@absolutejs/ai 0.0.51 → 0.0.53

package/README.md

@@ -111,8 +111,29 @@ const provider = openrouter({
 The adapter intentionally has no built-in geopolitical model list. Omitting
 `allowedModels` exposes the full OpenRouter catalog; applications that need a
 restricted catalog can define their own `allowedModels` and `allowedProviders`
-policy. Avoid `openrouter/auto` under a strict policy unless it is deliberately
-allowed.
+policy. Auto Router is fully supported with `openrouter/auto` (or
+`openrouter/auto-beta`), a sticky `sessionId`, and its typed plugin controls:
+
+```ts
+const provider = openrouter({
+  apiKey: process.env.OPENROUTER_API_KEY,
+  // Omit this for unrestricted access to every OpenRouter model.
+  allowedModels: ["openrouter/auto", "anthropic/*", "openai/*"],
+  requestOptions: {
+    sessionId: conversationId,
+    plugins: [
+      {
+        id: "auto-router",
+        cost_tier: "low",
+        allowed_models: ["anthropic/*", "openai/*"],
+      },
+    ],
+  },
+});
+```
+
+Under a strict policy, Auto Router's `allowed_models` is checked locally along
+with fallback, Fusion, advisor, subagent, and other indirectly selected models.
 
 Provider usage callbacks include OpenRouter's reported `costCredits`,
 `upstreamInferenceCostCredits`, cache-read/write token counts, and reasoning
@@ -149,7 +170,10 @@ message transforms, native reasoning controls, prompt and response caching,
 text-plus-audio output, verbosity, user attribution, and an `extraBody` escape
 hatch for new OpenRouter parameters. The escape hatch cannot replace models,
 fallbacks, providers, presets, messages, plugins, or tools; those fields use
-policy-aware typed options instead.
+policy-aware typed options instead. Advisor, Fusion, Shell, Subagent, model
+search, web search/fetch, image generation, Datetime, and Apply Patch server
+tools have typed wire parameters and documented range checks. OpenRouter's old
+`web` plugin is deprecated; use `openrouter:web_search` instead.
 
 URL images and PDFs, base64 audio, and URL/base64 video inputs use the ordinary
 AbsoluteJS content-block contract. URL citations are emitted as `citation`
@@ -161,8 +185,9 @@ metadata when reported.
 
 `createOpenRouterClient()` covers model/provider discovery, embeddings,
 reranking, streamed and non-streamed image generation, reusable files,
-Responses, speech, transcription, video jobs and downloads, batches, presets,
-credits, key metadata, and generation metadata. It also exports
+Responses, speech, typed transcription, video jobs and downloads, beta batches,
+presets, workspaces and budgets, activity/analytics, task classifications,
+credits, key metadata, and generation content. It also exports
 `verifyOpenRouterWebhookSignature()` for video completion webhooks. Its typed
 operations enforce the same model allowlist. `request()` and `requestRaw()` are
 forward-compatible access to new or administrative OpenRouter endpoints.
@@ -190,16 +215,90 @@ const reranked = await openrouterClient.rerank({
   query: "cost controls",
   documents: ["response caching", "CSS layout"],
 });
+
+// Response healing is documented for non-streaming structured responses.
+const healed = await openrouterClient.chat({
+  model: "anthropic/claude-sonnet-4.6",
+  messages: [{ role: "user", content: "Return a JSON object" }],
+  response_format: { type: "json_object" },
+  plugins: [{ id: "response-healing" }],
+});
+
+const batch = await openrouterClient.createBatch({
+  endpoint: "/v1/chat/completions",
+  model: "anthropic/claude-sonnet-4.6",
+  requests: [
+    { custom_id: "one", body: { messages: [{ role: "user", content: "Hi" }] } },
+  ],
+});
+const completed = await openrouterClient.waitForBatch(batch.id, {
+  signal: abortController.signal,
+  timeoutMs: 60_000,
+});
+```
+
+Batch traffic uses OpenRouter's separate `/api/beta/batches` API and returns
+inline typed results. `estimateOpenRouterModelCost()` calculates prompt,
+completion, request, image, web-search, reasoning, and cache costs directly from
+model-discovery pricing fields.
+
+OAuth helpers cover S256 PKCE, web and headless authorization URLs, code
+exchange, authenticated code creation, and user key deep-links:
+
+```ts
+const pkce = await generateOpenRouterPKCE();
+const authorizationUrl = createOpenRouterAuthorizationUrl({
+  callbackUrl: "https://example.com/openrouter/callback",
+  codeChallenge: pkce.codeChallenge,
+  codeChallengeMethod: pkce.codeChallengeMethod,
+});
+
+const { key } = await exchangeOpenRouterAuthCode({
+  code,
+  code_verifier: pkce.codeVerifier,
+  code_challenge_method: pkce.codeChallengeMethod,
+});
 ```
 
+### Complete OpenRouter management SDK
+
+The inference adapter stays small and policy-aware. The separate
+`@absolutejs/ai/openrouter/sdk` entry point configures and exposes OpenRouter's
+official OpenAPI-generated TypeScript SDK for the complete administrative and
+data surface:
+
+```ts
+import { createOpenRouterSDK } from "@absolutejs/ai/openrouter/sdk";
+
+const openrouterAdmin = createOpenRouterSDK({
+  tokenSource: getRotatingManagementKey,
+  appName: "My AbsoluteJS App",
+  appUrl: "https://example.com",
+  timeoutMs: 15_000,
+  retryConfig: { strategy: "backoff" },
+});
+
+const keys = await openrouterAdmin.apiKeys.list();
+const guardrails = await openrouterAdmin.guardrails.list();
+const embeddingModels = await openrouterAdmin.embeddings.listModels();
+```
+
+This entry point includes API-key management, BYOK, guardrails and assignments,
+observability destinations, organizations, SCIM, workspaces, public datasets,
+benchmarks, typed pagination, retries, per-call timeouts, and abort signals. It
+tracks compatible patch releases of OpenRouter's generated SDK so new OpenAPI
+fields do not depend on a handwritten AbsoluteJS type update. Normal
+`@absolutejs/ai/openrouter` imports do not load this management surface.
+
 For a strict model-origin policy, also assign an OpenRouter key/workspace
 guardrail with the same model allowlist. Provider allowlists restrict where a
 model runs; they do not identify who developed it. Presets and router aliases
 must be explicitly allowed, because their resolved model is controlled outside
 the request. The raw client is intentionally unopinionated and should be limited
-to trusted server-side administration code. OpenRouter's official SDK can be
-used alongside this package for its complete organization, SSO, SCIM, BYOK, and
-analytics type surface.
+to trusted server-side administration code. OpenRouter currently documents
+reporting generation feedback through Chatroom and Logs, not through a public
+feedback API, so AbsoluteJS exposes generation IDs/content without inventing an
+unstable endpoint.
 
 Use `openrouterResponses(config)` when an AbsoluteJS agent should stream through
 OpenRouter's stateless Responses API, or `openrouterMessages(config)` for the

package/dist/ai/index.js

@@ -2584,7 +2584,46 @@ var ollama = (config2 = {}) => {
 };
 
 // src/ai/providers/openrouterClient.ts
+var OPENROUTER_PRICING_KEYS = [
+  "prompt",
+  "completion",
+  "request",
+  "image",
+  "web_search",
+  "internal_reasoning",
+  "input_cache_read",
+  "input_cache_write"
+];
+var estimateOpenRouterCost = (pricing, units) => {
+  const components = {};
+  let total = 0;
+  for (const key of OPENROUTER_PRICING_KEYS) {
+    const quantity = units[key];
+    if (quantity === undefined)
+      continue;
+    if (!Number.isFinite(quantity) || quantity < 0)
+      throw new Error(`OpenRouter ${key} units must be non-negative`);
+    const rawPrice = pricing[key];
+    if (rawPrice === undefined)
+      continue;
+    const price = Number(rawPrice);
+    if (!Number.isFinite(price) || price < 0)
+      throw new Error(`OpenRouter ${key} price must be non-negative`);
+    components[key] = price * quantity;
+    total += components[key];
+  }
+  return { components, total };
+};
+var estimateOpenRouterModelCost = (model, units) => estimateOpenRouterCost(model.pricing ?? {}, units);
 var DEFAULT_BASE_URL6 = "https://openrouter.ai/api/v1";
+var DEFAULT_BATCH_BASE_URL = "https://openrouter.ai/api/beta";
+var DEFAULT_SITE_URL = "https://openrouter.ai";
+var TERMINAL_BATCH_STATUSES = new Set([
+  "completed",
+  "failed",
+  "expired",
+  "cancelled"
+]);
 var withoutLatestPrefix = (model) => model.startsWith("~") ? model.slice(1) : model;
 var openRouterModelMatchesRule = (model, rule) => {
   const normalizedModel = withoutLatestPrefix(model);
@@ -2598,6 +2637,22 @@ var assertAllowedModel = (model, allowedModels) => {
     return;
   throw new Error(`OpenRouter model "${model}" is not allowed`);
 };
+var assertAllowedModelsInValue = (value, allowedModels, key = "") => {
+  if (key === "model" && typeof value === "string")
+    assertAllowedModel(value, allowedModels);
+  if ((key === "models" || key === "analysis_models" || key === "allowed_models") && Array.isArray(value)) {
+    for (const model of value)
+      if (typeof model === "string")
+        assertAllowedModel(model, allowedModels);
+  }
+  if (Array.isArray(value)) {
+    for (const item of value)
+      assertAllowedModelsInValue(item, allowedModels);
+  } else if (value && typeof value === "object") {
+    for (const [childKey, child] of Object.entries(value))
+      assertAllowedModelsInValue(child, allowedModels, childKey);
+  }
+};
 var normalizePath = (path) => path.startsWith("/") ? path : `/${path}`;
 var encodeModelPath = (model) => model.split("/").map(encodeURIComponent).join("/");
 var withQuery = (url, query) => {
@@ -2648,6 +2703,54 @@ var parseImageSSE = async function* (response) {
   }
 };
 var toBytes = (value) => typeof value === "string" ? new TextEncoder().encode(value) : value;
+var toBase64Url = (bytes) => {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var generateOpenRouterPKCE = async () => {
+  const random = crypto.getRandomValues(new Uint8Array(32));
+  const codeVerifier = toBase64Url(random);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+  return {
+    codeChallenge: toBase64Url(new Uint8Array(digest)),
+    codeChallengeMethod: "S256",
+    codeVerifier
+  };
+};
+var createOpenRouterAuthorizationUrl = (options = {}) => {
+  const url = new URL("/auth", options.baseUrl ?? DEFAULT_SITE_URL);
+  if (options.callbackUrl)
+    url.searchParams.set("callback_url", options.callbackUrl);
+  if (options.codeChallenge)
+    url.searchParams.set("code_challenge", options.codeChallenge);
+  if (options.codeChallengeMethod)
+    url.searchParams.set("code_challenge_method", options.codeChallengeMethod);
+  if (options.keyLabel)
+    url.searchParams.set("key_label", options.keyLabel);
+  return url.toString();
+};
+var exchangeOpenRouterAuthCode = async (body, options = {}) => {
+  const response = await (options.fetch ?? globalThis.fetch)(`${(options.baseUrl ?? DEFAULT_BASE_URL6).replace(/\/$/, "")}/auth/keys`, {
+    body: JSON.stringify(body),
+    headers: { "Content-Type": "application/json" },
+    method: "POST"
+  });
+  if (!response.ok)
+    throw ProviderError.fromResponse("openrouter", response.status, await response.text());
+  return response.json();
+};
+var createOpenRouterKeyLinks = async (key, siteUrl = DEFAULT_SITE_URL) => {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(key)));
+  const hash = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const root = siteUrl.replace(/\/$/, "");
+  return {
+    hash,
+    logsUrl: `${root}/logs?api_key_hash=${hash}`,
+    settingsUrl: `${root}/keys/${hash}`
+  };
+};
 var hexToBytes = (hex) => {
   if (!/^[0-9a-f]+$/iu.test(hex) || hex.length % 2 !== 0)
     return;
@@ -2693,9 +2796,11 @@ var createOpenRouterClient = (config2) => {
   if (!config2.apiKey && !config2.tokenSource)
     throw new Error("createOpenRouterClient() requires either apiKey or tokenSource");
   const baseUrl = (config2.baseUrl ?? DEFAULT_BASE_URL6).replace(/\/$/, "");
+  const batchBaseUrl = (config2.batchBaseUrl ?? (config2.baseUrl ? new URL("../beta", `${baseUrl}/`).toString() : DEFAULT_BATCH_BASE_URL)).replace(/\/$/, "");
   const fetchImpl = config2.fetch ?? globalThis.fetch;
   const allowedModels = config2.allowedModels ? [...config2.allowedModels] : undefined;
-  const requestRaw = async (path, options = {}) => {
+  const defaultWorkspaceId = config2.workspaceId;
+  const requestRawAt = async (rootUrl, path, options = {}) => {
     const token = config2.tokenSource ? await Promise.resolve(config2.tokenSource()) : config2.apiKey;
     const suppliedHeaders = typeof config2.headers === "function" ? await config2.headers() : config2.headers ?? {};
     const headers = new Headers(suppliedHeaders);
@@ -2709,13 +2814,16 @@ var createOpenRouterClient = (config2) => {
       body = JSON.stringify(options.body);
     }
     const { query, ...requestInit } = options;
-    const response = await fetchImpl(withQuery(`${baseUrl}${normalizePath(path)}`, options.query), { ...requestInit, body, headers });
+    const response = await fetchImpl(withQuery(`${rootUrl}${normalizePath(path)}`, options.query), { ...requestInit, body, headers });
     if (!response.ok) {
       throw ProviderError.fromResponse("openrouter", response.status, await response.text());
     }
     return response;
   };
+  const requestRaw = (path, options = {}) => requestRawAt(baseUrl, path, options);
   const request = async (path, options = {}) => (await requestRaw(path, options)).json();
+  const requestBatch = async (path, options = {}) => (await requestRawAt(batchBaseUrl, path, options)).json();
+  const getBatch = (id) => requestBatch(`/batches/${encodeURIComponent(id)}`);
   const listModels = async (query) => {
     const result = await request("/models", { query });
     if (!allowedModels)
@@ -2734,10 +2842,52 @@ var createOpenRouterClient = (config2) => {
     };
   };
   return {
-    cancelBatch: (id) => request(`/batches/${encodeURIComponent(id)}/cancel`, {
+    addWorkspaceMembers: (id, userIds) => request(`/workspaces/${encodeURIComponent(id)}/members/add`, { body: { user_ids: [...userIds] }, method: "POST" }),
+    createAuthCode: (body) => request("/auth/keys/code", {
+      body: {
+        ...body,
+        workspace_id: body.workspace_id ?? defaultWorkspaceId
+      },
       method: "POST"
     }),
-    createBatch: (body) => request("/batches", { body, method: "POST" }),
+    chat: (body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request("/chat/completions", {
+        body: { ...body, stream: false },
+        method: "POST"
+      });
+    },
+    createPresetFromChatCompletions: (slug, body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request(`/presets/${encodeURIComponent(slug)}/chat/completions`, { body, method: "POST" });
+    },
+    createPresetFromMessages: (slug, body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request(`/presets/${encodeURIComponent(slug)}/messages`, { body, method: "POST" });
+    },
+    createPresetFromResponses: (slug, body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request(`/presets/${encodeURIComponent(slug)}/responses`, { body, method: "POST" });
+    },
+    createWorkspace: (body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request("/workspaces", {
+        body,
+        method: "POST"
+      });
+    },
+    createBatch: (body) => {
+      assertAllowedModel(body.model, allowedModels);
+      return requestBatch("/batches", {
+        body: {
+          endpoint: body.endpoint,
+          model: body.model,
+          requests: body.requests,
+          ...body.completion_window ? { completion_window: body.completion_window } : {}
+        },
+        method: "POST"
+      });
+    },
     createEmbedding: (body) => {
       assertAllowedModel(body.model, allowedModels);
       return request("/embeddings", {
@@ -2752,8 +2902,12 @@ var createOpenRouterClient = (config2) => {
         method: "POST"
       });
     },
-    deleteFile: (id, workspaceId) => request(`/files/${encodeURIComponent(id)}`, { method: "DELETE", query: { workspace_id: workspaceId } }),
-    downloadFile: (id, workspaceId) => requestRaw(`/files/${encodeURIComponent(id)}/content`, {
+    deleteFile: (id, workspaceId = defaultWorkspaceId) => request(`/files/${encodeURIComponent(id)}`, { method: "DELETE", query: { workspace_id: workspaceId } }),
+    deleteWorkspace: (id) => request(`/workspaces/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    }),
+    deleteWorkspaceBudget: (id, interval) => request(`/workspaces/${encodeURIComponent(id)}/budgets/${interval}`, { method: "DELETE" }),
+    downloadFile: (id, workspaceId = defaultWorkspaceId) => requestRaw(`/files/${encodeURIComponent(id)}/content`, {
       query: { workspace_id: workspaceId }
     }),
     downloadVideo: (id, index = 0) => requestRaw(`/videos/${encodeURIComponent(id)}/content`, {
@@ -2766,15 +2920,25 @@ var createOpenRouterClient = (config2) => {
         method: "POST"
       });
     },
-    getBatch: (id) => request(`/batches/${encodeURIComponent(id)}`),
+    getBatch,
+    getActivity: (query) => request("/activity", {
+      query: {
+        ...query,
+        workspace_id: query?.workspace_id ?? defaultWorkspaceId
+      }
+    }),
+    getAnalyticsMeta: () => request("/analytics/meta"),
     getCredits: () => request("/credits"),
     getCurrentKey: () => request("/key"),
-    getFile: (id, workspaceId) => request(`/files/${encodeURIComponent(id)}`, {
+    getFile: (id, workspaceId = defaultWorkspaceId) => request(`/files/${encodeURIComponent(id)}`, {
       query: { workspace_id: workspaceId }
     }),
     getGeneration: (id) => request("/generation", {
       query: { id }
     }),
+    getGenerationContent: (id) => request("/generation/content", {
+      query: { id }
+    }),
     getModelEndpoints: (model) => {
       assertAllowedModel(model, allowedModels);
       return request(`/models/${encodeModelPath(model)}/endpoints`);
@@ -2787,9 +2951,21 @@ var createOpenRouterClient = (config2) => {
       assertAllowedModel(model, allowedModels);
       return request(`/images/models/${encodeModelPath(model)}/endpoints`);
     },
+    getPreset: (slug) => request(`/presets/${encodeURIComponent(slug)}`),
+    getPresetVersion: (slug, version) => request(`/presets/${encodeURIComponent(slug)}/versions/${encodeURIComponent(String(version))}`),
+    getTaskClassifications: (window2 = "7d") => request("/classifications/task", {
+      query: { window: window2 }
+    }),
     getVideo: (id) => request(`/videos/${encodeURIComponent(id)}`),
+    getWorkspace: (id) => request(`/workspaces/${encodeURIComponent(id)}`),
     listImageModels: async () => filterModelList(await request("/images/models")),
-    listFiles: (query) => request("/files", { query }),
+    listEmbeddingModels: async () => filterModelList(await request("/embeddings/models")),
+    listFiles: (query) => request("/files", {
+      query: {
+        ...query,
+        workspace_id: query?.workspace_id ?? defaultWorkspaceId
+      }
+    }),
     listModels,
     listUserModels: async () => filterModelList(await request("/models/user")),
     listZdrEndpoints: async () => {
@@ -2804,11 +2980,20 @@ var createOpenRouterClient = (config2) => {
     countModels: (outputModalities) => request("/models/count", {
       query: { output_modalities: outputModalities }
     }),
-    listPresets: (offset = 0, limit = 100) => request("/presets", { query: { limit, offset } }),
+    listPresets: (offset = 0, limit = 100) => request("/presets", {
+      query: { limit, offset }
+    }),
     listPresetVersions: (slug, offset = 0, limit = 100) => request(`/presets/${encodeURIComponent(slug)}/versions`, { query: { limit, offset } }),
     listProviders: () => request("/providers"),
     listRerankModels: async () => filterModelList(await request("/rerank/models")),
     listVideoModels: async () => filterModelList(await request("/videos/models")),
+    listWorkspaceBudgets: (id) => request(`/workspaces/${encodeURIComponent(id)}/budgets`),
+    listWorkspaces: (offset = 0, limit = 100) => request("/workspaces", { query: { limit, offset } }),
+    queryAnalytics: (body) => request("/analytics/query", {
+      body,
+      method: "POST"
+    }),
+    removeWorkspaceMembers: (id, userIds) => request(`/workspaces/${encodeURIComponent(id)}/members/remove`, { body: { user_ids: [...userIds] }, method: "POST" }),
     request,
     requestRaw,
     streamImage: async function* (body, options = {}) {
@@ -2861,8 +3046,41 @@ var createOpenRouterClient = (config2) => {
       return request("/files", {
         body,
         method: "POST",
-        query: { workspace_id: options.workspaceId }
+        query: { workspace_id: options.workspaceId ?? defaultWorkspaceId }
       });
+    },
+    updateWorkspace: (id, body) => {
+      assertAllowedModelsInValue(body, allowedModels);
+      return request(`/workspaces/${encodeURIComponent(id)}`, { body, method: "PATCH" });
+    },
+    upsertWorkspaceBudget: (id, interval, limitUsd) => request(`/workspaces/${encodeURIComponent(id)}/budgets/${interval}`, { body: { limit_usd: limitUsd }, method: "PUT" }),
+    waitForBatch: async (id, options = {}) => {
+      const intervalMs = options.intervalMs ?? 1000;
+      const timeoutMs = options.timeoutMs;
+      if (!Number.isFinite(intervalMs) || intervalMs < 0)
+        throw new Error("OpenRouter batch intervalMs must be non-negative");
+      if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs < 0))
+        throw new Error("OpenRouter batch timeoutMs must be non-negative");
+      const startedAt = Date.now();
+      for (;; ) {
+        options.signal?.throwIfAborted();
+        const batch = await getBatch(id);
+        if (TERMINAL_BATCH_STATUSES.has(batch.status))
+          return batch;
+        if (timeoutMs !== undefined && Date.now() - startedAt + intervalMs > timeoutMs)
+          throw new Error(`Timed out waiting for OpenRouter batch "${id}"`);
+        await new Promise((resolve, reject) => {
+          const onAbort = () => {
+            clearTimeout(timeout);
+            reject(options.signal?.reason);
+          };
+          const timeout = setTimeout(() => {
+            options.signal?.removeEventListener("abort", onAbort);
+            resolve();
+          }, intervalMs);
+          options.signal?.addEventListener("abort", onAbort, { once: true });
+        });
+      }
     }
   };
 };
@@ -2999,7 +3217,7 @@ var assertAllowedPreset = (preset, allowedPresets) => {
 var assertIndirectModels = (value, allowedModels, key = "") => {
   if (key === "model" && typeof value === "string")
     assertAllowedModel2(value, allowedModels);
-  if ((key === "models" || key === "analysis_models") && Array.isArray(value)) {
+  if ((key === "models" || key === "analysis_models" || key === "allowed_models") && Array.isArray(value)) {
     for (const model of value) {
       if (typeof model === "string")
         assertAllowedModel2(model, allowedModels);
@@ -3013,6 +3231,84 @@ var assertIndirectModels = (value, allowedModels, key = "") => {
       assertIndirectModels(child, allowedModels, childKey);
   }
 };
+var assertIntegerRange = (label, value, minimum, maximum) => {
+  if (value === undefined)
+    return;
+  if (!Number.isInteger(value) || value < minimum || maximum !== undefined && value > maximum)
+    throw new Error(`OpenRouter ${label} must be an integer from ${minimum}${maximum === undefined ? " or greater" : ` to ${maximum}`}`);
+};
+var assertPluginOptions = (plugins) => {
+  for (const plugin of plugins ?? []) {
+    if (plugin.id === "response-healing")
+      throw new Error("OpenRouter response-healing requires a non-streaming request; use createOpenRouterClient().chat()");
+    if (plugin.id === "fusion") {
+      const fusion = plugin;
+      if (fusion.analysis_models && (fusion.analysis_models.length < 1 || fusion.analysis_models.length > 8))
+        throw new Error("OpenRouter Fusion analysis_models must contain 1-8 models");
+      assertIntegerRange("Fusion max_tool_calls", fusion.max_tool_calls, 1, 16);
+    }
+    if (plugin.id === "web") {
+      const web = plugin;
+      assertIntegerRange("web plugin max_results", web.max_results, 1, web.engine === "perplexity" ? 20 : 25);
+      if (web.include_domains?.length && web.exclude_domains?.length && (web.engine === "firecrawl" || web.engine === "parallel" || web.engine === "perplexity"))
+        throw new Error(`OpenRouter ${web.engine} web plugin cannot combine include_domains and exclude_domains`);
+    }
+  }
+};
+var assertServerToolOptions = (tools) => {
+  for (const tool of tools ?? []) {
+    if (tool.type === "openrouter:web_search") {
+      const parameters = tool.parameters;
+      assertIntegerRange("web search max_results", parameters?.max_results, 1, 25);
+      if (parameters?.engine === "perplexity" && (parameters.max_results ?? 0) > 20)
+        throw new Error("OpenRouter Perplexity web search max_results must be at most 20");
+      assertIntegerRange("web search max_characters", parameters?.max_characters, 1, 1e5);
+      assertIntegerRange("web search max_total_results", parameters?.max_total_results, 1);
+    }
+    if (tool.type === "openrouter:web_fetch") {
+      assertIntegerRange("web fetch max_uses", tool.parameters?.max_uses, 1);
+      assertIntegerRange("web fetch max_content_tokens", tool.parameters?.max_content_tokens, 1);
+    }
+    if (tool.type === "openrouter:image_generation") {
+      const compression = tool.parameters?.output_compression;
+      if (compression !== undefined && (!Number.isFinite(compression) || compression < 0 || compression > 100))
+        throw new Error("OpenRouter image generation output_compression must be 0-100");
+    }
+    if (tool.type === "openrouter:subagent") {
+      assertIntegerRange("subagent max_completion_tokens", tool.parameters.max_completion_tokens, 1);
+      assertIntegerRange("subagent max_tool_calls", tool.parameters.max_tool_calls, 1, 25);
+      const temperature = tool.parameters.temperature;
+      if (temperature !== undefined && (!Number.isFinite(temperature) || temperature < 0 || temperature > 2))
+        throw new Error("OpenRouter subagent temperature must be 0-2");
+      assertServerToolOptions(tool.parameters.tools);
+    }
+    if (tool.type === "openrouter:advisor") {
+      assertIntegerRange("advisor max_completion_tokens", tool.parameters?.max_completion_tokens, 1);
+      const temperature = tool.parameters?.temperature;
+      if (temperature !== undefined && (!Number.isFinite(temperature) || temperature < 0 || temperature > 2))
+        throw new Error("OpenRouter advisor temperature must be 0-2");
+    }
+    if (tool.type === "openrouter:fusion") {
+      const analysisModels = tool.parameters?.analysis_models;
+      if (analysisModels && (analysisModels.length < 1 || analysisModels.length > 8))
+        throw new Error("OpenRouter Fusion server tool analysis_models must contain 1-8 models");
+      assertIntegerRange("Fusion server tool max_completion_tokens", tool.parameters?.max_completion_tokens, 1);
+      assertIntegerRange("Fusion server tool max_tool_calls", tool.parameters?.max_tool_calls, 1, 16);
+      const temperature = tool.parameters?.temperature;
+      if (temperature !== undefined && (!Number.isFinite(temperature) || temperature < 0 || temperature > 2))
+        throw new Error("OpenRouter Fusion server tool temperature must be 0-2");
+      assertServerToolOptions(tool.parameters?.tools);
+    }
+    if (tool.type === "openrouter:shell") {
+      assertIntegerRange("shell sleep_after_seconds", tool.parameters?.sleep_after_seconds, 0, 2592000);
+      const environment = tool.parameters?.environment;
+      if (environment?.type === "container_reference" && (environment.container_id.length < 1 || environment.container_id.length > 20))
+        throw new Error("OpenRouter shell container_id must contain 1-20 characters");
+    }
+    if (tool.type === "openrouter:experimental__search_models")
+      assertIntegerRange("model search max_results", tool.parameters?.max_results, 1, 20);
+  }
+};
 var assertRequestOptions = (options, allowedModels, allowedPresets, allowedProviders) => {
   assertAllowedPreset(options.preset, allowedPresets);
   assertRequestRoutingPolicy(options.routing, allowedProviders);
@@ -3032,6 +3328,8 @@ var assertRequestOptions = (options, allowedModels, allowedPresets, allowedProvi
   assertIndirectModels(options.serverTools, allowedModels);
   assertIndirectModels(options.messagesTools, allowedModels);
   assertIndirectModels(options.plugins, allowedModels);
+  assertPluginOptions(options.plugins);
+  assertServerToolOptions(options.serverTools);
   if (options.extraBody) {
     const unsafe = Object.keys(options.extraBody).find((key) => SECURITY_SENSITIVE_EXTRA_BODY_FIELDS.has(key));
     if (unsafe)
@@ -7313,6 +7611,7 @@ export {
   meta,
   google,
   getProviderHealth,
+  generateOpenRouterPKCE,
   generateObjectAI,
   generateId,
   generateAIWithTools,
@@ -7320,13 +7619,18 @@ export {
   gemini,
   formCard,
   fetchProviderApiStatus,
+  exchangeOpenRouterAuthCode,
+  estimateOpenRouterModelCost,
+  estimateOpenRouterCost,
   diffCard,
   deepseek,
   credentialCard,
   createUiCards,
   createSyncConversationStore,
   createProviderProxyResponse,
+  createOpenRouterKeyLinks,
   createOpenRouterClient,
+  createOpenRouterAuthorizationUrl,
   createOAuth2ClientCredentialsTokenSource,
   createMemoryStore,
   createConversationManager,
@@ -7364,5 +7668,5 @@ export {
   BUILTIN_UI_CARDS
 };
 
-//# debugId=3B5ACA11D1118B9564756E2164756E21
+//# debugId=1A3329E4751DCFB764756E2164756E21
 //# sourceMappingURL=index.js.map