@gullabs/xai 0.5.0 → 0.5.1

package/README.md

@@ -169,7 +169,7 @@ xAI's own `/v1/models` listing surfaces `grok-4.5-latest` and `grok-build-latest
 - `serviceTier: 'priority'` → `service_tier: 'priority'` (`grok-4.6` only)
 - `output.jsonSchema` → `text.format: { type: 'json_schema', name, schema, strict: true }`
 - Usage: `usage.input_tokens` → `inputTokens`, `usage.output_tokens` → `outputTokens` (both already GROSS on xAI, unlike Gemini's sub-field summation); numeric extras (`num_sources_used`, `cost_in_usd_ticks`, etc.) surface into `usage.details` under their raw names, and the full raw payload is always in `usage.raw`
-- Errors: xAI's Responses API returns **HTTP 400 (not 401) for an invalid API key**. `classifyXaiError` special-cases the exact structured error-body signature (`code: 'invalid-argument'` with message prefix `"Incorrect API key provided"`, taken verbatim from a recorded live fixture) and reclassifies it as `invalid_auth`. It only inspects the STRUCTURED parsed error body — never free-form `Error.message` text — so a 400 that merely _mentions_ an API key (e.g. a schema-validation error echoing user content) stays `bad_request`. Any other 400, `429`→`rate_limited`, `5xx`→`server`, and timeouts fall through to `@gullabs/core`'s generic `classifyError`.
+- Errors: HTTP status is a hint. `classifyXaiError` inspects the STRUCTURED parsed body only — never free-form `Error.message`. Two recorded overlays: HTTP **400** whose body starts with `"Incorrect API key provided"` (prefix only; the SDK may drop `code`) → `invalid_auth`; HTTP **403** whose body starts with `"Content violates usage guidelines"` (e.g. `SAFETY_CHECK_TYPE_*`) → `content_filter`. A bare 403 without that body stays `invalid_auth`. Any other 400, `429`→`rate_limited`, `5xx`→`server`, and timeouts fall through to `@gullabs/core`'s generic `classifyError`.
 
 ## Learn more
 

package/dist/index.cjs

@@ -173,6 +173,11 @@ function isXaiAuthFailureBody(rawErr) {
   const text = extractXaiErrorBodyText(rawErr);
   return text !== void 0 && text.startsWith(XAI_AUTH_ERROR_MESSAGE_PREFIX);
 }
+var XAI_SAFETY_CHECK_MESSAGE_PREFIX = "Content violates usage guidelines";
+function isXaiSafetyCheckBody(rawErr) {
+  const text = extractXaiErrorBodyText(rawErr);
+  return text !== void 0 && text.startsWith(XAI_SAFETY_CHECK_MESSAGE_PREFIX);
+}
 var XAI_TRANSPORT_ERROR_PATTERN = /connection error|econnreset|econnrefused|etimedout|eai_again|epipe|socket hang up|fetch failed/i;
 function matchesXaiTransportSignature(err) {
   if (!(err instanceof Error)) return false;
@@ -211,6 +216,16 @@ function classifyXaiError(rawErr) {
       cause: base.cause ?? rawErr
     });
   }
+  if (base.httpStatus === 403 && isXaiSafetyCheckBody(rawErr)) {
+    const bodyText = extractXaiErrorBodyText(rawErr);
+    return new core.LlmError(bodyText ?? base.message, {
+      kind: "content_filter",
+      retryable: false,
+      httpStatus: base.httpStatus,
+      provider: "xai",
+      cause: base.cause ?? rawErr
+    });
+  }
   if (base.kind === "unknown" && isXaiTransportError(rawErr)) {
     return new core.LlmError(base.message, {
       kind: "server",