responses-proxy 0.1.0

package/dist/runtime-provider-repository.js

@@ -0,0 +1,1742 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import BetterSqlite3 from "better-sqlite3";
+import { cloneProviderRequestParameterPolicy, parseProviderRequestParameterPolicyInput, resolveMaxOutputTokensRule, } from "./provider-request-parameters.js";
+import { cloneRtkLayerPolicy, parseRtkLayerPolicyInput, } from "./rtk-layer.js";
+import { resolveClientTokenWindowStart } from "./client-token-limits.js";
+export { resolveClientTokenWindowStart } from "./client-token-limits.js";
+import { CODEWHISPERER_GENERATE_PATH, DEFAULT_KIRO_MODEL_ALIASES, } from "./kiro-codewhisperer.js";
+export const BUILTIN_CLIENT_ROUTE_KEYS = ["default"];
+export class RuntimeProviderError extends Error {
+    statusCode;
+    body;
+    constructor(statusCode, body) {
+        super(body.message);
+        this.statusCode = statusCode;
+        this.body = body;
+    }
+}
+export class RuntimeProviderRepository {
+    dbFile;
+    legacyStateFile;
+    db;
+    providerPresets;
+    activeProviderId;
+    modelOverrides;
+    clientRoutes;
+    clientRouteRtkPolicies;
+    clientRouteApiKeys;
+    constructor(dbFile, legacyStateFile, db, state, baseProviders) {
+        this.dbFile = dbFile;
+        this.legacyStateFile = legacyStateFile;
+        this.db = db;
+        const seededProviders = state.providers.length
+            ? mergeBaseProviders(state.providers, baseProviders)
+            : [...baseProviders];
+        this.providerPresets = ensureUniqueProviderIds(seededProviders.map((provider) => migrateLegacyProvider(provider)));
+        this.activeProviderId = this.resolveActiveProviderId(state.activeProviderId);
+        this.modelOverrides = this.resolveModelOverrides(state.modelOverrides, state.modelOverride);
+        this.clientRoutes = this.resolveClientRoutes(state.clientRoutes);
+        this.clientRouteRtkPolicies = this.resolveClientRouteRtkPolicies(state.clientRouteRtkPolicies);
+        this.clientRouteApiKeys = this.resolveClientRouteApiKeys(state.clientRouteApiKeys);
+    }
+    static async create(options) {
+        const db = openDatabase(options.dbFile);
+        ensureSchema(db);
+        backfillLegacyRequestParameterPolicies(db);
+        const stateFromDb = readStateFromDatabase(db);
+        const hasDbState = stateFromDb.providers.length > 0;
+        const legacyState = hasDbState ? undefined : loadLegacyState(options.legacyStateFile);
+        const initialState = hasDbState ? stateFromDb : legacyState ?? { providers: [] };
+        const repository = new RuntimeProviderRepository(options.dbFile, options.legacyStateFile, db, initialState, options.baseProviders);
+        if (!hasDbState || shouldPersistSeededProviders(initialState.providers, repository.providerPresets)) {
+            repository.persistRuntimeState();
+        }
+        return repository;
+    }
+    getDatabase() {
+        return this.db;
+    }
+    getActiveProviderId() {
+        return this.activeProviderId;
+    }
+    getModelOverride(client = "default") {
+        return this.modelOverrides[client];
+    }
+    getClientRoutesForUi() {
+        return this.listClientRouteKeys().map((key) => {
+            const providerId = this.clientRoutes[key] ?? null;
+            const provider = providerId ? this.getProvider(providerId) : undefined;
+            return {
+                key,
+                providerId,
+                providerName: provider?.name ?? null,
+                modelOverride: this.getModelOverride(key) ?? null,
+                rtkPolicy: cloneRtkLayerPolicy(this.getClientRouteRtkPolicy(key)) ?? null,
+                apiKeys: [...(this.clientRouteApiKeys[key] ?? [])],
+            };
+        });
+    }
+    getProviderIdForClient(client) {
+        const preferredId = this.clientRoutes[client] ?? this.activeProviderId;
+        return this.resolveActiveProviderId(preferredId);
+    }
+    getProviderForClient(client) {
+        return this.getProvider(this.getProviderIdForClient(client));
+    }
+    getClientRouteRtkPolicy(client = "default") {
+        return this.clientRouteRtkPolicies[normalizeClientRouteKey(client)];
+    }
+    getClientRouteApiKeys(client = "default") {
+        return [...(this.clientRouteApiKeys[normalizeClientRouteKey(client)] ?? [])];
+    }
+    getClientTokenLimit(client) {
+        const row = this.db
+            .prepare(`SELECT
+          client_route,
+          enabled,
+          token_limit,
+          window_type,
+          window_size_seconds,
+          hard_block,
+          created_at,
+          updated_at
+        FROM client_token_limits
+        WHERE client_route = ?`)
+            .get(normalizeClientRouteKey(client));
+        return row ? mapClientTokenLimitRow(row) : undefined;
+    }
+    getClientTokenUsage(client, now = new Date()) {
+        const clientRoute = normalizeClientRouteKey(client);
+        const config = this.getClientTokenLimit(clientRoute);
+        const windowStart = resolveClientTokenWindowStart(now, {
+            windowType: config?.windowType ?? "daily",
+            windowSizeSeconds: config?.windowSizeSeconds,
+        });
+        const row = this.db
+            .prepare(`SELECT
+          client_route,
+          window_start,
+          input_tokens,
+          output_tokens,
+          total_tokens,
+          updated_at
+        FROM client_token_usage
+        WHERE client_route = ? AND window_start = ?`)
+            .get(clientRoute, windowStart);
+        return (row ? mapClientTokenUsageRow(row) : buildEmptyClientTokenUsageSnapshot(clientRoute, windowStart));
+    }
+    listClientTokenLimitsForUi(now = new Date()) {
+        const rows = queryRows(this.db, `SELECT
+        client_route,
+        enabled,
+        token_limit,
+        window_type,
+        window_size_seconds,
+        hard_block,
+        created_at,
+        updated_at
+      FROM client_token_limits
+      ORDER BY client_route`);
+        const configByClientRoute = new Map(rows.map((row) => {
+            const config = mapClientTokenLimitRow(row);
+            return [config.clientRoute, config];
+        }));
+        return this.listClientRouteKeys().map((clientRoute) => {
+            const config = configByClientRoute.get(clientRoute) ?? null;
+            return {
+                clientRoute,
+                config,
+                usage: this.getClientTokenUsage(clientRoute, now),
+            };
+        });
+    }
+    setClientTokenLimit(client, input) {
+        const clientRoute = normalizeClientRouteKey(client);
+        const tokenLimit = Math.max(1, Math.floor(input.tokenLimit));
+        const windowType = normalizeClientTokenWindowType(input.windowType);
+        const windowSizeSeconds = windowType === "fixed" && input.windowSizeSeconds && input.windowSizeSeconds > 0
+            ? Math.floor(input.windowSizeSeconds)
+            : undefined;
+        const now = new Date().toISOString();
+        const existing = this.getClientTokenLimit(clientRoute);
+        this.db
+            .prepare(`INSERT INTO client_token_limits (
+          client_route,
+          enabled,
+          token_limit,
+          window_type,
+          window_size_seconds,
+          hard_block,
+          created_at,
+          updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(client_route) DO UPDATE SET
+          enabled = excluded.enabled,
+          token_limit = excluded.token_limit,
+          window_type = excluded.window_type,
+          window_size_seconds = excluded.window_size_seconds,
+          hard_block = excluded.hard_block,
+          updated_at = excluded.updated_at`)
+            .run(clientRoute, input.enabled ? 1 : 0, tokenLimit, windowType, windowSizeSeconds ?? null, input.hardBlock ? 1 : 0, existing?.createdAt ?? now, now);
+        return this.getClientTokenLimit(clientRoute);
+    }
+    deleteClientTokenLimit(client) {
+        const result = this.db
+            .prepare("DELETE FROM client_token_limits WHERE client_route = ?")
+            .run(normalizeClientRouteKey(client));
+        return result.changes > 0;
+    }
+    incrementClientTokenUsage(client, usage, now = new Date()) {
+        const clientRoute = normalizeClientRouteKey(client);
+        const config = this.getClientTokenLimit(clientRoute);
+        const windowStart = resolveClientTokenWindowStart(now, {
+            windowType: config?.windowType ?? "daily",
+            windowSizeSeconds: config?.windowSizeSeconds,
+        });
+        const inputTokens = normalizeNonNegativeInteger(usage.inputTokens);
+        const outputTokens = normalizeNonNegativeInteger(usage.outputTokens);
+        const totalTokens = normalizeNonNegativeInteger(usage.totalTokens);
+        const updatedAt = now.toISOString();
+        this.db.transaction(() => {
+            this.db
+                .prepare(`INSERT INTO client_token_usage (
+            client_route,
+            window_start,
+            input_tokens,
+            output_tokens,
+            total_tokens,
+            updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
+          ON CONFLICT(client_route, window_start) DO UPDATE SET
+            input_tokens = input_tokens + excluded.input_tokens,
+            output_tokens = output_tokens + excluded.output_tokens,
+            total_tokens = total_tokens + excluded.total_tokens,
+            updated_at = excluded.updated_at`)
+                .run(clientRoute, windowStart, inputTokens, outputTokens, totalTokens, updatedAt);
+        })();
+        return this.getClientTokenUsage(clientRoute, now);
+    }
+    resetClientTokenUsage(client, now = new Date()) {
+        const clientRoute = normalizeClientRouteKey(client);
+        const config = this.getClientTokenLimit(clientRoute);
+        const windowStart = resolveClientTokenWindowStart(now, {
+            windowType: config?.windowType ?? "daily",
+            windowSizeSeconds: config?.windowSizeSeconds,
+        });
+        const updatedAt = now.toISOString();
+        this.db.transaction(() => {
+            this.db
+                .prepare(`DELETE FROM client_token_usage
+          WHERE client_route = ? AND window_start = ?`)
+                .run(clientRoute, windowStart);
+            this.db
+                .prepare(`INSERT INTO client_token_usage (
+            client_route,
+            window_start,
+            input_tokens,
+            output_tokens,
+            total_tokens,
+            updated_at
+          ) VALUES (?, ?, 0, 0, 0, ?)`)
+                .run(clientRoute, windowStart, updatedAt);
+        })();
+        return this.getClientTokenUsage(clientRoute, now);
+    }
+    findClientRouteByApiKey(apiKey) {
+        const normalizedApiKey = typeof apiKey === "string" ? apiKey.trim() : "";
+        if (!normalizedApiKey) {
+            return undefined;
+        }
+        for (const clientRoute of this.listClientRouteKeys()) {
+            if ((this.clientRouteApiKeys[clientRoute] ?? []).includes(normalizedApiKey)) {
+                return clientRoute;
+            }
+        }
+        return undefined;
+    }
+    setClientRoute(client, providerId) {
+        const routeKey = normalizeClientRouteKey(client);
+        const normalizedProviderId = typeof providerId === "string" ? providerId.trim() : "";
+        if (normalizedProviderId) {
+            this.getProviderOrThrow(normalizedProviderId);
+            this.clientRoutes[routeKey] = normalizedProviderId;
+        }
+        else {
+            delete this.clientRoutes[routeKey];
+        }
+        this.persistRuntimeState();
+        return this.getProviderIdForClient(routeKey);
+    }
+    setModelOverride(client, model) {
+        const routeKey = normalizeClientRouteKey(client);
+        const normalized = model?.trim() ? model.trim() : undefined;
+        if (normalized) {
+            this.modelOverrides[routeKey] = normalized;
+        }
+        else {
+            delete this.modelOverrides[routeKey];
+        }
+        this.persistRuntimeState();
+        return this.getModelOverride(routeKey);
+    }
+    setClientRouteRtkPolicy(client, policy) {
+        const routeKey = normalizeClientRouteKey(client);
+        const normalized = cloneRtkLayerPolicy(policy);
+        if (normalized &&
+            (normalized.enabled !== undefined ||
+                normalized.toolOutputEnabled !== undefined ||
+                normalized.maxChars !== undefined ||
+                normalized.maxLines !== undefined)) {
+            this.clientRouteRtkPolicies[routeKey] = normalized;
+        }
+        else {
+            delete this.clientRouteRtkPolicies[routeKey];
+        }
+        this.persistRuntimeState();
+        return this.getClientRouteRtkPolicy(routeKey);
+    }
+    setClientRouteApiKeys(client, apiKeys) {
+        const routeKey = normalizeClientRouteKey(client);
+        const normalized = normalizeApiKeys(apiKeys ?? []);
+        if (normalized.length > 0) {
+            this.clientRouteApiKeys[routeKey] = normalized;
+        }
+        else {
+            delete this.clientRouteApiKeys[routeKey];
+        }
+        this.persistRuntimeState();
+        return this.getClientRouteApiKeys(routeKey);
+    }
+    addClientRoute(client, providerId) {
+        const routeKey = normalizeClientRouteKey(client);
+        if (this.listClientRouteKeys().includes(routeKey)) {
+            throw new RuntimeProviderError(409, {
+                type: "validation_error",
+                code: "CLIENT_ROUTE_ALREADY_EXISTS",
+                message: "Client route already exists",
+            });
+        }
+        return this.setClientRoute(routeKey, providerId || this.activeProviderId);
+    }
+    deleteClientRoute(client) {
+        const routeKey = normalizeClientRouteKey(client);
+        if (routeKey === "default") {
+            throw new RuntimeProviderError(400, {
+                type: "validation_error",
+                code: "DEFAULT_CLIENT_ROUTE_REQUIRED",
+                message: "The default client route cannot be deleted",
+            });
+        }
+        delete this.clientRoutes[routeKey];
+        delete this.modelOverrides[routeKey];
+        delete this.clientRouteRtkPolicies[routeKey];
+        delete this.clientRouteApiKeys[routeKey];
+        this.deleteClientTokenLimit(routeKey);
+        this.db.prepare("DELETE FROM client_token_usage WHERE client_route = ?").run(routeKey);
+        this.persistRuntimeState();
+    }
+    listClientRouteKeys() {
+        return [
+            ...new Set([
+                ...BUILTIN_CLIENT_ROUTE_KEYS,
+                ...Object.keys(this.clientRoutes),
+                ...Object.keys(this.modelOverrides),
+                ...Object.keys(this.clientRouteRtkPolicies),
+                ...Object.keys(this.clientRouteApiKeys),
+            ]),
+        ];
+    }
+    buildFallbackRouteOrder(currentClient) {
+        const normalizedCurrent = normalizeClientRouteKey(currentClient);
+        const prioritizedRoutes = normalizedCurrent === "codex"
+            ? ["default", "hermes", "codex"]
+            : normalizedCurrent === "default"
+                ? ["codex", "hermes", "default"]
+                : ["codex", "default", "hermes"];
+        return [
+            ...new Set([...prioritizedRoutes, ...this.listClientRouteKeys()].filter((routeKey) => routeKey !== normalizedCurrent)),
+        ];
+    }
+    resolveClientRouteApiKeys(value) {
+        const next = sanitizeClientRouteApiKeys(value);
+        delete next.default;
+        return next;
+    }
+    listProviders() {
+        return [...this.providerPresets];
+    }
+    listProvidersForUi() {
+        return this.providerPresets
+            .filter((provider) => !provider.capabilities.systemManaged)
+            .map((provider) => this.serializeProviderForUi(provider));
+    }
+    listProviderOptionsForClientSetup() {
+        return this.providerPresets.map((provider) => this.serializeProviderOptionForClientSetup(provider));
+    }
+    getProvider(id) {
+        return this.providerPresets.find((provider) => provider.id === id);
+    }
+    findProviderByProviderApiKey(apiKey) {
+        const normalized = typeof apiKey === "string" ? apiKey.trim() : "";
+        if (!normalized) {
+            return undefined;
+        }
+        return this.providerPresets.find((provider) => provider.providerApiKeys.includes(normalized));
+    }
+    findProviderByAccessKey(apiKey) {
+        return this.findProvidersByAccessKey(apiKey)[0];
+    }
+    findProvidersByAccessKey(apiKey) {
+        const normalized = typeof apiKey === "string" ? apiKey.trim() : "";
+        if (!normalized) {
+            return [];
+        }
+        const clientRoute = this.findClientRouteByApiKey(normalized);
+        if (clientRoute) {
+            const provider = this.getProviderForClient(clientRoute);
+            return provider ? [provider] : [];
+        }
+        return this.providerPresets.filter((provider) => provider.providerApiKeys.includes(normalized));
+    }
+    getProviderOrThrow(id) {
+        const provider = this.getProvider(id);
+        if (!provider) {
+            throw new RuntimeProviderError(404, {
+                type: "not_found",
+                code: "PROVIDER_NOT_FOUND",
+                message: "Provider was not found",
+            });
+        }
+        return provider;
+    }
+    getProviderForUiOrThrow(id) {
+        return this.serializeProviderForUi(this.getProviderOrThrow(id));
+    }
+    getActiveProvider() {
+        return this.getProviderForClient("default");
+    }
+    getFallbackProvider(client = "default", primaryProviderId) {
+        const preferredRouteOrder = this.buildFallbackRouteOrder(client);
+        const excludedProviderIds = new Set();
+        const normalizedPrimaryProviderId = typeof primaryProviderId === "string" ? primaryProviderId.trim() : "";
+        if (normalizedPrimaryProviderId) {
+            excludedProviderIds.add(normalizedPrimaryProviderId);
+        }
+        for (const routeKey of preferredRouteOrder) {
+            const provider = this.getProviderForClient(routeKey);
+            if (!provider || excludedProviderIds.has(provider.id)) {
+                continue;
+            }
+            return provider;
+        }
+        return undefined;
+    }
+    selectProvider(id) {
+        const provider = this.getProvider(id);
+        if (!provider) {
+            throw new RuntimeProviderError(400, {
+                type: "validation_error",
+                code: "INVALID_PROVIDER_ID",
+                message: "providerId must match one of the configured runtime providers",
+            });
+        }
+        this.activeProviderId = provider.id;
+        this.clientRoutes.default = provider.id;
+        this.persistRuntimeState();
+        return provider;
+    }
+    createProvider(input) {
+        const validated = this.parseProviderInput(input);
+        this.ensureNoDuplicate(validated);
+        const now = new Date().toISOString();
+        const provider = {
+            id: validated.id ?? `custom-${randomUUID().slice(0, 8)}`,
+            name: validated.name,
+            baseUrl: validated.baseUrl,
+            responsesUrl: validated.responsesUrl,
+            authMode: validated.authMode,
+            chatgptAccountId: validated.chatgptAccountId,
+            providerApiKeys: validated.providerApiKeys,
+            clientApiKeys: validated.clientApiKeys,
+            capabilities: validated.capabilities,
+            enabled: validated.enabled ?? false,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.providerPresets = [...this.providerPresets, provider];
+        if (!this.activeProviderId) {
+            this.activeProviderId = provider.id;
+        }
+        if (!this.clientRoutes.default && this.activeProviderId) {
+            this.clientRoutes.default = this.activeProviderId;
+        }
+        this.persistRuntimeState();
+        return provider;
+    }
+    updateProvider(id, input) {
+        const existing = this.getProviderOrThrow(id);
+        const validated = this.parseProviderInput(input);
+        this.ensureNoDuplicate(validated, id);
+        const updated = {
+            ...existing,
+            name: validated.name,
+            baseUrl: validated.baseUrl,
+            responsesUrl: validated.responsesUrl,
+            authMode: validated.authMode,
+            chatgptAccountId: validated.chatgptAccountId,
+            providerApiKeys: validated.providerApiKeys,
+            clientApiKeys: validated.clientApiKeys,
+            capabilities: validated.capabilities,
+            enabled: validated.enabled ?? existing.enabled,
+            updatedAt: new Date().toISOString(),
+        };
+        this.providerPresets = this.providerPresets.map((provider) => provider.id === id ? updated : provider);
+        this.persistRuntimeState();
+        return updated;
+    }
+    deleteProvider(id) {
+        this.getProviderOrThrow(id);
+        this.providerPresets = this.providerPresets.filter((provider) => provider.id !== id);
+        for (const key of this.listClientRouteKeys()) {
+            if (this.clientRoutes[key] === id) {
+                delete this.clientRoutes[key];
+            }
+        }
+        if (this.activeProviderId === id) {
+            this.activeProviderId = this.resolveActiveProviderId();
+            if (this.activeProviderId) {
+                this.clientRoutes.default = this.activeProviderId;
+            }
+            else {
+                delete this.clientRoutes.default;
+            }
+        }
+        this.persistRuntimeState();
+        return this.activeProviderId;
+    }
+    ensureNoDuplicate(input, ignoreId) {
+        const duplicate = this.providerPresets.find((provider) => provider.id !== ignoreId &&
+            (provider.baseUrl === input.baseUrl ||
+                normalizeProviderName(provider.name) === normalizeProviderName(input.name)));
+        if (duplicate) {
+            throw new RuntimeProviderError(409, {
+                type: "validation_error",
+                code: "PROVIDER_ALREADY_EXISTS",
+                message: "A provider with the same name or base URL already exists",
+            });
+        }
+        const conflictingProviderApiKey = input.providerApiKeys.find((apiKey) => this.providerPresets.some((provider) => provider.id !== ignoreId && provider.providerApiKeys.includes(apiKey)));
+        if (conflictingProviderApiKey) {
+            throw new RuntimeProviderError(409, {
+                type: "validation_error",
+                code: "PROVIDER_API_KEY_ALREADY_EXISTS",
+                message: "A provider API key is already assigned to another provider",
+            });
+        }
+    }
+    parseProviderInput(body) {
+        const name = typeof body.name === "string" ? body.name.trim() : "";
+        const id = typeof body.id === "string" && body.id.trim() ? body.id.trim() : undefined;
+        const baseUrl = typeof body.baseUrl === "string" ? body.baseUrl.trim() : "";
+        const responsesUrl = typeof body.responsesUrl === "string" && body.responsesUrl.trim()
+            ? body.responsesUrl.trim()
+            : undefined;
+        const providerApiKeys = normalizeApiKeysInput(body.providerApiKeys, body.apiKeys, body.apiKey);
+        const authMode = parseRuntimeProviderAuthMode(body.authMode);
+        const chatgptAccountId = typeof body.chatgptAccountId === "string" && body.chatgptAccountId.trim()
+            ? body.chatgptAccountId.trim()
+            : undefined;
+        if (!name) {
+            throw new RuntimeProviderError(400, {
+                type: "validation_error",
+                code: "INVALID_NAME",
+                message: "name is required",
+            });
+        }
+        let parsedBaseUrl;
+        let parsedResponsesUrl;
+        try {
+            parsedBaseUrl = new URL(baseUrl);
+        }
+        catch {
+            throw new RuntimeProviderError(400, {
+                type: "validation_error",
+                code: "INVALID_BASE_URL",
+                message: "baseUrl must be a valid URL",
+            });
+        }
+        if (responsesUrl) {
+            try {
+                parsedResponsesUrl = new URL(responsesUrl);
+            }
+            catch {
+                throw new RuntimeProviderError(400, {
+                    type: "validation_error",
+                    code: "INVALID_RESPONSES_URL",
+                    message: "responsesUrl must be a valid URL",
+                });
+            }
+        }
+        return {
+            name,
+            id,
+            baseUrl: parsedBaseUrl.toString().replace(/\/+$/, ""),
+            responsesUrl: (parsedResponsesUrl ?? new URL(toResponsesUrl(parsedBaseUrl.toString().replace(/\/+$/, ""))))
+                .toString()
+                .replace(/\/+$/, ""),
+            authMode,
+            chatgptAccountId,
+            providerApiKeys,
+            clientApiKeys: [],
+            capabilities: parseProviderCapabilitiesInput(body.capabilities),
+            enabled: body.enabled === false || body.enabled === "false" ? false : body.enabled === true || body.enabled === "true" ? true : undefined,
+        };
+    }
+    serializeProviderForUi(provider) {
+        return {
+            id: provider.id,
+            name: provider.name,
+            baseUrl: provider.baseUrl,
+            hasProviderApiKey: provider.providerApiKeys.length > 0,
+            providerApiKeys: [...provider.providerApiKeys],
+            providerApiKeysCount: provider.providerApiKeys.length,
+            authMode: parseRuntimeProviderAuthMode(provider.authMode),
+            chatgptAccountId: provider.chatgptAccountId ?? null,
+            capabilities: cloneCapabilities(provider.capabilities),
+            enabled: provider.enabled !== false,
+            createdAt: provider.createdAt ?? null,
+            updatedAt: provider.updatedAt ?? null,
+        };
+    }
+    serializeProviderOptionForClientSetup(provider) {
+        const view = this.serializeProviderForUi(provider);
+        return {
+            ...view,
+            providerApiKeys: [],
+        };
+    }
+    resolveActiveProviderId(preferredId) {
+        if (preferredId && this.providerPresets.some((provider) => provider.id === preferredId)) {
+            return preferredId;
+        }
+        return this.providerPresets[0]?.id ?? "";
+    }
+    resolveClientRoutes(routes) {
+        const resolved = sanitizeClientRoutes(routes);
+        if (!resolved.default && this.activeProviderId) {
+            resolved.default = this.activeProviderId;
+        }
+        return Object.fromEntries(Object.entries(resolved).filter(([, providerId]) => typeof providerId === "string" &&
+            this.providerPresets.some((provider) => provider.id === providerId)));
+    }
+    resolveModelOverrides(overrides, legacyDefault) {
+        const resolved = sanitizeModelOverrides(overrides);
+        if (!resolved.default && typeof legacyDefault === "string" && legacyDefault.trim()) {
+            resolved.default = legacyDefault.trim();
+        }
+        return resolved;
+    }
+    resolveClientRouteRtkPolicies(policies) {
+        if (!policies) {
+            return {};
+        }
+        return Object.fromEntries(Object.entries(policies)
+            .map(([clientRoute, policy]) => [normalizeClientRouteKey(clientRoute), cloneRtkLayerPolicy(policy)])
+            .filter((entry) => Boolean(entry[1])));
+    }
+    persistRuntimeState() {
+        this.db.exec("BEGIN");
+        try {
+            this.db.exec("DELETE FROM provider_api_keys");
+            this.db.exec("DELETE FROM client_api_keys");
+            this.db.exec("DELETE FROM providers");
+            this.db.exec("DELETE FROM client_routes");
+            this.db.exec("DELETE FROM model_overrides");
+            this.db.exec("DELETE FROM client_route_rtk_policies");
+            this.db.exec("DELETE FROM app_state");
+            const insertProvider = this.db.prepare(`
+        INSERT INTO providers (
+          id,
+          name,
+          base_url,
+          responses_url,
+          auth_mode,
+          chatgpt_account_id,
+          owned_by,
+          usage_check_enabled,
+          usage_check_url,
+          strip_max_output_tokens,
+          request_parameter_policy,
+          sanitize_reasoning_summary,
+          preserve_messages_payload,
+          preserve_raw_request_body,
+          transport_mode,
+          strip_model_prefixes,
+          model_aliases,
+          rtk_policy,
+          error_policy,
+          system_managed,
+          account_platform,
+          account_pool_required,
+          enabled,
+          created_at,
+          updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `);
+            const insertApiKey = this.db.prepare(`
+        INSERT INTO provider_api_keys (provider_id, api_key, position)
+        VALUES (?, ?, ?)
+      `);
+            const insertClientRoute = this.db.prepare(`
+        INSERT INTO client_routes (client_route, provider_id)
+        VALUES (?, ?)
+      `);
+            const insertModelOverride = this.db.prepare(`
+        INSERT INTO model_overrides (client_route, model)
+        VALUES (?, ?)
+      `);
+            const insertClientRouteRtkPolicy = this.db.prepare(`
+        INSERT INTO client_route_rtk_policies (client_route, policy)
+        VALUES (?, ?)
+      `);
+            const insertAppState = this.db.prepare(`
+        INSERT INTO app_state (key, value)
+        VALUES (?, ?)
+      `);
+            for (const provider of this.providerPresets) {
+                insertProvider.run(provider.id, provider.name, provider.baseUrl, provider.responsesUrl, parseRuntimeProviderAuthMode(provider.authMode), provider.chatgptAccountId ?? null, provider.capabilities.ownedBy ?? null, provider.capabilities.usageCheckEnabled ? 1 : 0, provider.capabilities.usageCheckUrl ?? null, provider.capabilities.stripMaxOutputTokens ? 1 : 0, JSON.stringify(cloneProviderRequestParameterPolicy(provider.capabilities.requestParameterPolicy)), provider.capabilities.sanitizeReasoningSummary ? 1 : 0, provider.capabilities.preserveMessagesPayload ? 1 : 0, provider.capabilities.preserveRawRequestBody ? 1 : 0, provider.capabilities.transportMode ?? "responses", JSON.stringify(provider.capabilities.stripModelPrefixes), JSON.stringify(provider.capabilities.modelAliases ?? {}), JSON.stringify(cloneRtkLayerPolicy(provider.capabilities.rtkPolicy) ?? {}), JSON.stringify(cloneProviderErrorPolicy(provider.capabilities.errorPolicy) ?? {}), provider.capabilities.systemManaged ? 1 : 0, provider.capabilities.accountPlatform ?? null, provider.capabilities.accountPoolRequired ? 1 : 0, provider.enabled !== false ? 1 : 0, provider.createdAt ?? null, provider.updatedAt ?? null);
+                provider.providerApiKeys.forEach((apiKey, index) => {
+                    insertApiKey.run(provider.id, apiKey, index);
+                });
+            }
+            Object.entries(this.clientRoutes).forEach(([clientRoute, providerId]) => {
+                insertClientRoute.run(clientRoute, providerId);
+            });
+            Object.entries(this.modelOverrides).forEach(([clientRoute, model]) => {
+                insertModelOverride.run(clientRoute, model);
+            });
+            Object.entries(this.clientRouteRtkPolicies).forEach(([clientRoute, policy]) => {
+                insertClientRouteRtkPolicy.run(clientRoute, JSON.stringify(cloneRtkLayerPolicy(policy) ?? {}));
+            });
+            insertAppState.run("active_provider_id", this.activeProviderId);
+            insertAppState.run("model_override", this.modelOverrides.default ?? "");
+            insertAppState.run("client_route_api_keys", JSON.stringify(this.clientRouteApiKeys));
+            this.db.exec("COMMIT");
+        }
+        catch (error) {
+            this.db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+}
+export const KIRO_PROVIDER_ID = "account-kiro";
+export function buildBuiltinProviderPresets(config) {
+    const presets = [];
+    // Only seed a primary upstream provider if the URL is a real endpoint
+    // (skip .invalid, .example, .test reserved domains per RFC 2606)
+    const upstreamHostname = (() => {
+        try {
+            return new URL(config.UPSTREAM_BASE_URL).hostname.toLowerCase();
+        }
+        catch {
+            return "";
+        }
+    })();
+    const isPlaceholder = upstreamHostname.endsWith(".invalid") ||
+        upstreamHostname.endsWith(".example") ||
+        upstreamHostname.endsWith(".test") ||
+        upstreamHostname === "";
+    if (!isPlaceholder) {
+        const primaryIdentity = inferProviderIdentity(config.UPSTREAM_BASE_URL, "");
+        presets.push({
+            id: primaryIdentity.id,
+            name: primaryIdentity.name,
+            baseUrl: config.UPSTREAM_BASE_URL,
+            responsesUrl: config.upstreamResponsesUrl,
+            authMode: "api_key",
+            providerApiKeys: normalizeApiKeys(config.UPSTREAM_API_KEY ? [config.UPSTREAM_API_KEY] : []),
+            clientApiKeys: [],
+            capabilities: buildDefaultCapabilitiesFromConfig(config),
+        });
+    }
+    if (config.KIRO_ENABLED) {
+        presets.push(buildKiroProviderPreset(config));
+    }
+    return ensureUniqueProviderIds(presets);
+}
+/**
+ * System-managed provider that serves requests through a Kiro (AWS CodeWhisperer)
+ * account from 9router. Accounts/tokens live in 9router's own DB; this preset only
+ * declares routing + the CodeWhisperer transport so the forward path can translate.
+ */
+function buildKiroProviderPreset(config) {
+    const region = config.KIRO_DEFAULT_REGION;
+    const baseUrl = `https://codewhisperer.${region}.amazonaws.com`;
+    return {
+        id: KIRO_PROVIDER_ID,
+        name: "Kiro (9router)",
+        baseUrl,
+        responsesUrl: `${baseUrl}${CODEWHISPERER_GENERATE_PATH}`,
+        authMode: "kiro",
+        enabled: false,
+        providerApiKeys: [],
+        clientApiKeys: [],
+        capabilities: {
+            systemManaged: true,
+            accountPlatform: "kiro",
+            accountPoolRequired: true,
+            usageCheckEnabled: false,
+            stripMaxOutputTokens: false,
+            requestParameterPolicy: {},
+            sanitizeReasoningSummary: false,
+            transportMode: "codewhisperer",
+            stripModelPrefixes: [],
+            modelAliases: { ...DEFAULT_KIRO_MODEL_ALIASES },
+        },
+    };
+}
+function openDatabase(dbFile) {
+    mkdirSync(path.dirname(dbFile), { recursive: true });
+    return new BetterSqlite3(dbFile);
+}
+function ensureSchema(db) {
+    db.pragma("foreign_keys = ON");
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS providers (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      base_url TEXT NOT NULL,
+      responses_url TEXT NOT NULL,
+      auth_mode TEXT NOT NULL DEFAULT 'api_key',
+      chatgpt_account_id TEXT,
+      owned_by TEXT,
+      usage_check_enabled INTEGER NOT NULL DEFAULT 0,
+      usage_check_url TEXT,
+      strip_max_output_tokens INTEGER NOT NULL DEFAULT 0,
+      request_parameter_policy TEXT NOT NULL DEFAULT '{}',
+      sanitize_reasoning_summary INTEGER NOT NULL DEFAULT 0,
+      preserve_messages_payload INTEGER NOT NULL DEFAULT 0,
+      preserve_raw_request_body INTEGER NOT NULL DEFAULT 0,
+      transport_mode TEXT NOT NULL DEFAULT 'responses',
+      strip_model_prefixes TEXT NOT NULL DEFAULT '[]',
+      model_aliases TEXT NOT NULL DEFAULT '{}',
+      rtk_policy TEXT NOT NULL DEFAULT '{}',
+      error_policy TEXT NOT NULL DEFAULT '{}',
+      system_managed INTEGER NOT NULL DEFAULT 0,
+      account_platform TEXT,
+      account_pool_required INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT,
+      updated_at TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS provider_api_keys (
+      provider_id TEXT NOT NULL,
+      api_key TEXT NOT NULL,
+      position INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (provider_id, api_key),
+      FOREIGN KEY (provider_id) REFERENCES providers(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS client_api_keys (
+      provider_id TEXT NOT NULL,
+      api_key TEXT NOT NULL,
+      position INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (provider_id, api_key),
+      FOREIGN KEY (provider_id) REFERENCES providers(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS client_routes (
+      client_route TEXT PRIMARY KEY,
+      provider_id TEXT NOT NULL,
+      FOREIGN KEY (provider_id) REFERENCES providers(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS model_overrides (
+      client_route TEXT PRIMARY KEY,
+      model TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS client_route_rtk_policies (
+      client_route TEXT PRIMARY KEY,
+      policy TEXT NOT NULL DEFAULT '{}'
+    );
+
+    CREATE TABLE IF NOT EXISTS app_state (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS client_token_limits (
+      client_route TEXT PRIMARY KEY,
+      enabled INTEGER NOT NULL DEFAULT 0,
+      token_limit INTEGER NOT NULL,
+      window_type TEXT NOT NULL,
+      window_size_seconds INTEGER,
+      hard_block INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS client_token_usage (
+      client_route TEXT NOT NULL,
+      window_start TEXT NOT NULL,
+      input_tokens INTEGER NOT NULL DEFAULT 0,
+      output_tokens INTEGER NOT NULL DEFAULT 0,
+      total_tokens INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (client_route, window_start)
+    );
+
+    -- Routing combo tables
+    CREATE TABLE IF NOT EXISTS routing_combos (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      description TEXT,
+      is_active INTEGER NOT NULL DEFAULT 1,
+      is_default INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS routing_tiers (
+      id TEXT PRIMARY KEY,
+      combo_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      priority INTEGER NOT NULL,
+      tier TEXT NOT NULL,
+      is_enabled INTEGER NOT NULL DEFAULT 1,
+      fallback_delay INTEGER NOT NULL DEFAULT 1000,
+      max_retries INTEGER NOT NULL DEFAULT 2,
+      health_threshold TEXT,
+      FOREIGN KEY (combo_id) REFERENCES routing_combos(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS routing_tier_providers (
+      id TEXT PRIMARY KEY,
+      tier_id TEXT NOT NULL,
+      provider_id TEXT NOT NULL,
+      weight INTEGER NOT NULL DEFAULT 50,
+      is_enabled INTEGER NOT NULL DEFAULT 1,
+      model_override TEXT,
+      FOREIGN KEY (tier_id) REFERENCES routing_tiers(id) ON DELETE CASCADE,
+      FOREIGN KEY (provider_id) REFERENCES providers(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS routing_combo_policies (
+      combo_id TEXT PRIMARY KEY,
+      load_balancing TEXT NOT NULL DEFAULT 'weighted',
+      failover_strategy TEXT NOT NULL DEFAULT 'immediate',
+      token_budget_mode TEXT NOT NULL DEFAULT 'per_route',
+      quota_management TEXT,
+      cost_optimization TEXT,
+      retry_policy TEXT,
+      FOREIGN KEY (combo_id) REFERENCES routing_combos(id) ON DELETE CASCADE
+    );
+
+    CREATE TABLE IF NOT EXISTS routing_combo_client_routes (
+      combo_id TEXT NOT NULL,
+      client_route TEXT NOT NULL,
+      PRIMARY KEY (combo_id, client_route),
+      FOREIGN KEY (combo_id) REFERENCES routing_combos(id) ON DELETE CASCADE
+    );
+  `);
+    ensureProvidersColumn(db, "owned_by", "TEXT");
+    ensureProvidersColumn(db, "auth_mode", "TEXT NOT NULL DEFAULT 'api_key'");
+    ensureProvidersColumn(db, "chatgpt_account_id", "TEXT");
+    ensureProvidersColumn(db, "usage_check_enabled", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "usage_check_url", "TEXT");
+    ensureProvidersColumn(db, "strip_max_output_tokens", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "request_parameter_policy", "TEXT NOT NULL DEFAULT '{}'");
+    ensureProvidersColumn(db, "sanitize_reasoning_summary", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "preserve_messages_payload", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "preserve_raw_request_body", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "transport_mode", "TEXT NOT NULL DEFAULT 'responses'");
+    ensureProvidersColumn(db, "strip_model_prefixes", "TEXT NOT NULL DEFAULT '[]'");
+    ensureProvidersColumn(db, "model_aliases", "TEXT NOT NULL DEFAULT '{}'");
+    ensureProvidersColumn(db, "rtk_policy", "TEXT NOT NULL DEFAULT '{}'");
+    ensureProvidersColumn(db, "error_policy", "TEXT NOT NULL DEFAULT '{}'");
+    ensureProvidersColumn(db, "system_managed", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "account_platform", "TEXT");
+    ensureProvidersColumn(db, "account_pool_required", "INTEGER NOT NULL DEFAULT 0");
+    ensureProvidersColumn(db, "enabled", "INTEGER NOT NULL DEFAULT 0");
+    ensureSharedApiKeyTable(db, "provider_api_keys");
+    ensureSharedApiKeyTable(db, "client_api_keys");
+}
+function readStateFromDatabase(db) {
+    const providerRows = queryRows(db, `SELECT
+      id,
+      name,
+      base_url,
+      responses_url,
+      auth_mode,
+      chatgpt_account_id,
+      owned_by,
+      usage_check_enabled,
+      usage_check_url,
+      strip_max_output_tokens,
+      request_parameter_policy,
+      sanitize_reasoning_summary,
+      preserve_messages_payload,
+      preserve_raw_request_body,
+      transport_mode,
+      strip_model_prefixes,
+      model_aliases,
+      rtk_policy,
+      error_policy,
+      system_managed,
+      account_platform,
+      account_pool_required,
+      enabled,
+      created_at,
+      updated_at
+    FROM providers
+    ORDER BY name, id`);
+    const apiKeyRows = queryRows(db, "SELECT provider_id, api_key FROM provider_api_keys ORDER BY provider_id, position, api_key");
+    const clientRouteRows = queryRows(db, "SELECT client_route, provider_id FROM client_routes ORDER BY client_route");
+    const modelOverrideRows = queryRows(db, "SELECT client_route, model FROM model_overrides ORDER BY client_route");
+    const clientRouteRtkPolicyRows = queryRows(db, "SELECT client_route, policy FROM client_route_rtk_policies ORDER BY client_route");
+    const appStateRows = queryRows(db, "SELECT key, value FROM app_state ORDER BY key");
+    const providerApiKeysByProvider = new Map();
+    for (const row of apiKeyRows) {
+        const current = providerApiKeysByProvider.get(row.provider_id) ?? [];
+        current.push(row.api_key);
+        providerApiKeysByProvider.set(row.provider_id, current);
+    }
+    const providers = providerRows.map((row) => ({
+        id: row.id,
+        name: row.name,
+        baseUrl: row.base_url,
+        responsesUrl: row.responses_url,
+        authMode: parseRuntimeProviderAuthMode(row.auth_mode),
+        chatgptAccountId: row.chatgpt_account_id?.trim() ? row.chatgpt_account_id.trim() : undefined,
+        providerApiKeys: providerApiKeysByProvider.get(row.id) ?? [],
+        clientApiKeys: [],
+        enabled: row.enabled !== 0,
+        capabilities: {
+            ownedBy: row.owned_by ?? undefined,
+            systemManaged: row.system_managed === 1,
+            accountPlatform: row.account_platform?.trim() ? row.account_platform.trim() : undefined,
+            accountPoolRequired: row.account_pool_required === 1,
+            usageCheckEnabled: row.usage_check_enabled === 1,
+            usageCheckUrl: row.usage_check_url?.trim() ? row.usage_check_url.trim() : undefined,
+            stripMaxOutputTokens: row.strip_max_output_tokens === 1,
+            requestParameterPolicy: normalizeStoredRequestParameterPolicy(row.request_parameter_policy, row.strip_max_output_tokens === 1),
+            sanitizeReasoningSummary: row.sanitize_reasoning_summary === 1,
+            preserveMessagesPayload: row.preserve_messages_payload === 1,
+            preserveRawRequestBody: row.preserve_raw_request_body === 1,
+            transportMode: normalizeTransportMode(row.transport_mode),
+            stripModelPrefixes: normalizeStringList(row.strip_model_prefixes),
+            modelAliases: normalizeStringMap(row.model_aliases),
+            rtkPolicy: parseRtkLayerPolicyInput(safeJsonParse(row.rtk_policy ?? "{}")),
+            errorPolicy: parseProviderErrorPolicyInput(safeJsonParse(row.error_policy ?? "{}")),
+        },
+        createdAt: row.created_at ?? undefined,
+        updatedAt: row.updated_at ?? undefined,
+    }));
+    const appState = new Map(appStateRows.map((row) => [row.key, row.value]));
+    const clientRoutes = Object.fromEntries(clientRouteRows.map((row) => [row.client_route, row.provider_id]));
+    const modelOverrides = Object.fromEntries(modelOverrideRows.map((row) => [row.client_route, row.model]));
+    const clientRouteRtkPolicies = Object.fromEntries(clientRouteRtkPolicyRows
+        .map((row) => [row.client_route, parseRtkLayerPolicyInput(safeJsonParse(row.policy))])
+        .filter((entry) => Boolean(entry[1])));
+    const modelOverride = appState.get("model_override");
+    const clientRouteApiKeys = sanitizeClientRouteApiKeys(safeJsonParse(appState.get("client_route_api_keys") ?? "{}"));
+    return {
+        providers,
+        activeProviderId: appState.get("active_provider_id"),
+        modelOverride: modelOverride?.trim() ? modelOverride : undefined,
+        modelOverrides,
+        clientRoutes,
+        clientRouteRtkPolicies,
+        clientRouteApiKeys,
+    };
+}
+function queryRows(db, sql) {
+    return db.prepare(sql).all();
+}
+function mapClientTokenLimitRow(row) {
+    return {
+        clientRoute: normalizeClientRouteKey(row.client_route),
+        enabled: row.enabled === 1,
+        tokenLimit: Math.max(0, Number(row.token_limit ?? 0)),
+        windowType: normalizeClientTokenWindowType(row.window_type),
+        windowSizeSeconds: typeof row.window_size_seconds === "number" && row.window_size_seconds > 0
+            ? row.window_size_seconds
+            : undefined,
+        hardBlock: row.hard_block !== 0,
+        createdAt: row.created_at ?? new Date(0).toISOString(),
+        updatedAt: row.updated_at ?? row.created_at ?? new Date(0).toISOString(),
+    };
+}
+function mapClientTokenUsageRow(row) {
+    return {
+        clientRoute: normalizeClientRouteKey(row.client_route),
+        windowStart: row.window_start,
+        inputTokens: Math.max(0, Number(row.input_tokens ?? 0)),
+        outputTokens: Math.max(0, Number(row.output_tokens ?? 0)),
+        totalTokens: Math.max(0, Number(row.total_tokens ?? 0)),
+        updatedAt: row.updated_at ?? new Date(0).toISOString(),
+    };
+}
+function buildEmptyClientTokenUsageSnapshot(clientRoute, windowStart) {
+    return {
+        clientRoute,
+        windowStart,
+        inputTokens: 0,
+        outputTokens: 0,
+        totalTokens: 0,
+        updatedAt: windowStart,
+    };
+}
+function normalizeClientTokenWindowType(value) {
+    switch (value) {
+        case "weekly":
+        case "monthly":
+        case "fixed":
+            return value;
+        case "daily":
+        default:
+            return "daily";
+    }
+}
+function normalizeNonNegativeInteger(value) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return 0;
+    }
+    return Math.floor(parsed);
+}
+function ensureSharedApiKeyTable(db, tableName) {
+    const tableSql = db
+        .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?")
+        .get(tableName);
+    if (!tableSql?.sql?.includes("api_key TEXT NOT NULL UNIQUE")) {
+        return;
+    }
+    const tempTableName = `${tableName}_legacy_unique`;
+    db.exec(`
+    ALTER TABLE ${tableName} RENAME TO ${tempTableName};
+
+    CREATE TABLE ${tableName} (
+      provider_id TEXT NOT NULL,
+      api_key TEXT NOT NULL,
+      position INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (provider_id, api_key),
+      FOREIGN KEY (provider_id) REFERENCES providers(id) ON DELETE CASCADE
+    );
+
+    INSERT OR IGNORE INTO ${tableName} (provider_id, api_key, position)
+    SELECT provider_id, api_key, position
+    FROM ${tempTableName};
+
+    DROP TABLE ${tempTableName};
+  `);
+}
+function loadLegacyState(stateFile) {
+    try {
+        const raw = readFileSync(stateFile, "utf8");
+        const parsed = JSON.parse(raw);
+        const providers = Array.isArray(parsed.providers)
+            ? parsed.providers
+                .map((item) => sanitizeProvider(item))
+                .filter((item) => Boolean(item))
+            : Array.isArray(parsed.customProviders)
+                ? (parsed.customProviders ?? [])
+                    .map((item) => sanitizeCustomProvider(item))
+                    .filter((item) => Boolean(item))
+                : [];
+        return {
+            providers,
+            activeProviderId: typeof parsed.activeProviderId === "string" && parsed.activeProviderId.trim()
+                ? parsed.activeProviderId.trim()
+                : undefined,
+            modelOverride: typeof parsed.modelOverride === "string" && parsed.modelOverride.trim()
+                ? parsed.modelOverride.trim()
+                : undefined,
+            modelOverrides: sanitizeModelOverrides(parsed.modelOverrides),
+            clientRoutes: sanitizeClientRoutes(parsed.clientRoutes),
+            clientRouteRtkPolicies: sanitizeClientRouteRtkPolicies(parsed.clientRouteRtkPolicies),
+            clientRouteApiKeys: sanitizeClientRouteApiKeys(parsed.clientRouteApiKeys),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function sanitizeCustomProvider(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    const id = typeof record.id === "string" ? record.id.trim() : "";
+    const name = typeof record.name === "string" ? record.name.trim() : "";
+    const baseUrl = typeof record.baseUrl === "string" ? record.baseUrl.trim() : "";
+    const providerApiKeys = normalizeApiKeysInput(record.providerApiKeys, record.apiKeys, record.apiKey);
+    const createdAt = typeof record.createdAt === "string" && record.createdAt.trim()
+        ? record.createdAt.trim()
+        : undefined;
+    const updatedAt = typeof record.updatedAt === "string" && record.updatedAt.trim()
+        ? record.updatedAt.trim()
+        : undefined;
+    const capabilities = parseProviderCapabilitiesInput(record.capabilities);
+    const authMode = parseRuntimeProviderAuthMode(record.authMode);
+    const chatgptAccountId = typeof record.chatgptAccountId === "string" && record.chatgptAccountId.trim()
+        ? record.chatgptAccountId.trim()
+        : undefined;
+    if (!id || !name || !baseUrl) {
+        return undefined;
+    }
+    try {
+        const parsedBaseUrl = new URL(baseUrl);
+        const normalizedBaseUrl = parsedBaseUrl.toString().replace(/\/+$/, "");
+        return {
+            id,
+            name,
+            baseUrl: normalizedBaseUrl,
+            responsesUrl: toResponsesUrl(normalizedBaseUrl),
+            authMode,
+            chatgptAccountId,
+            providerApiKeys,
+            clientApiKeys: [],
+            capabilities,
+            createdAt,
+            updatedAt,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function sanitizeProvider(value) {
+    return sanitizeCustomProvider(value);
+}
+function sanitizeClientRoutes(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const next = {};
+    const legacyDefault = typeof record.default === "string" ? record.default.trim() : "";
+    if (legacyDefault) {
+        next.default = legacyDefault;
+    }
+    for (const [rawKey, rawValue] of Object.entries(record)) {
+        const key = normalizeClientRouteKey(rawKey);
+        const providerId = typeof rawValue === "string" ? rawValue.trim() : "";
+        if (providerId) {
+            next[key] = providerId;
+        }
+    }
+    return next;
+}
+function sanitizeModelOverrides(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const next = {};
+    const legacyDefault = typeof record.default === "string" ? record.default.trim() : "";
+    if (legacyDefault) {
+        next.default = legacyDefault;
+    }
+    for (const [rawKey, rawValue] of Object.entries(record)) {
+        const key = normalizeClientRouteKey(rawKey);
+        const model = typeof rawValue === "string" ? rawValue.trim() : "";
+        if (model) {
+            next[key] = model;
+        }
+    }
+    return next;
+}
+function sanitizeClientRouteRtkPolicies(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const next = {};
+    for (const [rawKey, rawValue] of Object.entries(record)) {
+        const key = normalizeClientRouteKey(rawKey);
+        const policy = parseRtkLayerPolicyInput(rawValue);
+        if (policy) {
+            next[key] = policy;
+        }
+    }
+    return next;
+}
+function sanitizeClientRouteApiKeys(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const next = {};
+    for (const [rawKey, rawValue] of Object.entries(record)) {
+        const key = normalizeClientRouteKey(rawKey);
+        const apiKeys = normalizeApiKeysInput(rawValue);
+        if (apiKeys.length > 0) {
+            next[key] = apiKeys;
+        }
+    }
+    return next;
+}
+function normalizeApiKeysInput(...values) {
+    for (const value of values) {
+        if (Array.isArray(value)) {
+            return normalizeApiKeys(value);
+        }
+        if (typeof value === "string") {
+            return normalizeApiKeys(value.split(/\r?\n|,/g));
+        }
+    }
+    return [];
+}
+function normalizeApiKeys(values) {
+    return [
+        ...new Set(values
+            .map((value) => (typeof value === "string" ? value.trim() : ""))
+            .filter(Boolean)),
+    ];
+}
+function parseRuntimeProviderAuthMode(value) {
+    if (value === "chatgpt_oauth") {
+        return "chatgpt_oauth";
+    }
+    if (value === "kiro") {
+        return "kiro";
+    }
+    return "api_key";
+}
+export function normalizeClientRouteKey(value) {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    if (!normalized) {
+        throw new RuntimeProviderError(400, {
+            type: "validation_error",
+            code: "INVALID_CLIENT_ROUTE",
+            message: "client route is required",
+        });
+    }
+    return normalized;
+}
+function migrateLegacyProvider(provider) {
+    const migrated = {
+        ...provider,
+        authMode: parseRuntimeProviderAuthMode(provider.authMode),
+        chatgptAccountId: provider.chatgptAccountId?.trim() || undefined,
+    };
+    if (provider.id !== "primary" && provider.id !== "fallback") {
+        return migrated;
+    }
+    const identity = inferProviderIdentity(provider.baseUrl, provider.name);
+    return {
+        ...migrated,
+        id: identity.id,
+        name: identity.name,
+        capabilities: cloneCapabilities(provider.capabilities),
+    };
+}
+function inferProviderIdentity(baseUrl, fallbackName) {
+    try {
+        const hostname = new URL(baseUrl).hostname.toLowerCase();
+        const normalizedHost = hostname
+            .replace(/^api\./, "")
+            .replace(/^www\./, "")
+            .replace(/\.[a-z]+$/, "")
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-+|-+$/g, "");
+        const normalizedName = normalizeProviderName(fallbackName || normalizedHost || "provider");
+        return {
+            id: normalizedName.replace(/[^a-z0-9]+/g, "-"),
+            name: normalizedName,
+        };
+    }
+    catch {
+        const normalizedName = normalizeProviderName(fallbackName || "provider");
+        return {
+            id: normalizedName.replace(/[^a-z0-9]+/g, "-"),
+            name: normalizedName,
+        };
+    }
+}
+function ensureUniqueProviderIds(providers) {
+    const usedIds = new Map();
+    return providers.map((provider) => {
+        const baseId = provider.id.trim() || "provider";
+        const seen = usedIds.get(baseId) ?? 0;
+        usedIds.set(baseId, seen + 1);
+        if (seen === 0) {
+            return provider;
+        }
+        return {
+            ...provider,
+            id: `${baseId}-${seen + 1}`,
+        };
+    });
+}
+function mergeBaseProviders(runtimeProviders, baseProviders) {
+    const merged = [...runtimeProviders];
+    for (const baseProvider of baseProviders) {
+        const matchingIndex = merged.findIndex((provider) => provider.id === baseProvider.id ||
+            provider.baseUrl === baseProvider.baseUrl ||
+            normalizeProviderName(provider.name) === normalizeProviderName(baseProvider.name));
+        if (matchingIndex === -1) {
+            merged.push(baseProvider);
+            continue;
+        }
+        const existing = merged[matchingIndex];
+        if (isUnmodifiedSeededProvider(existing)) {
+            merged[matchingIndex] = {
+                ...baseProvider,
+                createdAt: existing.createdAt,
+                updatedAt: existing.updatedAt,
+            };
+        }
+    }
+    return merged;
+}
+function isUnmodifiedSeededProvider(provider) {
+    return !provider.createdAt && !provider.updatedAt;
+}
+function shouldPersistSeededProviders(originalProviders, nextProviders) {
+    if (originalProviders.length !== nextProviders.length) {
+        return true;
+    }
+    return nextProviders.some((provider, index) => {
+        const original = originalProviders[index];
+        return (!original ||
+            original.id !== provider.id ||
+            original.name !== provider.name ||
+            original.baseUrl !== provider.baseUrl ||
+            original.authMode !== provider.authMode ||
+            original.chatgptAccountId !== provider.chatgptAccountId ||
+            JSON.stringify(original.providerApiKeys) !== JSON.stringify(provider.providerApiKeys) ||
+            JSON.stringify(cloneCapabilities(original.capabilities)) !==
+                JSON.stringify(cloneCapabilities(provider.capabilities)));
+    });
+}
+function normalizeProviderName(value) {
+    return value.trim().toLowerCase();
+}
+function toResponsesUrl(baseUrl) {
+    return baseUrl.endsWith("/v1") ? `${baseUrl}/responses` : `${baseUrl}/v1/responses`;
+}
+function buildDefaultCapabilitiesFromConfig(config) {
+    const requestParameterPolicyInput = config.MAX_OUTPUT_TOKENS_PARAMETER_MODE_FOR_PROVIDER
+        ? {
+            maxOutputTokens: {
+                mode: config.MAX_OUTPUT_TOKENS_PARAMETER_MODE_FOR_PROVIDER,
+                ...(config.MAX_OUTPUT_TOKENS_PARAMETER_MODE_FOR_PROVIDER === "rename" &&
+                    config.MAX_OUTPUT_TOKENS_PARAMETER_TARGET_FOR_PROVIDER?.trim()
+                    ? {
+                        target: config.MAX_OUTPUT_TOKENS_PARAMETER_TARGET_FOR_PROVIDER.trim(),
+                    }
+                    : {}),
+            },
+        }
+        : {};
+    const maxOutputTokensRule = resolveMaxOutputTokensRule({
+        stripMaxOutputTokens: config.STRIP_MAX_OUTPUT_TOKENS_FOR_PROVIDER ?? false,
+        requestParameterPolicy: requestParameterPolicyInput,
+    });
+    const requestParameterPolicy = cloneProviderRequestParameterPolicy({
+        maxOutputTokens: maxOutputTokensRule,
+    });
+    return {
+        usageCheckEnabled: Boolean(config.PROVIDER_USAGE_CHECK_ENABLED && config.PROVIDER_USAGE_CHECK_URL),
+        usageCheckUrl: config.PROVIDER_USAGE_CHECK_URL,
+        stripMaxOutputTokens: maxOutputTokensRule.mode === "strip",
+        requestParameterPolicy,
+        sanitizeReasoningSummary: config.SANITIZE_REASONING_SUMMARY_FOR_PROVIDER ?? false,
+        stripModelPrefixes: [],
+        rtkPolicy: cloneRtkLayerPolicy({
+            enabled: config.RTK_LAYER_ENABLED,
+            toolOutputEnabled: config.RTK_LAYER_TOOL_OUTPUT_ENABLED,
+            maxChars: config.RTK_LAYER_TOOL_OUTPUT_MAX_CHARS,
+            maxLines: config.RTK_LAYER_TOOL_OUTPUT_MAX_LINES,
+            tailLines: config.RTK_LAYER_TOOL_OUTPUT_TAIL_LINES,
+            tailChars: config.RTK_LAYER_TOOL_OUTPUT_TAIL_CHARS,
+            detectFormat: config.RTK_LAYER_TOOL_OUTPUT_DETECT_FORMAT,
+        }),
+        errorPolicy: inferDefaultProviderErrorPolicy(config.UPSTREAM_BASE_URL),
+    };
+}
+function parseProviderCapabilitiesInput(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {
+            usageCheckEnabled: false,
+            stripMaxOutputTokens: false,
+            requestParameterPolicy: {},
+            sanitizeReasoningSummary: false,
+            stripModelPrefixes: [],
+        };
+    }
+    const record = value;
+    const ownedBy = typeof record.ownedBy === "string" && record.ownedBy.trim()
+        ? record.ownedBy.trim()
+        : undefined;
+    const accountPlatform = typeof record.accountPlatform === "string" && record.accountPlatform.trim()
+        ? record.accountPlatform.trim()
+        : typeof record.account_platform === "string" && record.account_platform.trim()
+            ? record.account_platform.trim()
+            : undefined;
+    const usageCheckUrl = typeof record.usageCheckUrl === "string" && record.usageCheckUrl.trim()
+        ? normalizeOptionalUrl(record.usageCheckUrl)
+        : undefined;
+    const requestParameterPolicy = parseProviderRequestParameterPolicyInput(record.requestParameterPolicy ?? record.request_parameter_policy);
+    const maxOutputTokensRule = resolveMaxOutputTokensRule({
+        stripMaxOutputTokens: coerceBoolean(record.stripMaxOutputTokens),
+        requestParameterPolicy,
+    });
+    return {
+        ownedBy,
+        systemManaged: coerceBoolean(record.systemManaged ?? record.system_managed),
+        accountPlatform,
+        accountPoolRequired: coerceBoolean(record.accountPoolRequired ?? record.account_pool_required),
+        usageCheckEnabled: coerceBoolean(record.usageCheckEnabled),
+        usageCheckUrl,
+        stripMaxOutputTokens: maxOutputTokensRule.mode === "strip",
+        requestParameterPolicy,
+        sanitizeReasoningSummary: coerceBoolean(record.sanitizeReasoningSummary),
+        preserveMessagesPayload: coerceBoolean(record.preserveMessagesPayload ?? record.preserve_messages_payload),
+        preserveRawRequestBody: coerceBoolean(record.preserveRawRequestBody ?? record.preserve_raw_request_body),
+        transportMode: normalizeTransportMode(record.transportMode ?? record.transport_mode),
+        stripModelPrefixes: normalizeStringList(record.stripModelPrefixes),
+        modelAliases: normalizeStringMap(record.modelAliases ?? record.model_aliases),
+        rtkPolicy: parseRtkLayerPolicyInput(record.rtkPolicy ?? record.rtk_policy),
+        errorPolicy: parseProviderErrorPolicyInput(record.errorPolicy ?? record.error_policy),
+    };
+}
+function cloneCapabilities(capabilities) {
+    const maxOutputTokensRule = resolveMaxOutputTokensRule(capabilities);
+    return {
+        ownedBy: capabilities?.ownedBy,
+        systemManaged: capabilities?.systemManaged ?? false,
+        accountPlatform: capabilities?.accountPlatform,
+        accountPoolRequired: capabilities?.accountPoolRequired ?? false,
+        usageCheckEnabled: capabilities?.usageCheckEnabled ?? false,
+        usageCheckUrl: capabilities?.usageCheckUrl,
+        stripMaxOutputTokens: maxOutputTokensRule.mode === "strip",
+        requestParameterPolicy: cloneProviderRequestParameterPolicy({
+            maxOutputTokens: maxOutputTokensRule,
+        }),
+        sanitizeReasoningSummary: capabilities?.sanitizeReasoningSummary ?? false,
+        preserveMessagesPayload: capabilities?.preserveMessagesPayload ?? false,
+        preserveRawRequestBody: capabilities?.preserveRawRequestBody ?? false,
+        transportMode: normalizeTransportMode(capabilities?.transportMode) ?? "responses",
+        stripModelPrefixes: [...(capabilities?.stripModelPrefixes ?? [])],
+        modelAliases: { ...(capabilities?.modelAliases ?? {}) },
+        rtkPolicy: cloneRtkLayerPolicy(capabilities?.rtkPolicy),
+        errorPolicy: cloneProviderErrorPolicy(capabilities?.errorPolicy),
+    };
+}
+function normalizeOptionalUrl(value) {
+    try {
+        return new URL(value.trim()).toString();
+    }
+    catch {
+        throw new RuntimeProviderError(400, {
+            type: "validation_error",
+            code: "INVALID_PROVIDER_CAPABILITIES",
+            message: "capabilities.usageCheckUrl must be a valid URL",
+        });
+    }
+}
+function normalizeTransportMode(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "responses" ||
+        normalized === "chat_completions" ||
+        normalized === "codewhisperer") {
+        return normalized;
+    }
+    return undefined;
+}
+function coerceBoolean(value) {
+    return value === true || value === "true" || value === 1 || value === "1";
+}
+function normalizeStringList(value) {
+    if (typeof value === "string") {
+        try {
+            const parsed = JSON.parse(value);
+            if (Array.isArray(parsed)) {
+                return normalizeStringList(parsed);
+            }
+        }
+        catch {
+            return normalizeApiKeys(value.split(/\r?\n|,/g));
+        }
+    }
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return [
+        ...new Set(value
+            .map((item) => (typeof item === "string" ? item.trim() : ""))
+            .filter(Boolean)),
+    ];
+}
+function normalizeStringMap(value) {
+    const parsed = typeof value === "string"
+        ? safeJsonParse(value)
+        : value;
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const entries = Object.entries(parsed)
+        .map(([key, rawValue]) => [
+        typeof key === "string" ? key.trim() : "",
+        typeof rawValue === "string" ? rawValue.trim() : "",
+    ])
+        .filter(([key, mapped]) => key && mapped);
+    if (!entries.length) {
+        return undefined;
+    }
+    return Object.fromEntries(entries);
+}
+function normalizeStoredRequestParameterPolicy(raw, stripMaxOutputTokens) {
+    const parsed = raw?.trim() ? safeJsonParse(raw) : undefined;
+    const parsedPolicy = parseProviderRequestParameterPolicyInput(parsed);
+    return cloneProviderRequestParameterPolicy(parsedPolicy.maxOutputTokens
+        ? parsedPolicy
+        : parseProviderRequestParameterPolicyInput({
+            maxOutputTokens: stripMaxOutputTokens ? "strip" : "forward",
+        }));
+}
+function cloneProviderErrorPolicy(policy) {
+    if (!policy || !Array.isArray(policy.rules) || policy.rules.length === 0) {
+        return undefined;
+    }
+    return {
+        rules: policy.rules.map((rule) => ({
+            statusCodes: Array.isArray(rule.statusCodes) && rule.statusCodes.length > 0
+                ? rule.statusCodes.filter((value) => Number.isInteger(value))
+                : undefined,
+            upstreamCodes: normalizeStringList(rule.upstreamCodes),
+            upstreamTypes: normalizeStringList(rule.upstreamTypes),
+            messageIncludes: normalizeStringList(rule.messageIncludes),
+            bodyIncludes: normalizeStringList(rule.bodyIncludes),
+            code: typeof rule.code === "string" && rule.code.trim() ? rule.code.trim() : undefined,
+            message: typeof rule.message === "string" && rule.message.trim() ? rule.message.trim() : undefined,
+            retryable: typeof rule.retryable === "boolean" ? rule.retryable : undefined,
+        })),
+    };
+}
+function parseProviderErrorPolicyInput(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    const rulesInput = Array.isArray(record.rules) ? record.rules : [];
+    const rules = rulesInput
+        .map((item) => parseProviderErrorPolicyRuleInput(item))
+        .filter((item) => Boolean(item));
+    if (rules.length === 0) {
+        return undefined;
+    }
+    return { rules };
+}
+function parseProviderErrorPolicyRuleInput(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    const statusCodes = normalizeIntegerList(record.statusCodes ?? record.status_codes);
+    const upstreamCodes = normalizeStringList(record.upstreamCodes ?? record.upstream_codes);
+    const upstreamTypes = normalizeStringList(record.upstreamTypes ?? record.upstream_types);
+    const messageIncludes = normalizeStringList(record.messageIncludes ?? record.message_includes);
+    const bodyIncludes = normalizeStringList(record.bodyIncludes ?? record.body_includes);
+    const code = typeof record.code === "string" && record.code.trim() ? record.code.trim() : undefined;
+    const message = typeof record.message === "string" && record.message.trim() ? record.message.trim() : undefined;
+    const retryable = typeof record.retryable === "boolean" ? record.retryable : undefined;
+    if (statusCodes.length === 0 &&
+        upstreamCodes.length === 0 &&
+        upstreamTypes.length === 0 &&
+        messageIncludes.length === 0 &&
+        bodyIncludes.length === 0) {
+        return undefined;
+    }
+    return {
+        statusCodes: statusCodes.length > 0 ? statusCodes : undefined,
+        upstreamCodes: upstreamCodes.length > 0 ? upstreamCodes : undefined,
+        upstreamTypes: upstreamTypes.length > 0 ? upstreamTypes : undefined,
+        messageIncludes: messageIncludes.length > 0 ? messageIncludes : undefined,
+        bodyIncludes: bodyIncludes.length > 0 ? bodyIncludes : undefined,
+        code,
+        message,
+        retryable,
+    };
+}
+function normalizeIntegerList(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return [...new Set(value.filter((item) => Number.isInteger(item)).map((item) => Number(item)))];
+}
+function inferDefaultProviderErrorPolicy(baseUrl) {
+    try {
+        const hostname = new URL(baseUrl).hostname.toLowerCase();
+        if (hostname === "krouter.net" || hostname === "api.krouter.net") {
+            return {
+                rules: [
+                    {
+                        statusCodes: [413],
+                        code: "UPSTREAM_REQUEST_TOO_LARGE",
+                        message: "Upstream rejected the request because the serialized prompt body is too large",
+                        retryable: false,
+                    },
+                    {
+                        bodyIncludes: ["request body is too large"],
+                        code: "UPSTREAM_REQUEST_TOO_LARGE",
+                        message: "Upstream rejected the request because the serialized prompt body is too large",
+                        retryable: false,
+                    },
+                    {
+                        statusCodes: [429],
+                        code: "UPSTREAM_RATE_LIMITED",
+                        message: "Upstream rate limit reached",
+                        retryable: true,
+                    },
+                ],
+            };
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+function safeJsonParse(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function ensureProvidersColumn(db, columnName, sqlDefinition) {
+    const columns = db.prepare("PRAGMA table_info(providers)").all();
+    if (!columns.some((column) => column.name === columnName)) {
+        db.exec(`ALTER TABLE providers ADD COLUMN ${columnName} ${sqlDefinition}`);
+    }
+}
+function backfillLegacyRequestParameterPolicies(db) {
+    db.exec(`
+    UPDATE providers
+    SET request_parameter_policy = CASE
+      WHEN strip_max_output_tokens = 1
+        THEN '{"maxOutputTokens":{"mode":"strip"}}'
+      ELSE '{"maxOutputTokens":{"mode":"forward"}}'
+    END
+    WHERE request_parameter_policy IS NULL
+      OR TRIM(request_parameter_policy) = ''
+      OR TRIM(request_parameter_policy) = '{}'
+  `);
+}