@ai21/gateway 0.5.3

package/dist/verify.js

@@ -0,0 +1,309 @@
+/**
+ * One real request through the gateway, to prove the written config works and flip
+ * the agent's `used` latch. Three tiers, because the CLI holds no Anthropic
+ * credential and the gateway requires one: `claude -p` if it is on PATH, else a
+ * direct ping if a key is available, else skip.
+ *
+ * Two invariants: verification never changes the exit code, and exactly one
+ * request is fired — a winning tier means no later tier runs.
+ */
+import { spawn } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { DEFAULT_URLS, isInsecureGateway } from "./args.js";
+export const CLAUDE_COMMAND = "claude";
+/* An instruction with a trivial answer, and it names itself so a gateway trace shows
+ * why the request happened. Both halves matter: "ai21-gateway CLI verification" alone
+ * reads as a task label, and Claude Code answered it by exploring the repo and hunting
+ * for tools — measured at >90s against ~5s for this. */
+export const CLAUDE_PROMPT = "ai21-gateway CLI connectivity check — reply with OK and nothing else.";
+export const PING_PATH = "/v1/messages";
+/** Names the directory, since `--repo` and `--user` verify from different ones. Ends
+ *  without a full stop: a `reason` must not, and report.ts punctuates for it. */
+function manualHint(cwd) {
+    return `Run \`${CLAUDE_COMMAND} -p "${CLAUDE_PROMPT}"\` in ${cwd} to verify by hand`;
+}
+/**
+ * Both tiers are bounded; the spawn gets longer because it waits on a full model
+ * round trip. 20s is measured, not guessed: a working `claude -p` returns in ~5s,
+ * and a rejected one hangs rather than failing, so this budget is what turns that
+ * hang into a message.
+ */
+export const PING_TIMEOUT_MS = 10_000;
+export const CLAUDE_TIMEOUT_MS = 20_000;
+/** Mirrors the `genericCurl` snippet; a contract test holds the two together. */
+export const PING_BODY = {
+    model: "claude-sonnet-4-5",
+    max_tokens: 64,
+    messages: [{ role: "user", content: "Hello through the gateway" }],
+};
+/** npm installs the Claude Code CLI as `claude.cmd`, so this must not be empty. */
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+/**
+ * Hand-rolled rather than shelling out to `which`/`where`, which is slower and
+ * absent from stripped Windows images. `node:path`'s `join` and `delimiter` follow
+ * the *host* platform, so they cannot resolve a Windows PATH under test on macOS.
+ */
+export function findOnPath(command, lookup) {
+    const windows = lookup.platform === "win32";
+    const separator = windows ? ";" : ":";
+    const raw = lookup.processEnv.PATH ?? (windows ? lookup.processEnv.Path : undefined) ?? "";
+    const extensions = windows ? (lookup.processEnv.PATHEXT ?? DEFAULT_PATHEXT).split(";") : [""];
+    for (const dir of raw.split(separator)) {
+        if (dir === "")
+            continue;
+        for (const extension of extensions) {
+            const candidate = `${dir.replace(/[\\/]+$/, "")}${windows ? "\\" : "/"}${command}${extension}`;
+            if (lookup.isExecutableFile(candidate))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+/** Blanks every credential in play, wherever it appears. */
+function redactSecrets(text, ctx) {
+    let redacted = text;
+    for (const secret of [ctx.ai21Key, resolveAnthropicKey(ctx)]) {
+        if (secret === undefined || secret === "")
+            continue;
+        redacted = redacted.split(secret).join("****");
+    }
+    return redacted;
+}
+const MAX_REASON_LENGTH = 200;
+/** First line only, scrubbed and bounded — a reason, not a log dump. */
+function quoteOutput(output, ctx) {
+    const [firstLine = ""] = redactSecrets(output, ctx).trim().split("\n");
+    const trimmed = firstLine.trim();
+    if (trimmed === "")
+        return "";
+    return trimmed.length > MAX_REASON_LENGTH ? `: ${trimmed.slice(0, MAX_REASON_LENGTH)}…` : `: ${trimmed}`;
+}
+function resolveAnthropicKey(ctx) {
+    if (ctx.anthropicKey !== undefined && ctx.anthropicKey !== "")
+        return ctx.anthropicKey;
+    // Set-but-empty is how people disable it; treating that as a credential would
+    // turn a clean skip into a guaranteed 401.
+    const fromEnv = ctx.processEnv.ANTHROPIC_API_KEY;
+    return fromEnv !== undefined && fromEnv !== "" ? fromEnv : undefined;
+}
+/**
+ * The spawned `claude` inherits our environment, but settings.json still wins:
+ * measured with two loopback servers, every model request used the file's
+ * ANTHROPIC_BASE_URL and headers, not exported ones. So no warning is owed for
+ * those two variables — only for ANTHROPIC_API_KEY, which we never write.
+ */
+async function viaClaude(executable, ctx, deps) {
+    const result = await deps.runCommand(executable, ["-p", CLAUDE_PROMPT], {
+        cwd: ctx.cwd,
+        timeoutMs: CLAUDE_TIMEOUT_MS,
+    });
+    if (result.code === 0)
+        return { kind: "passed", via: "claude-cli" };
+    const failed = (reason) => ({ kind: "failed", via: "claude-cli", reason });
+    if (result.timedOut) {
+        // `claude` prints nothing while retrying, so the timeout alone cannot say which
+        // credential failed; one probe can. A second request is allowed here only because
+        // it follows a failure and cannot authenticate, so it never flips `used`.
+        const timedOut = `\`${CLAUDE_COMMAND} -p\` did not answer within ${CLAUDE_TIMEOUT_MS / 1000}s`;
+        switch (await probeCredentials(ctx, deps)) {
+            case "ai21-rejected":
+                return failed(`${timedOut}, and the gateway rejected the AI21 key${environmentNote(ctx)}`);
+            case "ai21-accepted":
+                /* Deliberately not "check the Anthropic credential": the gateway answering means
+                 * the config is right, and the likeliest cause is `claude` itself being slow or
+                 * busy in this directory. Running the prompt by hand settles it in one step. */
+                return failed(`${timedOut}, but the gateway accepted the AI21 key — so the configuration is good and ` +
+                    `\`${CLAUDE_COMMAND}\` itself did not answer in time. ${manualHint(ctx.cwd)}`);
+            case "inconclusive":
+                return failed(`${timedOut}, which usually means the gateway rejected the credentials and \`${CLAUDE_COMMAND}\` is ` +
+                    `retrying silently — check the AI21 key and the agent id${environmentNote(ctx)}`);
+        }
+    }
+    if (result.code === null) {
+        return failed(`\`${CLAUDE_COMMAND}\` could not be run${quoteOutput(result.output, ctx)}`);
+    }
+    return failed(`\`${CLAUDE_COMMAND} -p\` exited ${result.code}${quoteOutput(result.output, ctx)}`);
+}
+/** A production key sent to staging is refused indistinguishably from a typo. */
+function environmentNote(ctx) {
+    return ctx.urls.gateway === DEFAULT_URLS.gateway
+        ? ""
+        : /* Carries its own leading separator and no trailing full stop, because it is
+           * optional and `report.ts` composes the reason into a sentence with a full stop of
+           * its own. A call site that punctuates *before* this note prints "the AI21 key.."
+           * whenever the note is empty — which is every production run. */
+            ". AI21 keys are per-environment: a production key will not work against this gateway";
+}
+/** Explanations for the statuses users actually hit, keyed by what to check. */
+const STATUS_HINTS = {
+    401: "the AI21 key or the Anthropic credential was rejected",
+    403: "the key is not allowed to use this agent",
+    404: "check the gateway URL",
+};
+/** A value that cannot be a real credential, so the probe can never succeed. */
+const PROBE_ANTHROPIC_KEY = "sk-ant-invalid-credential-probe";
+function classifyRejection(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return "inconclusive";
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return "inconclusive";
+    const shape = parsed;
+    // Anthropic answers `{"type":"error","error":{…}}`, the gateway `{"detail":"…"}`.
+    // Reaching Anthropic at all proves the gateway forwarded us.
+    if (shape.error !== undefined || shape.type === "error")
+        return "ai21-accepted";
+    if (shape.detail !== undefined)
+        return "ai21-rejected";
+    return "inconclusive";
+}
+async function probeCredentials(ctx, deps) {
+    // Diagnosing is not a reason to put the key on the wire in the clear.
+    if (isInsecureGateway(ctx.urls.gateway))
+        return "inconclusive";
+    try {
+        const response = await deps.fetchImpl(`${ctx.urls.gateway}${PING_PATH}`, {
+            method: "POST",
+            headers: pingHeaders(PROBE_ANTHROPIC_KEY, ctx),
+            body: JSON.stringify(PING_BODY),
+            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        });
+        // Cannot happen with an invalid key, but if it did the AI21 side is fine.
+        if (response.ok)
+            return "ai21-accepted";
+        return classifyRejection((await response.text?.()) ?? "");
+    }
+    catch {
+        return "inconclusive";
+    }
+}
+function pingHeaders(anthropicKey, ctx) {
+    const headers = {
+        "x-ai21-key": ctx.ai21Key,
+        "x-agent-id": ctx.agentId,
+        "x-api-key": anthropicKey,
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json",
+    };
+    if (ctx.userId !== undefined)
+        headers["x-ai21-user-id"] = ctx.userId;
+    return headers;
+}
+function isAbort(err) {
+    return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+}
+async function viaDirectPing(anthropicKey, ctx, deps) {
+    const failed = (reason) => ({ kind: "failed", via: "direct-ping", reason });
+    // This carries both credentials, so an off-box plain-http endpoint would put them
+    // on the wire in the clear. Refused rather than sent; the write still stands.
+    if (isInsecureGateway(ctx.urls.gateway)) {
+        return failed(`refusing to send credentials to ${ctx.urls.gateway} over plain http; use https, or verify by hand`);
+    }
+    try {
+        const response = await deps.fetchImpl(`${ctx.urls.gateway}${PING_PATH}`, {
+            method: "POST",
+            headers: pingHeaders(anthropicKey, ctx),
+            body: JSON.stringify(PING_BODY),
+            signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+        });
+        if (response.ok)
+            return { kind: "passed", via: "direct-ping" };
+        const hint = STATUS_HINTS[response.status];
+        const note = response.status === 401 ? environmentNote(ctx) : "";
+        return failed(`the gateway answered ${response.status}${hint === undefined ? "" : ` (${hint})`}${note}`);
+    }
+    catch (err) {
+        if (isAbort(err)) {
+            return failed(`the gateway did not answer within ${PING_TIMEOUT_MS / 1000}s`);
+        }
+        // The cause of a fetch rejection is a DNS/TLS/socket detail that reads as
+        // noise and can carry an internal hostname, so it is named, not quoted.
+        return failed(`the gateway could not be reached at ${ctx.urls.gateway}`);
+    }
+}
+export async function verify(ctx, deps) {
+    const executable = findOnPath(CLAUDE_COMMAND, deps.lookup);
+    if (executable !== undefined)
+        return viaClaude(executable, ctx, deps);
+    const anthropicKey = resolveAnthropicKey(ctx);
+    if (anthropicKey !== undefined)
+        return viaDirectPing(anthropicKey, ctx, deps);
+    return { kind: "skipped", hint: `${manualHint(ctx.cwd)}.` };
+}
+/** Cap on captured subprocess output — only the first line is ever quoted. */
+const MAX_CAPTURED_OUTPUT = 4_096;
+function runCommand(executable, args, opts) {
+    return new Promise((resolve) => {
+        // A .cmd cannot be spawned without a shell since the CVE-2024-27980 fix. Safe
+        // here because every argument is a literal. Killing the shell may orphan the
+        // real `claude`, which exits on its own shortly after.
+        const shell = /\.(cmd|bat)$/i.test(executable);
+        const child = spawn(shell ? `"${executable}"` : executable, [...args], {
+            cwd: opts.cwd,
+            shell,
+            // stdin closed: `claude` must never sit waiting on input we will not send.
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let output = "";
+        const capture = (chunk) => {
+            if (output.length < MAX_CAPTURED_OUTPUT)
+                output += chunk.toString("utf8");
+        };
+        child.stdout?.on("data", capture);
+        child.stderr?.on("data", capture);
+        let done = false;
+        const settle = (result) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        /**
+         * Our own timer, not spawn's `timeout`: Windows reports a killed process as an
+         * ordinary non-zero exit, so an inferred timeout would be wrong there.
+         *
+         * It resolves the promise itself rather than killing and waiting for `close`.
+         * `close` fires when the *stdio* closes, and anything `claude` spawned inherits
+         * those pipes — an MCP server or a hook outliving its parent holds them open, so
+         * the kill lands and `close` never comes. That hung the CLI indefinitely after a
+         * write it had already completed. The budget is now a guarantee, not a hope.
+         */
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGKILL");
+            settle({ code: null, timedOut, output: output.trim() });
+        }, opts.timeoutMs);
+        // A spawn error may never emit `close`, so both paths settle. Only the errno is
+        // kept — the message carries an absolute path.
+        child.once("error", (err) => settle({ code: null, timedOut, output: err.code ?? "" }));
+        child.once("close", (code) => settle({ code, timedOut, output: output.trim() }));
+    });
+}
+function isExecutableFile(candidate) {
+    try {
+        if (!statSync(candidate).isFile())
+            return false;
+        // The execute bit is meaningless on Windows, where the extension decides.
+        if (process.platform !== "win32")
+            accessSync(candidate, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The real-world adapters, kept here so `cli.ts` stays a thin edge. */
+export function nodeVerifyDeps(processEnv) {
+    return {
+        lookup: { platform: process.platform, processEnv, isExecutableFile },
+        runCommand,
+        fetchImpl: fetch,
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAqB,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE/E,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC;;;wDAGwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,uEAAuE,CAAC;AACrG,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AAExC;iFACiF;AACjF,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,SAAS,cAAc,QAAQ,aAAa,UAAU,GAAG,oBAAoB,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,iFAAiF;AACjF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,EAAE,mBAAmB;IAC1B,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;CAC1D,CAAC;AA8DX,mFAAmF;AACnF,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,MAAkB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3F,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE9F,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QAEzB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC;YAC/F,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4DAA4D;AAC5D,SAAS,aAAa,CAAC,IAAY,EAAE,GAAkB;IACrD,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,SAAS;QAEpD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,wEAAwE;AACxE,SAAS,WAAW,CAAC,MAAc,EAAE,GAAkB;IACrD,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC;IAEvF,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAEjD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,GAAkB,EAAE,IAAgB;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;QACtE,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAElG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,gFAAgF;QAChF,kFAAkF;QAClF,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,KAAK,cAAc,+BAA+B,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAC/F,QAAQ,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,KAAK,eAAe;gBAClB,OAAO,MAAM,CAAC,GAAG,QAAQ,0CAA0C,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7F,KAAK,eAAe;gBAClB;;gGAEgF;gBAChF,OAAO,MAAM,CACX,GAAG,QAAQ,6EAA6E;oBACtF,KAAK,cAAc,qCAAqC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;YACJ,KAAK,cAAc;gBACjB,OAAO,MAAM,CACX,GAAG,QAAQ,oEAAoE,cAAc,QAAQ;oBACnG,0DAA0D,eAAe,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,KAAK,cAAc,sBAAsB,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,cAAc,gBAAgB,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;2EAGiE;YACjE,sFAAsF,CAAC;AAC7F,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,uDAAuD;IAC5D,GAAG,EAAE,0CAA0C;IAC/C,GAAG,EAAE,uBAAuB;CAC7B,CAAC;AAQF,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAE9D,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAEzE,MAAM,KAAK,GAAG,MAA+D,CAAC;IAC9E,kFAAkF;IAClF,6DAA6D;IAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC;IAEhF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEvD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAClE,sEAAsE;IACtE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,cAAc,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,EAAE,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,CAAC,mBAAmB,EAAE,GAAG,CAAC;YAC9C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC;QAExC,OAAO,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB,EAAE,GAAkB;IAC3D,MAAM,OAAO,GAA2B;QACtC,YAAY,EAAE,GAAG,CAAC,OAAO;QACzB,YAAY,EAAE,GAAG,CAAC,OAAO;QACzB,WAAW,EAAE,YAAY;QACzB,mBAAmB,EAAE,YAAY;QACjC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IAErE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,GAAkB,EAAE,IAAgB;IACrF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnG,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,OAAO,gDAAgD,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,EAAE,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;QAE/D,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjE,OAAO,MAAM,CAAC,wBAAwB,QAAQ,CAAC,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,qCAAqC,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,MAAM,CAAC,uCAAuC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAkB,EAAE,IAAgB;IAC/D,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAEtE,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE9E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,SAAS,UAAU,CACjB,UAAkB,EAClB,IAAuB,EACvB,IAA0D;IAE1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,8EAA8E;QAC9E,6EAA6E;QAC7E,uDAAuD;QACvD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACrE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK;YACL,2EAA2E;YAC3E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,CAAC,KAAa,EAAQ,EAAE;YACtC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAElC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAQ,EAAE;YAC7C,IAAI,IAAI;gBAAE,OAAO;YAEjB,IAAI,GAAG,IAAI,CAAC;YACZ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF;;;;;;;;;WASG;QACH,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,gFAAgF;QAChF,+CAA+C;QAC/C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAG,GAA6B,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAClH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAC;QAEhD,0EAA0E;QAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,UAA8C;IAC3E,OAAO;QACL,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE;QACpE,UAAU;QACV,SAAS,EAAE,KAA6B;KACzC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@ai21/gateway",
+  "//version": "Placeholder. The source of truth is the Artifact Registry — CI sets this from NODE_PACKAGE_VERSION at publish time (see the Semantic Release user guide).",
+  "version": "0.5.3",
+  "description": "One command to point a local coding agent at the AI21 Intelligent Gateway",
+  "type": "module",
+  "bin": {
+    "ai21-gateway": "dist/cli.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint src test --ext .ts --report-unused-disable-directives --max-warnings 0",
+    "lint:fix": "eslint src test --ext .ts --fix",
+    "typecheck": "tsc --noEmit",
+    "format": "prettier --write \"(src|test)/**\" --no-error-on-unmatched-pattern",
+    "format:check": "prettier --check \"(src|test)/**\" --no-error-on-unmatched-pattern",
+    "quality": "npm audit --omit=dev --audit-level=moderate && npm run lint && npm run typecheck && npm run format:check",
+    "test": "npm run build && npm run typecheck:test && node --disable-warning=ExperimentalWarning --experimental-strip-types --test",
+    "precommit": "npm run format:check && npm run lint && npm run typecheck && npm test",
+    "pack": "npm pack",
+    "prepack": "npm run build",
+    "typecheck:test": "tsc -p tsconfig.test.json"
+  },
+  "prettier": {
+    "printWidth": 120,
+    "trailingComma": "all"
+  },
+  "keywords": [
+    "ai21",
+    "gateway",
+    "claude-code",
+    "cli"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AI21Labs/ai21-intelligent-gateway-cli.git"
+  },
+  "//overrides": "eslint 8 (required by @ai21/eslint-plugin's peer range) reaches brace-expansion <=5.0.7 via minimatch, which carries a DoS advisory with no patch in the 1.x/2.x lines. 5.0.8 is the only patched release and is dual CJS/ESM, so it drops in. Dev-only, but this keeps `npm audit` clean rather than muted.",
+  "overrides": {
+    "brace-expansion": "5.0.8"
+  },
+  "devDependencies": {
+    "@types/node": "20.19.9",
+    "@typescript-eslint/eslint-plugin": "8.46.2",
+    "@typescript-eslint/parser": "8.46.2",
+    "eslint": "8.57.1",
+    "eslint-config-prettier": "9.1.0",
+    "prettier": "3.6.2",
+    "typescript": "5.9.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}