typesafe-sdk-ruby 0.6.0.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a081c1995e40528b73408af6b6188d0c9784b497de463b2821694e6a1a895c81
-  data.tar.gz: 7c7363485285de50ef55a68dfe3f6606e3c0a08f0f41133fbb182010626144bc
+  metadata.gz: d9c873fb65592342cbe6b344decd33db540327f8dac873d1ad2c42e1edea58f1
+  data.tar.gz: 6d1a977041d8d12fb31b0654e7ffae904170d2d3432951a67751dc30b9aa6d20
 SHA512:
-  metadata.gz: 26a637c0d1fc8afb9f29e20ab2860d287d12491c6a93c7c28c2db574adce747abba8c60eae1d70cff7efd3610b08db1f9ea0fdf4d727c58aeaee08cc12c35811
-  data.tar.gz: 1e9bfee179126a48aa3f640b87149f9af99a8e47c03bb13d29c2d550a520522e98496ceeabd63aa9949fced46f242cc600133c34aab5685b74a23ecfd47a14a5
+  metadata.gz: 3e51268bb25700c0c833013b3a6ba850379d86522a72d7438efe2c4b29fd9c868599486408459349f4a3281a6bb7768f20189fc16bc0c6220872f22ec3dd940c
+  data.tar.gz: e4971f23dde4a6c7672c4c922ef3fe72460c520919b868e4ec08730ba4f32136659dca3c48e1e18728a8c3e920c4c6405cdf6acc9e0fa5245003983f7d6477b9

data/CHANGELOG.md

@@ -6,6 +6,43 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 Versions follow the official JavaScript SDK, with a fourth numeric component for Ruby-only
 corrections. See [RELEASING.md](docs/RELEASING.md).
 
+## [0.7.0] - 2026-10-16
+
+Compatibility target: official JavaScript SDK 0.7.0, commit `b844cd1`.
+
+### Added
+
+- Images, an experimental API feature enabled with the `TypeSafe-Danger-Zone-Images: true`
+  header: create them with `Typesafe::SDK.image` from file bytes, a `Pathname`, or an IO, or
+  with `Typesafe::SDK::Image.from_base64`. Place them in `state`, question instructions, or
+  criteria; join them into text with `Typesafe::SDK.with_assets` and `Typesafe::SDK.join_assets`;
+  or reference them by names you choose in `assets:`. Requests with images are sent as
+  `multipart/form-data`, with each image's bytes in its own part.
+- `box` questions and `BoxResponse` answers, which locate what their instructions describe in an
+  image; use them with the `jev-preview` model.
+- zstd compression for request bodies of 1 KiB or more when the optional `zstd-ruby` gem is
+  available; pass `compression: false` to send bodies uncompressed.
+- `#to_h` on every answer, returning all fields the API sent, including unmodeled ones.
+
+### Changed
+
+- Non-finite floats (`NaN`, `Infinity`, `-Infinity`) in a request are sent as strings, as
+  JS 0.7.0 does, instead of raising `JSON::GeneratorError` (upstream #17).
+- Noul questions whose `criteria` is not a Hash raise `TypeSafeError` before sending.
+- Usage token counts are documented as possibly `nil` when the API doesn't report them.
+- A request containing a circular reference raises `TypeSafeError` instead of a JSON error.
+- Custom `http:` adapters can receive binary bodies: `multipart/form-data` for requests with
+  images, and zstd-compressed bodies of 1 KiB or more when `zstd-ruby` is loaded. Send the body
+  unchanged with the given headers, or pass `compression: false` to keep JSON bodies uncompressed.
+
+### Fixed
+
+- Debug logs no longer show an `x-api-key` value or a spaceless credential as an
+  authorization scheme; only an alphabetic scheme followed by a credential is kept
+  (upstream #18).
+- HTML error pages from Cloudflare raise errors whose message names the edge block and its
+  `cf-ray` ID instead of quoting the HTML (upstream #15). The error classes are unchanged.
+
 ## [0.6.0.1] - 2026-09-21
 
 Compatibility target: official JavaScript SDK 0.6.0, commit `66880cc`.

data/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 A community-maintained Ruby client for [TypeSafe AI](https://typesafe.ai), with typed answer
-objects, retries, timeouts, cancellation, and configurable logging.
+objects, image assets, retries, timeouts, cancellation, request compression, and configurable logging.
 
 TypeSafe's Jev model evaluates state against questions defined by your application. It returns
 structured decisions that your code can use for classification, ranking, and routing.
@@ -13,10 +13,10 @@ Read the [official introduction](https://docs.typesafe.ai/introduction) for the
 
 **Unofficial:** this project is not affiliated with, endorsed by, or supported by TypeSafe AI.
 It targets the official [JavaScript SDK](https://github.com/typesafe-ai/typesafe-sdk-js)
-**0.6.0**. Official [JavaScript and Python SDKs](https://docs.typesafe.ai/sdk) are maintained
+**0.7.0**. Official [JavaScript and Python SDKs](https://docs.typesafe.ai/sdk) are maintained
 by TypeSafe AI.
 
-**Version:** this README documents Ruby **0.6.0.1**, targeting JS **0.6.0**.
+**Version:** this README documents Ruby **0.7.0**, targeting JS **0.7.0**.
 Ruby-only corrections add a fourth version component. Check
 [RubyGems](https://rubygems.org/gems/typesafe-sdk-ruby) and
 [GitHub releases](https://github.com/afurm/typesafe-sdk-ruby/releases) for published versions;
@@ -76,6 +76,7 @@ puts response.usage.input_tokens
 | `noul` | A yes/no judgment | `noul`: probability of yes, from 0 to 1 |
 | `choice` | Selecting one named option | `choice`, `probabilities`, `confidence` |
 | `score` | Rating against ordered descriptions | `score`, `legend`, `probabilities`, `confidence` |
+| `box` | Locating something in an image ([Images](#images)) | `box` (`top`, `bottom`, `left`, `right`), `confidence` |
 
 Mix question types in a single call. Each question is evaluated against the same state,
 independently of the other questions. Put the meaning in the instructions and criteria;
@@ -124,17 +125,113 @@ See [structured questions](https://docs.typesafe.ai/primitives/advanced) for mor
 
 From Ruby **0.6.0.1**, builders and raw question hashes are checked before sending:
 
-- State must be a string, object, or array; `nil` is rejected, while `""`, `{}`, and `[]` are allowed.
-- Noul needs instructions or at least one non-nil true/false outcome description.
+- State must be a string, object, array, or image; `nil` is rejected, while `""`, `{}`, and `[]` are allowed.
+- Noul needs instructions or at least one non-nil true/false outcome description; its criteria,
+  when given, must be a Hash (from 0.7.0).
 - Score needs **2–10** levels. A nil level is rejected; use `""` explicitly to keep an
   undescribed position. The SDK never drops or renumbers levels.
 - Choice needs **1–255** options. Nil descriptions remain valid for choice labels.
 - Question names must not be empty strings.
 
 Failures raise `Typesafe::SDK::TypeSafeError` without an HTTP request. These checks address
-request shapes reported as rejected by the API, even though JS 0.6.0 accepts them locally.
+request shapes reported as rejected by the API. JS 0.7.0 now rejects nil state and empty noul
+questions too; the score and choice bounds, nil score levels, and empty names remain Ruby-only checks.
 See the [upstream issue audit](docs/UPSTREAM_ISSUES.md) for evidence and limitations.
 
+From Ruby **0.7.0**, as in JS 0.7.0, non-finite floats such as `Float::NAN` are sent as the
+strings `"NaN"`, `"Infinity"`, and `"-Infinity"`, because JSON cannot represent them. Every answer
+also responds to `to_h`, which returns all of its fields, including ones this SDK doesn't model.
+Usage token counts are `nil` when the API doesn't report them.
+
+## Images
+
+Added in Ruby **0.7.0**. Create an image with `Typesafe::SDK.image` from file bytes (a binary
+`String`), a `Pathname` (read when the request is sent), or an IO (read immediately), or with
+`Typesafe::SDK::Image.from_base64` from base64 text. Images must be PNG or JPEG. The API detects
+the format from the file bytes and rejects other formats, such as WebP and GIF, with a
+`BadRequestError`. You can use an image in a request in three ways, and you can combine them.
+
+Image support is an experimental API feature. Opt in by sending the
+`TypeSafe-Danger-Zone-Images: true` header for a client, or per call with `headers:`:
+
+```ruby
+client = Typesafe::SDK::Client.new(default_headers: { "TypeSafe-Danger-Zone-Images" => "true" })
+```
+
+**Place the image in the content.** Put it anywhere in `state`, question instructions, or criteria:
+
+```ruby
+require "pathname"
+
+photo = Typesafe::SDK.image(Pathname("returns/RMA-1042.jpg"))
+response = client.system_one(
+  state: { claim: "The mug arrived with a chipped rim.", photo: photo },
+  questions: {
+    damaged: Typesafe::SDK.noul("Is the product in the photo damaged?"),
+    severity: Typesafe::SDK.score("How severe is the damage?", %w[none cosmetic unusable]),
+  },
+)
+puts response[:damaged].noul, response[:severity].score
+```
+
+**Write the image into text with `with_assets`.** Ruby has no tagged template literals, so pass
+the text and images as separate arguments, in order; other values are converted with `to_s`.
+`join_assets` joins a list like `Array#join`, with `","` as the default separator, as in
+JavaScript's `withAssets.join`:
+
+```ruby
+upload = Typesafe::SDK.image(params[:photo].read)
+catalog = Typesafe::SDK.image(Pathname("catalog/mug.png"))
+uploads = params[:photos].map { |file| Typesafe::SDK.image(file.read) }
+
+response = client.system_one(
+  state: Typesafe::SDK.with_assets("The seller uploaded ", Typesafe::SDK.join_assets(uploads, ", "), "."),
+  questions: {
+    same_product: Typesafe::SDK.noul(Typesafe::SDK.with_assets("Does ", upload, " show the product in ", catalog, "?")),
+  },
+)
+```
+
+Each image is sent once, however many times it is used. Plain string interpolation, such as
+`"Compare #{upload}"`, writes only the image's reference, so the call raises `TypeSafeError`
+before the request is sent.
+
+**Choose your own references with `assets:`.** Pass images keyed by names of your choice, then
+use those names in plain strings, such as prompts stored in configuration:
+
+```ruby
+response = client.system_one(
+  state: "A customer returned <delivered>. The catalog photo is <catalog>.",
+  questions: { matches: Typesafe::SDK.noul("Is <delivered> the product shown in <catalog>?") },
+  assets: {
+    "<delivered>" => Typesafe::SDK.image(File.binread("returns/RMA-1042.jpg")),
+    "<catalog>" => Typesafe::SDK.image(Pathname("catalog/mug.png")),
+  },
+)
+```
+
+Use distinct delimiters, such as `<delivered>`, so names don't match ordinary text. An image in
+`assets:` that also appears in content or `with_assets` text is written there under its name.
+Every name in `assets:` must appear in the request; otherwise the call raises `TypeSafeError`
+before sending.
+
+**Locate something with `box`.** A box question locates what its instructions describe. The
+answer's `box` holds the edges as fractions of the image's height (`top`, `bottom`) and width
+(`left`, `right`). Its `confidence` is `nil` when the API doesn't report one. Use the
+`jev-preview` model for box questions:
+
+```ruby
+response = client.system_one(
+  state: Typesafe::SDK.image(Pathname("returns/RMA-1042.jpg")),
+  questions: { damage: Typesafe::SDK.box("The damaged area of the product") },
+  model: "jev-preview",
+)
+box = response[:damage].box
+puts [box.top, box.bottom, box.left, box.right].inspect
+```
+
+Requests with images are sent as `multipart/form-data`, with each image's file bytes in its own part.
+
 ## Using confidence
 
 Choice and Score include confidence derived from their probability distributions. Confidence
@@ -162,6 +259,7 @@ construction. Error messages do not include the key.
 | `base_url:` | `TYPESAFE_BASE_URL` | `https://api.typesafe.ai` |
 | `default_model:` | `TYPESAFE_DEFAULT_MODEL` | `jev-latest` |
 | `log_level:` | `TYPESAFE_LOG_LEVEL` | `warn` |
+| `compression:` | None | `:zstd` when `zstd-ruby` is installed, otherwise `false` |
 
 ```ruby
 client = Typesafe::SDK::Client.new(
@@ -172,6 +270,19 @@ client = Typesafe::SDK::Client.new(
 )
 ```
 
+### Request compression
+
+Added in Ruby **0.7.0**. When the optional [`zstd-ruby`](https://rubygems.org/gems/zstd-ruby) gem
+is available (add `gem "zstd-ruby"` to your Gemfile), the client compresses request bodies of
+1 KiB or more with zstd, which reduces upload size and time, especially for large states and
+images. Smaller bodies are sent uncompressed. Without the gem, all bodies are sent uncompressed;
+`compression: :zstd` then raises `TypeSafeError`. Pass `compression: false` to send all bodies
+uncompressed, for example to an API that doesn't accept compressed requests:
+
+```ruby
+client = Typesafe::SDK::Client.new(compression: false)
+```
+
 `jev-latest` is a moving alias. For reproducible deployments, select an explicit model from
 `client.models.list` and set `default_model:` or a per-call `model:`. See
 [available models and aliases](https://docs.typesafe.ai/models).
@@ -239,6 +350,10 @@ Errors reach your code after any configured retries. All SDK errors inherit from
 | `APITimeoutError` | Subclass of `APIConnectionError`; exposes `timeout_ms` |
 | `APIUserAbortError` | Caller cancellation; never retried |
 
+From Ruby 0.7.0, when an HTML page from Cloudflare answers instead of the API, for example because
+its firewall matched text such as a shell command in `state`, the error message says so and
+includes the `cf-ray` ID to report to TypeSafe support. The error class and `body` are unchanged.
+
 ## Response metadata and additional fields
 
 Added for Ruby **0.6.0.1**:
@@ -292,7 +407,9 @@ end
 
 The default logger writes to `$stderr` with a `[typesafe-ai]` prefix. `info` includes request
 summaries; `debug` adds redacted credential headers and request/response bodies. Bodies may
-contain application data and are **not** redacted.
+contain application data and are **not** redacted. Image bytes are not logged; requests show each
+image's multipart part name. From Ruby 0.7.0, `x-api-key` values are always fully masked, and
+authorization headers keep only an alphabetic scheme, such as `Bearer`, that a credential follows.
 
 From Ruby 0.6.0.1, standard Ruby `Logger` and `Rails.logger` also accept debug details:
 
@@ -316,6 +433,10 @@ application if your Ruby version does not provide it by default.
 | `retry: { maxRetries: 0 }` | `retry_policy: { max_retries: 0 }` |
 | `.withResponse()` | `with_response: true` (Ruby 0.6.0.1+) |
 | `AbortController` | `Typesafe::SDK::Signal` |
+| `image(blob)`, `Image.fromBase64(text)` | `Typesafe::SDK.image(bytes_or_pathname)`, `Typesafe::SDK::Image.from_base64(text)` |
+| `` withAssets`Compare ${a} with ${b}` `` | `Typesafe::SDK.with_assets("Compare ", a, " with ", b)` |
+| `withAssets.join(images, ", ")` | `Typesafe::SDK.join_assets(images, ", ")` |
+| `compression: false` | `compression: false` |
 | `answers.category` | `response[:category]` or `response.answers["category"]` |
 
 Ruby calls are synchronous and return Ruby answer objects. They do not provide TypeScript

data/docs/COMPATIBILITY.md

@@ -1,8 +1,8 @@
 # JavaScript SDK compatibility
 
-This unofficial Ruby client targets the official `@typesafe-ai/sdk` **0.6.0** release,
-commit [`66880ccded6cb642dc1809620c2b108c33730214`](https://github.com/typesafe-ai/typesafe-sdk-js/tree/66880ccded6cb642dc1809620c2b108c33730214).
-Audit date: 2026-09-21. This is a tested compatibility target, not a claim of endorsement
+This unofficial Ruby client targets the official `@typesafe-ai/sdk` **0.7.0** release,
+commit [`b844cd1aca12855a5d24a2df52a1401c86e7d37a`](https://github.com/typesafe-ai/typesafe-sdk-js/tree/b844cd1aca12855a5d24a2df52a1401c86e7d37a).
+Audit date: 2026-10-16. This is a tested compatibility target, not a claim of endorsement
 or a guarantee about future API changes.
 
 ## What is covered
@@ -11,44 +11,72 @@ or a guarantee about future API changes.
 | --- | --- |
 | Endpoints | `POST /v1/systemone`, `GET /v1/models` |
 | Defaults | `jev-latest`, 10-second attempt timeout, two retries |
-| Questions | Noul, choice, ordered score criteria; structured instructions/state and nullable choice descriptions |
+| Questions | Noul, choice, ordered score criteria, and box; structured instructions/state and nullable choice descriptions |
+| Images | `image`, `Image.from_base64`, images in content, `with_assets`/`join_assets` text, named `assets:`; multipart encoding, part names, content types, and reference validation |
+| Compression | zstd for bodies of 1 KiB or more (UTF-8 bytes), `compression: false`, protected `Content-Encoding`, same bytes on every retry |
+| Serialization | Non-finite floats sent as `"NaN"`, `"Infinity"`, `"-Infinity"`; the request is copied when the call starts |
 | Configuration | Explicit settings override trimmed environment values |
 | Retries | 408, 429, 500–599; connection and timeout failures independently configurable |
 | Server delays | Fractional milliseconds/seconds, HTTP dates, maximum delay and jitter |
 | Headers | Case-insensitive overrides; protected auth, content type, SDK and retry headers |
 | Errors | HTTP subclasses, validation messages, request IDs, connection/timeout/cancellation errors |
 | Transport | Timeout includes full body delivery; cancellation interrupts an active attempt and backoff; truncated bodies are retried |
-| Results | Typed answers and usage; model cards; `with_response: true` for HTTP metadata |
+| Results | Typed answers (including box answers and nullable usage), `to_h` with unmodeled fields; model cards; `with_response: true` for HTTP metadata |
 | Extension fields | `extra_body:` forwards additional JSON fields without overriding named arguments |
 
-The checked-in `spec/fixtures/js-0.6.0.json` was generated by executing the published
+The checked-in `spec/fixtures/js-0.7.0.json` was generated by executing the published
 JavaScript package, rather than by copying expected output from the Ruby implementation.
-`parity_spec.rb` compares question JSON, request payloads, metadata, error mapping/messages,
-complete answer fields (including fractional scores and string rubric keys), retry header
-parsing, and nullable retry flags. `http_spec.rb` uses real loopback sockets to exercise behavior
+`parity_spec.rb` compares question JSON, request payloads (including non-finite numbers),
+multipart requests and parts with images in content, text, and named assets, `withAssets.join`
+text, asset validation messages, base64 decoding, compression thresholds, metadata, error
+mapping/messages, complete answer fields (including box answers, fractional scores, and string
+rubric keys), retry header parsing, and nullable retry flags. Image references are random, so
+the fixture replaces them with stable labels. `http_spec.rb` uses real loopback sockets to exercise behavior
 that mocked HTTP adapters cannot verify. Other specs cover Ruby configuration and logging.
 Known upstream bugs are corrected explicitly in the comparisons; the fixtures retain the
 original JS behavior for those cases.
 See the [issue-by-issue audit](UPSTREAM_ISSUES.md) for every upstream issue reviewed.
 
-To regenerate the fixtures, download the official release asset from
-[GitHub](https://github.com/typesafe-ai/typesafe-sdk-js/releases/tag/v0.6.0), unpack it, and run:
+To regenerate the fixtures with Node.js 22.15 or newer, unpack the official package
+(`npm pack @typesafe-ai/sdk@0.7.0`, or the asset from the
+[GitHub release](https://github.com/typesafe-ai/typesafe-sdk-js/releases/tag/v0.7.0)) and run:
 
 ```sh
-node script/generate_parity_fixtures.cjs /path/to/package > spec/fixtures/js-0.6.0.json
+node script/generate_parity_fixtures.cjs /path/to/package > spec/fixtures/js-0.7.0.json
 bundle exec rake
 ```
 
 ## Intentional Ruby differences and limits
 
-- Ruby 0.6.0.1 validates API keys without echoing their contents and rejects reported
+- Images: Ruby accepts a binary `String`, a `Pathname` (read when the request is sent, like a
+  JavaScript `Blob`), or an IO (read immediately, since it may not be readable twice). Ruby has
+  no tagged template literals, so `with_assets(*parts)` joins text and images given as separate
+  arguments, converting other values with `to_s` (`nil` becomes `""`, as in interpolation; the
+  JavaScript template writes `null`). A Hash or Array part is written with `to_s`, which includes
+  the references of images inside it, so those images are attached; JavaScript writes
+  `[object Object]` and attaches none. `join_assets` defaults to `","`, as `withAssets.join` does.
+- `assets:` must be a Hash of nonempty names to images; Ruby checks this before sending.
+  A request containing a cycle raises `TypeSafeError`; JavaScript raises a `TypeError`.
+- Compression needs the optional `zstd-ruby` gem; it is detected once per process, as JS
+  detects Node.js zstd support. `compression:` accepts `:zstd`, `"zstd"`, or `false`, and
+  `client.compression` returns `:zstd` or `false`.
+- JS 0.7.0 returns rejected promises instead of throwing for invalid requests. Ruby calls are
+  synchronous, so invalid requests and options raise `TypeSafeError` from the call, before any
+  image is read or request is sent.
+- Ruby keeps its 0.6.0.1 validation messages. JS 0.7.0 adds similar checks for nil state and
+  empty noul questions with its own wording, and both now reject non-Hash noul criteria.
+
+- Since 0.6.0.1, Ruby validates API keys without echoing their contents and rejects reported
   API-invalid state/question shapes locally. Score levels must be non-nil and number 2–10;
   choice options must number 1–255; noul requires instructions or an outcome description;
-  state must be a string, object, or array; question names cannot be empty.
+  state must be a string, object, array, or image; question names cannot be empty.
   Builders and raw question hashes use the same checks. This intentionally tightens the
-  permissive JS 0.6.0 behavior; local validation is not a complete server schema validator.
+  JS 0.7.0 behavior, which still accepts nil score levels and unbounded score/choice sizes; local validation is not a complete server schema validator.
 - Blank retry headers fall back to configured backoff (or another valid delay header).
-  JS 0.6.0 incorrectly treats blanks as zero. Literal zero remains valid in Ruby.
+  JS 0.7.0 still treats blanks as zero. Literal zero remains valid in Ruby.
+- Debug logs fully mask `x-api-key` and keep only an alphabetic authorization scheme followed
+  by a credential (upstream #18, unchanged in JS 0.7.0). Cloudflare HTML error pages get a
+  message naming the edge block and `cf-ray` ID (upstream #15).
 - HTTP 402, 409, and 413 have `PaymentRequiredError`, `ConflictError`, and
   `PayloadTooLargeError` subclasses. Existing `APIError` rescue clauses still catch them.
 - Methods/options use snake_case. `timeout:` is in **seconds**; retry settings ending in
@@ -78,7 +106,8 @@ Offline tests do not prove account authentication, current model availability, b
 production inference behavior. No live API key was available during this audit, so no live
 TypeSafe request was made.
 
-An explicit smoke test checks model listing and all three answer types with synthetic input:
+An explicit smoke test checks model listing and the noul, choice, and score answer types with
+synthetic input:
 
 ```sh
 # Set TYPESAFE_API_KEY securely in your environment first.
@@ -86,4 +115,5 @@ TYPESAFE_LIVE_TEST=1 bundle exec ruby script/smoke_test.rb
 ```
 
 This makes one inference request, which may incur normal API charges. It does not retry or
-print the API key, input bodies, or full responses.
+print the API key, input bodies, or full responses. Add `TYPESAFE_LIVE_IMAGES=1` for an account
+with image access to also send one image with a box question to `jev-preview`.

data/docs/UPSTREAM_ISSUES.md

@@ -1,9 +1,11 @@
 # Upstream issue audit
 
-Reviewed all **11 issues** returned by the official JavaScript repository's all-state issue
-list on **2026-09-21**, including their comments. All were open at review time. The baseline
-is `@typesafe-ai/sdk` **0.6.0**, commit `66880ccded6cb642dc1809620c2b108c33730214`.
-Ruby changes below are included in **0.6.0.1**.
+Reviewed all **17 issues** in the official JavaScript repository's issue list, including their
+comments: the first 11 on **2026-09-21** against `@typesafe-ai/sdk` **0.6.0** (commit
+`66880cc`), with Ruby fixes in **0.6.0.1**, and #15–#20 on **2026-10-16** against **0.7.0**
+(commit `b844cd1aca12855a5d24a2df52a1401c86e7d37a`), with Ruby fixes in **0.7.0**. The issue
+page showed no closed issues; it does not show each issue's state, so the six new issues were
+checked individually and were open.
 
 This audit distinguishes client fixes from runtime differences and server feature requests.
 It does not claim that the upstream issues are closed or that every requested API feature
@@ -14,22 +16,28 @@ known JS bugs is not a compatibility goal.
 
 | Upstream issue | Ruby disposition | Evidence or remaining limitation |
 | --- | --- | --- |
+| [#20: 0.7.0 fails every request on Bun](https://github.com/typesafe-ai/typesafe-sdk-js/issues/20) | Bun/Fetch-specific; not applicable | The failure is in JS 0.7.0's Fetch body buffering under Bun. Ruby's Net::HTTP transport reads each body once in its own worker; real-socket tests cover body delivery, timeouts, and cancellation. |
+| [#19: custom `fetch` called with the client as `this`](https://github.com/typesafe-ai/typesafe-sdk-js/issues/19) | JavaScript-specific; not applicable | Ruby calls a custom `http:` adapter's `request` method on the adapter itself, so there is no receiver mismatch. |
+| [#18: secrets shown as an authorization scheme in logs](https://github.com/typesafe-ai/typesafe-sdk-js/issues/18) | Fixed locally | Ruby had the same logic. `x-api-key` values are always fully masked; authorization headers keep only an alphabetic scheme followed by a credential. `"sk-live-… x"` and `"TOKEN "` are no longer shown. Unchanged in JS 0.7.0. |
+| [#17: non-finite numbers serialized as null](https://github.com/typesafe-ai/typesafe-sdk-js/issues/17) | Matches JS 0.7.0 | Ruby 0.6.0.1 raised `JSON::GeneratorError`. Like JS 0.7.0, Ruby now sends `"NaN"`, `"Infinity"`, and `"-Infinity"` instead; the issue proposed rejecting them, and Ruby follows the released upstream behavior. |
+| [#16: token admission bounds and billing reconciliation](https://github.com/typesafe-ai/typesafe-sdk-js/issues/16) | Requires upstream API/documentation | There is no official tokenizer, token-count endpoint, or charge export to wrap. Ruby doesn't estimate tokens; `with_response: true` exposes the request ID and raw `usage` for reconciliation. |
+| [#15: Cloudflare HTML 403 for state containing shell commands](https://github.com/typesafe-ai/typesafe-sdk-js/issues/15) | Server-side; clearer Ruby error | The block happens before the API, so no client change can let these requests through. Ruby now names a Cloudflare HTML page and its `cf-ray` ID in the error message instead of quoting HTML. The class stays `PermissionDeniedError`, and the HTML stays in `body`. |
 | [#14: API key disclosure and empty keys](https://github.com/typesafe-ai/typesafe-sdk-js/issues/14) | Fixed locally | Validate explicit and environment keys at construction, trim outer spaces/tabs/line endings, reject empty/non-ASCII/control/embedded-whitespace values, and copy/freeze the key. Validation errors contain no key and make no request or retry. Header-construction failures also propagate without connection retries. |
 | [#13: actionable HTTP error classes](https://github.com/typesafe-ai/typesafe-sdk-js/issues/13) | Implemented | HTTP 402, 409, and 413 map to `PaymentRequiredError`, `ConflictError`, and `PayloadTooLargeError`. Each remains an `APIError`, retains response metadata, and is not retried by default. |
-| [#12: null score levels](https://github.com/typesafe-ai/typesafe-sdk-js/issues/12) | Fixed locally | Builders and raw hashes reject nil levels. Use an explicit empty string for an undescribed position; entries are never removed or renumbered. This workaround is reported accepted in the upstream issue, not independently verified against the live API here. |
+| [#12: null score levels](https://github.com/typesafe-ai/typesafe-sdk-js/issues/12) | Fixed locally; still accepted by JS 0.7.0 | Builders and raw hashes reject nil levels. Use an explicit empty string for an undescribed position; entries are never removed or renumbered. This workaround is reported accepted in the upstream issue, not independently verified against the live API here. |
 | [#11: calibrated multi-label selection](https://github.com/typesafe-ai/typesafe-sdk-js/issues/11) | Requires upstream API/model support | Choice selects one option. Multiple noul questions are independent judgments, not a calibrated competitive multi-label substitute. The Ruby SDK does not invent such an endpoint or promise equivalent calibration. |
 | [#10: cached or registered criteria](https://github.com/typesafe-ai/typesafe-sdk-js/issues/10) | Requires upstream API support | Reusing a Ruby question Hash still sends the criteria on each request and does not reduce billed tokens. There is no supported registration/cache API in the audited JS SDK. No synthetic `cached_tokens` field is exposed. |
-| [#9: blank retry delay headers](https://github.com/typesafe-ai/typesafe-sdk-js/issues/9) | Fixed locally | Blank/whitespace-only delays fall back to configured backoff; blank milliseconds can fall through to valid seconds. Literal zero is still honored. Request-path tests verify the actual retry delay. |
+| [#9: blank retry delay headers](https://github.com/typesafe-ai/typesafe-sdk-js/issues/9) | Fixed locally; unchanged in JS 0.7.0 | Blank/whitespace-only delays fall back to configured backoff; blank milliseconds can fall through to valid seconds. Literal zero is still honored. Request-path tests verify the actual retry delay. |
 | [#8: Node timer overflow](https://github.com/typesafe-ai/typesafe-sdk-js/issues/8) | Node-specific; Ruby equivalent tested | Ruby does not use Node timers. Real loopback requests with delayed responses succeed at and just above Node's 2,147,483,647 ms boundary, for both constructor and per-call settings. This is not a guarantee for every arbitrarily large OS timeout. |
 | [#7: list the community Go SDK](https://github.com/typesafe-ai/typesafe-sdk-js/issues/7) | Upstream documentation request | No Ruby defect. Whether TypeSafe lists third-party clients is an upstream decision; this repository clearly identifies itself as unofficial. |
-| [#6: API-invalid request shapes and limits](https://github.com/typesafe-ai/typesafe-sdk-js/issues/6) | Fixed locally | Require string/object/array state and reject nil; require noul instructions or a non-nil true/false description; enforce 2–10 score levels, 1–255 choice options, and nonempty question names. Empty state containers, single-option choice, and whitespace-only names remain allowed. |
+| [#6: API-invalid request shapes and limits](https://github.com/typesafe-ai/typesafe-sdk-js/issues/6) | Fixed locally; partly in JS 0.7.0 | Require string/object/array/image state and reject nil; require noul instructions or a non-nil true/false description; enforce 2–10 score levels, 1–255 choice options, and nonempty question names. Empty state containers, single-option choice, and whitespace-only names remain allowed. JS 0.7.0 now rejects null state, empty noul questions, and empty or non-map choice criteria, but not the size bounds. |
 | [#4: numeric choice label inference](https://github.com/typesafe-ai/typesafe-sdk-js/issues/4) | TypeScript-specific; Ruby equivalent tested | Ruby has no TypeScript `never` inference. Numeric labels serialize as JSON string keys and choice answers/probability keys remain strings. |
 | [#2: handled cancellation crashes Node](https://github.com/typesafe-ai/typesafe-sdk-js/issues/2) | Different transport; Ruby equivalent tested | The Net::HTTP worker is cleaned up before cancellation returns. Separate processes with `Thread.abort_on_exception = true` catch `APIUserAbortError` and exit normally after cancellation during successful and error response bodies, for inference and model listing. Existing socket tests also exercise cancellation and worker cleanup. |
 
 ## Compatibility and migration
 
 The local validation, blank-header handling, and added error subclasses intentionally differ
-from JS 0.6.0. Previously accepted local inputs that are reported rejected by the API now raise
+from JS 0.6.0, and most still differ from JS 0.7.0. Previously accepted local inputs that are reported rejected by the API now raise
 `TypeSafeError` earlier. In particular, replace `noul()` with an actual question or outcome
 criteria, supply non-nil state, and replace nil score placeholders explicitly with descriptions
 or empty strings. Do not drop score slots to pass validation, because their positions define
@@ -51,6 +59,8 @@ upstream documentation before relying on newly introduced fields or sending `ext
 
 - [Issue regressions](../spec/typesafe/sdk/upstream_issues_spec.rb): request validation,
   API key handling, retry scheduling, error mapping, and numeric labels using synthetic data.
+- [0.7.0 regressions](../spec/typesafe/sdk/release_0_7_spec.rb): non-finite numbers (#17),
+  credential redaction (#18), Cloudflare error pages (#15), and box/validation changes.
 - [Socket regressions](../spec/typesafe/sdk/http_spec.rb): actual Ruby transport behavior,
   including the Node timer boundary, cancellation, and slow/truncated bodies.
 - [Subprocess cancellation](../spec/typesafe/sdk/cancellation_process_spec.rb): handled