@maxceem/agw 0.1.13 → 0.2.1

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.1.13", wrangler: "4.96.0", upgradeFrom: ["0.1.13", "0.1.12", "0.1.11", "0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.1.13/gateway-0.1.13.tar.gz", sha256: "52bc83d5f54f79cd8bb1b868333648061dd444b41c34145e49698ad81bb794ac", manifest: "de2e8d1f4a9928be46b87571b7fcff33dc1d37c5bb008ba3261e97101f21781b" } };
+var define_AGW_MANIFEST_default = { version: "0.2.1", wrangler: "4.96.0", upgradeFrom: ["0.2.1", "0.2.0", "0.1.13", "0.1.12", "0.1.11", "0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.2.1/gateway-0.2.1.tar.gz", sha256: "09d5d34a924dedf99ca6268d2b699e3d524b72d07a6c6853629dc6c8c9a42307", manifest: "f0a1e385150b39c24707296f9618dea4bb21b73822bb976a58ac03a1482408a0" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -14525,6 +14525,99 @@ function date4(params) {
 // ../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../src/core/records.ts
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+
+// ../src/core/cost-report.ts
+function finiteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function servedProviderOf(root) {
+  const available = asRecord(asRecord(root.openrouter_metadata)?.endpoints)?.available;
+  if (Array.isArray(available)) {
+    for (const entry of available) {
+      const endpoint = asRecord(entry);
+      if (endpoint?.selected === true) {
+        const named = nonEmptyString(endpoint.provider);
+        if (named) return named;
+      }
+    }
+  }
+  return nonEmptyString(root.provider);
+}
+function upstreamInferenceCost(usage2) {
+  const upstream = finiteNumber(asRecord(usage2?.cost_details)?.upstream_inference_cost);
+  return upstream !== null && upstream > 0 ? upstream : null;
+}
+function reportedByok(root, usage2) {
+  if (usage2?.is_byok === true) return true;
+  if (asRecord(root.openrouter_metadata)?.is_byok === true) return true;
+  return upstreamInferenceCost(usage2) !== null;
+}
+var OPENROUTER_COST_REPORT = {
+  // Which host actually served a request is opt-in per request; without this
+  // header the response names no serving provider at all.
+  requestHeaders: { "x-openrouter-metadata": "enabled" },
+  read(root, report) {
+    let said = false;
+    const usage2 = asRecord(root.usage);
+    if (report.costUsd === null) {
+      const cost = usage2 ? finiteNumber(usage2.cost) : null;
+      if (cost !== null && cost >= 0) {
+        report.costUsd = cost + (upstreamInferenceCost(usage2) ?? 0);
+        said = true;
+      }
+    }
+    if (report.servedProvider === null) {
+      const served = servedProviderOf(root);
+      if (served !== null) {
+        report.servedProvider = served;
+        said = true;
+      }
+    }
+    if (report.servedModel === null) {
+      const model = nonEmptyString(root.model);
+      if (model !== null) {
+        report.servedModel = model;
+        said = true;
+      }
+    }
+    if (report.credentialSource === null && reportedByok(root, usage2)) {
+      report.credentialSource = "byok";
+      said = true;
+    }
+    return said;
+  }
+};
+
+// ../src/shared/provider-auth.ts
+var PROVIDER_AUTH = {
+  openai: { header: "authorization", scheme: "Bearer " },
+  anthropic: { header: "x-api-key" },
+  xai: { header: "authorization", scheme: "Bearer " },
+  gemini: { header: "x-goog-api-key" },
+  perplexity: { header: "authorization", scheme: "Bearer " },
+  deepseek: { header: "authorization", scheme: "Bearer " },
+  groq: { header: "authorization", scheme: "Bearer " },
+  mistral: { header: "authorization", scheme: "Bearer " },
+  together: { header: "authorization", scheme: "Bearer " },
+  fireworks: { header: "authorization", scheme: "Bearer " },
+  cerebras: { header: "authorization", scheme: "Bearer " },
+  moonshot: { header: "authorization", scheme: "Bearer " },
+  huggingface: { header: "authorization", scheme: "Bearer " },
+  baseten: { header: "authorization", scheme: "Bearer " },
+  bytedance: { header: "authorization", scheme: "Bearer " },
+  openrouter: { header: "authorization", scheme: "Bearer " }
+};
+var PROVIDER_CREDENTIAL_HEADERS = [
+  ...new Set(Object.values(PROVIDER_AUTH).map((auth) => auth.header.toLowerCase()))
+];
+
 // ../src/shared/capabilities.ts
 var PROVIDER_TYPES = [
   "openai",
@@ -14604,8 +14697,143 @@ var VERCEL_ROUTES = {
   moonshot: vercelRoute("moonshotai/")
 };
 
-// ../src/core/providers.ts
+// ../src/shared/app-config.ts
+var ISSUER_PROVIDERS = ["firebase", "supabase", "auth0", "clerk", "custom"];
+var ENTITLEMENT_CHECKS = ["revenuecat", "custom"];
+var ENDPOINT_SLUG = /^[a-z0-9-]{1,64}$/;
 var PROVIDER_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+var HTTP_FIELD_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var RESERVED_END_USER_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  ...PROVIDER_CREDENTIAL_HEADERS,
+  "x-app-version",
+  "content-type",
+  "content-length",
+  "host"
+]);
+
+// ../src/core/providers.ts
+var PROVIDER_REGISTRY = {
+  openai: {
+    directBaseUrl: "https://api.openai.com/",
+    auth: PROVIDER_AUTH.openai,
+    modelAuthor: "OpenAI"
+  },
+  anthropic: {
+    directBaseUrl: "https://api.anthropic.com/",
+    auth: PROVIDER_AUTH.anthropic,
+    modelAuthor: "Anthropic",
+    // Anthropic refuses any request without a version header, probe included —
+    // and a probe has no client to send one for it. Deliberately not a
+    // `requestHeaders` entry: on live traffic this is the *client's* API version,
+    // set by every Anthropic SDK, and pinning it server-side would strip that
+    // choice and silently downgrade every request to the oldest version.
+    probeHeaders: { "anthropic-version": "2023-06-01" }
+  },
+  xai: {
+    directBaseUrl: "https://api.x.ai/",
+    auth: PROVIDER_AUTH.xai,
+    modelAuthor: "xAI"
+  },
+  gemini: {
+    directBaseUrl: "https://generativelanguage.googleapis.com/",
+    auth: PROVIDER_AUTH.gemini,
+    modelAuthor: "Google"
+  },
+  perplexity: {
+    directBaseUrl: "https://api.perplexity.ai/",
+    auth: PROVIDER_AUTH.perplexity,
+    modelAuthor: "Perplexity"
+  },
+  // OpenAI-compatible chat-completions services. `modelAuthor` is set only
+  // where one answer is right for every model the type serves; the hosts below
+  // that carry no author serve other labs' open-weight models, and authorship
+  // comes from the catalog entry per model instead.
+  deepseek: {
+    // No `v1` segment: DeepSeek documents the bare origin as its OpenAI base
+    // URL, and `https://api.deepseek.com/anthropic` for the Anthropic format.
+    directBaseUrl: "https://api.deepseek.com/",
+    auth: PROVIDER_AUTH.deepseek,
+    modelAuthor: "DeepSeek"
+  },
+  groq: {
+    // Groq's OpenAI-compatible surface lives under `openai/v1/`, so the client
+    // path is `openai/v1/chat/completions` rather than `v1/chat/completions`.
+    directBaseUrl: "https://api.groq.com/",
+    auth: PROVIDER_AUTH.groq
+  },
+  mistral: {
+    directBaseUrl: "https://api.mistral.ai/",
+    auth: PROVIDER_AUTH.mistral,
+    modelAuthor: "Mistral"
+  },
+  together: {
+    // `api.together.ai`, not the `.xyz` host older SDKs default to: the current
+    // OpenAI-compatibility guide names this one and warns against the other.
+    directBaseUrl: "https://api.together.ai/",
+    auth: PROVIDER_AUTH.together
+  },
+  fireworks: {
+    // The inference plane is `/inference/v1`; `/v1` on the same host is the
+    // control plane, so the client path is `inference/v1/chat/completions`.
+    directBaseUrl: "https://api.fireworks.ai/",
+    auth: PROVIDER_AUTH.fireworks
+  },
+  cerebras: {
+    directBaseUrl: "https://api.cerebras.ai/",
+    auth: PROVIDER_AUTH.cerebras
+  },
+  moonshot: {
+    // The international host. `api.moonshot.cn` is the separate China platform
+    // and is not reachable with a key issued for this one.
+    directBaseUrl: "https://api.moonshot.ai/",
+    auth: PROVIDER_AUTH.moonshot,
+    modelAuthor: "Moonshot AI"
+  },
+  huggingface: {
+    // The Inference Providers router: one OpenAI-compatible surface in front of
+    // many upstreams, so it has no author of its own and no stable per-model
+    // price — the router picks the upstream, and the same model ID costs an
+    // order of magnitude more on some of them than others. It ships with no
+    // catalog section for that reason; see `catalogPrice` in usage.ts.
+    directBaseUrl: "https://router.huggingface.co/",
+    auth: PROVIDER_AUTH.huggingface
+  },
+  baseten: {
+    // The Model APIs inference host. `api.baseten.co` is the management plane
+    // for dedicated deployments and answers to different paths entirely.
+    directBaseUrl: "https://inference.baseten.co/",
+    auth: PROVIDER_AUTH.baseten
+  },
+  bytedance: {
+    // BytePlus ModelArk, the international edition: `/api/v3` is its version
+    // segment, so client paths carry no `v1`. `ark.cn-beijing.volces.com` is
+    // the separate China platform, and `ark.eu-west.bytepluses.com` is a second
+    // region — keys and catalogs are region-isolated, so reaching either needs
+    // the per-row base URL override that Stage 6 introduces.
+    directBaseUrl: "https://ark.ap-southeast.bytepluses.com/api/v3/",
+    auth: PROVIDER_AUTH.bytedance
+  },
+  openrouter: {
+    // An aggregator treated as a provider type: it is the counterparty that
+    // bills the organization, and its slugs (`google/gemini-3.6-flash`) are the
+    // canonical model IDs here — there is no underlying ID to translate to.
+    // `/api/v1` is its documented server URL, so the client path is
+    // `v1/chat/completions` under this origin.
+    directBaseUrl: "https://openrouter.ai/api/",
+    auth: PROVIDER_AUTH.openrouter,
+    // Every chat-completions response carries `usage.cost`: what OpenRouter
+    // actually charged for that request, which beats any local estimate of a
+    // catalog this deployment does not track. It is also the only way to bill
+    // the type at all, since no static price list covers 400 models across
+    // every lab. The declaration owns the parsing and the header that asks for
+    // the routing metadata — see `src/core/cost-report.ts`.
+    costReport: OPENROUTER_COST_REPORT,
+    // No `modelAuthor`: an aggregator serves everyone's models, and the slug
+    // namespace answers per model instead.
+    authorNamespacedModels: true
+  }
+};
 
 // ../src/core/origin-guard.ts
 var MAX_BASE_URL_LENGTH = 200;
@@ -14714,10 +14942,6 @@ function checkOperatorBaseUrl(input) {
   return { ok: true, baseUrl };
 }
 
-// ../src/core/types.ts
-var ISSUER_PROVIDERS = ["firebase", "supabase", "auth0", "clerk", "custom"];
-var ENTITLEMENT_CHECKS = ["revenuecat", "custom"];
-
 // ../src/contracts/schemas.ts
 var ProviderTypeSchema = external_exports.enum(PROVIDER_TYPES);
 var NullableRequestLimit = external_exports.number().int().positive().nullable();
@@ -14751,7 +14975,7 @@ var IssuerAuthenticationSchema = external_exports.object({
   provider: external_exports.enum(ISSUER_PROVIDERS).optional(),
   entitlement: external_exports.enum(ENTITLEMENT_CHECKS).optional()
 }).strict();
-var EndUserHeaderSchema = external_exports.string().trim().min(1).max(64).regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, { error: "header must be a valid HTTP header name" });
+var EndUserHeaderSchema = external_exports.string().trim().min(1).max(64).regex(HTTP_FIELD_NAME, { error: "header must be a valid HTTP header name" });
 var HeaderEndUserSchema = external_exports.object({
   source: external_exports.literal("header"),
   header: EndUserHeaderSchema
@@ -14849,7 +15073,7 @@ var AppConfigSchema = external_exports.object({
     per_user: LimitScopeSchema,
     per_app: LimitScopeSchema
   }).optional(),
-  endpoints: external_exports.record(external_exports.string().regex(/^[a-z0-9-]{1,64}$/), EndpointSchema).optional()
+  endpoints: external_exports.record(external_exports.string().regex(ENDPOINT_SLUG), EndpointSchema).optional()
 }).meta({ id: "AppConfig" });
 var AppWriteSchema = external_exports.object({
   name: external_exports.string().min(1).max(100),
@@ -14972,13 +15196,16 @@ var ProviderGatewayTestRequestSchema = external_exports.discriminatedUnion("type
   error: "Provider gateway type must be one of cf_aig, vercel"
 }).meta({ id: "ProviderGatewayTestRequest" });
 var ProviderGatewayUpdateRequestSchema = external_exports.object({
-  name: ProviderNameSchema
+  name: ProviderNameSchema,
+  revision: external_exports.number().int().positive().meta({ description: "The gateway revision returned by the read this edit is based on." })
 }).strict().meta({ id: "ProviderGatewayUpdateRequest" });
 var ProviderGatewayRotateRequestSchema = external_exports.object({
-  token: ProviderSecretSchema
+  token: ProviderSecretSchema,
+  revision: external_exports.number().int().positive().meta({ description: "The gateway revision returned by the read this rotation is based on." })
 }).strict().meta({ id: "ProviderGatewayRotateRequest" });
 var BASE_URL_REQUIRES_SECRET = "Changing the base URL requires re-supplying the provider key, because the stored key is never sent to a new origin";
 var ProviderUpdateRequestSchema = external_exports.object({
+  revision: external_exports.number().int().positive().meta({ description: "The provider revision returned by the read this update is based on." }),
   name: ProviderNameSchema.optional(),
   secret: ProviderSecretSchema.optional(),
   /** A full replace; `null` clears the row's routing configuration. */
@@ -15222,6 +15449,7 @@ var ProviderSummarySchema = external_exports.object({
     example: "https://my-resource.openai.azure.com/openai/v1/"
   }),
   pricing: ProviderPricingSchema.nullable(),
+  revision: external_exports.number().int().positive(),
   status: external_exports.enum(["active", "disabled"]).meta({
     description: "disabled is a reversible pause: the row keeps its secret, its pricing and its slug, and requests to it fail with provider_disabled until it is enabled again."
   }),
@@ -15262,6 +15490,7 @@ var providerGatewayFields = {
   referencedCount: external_exports.number().int().nonnegative().meta({
     description: "All provider instances referencing this gateway, including disabled rows retained for re-enabling. Deletion is refused while this is above zero."
   }),
+  revision: external_exports.number().int().positive(),
   status: external_exports.enum(["active", "revoked"]),
   createdAt: external_exports.string(),
   updatedAt: external_exports.string(),
@@ -16477,9 +16706,9 @@ async function resourceCommand(ctx, command, args, flags) {
       if (!existingGateway) fail("invalid_arguments", "Supply the gateway to rotate.");
       const value2 = await secret(flags, "Gateway token");
       if (flags.browser)
-        return ctx.operation("provider-gateway.rotate-key", { id: existingGateway.id });
+        return ctx.operation("provider-gateway.rotate-key", { id: existingGateway.id, revision: existingGateway.revision });
       return (await ctx.call("rotateProviderGateway", [existingGateway.id], {
-        body: { token: value2 }
+        body: { token: value2, revision: existingGateway.revision }
       })).data;
     }
     if (!existingProvider) fail("invalid_arguments", "Supply the provider to rotate.");
@@ -16490,16 +16719,17 @@ async function resourceCommand(ctx, command, args, flags) {
       );
     const value = await secret(flags, "Provider API key");
     if (flags.browser)
-      return ctx.operation("provider.rotate-key", { id: existingProvider.id });
+      return ctx.operation("provider.rotate-key", { id: existingProvider.id, revision: existingProvider.revision });
     return (await ctx.call("updateProvider", [existingProvider.id], {
-      body: { secret: value }
+      body: { secret: value, revision: existingProvider.revision }
     })).data;
   }
   if (action === "update") {
     if (gateway) {
       if (!existingGateway) fail("invalid_arguments", "Supply the gateway to update.");
       const body2 = validate(ProviderGatewayUpdateRequestSchema, {
-        name: await required2(flags, "name")
+        name: await required2(flags, "name"),
+        revision: existingGateway.revision
       });
       return (await ctx.call("updateProviderGateway", [existingGateway.id], { body: body2 })).data;
     }
@@ -16532,6 +16762,7 @@ async function resourceCommand(ctx, command, args, flags) {
     if (flags["base-url"] || flags["clear-base-url"]) {
       validate(ProviderUpdateRequestSchema, {
         ...draft,
+        revision: existingProvider.revision,
         secret: "validation-placeholder"
       });
       const value = await secret(flags, "Provider API key");
@@ -16539,10 +16770,11 @@ async function resourceCommand(ctx, command, args, flags) {
     }
     const body = validate(ProviderUpdateRequestSchema, {
       ...draft,
+      revision: existingProvider.revision,
       ...flags.browser ? { secret: "validation-placeholder" } : {}
     });
     if (flags.browser)
-      return ctx.operation("provider.update", { id: existingProvider.id, ...draft });
+      return ctx.operation("provider.update", { id: existingProvider.id, revision: existingProvider.revision, ...draft });
     return (await ctx.call("updateProvider", [existingProvider.id], { body })).data;
   }
   fail("unknown_command", "Unknown command.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.1.13",
+  "version": "0.2.1",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,8 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.2.0",
+    "0.1.13",
     "0.1.12",
     "0.1.11",
     "0.1.10",