@revealui/ai 0.6.3 → 0.7.0

package/dist/llm/resolve.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Per-request LLM client resolver (GAP-360 PR-2).
+ *
+ * The single home for key resolution at every dispatch site (spec §5.2 / §5.4).
+ * One resolver, consumed by all sites — no site-local copies.
+ *
+ * Resolution order (spec §5.2):
+ *   1. Per-user BYOK        — createLLMClientForUser (preferred)
+ *   2. Site inference config — workspace_inference_configs (hostedViable on hosted)
+ *   3. Deployment env        — createLLMClientFromEnv (SELF-HOSTED ONLY)
+ *   4. Hosted + nothing above → throw LLMNotConfiguredError (typed → HTTP 409)
+ *
+ * Security invariants (spec §6, guardrail-2):
+ *   - §6.1 userId is authenticated-identity-scoped; the caller derives it from
+ *     session/entitlement context — or, for the durable worker, the
+ *     authenticated dispatcher captured server-side at enqueue time — never
+ *     from request params/body, and never from a client-writable DB column
+ *     (e.g. a ticket's `reporterId`, which has no ownership check on the
+ *     general tickets API). The resolver takes userId as an argument and
+ *     never reads it from a request. The same rule binds the step-2 site
+ *     inference key: the workspaceId is client-writable, so its stored key is
+ *     decrypted only after userCanAccessSite confirms the caller owns or
+ *     collaborates on that site. Otherwise a request could name another
+ *     tenant's site id and run on that site's key.
+ *   - §6.2 plaintext lifetime = request scope. The client is constructed per
+ *     request; no key cache. Nothing here logs, serializes, or returns a key.
+ *   - §6.3 decryption is server-side only via the existing decryptApiKey.
+ *   - §6.4 the byok:key:accessed audit event fires inside createLLMClientForUser
+ *     when an audit store is wired (ctx.auditStore).
+ *   - §6.5 fail-closed: unknown provider / failed decrypt / a non-hostedViable
+ *     provider on hosted resolves to LLMNotConfiguredError, never an env
+ *     fallthrough on hosted (the exact silent-localhost defect class).
+ *   - §6.6 no new secret surface.
+ *
+ * Feature flag (spec §7): HOSTED_BYOK_DISPATCH. Default ON for hosted, absent
+ * (off) for self-hosted so self-hosted env-first behavior is byte-unchanged.
+ * The flag is the one-release rollback lever.
+ */
+import type { Database } from '@revealui/db/client';
+import type { AuditStore } from '../audit/store.js';
+import { LLMClient } from './client.js';
+/**
+ * Thrown when a hosted deployment has no usable LLM configuration for the
+ * request. Maps to HTTP 409 (configuration is the remedy, not payment).
+ * Callers name {@link settingsPath} in the machine-readable response body.
+ */
+export declare class LLMNotConfiguredError extends Error {
+    /** Stable machine-readable code for API response bodies. */
+    readonly code: "LLM_NOT_CONFIGURED";
+    /** Where the account owner configures a key. */
+    readonly settingsPath: "/settings/api-keys";
+    constructor(message?: string);
+}
+/** The 409 response body every dispatch site returns for an unconfigured account. */
+export interface LLMNotConfiguredBody {
+    success: false;
+    error: string;
+    code: 'LLM_NOT_CONFIGURED';
+    settingsPath: '/settings/api-keys';
+}
+/** Build the machine-readable 409 body for {@link LLMNotConfiguredError}. */
+export declare function llmNotConfiguredBody(err: LLMNotConfiguredError): LLMNotConfiguredBody;
+export interface ResolveLLMContext {
+    /**
+     * True on the hosted revealui.com SaaS deployment. Derived by the caller from
+     * the existing deployment-mode signal (server: detectDeploymentMode; admin:
+     * REVEALUI_LICENSE_PRIVATE_KEY presence) — never sniffed here.
+     */
+    isHosted: boolean;
+    /** Site id for step-2 site-level config lookup. Omit when the site has none. */
+    workspaceId?: string;
+    /**
+     * Durable audit sink for the byok:key:accessed event (§6.4). Only `append` is
+     * used, so a persistent store (DrizzleAuditStore) fits. Omit where none is
+     * wired (e.g. the admin process, in-memory until GAP-338 closes).
+     */
+    auditStore?: Pick<AuditStore, 'append'>;
+}
+/**
+ * Whether the BYOK dispatch order (spec §5.2) is active. Default follows the
+ * deployment: ON when hosted, OFF when self-hosted. HOSTED_BYOK_DISPATCH
+ * overrides explicitly; an unrecognized value falls back to the default.
+ */
+export declare function hostedByokDispatchEnabled(isHosted: boolean): boolean;
+/**
+ * Resolve the LLM client for a single request.
+ *
+ * @param userId - Authenticated user id, from session/entitlement context for
+ *   request-scoped callers, or the authenticated dispatcher captured
+ *   server-side at enqueue time for the durable worker. Never a request
+ *   param/body value, and never a client-writable DB column. Null when there
+ *   is no authenticated user.
+ * @param db - Drizzle client.
+ * @param ctx - Deployment mode, optional site id, optional audit sink.
+ */
+export declare function resolveLLMClientForRequest(userId: string | null, db: Database, ctx: ResolveLLMContext): Promise<LLMClient>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/llm/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/llm/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAIL,SAAS,EAEV,MAAM,aAAa,CAAC;AAMrB;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAG,oBAAoB,CAAU;gBAE1C,OAAO,SAAoD;CAIxE;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,oBAAoB,CAAC;IAC3B,YAAY,EAAE,oBAAoB,CAAC;CACpC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,oBAAoB,CAOrF;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;CACzC;AAKD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,SAAS,CAAC,CAsDpB"}

package/dist/llm/resolve.js

@@ -0,0 +1,218 @@
+/**
+ * Per-request LLM client resolver (GAP-360 PR-2).
+ *
+ * The single home for key resolution at every dispatch site (spec §5.2 / §5.4).
+ * One resolver, consumed by all sites — no site-local copies.
+ *
+ * Resolution order (spec §5.2):
+ *   1. Per-user BYOK        — createLLMClientForUser (preferred)
+ *   2. Site inference config — workspace_inference_configs (hostedViable on hosted)
+ *   3. Deployment env        — createLLMClientFromEnv (SELF-HOSTED ONLY)
+ *   4. Hosted + nothing above → throw LLMNotConfiguredError (typed → HTTP 409)
+ *
+ * Security invariants (spec §6, guardrail-2):
+ *   - §6.1 userId is authenticated-identity-scoped; the caller derives it from
+ *     session/entitlement context — or, for the durable worker, the
+ *     authenticated dispatcher captured server-side at enqueue time — never
+ *     from request params/body, and never from a client-writable DB column
+ *     (e.g. a ticket's `reporterId`, which has no ownership check on the
+ *     general tickets API). The resolver takes userId as an argument and
+ *     never reads it from a request. The same rule binds the step-2 site
+ *     inference key: the workspaceId is client-writable, so its stored key is
+ *     decrypted only after userCanAccessSite confirms the caller owns or
+ *     collaborates on that site. Otherwise a request could name another
+ *     tenant's site id and run on that site's key.
+ *   - §6.2 plaintext lifetime = request scope. The client is constructed per
+ *     request; no key cache. Nothing here logs, serializes, or returns a key.
+ *   - §6.3 decryption is server-side only via the existing decryptApiKey.
+ *   - §6.4 the byok:key:accessed audit event fires inside createLLMClientForUser
+ *     when an audit store is wired (ctx.auditStore).
+ *   - §6.5 fail-closed: unknown provider / failed decrypt / a non-hostedViable
+ *     provider on hosted resolves to LLMNotConfiguredError, never an env
+ *     fallthrough on hosted (the exact silent-localhost defect class).
+ *   - §6.6 no new secret surface.
+ *
+ * Feature flag (spec §7): HOSTED_BYOK_DISPATCH. Default ON for hosted, absent
+ * (off) for self-hosted so self-hosted env-first behavior is byte-unchanged.
+ * The flag is the one-release rollback lever.
+ */
+import { createLogger } from '@revealui/core/observability/logger';
+import { decryptApiKey } from '@revealui/db/crypto';
+import { siteCollaborators, sites, workspaceInferenceConfigs } from '@revealui/db/schema';
+import { and, eq } from 'drizzle-orm';
+import { createLLMClientForUser, createLLMClientFromEnv, isHostedViable, LLMClient, } from './client.js';
+const resolverLogger = createLogger({ component: 'resolveLLMClientForRequest' });
+/** Emitted once per process when the hosted BYOK rollback lever is pulled. */
+let warnedBreakGlass = false;
+/**
+ * Thrown when a hosted deployment has no usable LLM configuration for the
+ * request. Maps to HTTP 409 (configuration is the remedy, not payment).
+ * Callers name {@link settingsPath} in the machine-readable response body.
+ */
+export class LLMNotConfiguredError extends Error {
+    /** Stable machine-readable code for API response bodies. */
+    code = 'LLM_NOT_CONFIGURED';
+    /** Where the account owner configures a key. */
+    settingsPath = '/settings/api-keys';
+    constructor(message = 'No LLM provider is configured for this account.') {
+        super(message);
+        this.name = 'LLMNotConfiguredError';
+    }
+}
+/** Build the machine-readable 409 body for {@link LLMNotConfiguredError}. */
+export function llmNotConfiguredBody(err) {
+    return {
+        success: false,
+        error: err.message,
+        code: err.code,
+        settingsPath: err.settingsPath,
+    };
+}
+const FLAG_ON = new Set(['true', '1', 'on', 'yes']);
+const FLAG_OFF = new Set(['false', '0', 'off', 'no']);
+/**
+ * Whether the BYOK dispatch order (spec §5.2) is active. Default follows the
+ * deployment: ON when hosted, OFF when self-hosted. HOSTED_BYOK_DISPATCH
+ * overrides explicitly; an unrecognized value falls back to the default.
+ */
+export function hostedByokDispatchEnabled(isHosted) {
+    const raw = process.env.HOSTED_BYOK_DISPATCH;
+    if (raw === undefined || raw.trim() === '')
+        return isHosted;
+    const value = raw.trim().toLowerCase();
+    if (FLAG_OFF.has(value))
+        return false;
+    if (FLAG_ON.has(value))
+        return true;
+    return isHosted;
+}
+/**
+ * Resolve the LLM client for a single request.
+ *
+ * @param userId - Authenticated user id, from session/entitlement context for
+ *   request-scoped callers, or the authenticated dispatcher captured
+ *   server-side at enqueue time for the durable worker. Never a request
+ *   param/body value, and never a client-writable DB column. Null when there
+ *   is no authenticated user.
+ * @param db - Drizzle client.
+ * @param ctx - Deployment mode, optional site id, optional audit sink.
+ */
+export async function resolveLLMClientForRequest(userId, db, ctx) {
+    const hosted = ctx.isHosted;
+    // Feature-flag gate. When disabled (self-hosted default), behavior is
+    // byte-unchanged: env-first, exactly as before this PR.
+    if (!hostedByokDispatchEnabled(hosted)) {
+        if (hosted && !warnedBreakGlass) {
+            warnedBreakGlass = true;
+            // Break-glass: HOSTED_BYOK_DISPATCH is explicitly off on a hosted
+            // deployment. Every account now shares the deployment env client while
+            // this lever is pulled — a deliberate one-release rollback, but an
+            // operator must know it is active.
+            resolverLogger.warn('HOSTED_BYOK_DISPATCH is disabled on a hosted deployment — all accounts are ' +
+                'sharing the deployment env LLM client instead of per-account BYOK keys.');
+        }
+        return createLLMClientFromEnv();
+    }
+    // 1. Per-user BYOK (preferred). On hosted, filter to hostedViable providers
+    //    so a localhost-only BYOK key (e.g. ollama) can never yield a localhost
+    //    client — that is the silent-localhost defect (§6.5, fail-closed).
+    if (userId) {
+        try {
+            const byok = await createLLMClientForUser(userId, db, ctx.auditStore, {
+                hostedViableOnly: hosted,
+            });
+            if (byok)
+                return byok;
+        }
+        catch {
+            // Failed decrypt / unknown-provider row / CHECK-violating row. Fail-closed
+            // on hosted — never fall through to env. Self-hosted may continue.
+            if (hosted) {
+                throw new LLMNotConfiguredError('Your stored API key could not be used. Re-add it under /settings/api-keys.');
+            }
+        }
+    }
+    // 2. Site-level inference config. userId is passed so the site's stored key
+    //    is decrypted only for a caller authorized on that site (§6.1) — the
+    //    workspaceId reaching here is a client-writable value (e.g. a request
+    //    body field), so it carries no ownership guarantee on its own.
+    const siteClient = await resolveSiteInferenceClient(db, userId, ctx.workspaceId, hosted);
+    if (siteClient)
+        return siteClient;
+    // 3. Deployment env — SELF-HOSTED ONLY. Forbidden on hosted (§5.2 step 3).
+    if (!hosted) {
+        return createLLMClientFromEnv();
+    }
+    // 4. Hosted + nothing above → fail loud, actionable.
+    throw new LLMNotConfiguredError();
+}
+/**
+ * Whether `userId` is authorized to act on `siteId` — the site's owner, or a
+ * row in `site_collaborators`. Gate for the site inference key (§6.1): the
+ * site's stored provider key must never be decrypted for a caller who does not
+ * belong to the site, even though the workspaceId is client-supplied.
+ */
+async function userCanAccessSite(db, userId, siteId) {
+    const [owned] = await db
+        .select({ id: sites.id })
+        .from(sites)
+        .where(and(eq(sites.id, siteId), eq(sites.ownerId, userId)))
+        .limit(1);
+    if (owned)
+        return true;
+    const [collaborator] = await db
+        .select({ id: siteCollaborators.id })
+        .from(siteCollaborators)
+        .where(and(eq(siteCollaborators.siteId, siteId), eq(siteCollaborators.userId, userId)))
+        .limit(1);
+    return Boolean(collaborator);
+}
+/**
+ * Build a client from the site's workspace_inference_configs row (spec §5.2
+ * step 2). Returns null when the site has no config, when the caller is not
+ * authorized on the site, or (on hosted) when its provider is not hostedViable.
+ * Fail-closed: a malformed row throws on hosted and is skipped on self-hosted.
+ */
+async function resolveSiteInferenceClient(db, userId, workspaceId, hosted) {
+    if (!workspaceId)
+        return null;
+    // §6.1 authorization: only decrypt a site's key for a caller who belongs to
+    // that site. An unauthorized (or anonymous) request skips the site config
+    // entirely; on hosted it then falls through to the step-4 409, never a
+    // decrypt of another tenant's key.
+    if (!(userId && (await userCanAccessSite(db, userId, workspaceId))))
+        return null;
+    const [config] = await db
+        .select()
+        .from(workspaceInferenceConfigs)
+        .where(eq(workspaceInferenceConfigs.workspaceId, workspaceId))
+        .limit(1);
+    if (!config)
+        return null;
+    const provider = config.provider;
+    // On hosted, only hostedViable providers are reachable. A non-viable site
+    // config is skipped so resolution fails closed rather than hitting localhost.
+    if (hosted && !isHostedViable(provider))
+        return null;
+    try {
+        // Keyless providers (ollama / inference-snaps) carry a NULL encrypted key
+        // and use the provider name as the placeholder key — matches the env
+        // factory. Keyed providers decrypt server-side at dispatch time (§6.3).
+        const apiKey = config.encryptedApiKey ? decryptApiKey(config.encryptedApiKey) : provider;
+        return new LLMClient({
+            provider,
+            apiKey,
+            model: config.model ?? undefined,
+            baseURL: config.baseURL ?? undefined,
+            temperature: config.temperature ?? undefined,
+            maxTokens: config.maxTokens ?? undefined,
+        });
+    }
+    catch {
+        // Unknown provider / failed decrypt. Fail-closed on hosted; skip on self-hosted.
+        if (hosted) {
+            throw new LLMNotConfiguredError('This site’s inference configuration could not be used. Update it under /settings/api-keys.');
+        }
+        return null;
+    }
+}

package/dist/llm/server.d.ts

@@ -10,5 +10,6 @@ export * from './providers/groq.js';
 export * from './providers/inference-snaps.js';
 export * from './providers/ollama.js';
 export * from './providers/openai-compat.js';
+export * from './resolve.js';
 export * from './workspace-provider-config.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/llm/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/llm/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAC;AAG5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAI7C,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/llm/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAC;AAE5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAE7C,cAAc,cAAc,CAAC;AAI7B,cAAc,gCAAgC,CAAC"}

package/dist/llm/server.js

@@ -12,6 +12,8 @@ export * from './providers/groq.js';
 export * from './providers/inference-snaps.js';
 export * from './providers/ollama.js';
 export * from './providers/openai-compat.js';
+// Export the per-request client resolver (GAP-360 PR-2)
+export * from './resolve.js';
 // Export per-workspace provider registry (used by admin inference-config route
 // to hydrate per-site config at boot + apply changes immediately on PUT)
 export * from './workspace-provider-config.js';

package/dist/llm/token-counter.d.ts

@@ -19,6 +19,24 @@ export interface CostEstimate {
     model: string;
     direction: 'input' | 'output';
 }
+/**
+ * Per-1M-token pricing (USD). Single source of truth for every cost path in the package:
+ * `estimateCost` (input/output) and `calculateCacheCost` (cache-utils, cacheWrite/cacheRead).
+ * Cache rates follow Anthropic's model (write ~125% of input, read ~10%); non-caching
+ * providers carry 0 (local models are free; cache cost is not modelled for hosted
+ * non-Anthropic providers here).
+ */
+export interface ModelPricing {
+    /** USD per 1M input tokens. */
+    input: number;
+    /** USD per 1M output tokens. */
+    output: number;
+    /** USD per 1M tokens written to the prompt cache (0 where unsupported/unmodelled). */
+    cacheWrite: number;
+    /** USD per 1M tokens read from the prompt cache (0 where unsupported/unmodelled). */
+    cacheRead: number;
+}
+export declare const MODEL_PRICING: Record<string, ModelPricing>;
 /**
  * Estimate token count for a string.
  */

package/dist/llm/token-counter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-counter.d.ts","sourceRoot":"","sources":["../../src/llm/token-counter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC/B;AAiCD;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAGxF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAQjG;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,OAAO,GAAG,QAAQ,GAC5B,YAAY,CASd;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAI9C"}
+{"version":3,"file":"token-counter.d.ts","sourceRoot":"","sources":["../../src/llm/token-counter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAmBtD,CAAC;AAeF;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAGxF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAQjG;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,OAAO,GAAG,QAAQ,GAC5B,YAAY,CASd;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAI9C"}

package/dist/llm/token-counter.js

@@ -8,22 +8,25 @@
  * Limitation: actual token counts differ by model tokenizer. This is
  * accurate enough for budget tracking and context window management.
  */
-// Cost per 1M tokens (USD)  -  input/output pricing
-const MODEL_PRICING = {
-    // Anthropic
-    'claude-opus-4-6': { input: 15.0, output: 75.0 },
-    'claude-sonnet-4-6': { input: 3.0, output: 15.0 },
-    'claude-haiku-4-5-20251001': { input: 0.25, output: 1.25 },
+export const MODEL_PRICING = {
+    // Anthropic (current)
+    'claude-opus-4-6': { input: 15.0, output: 75.0, cacheWrite: 18.75, cacheRead: 1.5 },
+    'claude-sonnet-4-6': { input: 3.0, output: 15.0, cacheWrite: 3.75, cacheRead: 0.3 },
+    'claude-haiku-4-5-20251001': { input: 0.25, output: 1.25, cacheWrite: 0.3125, cacheRead: 0.025 },
+    // Anthropic (legacy 2024  -  retained for cache-cost callers/examples)
+    'claude-3-5-sonnet-20241022': { input: 3.0, output: 15.0, cacheWrite: 3.75, cacheRead: 0.3 },
+    'claude-3-5-haiku-20241022': { input: 1.0, output: 5.0, cacheWrite: 1.25, cacheRead: 0.1 },
+    'claude-3-opus-20240229': { input: 15.0, output: 75.0, cacheWrite: 18.75, cacheRead: 1.5 },
     // OpenAI
-    'gpt-4o': { input: 5.0, output: 15.0 },
-    'gpt-4o-mini': { input: 0.15, output: 0.6 },
+    'gpt-4o': { input: 5.0, output: 15.0, cacheWrite: 0, cacheRead: 0 },
+    'gpt-4o-mini': { input: 0.15, output: 0.6, cacheWrite: 0, cacheRead: 0 },
     // Groq (Qwen  -  Apache 2.0)
-    'qwen/qwen3-32b': { input: 0.59, output: 0.79 },
+    'qwen/qwen3-32b': { input: 0.59, output: 0.79, cacheWrite: 0, cacheRead: 0 },
     // Ollama (self-hosted  -  no cost)
-    'gemma4:e2b': { input: 0, output: 0 },
-    'gemma4:e4b': { input: 0, output: 0 },
-    'gemma4:26b': { input: 0, output: 0 },
-    'nomic-embed-text': { input: 0, output: 0 },
+    'gemma4:e2b': { input: 0, output: 0, cacheWrite: 0, cacheRead: 0 },
+    'gemma4:e4b': { input: 0, output: 0, cacheWrite: 0, cacheRead: 0 },
+    'gemma4:26b': { input: 0, output: 0, cacheWrite: 0, cacheRead: 0 },
+    'nomic-embed-text': { input: 0, output: 0, cacheWrite: 0, cacheRead: 0 },
 };
 function charsPerToken(model) {
     const lower = model.toLowerCase();

package/dist/orchestration/runtime.d.ts

@@ -4,24 +4,18 @@
  * Executes agent tasks with tool execution, memory management, and error handling
  */
 import type { LLMClient } from '../llm/client.js';
+import type { ReasoningEffort } from '../llm/providers/base.js';
 import type { AgentSkillProvider } from '../skills/integration/agent-skill-provider.js';
 import type { ApprovalCallback } from '../tools/base.js';
 import type { MCPToolSource, McpClientLike } from '../tools/mcp-adapter.js';
 import type { Agent, AgentResult, Task } from './agent.js';
 /**
- * Controls how much of the model's token budget is allocated to internal reasoning.
- * Applies to Anthropic Claude only  -  ignored by other providers.
- *
- * | Level   | Budget (tokens) | Use case                          |
- * |---------|-----------------|-----------------------------------|
- * | off     | 0               | Disabled (default)                |
- * | minimal | 512             | Simple tasks, cost-sensitive      |
- * | low     | 2 048           | Moderate complexity               |
- * | medium  | 8 000           | Multi-step reasoning              |
- * | high    | 16 000          | Complex planning                  |
- * | xhigh   | 31 999          | Maximum depth (expensive)         |
+ * Reasoning-depth hint for a task. Alias of the neutral `ReasoningEffort` — the agnostic
+ * Reasoner port's control vocabulary. Mapping a level to a provider's native control
+ * (e.g. a thinking-token budget) is the adapter's job; a provider that advertises
+ * `reasoningEffort: false` treats it as a no-op.
  */
-export type ThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+export type ThinkingLevel = ReasoningEffort;
 export interface RuntimeConfig {
     maxIterations?: number;
     timeout?: number;

package/dist/orchestration/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/orchestration/runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AAE3E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAWpF,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IACpE;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,SAAS,CAAC;IAC/D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,qBAAa,YAAY;IACvB,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;IAChC,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,cAAc,CAAgD;IACtE,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,aAAkB;IA0BtC;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YAqBzE,OAAO;IAoPrB;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI7B;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAc9E;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B9B;;OAEG;IACH,SAAS,IAAI;QACX,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB;CAOF"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/orchestration/runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAW,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AAE3E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG5E,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IACpE;;;;OAIG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,SAAS,CAAC;IAC/D;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,qBAAa,YAAY;IACvB,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;IAChC,OAAO,CAAC,SAAS,CAAc;IAC/B,OAAO,CAAC,cAAc,CAAgD;IACtE,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,aAAkB;IA0BtC;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YAqBzE,OAAO;IA8OrB;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI7B;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAc9E;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B9B;;OAEG;IACH,SAAS,IAAI;QACX,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB;CAOF"}

package/dist/orchestration/runtime.js

@@ -9,14 +9,6 @@ import { estimateCost } from '../llm/token-counter.js';
 import { ToolCallDeduplicator } from '../tools/deduplicator.js';
 import { createToolsFromMcpClient, discoverMCPTools } from '../tools/mcp-adapter.js';
 import { createWebSearchTool } from '../tools/web/duck-duck-go.js';
-const THINKING_BUDGETS = {
-    off: 0,
-    minimal: 512,
-    low: 2048,
-    medium: 8000,
-    high: 16000,
-    xhigh: 31999,
-};
 export class AgentRuntime {
     config;
     taskQueue = [];
@@ -101,8 +93,8 @@ export class AgentRuntime {
             {
                 role: 'system',
                 content: agent.instructions,
-                // Cache agent instructions for cost savings (Anthropic only)
-                cacheControl: this.config.enableCache ? { type: 'ephemeral' } : undefined,
+                // Cache agent instructions for cost savings (effective where promptCache is supported)
+                cache: this.config.enableCache || undefined,
             },
             {
                 role: 'user',
@@ -130,10 +122,6 @@ export class AgentRuntime {
                         },
                     };
                 }
-                // Resolve thinking budget if a level is configured
-                const thinkingBudget = this.config.thinkingLevel && this.config.thinkingLevel !== 'off'
-                    ? THINKING_BUDGETS[this.config.thinkingLevel]
-                    : undefined;
                 // Get LLM response (with caching for agent instructions and tools)
                 const response = await llmClient.chat(messages, {
                     tools: allTools.map((tool) => ({
@@ -144,8 +132,8 @@ export class AgentRuntime {
                             parameters: z.toJSONSchema(tool.parameters),
                         },
                     })),
-                    enableCache: this.config.enableCache,
-                    thinkingBudget,
+                    cacheHint: this.config.enableCache,
+                    effort: this.config.thinkingLevel,
                 });
                 // Accumulate token usage and cost
                 const iterationTokens = response.usage?.totalTokens ?? 0;

package/dist/orchestration/streaming-runtime.js

@@ -36,7 +36,7 @@ export class StreamingAgentRuntime extends AgentRuntime {
             {
                 role: 'system',
                 content: agent.instructions,
-                cacheControl: { type: 'ephemeral' },
+                cache: true,
             },
             {
                 role: 'user',

package/dist/skills/types.d.ts

@@ -27,13 +27,13 @@ export declare const SkillMetadataSchema: z.ZodObject<{
     repository: z.ZodOptional<z.ZodString>;
     tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
     compatibility: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        anthropic: "anthropic";
+        openai: "openai";
         "claude-code": "claude-code";
         cursor: "cursor";
         windsurf: "windsurf";
         cline: "cline";
         copilot: "copilot";
-        openai: "openai";
-        anthropic: "anthropic";
         universal: "universal";
     }>>>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -78,13 +78,13 @@ export declare const SkillSchema: z.ZodObject<{
         repository: z.ZodOptional<z.ZodString>;
         tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
         compatibility: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            anthropic: "anthropic";
+            openai: "openai";
             "claude-code": "claude-code";
             cursor: "cursor";
             windsurf: "windsurf";
             cline: "cline";
             copilot: "copilot";
-            openai: "openai";
-            anthropic: "anthropic";
             universal: "universal";
         }>>>;
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -143,13 +143,13 @@ export declare const SkillActivationResultSchema: z.ZodObject<{
             repository: z.ZodOptional<z.ZodString>;
             tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
             compatibility: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                anthropic: "anthropic";
+                openai: "openai";
                 "claude-code": "claude-code";
                 cursor: "cursor";
                 windsurf: "windsurf";
                 cline: "cline";
                 copilot: "copilot";
-                openai: "openai";
-                anthropic: "anthropic";
                 universal: "universal";
             }>>>;
             allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/ai",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "AI runtime for agent-driven products — agents, memory, LLM providers (Inference Snaps, Ollama, OpenAI-compatible), tools, and orchestration. Anthropic-SDK-free.",
   "keywords": [
     "agent",
@@ -25,20 +25,20 @@
   "dependencies": {
     "lru-cache": "^11.5.1",
     "zod": "^4.4.3",
-    "@revealui/contracts": "0.6.1",
-    "@revealui/core": "0.10.2",
-    "@revealui/db": "0.7.2",
+    "@revealui/contracts": "0.7.0",
+    "@revealui/core": "0.11.1",
+    "@revealui/db": "0.8.0",
     "@revealui/resilience": "0.2.4"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.5.2",
+    "@electric-sql/pglite": "^0.5.4",
     "@testing-library/react": "^16.3.2",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.10",
     "jsdom": "29.1.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.10",
     "@revealui/dev": "0.1.0"
   },
   "engines": {