,SAAO,qBAAqB,OAAO,KAAK;AAC1C;AAKO,SAAS,qBAAqB,SAA6C;AAChF,QAAM,eAAkC,CAAC,gBAAG,YAAY,gBAAG,WAAW,gBAAG,QAAQ;AAEjF,QAAM,aAAa,eAAe,OAAO;AAGzC,MACE,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,aAAa,KACjC,WAAW,SAAS,SAAS,GAC7B;AACA,iBAAa,KAAK,gBAAG,MAAM;AAAA,EAC7B;AAGA,MAAI,WAAW,SAAS,SAAS,GAAG;AAClC,iBAAa,KAAK,gBAAG,iBAAiB;AAAA,EACxC;AAEA,SAAO;AACT;;;AC3IO,SAAS,cAAc,cAAqD;AACjF,UAAQ,cAAc;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA;AAAA;AAAA;AAAA,IAIT;AACE,aAAO;AAAA,EACX;AACF;AAGO,IAAM,mBAA8B;AAAA,EACzC,QAAQ;AAAA,EACR,QAAQ;AACV;AA0BO,SAAS,gBACd,QACA,OACA,iBACuB;AACvB,MAAI,OAAO,kBAAkB,iBAAkB,QAAO;AACtD,MAAI,OAAO,kBAAkB,YAAY,iBAAiB,MAAM,EAAG,QAAO;AAC1E,QAAM,kBAAkB,OAAO,2BAA2B;AAC1D,MAAI,CAAC,mBAAmB,EAAE,oBAAoB,UAAa,kBAAkB,IAAI;AAC/E,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QACE;AAAA,IACF,GAAI,oBAAoB,SAAY,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC7D;AACF;AAEA,SAAS,iBAAiB,QAAwC;AAChE,QAAM,OAAO,OAAO,QAAQ;AAC5B,MAAI,SAAS,QAAQ,SAAS,GAAI,QAAO;AACzC,UAAQ,OAAO,QAAQ,YAAY,UAAU,KAAK;AACpD;AAMA,SAAS,mBAAmB,MAAuB;AACjD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO,EAAE,MAAM,KAAK;AAAA,EACtB;AACF;AAKO,SAAS,yBAAyB,QAA+C;AACtF,QAAM,SAAyB,CAAC;AAChC,QAAM,UAAU,OAAO;AAGvB,MAAI,QAAQ,YAAY,QAAQ,QAAQ,YAAY,IAAI;AACtD,WAAO,KAAK,EAAE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,CAAC;AAAA,EACrD;AAGA,MAAI,QAAQ,eAAe,UAAa,QAAQ,WAAW,SAAS,GAAG;AACrE,eAAW,YAAY,QAAQ,YAAY;AACzC,UAAI,mBAAmB,QAAQ,GAAG;AAChC,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,IAAI,SAAS;AAAA,UACb,MAAM,SAAS,SAAS;AAAA,UACxB,OAAO,mBAAmB,SAAS,SAAS,SAAS;AAAA,QACvD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,EAAE,MAAM,QAAQ,MAAM,GAAG,CAAC;AAAA,EACxC;AAEA,SAAO;AACT;AAUO,SAAS,WAAW,SAAgD;AACzE,MAAI,QAAQ,SAAS,UAAU;AAC7B,WAAO,CAAC,iBAAiB,OAAO,CAAC;AAAA,EACnC;AACA,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO,eAAe,OAAO;AAAA,EAC/B;AACA,SAAO,CAAC,oBAAoB,OAAO,CAAC;AACtC;AAKA,SAAS,iBAAiB,SAA8C;AACtE,QAAM,UACJ,OAAO,QAAQ,YAAY,WACvB,QAAQ,UACR,QAAQ,QACL,OAAO,CAAC,MAA2C,EAAE,SAAS,MAAM,EACpE,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,IAAI;AAClB,SAAO,EAAE,MAAM,UAAU,QAAQ;AACnC;AAKA,SAAS,eAAe,SAAgD;AACtE,MAAI,OAAO,QAAQ,YAAY,UAAU;AACvC,WAAO,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAAA,EACpD;AAGA,QAAM,cAAc,QAAQ,QAAQ;AAAA,IAClC,CAAC,MACC,EAAE,SAAS;AAAA,EACf;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO,YAAY,IAAI,CAAC,YAAY;AAAA,MAClC,MAAM;AAAA,MACN,cAAc,OAAO;AAAA,MACrB,SAAS,OAAO;AAAA,IAClB,EAAE;AAAA,EACJ;AAGA,QAAM,UAAU,QAAQ,QAAQ,IAAI,CAAC,UAAU;AAC7C,QAAI,MAAM,SAAS,QAAQ;AACzB,aAAO,EAAE,MAAM,QAAiB,MAAM,MAAM,KAAK;AAAA,IACnD;AACA,QAAI,MAAM,SAAS,SAAS;AAC1B,aAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW;AAAA,UACT,KAAK,QAAQ,MAAM,OAAO,UAAU,WAAW,MAAM,OAAO,IAAI;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,QAAiB,MAAM,GAAG;AAAA,EAC3C,CAAC;AAED,SAAO,CAAC,EAAE,MAAM,QAAQ,QAAQ,CAAC;AACnC;AAKA,SAAS,oBAAoB,SAA8C;AACzE,MAAI,OAAO,QAAQ,YAAY,UAAU;AACvC,WAAO,EAAE,MAAM,aAAa,SAAS,QAAQ,QAAQ;AAAA,EACvD;AAGA,QAAM,WAAW,QAAQ,QAAQ;AAAA,IAC/B,CAAC,MACC,EAAE,SAAS;AAAA,EACf;AAEA,QAAM,cAAc,QAAQ,QACzB,OAAO,CAAC,MAA2C,EAAE,SAAS,MAAM,EACpE,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,EAAE;AAEV,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,mBAA+C;AAAA,MACnD,MAAM;AAAA,MACN,SAAS,gBAAgB,KAAK,cAAc;AAAA,MAC5C,YAAY,SAAS,IAAI,CAAC,UAAU;AAAA,QAClC,IAAI,KAAK;AAAA,QACT,MAAM;AAAA,QACN,UAAU;AAAA,UACR,MAAM,KAAK;AAAA,UACX,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,QACtC;AAAA,MACF,EAAE;AAAA,IACJ;AACA,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,MAAM,aAAa,SAAS,YAAY;AACnD;AAKO,SAAS,QAAQ,MAA0C;AAChE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU;AAAA,MACR,MAAM,KAAK;AAAA,MACX,aAAa,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,IACnB;AAAA,EACF;AACF;AAKO,SAAS,iBAAiB,UAAkD;AACjF,QAAM,IAAI,SAAS;AAInB,MAAI,MAAM,OAAW,QAAO;AAC5B,QAAM,SAAS,EAAE,uBAAuB;AACxC,SAAO;AAAA,IACL,aAAa,EAAE;AAAA,IACf,cAAc,EAAE;AAAA,IAChB,aAAa,EAAE;AAAA,IACf,GAAI,WAAW,SAAY,EAAE,mBAAmB,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAKA,SAAS,gBACP,OACA,cACA,YACe;AACf,QAAM,SAAwB,CAAC;AAE/B,MAAI,MAAM,YAAY,UAAa,MAAM,YAAY,QAAQ,MAAM,YAAY,IAAI;AAEjF,QAAI,iBAAiB,KAAK,CAAC,YAAY;AACrC,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,OAAO;AAAA,QACP,cAAc,EAAE,MAAM,QAAQ,MAAM,GAAG;AAAA,MACzC,CAAC;AAAA,IACH;AAEA,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,OAAO;AAAA,MACP,OAAO,EAAE,MAAM,cAAc,MAAM,MAAM,QAAQ;AAAA,IACnD,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAaO,SAAS,4BAAiD;AAC/D,SAAO,EAAE,OAAO,oBAAI,IAAI,EAAE;AAC5B;AAOA,SAAS,yBACP,OACA,OACM;AACN,aAAW,YAAY,MAAM,cAAc,CAAC,GAAG;AAC7C,UAAM,QAAQ,MAAM,MAAM,IAAI,SAAS,KAAK,KAAK,EAAE,IAAI,IAAI,MAAM,IAAI,MAAM,GAAG;AAC9E,QAAI,SAAS,OAAO,OAAW,OAAM,KAAK,SAAS;AACnD,QAAI,SAAS,UAAU,SAAS,OAAW,OAAM,OAAO,SAAS,SAAS;AAC1E,QAAI,SAAS,UAAU,cAAc,OAAW,OAAM,QAAQ,SAAS,SAAS;AAChF,UAAM,MAAM,IAAI,SAAS,OAAO,KAAK;AAAA,EACvC;AACF;AAGA,SAAS,eAAe,OAA2C;AACjE,QAAM,SAAwB,CAAC,GAAG,MAAM,MAAM,QAAQ,CAAC,EACpD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,EACxB,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO;AAAA,IACvB,MAAM;AAAA,IACN;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,OAAO,KAAK,SAAS,KAAK,CAAC,IAAI,mBAAmB,KAAK,IAAI;AAAA,IAC7D;AAAA,EACF,EAAE;AACJ,QAAM,MAAM,MAAM;AAClB,SAAO;AACT;AAKA,SAAS,gBACP,QACA,OACA,cACA,WACe;AACf,QAAM,SAAwB,CAAC;AAE/B,MAAI,OAAO,kBAAkB,MAAM;AACjC,WAAO,KAAK,GAAG,eAAe,SAAS,CAAC;AAGxC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAmBD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,OAAO,EAAE,aAAa,cAAc,OAAO,aAAa,EAAE;AAAA;AAAA;AAAA,MAG1D,GAAI,MAAM,UAAU,UAAa,MAAM,UAAU,OAC7C;AAAA,QACE,OAAO;AAAA;AAAA,UAEL,aAAa;AAAA,UACb,qBAAqB;AAAA,UACrB,cAAc,MAAM,MAAM;AAAA,UAC1B,aAAa,MAAM,MAAM;AAAA,QAC3B;AAAA,MACF,IACA,CAAC;AAAA,IACP,CAAC;AAGD,WAAO,KAAK,EAAE,MAAM,eAAe,CAAC;AAAA,EACtC;AAEA,SAAO;AACT;AAKO,SAAS,eACd,OACA,cACA,YACA,WACe;AACf,QAAM,SAAwB,CAAC;AAC/B,QAAM,SAAS,MAAM,QAAQ,CAAC;AAG9B,MAAI,CAAC,YAAY;AACf,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,EAAE,OAAO,MAAM,MAAM;AAAA,IAChC,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,QAAW;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO;AAGrB,SAAO,KAAK,GAAG,gBAAgB,OAAO,cAAc,UAAU,CAAC;AAG/D,2BAAyB,OAAO,SAAS;AAGzC,SAAO,KAAK,GAAG,gBAAgB,QAAQ,OAAO,cAAc,SAAS,CAAC;AAEtE,SAAO;AACT;;;AFjXA,SAAS,MAAM,KAAa,KAAiD;AAC3E,SAAO,QAAQ,QAAQ,QAAQ,UAAa,QAAQ,KAAK,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC;AACrF;AAEA,SAAS,uBAAuB,GAAiB,QAAyB;AACxE,QAAM,OAAO;AAAA,IACX,QAAQ,OAAO,EAAE,UAAU,SAAS,CAAC;AAAA,IACrC,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,MAAM,QAAQ,EAAE,IAAI;AAAA,IACpB,MAAM,SAAS,EAAE,KAAK;AAAA,IACtB,MAAM,cAAc,EAAE,SAAS;AAAA,EACjC,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE;AACxB,MAAI,OAAO;AACX,MAAI,EAAE,UAAU,UAAa,EAAE,UAAU,MAAM;AAC7C,QAAI;AACF,YAAM,MAAM,KAAK,UAAU,EAAE,KAAK;AAClC,aAAO,SAAS,IAAI,SAAS,uBAAuB,GAAG,IAAI,MAAM,GAAG,oBAAoB,CAAC,WAAM,GAAG;AAAA,IACpG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,qBAAqB,GAAG,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,IAAI,MAAM;AACpF;AAGA,IAAM,uBAAuB;AAEtB,IAAM,gBAAN,cAA4B,YAAY;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,YAAY,QAA6B;AACvC,UAAM,kBACJ,OAAO,oBAAoB,OAAO,OAAO,UAAU,eAAe,OAAO,OAAO;AAGlF,UAAM,aAAgC;AAAA,MACpC,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,cAAc,qBAAqB,OAAO,OAAO;AAAA,MACjD,QAAQ,OAAO;AAAA,IACjB;AAGA,QAAI,OAAO,YAAY,QAAW;AAChC,iBAAW,UAAU,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,YAAY,QAAW;AAChC,iBAAW,UAAU,OAAO;AAAA,IAC9B;AACA,QAAI,OAAO,eAAe,QAAW;AACnC,iBAAW,aAAa,OAAO;AAAA,IACjC;AAEA,UAAM,UAAU;AAEhB,SAAK,SAAS,OAAO;AACrB,SAAK,kBAAkB;AAGvB,kBAAc,OAAO,QAAQ,UAAU,OAAO,OAAO;AAErD,SAAK,SAAS,KAAK,aAAa,MAAM;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKQ,aAAa,QAAqC;AACxD,UAAM,gBAAyD;AAAA,MAC7D,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO,cAAc;AAAA,IACnC;AAEA,QAAI,OAAO,YAAY,QAAW;AAChC,oBAAc,UAAU,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,YAAY,QAAW;AAChC,oBAAc,UAAU,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,oBAAc,eAAe,OAAO;AAAA,IACtC;AACA,QAAI,OAAO,mBAAmB,QAAW;AACvC,oBAAc,iBAAiB,OAAO;AAAA,IACxC;AACA,QAAI,OAAO,iBAAiB,QAAW;AACrC,oBAAc,eAAe,OAAO;AAAA,IACtC;AAEA,WAAO,IAAI,OAAO,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS,iBAA4C;AACnD,UAAM,aAAa,MAAM,eAAe;AACxC,QAAI,CAAC,WAAW,IAAI;AAClB,aAAO;AAAA,IACT;AAGA,UAAM,YAAY,uBAAuB,KAAK,OAAO,QAAQ,KAAK,YAAY,KAAK,OAAO;AAC1F,QAAI,CAAC,UAAU,GAAI,QAAO;AAE1B,WAAO,GAAG,MAAS;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,SAA6E;AAC1F,SAAK,WAAW,OAAO;AAEvB,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,kBAAkB,OAAO;AACrD,WAAK,YAAY,QAAQ;AACzB,aAAO,GAAG,QAAQ;AAAA,IACpB,SAAS,OAAO;AACd,aAAO,IAAI,KAAK,eAAe,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcmB,eAAe,OAA4B;AAC5D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,IAAI;AAIV,YAAM,QAIF,IAAI,MAAM,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU,EAAE;AAC5D,YAAM,SAAS,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;AACzD,YAAM,OAAO,EAAE,QAAQ;AACvB,YAAM,QAAQ,OAAO,EAAE,UAAU,YAAY,EAAE,UAAU,KAAK,EAAE,QAAQ;AACxE,YAAM,QAAQ;AACd,YAAM,aAAa,MAAM,eAAe,KAAK;AAE7C,iBAAW,UAAU,GAAG,KAAK,UAAU,IAAI,KAAK,OAAO,KAAK,uBAAuB,GAAG,KAAK,MAAM,CAAC;AAClG,aAAO;AAAA,IACT;AACA,UAAMC,OAAM,MAAM,eAAe,KAAK;AACtC,IAAAA,KAAI,UAAU,qBAAqBA,KAAI,SAAS,KAAK,MAAM;AAC3D,WAAOA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,OAAO,SAAwD;AACpE,SAAK,WAAW,OAAO;AAEvB,UAAM,CAAC,YAAY,QAAQ,IAAI,aAA0B;AAGzD,SAAK,cAAc,SAAS,UAAU,EAAE,MAAM,CAAC,UAAmB;AAChE,YAAM,aAAa,KAAK,eAAe,KAAK;AAC5C,iBAAW,MAAM,UAAU;AAAA,IAC7B,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQS,YAAY,MAA+B;AAElD,WAAO,QAAQ,QAAQ,kBAAkB,EAAE,aAAa,MAAM,QAAQ,CAAC;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,SAAyD;AACvF,UAAM,EAAE,QAAQ,QAAQ,IAAI,KAAK,mBAAmB,OAAO;AAM3D,UAAM,WACJ,QAAQ,WAAW,SACf,MAAM,KAAK,OAAO,KAAK,YAAY,OAAO,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC,IAC5E,MAAM,KAAK,OAAO,KAAK,YAAY,OAAO,MAAM;AAEtD,WAAO,KAAK,YAAY,UAAU,OAAO;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cACZ,SACA,YAKe;AACf,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,KAAK,mBAAmB,OAAO;AAClD,YAAM,SAAS,MAAM,KAAK,OAAO,KAAK,YAAY,OAAO,EAAE,GAAG,QAAQ,QAAQ,KAAK,CAAC;AAEpF,UAAI,eAAe;AACnB,UAAI,aAAa;AACjB,YAAM,YAAY,0BAA0B;AAE5C,uBAAiB,SAAS,QAAQ;AAGhC,YAAI,MAAM,QAAQ,CAAC,GAAG,kBAAkB,kBAAkB;AACxD,gBAAM,eAAe,GAAG,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI,kBAAkB,MAAM,KAAK;AAAA,QAC1F;AACA,cAAM,eAAe,eAAe,OAAO,cAAc,YAAY,SAAS;AAE9E,mBAAW,eAAe,cAAc;AACtC,cAAI,YAAY,SAAS,iBAAiB;AACxC,yBAAa;AAAA,UACf;AACA,cAAI,YAAY,SAAS,uBAAuB;AAC9C;AAAA,UACF;AACA,qBAAW,KAAK,WAAW;AAAA,QAC7B;AAAA,MACF;AAEA,iBAAW,SAAS;AAAA,IACtB,SAAS,OAAO;AACd,YAAM,aAAa,KAAK,eAAe,KAAK;AAC5C,iBAAW,MAAM,UAAU;AAAA,IAC7B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAmB,SAGzB;AACA,UAAM,WAAW,KAAK,cAAc,OAAO;AAE3C,UAAM,SAA6D;AAAA,MACjE,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,uBAAuB,QAAQ,aAAa,KAAK,2BAA2B;AAAA,IAC9E;AAEA,UAAM,UAAU,KAAK,kBAAkB,QAAQ,OAAO;AACtD,WAAO,EAAE,QAAQ,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,SAA0D;AAC9E,UAAM,WAAyC,CAAC;AAGhD,QAAI,QAAQ,iBAAiB,UAAa,QAAQ,iBAAiB,IAAI;AACrE,eAAS,KAAK,EAAE,MAAM,UAAU,SAAS,QAAQ,aAAa,CAAC;AAAA,IACjE;AAGA,eAAW,OAAO,QAAQ,UAAU;AAClC,UAAI,IAAI,SAAS,YAAY,QAAQ,iBAAiB,QAAW;AAC/D;AAAA,MACF;AACA,eAAS,KAAK,GAAG,WAAW,GAAG,CAAC;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,kBACN,QACA,SACyB;AAOzB,UAAM,OAAO,mBAAmB,SAAS,KAAK,eAAe;AAC7D,QAAI,KAAK,gBAAgB,QAAW;AAClC,aAAO,cAAc,KAAK;AAAA,IAC5B;AAEA,QAAI,QAAQ,SAAS,UAAa,QAAQ,KAAK,SAAS,GAAG;AACzD,aAAO,OAAO,QAAQ;AAAA,IACxB;AAEA,QAAI,QAAQ,UAAU,UAAa,QAAQ,MAAM,SAAS,GAAG;AAC3D,aAAO,QAAQ,QAAQ,MAAM,IAAI,OAAO;AAAA,IAC1C;AAEA,SAAK,kBAAkB,QAAQ,OAAO;AAGtC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKQ,kBACN,QACA,SACM;AACN,QAAI,QAAQ,mBAAmB,QAAW;AACxC;AAAA,IACF;AAEA,QAAI,QAAQ,eAAe,SAAS,eAAe;AACjD,aAAO,kBAAkB,EAAE,MAAM,cAAc;AAAA,IACjD,WAAW,QAAQ,eAAe,SAAS,eAAe;AACxD,aAAO,kBAAkB;AAAA,QACvB,MAAM;AAAA,QACN,aAAa;AAAA,UACX,MAAM;AAAA,UACN,QAAQ,QAAQ,eAAe;AAAA,QACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,YACN,UACA,UAAmC,CAAC,GAChB;AAKpB,UAAM,cAAc,SAAS,QAAQ,CAAC;AACtC,QAAI,gBAAgB,QAAW;AAC7B,YAAM;AAAA,QACJ,GAAG,KAAK,UAAU,IAAI,KAAK,OAAO;AAAA,QAClC,EAAE,QAAQ,cAAc,QAAQ,oCAAoC;AAAA,QACpE,SAAS;AAAA,MACX;AAAA,IACF;AACA,UAAM,YAAY,gBAAgB,aAAa,SAAS,OAAO,KAAK,kBAAkB,CAAC;AACvF,QAAI,cAAc;AAChB,YAAM,eAAe,GAAG,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI,WAAW,SAAS,KAAK;AAEtF,UAAM,UAAU,yBAAyB,WAAW;AACpD,UAAM,QAAgC,iBAAiB,QAAQ;AAE/D,WAAO;AAAA,MACL;AAAA,MACA,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,MACvC,YAAY,cAAc,YAAY,aAAa;AAAA,MACnD,OAAO,SAAS;AAAA;AAAA;AAAA,MAGhB,GAAI,QAAQ,SAAS,IAAI,EAAE,UAAU,QAAQ,IAAI,CAAC;AAAA,IACpD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAA6B;AACnC,WAAO,0BAA0B,KAAK,eAAe,MAAM;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,6BAAqC;AAC3C,WAAO,KAAK,kBAAkB,IAAI,0CAA0C;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,aAAgD;AACpD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,KAAK,gBAAgB,QAAQ,MAAM,KAAK,YAAY,YAAY,oBAAoB;AACtF,aAAO,KAAK,YAAY;AAAA,IAC1B;AACA,QAAI,KAAK,mBAAmB,MAAM;AAChC,aAAO,KAAK;AAAA,IACd;AACA,UAAM,WAAW,KAAK,YAAY;AAClC,SAAK,iBAAiB;AACtB,QAAI;AACF,YAAM,QAAQ,MAAM;AACpB,WAAK,cAAc,EAAE,OAAO,WAAW,KAAK,IAAI,EAAE;AAClD,aAAO;AAAA,IACT,UAAE;AACA,WAAK,iBAAiB;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,cAA6E;AAAA,EAC7E,iBAA2D;AAAA,EAEnE,MAAc,cAAiD;AAC7D,UAAM,OAAO,MAAM,KAAK,OAAO,OAAO,KAAK;AAC3C,WAAO,KAAK,KAAK,IAAI,CAAC,MAAqB;AACzC,YAAM,OAAsB,EAAE,IAAI,EAAE,GAAG;AACvC,UAAI,OAAO,EAAE,aAAa,UAAU;AAClC,eAAO,EAAE,GAAG,MAAM,SAAS,EAAE,UAAU,WAAW,EAAE,QAAQ;AAAA,MAC9D;AACA,UAAI,OAAO,EAAE,YAAY,UAAU;AACjC,eAAO,EAAE,GAAG,MAAM,WAAW,EAAE,QAAQ;AAAA,MACzC;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,IAAM,qBAAqB,IAAI,KAAK;AAGpC,IAAM,0CAA0C;AAUhD,SAAS,eAAe,QAAgB,WAAsB,aAAkC;AAC9F,SAAO,IAAI,WAAW,GAAG,MAAM,KAAK,UAAU,MAAM,IAAI;AAAA,IACtD,MAAM,UAAU;AAAA,IAChB,SAAS;AAAA,MACP,QAAQ,UAAU;AAAA,MAClB,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,MACnD,GAAI,UAAU,oBAAoB,SAC9B,EAAE,iBAAiB,UAAU,gBAAgB,IAC7C,CAAC;AAAA,IACP;AAAA,EACF,CAAC;AACH;AAiBO,SAAS,oBAAoB,QAA4C;AAC9E,SAAO,IAAI,cAAc,MAAM;AACjC;;;AGnkBA,SAAS,oBAAoB;AAM7B,IAAM,gBAAgB,aAAa,EAAE,WAAW,kBAAkB,CAAC;AAY5D,SAAS,oBACd,MACA,SAAkB,eACY;AAC9B,QAAM,MAAM,eAAe,MAAM,MAAM;AACvC,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,SAAS,gBAAgB,KAAK,MAAM,MAAM;AAChD,MAAI,WAAW,KAAM,QAAO;AAE5B,QAAM,UAAU,2BAA2B,MAAM;AACjD,MAAI,YAAY,MAAM;AACpB,WAAO,MAAM,8DAA8D,EAAE,KAAK,CAAC;AACnF,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,OAAO,QAAQ,YAAY,WAAW,QAAQ,QAAQ,KAAK,IAAI;AAC/E,QAAM,YAAY,OAAO,QAAQ,WAAW,WAAW,QAAQ,OAAO,KAAK,IAAI;AAC/E,MAAI,YAAY,MAAM,cAAc,IAAI;AACtC,WAAO,KAAK,mEAAmE,EAAE,KAAK,CAAC;AACvF,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,wBAAwB,SAAS;AAChD,MAAI,WAAW,MAAM;AACnB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,SAAO,KAAK,6CAA6C,EAAE,MAAM,WAAW,OAAO,GAAG,KAAK,CAAC;AAC5F,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,SAAS,eAAe,MAAc,QAAgC;AACpE,MAAI;AACF,WAAO,aAAa,MAAM,MAAM;AAAA,EAClC,SAASC,MAAc;AACrB,UAAM,MAAMA,gBAAe,QAAQA,KAAI,UAAU,OAAOA,IAAG;AAC3D,WAAO,MAAM,gCAAgC,EAAE,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO;AAAA,EACT;AACF;AAOA,SAAS,gBAAgB,KAAa,MAAc,QAA0B;AAC5E,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,SAASA,MAAc;AACrB,UAAM,OAAOA,gBAAe,QAAQA,KAAI,OAAO;AAC/C,WAAO,KAAK,6CAA6C,EAAE,MAAM,OAAO,KAAK,CAAC;AAC9E,WAAO;AAAA,EACT;AACF;AAOA,SAAS,2BACP,QACgD;AAChD,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAC1D,QAAM,OAAO;AACb,QAAM,YAAY,KAAK;AACvB,MAAI,OAAO,cAAc,YAAY,cAAc,KAAM,QAAO;AAChE,QAAM,WAAY,UAAsC,eAAe;AACvE,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM,QAAO;AAC9D,QAAM,UAAW,SAAmC;AACpD,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,SAAO;AACT;AAQA,SAAS,wBAAwB,OAA8B;AAC7D,QAAM,QAAQ,yBAAyB,KAAK,KAAK;AACjD,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,UAAU,MAAM,CAAC;AACvB,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,WAAW,QAAQ,IAAI,OAAO;AACpC,MAAI,aAAa,UAAa,aAAa,GAAI,QAAO;AACtD,SAAO;AACT;;;ALhCO,SAAS,sBAAsB,SAAwD;AAC5F,QAAM,MAAgB,QAAyC;AAC/D,SAAO,OAAO,QAAQ,YAAY,gBAAgB,GAAG;AACvD;AAqBO,SAAS,sBAAiD;AAC/D,QAAM,UAAU,mBAAmB;AACnC,MAAI,YAAY,KAAM,QAAO;AAC7B,SAAO,wBAAwB;AACjC;AASA,SAAS,qBAAgD;AACvD,QAAM,SAAS,QAAQ,IAAI,qBAAqB,GAAG,KAAK;AACxD,QAAM,SAAS,QAAQ,IAAI,qBAAqB,GAAG,KAAK;AACxD,MAAI,WAAW,UAAa,WAAW,GAAI,QAAO;AAClD,MAAI,WAAW,UAAa,WAAW,GAAI,QAAO;AAClD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,UAAU,yBAAyB;AAAA,IACnC,gBAAgB,mBAAmB;AAAA,IACnC,GAAG,qBAAqB,QAAQ,QAAQ,KAAK,cAAc;AAAA,EAC7D;AACF;AAEA,SAAS,0BAAqD;AAC5D,QAAM,eAAe,QAAQ,IAAI,uBAAuB,GAAG,KAAK;AAChE,MAAI,iBAAiB,UAAa,iBAAiB,GAAI,QAAO;AAC9D,QAAM,WAAW,oBAAoB,YAAY;AACjD,MAAI,aAAa,KAAM,QAAO;AAC9B,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,UAAU,yBAAyB;AAAA,IACnC,gBAAgB,mBAAmB;AAAA,IACnC,GAAG,qBAAqB,SAAS,SAAS,QAAQ,KAAK,cAAc;AAAA,EACvE;AACF;AAEA,IAAM,iBAAiB,aAAa,EAAE,WAAW,wBAAwB,CAAC;AAanE,SAAS,yBACd,MAAyB,QAAQ,KACjC,SAAkB,gBACV;AACR,QAAM,MAAM,IAAI,0BAA0B,GAAG,KAAK;AAClD,MAAI,QAAQ,UAAa,QAAQ,GAAI,QAAO;AAC5C,QAAM,SAAS,yBAAyB,GAAG;AAC3C,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO;AAAA,IACL,GAAG,0BAA0B,aAAa,MAAM,mCAAmC,8BAA8B;AAAA,IACjH,EAAE,KAAK,4BAA4B,QAAQ,OAAO,aAAa;AAAA,EACjE;AACA,SAAO;AACT;AAaA,IAAM,wBAAwB;AAG9B,IAAM,6BAA6B;AASnC,IAAM,mBAAmB;AAQzB,SAAS,kBACP,QACA,QACc;AACd,QAAM,OAAO,OAAO,OAAO,CAAC,MAAM,iBAAiB,KAAK,EAAE,EAAE,CAAC;AAC7D,QAAM,UAAU,OAAO,SAAS,KAAK;AACrC,MAAI,UAAU,GAAG;AACf,YAAQ;AAAA,MACN,WAAW,OAAO,OAAO,CAAC;AAAA,MAC1B,EAAE,SAAS,MAAM,KAAK,OAAO;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAUA,eAAsB,eACpB,QACA,QAC0D;AAC1D,QAAM,UAAU,MAAM,uBAAuB,QAAQ,MAAM;AAC3D,SAAO,QAAQ,KAAK,GAAG,QAAQ,MAAM,MAAM,IAAI;AACjD;AASA,eAAsB,uBACpB,QACA,QAGA;AASA,QAAM,YAAY,MAAM,iBAAiB,OAAO,OAAO;AACvD,MAAI,UAAU,UAAU,wBAAwB;AAC9C,WAAO,IAAI,IAAI,wBAAwB,SAAS,CAAC;AAAA,EACnD;AACA,MAAI,UAAU,UAAU,oBAAoB;AAG1C,WAAO,IAAI,IAAI,YAAY,GAAG,6BAA6B,UAAU,UAAU,IAAI,GAAG,CAAC;AAAA,EACzF;AACA,MAAI;AACF,UAAM,SAAS,IAAIC,QAAO;AAAA,MACxB,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA;AAAA;AAAA,MAGf,SAAS;AAAA,MACT,YAAY;AAAA;AAAA;AAAA,MAGZ,GAAG,qBAAqB,MAAM;AAAA,IAChC,CAAC;AACD,UAAM,OAAO,MAAM,OAAO,OAAO,KAAK;AAGtC,UAAM,SAAS,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,GAAG,OAAO,EAAE,EAAE;AACxE,UAAM,YAAY,OAAO,kBAAkB,CAAC;AAC5C,UAAM,UAAU,qBAAqB,kBAAkB,QAAQ,MAAM,GAAG,WAAW,MAAM;AACzF,QAAI,QAAQ,SAAS,uBAAuB;AAC1C,aAAO,IAAI,aAAa,QAAQ,KAAK,KAAK,QAAQ,QAAQ,QAAQ,UAAU,SAAS,CAAC,CAAC;AAAA,IACzF;AACA,WAAO,GAAG;AAAA,MACR,aAAa,KAAK,KAAK;AAAA,MACvB,QAAQ,QAAQ,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO;AAAA,QACrC,IAAI,EAAE;AAAA,QACN,SAAS,EAAE;AAAA,QACX,SAAS,EAAE;AAAA,MACb,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,GAAY;AAInB,WAAO;AAAA,MACL,IAAI;AAAA,QACF,kCAAkC,WAAW,OAAO,OAAO,CAAC,KACvD,aAAa,gBAAgB,CAAC,GAAG,OAAO,MAAM,CAAC,YACxC,qBAAqB,QAAQ,qBAAqB;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,aACP,QACA,QACA,SACA,aACa;AACb,QAAM,MAAM,OAAO,qBAAqB;AACxC,QAAM,OAAO,WAAW,OAAO,OAAO;AACtC,QAAM,SAAS,cACX,GAAG,wBAAwB,YAAY,OAAO,OAAO,CAAC,WAAW,OAAO,MAAM,CAAC,mBAC/E,aAAa,OAAO,MAAM,CAAC,YAAY,OAAO,OAAO,CAAC;AAC1D,SAAO,IAAI;AAAA,IACT,WAAW,IAAI,KAAK,MAAM,eAAe,GAAG,qDACnC,wBAAwB,qFACS,GAAG;AAAA,EAC/C;AACF;AAiBO,SAAS,0BACd,SACA,QACA,SACqB;AAKrB,QAAM,QAAQ,IAAI,cAAc;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,iBAAiB;AAAA,IACjB,GAAG,qBAAqB,MAAM;AAAA,EAChC,CAAC;AACD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,OAAO,OAAO,YAAY,8BAA8B;AAAA,EAC1D;AACA,SAAO,YAAY,SAAY,UAAU,OAAO,OAAO,SAAS,EAAE,QAAQ,CAAC;AAC7E;AAcA,SAAS,mBAAmB,OAAsB,YAAgD;AAChG,QAAM,UAA+B;AAAA,IACnC;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,cAAc,MAAM;AAAA,IACpB,aAAa,CAAC,SAAS,MAAM,YAAY,IAAI;AAAA,IAC7C,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC3C,QAAQ,CAAC,YAAY,MAAM,OAAO,OAAO;AAAA,IACzC,MAAM,SAAS,SAA6E;AAC1F,YAAM,QAAQ,gBAAgB,EAAE,IAAI;AACpC,YAAM,SAAS,MAAM,MAAM,SAAS,OAAO;AAC3C,YAAM,YAAY,gBAAgB,EAAE,IAAI,IAAI;AAC5C,UAAI;AACF,YAAI,OAAO,IAAI;AACb,gBAAM,IAAI,OAAO,MAAM;AAKvB,cAAI,MAAM,OAAW,QAAO;AAG5B,gBAAM,OAAO,kBAAkB,YAAY,MAAM,SAAS,EAAE,aAAa,EAAE,YAAY;AACvF,2BAAiB;AAAA,YACf,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,YAClC,SAAS,MAAM;AAAA,YACf,YAAY,MAAM;AAAA,YAClB,aAAa,EAAE;AAAA,YACf,cAAc,EAAE;AAAA,YAChB,SAAS,KAAK;AAAA,YACd;AAAA,YACA,SAAS;AAAA,YACT,QAAQ,KAAK;AAAA,YACb,GAAI,KAAK,SAAS,EAAE,aAAa,KAAK,WAAW,IAAI,CAAC;AAAA,UACxD,CAAC;AAAA,QACH,OAAO;AACL,2BAAiB,OAAO,WAAW,OAAO,MAAM,IAAI;AAAA,QACtD;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,mBAAiB,SAAS,KAAK;AAC/B,SAAO;AACT;AAGA,SAAS,iBAAiB,OAAsB,WAAmB,WAAyB;AAC1F,mBAAiB;AAAA,IACf,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,SAAS,MAAM;AAAA,IACf,YAAY,MAAM;AAAA,IAClB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAQA,SAAS,iBAAiB,SAAwB,OAA4B;AAC5E,QAAM,OAAO,MAAM,YAAY,KAAK,KAAK;AACzC,MAAI,SAAS,OAAW;AACxB,UAAQ,aAAa,MAAyC,KAAK;AACrE;AAYA,eAAsB,0BACpB,QAC+D;AAC/D,QAAM,SAAS,oBAAoB;AACnC,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,aAAa,MAAM,eAAe,QAAQ,MAAM;AACtD,MAAI,CAAC,WAAW,GAAI,QAAO;AAC3B,SAAO,GAAG,WAAW,MAAM,IAAI,CAAC,MAAM,0BAA0B,EAAE,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3F;","names":["OpenAI","err","err","OpenAI"]}

package/dist/{chunk-V7VGNFAN.js → chunk-73Y7XRKL.js}

@@ -1,10 +1,14 @@
+import {
+  ensureGatewayDiscovered,
+  gatewayDiscoveryGeneration
+} from "./chunk-JX7D7GXS.js";
 import {
   createAutoAdapter
-} from "./chunk-E5QULKGJ.js";
+} from "./chunk-BNRWICG7.js";
 import {
   getDefaultCliCircuitBreakerRegistry,
   mapModelErrorToCategory
-} from "./chunk-QSXDLYV4.js";
+} from "./chunk-QDELEGK7.js";
 import {
   CircularBuffer,
   ConfigError,
@@ -30,7 +34,7 @@ import {
   resolveModelIdentitySync,
   toRateLimitError,
   warnIfGatewayCostUndeclared
-} from "./chunk-X7BYCDQN.js";
+} from "./chunk-KGLMAIY3.js";
 
 // src/config/model-equivalence.ts
 var VARIANT_QUIRKS = /* @__PURE__ */ new Set(["small", "image"]);
@@ -404,6 +408,8 @@ var ResilientAdapter = class {
   defaultCliTimeoutMs;
   /** Inflight detection promise for coalescing concurrent calls (Issue #1423). */
   detectionPromise;
+  /** The {@link gatewayDiscoveryGeneration} the current selection was made under (#6659). */
+  detectedAtGeneration = 0;
   constructor(config) {
     this.logger = config?.logger ?? createLogger({ component: "resilient-adapter" });
     this.preferredCli = config?.preferredCli;
@@ -534,6 +540,16 @@ var ResilientAdapter = class {
   }
   // --- Private methods ---
   async ensureAdapter() {
+    if (this.currentAdapter === void 0) {
+      await ensureGatewayDiscovered();
+    } else {
+      void ensureGatewayDiscovered();
+    }
+    if (this.currentAdapter !== void 0 && this.detectedAtGeneration !== gatewayDiscoveryGeneration()) {
+      this.currentAdapter = void 0;
+      this.currentSelection = void 0;
+      this.hasEverDetected = false;
+    }
     if (this.currentAdapter !== void 0) {
       return this.currentAdapter;
     }
@@ -543,6 +559,7 @@ var ResilientAdapter = class {
     return this.detectionPromise;
   }
   async detectAdapter() {
+    const generation = gatewayDiscoveryGeneration();
     try {
       this.logger.info("Detecting model adapter (lazy)");
       const config = {
@@ -554,6 +571,7 @@ var ResilientAdapter = class {
       };
       const selection = await createAutoAdapter(config);
       this.applySelection(selection);
+      this.detectedAtGeneration = generation;
       return this.currentAdapter;
     } catch (error) {
       const message = getErrorMessage(error);
@@ -1050,4 +1068,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-V7VGNFAN.js.map
+//# sourceMappingURL=chunk-73Y7XRKL.js.map