chore: bump @routstr/sdk, ignore npm artifacts, use max_completion_tokens

- Bump version to 0.4.6 and @routstr/sdk to ^0.4.2; declare published
  files (dist, src, README, SECURITY).
- Default request limit now sets max_completion_tokens (OpenAI-standard,
  accepted by reasoning models) instead of legacy max_tokens, keeping
  max_output_tokens for the Responses API.
- Ignore npm lockfiles; scope root index.ts ignore pattern to root only.

.gitignore

@@ -39,5 +39,9 @@ graphify-out/
 findings/
 routstrd-findings.zip
 
-# Standalone prototype scripts
-index.ts
+# Standalone prototype scripts (root-level only)
+/index.ts
+
+# npm artifacts (repo uses bun/bun.lock)
+package-lock.json
+npm-shrinkwrap.json

package.json

@@ -1,12 +1,18 @@
 {
   "name": "routstrd",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "module": "src/index.ts",
   "type": "module",
   "private": false,
   "bin": {
     "routstrd": "./dist/index.js"
   },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "SECURITY.md"
+  ],
   "scripts": {
     "start": "bun src/index.ts start",
     "stop": "bun src/index.ts stop",
@@ -27,7 +33,7 @@
     "@cashu/cashu-ts": "^4.3.0",
     "@cashu/coco-core": "^1.0.1",
     "@cashu/coco-sqlite-bun": "^1.0.1",
-    "@routstr/sdk": "^0.4.1",
+    "@routstr/sdk": "^0.4.2",
     "@scure/bip39": "^2.2.0",
     "applesauce-core": "^5.1.0",
     "applesauce-relay": "^5.1.0",

src/daemon/http/index.ts

@@ -1712,15 +1712,20 @@ export function createDaemonRequestHandler(deps: {
     // limit. Without this, the SDK prices at the provider's worst-case
     // max_completion_cost, which varies widely across providers (2.3× for
     // kimi-k3) and balloons during provider failover. Chat/completions use
-    // max_tokens; the OpenAI Responses API uses max_output_tokens.
+    // max_completion_tokens (the OpenAI-standard field; legacy max_tokens is
+    // deprecated and rejected by reasoning models); the Responses API uses
+    // max_output_tokens.
     if (deps.maxTokens > 0) {
       const isResponsesPath = url.pathname.includes("/responses");
       if (isResponsesPath) {
         if (typeof bodyObj.max_output_tokens !== "number") {
           bodyObj.max_output_tokens = deps.maxTokens;
         }
-      } else if (typeof bodyObj.max_tokens !== "number") {
-        bodyObj.max_tokens = deps.maxTokens;
+      } else if (
+        typeof bodyObj.max_completion_tokens !== "number" &&
+        typeof bodyObj.max_tokens !== "number"
+      ) {
+        bodyObj.max_completion_tokens = deps.maxTokens;
       }
     }