@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/server/ai.d.ts

@@ -0,0 +1,111 @@
+/**
+ * `ai()`: the Gateway's default chat model for an app that needs "a model"
+ * rather than one provider (docs/design/2026-10-model-providers.md). The
+ * manifest says `ai: { chat: true }` (or `{ chat: { why } }`); the Gateway's
+ * operator decides which provider and model that is (`everyapp ai
+ * default`, else OpenRouter → Workers AI → OpenAI → …, the first with its
+ * key set), and the app never names either: it sends OpenAI-shaped chat
+ * completions (and embeddings) to `/api/ai/default/v1/…` with `model:
+ * "default"` or no model at all, and the Gateway fills the model in.
+ *
+ * An OpenAI client takes `baseURL` and `fetch` as they are:
+ *
+ *   const { baseURL, fetch, model } = ai({ env, for: request });
+ *   const client = new OpenAI({ baseURL, fetch, apiKey: "gateway-managed" });
+ *   await client.chat.completions.create({ model, messages });
+ *
+ * In local development with no Gateway, the developer's own key in
+ * `.dev.vars` decides the provider by the same order (createGatewayFetch's
+ * fallback). An app that needs one provider in particular keeps listing it
+ * under `providers` and calling `/api/ai/<provider>/…`.
+ */
+import { AI_DEFAULT_MODEL } from "../internal/index.js";
+import { type GatewayCallFor } from "./attribution.js";
+import { type CreateGatewayFetchOptions } from "./gatewayFetch.js";
+import type { SetupInfo } from "./refusal.js";
+export interface AiClient {
+    /** `http://every-app-gateway.internal/api/ai/default/v1`: an OpenAI client's base URL. */
+    baseURL: string;
+    /** The fetch that reaches the Gateway (or, in dev, the provider directly). */
+    fetch: typeof fetch;
+    /** The model name that means "whatever the Gateway's default is": `default`. */
+    model: typeof AI_DEFAULT_MODEL;
+    /** The default route's chat completions URL, for a plain `fetch`. */
+    chatCompletionsUrl: string;
+    /** The default route's embeddings URL, for a plain `fetch`. */
+    embeddingsUrl: string;
+}
+/** The base URL of the default route, as the SDK and the docs name it. */
+export declare const AI_DEFAULT_BASE_URL = "http://every-app-gateway.internal/api/ai/default/v1";
+/**
+ * The Gateway's default chat model as a client: a base URL, a fetch and
+ * the model name to send. Throws `ConfigurationError` where
+ * `createGatewayFetch` does (no binding and no dev key) and
+ * `AttributionError` where a shared app's call says nobody's.
+ */
+export declare function ai(options: CreateGatewayFetchOptions & {
+    optional: true;
+}): AiClient | null;
+export declare function ai(options: CreateGatewayFetchOptions): AiClient;
+/** Whether model calls to a provider (or the default) would go through. */
+export interface AiStatus extends SetupInfo {
+    /** The id asked about: `default`, or a provider's (`openrouter`, `workers-ai`, …). */
+    provider: string;
+    /** The manifest asks for it: `ai.chat` for `default`, else `providers`. */
+    requested: boolean;
+    /** The Gateway (in local dev, `.dev.vars`) holds every setting it needs. */
+    configured: boolean;
+    /** Calls would go through. */
+    ready: boolean;
+    /**
+     * For `default`: the provider and model calls go to now, or null while
+     * none is configured. Null for a named provider.
+     */
+    resolved: {
+        provider: string;
+        label: string;
+        model: string;
+    } | null;
+}
+/**
+ * Whether the app can use a model right now, without calling one: gate
+ * an AI feature and show `setup` ("A chat model isn't set up on this
+ * Gateway: it needs OPENROUTER_API_KEY. An admin runs: pnpm everyapp
+ * configure inbox") up front instead of failing mid-task. `provider`
+ * defaults to `default`, the Gateway's default model (`ai: { chat: true }`);
+ * name one the manifest lists under `providers` to ask about it instead.
+ * The Gateway owns the wording: show `setup` and `command` as they are.
+ *
+ * Over the binding it sends `GET /api/ai/<provider>`; in local dev it
+ * answers from `.dev.vars` by the same rule `createGatewayFetch()` uses.
+ */
+export declare function aiStatus({ env, provider, for: explicitTarget, }: {
+    env: object;
+    provider?: string;
+    /**
+     * Whom the status is for: the default resolves on that organization's
+     * choice (`everyapp ai default`). Left out, the request `everyApp()` is
+     * serving or the organization `withOrganization()` named, as on every
+     * call.
+     */
+    for?: GatewayCallFor;
+}): Promise<AiStatus>;
+/**
+ * A provider's root behind the Gateway, `http://every-app-gateway.internal/api/ai/<provider>`:
+ * join the provider's own paths onto it (`/api/v1/chat/completions` for
+ * OpenRouter) and send them with `createGatewayFetch()`. For an OpenAI
+ * client's `baseURL`, use {@link aiBaseUrl}.
+ */
+export declare function providerBaseUrl(provider: string): string;
+/**
+ * The OpenAI-compatible base URL of `provider` behind the Gateway, for an
+ * OpenAI client's `baseURL` (with `fetch: createGatewayFetch(...)`):
+ * `default` (the default) is {@link AI_DEFAULT_BASE_URL},
+ * `…/api/ai/default/v1`; a catalog provider's is its root and the prefix
+ * of its chat route (`…/api/ai/openrouter/api/v1`, `…/api/ai/workers-ai/v1`,
+ * `…/api/ai/openai/v1`). Throws `ConfigurationError` for a provider with
+ * no OpenAI-compatible chat route (Cohere): call {@link providerBaseUrl}
+ * with its own paths instead.
+ */
+export declare function aiBaseUrl(provider?: string): string;
+//# sourceMappingURL=ai.d.ts.map

package/dist/server/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../../src/server/ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,gBAAgB,EAOjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,gFAAgF;IAChF,KAAK,EAAE,OAAO,gBAAgB,CAAC;IAC/B,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,wDAAuD,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,EAAE,CAChB,OAAO,EAAE,yBAAyB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GACtD,QAAQ,GAAG,IAAI,CAAC;AACnB,wBAAgB,EAAE,CAAC,OAAO,EAAE,yBAAyB,GAAG,QAAQ,CAAC;AAajE,2EAA2E;AAC3E,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,QAA8B,EAC9B,GAAG,EAAE,cAAc,GACpB,EAAE;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+EpB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAaxE"}

package/dist/server/ai.js

@@ -0,0 +1,145 @@
+/**
+ * `ai()`: the Gateway's default chat model for an app that needs "a model"
+ * rather than one provider (docs/design/2026-10-model-providers.md). The
+ * manifest says `ai: { chat: true }` (or `{ chat: { why } }`); the Gateway's
+ * operator decides which provider and model that is (`everyapp ai
+ * default`, else OpenRouter → Workers AI → OpenAI → …, the first with its
+ * key set), and the app never names either: it sends OpenAI-shaped chat
+ * completions (and embeddings) to `/api/ai/default/v1/…` with `model:
+ * "default"` or no model at all, and the Gateway fills the model in.
+ *
+ * An OpenAI client takes `baseURL` and `fetch` as they are:
+ *
+ *   const { baseURL, fetch, model } = ai({ env, for: request });
+ *   const client = new OpenAI({ baseURL, fetch, apiKey: "gateway-managed" });
+ *   await client.chat.completions.create({ model, messages });
+ *
+ * In local development with no Gateway, the developer's own key in
+ * `.dev.vars` decides the provider by the same order (createGatewayFetch's
+ * fallback). An app that needs one provider in particular keeps listing it
+ * under `providers` and calling `/api/ai/<provider>/…`.
+ */
+import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, CATALOG, ConfigurationError, aiProviderSettings, devAiProvider, resolveAiDefault, } from "../internal/index.js";
+import { applyAttribution, attributionFor, } from "./attribution.js";
+import { BINDING_ORIGIN, createGatewayFetch, gatewayBinding, } from "./gatewayFetch.js";
+/** The base URL of the default route, as the SDK and the docs name it. */
+export const AI_DEFAULT_BASE_URL = `${BINDING_ORIGIN}/api/ai/${AI_DEFAULT_PROVIDER}/v1`;
+export function ai(options) {
+    const fetch = createGatewayFetch(options);
+    if (!fetch)
+        return null;
+    return {
+        baseURL: AI_DEFAULT_BASE_URL,
+        fetch,
+        model: AI_DEFAULT_MODEL,
+        chatCompletionsUrl: `${AI_DEFAULT_BASE_URL}/chat/completions`,
+        embeddingsUrl: `${AI_DEFAULT_BASE_URL}/embeddings`,
+    };
+}
+/**
+ * Whether the app can use a model right now, without calling one: gate
+ * an AI feature and show `setup` ("A chat model isn't set up on this
+ * Gateway: it needs OPENROUTER_API_KEY. An admin runs: pnpm everyapp
+ * configure inbox") up front instead of failing mid-task. `provider`
+ * defaults to `default`, the Gateway's default model (`ai: { chat: true }`);
+ * name one the manifest lists under `providers` to ask about it instead.
+ * The Gateway owns the wording: show `setup` and `command` as they are.
+ *
+ * Over the binding it sends `GET /api/ai/<provider>`; in local dev it
+ * answers from `.dev.vars` by the same rule `createGatewayFetch()` uses.
+ */
+export async function aiStatus({ env, provider = AI_DEFAULT_PROVIDER, for: explicitTarget, }) {
+    const target = attributionFor(env, explicitTarget, "aiStatus");
+    const values = env;
+    const binding = gatewayBinding(env);
+    const unavailable = {
+        provider,
+        requested: false,
+        configured: false,
+        ready: false,
+        resolved: null,
+        settings: [],
+        setup: null,
+        command: null,
+    };
+    if (binding && typeof binding.fetch === "function") {
+        const headers = new Headers();
+        if (target !== undefined)
+            applyAttribution(headers, target);
+        const response = await binding.fetch(`${BINDING_ORIGIN}/api/ai/${encodeURIComponent(provider)}`, { headers });
+        if (!response.ok)
+            return unavailable;
+        const body = (await response.json());
+        return {
+            ...unavailable,
+            ...body,
+            provider,
+            settings: Array.isArray(body.settings) ? body.settings : [],
+            setup: typeof body.setup === "string" ? body.setup : null,
+            command: typeof body.command === "string" ? body.command : null,
+            resolved: body.resolved ?? null,
+        };
+    }
+    if (!values["EVERYAPP_DEV"])
+        return unavailable;
+    const isSet = (name) => typeof values[name] === "string" && values[name].trim() !== "";
+    const dev = (label, settings, configured, resolved, also = "") => ({
+        provider,
+        requested: true,
+        configured,
+        ready: configured,
+        resolved,
+        settings: configured ? [] : [...settings],
+        setup: configured
+            ? null
+            : `${label} isn't set up for local development: set ${settings.join(" and ")}${also} in .dev.vars.`,
+        command: null,
+    });
+    if (provider === AI_DEFAULT_PROVIDER) {
+        const resolution = resolveAiDefault({ provider: null, isSet });
+        return dev("A chat model", resolution.settings, resolution.configured, resolution.configured
+            ? {
+                provider: resolution.provider,
+                label: resolution.label,
+                model: resolution.model,
+            }
+            : null, " (or another model provider's key)");
+    }
+    const spec = devAiProvider(provider);
+    if (!spec)
+        return unavailable;
+    const settings = aiProviderSettings(spec);
+    return dev(CATALOG.get(provider)?.label ?? provider, settings, settings.every(isSet), null);
+}
+const CHAT_COMPLETIONS = "/chat/completions";
+/**
+ * A provider's root behind the Gateway, `http://every-app-gateway.internal/api/ai/<provider>`:
+ * join the provider's own paths onto it (`/api/v1/chat/completions` for
+ * OpenRouter) and send them with `createGatewayFetch()`. For an OpenAI
+ * client's `baseURL`, use {@link aiBaseUrl}.
+ */
+export function providerBaseUrl(provider) {
+    return `${BINDING_ORIGIN}/api/ai/${encodeURIComponent(provider)}`;
+}
+/**
+ * The OpenAI-compatible base URL of `provider` behind the Gateway, for an
+ * OpenAI client's `baseURL` (with `fetch: createGatewayFetch(...)`):
+ * `default` (the default) is {@link AI_DEFAULT_BASE_URL},
+ * `…/api/ai/default/v1`; a catalog provider's is its root and the prefix
+ * of its chat route (`…/api/ai/openrouter/api/v1`, `…/api/ai/workers-ai/v1`,
+ * `…/api/ai/openai/v1`). Throws `ConfigurationError` for a provider with
+ * no OpenAI-compatible chat route (Cohere): call {@link providerBaseUrl}
+ * with its own paths instead.
+ */
+export function aiBaseUrl(provider = AI_DEFAULT_PROVIDER) {
+    if (provider === AI_DEFAULT_PROVIDER)
+        return AI_DEFAULT_BASE_URL;
+    const capability = CATALOG.get(provider);
+    const chat = capability?.mode === "ai" && "chat" in capability
+        ? capability.chat
+        : undefined;
+    if (!chat?.path.endsWith(CHAT_COMPLETIONS)) {
+        throw new ConfigurationError(`${provider} has no OpenAI-compatible chat route in the catalog: join its own paths onto providerBaseUrl("${provider}") instead.`);
+    }
+    return `${providerBaseUrl(provider)}${chat.path.slice(0, -CHAT_COMPLETIONS.length)}`;
+}

package/dist/server/aiBinding.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
+ * binding, for code written against `env.AI.run(model, inputs, options)`.
+ *
+ * An app on Every App needs no `ai` binding of its own to call models: the
+ * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
+ * Code that already calls `env.AI.run()` (upstream code a port keeps, the
+ * Agents SDK, `workers-ai-provider`) gets this object in its place:
+ *
+ *   const AI = gatewayAiBinding(env, { for: request });
+ *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
+ *
+ * Each `run()` becomes an OpenAI-compatible call on the provider's route
+ * through the Gateway (`createGatewayFetch`): text generation (`messages`
+ * or `prompt`) on its chat completions route, text embeddings (`text`) on
+ * its embeddings route, answered in Workers AI's shapes (`{ response,
+ * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
+ * {"response": …}` events with `stream: true`). In local development
+ * without a Gateway, the developer's own key in `.dev.vars` is used, as
+ * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
+ * for Workers AI).
+ */
+import { AI_DEFAULT_PROVIDER, type AiProviderId } from "../internal/index.js";
+import type { GatewayCallFor } from "./attribution.js";
+export interface GatewayAiBindingOptions {
+    /**
+     * Whom the calls are for: the inbound request, or `{ background: true,
+     * organizationId }` (createGatewayFetch's `for`).
+     */
+    for?: GatewayCallFor;
+    /**
+     * The Gateway provider the calls go to: an `ai` entry of the catalog
+     * with OpenAI-compatible routes (`workers-ai`, `openrouter`, `openai`,
+     * …), or `default`, the operator's model (`ai: { chat: true }`).
+     * Default: `workers-ai`, the provider `env.AI` reaches, so `@cf/…` model
+     * ids work as they are. The manifest lists the provider under
+     * `providers` (or says `ai.chat` for `default`).
+     */
+    provider?: AiProviderId | typeof AI_DEFAULT_PROVIDER;
+    /**
+     * The model id to send for a model the code names, e.g.
+     * `{ "@cf/meta/llama-3.1-8b-instruct-fast": "meta-llama/llama-3.1-8b-instruct" }`
+     * with `provider: "openrouter"`. A model not listed is sent as it is,
+     * except that on `default` an `@cf/…` id becomes `default` (the
+     * operator's model).
+     */
+    models?: Readonly<Record<string, string>>;
+}
+/**
+ * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
+ * `env.AI`. `run()` covers text generation (messages or prompt; tools;
+ * `stream: true`; `returnRawResponse`, which returns the provider's
+ * OpenAI-shaped `Response`) and text embeddings; the binding's other
+ * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
+ * other tasks (images, audio, batches, websockets) throw
+ * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
+ * operator decides whether calls go through Cloudflare AI Gateway
+ * (`everyapp ai gateway on`).
+ *
+ * Errors are thrown as a binding throws them: `GatewayRefusalError` when
+ * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
+ * …), `ConfigurationError` where createGatewayFetch throws one (no binding
+ * and no dev key), and an `Error` naming the status when the provider
+ * answered with an error. Nothing is checked when the binding is made, so
+ * making one per request costs nothing.
+ */
+export declare function gatewayAiBinding(env: object, options?: GatewayAiBindingOptions): Ai;
+//# sourceMappingURL=aiBinding.d.ts.map

package/dist/server/aiBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiBinding.d.ts","sourceRoot":"","sources":["../../src/server/aiBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAEL,mBAAmB,EAInB,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIvD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,mBAAmB,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAUD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,uBAA4B,GACpC,EAAE,CAoEJ"}

package/dist/server/aiBinding.js

@@ -0,0 +1,294 @@
+/**
+ * `gatewayAiBinding(env)`: the Gateway's AI providers as a Workers AI
+ * binding, for code written against `env.AI.run(model, inputs, options)`.
+ *
+ * An app on Every App needs no `ai` binding of its own to call models: the
+ * Gateway holds the keys, counts the calls and keeps the app to `ai.models`.
+ * Code that already calls `env.AI.run()` (upstream code a port keeps, the
+ * Agents SDK, `workers-ai-provider`) gets this object in its place:
+ *
+ *   const AI = gatewayAiBinding(env, { for: request });
+ *   await AI.run("@cf/meta/llama-3.1-8b-instruct-fast", { messages });
+ *
+ * Each `run()` becomes an OpenAI-compatible call on the provider's route
+ * through the Gateway (`createGatewayFetch`): text generation (`messages`
+ * or `prompt`) on its chat completions route, text embeddings (`text`) on
+ * its embeddings route, answered in Workers AI's shapes (`{ response,
+ * tool_calls, usage }`, `{ shape, data }`, or a stream of `data:
+ * {"response": …}` events with `stream: true`). In local development
+ * without a Gateway, the developer's own key in `.dev.vars` is used, as
+ * `createGatewayFetch` does (WORKERS_AI_API_TOKEN and CLOUDFLARE_ACCOUNT_ID
+ * for Workers AI).
+ */
+import { AI_DEFAULT_MODEL, AI_DEFAULT_PROVIDER, AI_DEFAULT_ROUTES, ConfigurationError, devAiProvider, } from "../internal/index.js";
+import { BINDING_ORIGIN, createGatewayFetch } from "./gatewayFetch.js";
+import { GatewayRefusalError, gatewayRefusal } from "./refusal.js";
+/**
+ * A Workers AI binding (`Ai`) over the Gateway: pass it where code takes
+ * `env.AI`. `run()` covers text generation (messages or prompt; tools;
+ * `stream: true`; `returnRawResponse`, which returns the provider's
+ * OpenAI-shaped `Response`) and text embeddings; the binding's other
+ * methods (`gateway()`, `autorag()`, `models()`, `toMarkdown()`, …) and
+ * other tasks (images, audio, batches, websockets) throw
+ * `ConfigurationError`. `options.gateway` is ignored: the Gateway's
+ * operator decides whether calls go through Cloudflare AI Gateway
+ * (`everyapp ai gateway on`).
+ *
+ * Errors are thrown as a binding throws them: `GatewayRefusalError` when
+ * the Gateway refused (`ai_provider_not_configured`, `model_not_allowed`,
+ * …), `ConfigurationError` where createGatewayFetch throws one (no binding
+ * and no dev key), and an `Error` naming the status when the provider
+ * answered with an error. Nothing is checked when the binding is made, so
+ * making one per request costs nothing.
+ */
+export function gatewayAiBinding(env, options = {}) {
+    const provider = options.provider ?? "workers-ai";
+    async function run(model, inputs, runOptions = {}) {
+        if (runOptions.websocket) {
+            throw unsupported("run() with websocket: true");
+        }
+        if (!inputs || typeof inputs !== "object") {
+            throw unsupported("run() without an inputs object");
+        }
+        if (Array.isArray(inputs["requests"])) {
+            throw unsupported("run() with a batch of requests");
+        }
+        const embedding = !("messages" in inputs) && !("prompt" in inputs) && "text" in inputs;
+        if (!embedding && !("messages" in inputs) && !("prompt" in inputs)) {
+            throw unsupported("run() for anything but text generation (messages or prompt) and text embeddings (text)");
+        }
+        const url = `${BINDING_ORIGIN}/api/ai/${provider}${routeOf(provider, embedding ? "embeddings" : "chat")}`;
+        const sent = modelToSend(provider, model, options.models);
+        const body = embedding
+            ? { model: sent, input: inputs["text"] }
+            : chatBody(sent, inputs);
+        const gatewayFetch = createGatewayFetch({
+            env,
+            for: options.for,
+        });
+        const response = await gatewayFetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            ...(runOptions.signal ? { signal: runOptions.signal } : {}),
+        });
+        if (runOptions.returnRawResponse)
+            return response;
+        await throwIfFailed(response, provider);
+        if (embedding)
+            return embeddingOutput(await response.json());
+        if (inputs["stream"] === true) {
+            if (!response.body)
+                return new ReadableStream();
+            return response.body.pipeThrough(toWorkersAiStream());
+        }
+        return textOutput(await response.json());
+    }
+    const notHere = (method) => () => {
+        throw unsupported(`env.AI.${method}()`);
+    };
+    const binding = {
+        aiGatewayLogId: null,
+        run,
+        gateway: notHere("gateway"),
+        autorag: notHere("autorag"),
+        aiSearch: notHere("aiSearch"),
+        websearch: notHere("websearch"),
+        models: notHere("models"),
+        toMarkdown: notHere("toMarkdown"),
+    };
+    // `Ai` is the app's own Workers types' class (it changes with each
+    // version); the object above is its working subset, the rest throwing.
+    return binding;
+}
+function unsupported(what) {
+    return new ConfigurationError(`${what} isn't available through the Every App gateway; call the provider's routes with createGatewayFetch() instead.`);
+}
+/** The provider's path for a chat or an embeddings call, under `/api/ai/<provider>`. */
+function routeOf(provider, kind) {
+    if (provider === AI_DEFAULT_PROVIDER)
+        return AI_DEFAULT_ROUTES[kind];
+    const spec = devAiProvider(provider);
+    if (!spec) {
+        throw new ConfigurationError(`gatewayAiBinding: ${JSON.stringify(provider)} is not an AI provider of the catalog.`);
+    }
+    const route = spec[kind];
+    if (!route) {
+        throw new ConfigurationError(`gatewayAiBinding: ${provider} has no OpenAI-compatible ${kind === "chat" ? "chat completions" : "embeddings"} route.`);
+    }
+    return route.path;
+}
+function modelToSend(provider, model, models) {
+    const mapped = models && Object.hasOwn(models, model) ? models[model] : null;
+    if (mapped)
+        return mapped;
+    if (provider === AI_DEFAULT_PROVIDER && model.startsWith("@cf/")) {
+        return AI_DEFAULT_MODEL;
+    }
+    return model;
+}
+/**
+ * Workers AI's text generation inputs as a chat completions body: `prompt`
+ * as one user message, legacy tools (`{ name, description, parameters }`)
+ * as OpenAI's, everything else (max_tokens, temperature, response_format,
+ * stream, …) as it is. Never adds `stream_options` (Workers AI refuses it
+ * on a call that doesn't stream).
+ */
+function chatBody(model, inputs) {
+    const { prompt, messages, tools, raw: _raw, lora: _lora, ...rest } = inputs;
+    const body = {
+        ...rest,
+        model,
+        messages: messages ??
+            (typeof prompt === "string" ? [{ role: "user", content: prompt }] : []),
+    };
+    if (Array.isArray(tools))
+        body["tools"] = tools.map(openAiTool);
+    return body;
+}
+function openAiTool(tool) {
+    if (!isRecord(tool) || "function" in tool)
+        return tool;
+    const { name, description, parameters } = tool;
+    return {
+        type: "function",
+        function: {
+            name,
+            ...(description === undefined ? {} : { description }),
+            ...(parameters === undefined ? {} : { parameters }),
+        },
+    };
+}
+async function throwIfFailed(response, provider) {
+    if (response.ok)
+        return;
+    const refusal = await gatewayRefusal(response.clone());
+    if (refusal)
+        throw new GatewayRefusalError(refusal);
+    const text = await response.text().catch(() => "");
+    throw new Error(`AI (${provider}) answered ${response.status}${text ? `: ${text.slice(0, 500)}` : ""}`);
+}
+/** A chat completion as Workers AI answers text generation. */
+function textOutput(body) {
+    const choice = firstChoice(body);
+    const message = isRecord(choice?.["message"]) ? choice["message"] : {};
+    const toolCalls = workersAiToolCalls(message["tool_calls"]);
+    const usage = isRecord(body) ? body["usage"] : undefined;
+    return {
+        // Workers AI may send an all-digit reply as a JSON number.
+        response: textOf(message["content"]),
+        ...(toolCalls ? { tool_calls: toolCalls } : {}),
+        ...(isRecord(usage) ? { usage } : {}),
+    };
+}
+/**
+ * OpenAI tool calls as both forms Workers AI answers with: the legacy
+ * `{ name, arguments }` (arguments parsed) and the OpenAI-shaped
+ * `{ id, type, function }`.
+ */
+function workersAiToolCalls(calls) {
+    if (!Array.isArray(calls) || calls.length === 0)
+        return undefined;
+    return calls.filter(isRecord).map((call) => {
+        const fn = isRecord(call["function"]) ? call["function"] : {};
+        const args = fn["arguments"];
+        return {
+            ...(call["id"] === undefined ? {} : { id: call["id"] }),
+            type: "function",
+            function: { name: fn["name"], arguments: args },
+            name: fn["name"],
+            arguments: typeof args === "string" ? parsedOr(args) : args,
+        };
+    });
+}
+/** Embeddings as Workers AI answers them: `{ shape: [rows, dimensions], data }`. */
+function embeddingOutput(body) {
+    const rows = isRecord(body) && Array.isArray(body["data"]) ? body["data"] : [];
+    const data = rows
+        .filter(isRecord)
+        .sort((a, b) => Number(a["index"] ?? 0) - Number(b["index"] ?? 0))
+        .map((row) => Array.isArray(row["embedding"]) ? row["embedding"] : []);
+    return { shape: [data.length, data[0]?.length ?? 0], data };
+}
+/**
+ * An OpenAI chat completions event stream as Workers AI streams text:
+ * one `data: {"response": "<token>"}` event per chunk with text (tool call
+ * deltas and usage alongside), then `data: [DONE]`.
+ */
+function toWorkersAiStream() {
+    const decoder = new TextDecoder();
+    const encoder = new TextEncoder();
+    let pending = "";
+    const convert = (line) => {
+        const match = /^data:[ ]?(.*?)\r?$/s.exec(line);
+        if (!match)
+            return "";
+        const data = match[1].trim();
+        if (data === "[DONE]")
+            return "data: [DONE]\n\n";
+        let chunk;
+        try {
+            chunk = JSON.parse(data);
+        }
+        catch {
+            return "";
+        }
+        const choice = firstChoice(chunk);
+        const delta = isRecord(choice?.["delta"]) ? choice["delta"] : {};
+        const usage = isRecord(chunk) ? chunk["usage"] : undefined;
+        const toolCalls = Array.isArray(delta["tool_calls"])
+            ? delta["tool_calls"]
+            : undefined;
+        const event = {
+            response: textOf(delta["content"]),
+            ...(toolCalls ? { tool_calls: toolCalls } : {}),
+            ...(isRecord(usage) ? { usage } : {}),
+        };
+        if (!event.response && !toolCalls && !isRecord(usage))
+            return "";
+        return `data: ${JSON.stringify(event)}\n\n`;
+    };
+    return new TransformStream({
+        transform(bytes, controller) {
+            pending += decoder.decode(bytes, { stream: true });
+            const end = pending.lastIndexOf("\n");
+            if (end === -1)
+                return;
+            const lines = pending.slice(0, end).split("\n");
+            pending = pending.slice(end + 1);
+            const out = lines.map(convert).join("");
+            if (out)
+                controller.enqueue(encoder.encode(out));
+        },
+        flush(controller) {
+            pending += decoder.decode();
+            const out = convert(pending);
+            if (out)
+                controller.enqueue(encoder.encode(out));
+        },
+    });
+}
+function firstChoice(body) {
+    if (!isRecord(body) || !Array.isArray(body["choices"]))
+        return undefined;
+    const choice = body["choices"][0];
+    return isRecord(choice) ? choice : undefined;
+}
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (typeof content === "number")
+        return String(content);
+    return "";
+}
+function parsedOr(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/server/attribution.d.ts

@@ -1,6 +1,8 @@
 /**
  * Whom a call through the gateway is for, which decides the organization
- * it counts against:
+ * it counts against. Left out, it comes from the request context: the
+ * request `everyApp()` is serving (its person, while the identity is good),
+ * or the organization `withOrganization()` named. Given explicitly:
  *
  *  - the inbound `Request`: its person, by the identity the gateway put on
  *    it (forwarded as is);
@@ -24,11 +26,13 @@ export declare class AttributionError extends Error {
     constructor(message: string);
 }
 /**
- * Check `target` before any call is made: a shared app's Worker must pass
- * the request or name the organization, and anything else passed must be
- * one of the two shapes.
+ * Whom the call is for, checked before any call is made: `target` as the
+ * app passed it, else the request context's answer
+ * ({@link attributionFromContext}; a `RequestContextError` outside every
+ * context). A shared app's Worker must end up with the request or an
+ * organization, and anything passed must be one of the two shapes.
  */
-export declare function checkAttribution(env: object, target: GatewayCallFor | undefined, what: string): void;
+export declare function attributionFor(env: object, target: GatewayCallFor | undefined, what: string): GatewayCallFor | undefined;
 /**
  * Put the call's attribution on its headers: the request's identity, or the
  * background work's organization, and never one the app set itself.

package/dist/server/attribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,0BAA0B;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GACX,IAAI,CAsBN;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,IAAI,CAUN;AASD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAO1D"}
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB,OAAO,GACP;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,0BAA0B;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GACX,cAAc,GAAG,SAAS,CAI5B;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,IAAI,CAUN;AASD,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAO1D"}