omnigateway 0.2.0 → 0.2.1

package/bin/omni.js

@@ -155,12 +155,14 @@ function createAdminAuth(store, opts) {
 var ANTHROPIC_NATIVE_TOOLS = {
   anthropic: true,
   openai: false,
-  kimi: false
+  kimi: false,
+  custom: false
 };
 var PROVIDER_CAPABILITIES = {
   anthropic: { tools: true, images: true, reasoning: true },
   openai: { tools: true, images: true, reasoning: true },
-  kimi: { tools: true, images: false, reasoning: false }
+  kimi: { tools: true, images: false, reasoning: false },
+  custom: { tools: true, images: true, reasoning: true }
 };
 // packages/ir/src/errors.ts
 var RETRYABLE = {
@@ -174,6 +176,7 @@ var RETRYABLE = {
   TIMEOUT: true,
   NETWORK: true,
   BAD_REQUEST: false,
+  CONFLICT: false,
   CONTENT_FILTER: false,
   NO_CANDIDATES: false,
   ALL_CANDIDATES_FAILED: false,
@@ -240,6 +243,82 @@ function usageFromPromptTotal(promptTokens, outputTokens, cacheReadTokens, cache
     cacheWriteTokens
   };
 }
+// packages/ir/src/tokens.ts
+var CHARS_PER_TOKEN = 4;
+var IMAGE_TOKENS = 1600;
+var BLOCK_OVERHEAD = 4;
+var MESSAGE_OVERHEAD = 4;
+function fromText(text) {
+  return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+function blockTokens(block) {
+  switch (block.type) {
+    case "text":
+      return BLOCK_OVERHEAD + fromText(block.text);
+    case "image":
+      return BLOCK_OVERHEAD + IMAGE_TOKENS;
+    case "thinking":
+      return BLOCK_OVERHEAD + fromText(block.text);
+    case "toolUse":
+      return BLOCK_OVERHEAD + fromText(block.name) + fromText(safeJson(block.input));
+    case "toolResult":
+      return BLOCK_OVERHEAD + fromText(block.toolUseId) + fromText(block.content);
+    case "anthropicNative":
+      return BLOCK_OVERHEAD + fromText(block.blockType) + fromText(safeJson(block.data));
+  }
+}
+function messageTokens(message) {
+  let total = MESSAGE_OVERHEAD;
+  for (const block of message.content)
+    total += blockTokens(block);
+  return total;
+}
+function toolTokens(tool) {
+  if (tool.provider === "anthropic") {
+    return BLOCK_OVERHEAD + fromText(tool.name) + fromText(tool.type) + fromText(safeJson(tool.wire));
+  }
+  return BLOCK_OVERHEAD + fromText(tool.name) + fromText(tool.description ?? "") + fromText(safeJson(tool.inputSchema));
+}
+function safeJson(value) {
+  try {
+    return JSON.stringify(value) ?? "";
+  } catch {
+    return "";
+  }
+}
+function estimateInputTokens(request) {
+  let total = 0;
+  for (const block of request.system ?? [])
+    total += blockTokens(block);
+  for (const message of request.messages)
+    total += messageTokens(message);
+  for (const tool of request.tools ?? [])
+    total += toolTokens(tool);
+  return total;
+}
+function estimateCachedInputTokens(request) {
+  let running = 0;
+  let cached = 0;
+  for (const tool of request.tools ?? []) {
+    running += toolTokens(tool);
+    if (tool.cacheControl !== undefined)
+      cached = running;
+  }
+  for (const block of request.system ?? []) {
+    running += blockTokens(block);
+    if (cacheControlOf(block) !== undefined)
+      cached = running;
+  }
+  for (const message of request.messages) {
+    running += MESSAGE_OVERHEAD;
+    for (const block of message.content) {
+      running += blockTokens(block);
+      if (cacheControlOf(block) !== undefined)
+        cached = running;
+    }
+  }
+  return cached;
+}
 // packages/control/src/config.ts
 var MIN_KEY_LENGTH = 16;
 var TRUTHY = new Set(["1", "true", "yes", "on"]);
@@ -314,7 +393,8 @@ var BODY_ORDER = {
     "parallel_tool_calls",
     "metadata"
   ],
-  kimi: ["model", "messages", "tools", "tool_choice", "max_tokens", "temperature", "stream"]
+  kimi: ["model", "messages", "tools", "tool_choice", "max_tokens", "temperature", "stream"],
+  custom: []
 };
 function orderFields(obj, order) {
   const out = {};
@@ -415,10 +495,20 @@ var ANTHROPIC_MODELS = {
       id: "claude-haiku-4-5",
       label: "Claude Haiku 4.5",
       pricing: { input: 1, output: 5, cacheRead: 0.1, cacheWrite5m: 1.25, cacheWrite1h: 2 },
-      limits: { contextWindow: 200000, maxOutputTokens: 64000 }
+      limits: { contextWindow: 200000, maxOutputTokens: 64000 },
+      reasoningForm: "budget"
     }
   ]
 };
+var ONE_M_SUFFIX = "[1m]";
+var DATED_SUFFIX = /-\d{8}$/;
+function anthropicReasoningForm(model) {
+  let id = model.trim();
+  if (id.toLowerCase().endsWith(ONE_M_SUFFIX))
+    id = id.slice(0, -ONE_M_SUFFIX.length).trim();
+  id = id.replace(DATED_SUFFIX, "");
+  return ANTHROPIC_MODELS.models.find((m) => m.id === id)?.reasoningForm ?? "adaptive";
+}
 
 // packages/providers/src/kimi/models.ts
 var KIMI_MODELS = {
@@ -490,7 +580,8 @@ var OPENAI_MODELS = {
 var PROVIDER_MODEL_CATALOG = {
   anthropic: ANTHROPIC_MODELS,
   openai: OPENAI_MODELS,
-  kimi: KIMI_MODELS
+  kimi: KIMI_MODELS,
+  custom: { defaultModel: "", models: [] }
 };
 function catalogPricing(provider, model) {
   return PROVIDER_MODEL_CATALOG[provider]?.models.find((entry) => entry.id === model)?.pricing ?? null;
@@ -703,7 +794,8 @@ var kimi = {
 var PROFILES = {
   anthropic: { ...anthropic, order: envOrder("OMNI_ORDER_ANTHROPIC", anthropic.order) },
   openai: { ...openai, order: envOrder("OMNI_ORDER_OPENAI", openai.order) },
-  kimi: { ...kimi, order: envOrder("OMNI_ORDER_KIMI", kimi.order) }
+  kimi: { ...kimi, order: envOrder("OMNI_ORDER_KIMI", kimi.order) },
+  custom: { headers: [], order: [] }
 };
 
 // packages/providers/src/sse.ts
@@ -1265,6 +1357,45 @@ function encodeToolChoice(c) {
       return { type: "tool", name: c.name };
   }
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutEffort(vendor, note2) {
+  const config = vendor.output_config;
+  if (!isRecord(config))
+    return vendor;
+  const entries = Object.entries(config);
+  const kept = entries.filter(([key]) => key !== "effort");
+  if (kept.length === entries.length)
+    return vendor;
+  note2("anthropic:effort-unsupported");
+  if (kept.length === 0) {
+    return Object.fromEntries(Object.entries(vendor).filter(([key]) => key !== "output_config"));
+  }
+  return { ...vendor, output_config: Object.fromEntries(kept) };
+}
+var THINKING_ONLY_EDITS = new Set(["clear_thinking_20251015"]);
+function thinkingIsOff(thinking) {
+  if (!isRecord(thinking))
+    return thinking !== undefined;
+  return thinking.type !== "adaptive" && thinking.type !== "enabled";
+}
+function stripUnsupportedEdits(body, note2) {
+  if (!thinkingIsOff(body.thinking))
+    return;
+  const config = body.context_management;
+  if (!isRecord(config) || !Array.isArray(config.edits))
+    return;
+  const kept = config.edits.filter((e) => !(isRecord(e) && THINKING_ONLY_EDITS.has(String(e.type))));
+  if (kept.length === config.edits.length)
+    return;
+  note2("anthropic:clear-thinking-unsupported");
+  if (kept.length === 0 && Object.keys(config).length === 1) {
+    delete body.context_management;
+    return;
+  }
+  body.context_management = { ...config, edits: kept };
+}
 function toWire(req, model, opts) {
   const degradations = [];
   const note2 = (d) => {
@@ -1314,12 +1445,20 @@ function toWire(req, model, opts) {
   if (req.reasoning !== undefined) {
     switch (req.reasoning.mode) {
       case "adaptive":
+        if (anthropicReasoningForm(model) === "budget") {
+          body.thinking = { type: "disabled" };
+          note2("anthropic:adaptive-thinking-unsupported");
+          break;
+        }
         body.thinking = {
           type: "adaptive",
           ...req.reasoning.display === undefined ? {} : { display: req.reasoning.display }
         };
         if (req.reasoning.effort !== undefined) {
-          body.output_config = { ...body.output_config ?? {}, effort: req.reasoning.effort };
+          body.output_config = {
+            ...isRecord(body.output_config) ? body.output_config : {},
+            effort: req.reasoning.effort
+          };
         }
         break;
       case "budget":
@@ -1330,7 +1469,9 @@ function toWire(req, model, opts) {
         break;
     }
   }
-  Object.assign(body, req.vendor?.anthropic ?? {});
+  const vendor = req.vendor?.anthropic ?? {};
+  Object.assign(body, anthropicReasoningForm(model) === "budget" ? withoutEffort(vendor, note2) : vendor);
+  stripUnsupportedEdits(body, note2);
   return { body, degradations };
 }
 
@@ -1394,115 +1535,6 @@ var anthropicAdapter = {
     return { events: decodeAnthropic(parseSse(res.body)), degradations: notes };
   }
 };
-// packages/providers/src/http-client.ts
-import { request as httpRequest } from "http";
-import { request as httpsRequest } from "https";
-import { Readable } from "stream";
-function nodeHttpClient(options = {}) {
-  const logger2 = options.logger ?? noopLogger;
-  const now = options.now ?? (() => Date.now());
-  return (req) => new Promise((resolve, reject) => {
-    const url = new URL(req.url);
-    const startedAt = now();
-    let traced = false;
-    const trace = (status, failed = false) => {
-      if (traced || !logger2.enabled("debug"))
-        return;
-      traced = true;
-      logger2.debug("upstream http", {
-        provider: req.provider,
-        status,
-        host: url.host,
-        path: url.pathname,
-        durationMs: now() - startedAt,
-        reason: failed ? "transport error" : undefined
-      });
-    };
-    const send = url.protocol === "https:" ? httpsRequest : httpRequest;
-    const bodyBytes = Buffer.from(req.body, "utf8");
-    const headers = {};
-    for (const [name, value] of req.headers)
-      headers[name] = value;
-    if (req.body.length > 0 && !hasHeader(req, "content-length")) {
-      headers["Content-Length"] = bodyBytes.byteLength;
-    }
-    const outgoing = send({
-      protocol: url.protocol,
-      hostname: url.hostname,
-      port: url.port || (url.protocol === "https:" ? 443 : 80),
-      path: `${url.pathname}${url.search}`,
-      method: req.method,
-      headers,
-      setHost: !hasHeader(req, "host")
-    }, (incoming) => {
-      const chunks = [];
-      let buffered = null;
-      const responseHeaders = new Headers;
-      for (const [k, v] of Object.entries(incoming.headers)) {
-        if (Array.isArray(v))
-          for (const one of v)
-            responseHeaders.append(k, one);
-        else if (typeof v === "string")
-          responseHeaders.set(k, v);
-      }
-      trace(incoming.statusCode);
-      resolve({
-        status: incoming.statusCode ?? 0,
-        headers: responseHeaders,
-        body: Readable.toWeb(incoming),
-        text: () => {
-          buffered ??= new Promise((res, rej) => {
-            incoming.on("data", (c) => chunks.push(c));
-            incoming.on("end", () => res(Buffer.concat(chunks).toString("utf8")));
-            incoming.on("error", rej);
-          });
-          return buffered;
-        }
-      });
-    });
-    const onAbort = () => outgoing.destroy(new Error("aborted"));
-    outgoing.on("error", (err) => {
-      req.signal.removeEventListener("abort", onAbort);
-      trace(undefined, true);
-      reject(err);
-    });
-    outgoing.on("close", () => req.signal.removeEventListener("abort", onAbort));
-    if (req.signal.aborted) {
-      outgoing.destroy(new Error("aborted"));
-      return;
-    }
-    req.signal.addEventListener("abort", onAbort, { once: true });
-    if (bodyBytes.byteLength > 0)
-      outgoing.write(bodyBytes);
-    outgoing.end();
-  });
-}
-function hasHeader(req, lowerName) {
-  return req.headers.some(([name]) => name.toLowerCase() === lowerName);
-}
-// packages/providers/src/kimi-device.ts
-import { randomUUID } from "crypto";
-function mintKimiDevice() {
-  return {
-    deviceId: randomUUID(),
-    deviceName: "MacBook-Pro",
-    deviceModel: "MacBookPro18,3",
-    osVersion: "15.3.1"
-  };
-}
-function kimiDeviceHeaders(providerData) {
-  const deviceId = providerData.deviceId;
-  if (typeof deviceId !== "string" || deviceId.length === 0)
-    return [];
-  const str = (v) => typeof v === "string" && v.length > 0 ? v : "unknown";
-  return [
-    ["X-Msh-Device-Id", deviceId],
-    ["X-Msh-Device-Name", str(providerData.deviceName)],
-    ["X-Msh-Device-Model", str(providerData.deviceModel)],
-    ["X-Msh-Os-Version", str(providerData.osVersion)]
-  ];
-}
-
 // packages/providers/src/kimi/decode.ts
 var FINISH = {
   stop: "endTurn",
@@ -1613,7 +1645,7 @@ function encodeToolChoice2(c) {
       return { type: "function", function: { name: c.name } };
   }
 }
-function toChatWire(req, model) {
+function toChatWire(req, model, vendor = "kimi") {
   const degradations = [];
   const note2 = (d) => {
     if (!degradations.includes(d))
@@ -1697,44 +1729,10 @@ function toChatWire(req, model) {
     body.tool_choice = encodeToolChoice2(req.toolChoice);
   if (req.reasoning !== undefined)
     note2("kimi:reasoning-dropped");
-  Object.assign(body, req.vendor?.kimi ?? {});
+  Object.assign(body, req.vendor?.[vendor] ?? {});
   return { body, degradations };
 }
 
-// packages/providers/src/kimi/index.ts
-var BASE_URL2 = "https://api.kimi.com/coding/v1/chat/completions";
-var kimiAdapter = {
-  id: "kimi",
-  capabilities: PROVIDER_CAPABILITIES.kimi,
-  async send(req) {
-    const { body, degradations } = toChatWire(req.request, req.model);
-    const token = req.credentials.accessToken ?? req.credentials.apiKey;
-    if (token === null) {
-      throw new GatewayError("AUTH", "kimi credential has no token", { provider: "kimi" });
-    }
-    const protocol = [
-      ["Content-Type", "application/json"],
-      ["Accept", "text/event-stream"],
-      ["Authorization", `Bearer ${token}`],
-      ...kimiDeviceHeaders(req.credentials.providerData)
-    ];
-    const profile = PROFILES.kimi;
-    const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
-    const res = await req.http({
-      provider: "kimi",
-      url: BASE_URL2,
-      method: "POST",
-      headers,
-      body: JSON.stringify(orderFields({ ...body, stream: true }, BODY_ORDER.kimi)),
-      signal: req.signal
-    });
-    if (res.status < 200 || res.status >= 300)
-      throw await httpError(res, "kimi");
-    if (res.body === null)
-      throw new GatewayError("UPSTREAM", "empty response body", { provider: "kimi" });
-    return { events: decodeChat(parseSse(res.body)), degradations };
-  }
-};
 // packages/providers/src/openai/decode.ts
 var ERROR_CODE = {
   rate_limit_exceeded: "RATE_LIMIT",
@@ -2010,6 +2008,190 @@ ${block.text}
   return { body, degradations };
 }
 
+// packages/providers/src/custom/index.ts
+function metadata(data) {
+  const { origin, protocol } = data;
+  if (typeof origin !== "string" || protocol !== "chat_completions" && protocol !== "responses") {
+    throw new GatewayError("BAD_REQUEST", "custom credential has invalid endpoint metadata");
+  }
+  return { origin, protocol };
+}
+var customAdapter = {
+  id: "custom",
+  capabilities: PROVIDER_CAPABILITIES.custom,
+  async send(req) {
+    const apiKey = req.credentials.apiKey;
+    if (apiKey === null) {
+      throw new GatewayError("AUTH", "custom credential has no API key", { provider: "custom" });
+    }
+    const { origin, protocol } = metadata(req.credentials.providerData);
+    const encoded = protocol === "chat_completions" ? toChatWire(req.request, req.model, "openai") : toResponsesWire(req.request, req.model);
+    const headers = [
+      ["Content-Type", "application/json"],
+      ["Authorization", `Bearer ${apiKey}`]
+    ];
+    const res = await req.http({
+      provider: "custom",
+      url: `${origin}/v1/${protocol === "chat_completions" ? "chat/completions" : "responses"}`,
+      method: "POST",
+      headers,
+      body: JSON.stringify({ ...encoded.body, stream: true }),
+      signal: req.signal
+    });
+    if (res.status < 200 || res.status >= 300)
+      throw await httpError(res, "custom");
+    if (res.body === null) {
+      throw new GatewayError("UPSTREAM", "empty response body", { provider: "custom" });
+    }
+    return {
+      events: protocol === "chat_completions" ? decodeChat(parseSse(res.body)) : decodeResponses(parseSse(res.body)),
+      degradations: encoded.degradations.map((value) => value.replace(protocol === "chat_completions" ? /^kimi:/ : /^openai:/, "custom:"))
+    };
+  }
+};
+// packages/providers/src/http-client.ts
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { Readable } from "stream";
+function nodeHttpClient(options = {}) {
+  const logger2 = options.logger ?? noopLogger;
+  const now = options.now ?? (() => Date.now());
+  return (req) => new Promise((resolve, reject) => {
+    const url = new URL(req.url);
+    const startedAt = now();
+    let traced = false;
+    const trace = (status, failed = false) => {
+      if (traced || !logger2.enabled("debug"))
+        return;
+      traced = true;
+      logger2.debug("upstream http", {
+        provider: req.provider,
+        status,
+        host: url.host,
+        path: url.pathname,
+        durationMs: now() - startedAt,
+        reason: failed ? "transport error" : undefined
+      });
+    };
+    const send = url.protocol === "https:" ? httpsRequest : httpRequest;
+    const bodyBytes = Buffer.from(req.body, "utf8");
+    const headers = {};
+    for (const [name, value] of req.headers)
+      headers[name] = value;
+    if (req.body.length > 0 && !hasHeader(req, "content-length")) {
+      headers["Content-Length"] = bodyBytes.byteLength;
+    }
+    const outgoing = send({
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port || (url.protocol === "https:" ? 443 : 80),
+      path: `${url.pathname}${url.search}`,
+      method: req.method,
+      headers,
+      setHost: !hasHeader(req, "host")
+    }, (incoming) => {
+      const chunks = [];
+      let buffered = null;
+      const responseHeaders = new Headers;
+      for (const [k, v] of Object.entries(incoming.headers)) {
+        if (Array.isArray(v))
+          for (const one of v)
+            responseHeaders.append(k, one);
+        else if (typeof v === "string")
+          responseHeaders.set(k, v);
+      }
+      trace(incoming.statusCode);
+      resolve({
+        status: incoming.statusCode ?? 0,
+        headers: responseHeaders,
+        body: Readable.toWeb(incoming),
+        text: () => {
+          buffered ??= new Promise((res, rej) => {
+            incoming.on("data", (c) => chunks.push(c));
+            incoming.on("end", () => res(Buffer.concat(chunks).toString("utf8")));
+            incoming.on("error", rej);
+          });
+          return buffered;
+        }
+      });
+    });
+    const onAbort = () => outgoing.destroy(new Error("aborted"));
+    outgoing.on("error", (err) => {
+      req.signal.removeEventListener("abort", onAbort);
+      trace(undefined, true);
+      reject(err);
+    });
+    outgoing.on("close", () => req.signal.removeEventListener("abort", onAbort));
+    if (req.signal.aborted) {
+      outgoing.destroy(new Error("aborted"));
+      return;
+    }
+    req.signal.addEventListener("abort", onAbort, { once: true });
+    if (bodyBytes.byteLength > 0)
+      outgoing.write(bodyBytes);
+    outgoing.end();
+  });
+}
+function hasHeader(req, lowerName) {
+  return req.headers.some(([name]) => name.toLowerCase() === lowerName);
+}
+// packages/providers/src/kimi-device.ts
+import { randomUUID } from "crypto";
+function mintKimiDevice() {
+  return {
+    deviceId: randomUUID(),
+    deviceName: "MacBook-Pro",
+    deviceModel: "MacBookPro18,3",
+    osVersion: "15.3.1"
+  };
+}
+function kimiDeviceHeaders(providerData) {
+  const deviceId = providerData.deviceId;
+  if (typeof deviceId !== "string" || deviceId.length === 0)
+    return [];
+  const str = (v) => typeof v === "string" && v.length > 0 ? v : "unknown";
+  return [
+    ["X-Msh-Device-Id", deviceId],
+    ["X-Msh-Device-Name", str(providerData.deviceName)],
+    ["X-Msh-Device-Model", str(providerData.deviceModel)],
+    ["X-Msh-Os-Version", str(providerData.osVersion)]
+  ];
+}
+
+// packages/providers/src/kimi/index.ts
+var BASE_URL2 = "https://api.kimi.com/coding/v1/chat/completions";
+var kimiAdapter = {
+  id: "kimi",
+  capabilities: PROVIDER_CAPABILITIES.kimi,
+  async send(req) {
+    const { body, degradations } = toChatWire(req.request, req.model);
+    const token = req.credentials.accessToken ?? req.credentials.apiKey;
+    if (token === null) {
+      throw new GatewayError("AUTH", "kimi credential has no token", { provider: "kimi" });
+    }
+    const protocol = [
+      ["Content-Type", "application/json"],
+      ["Accept", "text/event-stream"],
+      ["Authorization", `Bearer ${token}`],
+      ...kimiDeviceHeaders(req.credentials.providerData)
+    ];
+    const profile = PROFILES.kimi;
+    const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
+    const res = await req.http({
+      provider: "kimi",
+      url: BASE_URL2,
+      method: "POST",
+      headers,
+      body: JSON.stringify(orderFields({ ...body, stream: true }, BODY_ORDER.kimi)),
+      signal: req.signal
+    });
+    if (res.status < 200 || res.status >= 300)
+      throw await httpError(res, "kimi");
+    if (res.body === null)
+      throw new GatewayError("UPSTREAM", "empty response body", { provider: "kimi" });
+    return { events: decodeChat(parseSse(res.body)), degradations };
+  }
+};
 // packages/providers/src/openai/index.ts
 var OAUTH_URL = "https://chatgpt.com/backend-api/codex/responses";
 var API_URL = "https://api.openai.com/v1/responses";
@@ -2222,11 +2404,11 @@ function pendingError(code) {
   error[PENDING_MARKER] = true;
   return error;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null;
 }
 function recordFrom(value) {
-  return isRecord(value) ? value : null;
+  return isRecord2(value) ? value : null;
 }
 function stringFrom(value, field) {
   const candidate = value[field];
@@ -2429,7 +2611,7 @@ function createPendingFlows(opts) {
 }
 
 // packages/control/src/connect.ts
-var PROVIDER_IDS = ["anthropic", "openai", "kimi"];
+var PROVIDER_IDS = ["anthropic", "openai", "kimi", "custom"];
 var FLOW_TTL_MS = 600000;
 function isProviderId(value) {
   return typeof value === "string" && PROVIDER_IDS.includes(value);
@@ -2470,6 +2652,8 @@ function createConnectFlows(deps) {
   }
   async function complete(flow, code) {
     const provider = deps.providers[flow.provider];
+    if (provider === undefined)
+      throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
     const result = await provider.exchange({ code, pending: flow.pending }, { http: deps.http, now: deps.now });
     const id = crypto.randomUUID();
     await deps.store.credentials.create({
@@ -2513,6 +2697,9 @@ function createConnectFlows(deps) {
       }
       const label = typeof labelInput === "string" && labelInput.trim().length > 0 ? labelInput.trim() : providerInput;
       const provider = deps.providers[providerInput];
+      if (provider === undefined) {
+        throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
+      }
       const redirectUri = callbackUri(providerInput);
       const start = provider.begin === undefined ? provider.start({ redirectUri }) : await (async () => {
         const initial = provider.start({ redirectUri });
@@ -13765,12 +13952,12 @@ function describe(description) {
   ch._zod.check = () => {};
   return ch;
 }
-function meta(metadata) {
+function meta(metadata2) {
   const ch = new $ZodCheck({ check: "meta" });
   ch._zod.onattach = [
     (inst) => {
       const existing = globalRegistry.get(inst) ?? {};
-      globalRegistry.add(inst, { ...existing, ...metadata });
+      globalRegistry.add(inst, { ...existing, ...metadata2 });
     }
   ];
   ch._zod.check = () => {};
@@ -16902,20 +17089,15 @@ function parseOrThrow(schema, body2) {
   const path = issue2?.path.join(".") ?? "(root)";
   throw new GatewayError("BAD_REQUEST", `${path}: ${issue2?.message ?? "invalid request"}`);
 }
-var providerIdSchema = exports_external.enum(["anthropic", "openai", "kimi"]);
+var providerIdSchema = exports_external.enum(["anthropic", "openai", "kimi", "custom"]);
 var dryRunSchema = exports_external.object({
   tools: exports_external.boolean().default(false),
   images: exports_external.boolean().default(false),
   reasoning: exports_external.boolean().default(false)
 }).strict();
-var modelSchema = exports_external.object({
-  id: exports_external.string().min(1).refine((value) => !value.toLowerCase().startsWith("claude/"), {
-    message: 'model id must not start with "claude/": that prefix is reserved for discovery mirrors'
-  }),
-  strategy: exports_external.enum(["score", "priority", "roundRobin", "weighted"]),
-  isAlias: exports_external.boolean(),
-  targets: exports_external.array(exports_external.object({
-    provider: providerIdSchema,
+var targetSchema = exports_external.discriminatedUnion("provider", [
+  exports_external.object({
+    provider: exports_external.enum(["anthropic", "openai", "kimi"]),
     model: exports_external.string().min(1),
     tier: exports_external.number().int().min(1),
     weight: exports_external.number().positive(),
@@ -16933,7 +17115,36 @@ var modelSchema = exports_external.object({
       images: exports_external.boolean(),
       reasoning: exports_external.boolean()
     })
-  })).min(1, "a virtual model needs at least one target")
+  }).strict(),
+  exports_external.object({
+    provider: exports_external.literal("custom"),
+    endpointId: exports_external.string().trim().min(1),
+    model: exports_external.string().min(1),
+    tier: exports_external.number().int().min(1),
+    weight: exports_external.number().positive(),
+    costPerMTok: exports_external.object({
+      input: exports_external.number().min(0),
+      output: exports_external.number().min(0),
+      cacheRead: exports_external.number().min(0).optional(),
+      cacheWrite5m: exports_external.number().min(0).optional(),
+      cacheWrite1h: exports_external.number().min(0).optional()
+    }),
+    contextWindow: exports_external.number().int().positive().optional(),
+    maxOutputTokens: exports_external.number().int().positive().optional(),
+    capabilities: exports_external.object({
+      tools: exports_external.boolean(),
+      images: exports_external.boolean(),
+      reasoning: exports_external.boolean()
+    })
+  }).strict()
+]);
+var modelSchema = exports_external.object({
+  id: exports_external.string().min(1).refine((value) => !value.toLowerCase().startsWith("claude/"), {
+    message: 'model id must not start with "claude/": that prefix is reserved for discovery mirrors'
+  }),
+  strategy: exports_external.enum(["score", "priority", "roundRobin", "weighted"]),
+  isAlias: exports_external.boolean(),
+  targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
 });
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
@@ -16947,7 +17158,7 @@ var settingsSchema = exports_external.object({
     quota: exports_external.number(),
     cost: exports_external.number(),
     latency: exports_external.number(),
-    recency: exports_external.number()
+    load: exports_external.number()
   }).strict(),
   maxAttempts: exports_external.number().int().min(1).max(10),
   requestDeadlineMs: exports_external.number().int().min(0),
@@ -17012,14 +17223,48 @@ async function getCredential(store, id) {
     throw new GatewayError("BAD_REQUEST", "no such credential");
   return summarizeCredential(credential);
 }
+function requiredString(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new GatewayError("BAD_REQUEST", `${field}: must not be empty`);
+  }
+  return value.trim();
+}
+function customProviderData(input) {
+  const endpointId = requiredString(input.endpointId, "endpointId");
+  const endpointLabel = requiredString(input.endpointLabel, "endpointLabel");
+  const originInput = requiredString(input.origin, "origin");
+  if (input.protocol !== "chat_completions" && input.protocol !== "responses") {
+    throw new GatewayError("BAD_REQUEST", "protocol: unsupported protocol");
+  }
+  let url2;
+  try {
+    url2 = new URL(originInput);
+  } catch {
+    throw new GatewayError("BAD_REQUEST", "origin: must be a valid URL");
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:" || url2.hostname.length === 0 || url2.username.length > 0 || url2.password.length > 0 || url2.pathname !== "" && url2.pathname !== "/" || url2.search.length > 0 || url2.hash.length > 0) {
+    throw new GatewayError("BAD_REQUEST", "origin: must be an HTTP(S) server origin");
+  }
+  return { endpointId, endpointLabel, origin: url2.origin, protocol: input.protocol };
+}
+function sameCustomEndpoint(a, b) {
+  return a.endpointId === b.endpointId && a.endpointLabel === b.endpointLabel && a.origin === b.origin && a.protocol === b.protocol;
+}
 async function createApiKeyCredential(store, input, logger2 = noopLogger) {
   const provider = parseOrThrow(providerIdSchema, input.provider);
-  if (typeof input.apiKey !== "string" || input.apiKey.trim().length === 0) {
-    throw new GatewayError("BAD_REQUEST", "apiKey: must not be empty");
-  }
+  const apiKey = requiredString(input.apiKey, "apiKey");
   if (input.label !== undefined && typeof input.label !== "string") {
     throw new GatewayError("BAD_REQUEST", "label: must be a string");
   }
+  let providerData = {};
+  if (provider === "custom") {
+    const custom2 = customProviderData(input);
+    const existing = (await store.credentials.list()).filter((credential) => credential.provider === "custom" && credential.providerData.endpointId === custom2.endpointId);
+    if (existing.some((credential) => !sameCustomEndpoint(credential.providerData, custom2))) {
+      throw new GatewayError("CONFLICT", `endpointId: metadata conflicts with existing endpoint`);
+    }
+    providerData = custom2;
+  }
   const label = input.label?.trim() || `${provider} api key`;
   const created = await store.credentials.create({
     id: crypto.randomUUID(),
@@ -17031,12 +17276,12 @@ async function createApiKeyCredential(store, input, logger2 = noopLogger) {
     weight: 1,
     expiresAt: null,
     accountEmail: null,
-    providerData: {},
+    providerData,
     disabledReason: null,
     disabledAt: null,
     accessToken: null,
     refreshToken: null,
-    apiKey: input.apiKey,
+    apiKey,
     idToken: null
   });
   logger2.info("credential added", { credentialId: created.id, provider: created.provider });
@@ -17171,6 +17416,9 @@ function eligible(input) {
     for (const credential of snapshot.credentials) {
       if (credential.provider !== target.provider)
         continue;
+      if (target.provider === "custom" && credential.providerData.endpointId !== target.endpointId) {
+        continue;
+      }
       const drop = (reason) => {
         excluded.push({ credentialId: credential.id, model: target.model, reason });
       };
@@ -17242,6 +17490,22 @@ function quotaHeadroom(credential, windows, now, pollIntervalMs) {
   return Math.min(...usable.map((w) => paceAdjusted(w, now)));
 }
 
+// packages/store/src/types.ts
+var READ_OVER_INPUT = 0.1;
+function cacheReadRate(prices) {
+  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+}
+var DEFAULT_SETTINGS = {
+  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
+  maxAttempts: 3,
+  requestDeadlineMs: 120000,
+  breakerThreshold: 3,
+  breakerCooldownMs: 30000,
+  logRetentionDays: 30,
+  quotaPollIntervalMs: 300000,
+  rtkEnabled: false
+};
+
 // packages/router/src/score.ts
 var UNKNOWN = 0.5;
 function lowerIsBetter(value, min, max) {
@@ -17249,43 +17513,49 @@ function lowerIsBetter(value, min, max) {
     return 1;
   return (max - value) / (max - min);
 }
-function blendedCost(input, output) {
-  return input * 0.25 + output * 0.75;
+function ratio(value, min) {
+  return Math.min(1, min / value);
+}
+function bestPositive(values) {
+  const positive = values.filter((v) => v > 0);
+  return positive.length > 0 ? Math.min(...positive) : null;
+}
+var EXPECTED_OUTPUT_TOKENS = 1000;
+function requestCost(target, request2) {
+  const cachedTok = estimateCachedInputTokens(request2);
+  const freshTok = Math.max(0, estimateInputTokens(request2) - cachedTok);
+  const outTok = Math.min(request2.maxTokens ?? EXPECTED_OUTPUT_TOKENS, EXPECTED_OUTPUT_TOKENS);
+  return freshTok * target.costPerMTok.input + cachedTok * cacheReadRate(target.costPerMTok) + outTok * target.costPerMTok.output;
+}
+function healthScore(h) {
+  const base = 1 / (1 + (h?.consecutiveFailures ?? 0));
+  return h?.breakerState === "open" || h?.breakerState === "halfOpen" ? base * 0.5 : base;
 }
 function score(pairs, input) {
-  const { snapshot, now } = input;
+  const { snapshot, now, load } = input;
   const w = snapshot.settings.weights;
   const tiers = pairs.map((p) => p.target.tier);
   const minTier = Math.min(...tiers);
   const maxTier = Math.max(...tiers);
-  const costs = pairs.map((p) => blendedCost(p.target.costPerMTok.input, p.target.costPerMTok.output));
-  const minCost = Math.min(...costs);
-  const maxCost = Math.max(...costs);
-  const latencies = pairs.flatMap((p) => {
+  const costs = pairs.map((p) => requestCost(p.target, input.request));
+  const bestCost = bestPositive(costs);
+  const bestLatency = bestPositive(pairs.flatMap((p) => {
     const h = snapshot.health.get(healthKey(p.credential.id, p.target.model));
     return h?.ewmaTtftMs != null ? [h.ewmaTtftMs] : [];
-  });
-  const minLatency = latencies.length > 0 ? Math.min(...latencies) : 0;
-  const maxLatency = latencies.length > 0 ? Math.max(...latencies) : 0;
-  const idleTimes = pairs.map((p) => {
-    const h = snapshot.health.get(healthKey(p.credential.id, p.target.model));
-    return h?.lastUsedAt == null ? Number.POSITIVE_INFINITY : now - h.lastUsedAt;
-  });
-  const finiteIdle = idleTimes.filter(Number.isFinite);
-  const maxIdle = finiteIdle.length > 0 ? Math.max(...finiteIdle) : 1;
+  }));
   return pairs.map((pair, i) => {
-    const h = snapshot.health.get(healthKey(pair.credential.id, pair.target.model));
+    const key = healthKey(pair.credential.id, pair.target.model);
+    const h = snapshot.health.get(key);
     const tier = lowerIsBetter(pair.target.tier, minTier, maxTier);
-    let health = 1 / (1 + (h?.consecutiveFailures ?? 0));
-    if (h?.breakerState === "open" || h?.breakerState === "halfOpen")
-      health *= 0.5;
+    const inflight = load.get(key) ?? 0;
+    const loadTerm = 1 / (1 + inflight);
+    const health = healthScore(h);
     const quota = quotaHeadroom(pair.credential, snapshot.quota.get(pair.credential.id) ?? [], now, snapshot.settings.quotaPollIntervalMs);
-    const cost = maxCost === 0 ? UNKNOWN : lowerIsBetter(costs[i], minCost, maxCost);
-    const latency = h?.ewmaTtftMs == null ? UNKNOWN : lowerIsBetter(h.ewmaTtftMs, minLatency, maxLatency);
-    const idle = idleTimes[i];
-    const recency = Number.isFinite(idle) ? Math.min(1, idle / (maxIdle || 1)) : 1;
-    const reasons = { tier, health, quota, cost, latency, recency };
-    const base = tier * w.tier + health * w.health + quota * w.quota + cost * w.cost + latency * w.latency + recency * w.recency;
+    const ownCost = costs[i];
+    const cost = ownCost <= 0 || bestCost === null ? UNKNOWN : ratio(ownCost, bestCost);
+    const latency = h?.ewmaTtftMs == null || h.ewmaTtftMs <= 0 || bestLatency === null ? UNKNOWN : ratio(h.ewmaTtftMs, bestLatency);
+    const reasons = { tier, health, quota, cost, latency, load: loadTerm };
+    const base = tier * w.tier + health * w.health + quota * w.quota + cost * w.cost + latency * w.latency + loadTerm * w.load;
     return {
       credential: pair.credential,
       target: pair.target,
@@ -17298,8 +17568,8 @@ function score(pairs, input) {
 var PROVIDERS = new Set(Object.keys(PROVIDER_CAPABILITIES));
 
 // packages/router/src/index.ts
-function weightedShuffle(candidates, rand, headroom) {
-  const drawWeight = (c) => c.credential.weight * c.target.weight * headroom(c);
+function weightedShuffle(candidates, rand, headroom, health) {
+  const drawWeight = (c) => c.credential.weight * c.target.weight * headroom(c) * health(c);
   const total = candidates.reduce((sum, c) => sum + drawWeight(c), 0);
   if (total <= 0)
     return [...candidates].sort((a, b) => b.score - a.score);
@@ -17322,6 +17592,8 @@ function rank(input) {
     return { candidates: [], excluded };
   const scored = score(pairs, input);
   const headroom = (c) => quotaHeadroom(c.credential, input.snapshot.quota.get(c.credential.id) ?? [], input.now, input.snapshot.settings.quotaPollIntervalMs);
+  const health = (c) => healthScore(input.snapshot.health.get(healthKey(c.credential.id, c.target.model)));
+  const inflight = (c) => input.load.get(healthKey(c.credential.id, c.target.model)) ?? 0;
   switch (input.model.strategy) {
     case "priority":
       scored.sort((a, b) => a.target.tier - b.target.tier || b.score - a.score);
@@ -17332,11 +17604,11 @@ function rank(input) {
         return h?.lastUsedAt == null ? Number.POSITIVE_INFINITY : input.now - h.lastUsedAt;
       };
       const spent = (c) => headroom(c) < QUOTA_FLOOR ? 1 : 0;
-      scored.sort((a, b) => spent(a) - spent(b) || idle(b) - idle(a));
+      scored.sort((a, b) => spent(a) - spent(b) || inflight(a) - inflight(b) || idle(b) - idle(a));
       break;
     }
     case "weighted":
-      return { candidates: weightedShuffle(scored, input.rand, headroom), excluded };
+      return { candidates: weightedShuffle(scored, input.rand, headroom, health), excluded };
     case "score":
       scored.sort((a, b) => b.score - a.score);
       break;
@@ -17369,7 +17641,7 @@ async function dryRun(deps, modelId, input) {
     } : {},
     ...need.reasoning ? { reasoning: { mode: "adaptive" } } : {}
   };
-  const result = rank({ request: probe, model, snapshot, now, rand: 0 });
+  const result = rank({ request: probe, model, snapshot, now, rand: 0, load: new Map });
   return {
     modelId: model.id,
     strategy: model.strategy,
@@ -17426,21 +17698,24 @@ function unhex(s) {
     out[i] = Number.parseInt(s.slice(i * 2, i * 2 + 2), 16);
   return out;
 }
-// packages/store/src/types.ts
-var DEFAULT_SETTINGS = {
-  weights: { tier: 10, health: 3, quota: 2, cost: 1, latency: 1, recency: 0.5 },
-  maxAttempts: 3,
-  requestDeadlineMs: 120000,
-  breakerThreshold: 3,
-  breakerCooldownMs: 30000,
-  logRetentionDays: 30,
-  quotaPollIntervalMs: 300000,
-  rtkEnabled: false
-};
-
 // packages/store/src/sqlite/config.ts
 var SETTINGS_KEY = "settings";
 var ADMIN_HASH_KEY = "adminPasswordHash";
+function knownWeights(stored) {
+  const d = DEFAULT_SETTINGS.weights;
+  const pick2 = (key) => {
+    const value = stored?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : d[key];
+  };
+  return {
+    tier: pick2("tier"),
+    health: pick2("health"),
+    quota: pick2("quota"),
+    load: pick2("load"),
+    cost: pick2("cost"),
+    latency: pick2("latency")
+  };
+}
 function createConfigRepo(db, emit2 = () => {}) {
   const readRaw = (key) => db.query("SELECT value FROM settings WHERE key = ?").get(key)?.value ?? null;
   const writeRaw = (key, value) => {
@@ -17478,7 +17753,7 @@ function createConfigRepo(db, emit2 = () => {}) {
           ...DEFAULT_SETTINGS,
           ...stored,
           rtkEnabled: stored.rtkEnabled === true,
-          weights: { ...DEFAULT_SETTINGS.weights, ...stored.weights }
+          weights: knownWeights(stored.weights)
         };
       } catch {
         return DEFAULT_SETTINGS;
@@ -18515,6 +18790,11 @@ async function putModel(store, id, input) {
   if (model.id !== id) {
     throw new GatewayError("BAD_REQUEST", "model id in the path and body must match");
   }
+  const customEndpointIds = new Set((await store.credentials.list()).filter((credential) => credential.provider === "custom").map((credential) => credential.providerData.endpointId).filter((endpointId) => typeof endpointId === "string"));
+  const missing = model.targets.find((target) => target.provider === "custom" && (target.endpointId === undefined || !customEndpointIds.has(target.endpointId)));
+  if (missing !== undefined) {
+    throw new GatewayError("BAD_REQUEST", `custom endpoint "${missing.endpointId}" has no credential`);
+  }
   await store.config.putModel(model);
 }
 async function removeModel(store, id) {
@@ -18637,7 +18917,7 @@ var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL3 = "https://auth.openai.com/oauth/token";
 var SCOPES2 = "openid profile email offline_access";
 var USAGE_URL3 = "https://chatgpt.com/backend-api/wham/usage";
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function nonBlankStringOrNull(value) {
@@ -18654,19 +18934,19 @@ function decodeClaims(idToken) {
   }
   try {
     const json5 = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!isRecord2(json5))
+    if (!isRecord3(json5))
       return { email: null, accountId: null };
     const auth = json5["https://api.openai.com/auth"];
     return {
       email: typeof json5.email === "string" ? json5.email : null,
-      accountId: isRecord2(auth) ? nonBlankStringOrNull(auth.chatgpt_account_id) : null
+      accountId: isRecord3(auth) ? nonBlankStringOrNull(auth.chatgpt_account_id) : null
     };
   } catch {
     return { email: null, accountId: null };
   }
 }
 function parseTokenResponse(value) {
-  if (!isRecord2(value) || typeof value.access_token !== "string")
+  if (!isRecord3(value) || typeof value.access_token !== "string")
     return null;
   return {
     accessToken: value.access_token,
@@ -18801,6 +19081,9 @@ function createRefresher(deps) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
     const provider = deps.providers[credential.provider];
+    if (provider === undefined) {
+      throw new GatewayError("BAD_REQUEST", "provider does not support OAuth refresh");
+    }
     logger2.debug("refreshing credential", {
       provider: credential.provider,
       credentialId: credential.id
@@ -19520,7 +19803,8 @@ var console_ = {
 var PROVIDER_TONE = {
   anthropic: "magenta",
   openai: "green",
-  kimi: "blue"
+  kimi: "blue",
+  custom: "cyan"
 };
 function provider(ctx, id) {
   return paint(ctx, PROVIDER_TONE[id], id);
@@ -19684,21 +19968,36 @@ var credentialsRefresh = {
   }
 };
 var credentialsAddKey = {
-  usage: "credentials add-key <provider> [--label L]",
+  usage: "credentials add-key <provider> [--label L] [--endpoint-id ID --endpoint-label L --origin URL --protocol P]",
   summary: "Store a provider API key, read from a prompt or stdin",
-  options: { label: { type: "string" } },
+  options: {
+    label: { type: "string" },
+    "endpoint-id": { type: "string" },
+    "endpoint-label": { type: "string" },
+    origin: { type: "string" },
+    protocol: { type: "string" }
+  },
   async run(args, { ctx, writer, prompt }) {
     const providerId = requirePositional(args, 0, "provider");
     if (!isProviderId(providerId)) {
-      throw new UsageError("provider must be one of anthropic, openai, kimi");
+      throw new UsageError("provider must be one of anthropic, openai, kimi, custom");
     }
+    const protocolFlag = stringFlag(args.values, "protocol");
+    const protocol = protocolFlag === "chat-completions" ? "chat_completions" : protocolFlag === "responses" ? "responses" : protocolFlag;
     const key = await prompt.secret(`${providerId} API key: `);
     if (key.length === 0)
       throw new CliError("no API key given");
-    const created = await createApiKeyCredential(await ctx.store(), {
+    const store = await ctx.store();
+    const endpointId = stringFlag(args.values, "endpoint-id");
+    const existingEndpoint = providerId === "custom" && endpointId !== undefined ? (await listCredentials(store)).find((credential) => credential.provider === "custom" && credential.providerData.endpointId === endpointId.trim()) : undefined;
+    const created = await createApiKeyCredential(store, {
       provider: providerId,
       apiKey: key,
-      label: stringFlag(args.values, "label")
+      label: stringFlag(args.values, "label"),
+      endpointId,
+      endpointLabel: stringFlag(args.values, "endpoint-label") ?? existingEndpoint?.providerData.endpointLabel,
+      origin: stringFlag(args.values, "origin") ?? existingEndpoint?.providerData.origin,
+      protocol: protocol ?? existingEndpoint?.providerData.protocol
     });
     emit(ctx, writer, { id: created.id, provider: created.provider }, () => `stored ${created.provider} api key as ${created.id}`);
   }