@runappsai/sdk 0.0.0-stage → 0.3.1

package/dist/transport.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Internal — shared HTTP transport used by every service. Not part of the
+ * public API; do not import from outside `src/`.
+ *
+ * Uses the global `fetch` (Node 18+ / browsers / Deno / Bun all ship it).
+ * Errors from the gateway (status >= 400) are parsed and surfaced as
+ * `APIError`. Network errors propagate as the underlying fetch reject.
+ */
+export interface TransportOptions {
+    baseURL: string;
+    /** Static bearer token. Required unless `apiKeyResolver` is supplied. */
+    apiKey?: string;
+    /** Dynamic resolver — called immediately before each request. Use this
+     *  when the token is short-lived and refreshed externally (e.g. running
+     *  inside a runjobs resource bundle that exposes
+     *  `window.runjobs.getToken()`). The result is awaited per request, so
+     *  the caller can return a Promise that hits a token endpoint. Wins
+     *  over `apiKey` when both are supplied. */
+    apiKeyResolver?: () => string | Promise<string>;
+    /**
+     * Hook invoked on 401 responses, *before* the request is automatically
+     * retried once.  Use this to invalidate any cached token so the next
+     * `apiKeyResolver` call fetches a fresh one.  Throwing here cancels
+     * the retry — the original 401 propagates.
+     *
+     * Typical wiring (browser-auth):
+     *   onUnauthorized: () => auth.invalidate()
+     * which clears the in-memory + persisted token without flipping the
+     * sticky "signed out" flag.  The retry's resolveToken() then triggers
+     * the standard signIn() redirect-grant flow.
+     */
+    onUnauthorized?: () => void | Promise<void>;
+    /** Optional fetch override (e.g. node-fetch with custom agent). */
+    fetchImpl?: typeof fetch;
+}
+export declare class Transport {
+    readonly baseURL: string;
+    private readonly apiKey;
+    private readonly apiKeyResolver;
+    private readonly onUnauthorized;
+    private readonly fetchImpl;
+    constructor(opts: TransportOptions);
+    /** Resolve the bearer token for the next request. */
+    private resolveToken;
+    /**
+     * Wrap a fetch call with single-attempt 401 retry.  `build` produces a
+     * fresh RequestInit each call (so headers can re-resolve a fresh token,
+     * and bodies can be re-streamed for retry).  On 401, invokes
+     * `onUnauthorized()` (giving the caller a chance to invalidate cached
+     * auth state) then retries once with a fresh init.  No retry if
+     * `onUnauthorized` is absent or already retried.
+     */
+    private fetchWithAuthRetry;
+    /**
+     * Every request goes out uncacheable.
+     *
+     * Our identity lives in the Authorization header, never in the URL — so
+     * two different apps calling e.g. `/v1/files/projects/index.json` hit the
+     * *same* URL with different tokens.  The browser's HTTP cache doesn't key
+     * on request headers, and it is partitioned by the top-level registrable
+     * domain, which every `*.runapps.dev` bundle shares.  One cacheable
+     * response was therefore enough for app A to read app B's file and then
+     * save it back as its own.  The server no longer marks these cacheable;
+     * this is the client-side half of that fix, and it also protects bundles
+     * pinned to an older backend.
+     */
+    private buildInit;
+    /** POST JSON body; parse JSON response. */
+    postJSON<T>(path: string, body: unknown, init?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
+    /** GET path; parse JSON response. */
+    getJSON<T>(path: string, init?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
+    /** GET path; return raw bytes + content-type (for video/audio downloads)
+     *  and the ETag of those bytes, when the server sends one. */
+    getRaw(path: string, init?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        data: Uint8Array;
+        contentType: string;
+        etag?: string;
+    }>;
+    /** POST a multipart/form-data body. Used by audio.transcribe and image.edit. */
+    postMultipart<T>(path: string, form: FormData, init?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
+    /**
+     * POST JSON body; return the raw streaming Response. Used by chat
+     * streaming. Caller is responsible for consuming the SSE body.
+     */
+    postJSONStream(path: string, body: unknown, init?: {
+        signal?: AbortSignal;
+    }): Promise<Response>;
+    /** PUT raw bytes with caller-supplied content type and headers. */
+    putBytes<T>(path: string, body: BodyInit, opts?: {
+        contentType?: string;
+        headers?: Record<string, string>;
+        signal?: AbortSignal;
+        parse?: "json" | "none";
+    }): Promise<T>;
+    /** DELETE path; parse JSON response (or no body). */
+    deletePath<T>(path: string, init?: {
+        signal?: AbortSignal;
+        parse?: "json" | "none";
+    }): Promise<T>;
+    /** HEAD path; surface status + selected response headers.  Used by
+     *  exists / stat where the body would just be an opaque blob. */
+    head(path: string, init?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        status: number;
+        headers: Headers;
+    }>;
+    private jsonHeaders;
+    private authHeaders;
+    private parseError;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;gDAK4C;IAC5C,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,SAAS;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+C;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2C;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,IAAI,EAAE,gBAAgB;IAmBlC,qDAAqD;YACvC,YAAY;IAK1B;;;;;;;OAOG;YACW,kBAAkB;IAiBhC;;;;;;;;;;;;OAYG;YACW,SAAS;IAKvB,2CAA2C;IACrC,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,CAAC,CAAC;IAab,qCAAqC;IAC/B,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,CAAC,CAAC;IAYb;kEAC8D;IACxD,MAAM,CACV,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAepE,gFAAgF;IAC1E,aAAa,CAAC,CAAC,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,CAAC,CAAC;IAab;;;OAGG;IACG,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,QAAQ,CAAC;IAgBpB,mEAAmE;IAC7D,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE;QACL,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,GACA,OAAO,CAAC,CAAC,CAAC;IAmBb,qDAAqD;IAC/C,UAAU,CAAC,CAAC,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,CAAC,CAAC;IAWb;qEACiE;IAC3D,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;YASlC,WAAW;YAOX,WAAW;YAIX,UAAU;CAazB"}

package/dist/transport.js

@@ -0,0 +1,214 @@
+import { APIError } from "./errors.js";
+export class Transport {
+    baseURL;
+    apiKey;
+    apiKeyResolver;
+    onUnauthorized;
+    fetchImpl;
+    constructor(opts) {
+        if (!opts.apiKey && !opts.apiKeyResolver) {
+            throw new Error("RunApps: pass either `apiKey` or `apiKeyResolver` when constructing the client");
+        }
+        this.baseURL = opts.baseURL.replace(/\/+$/, "");
+        this.apiKey = opts.apiKey;
+        this.apiKeyResolver = opts.apiKeyResolver;
+        this.onUnauthorized = opts.onUnauthorized;
+        // Bind to globalThis when using the platform's native fetch.
+        // Without binding, `this.fetchImpl(...)` invokes with `this`
+        // pointing at the Transport instance, and the browser's
+        // `Window.fetch` rejects that with "Illegal invocation".
+        // Caller-supplied `fetchImpl` is used as-is — they're responsible
+        // for any binding their wrapper needs.
+        this.fetchImpl = opts.fetchImpl ?? fetch.bind(globalThis);
+    }
+    /** Resolve the bearer token for the next request. */
+    async resolveToken() {
+        if (this.apiKeyResolver)
+            return await this.apiKeyResolver();
+        return this.apiKey ?? "";
+    }
+    /**
+     * Wrap a fetch call with single-attempt 401 retry.  `build` produces a
+     * fresh RequestInit each call (so headers can re-resolve a fresh token,
+     * and bodies can be re-streamed for retry).  On 401, invokes
+     * `onUnauthorized()` (giving the caller a chance to invalidate cached
+     * auth state) then retries once with a fresh init.  No retry if
+     * `onUnauthorized` is absent or already retried.
+     */
+    async fetchWithAuthRetry(path, build) {
+        const url = this.baseURL + path;
+        let resp = await this.fetchImpl(url, await this.buildInit(build));
+        if (resp.status !== 401 || !this.onUnauthorized)
+            return resp;
+        try {
+            await this.onUnauthorized();
+        }
+        catch {
+            // Hook bailed out — surface the original 401.
+            return resp;
+        }
+        resp = await this.fetchImpl(url, await this.buildInit(build));
+        return resp;
+    }
+    /**
+     * Every request goes out uncacheable.
+     *
+     * Our identity lives in the Authorization header, never in the URL — so
+     * two different apps calling e.g. `/v1/files/projects/index.json` hit the
+     * *same* URL with different tokens.  The browser's HTTP cache doesn't key
+     * on request headers, and it is partitioned by the top-level registrable
+     * domain, which every `*.runapps.dev` bundle shares.  One cacheable
+     * response was therefore enough for app A to read app B's file and then
+     * save it back as its own.  The server no longer marks these cacheable;
+     * this is the client-side half of that fix, and it also protects bundles
+     * pinned to an older backend.
+     */
+    async buildInit(build) {
+        const init = await build();
+        return init.cache ? init : { ...init, cache: "no-store" };
+    }
+    /** POST JSON body; parse JSON response. */
+    async postJSON(path, body, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "POST",
+            headers: await this.jsonHeaders(),
+            body: JSON.stringify(body),
+            signal: init?.signal,
+        }));
+        if (!resp.ok) {
+            throw await this.parseError(resp);
+        }
+        return (await resp.json());
+    }
+    /** GET path; parse JSON response. */
+    async getJSON(path, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "GET",
+            headers: await this.authHeaders(),
+            signal: init?.signal,
+        }));
+        if (!resp.ok) {
+            throw await this.parseError(resp);
+        }
+        return (await resp.json());
+    }
+    /** GET path; return raw bytes + content-type (for video/audio downloads)
+     *  and the ETag of those bytes, when the server sends one. */
+    async getRaw(path, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "GET",
+            headers: await this.authHeaders(),
+            signal: init?.signal,
+        }));
+        if (!resp.ok) {
+            throw await this.parseError(resp);
+        }
+        const buf = new Uint8Array(await resp.arrayBuffer());
+        const contentType = resp.headers.get("content-type") ?? "";
+        const etag = (resp.headers.get("etag") ?? "").replace(/"/g, "") || undefined;
+        return { data: buf, contentType, etag };
+    }
+    /** POST a multipart/form-data body. Used by audio.transcribe and image.edit. */
+    async postMultipart(path, form, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "POST",
+            headers: await this.authHeaders(), // do NOT set Content-Type — fetch sets it with boundary
+            body: form,
+            signal: init?.signal,
+        }));
+        if (!resp.ok) {
+            throw await this.parseError(resp);
+        }
+        return (await resp.json());
+    }
+    /**
+     * POST JSON body; return the raw streaming Response. Used by chat
+     * streaming. Caller is responsible for consuming the SSE body.
+     */
+    async postJSONStream(path, body, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "POST",
+            headers: {
+                ...(await this.jsonHeaders()),
+                "Accept-Encoding": "identity", // SSE lines arrive immediately, no gzip
+            },
+            body: JSON.stringify(body),
+            signal: init?.signal,
+        }));
+        if (!resp.ok) {
+            throw await this.parseError(resp);
+        }
+        return resp;
+    }
+    /** PUT raw bytes with caller-supplied content type and headers. */
+    async putBytes(path, body, opts) {
+        const resp = await this.fetchWithAuthRetry(path, async () => {
+            const headers = {
+                ...(await this.authHeaders()),
+                "Content-Type": opts?.contentType ?? "application/octet-stream",
+            };
+            if (opts?.headers)
+                Object.assign(headers, opts.headers);
+            return {
+                method: "PUT",
+                headers,
+                body,
+                signal: opts?.signal,
+            };
+        });
+        if (!resp.ok)
+            throw await this.parseError(resp);
+        if (opts?.parse === "none")
+            return undefined;
+        return (await resp.json());
+    }
+    /** DELETE path; parse JSON response (or no body). */
+    async deletePath(path, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "DELETE",
+            headers: await this.authHeaders(),
+            signal: init?.signal,
+        }));
+        if (!resp.ok)
+            throw await this.parseError(resp);
+        if (init?.parse === "none")
+            return undefined;
+        return (await resp.json());
+    }
+    /** HEAD path; surface status + selected response headers.  Used by
+     *  exists / stat where the body would just be an opaque blob. */
+    async head(path, init) {
+        const resp = await this.fetchWithAuthRetry(path, async () => ({
+            method: "HEAD",
+            headers: await this.authHeaders(),
+            signal: init?.signal,
+        }));
+        return { status: resp.status, headers: resp.headers };
+    }
+    async jsonHeaders() {
+        return {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${await this.resolveToken()}`,
+        };
+    }
+    async authHeaders() {
+        return { Authorization: `Bearer ${await this.resolveToken()}` };
+    }
+    async parseError(resp) {
+        const text = await resp.text();
+        let type = "error";
+        let message = text || resp.statusText;
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed.type)
+                type = parsed.type;
+            if (parsed.message)
+                message = parsed.message;
+        }
+        catch {
+            // Body wasn't JSON — fall back to raw text.
+        }
+        return new APIError(resp.status, type, message);
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsCvC,MAAM,OAAO,SAAS;IACX,OAAO,CAAS;IACR,MAAM,CAAqB;IAC3B,cAAc,CAA+C;IAC7D,cAAc,CAA2C;IACzD,SAAS,CAAe;IAEzC,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,6DAA6D;QAC7D,6DAA6D;QAC7D,wDAAwD;QACxD,yDAAyD;QACzD,kEAAkE;QAClE,uCAAuC;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,qDAAqD;IAC7C,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAC9B,IAAY,EACZ,KAAiC;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,SAAS,CAAC,KAAiC;QACvD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAAa,EACb,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED;kEAC8D;IAC9D,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,wDAAwD;YAC3F,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,IAAY,EACZ,IAAa,EACb,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,iBAAiB,EAAE,UAAU,EAAE,wCAAwC;aACxE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAAc,EACd,IAKC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,OAAO,GAA2B;gBACtC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,cAAc,EAAE,IAAI,EAAE,WAAW,IAAI,0BAA0B;aAChE,CAAC;YACF,IAAI,IAAI,EAAE,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE,IAAI,EAAE,MAAM;aACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,KAAK,KAAK,MAAM;YAAE,OAAO,SAAyB,CAAC;QAC7D,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,UAAU,CACd,IAAY,EACZ,IAAwD;QAExD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,KAAK,KAAK,MAAM;YAAE,OAAO,SAAyB,CAAC;QAC7D,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED;qEACiE;IACjE,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAA+B;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,MAAM;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,OAAO;YACL,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE;SACrD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAc;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwC,CAAC;YACvE,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACpC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Usage carries token consumption and cost information returned with every
+ * gateway response. `total_cost` is the gateway's billing total in USD —
+ * always present, while token counts are only populated when the upstream
+ * provider surfaces them.
+ *
+ * For chat completions that invoked server-executed tools (via the
+ * `server_tools` field), `total_cost` includes BOTH the model's raw
+ * upstream cost (summed across iterations) AND the post-markup USD price
+ * of every tool invocation.  The per-tool breakdown lives in `tool_costs`
+ * so callers can attribute charges without having to re-run the loop.
+ */
+export interface Usage {
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    total_tokens?: number;
+    total_cost: number;
+    tool_costs?: ToolCost[];
+}
+/**
+ * Per-tool spend for a single chat completion that used server-executed
+ * tools.  `cost` is in USD and already post-markup — it matches the
+ * amount actually deducted from the user's balance for that tool's
+ * invocations during the request.
+ */
+export interface ToolCost {
+    name: string;
+    count: number;
+    cost: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,KAAK;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/validate.d.ts

@@ -0,0 +1,16 @@
+import type { Schema } from "./model_options.js";
+export interface ValidationError {
+    field: string;
+    reason: string;
+}
+/**
+ * Three-pass validator: per-field type/enum/bounds → per-field
+ * presence → cross-field constraints. Unknown fields in `req`
+ * (vendor passthroughs) are silently ignored — the gateway still
+ * validates them server-side if it cares.
+ *
+ * Returns an empty array on success, or a flat list of all
+ * validation failures so the UI can surface them at once.
+ */
+export declare function validateRequest(schema: Schema | null | undefined, req?: Record<string, unknown>): ValidationError[];
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAkC,MAAM,oBAAoB,CAAC;AAEjF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,eAAe,EAAE,CA8BnB"}