@harperfast/harper 5.2.0 → 5.2.2

package/dist/resources/models/openaiStream.js

@@ -14,6 +14,51 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openaiStream = openaiStream;
 const node_crypto_1 = require("node:crypto");
+// Bounds on per-stream tool-call assembly. The backend supplies both the call ids and the
+// argument fields, and this runs on a public HTTP path, so neither can be unbounded. Overflow
+// terminates the stream through the same sanitized error-frame path as any backend failure.
+const MAX_TOOL_CALLS_PER_STREAM = 256;
+const MAX_TOOL_ARGUMENT_KEYS = 1024;
+// Cumulative serialized-character budget across the WHOLE stream's assembly (ids, names,
+// and every argument value as it arrives, plus per-entry JSON syntax so the count is an
+// upper bound on `JSON.stringify(arguments)`, not just the raw content). Call/key counts
+// alone don't bound memory — one key can hold an arbitrarily large value, and the final
+// JSON.stringify duplicates the retained allocation — so the budget is charged per delta
+// (O(delta), no re-serialization of the accumulator) and monotonically: replacing an
+// existing key charges the new value too, so churn cannot smuggle unbounded values under
+// a stable key count. The SSE frame that flushes the calls adds only a bounded constant
+// envelope per call plus string-escaping of the arguments blob (< 2x), so the frame size
+// is bounded by a small multiple of this budget.
+const MAX_TOOL_ASSEMBLY_CHARS = 1_048_576;
+/** Signals that a stream exceeded the tool-assembly bounds; surfaced as an SSE error frame. */
+class ToolAssemblyOverflowError extends Error {
+    statusCode = 502;
+}
+/**
+ * Merge `source` into `target`, returning the keys added and the serialized characters
+ * charged. Charging over-approximates `JSON.stringify(target).length`: each first add
+ * charges the key plus 4 chars of JSON syntax (`"key":` quotes and colon, plus the
+ * comma/brace share), and every assignment — replacements included — charges the
+ * serialized value. Since a replacement's earlier charge is never refunded, the
+ * cumulative total stays an upper bound on the retained serialization while keeping
+ * accumulation O(delta), not O(total).
+ */
+function assignCountingNewKeys(target, source) {
+    let addedKeys = 0;
+    let addedChars = 0;
+    for (const key in source) {
+        if (!(key in target)) {
+            addedKeys++;
+            addedChars += key.length + 4;
+        }
+        const value = source[key];
+        // `?? ''`: JSON.stringify returns undefined for undefined/function/symbol values —
+        // impossible from JSON.parse but reachable from a custom backend's crafted object.
+        addedChars += (JSON.stringify(value) ?? '').length;
+        target[key] = value;
+    }
+    return { addedKeys, addedChars };
+}
 /**
  * Wrap a `GenerateChunk` async iterable as OpenAI `chat.completion.chunk` SSE messages,
  * terminated by the `[DONE]` sentinel. Content deltas stream inline; tool calls are
@@ -32,6 +77,7 @@ async function* openaiStream(tokens, opts = {}) {
     // (`{"a":1}` + `{"b":2}` → invalid JSON) — Harper's already-buffered upstream model
     // means we cannot faithfully reproduce per-token argument fragments anyway.
     const toolAssembly = new Map();
+    let assemblyChars = 0;
     const chunk = (delta, finish) => ({
         data: {
             id,
@@ -41,30 +87,76 @@ async function* openaiStream(tokens, opts = {}) {
             choices: [{ index: 0, delta, finish_reason: finish }],
         },
     });
-    for await (const token of tokens) {
-        if (token.deltaContent !== undefined) {
-            const delta = {};
-            if (!roleSent) {
-                delta.role = 'assistant';
-                roleSent = true;
+    try {
+        for await (const token of tokens) {
+            if (token.deltaContent !== undefined) {
+                const delta = {};
+                if (!roleSent) {
+                    delta.role = 'assistant';
+                    roleSent = true;
+                }
+                delta.content = token.deltaContent;
+                yield chunk(delta, null);
             }
-            delta.content = token.deltaContent;
-            yield chunk(delta, null);
-        }
-        if (token.deltaToolCalls) {
-            for (const incoming of token.deltaToolCalls) {
-                if (!incoming.id)
-                    continue;
-                const existing = toolAssembly.get(incoming.id) ?? { index: toolAssembly.size, arguments: {} };
-                if (incoming.name)
-                    existing.name = incoming.name;
-                if (incoming.arguments)
-                    existing.arguments = { ...existing.arguments, ...incoming.arguments };
-                toolAssembly.set(incoming.id, existing);
+            if (token.deltaToolCalls) {
+                for (const incoming of token.deltaToolCalls) {
+                    if (!incoming.id)
+                        continue;
+                    let existing = toolAssembly.get(incoming.id);
+                    if (!existing) {
+                        // Cap distinct calls per stream: ids come from the backend, and an
+                        // unbounded map on a public HTTP path is a memory risk.
+                        if (toolAssembly.size >= MAX_TOOL_CALLS_PER_STREAM) {
+                            throw new ToolAssemblyOverflowError(`stream exceeded ${MAX_TOOL_CALLS_PER_STREAM} tool calls`);
+                        }
+                        // Null-prototype: arguments come from JSON.parse, so a field literally
+                        // named `__proto__` is an own property. Object.assign uses [[Set]], which
+                        // on an ordinary object would hit Object.prototype's inherited `__proto__`
+                        // setter and silently drop the field (the previous spread did not).
+                        existing = { index: toolAssembly.size, arguments: Object.create(null), argumentCount: 0 };
+                        toolAssembly.set(incoming.id, existing);
+                        // + 96: the flush frame's fixed per-call envelope (index/id/type/function
+                        // syntax and the argument object's braces), so 256 calls of envelope are
+                        // inside the budget too, not on top of it.
+                        assemblyChars += incoming.id.length + 96;
+                    }
+                    if (incoming.name && incoming.name !== existing.name) {
+                        assemblyChars += incoming.name.length;
+                        existing.name = incoming.name;
+                    }
+                    // Guard the contract (`ToolCall.arguments` is an object): a string would be
+                    // assigned index-wise, inflating the field count from characters.
+                    if (incoming.arguments && typeof incoming.arguments === 'object') {
+                        // Mutate rather than re-spread — spreading copied every previously
+                        // accumulated property on each partial delta (O(n²) as fields grow) — and
+                        // count only newly-introduced keys so the bound check stays O(delta) too.
+                        const { addedKeys, addedChars } = assignCountingNewKeys(existing.arguments, incoming.arguments);
+                        existing.argumentCount += addedKeys;
+                        assemblyChars += addedChars;
+                        if (existing.argumentCount > MAX_TOOL_ARGUMENT_KEYS) {
+                            throw new ToolAssemblyOverflowError(`tool call arguments exceeded ${MAX_TOOL_ARGUMENT_KEYS} fields`);
+                        }
+                    }
+                    if (assemblyChars > MAX_TOOL_ASSEMBLY_CHARS) {
+                        throw new ToolAssemblyOverflowError(`stream tool-call assembly exceeded ${MAX_TOOL_ASSEMBLY_CHARS} serialized characters`);
+                    }
+                }
             }
+            if (token.finishReason)
+                finishReason = token.finishReason;
         }
-        if (token.finishReason)
-            finishReason = token.finishReason;
+    }
+    catch (err) {
+        // The backend can throw partway through the stream (Models#wrapStream re-throws
+        // mid-stream backend errors). Headers/200 are already flushed, so this can't be an
+        // HTTP error status — emit a final OpenAI-shaped `data: {error}` frame so SDK clients
+        // see a parseable error (matching the non-streaming path) instead of an abrupt socket
+        // close. OpenAI terminates the stream on error and sends no `[DONE]`, so we do the same.
+        const error = opts.formatError
+            ? opts.formatError(err)
+            : { message: 'Internal server error', type: 'server_error', code: null, param: null };
+        yield { data: { error } };
+        return;
     }
     if (toolAssembly.size > 0) {
         const toolCalls = [];

package/dist/resources/models/openaiStream.js.map

@@ -1 +1 @@
-{"version":3,"file":"openaiStream.js","sourceRoot":"","sources":["../../../resources/models/openaiStream.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AA6CH,oCA4EC;AAvHD,6CAAyC;AAsCzC;;;;GAIG;AACI,KAAK,SAAS,CAAC,CAAC,YAAY,CAClC,MAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,YAAY,IAAA,wBAAU,GAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAE/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAA4C,CAAC;IAEjD,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAA+D,CAAC;IAE5F,MAAM,KAAK,GAAG,CAAC,KAAkB,EAAE,MAAiC,EAAuB,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE;YACL,EAAE;YACF,MAAM,EAAE,uBAAuB;YAC/B,OAAO;YACP,KAAK;YACL,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;SACrD;KACD,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC;YACnC,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,SAAS;gBAC3B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;gBAC9F,IAAI,QAAQ,CAAC,IAAI;oBAAE,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACjD,IAAI,QAAQ,CAAC,SAAS;oBAAE,QAAQ,CAAC,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC9F,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,IAAI,KAAK,CAAC,YAAY;YAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC3D,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;aAC9E,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC;YACzB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAuB,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,aAAa,GAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,aAAa,CAAC,IAAI,GAAG,WAAW,CAAC;IAChD,MAAM,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEnC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"openaiStream.js","sourceRoot":"","sources":["../../../resources/models/openaiStream.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AA2GH,oCA8HC;AAvOD,6CAAyC;AAkBzC,0FAA0F;AAC1F,8FAA8F;AAC9F,4FAA4F;AAC5F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,yFAAyF;AACzF,wFAAwF;AACxF,yFAAyF;AACzF,wFAAwF;AACxF,yFAAyF;AACzF,qFAAqF;AACrF,yFAAyF;AACzF,wFAAwF;AACxF,yFAAyF;AACzF,iDAAiD;AACjD,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C,+FAA+F;AAC/F,MAAM,yBAA0B,SAAQ,KAAK;IAC5C,UAAU,GAAG,GAAG,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,MAAc,EAAE,MAAc;IAC5D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACtB,SAAS,EAAE,CAAC;YACZ,UAAU,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;QACvD,mFAAmF;QACnF,mFAAmF;QACnF,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAClD,MAAkC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAoCD;;;;GAIG;AACI,KAAK,SAAS,CAAC,CAAC,YAAY,CAClC,MAAoC,EACpC,OAA4B,EAAE;IAE9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,YAAY,IAAA,wBAAU,GAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAE/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAA4C,CAAC;IAEjD,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsF,CAAC;IACnH,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,KAAK,GAAG,CAAC,KAAkB,EAAE,MAAiC,EAAuB,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE;YACL,EAAE;YACF,MAAM,EAAE,uBAAuB;YAC/B,OAAO;YACP,KAAK;YACL,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;SACrD;KACD,CAAC,CAAC;IAEH,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACf,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC;oBACzB,QAAQ,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC;gBACnC,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBAC1B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,SAAS;oBAC3B,IAAI,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACf,mEAAmE;wBACnE,wDAAwD;wBACxD,IAAI,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;4BACpD,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,yBAAyB,aAAa,CAAC,CAAC;wBAChG,CAAC;wBACD,uEAAuE;wBACvE,0EAA0E;wBAC1E,2EAA2E;wBAC3E,oEAAoE;wBACpE,QAAQ,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;wBAC1F,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;wBACxC,0EAA0E;wBAC1E,yEAAyE;wBACzE,2CAA2C;wBAC3C,aAAa,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;oBAC1C,CAAC;oBACD,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;wBACtD,aAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;wBACtC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;oBAC/B,CAAC;oBACD,4EAA4E;oBAC5E,kEAAkE;oBAClE,IAAI,QAAQ,CAAC,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAClE,mEAAmE;wBACnE,0EAA0E;wBAC1E,0EAA0E;wBAC1E,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;wBAChG,QAAQ,CAAC,aAAa,IAAI,SAAS,CAAC;wBACpC,aAAa,IAAI,UAAU,CAAC;wBAC5B,IAAI,QAAQ,CAAC,aAAa,GAAG,sBAAsB,EAAE,CAAC;4BACrD,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,sBAAsB,SAAS,CAAC,CAAC;wBACtG,CAAC;oBACF,CAAC;oBACD,IAAI,aAAa,GAAG,uBAAuB,EAAE,CAAC;wBAC7C,MAAM,IAAI,yBAAyB,CAClC,sCAAsC,uBAAuB,wBAAwB,CACrF,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,KAAK,CAAC,YAAY;gBAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QAC3D,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,gFAAgF;QAChF,mFAAmF;QACnF,sFAAsF;QACtF,sFAAsF;QACtF,yFAAyF;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW;YAC7B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvF,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;IACR,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;aAC9E,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC;YACzB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC;QAC7B,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAuB,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,aAAa,GAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,aAAa,CAAC,IAAI,GAAG,WAAW,CAAC;IAChD,MAAM,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEnC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC1B,CAAC"}

package/dist/resources/models/v1/chatCompletions.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `POST /v1/chat/completions` — OpenAI-compatible chat endpoint (#631).
+ *
+ * SSE serving-path note: the OpenAI SDK sends `Accept: application/json` for
+ * ALL requests including streaming ones (`client.ts:1160` in the SDK source).
+ * Harper's REST layer dispatches `Accept: text/event-stream` as CONNECT, and
+ * everything else as the HTTP method. So `stream: true` from an OpenAI SDK
+ * client reaches this `post()` handler, NOT `connect()`. We detect the `stream`
+ * flag in the body and return `{ body: Readable }` which REST.ts bypasses
+ * serialisation on (REST.ts:165-193) — exactly like any SSE resource response,
+ * but initiated from `post()` rather than `connect()`.
+ */
+import type { Readable } from 'node:stream';
+import { Resource } from '../../Resource.ts';
+export declare class V1ChatCompletions extends Resource {
+    static reservedPath: boolean;
+    static post(_target: unknown, body: unknown, request: unknown): Promise<import("./errors.ts").OpenAIErrorResponse | import("./translation.ts").OAIChatCompletion | {
+        status: number;
+        headers: {
+            'Content-Type': string;
+            'Cache-Control': string;
+            'X-Accel-Buffering': string;
+        };
+        body: Readable;
+    }>;
+    /**
+     * A client that sends an explicit `Accept: text/event-stream` with its POST is
+     * dispatched by REST as CONNECT (REST.ts), not POST. The OpenAI SDK happens to send
+     * `Accept: application/json` even when streaming, but other valid SSE clients do not.
+     *
+     * Without this override the request reached `Resource`'s default `connect`, whose
+     * instance path returns `subscribe()` — an empty `IterableEventQueue` — so the client
+     * got a 200 SSE response that stayed open forever emitting nothing, rather than an
+     * error it could act on.
+     *
+     * REST passes `null` as the CONNECT body (`resource.connect(target, null, request)`),
+     * so the parsed body is taken off the request and handed to the same `post()`
+     * implementation — one code path, identical validation and error shaping.
+     *
+     * `connect` is also reachable from the WebSocket handler with a different signature
+     * (`resourceRequest, incomingMessages, request`), where there is no `request.data`;
+     * that case is rejected as a client error rather than returning an envelope the WS
+     * path would fail to iterate.
+     */
+    static connect(target: unknown, _data: unknown, request: unknown): Promise<import("./errors.ts").OpenAIErrorResponse | import("./translation.ts").OAIChatCompletion | {
+        status: number;
+        headers: {
+            'Content-Type': string;
+            'Cache-Control': string;
+            'X-Accel-Buffering': string;
+        };
+        body: Readable;
+    }>;
+}

package/dist/resources/models/v1/chatCompletions.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * `POST /v1/chat/completions` — OpenAI-compatible chat endpoint (#631).
+ *
+ * SSE serving-path note: the OpenAI SDK sends `Accept: application/json` for
+ * ALL requests including streaming ones (`client.ts:1160` in the SDK source).
+ * Harper's REST layer dispatches `Accept: text/event-stream` as CONNECT, and
+ * everything else as the HTTP method. So `stream: true` from an OpenAI SDK
+ * client reaches this `post()` handler, NOT `connect()`. We detect the `stream`
+ * flag in the body and return `{ body: Readable }` which REST.ts bypasses
+ * serialisation on (REST.ts:165-193) — exactly like any SSE resource response,
+ * but initiated from `post()` rather than `connect()`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.V1ChatCompletions = void 0;
+const contentTypes_ts_1 = require("../../../server/serverHelpers/contentTypes.js");
+const Resource_ts_1 = require("../../Resource.js");
+const Models_ts_1 = require("../Models.js");
+const openaiStream_ts_1 = require("../openaiStream.js");
+const errors_ts_1 = require("./errors.js");
+const translation_ts_1 = require("./translation.js");
+const sseHandler = contentTypes_ts_1.contentTypes.get('text/event-stream');
+// @ts-ignore — Resource base class is not typed for static dispatch; pattern mirrors login.ts
+class V1ChatCompletions extends Resource_ts_1.Resource {
+    // Reserve this fixed route: a later app registration at the same path becomes a
+    // loud conflict (ErrorResource) instead of silently replacing the gateway and its
+    // super_user gate. See Resources.set.
+    static reservedPath = true;
+    static async post(_target, body, request) {
+        const authError = (0, errors_ts_1.authorizeV1Request)(request);
+        if (authError)
+            return authError;
+        // REST.ts passes `request.data` directly, which is the (unawaited) streaming
+        // JSON deserializer's Promise — awaiting here is a no-op for callers (e.g.
+        // unit tests) that already pass a plain object. A malformed JSON body rejects
+        // this promise, which is a client error, not a 500.
+        try {
+            body = await body;
+        }
+        catch (err) {
+            return (0, errors_ts_1.badRequest)(`Could not parse request body: ${err instanceof Error ? err.message : 'invalid JSON'}`);
+        }
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+            return (0, errors_ts_1.badRequest)('Request body must be a JSON object');
+        }
+        const req = body;
+        // Validate the nested wire shapes before mapping: the mappers assume well-formed
+        // input, so an unvalidated `messages:[null]` / `tools:[{}]` would throw a TypeError
+        // and surface as an RFC 9457 500 instead of an OpenAI 400.
+        const invalid = (0, translation_ts_1.validateChatRequest)(req);
+        if (invalid)
+            return (0, errors_ts_1.badRequest)(invalid);
+        const model = typeof req.model === 'string' ? req.model : 'default';
+        try {
+            const messages = (0, translation_ts_1.translateMessages)(req.messages);
+            // tool_choice: 'none' means "do not call tools" — the only faithful way to honor
+            // that against a returns-tool-calls backend is to not offer the tools at all.
+            // 'required'/named selection are rejected in validateChatRequest.
+            const tools = req.tool_choice === 'none' || !req.tools?.length ? undefined : (0, translation_ts_1.translateTools)(req.tools);
+            const input = (0, translation_ts_1.toGenerateInput)(messages, tools);
+            const opts = (0, translation_ts_1.toGenerateOpts)(req);
+            if (req.stream) {
+                const tokenStream = Models_ts_1.models.generateStream(input, opts);
+                // serializeStream wraps the async iterable in a Node Readable so REST.ts
+                // can return it without re-serialising. The `body` presence on the return
+                // value skips REST.ts's own serialize() call (REST.ts:165-193).
+                // formatError reuses the non-streaming error mapping so a mid-stream backend
+                // failure reaches the client as an OpenAI-shaped SSE error frame.
+                const readable = sseHandler.serializeStream((0, openaiStream_ts_1.openaiStream)(tokenStream, { model, formatError: (err) => (0, errors_ts_1.toOpenAIError)(err).data.error }));
+                return {
+                    status: 200,
+                    headers: {
+                        'Content-Type': 'text/event-stream',
+                        'Cache-Control': 'no-cache',
+                        'X-Accel-Buffering': 'no',
+                    },
+                    body: readable,
+                };
+            }
+            const result = await Models_ts_1.models.generate(input, opts);
+            return (0, translation_ts_1.toChatCompletion)(result, model);
+        }
+        catch (err) {
+            return (0, errors_ts_1.toOpenAIError)(err);
+        }
+    }
+    /**
+     * A client that sends an explicit `Accept: text/event-stream` with its POST is
+     * dispatched by REST as CONNECT (REST.ts), not POST. The OpenAI SDK happens to send
+     * `Accept: application/json` even when streaming, but other valid SSE clients do not.
+     *
+     * Without this override the request reached `Resource`'s default `connect`, whose
+     * instance path returns `subscribe()` — an empty `IterableEventQueue` — so the client
+     * got a 200 SSE response that stayed open forever emitting nothing, rather than an
+     * error it could act on.
+     *
+     * REST passes `null` as the CONNECT body (`resource.connect(target, null, request)`),
+     * so the parsed body is taken off the request and handed to the same `post()`
+     * implementation — one code path, identical validation and error shaping.
+     *
+     * `connect` is also reachable from the WebSocket handler with a different signature
+     * (`resourceRequest, incomingMessages, request`), where there is no `request.data`;
+     * that case is rejected as a client error rather than returning an envelope the WS
+     * path would fail to iterate.
+     */
+    static async connect(target, _data, request) {
+        const data = request?.data;
+        if (data === undefined) {
+            return (0, errors_ts_1.badRequest)('This endpoint requires a JSON request body; WebSocket connections are not supported');
+        }
+        return this.post(target, data, request);
+    }
+}
+exports.V1ChatCompletions = V1ChatCompletions;
+//# sourceMappingURL=chatCompletions.js.map

package/dist/resources/models/v1/chatCompletions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chatCompletions.js","sourceRoot":"","sources":["../../../../resources/models/v1/chatCompletions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,mFAA6E;AAC7E,mDAA6C;AAC7C,4CAAsC;AACtC,wDAAkD;AAClD,2CAA4E;AAC5E,qDAO0B;AAI1B,MAAM,UAAU,GAAG,8BAAY,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;AAEvE,8FAA8F;AAC9F,MAAa,iBAAkB,SAAQ,sBAAQ;IAC9C,gFAAgF;IAChF,kFAAkF;IAClF,sCAAsC;IACtC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAgB;QAClE,MAAM,SAAS,GAAG,IAAA,8BAAkB,EAAC,OAAc,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,oDAAoD;QACpD,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,IAAA,sBAAU,EAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAA,sBAAU,EAAC,oCAAoC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,IAAsB,CAAC;QAEnC,iFAAiF;QACjF,oFAAoF;QACpF,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAA,oCAAmB,EAAC,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,IAAA,sBAAU,EAAC,OAAO,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjD,iFAAiF;YACjF,8EAA8E;YAC9E,kEAAkE;YAClE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,+BAAc,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,IAAA,gCAAe,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAA,+BAAc,EAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,kBAAM,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACvD,yEAAyE;gBACzE,0EAA0E;gBAC1E,gEAAgE;gBAChE,6EAA6E;gBAC7E,kEAAkE;gBAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAC1C,IAAA,8BAAY,EAAC,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CACzF,CAAC;gBACF,OAAO;oBACN,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACR,cAAc,EAAE,mBAAmB;wBACnC,eAAe,EAAE,UAAU;wBAC3B,mBAAmB,EAAE,IAAI;qBACzB;oBACD,IAAI,EAAE,QAAQ;iBACd,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,kBAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAA,iCAAgB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAe,EAAE,KAAc,EAAE,OAAgB;QACrE,MAAM,IAAI,GAAI,OAA8B,EAAE,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAA,sBAAU,EAAC,qFAAqF,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;;AA7FF,8CA8FC"}

package/dist/resources/models/v1/embeddings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `POST /v1/embeddings` — OpenAI-compatible embedding endpoint (#631).
+ *
+ * Maps OpenAI's `{ model, input }` request body to `scope.models.embed()` and
+ * returns `{ object: 'list', data: [...], model, usage }` per the OpenAI wire spec.
+ */
+import { Resource } from '../../Resource.ts';
+export declare class V1Embeddings extends Resource {
+    static reservedPath: boolean;
+    static post(_target: unknown, body: Record<string, unknown>, request: unknown): Promise<import("./errors.ts").OpenAIErrorResponse | import("./translation.ts").OAIEmbedResponse>;
+}

package/dist/resources/models/v1/embeddings.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * `POST /v1/embeddings` — OpenAI-compatible embedding endpoint (#631).
+ *
+ * Maps OpenAI's `{ model, input }` request body to `scope.models.embed()` and
+ * returns `{ object: 'list', data: [...], model, usage }` per the OpenAI wire spec.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.V1Embeddings = void 0;
+const Resource_ts_1 = require("../../Resource.js");
+const Models_ts_1 = require("../Models.js");
+const errors_ts_1 = require("./errors.js");
+const translation_ts_1 = require("./translation.js");
+// Cap batched input, matching OpenAI's own 2048-item limit. The endpoint is
+// super_user-only and off by default, so this is a sanity bound (avoid an
+// unbounded fan-out to the backend), not a security control.
+const MAX_EMBEDDING_INPUTS = 2048;
+// @ts-ignore — Resource base class is not typed for static dispatch; pattern mirrors login.ts
+class V1Embeddings extends Resource_ts_1.Resource {
+    // Reserve this fixed route: a later app registration at the same path becomes a
+    // loud conflict (ErrorResource) instead of silently replacing the gateway and its
+    // super_user gate. See Resources.set.
+    static reservedPath = true;
+    static async post(_target, body, request) {
+        const authError = (0, errors_ts_1.authorizeV1Request)(request);
+        if (authError)
+            return authError;
+        // REST.ts passes `request.data` directly, which is the (unawaited) streaming
+        // JSON deserializer's Promise — awaiting here is a no-op for callers (e.g.
+        // unit tests) that already pass a plain object. A malformed JSON body rejects
+        // this promise, which is a client error, not a 500 (matches chatCompletions).
+        try {
+            body = await body;
+        }
+        catch (err) {
+            return (0, errors_ts_1.badRequest)(`Could not parse request body: ${err instanceof Error ? err.message : 'invalid JSON'}`);
+        }
+        if (!body || typeof body !== 'object' || Array.isArray(body))
+            return (0, errors_ts_1.badRequest)('Request body must be a JSON object');
+        const raw = body;
+        // Mirrors validateChatRequest: a non-string model would silently invoke the
+        // configured default rather than being rejected.
+        if (raw.model !== undefined && typeof raw.model !== 'string')
+            return (0, errors_ts_1.badRequest)("'model' must be a string");
+        const input = raw.input;
+        if (input === undefined || input === null)
+            return (0, errors_ts_1.badRequest)("'input' is required");
+        if (typeof input !== 'string' && !Array.isArray(input)) {
+            return (0, errors_ts_1.badRequest)("'input' must be a string or array of strings");
+        }
+        if (Array.isArray(input) && !input.every((v) => typeof v === 'string')) {
+            return (0, errors_ts_1.badRequest)("'input' array elements must be strings");
+        }
+        if (Array.isArray(input) && input.length > MAX_EMBEDDING_INPUTS) {
+            return (0, errors_ts_1.badRequest)(`'input' array must not exceed ${MAX_EMBEDDING_INPUTS} items`);
+        }
+        const model = typeof raw.model === 'string' ? raw.model : 'default';
+        const opts = (0, translation_ts_1.toEmbedOpts)(raw);
+        try {
+            // embedWithUsage, not embed(): the public facade drops the result-level usage
+            // backends report, and OpenAI clients read real token counts off the response.
+            const { vectors, usage } = await Models_ts_1.models.embedWithUsage(input, opts);
+            return (0, translation_ts_1.toEmbedResponse)(vectors, model, usage);
+        }
+        catch (err) {
+            return (0, errors_ts_1.toOpenAIError)(err);
+        }
+    }
+}
+exports.V1Embeddings = V1Embeddings;
+//# sourceMappingURL=embeddings.js.map

package/dist/resources/models/v1/embeddings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embeddings.js","sourceRoot":"","sources":["../../../../resources/models/v1/embeddings.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,mDAA6C;AAC7C,4CAAsC;AACtC,2CAA4E;AAC5E,qDAAgE;AAEhE,4EAA4E;AAC5E,0EAA0E;AAC1E,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,8FAA8F;AAC9F,MAAa,YAAa,SAAQ,sBAAQ;IACzC,gFAAgF;IAChF,kFAAkF;IAClF,sCAAsC;IACtC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAgB,EAAE,IAA6B,EAAE,OAAgB;QAClF,MAAM,SAAS,GAAG,IAAA,8BAAkB,EAAC,OAAc,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,IAAI,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,IAAA,sBAAU,EAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3D,OAAO,IAAA,sBAAU,EAAC,oCAAoC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAE5C,4EAA4E;QAC5E,iDAAiD;QACjD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAA,sBAAU,EAAC,0BAA0B,CAAC,CAAC;QAE5G,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAA,sBAAU,EAAC,qBAAqB,CAAC,CAAC;QACpF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,IAAA,sBAAU,EAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,IAAA,sBAAU,EAAC,wCAAwC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACjE,OAAO,IAAA,sBAAU,EAAC,iCAAiC,oBAAoB,QAAQ,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,IAAI,GAAG,IAAA,4BAAW,EAAC,GAAU,CAAC,CAAC;QAErC,IAAI,CAAC;YACJ,8EAA8E;YAC9E,+EAA+E;YAC/E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAM,CAAC,cAAc,CAAC,KAA0B,EAAE,IAAI,CAAC,CAAC;YACzF,OAAO,IAAA,gCAAe,EAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;;AAlDF,oCAmDC"}

package/dist/resources/models/v1/errors.d.ts

@@ -0,0 +1,54 @@
+/**
+ * OpenAI error envelope helpers for the `/v1/*` gateway (#631).
+ *
+ * Harper's REST layer serialises uncaught errors as RFC 9457 Problem Details.
+ * Resources that need the OpenAI `{ error: { message, type, code, param } }`
+ * shape must catch errors themselves and call `toOpenAIError()` / `badRequest()`.
+ */
+type OpenAIErrorType = 'invalid_request_error' | 'server_error' | 'authentication_error' | 'permission_error' | 'api_error';
+export interface OpenAIErrorBody {
+    message: string;
+    type: OpenAIErrorType;
+    code: string | null;
+    param: string | null;
+}
+/** HTTP response payload from a gateway error; resource methods return this directly. */
+export interface OpenAIErrorResponse {
+    status: number;
+    headers: {
+        'Content-Type': 'application/json';
+    };
+    data: {
+        error: OpenAIErrorBody;
+    };
+}
+/**
+ * Map any thrown value to an OpenAI error envelope. Uses `statusCode` when
+ * present (Harper's `ClientError` / `ServerError` convention). Falls back to
+ * `500 server_error`. `ModelBackendNotFoundError` maps to `404 model_not_found`.
+ */
+export declare function toOpenAIError(err: unknown): OpenAIErrorResponse;
+/** Convenience for early request-body validation failures. */
+export declare function badRequest(message: string): OpenAIErrorResponse;
+/**
+ * Gate for the `/v1/*` handlers, since overriding the static `get`/`post` methods
+ * bypasses Resource's `transactional()` wrapper and its default `allowRead`/`allowCreate`
+ * checks (Resource.ts:685-733, 426-435) never run for these endpoints.
+ *
+ * Mirrors Resource's default gate (super_user-only) rather than introducing a new
+ * permission — see PR discussion for whether a dedicated `/v1/*` permission should
+ * replace this later.
+ *
+ * Returns an OpenAI-shape error response when access should be denied, or `null`
+ * when the request may proceed.
+ */
+export declare function authorizeV1Request(request: {
+    user?: {
+        role?: {
+            permission?: {
+                super_user?: boolean;
+            };
+        };
+    };
+}): OpenAIErrorResponse | null;
+export {};

package/dist/resources/models/v1/errors.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * OpenAI error envelope helpers for the `/v1/*` gateway (#631).
+ *
+ * Harper's REST layer serialises uncaught errors as RFC 9457 Problem Details.
+ * Resources that need the OpenAI `{ error: { message, type, code, param } }`
+ * shape must catch errors themselves and call `toOpenAIError()` / `badRequest()`.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toOpenAIError = toOpenAIError;
+exports.badRequest = badRequest;
+exports.authorizeV1Request = authorizeV1Request;
+const backendRegistry_ts_1 = require("../backendRegistry.js");
+const Models_ts_1 = require("../Models.js");
+const harper_logger_ts_1 = __importDefault(require("../../../utility/logging/harper_logger.js"));
+/**
+ * Map any thrown value to an OpenAI error envelope. Uses `statusCode` when
+ * present (Harper's `ClientError` / `ServerError` convention). Falls back to
+ * `500 server_error`. `ModelBackendNotFoundError` maps to `404 model_not_found`.
+ */
+function toOpenAIError(err) {
+    let status = 500;
+    let type = 'server_error';
+    let code = null;
+    if (err instanceof backendRegistry_ts_1.ModelBackendNotFoundError) {
+        status = 404;
+        type = 'invalid_request_error';
+        code = 'model_not_found';
+    }
+    else if (err instanceof Models_ts_1.ModelCapabilityError) {
+        // Caller-driven mismatch (e.g. `tools` or streaming against a backend that
+        // doesn't support it): the request is what's wrong, not the server. It extends
+        // ServerError (statusCode 500), so this must precede the statusCode branch —
+        // falling through would report a generic sanitized 500 for a client-actionable
+        // condition. The message is safe to pass through: it names only the backend and
+        // the capability the caller asked for.
+        status = 400;
+        type = 'invalid_request_error';
+        code = 'capability_unsupported';
+    }
+    else if (err instanceof Error && typeof err.statusCode === 'number') {
+        status = err.statusCode;
+        if (status === 401) {
+            type = 'authentication_error';
+        }
+        else if (status === 403) {
+            // OpenAI semantics: 401 = bad/missing credentials, 403 = valid credentials
+            // lacking permission (matches authorizeV1Request's own 403 envelope).
+            type = 'permission_error';
+        }
+        else if (status < 500) {
+            type = 'invalid_request_error';
+        }
+        else {
+            type = 'server_error';
+        }
+    }
+    // 5xx messages stay generic: internal error strings (backend stack details, file
+    // paths) don't belong in a wire response. The real error goes to the log. 4xx
+    // messages are client-actionable and pass through.
+    let message;
+    if (status >= 500) {
+        harper_logger_ts_1.default.error('v1 gateway error', err);
+        message = 'Internal server error';
+    }
+    else {
+        message = err instanceof Error ? err.message : 'Bad request';
+    }
+    return {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+        data: { error: { message, type, code, param: null } },
+    };
+}
+/** Convenience for early request-body validation failures. */
+function badRequest(message) {
+    return {
+        status: 400,
+        headers: { 'Content-Type': 'application/json' },
+        data: { error: { message, type: 'invalid_request_error', code: null, param: null } },
+    };
+}
+/**
+ * Gate for the `/v1/*` handlers, since overriding the static `get`/`post` methods
+ * bypasses Resource's `transactional()` wrapper and its default `allowRead`/`allowCreate`
+ * checks (Resource.ts:685-733, 426-435) never run for these endpoints.
+ *
+ * Mirrors Resource's default gate (super_user-only) rather than introducing a new
+ * permission — see PR discussion for whether a dedicated `/v1/*` permission should
+ * replace this later.
+ *
+ * Returns an OpenAI-shape error response when access should be denied, or `null`
+ * when the request may proceed.
+ */
+function authorizeV1Request(request) {
+    const user = request?.user;
+    if (!user) {
+        return {
+            status: 401,
+            headers: { 'Content-Type': 'application/json' },
+            data: {
+                error: {
+                    message: 'You must provide valid credentials to access this endpoint.',
+                    type: 'authentication_error',
+                    code: null,
+                    param: null,
+                },
+            },
+        };
+    }
+    if (!user.role?.permission?.super_user) {
+        return {
+            status: 403,
+            headers: { 'Content-Type': 'application/json' },
+            data: {
+                error: {
+                    message: 'You do not have permission to access this endpoint.',
+                    type: 'permission_error',
+                    code: null,
+                    param: null,
+                },
+            },
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=errors.js.map

package/dist/resources/models/v1/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../resources/models/v1/errors.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AA4BH,sCAkDC;AAGD,gCAMC;AAcD,gDAiCC;AApID,8DAAkE;AAClE,4CAAoD;AACpD,iGAAqE;AAmBrE;;;;GAIG;AACH,SAAgB,aAAa,CAAC,GAAY;IACzC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,IAAI,GAAoB,cAAc,CAAC;IAC3C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,GAAG,YAAY,8CAAyB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC;QACb,IAAI,GAAG,uBAAuB,CAAC;QAC/B,IAAI,GAAG,iBAAiB,CAAC;IAC1B,CAAC;SAAM,IAAI,GAAG,YAAY,gCAAoB,EAAE,CAAC;QAChD,2EAA2E;QAC3E,+EAA+E;QAC/E,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,uCAAuC;QACvC,MAAM,GAAG,GAAG,CAAC;QACb,IAAI,GAAG,uBAAuB,CAAC;QAC/B,IAAI,GAAG,wBAAwB,CAAC;IACjC,CAAC;SAAM,IAAI,GAAG,YAAY,KAAK,IAAI,OAAQ,GAAW,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,GAAI,GAAW,CAAC,UAAU,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,GAAG,sBAAsB,CAAC;QAC/B,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3B,2EAA2E;YAC3E,sEAAsE;YACtE,IAAI,GAAG,kBAAkB,CAAC;QAC3B,CAAC;aAAM,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACzB,IAAI,GAAG,uBAAuB,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,IAAI,GAAG,cAAc,CAAC;QACvB,CAAC;IACF,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,OAAe,CAAC;IACpB,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACnB,0BAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,uBAAuB,CAAC;IACnC,CAAC;SAAM,CAAC;QACP,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;IAC9D,CAAC;IAED,OAAO;QACN,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;KACrD,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,UAAU,CAAC,OAAe;IACzC,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;KACpF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,kBAAkB,CAAC,OAElC;IACA,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE;gBACL,KAAK,EAAE;oBACN,OAAO,EAAE,6DAA6D;oBACtE,IAAI,EAAE,sBAA+B;oBACrC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;iBACX;aACD;SACD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACxC,OAAO;YACN,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE;gBACL,KAAK,EAAE;oBACN,OAAO,EAAE,qDAAqD;oBAC9D,IAAI,EAAE,kBAA2B;oBACjC,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,IAAI;iBACX;aACD;SACD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}