@truefoundry/ai-gateway-sdk 0.0.0-stage → 0.0.2

package/dist/autogen/validate.d.ts

@@ -0,0 +1,6 @@
+import type { ErrorObject } from 'ajv';
+export interface Validator {
+    (json: unknown): boolean;
+    errors?: ErrorObject[] | null;
+}
+export declare function validateJson(json: any, validator: Validator, definitionName: string): any;

package/dist/autogen/validate.js

@@ -0,0 +1,15 @@
+export function validateJson(json, validator, definitionName) {
+    const jsonObject = typeof json === 'string' ? JSON.parse(json) : json;
+    if (validator(jsonObject)) {
+        return jsonObject;
+    }
+    const jsonPreviewStr = (typeof json === 'string' ? json : JSON.stringify(jsonObject)).substring(0, 200);
+    if (validator.errors) {
+        throw Error(`${definitionName} ${errorsText(validator.errors)}. JSON: ${jsonPreviewStr}`);
+    }
+    throw Error(`${definitionName} Unexpected data received. JSON: ${jsonPreviewStr}`);
+}
+function errorsText(errors) {
+    return errors.map(error => `${error.instancePath}: ${error.message}`).join('\n');
+}
+//# sourceMappingURL=validate.js.map

package/dist/autogen/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/autogen/validate.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAAC,IAAS,EAAE,SAAoB,EAAE,cAAsB;IAClF,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtE,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,cAAc,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,CAAC,GAAG,cAAc,oCAAoC,cAAc,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC"}

package/dist/cache/port.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Process-local {@link CachePort} bound from {@link LlmGatewaySdk}.
+ *
+ * Free-function auth helpers (WIF / Entra / STS) cannot take an SDK instance until
+ * P7 `execute` owns the call stack. The SDK binds the port on construct.
+ *
+ * Logical keys must **not** include `tenantName` — the gateway adapter prefixes
+ * tenant and owns serialization / Redis / NATS.
+ */
+import type { CachePort } from '../types/cache.js';
+/** Called from {@link LlmGatewaySdk} constructor. */
+export declare function bindCachePort(cache: CachePort): void;
+export declare function getCachePort(): CachePort | undefined;
+/** Opaque entry stored via {@link CachePort.update} (matches live credential cache). */
+export interface CachedCredentialsEntry<T = unknown> {
+    credentials: T;
+    original_key?: string;
+    /** Epoch ms; omit or past → treat as miss. */
+    expiration?: number;
+}
+/**
+ * Read non-expired credentials. Returns undefined when unbound, missing, or expired.
+ */
+export declare function getCachedCredentials<T>(key: string): Promise<T | undefined>;
+/**
+ * Store credentials when `expiration` is a future epoch ms. No-op when unbound or
+ * expiration is null (caller chose not to cache).
+ */
+export declare function storeCachedCredentials<T>(key: string, credentials: T, expiration: number | null, originalKey?: string): Promise<void>;
+/** @internal test helper — clears the process-local bind. */
+export declare function __resetBoundCachePortForTests(): void;

package/dist/cache/port.js

@@ -0,0 +1,44 @@
+let boundCache;
+/** Called from {@link LlmGatewaySdk} constructor. */
+export function bindCachePort(cache) {
+    boundCache = cache;
+}
+export function getCachePort() {
+    return boundCache;
+}
+/**
+ * Read non-expired credentials. Returns undefined when unbound, missing, or expired.
+ */
+export async function getCachedCredentials(key) {
+    const cache = boundCache;
+    if (!cache)
+        return undefined;
+    const entry = (await cache.get(key));
+    if (!entry || entry.credentials === undefined || entry.credentials === null)
+        return undefined;
+    if (typeof entry.expiration === 'number' && Date.now() >= entry.expiration)
+        return undefined;
+    return entry.credentials;
+}
+/**
+ * Store credentials when `expiration` is a future epoch ms. No-op when unbound or
+ * expiration is null (caller chose not to cache).
+ */
+export async function storeCachedCredentials(key, credentials, expiration, originalKey) {
+    if (expiration === null)
+        return;
+    const cache = boundCache;
+    if (!cache)
+        return;
+    const entry = {
+        credentials,
+        expiration,
+        ...(originalKey !== undefined ? { original_key: originalKey } : {}),
+    };
+    await cache.update(key, entry);
+}
+/** @internal test helper — clears the process-local bind. */
+export function __resetBoundCachePortForTests() {
+    boundCache = undefined;
+}
+//# sourceMappingURL=port.js.map

package/dist/cache/port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/cache/port.ts"],"names":[],"mappings":"AAWA,IAAI,UAAiC,CAAC;AAEtC,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,UAAU,GAAG,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,CAAC;AACpB,CAAC;AAUD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAI,GAAW;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAA0C,CAAC;IAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9F,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAC7F,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,WAAc,EACd,UAAyB,EACzB,WAAoB;IAEpB,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,KAAK,GAA8B;QACvC,WAAW;QACX,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,6BAA6B;IAC3C,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC"}

package/dist/catalog/snapshots.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Process-local refs to the dual catalog snapshots owned by {@link LlmGatewaySdk}.
+ *
+ * Free-function call sites (`modelParamUtils`, Anthropic betas / server-tools) cannot
+ * take an SDK instance until `execute` (P7) owns the call stack. The SDK binds these
+ * refs on construct / update so readers always see the latest full-map replace.
+ *
+ * Prefer one SDK instance per process (or isolation boundary). Replacing the instance
+ * rebinds the refs; concurrent instances would last-writer-win — same constraint as
+ * today's single `globalState` catalog.
+ */
+import type { CatalogProviderConfigs, ProviderModelConfigs } from '../types/modelConfig.js';
+/** Called from {@link LlmGatewaySdk} constructor and snapshot updates. */
+export declare function bindCatalogSnapshots(snapshots: {
+    modelConfig: ProviderModelConfigs;
+    providerConfig: CatalogProviderConfigs;
+}): void;
+export declare function getModelConfigSnapshot(): ProviderModelConfigs;
+export declare function getProviderConfigSnapshot(): CatalogProviderConfigs;

package/dist/catalog/snapshots.js

@@ -0,0 +1,14 @@
+let modelConfigSnapshot = {};
+let providerConfigSnapshot = {};
+/** Called from {@link LlmGatewaySdk} constructor and snapshot updates. */
+export function bindCatalogSnapshots(snapshots) {
+    modelConfigSnapshot = snapshots.modelConfig;
+    providerConfigSnapshot = snapshots.providerConfig;
+}
+export function getModelConfigSnapshot() {
+    return modelConfigSnapshot;
+}
+export function getProviderConfigSnapshot() {
+    return providerConfigSnapshot;
+}
+//# sourceMappingURL=snapshots.js.map

package/dist/catalog/snapshots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshots.js","sourceRoot":"","sources":["../../src/catalog/snapshots.ts"],"names":[],"mappings":"AAaA,IAAI,mBAAmB,GAAyB,EAAE,CAAC;AACnD,IAAI,sBAAsB,GAA2B,EAAE,CAAC;AAExD,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,SAGpC;IACC,mBAAmB,GAAG,SAAS,CAAC,WAAW,CAAC;IAC5C,sBAAsB,GAAG,SAAS,CAAC,cAAc,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Configuration Management
+ *
+ * Centralized configuration class for accessing environment variables
+ * with proper type safety, validation, and error handling.
+ */
+import type { UrlVerifyConfig } from './http/urlverify/config.js';
+/**
+ * Parses a comma-separated string into trimmed, non-empty tokens.
+ * If parsing yields no tokens, returns `fallbackWhenEmpty` when provided, otherwise `[]`.
+ */
+export declare const parseArray: (value: string, fallbackWhenEmpty?: string[]) => string[];
+/**
+ * Parses `CORS_ALLOWED_ORIGINS` into values Hono can match against the browser `Origin` header.
+ * Browsers send scheme+host+port only, so each entry is reduced via `URL.origin` (strips path /
+ * trailing slash). `*` is left unchanged. Unparseable tokens are kept as-is.
+ */
+export declare const parseCorsAllowedOrigins: (value: string | undefined) => string[];
+export declare const parseBoolean: (value: string | undefined) => boolean;
+export declare const parseIntWithErrorHandling: (value: string | undefined, radix?: number) => number;
+/**
+ * Parses a JSON string array env var (e.g. `["username"]` → `["username"]`).
+ * Missing/invalid input → empty array. Non-string entries are dropped.
+ */
+export declare const parseJsonArray: (value: string | undefined) => string[];
+/** Ported from servicefoundry-server's `parseJSONWithErrorHandling`: throws instead of silently dropping bad JSON. */
+export declare const parseJSONWithErrorHandling: <T>(value: string) => T;
+export interface GetEnvOptions {
+    defaultValue?: string;
+    required?: boolean;
+}
+export declare const getEnv: (key: string, options?: GetEnvOptions) => string | undefined;
+export interface Configuration {
+    PORT: number;
+    LOG_LEVEL: string;
+    LOG_FORMAT: string;
+    /** K8s SA name for TokenRequest when exchanging Vertex WIF (align with servicefoundry-server / chart RBAC). */
+    K8S_SERVICE_ACCOUNT_NAME: string;
+    /** AWS IMDS token endpoint for IMDSv2 session token retrieval (Vertex AWS WIF). */
+    AWS_IMDS_TOKEN_URL: string;
+    /** AWS IMDS region endpoint to retrieve the current AWS region (Vertex AWS WIF). */
+    AWS_IMDS_REGION_URL: string;
+    /** TTL in seconds for the IMDSv2 session token (Vertex AWS WIF). */
+    AWS_IMDS_TOKEN_TTL_SECONDS: string;
+    WEBSOCKET_DRAIN_TIMEOUT_MINUTES: number;
+    /**
+     * On a client cancel, finish the upstream call for non-streaming requests instead of aborting it,
+     * so the provider's own usage block is billed. A non-streaming response arrives in one piece, so
+     * aborting leaves nothing to attribute; this applies to every provider, whatever its cancel policy.
+     */
+    COMPLETE_NON_STREAMING_ON_CLIENT_CANCEL: boolean;
+    GATEWAY_AWS_ROLE_ARN: string | undefined;
+    GATEWAY_AWS_USER_ACCESS_KEY_ID: string | undefined;
+    GATEWAY_AWS_USER_SECRET_ACCESS_KEY: string | undefined;
+    HTTP_PROXY: string | undefined;
+    HTTPS_PROXY: string | undefined;
+    NO_PROXY: string | undefined;
+    HTTP_CLIENT_REQUEST_TIMEOUT_MS: number;
+    UNDICI_HEADERS_TIMEOUT_MS: number;
+    UNDICI_BODY_TIMEOUT_MS: number;
+    SSRF_BLOCKED_EXACT_IPS: string[];
+    ENABLE_SSRF: boolean;
+    ENFORCE_SSRF: boolean;
+    URL_VERIFY_CONFIG: Partial<UrlVerifyConfig>;
+    ENABLE_PROVIDER_CREDENTIAL_CACHE_ENCRYPTION: boolean;
+    ENABLE_AUTH_CACHE_METRICS: boolean;
+    /**
+     * When true, the auth cache falls back to a grant's own permissions when the bound role has no
+     * cached permissions (e.g. a stale/old-format ROLE snapshot in KV without `permissionsByResourceType`).
+     * Safety net against upgrade-time authz outages; disable once all ROLE snapshots are republished.
+     */
+    ENABLE_AUTH_CACHE_PERMISSION_FALLBACK: boolean;
+    /** Kill switch for holding a native `/responses` stream so an in-band failure can fall back. */
+    RESPONSES_IN_BAND_ERROR_FALLBACK_ENABLED: boolean;
+    TLS_ENABLED: boolean;
+    TLS_MUTUAL: boolean;
+    TLS_DIR: string;
+    TLS_MUTUAL_EXEMPT_PATHS: string[];
+}
+/**
+ * Main configuration object with environment variables.
+ * @returns The configuration object.
+ */
+declare const configuration: Configuration;
+/**
+ * Validates cross-field configuration invariants that can't be expressed
+ * via individual `required` flags. Call at server startup to fail fast.
+ */
+export default configuration;

package/dist/config.js

@@ -0,0 +1,195 @@
+// ============================================================================
+// HELPER FUNCTIONS
+// ============================================================================
+/**
+ * Parses a comma-separated string into trimmed, non-empty tokens.
+ * If parsing yields no tokens, returns `fallbackWhenEmpty` when provided, otherwise `[]`.
+ */
+export const parseArray = (value, fallbackWhenEmpty) => {
+    const parsed = value
+        .split(',')
+        .map(h => h.trim())
+        .filter(Boolean);
+    if (parsed.length > 0) {
+        return parsed;
+    }
+    return fallbackWhenEmpty !== undefined ? fallbackWhenEmpty : [];
+};
+/**
+ * Parses `CORS_ALLOWED_ORIGINS` into values Hono can match against the browser `Origin` header.
+ * Browsers send scheme+host+port only, so each entry is reduced via `URL.origin` (strips path /
+ * trailing slash). `*` is left unchanged. Unparseable tokens are kept as-is.
+ */
+export const parseCorsAllowedOrigins = (value) => {
+    return parseArray(value ?? '').map(entry => {
+        if (entry === '*') {
+            return entry;
+        }
+        try {
+            return new URL(entry).origin;
+        }
+        catch {
+            return entry;
+        }
+    });
+};
+export const parseBoolean = (value) => {
+    return value?.toLowerCase() === 'true';
+};
+export const parseIntWithErrorHandling = (value, radix = 10) => {
+    if (!value) {
+        throw new Error(`Failed to parse environment variable: value is undefined or empty.`);
+    }
+    try {
+        const parsedValue = parseInt(value, radix);
+        if (isNaN(parsedValue)) {
+            throw new Error(`Failed to parse environment variable value ${value} to integer.`);
+        }
+        return parsedValue;
+    }
+    catch (error) {
+        throw new Error(`Error parsing environment variable value ${value}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+};
+/**
+ * Parses a JSON string array env var (e.g. `["username"]` → `["username"]`).
+ * Missing/invalid input → empty array. Non-string entries are dropped.
+ */
+export const parseJsonArray = (value) => {
+    if (!value) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(value);
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.filter((item) => typeof item === 'string');
+    }
+    catch {
+        return [];
+    }
+};
+/** Ported from servicefoundry-server's `parseJSONWithErrorHandling`: throws instead of silently dropping bad JSON. */
+export const parseJSONWithErrorHandling = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch (error) {
+        throw new Error(`Error parsing environment variable value ${value}: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error,
+        });
+    }
+};
+export const getEnv = (key, options) => {
+    const value = process.env[key];
+    if (value !== undefined) {
+        return value;
+    }
+    // Checking for undefined as value can also be 0 or ""
+    if (options?.defaultValue !== undefined) {
+        return options.defaultValue;
+    }
+    if (process.env['NODE_ENV'] !== 'test' && options?.required) {
+        throw new Error(`Environment variable ${key} is required but was not specified.`);
+    }
+    return undefined;
+};
+/**
+ * Gets env var or derives it from CONTROL_PLANE_URL if not present
+ * @param envKey - Environment variable key
+ * @param deriveFn - Function to derive value from CONTROL_PLANE_URL (can return undefined)
+ * @param required - If true, throws error when neither env var nor CONTROL_PLANE_URL is set
+ */
+function getOrDeriveUrl(envKey, deriveFn, required = false) {
+    const explicit = getEnv(envKey);
+    if (explicit)
+        return explicit;
+    const controlPlaneUrl = getEnv('CONTROL_PLANE_URL');
+    if (controlPlaneUrl) {
+        return deriveFn(controlPlaneUrl);
+    }
+    if (required && process.env['NODE_ENV'] !== 'test') {
+        throw new Error(`Either ${envKey} or CONTROL_PLANE_URL must be set`);
+    }
+    return undefined;
+}
+function randomAlphanumeric(length) {
+    return Array.from({ length }, () => Math.floor(Math.random() * 36).toString(36)).join('');
+}
+// ============================================================================
+// CONFIGURATION OBJECT
+// ============================================================================
+/**
+ * Main configuration object with environment variables.
+ * @returns The configuration object.
+ */
+const configuration = {
+    // Application Configuration
+    PORT: parseIntWithErrorHandling(getEnv('PORT', { defaultValue: '8787' })),
+    // Control Plane Configuration
+    // Authentication & Authorization
+    // Logging
+    LOG_LEVEL: getEnv('LOG_LEVEL', { defaultValue: 'info' }),
+    LOG_FORMAT: getEnv('LOG_FORMAT', { defaultValue: 'text' }),
+    // OpenTelemetry Kill Switch
+    // OpenTelemetry Tracing - Endpoints
+    // OpenTelemetry Configuration
+    // Debugging
+    // Infrastructure
+    K8S_SERVICE_ACCOUNT_NAME: getEnv('K8S_SERVICE_ACCOUNT_NAME', { defaultValue: 'default' }),
+    AWS_IMDS_TOKEN_URL: getEnv('AWS_IMDS_TOKEN_URL', { defaultValue: 'http://169.254.169.254/latest/api/token' }),
+    AWS_IMDS_REGION_URL: getEnv('AWS_IMDS_REGION_URL', {
+        defaultValue: 'http://169.254.169.254/latest/meta-data/placement/region',
+    }),
+    AWS_IMDS_TOKEN_TTL_SECONDS: getEnv('AWS_IMDS_TOKEN_TTL_SECONDS', { defaultValue: '21600' }),
+    // Feature Flags & Configuration
+    WEBSOCKET_DRAIN_TIMEOUT_MINUTES: parseIntWithErrorHandling(getEnv('WEBSOCKET_DRAIN_TIMEOUT_MINUTES', { defaultValue: '15' })),
+    COMPLETE_NON_STREAMING_ON_CLIENT_CANCEL: parseBoolean(getEnv('COMPLETE_NON_STREAMING_ON_CLIENT_CANCEL', { defaultValue: 'true' })),
+    // Cache Configuration
+    // Gateway AWS Configuration for Assumed Role Support
+    GATEWAY_AWS_ROLE_ARN: getEnv('GATEWAY_AWS_ROLE_ARN'),
+    GATEWAY_AWS_USER_ACCESS_KEY_ID: getEnv('GATEWAY_AWS_USER_ACCESS_KEY_ID'),
+    GATEWAY_AWS_USER_SECRET_ACCESS_KEY: getEnv('GATEWAY_AWS_USER_SECRET_ACCESS_KEY'),
+    // Proxy Configuration
+    HTTP_PROXY: getEnv('HTTP_PROXY'),
+    HTTPS_PROXY: getEnv('HTTPS_PROXY'),
+    NO_PROXY: getEnv('NO_PROXY'),
+    HTTP_CLIENT_REQUEST_TIMEOUT_MS: parseIntWithErrorHandling(getEnv('HTTP_CLIENT_REQUEST_TIMEOUT_MS', { defaultValue: '10000' })),
+    // Undici Headers Timeout Configuration
+    UNDICI_HEADERS_TIMEOUT_MS: parseIntWithErrorHandling(getEnv('UNDICI_HEADERS_TIMEOUT_MS', { defaultValue: '900000' })),
+    // Undici Body Timeout Configuration
+    UNDICI_BODY_TIMEOUT_MS: parseIntWithErrorHandling(getEnv('UNDICI_BODY_TIMEOUT_MS', { defaultValue: '1800000' })),
+    SSRF_BLOCKED_EXACT_IPS: parseArray(getEnv('SSRF_BLOCKED_EXACT_IPS', { defaultValue: '169.254.169.254,169.254.170.2,fd00:ec2::254' })),
+    ENABLE_SSRF: parseBoolean(getEnv('ENABLE_SSRF', { defaultValue: 'true' })),
+    ENFORCE_SSRF: parseBoolean(getEnv('ENFORCE_SSRF', { defaultValue: 'false' })),
+    URL_VERIFY_CONFIG: parseJSONWithErrorHandling(getEnv('URL_VERIFY_CONFIG', { defaultValue: '{}' })),
+    // Internal mutual TLS. Off by default; the chart turns it on from global.mTLS.enabled.
+    TLS_ENABLED: parseBoolean(getEnv('TLS_ENABLED', { defaultValue: 'false' })),
+    TLS_MUTUAL: parseBoolean(getEnv('TLS_MUTUAL', { defaultValue: 'false' })),
+    TLS_DIR: getEnv('TLS_DIR', { defaultValue: '/etc/tls/truefoundry' }),
+    // These defaults are the paths reached by callers that present no client certificate, and every
+    // one of them is load-bearing. `/` is the chart's actual liveness AND readiness path, so
+    // omitting it means the pod never goes ready. `/metrics` is the ServiceMonitor scrape, which
+    // would otherwise fail silently — no error anyone sees, just missing dashboards. `/health` and
+    // `/api/llm/health` are both real: mountAllRoutes mounts the inference router at `/` and again
+    // at `/api/llm`, and tfy-proxy may or may not strip the prefix depending on the route.
+    //
+    // An explicitly empty TLS_MUTUAL_EXEMPT_PATHS falls back to these rather than yielding an empty
+    // list, because "exempt nothing" is not a state worth being able to reach by accident.
+    TLS_MUTUAL_EXEMPT_PATHS: parseArray(getEnv('TLS_MUTUAL_EXEMPT_PATHS', { defaultValue: '/,/health,/api/llm/health,/metrics' }), ['/', '/health', '/api/llm/health', '/metrics']),
+    ENABLE_PROVIDER_CREDENTIAL_CACHE_ENCRYPTION: parseBoolean(getEnv('ENABLE_PROVIDER_CREDENTIAL_CACHE_ENCRYPTION', { defaultValue: 'false' })),
+    ENABLE_AUTH_CACHE_METRICS: parseBoolean(getEnv('ENABLE_AUTH_CACHE_METRICS', { defaultValue: 'true' })),
+    // Default ON: safety net for stale/old-format ROLE snapshots after upgrade. Turn off once roles are republished.
+    ENABLE_AUTH_CACHE_PERMISSION_FALLBACK: parseBoolean(getEnv('ENABLE_AUTH_CACHE_PERMISSION_FALLBACK', { defaultValue: 'true' })),
+    RESPONSES_IN_BAND_ERROR_FALLBACK_ENABLED: parseBoolean(getEnv('RESPONSES_IN_BAND_ERROR_FALLBACK_ENABLED', { defaultValue: 'true' })),
+};
+// ============================================================================
+// CONFIGURATION VALIDATION
+// ============================================================================
+/**
+ * Validates cross-field configuration invariants that can't be expressed
+ * via individual `required` flags. Call at server startup to fail fast.
+ */
+export default configuration;
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,iBAA4B,EAAY,EAAE;IAClF,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAClB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAyB,EAAY,EAAE;IAC7E,OAAO,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAyB,EAAW,EAAE;IACjE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAyB,EAAE,QAAgB,EAAE,EAAU,EAAE;IACjG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,cAAc,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAyB,EAAY,EAAE;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,sHAAsH;AACtH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAI,KAAa,EAAK,EAAE;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9G;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,OAAuB,EAAsB,EAAE;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,YAAY,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,qCAAqC,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAc,EACd,QAAyD,EACzD,WAAoB,KAAK;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAyGD,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,aAAa,GAAkB;IACnC,4BAA4B;IAC5B,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAE,CAAC;IAE1E,8BAA8B;IAE9B,iCAAiC;IAEjC,UAAU;IACV,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAE;IACzD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAE;IAE3D,4BAA4B;IAE5B,oCAAoC;IAEpC,8BAA8B;IAE9B,YAAY;IAEZ,iBAAiB;IACjB,wBAAwB,EAAE,MAAM,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAE;IAC1F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,yCAAyC,EAAE,CAAE;IAC9G,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,EAAE;QACjD,YAAY,EAAE,0DAA0D;KACzE,CAAE;IACH,0BAA0B,EAAE,MAAM,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAE;IAE5F,gCAAgC;IAChC,+BAA+B,EAAE,yBAAyB,CACxD,MAAM,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAClE;IACD,uCAAuC,EAAE,YAAY,CACnD,MAAM,CAAC,yCAAyC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAC5E;IAED,sBAAsB;IAEtB,qDAAqD;IACrD,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,CAAC;IACpD,8BAA8B,EAAE,MAAM,CAAC,gCAAgC,CAAC;IACxE,kCAAkC,EAAE,MAAM,CAAC,oCAAoC,CAAC;IAEhF,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;IAE5B,8BAA8B,EAAE,yBAAyB,CACvD,MAAM,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CACpE;IAED,uCAAuC;IACvC,yBAAyB,EAAE,yBAAyB,CAClD,MAAM,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAChE;IAED,oCAAoC;IACpC,sBAAsB,EAAE,yBAAyB,CAC/C,MAAM,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAC9D;IAED,sBAAsB,EAAE,UAAU,CAChC,MAAM,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,6CAA6C,EAAE,CAAE,CACnG;IAED,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,iBAAiB,EAAE,0BAA0B,CAC3C,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAE,CACrD;IAED,uFAAuF;IACvF,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAE;IACrE,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,uFAAuF;IACvF,EAAE;IACF,gGAAgG;IAChG,uFAAuF;IACvF,uBAAuB,EAAE,UAAU,CACjC,MAAM,CAAC,yBAAyB,EAAE,EAAE,YAAY,EAAE,oCAAoC,EAAE,CAAE,EAC1F,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAChD;IAED,2CAA2C,EAAE,YAAY,CACvD,MAAM,CAAC,6CAA6C,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CACjF;IAED,yBAAyB,EAAE,YAAY,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IACtG,iHAAiH;IACjH,qCAAqC,EAAE,YAAY,CACjD,MAAM,CAAC,uCAAuC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAC1E;IAED,wCAAwC,EAAE,YAAY,CACpD,MAAM,CAAC,0CAA0C,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAC7E;CACO,CAAC;AAEX,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;GAGG;AAEH,eAAe,aAAa,CAAC"}

package/dist/constants/jsonRpc.d.ts

@@ -0,0 +1,30 @@
+export declare const JSON_RPC_ERRORS: {
+    readonly PARSE_ERROR: {
+        readonly code: -32700;
+        readonly message: "Parse error";
+    };
+    readonly INVALID_REQUEST: {
+        readonly code: -32600;
+        readonly message: "Invalid Request";
+    };
+    readonly METHOD_NOT_FOUND: {
+        readonly code: -32601;
+        readonly message: "Method not found";
+    };
+    readonly INVALID_PARAMS: {
+        readonly code: -32602;
+        readonly message: "Invalid params";
+    };
+    readonly INTERNAL_ERROR: {
+        readonly code: -32603;
+        readonly message: "Internal error";
+    };
+    readonly AUTHENTICATION_ERROR: {
+        readonly code: -32001;
+        readonly message: "Authentication error";
+    };
+    readonly RESOURCE_NOT_FOUND: {
+        readonly code: -32002;
+        readonly message: "Resource not found";
+    };
+};

package/dist/constants/jsonRpc.js

@@ -0,0 +1,11 @@
+// Standard JSON-RPC 2.0 error codes
+export const JSON_RPC_ERRORS = {
+    PARSE_ERROR: { code: -32700, message: 'Parse error' },
+    INVALID_REQUEST: { code: -32600, message: 'Invalid Request' },
+    METHOD_NOT_FOUND: { code: -32601, message: 'Method not found' },
+    INVALID_PARAMS: { code: -32602, message: 'Invalid params' },
+    INTERNAL_ERROR: { code: -32603, message: 'Internal error' },
+    AUTHENTICATION_ERROR: { code: -32001, message: 'Authentication error' },
+    RESOURCE_NOT_FOUND: { code: -32002, message: 'Resource not found' },
+};
+//# sourceMappingURL=jsonRpc.js.map

package/dist/constants/jsonRpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonRpc.js","sourceRoot":"","sources":["../../src/constants/jsonRpc.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAC7D,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE;IAC/D,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;IAC3D,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;IAC3D,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE;IACvE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE;CAC3D,CAAC"}

package/dist/constants.d.ts

@@ -0,0 +1,26 @@
+export declare const TFY_METADATA_HEADER = "x-tfy-metadata";
+export declare const TFY_RETRY_CONFIG_HEADER = "x-tfy-retry-config";
+export declare const TFY_CONVERSATION_ID_HEADER = "x-tfy-conversation-id";
+export declare const TFY_REQUEST_ID_HEADER = "x-tfy-request-id";
+export declare const TFY_LOGGING_CONFIG_HEADER = "x-tfy-logging-config";
+export declare const TFY_CACHE_CONFIG_HEADER = "x-tfy-cache-config";
+export declare const TFY_CACHE_CONTROL_HEADER = "x-tfy-cache-control";
+export declare const TFY_OPENAI_USE_RESPONSES_API_HEADER = "x-tfy-openai-use-responses-api";
+export declare const TFY_DISABLE_WEB_SEARCH_HEADER = "x-tfy-disable-web-search";
+export declare const TFY_HOST_HEADER = "tfy-host";
+export declare const TFY_ASSUME_USER_HEADER = "x-tfy-assume-user";
+export declare const TFY_ERROR_TYPES: {
+    readonly RATE_LIMIT: "tfy-rate-limit";
+    readonly BUDGET_LIMIT: "tfy-budget-limit";
+    readonly TFY_FORBIDDEN: "tfy-forbidden";
+    /** Model name is missing from the auth cache / cannot be resolved (still HTTP 403 to the client). */
+    readonly MODEL_NOT_FOUND: "tfy-model-not-found";
+    readonly REQUEST_FAILURE: "request-failure";
+    readonly REQUEST_TIMEOUT: "request-timeout";
+    readonly CLIENT_DISCONNECTED: "client-disconnected";
+    readonly PROVIDER_STREAMING_TERMINATED: "provider-streaming-terminated";
+    /** Provider reported a failure inside an HTTP 200 stream (e.g. a Responses `response.failed` frame). */
+    readonly PROVIDER_STREAM_ERROR: "provider-stream-error";
+    readonly TTFT_TIMEOUT: "ttft-timeout";
+    readonly UNKNOWN_ERROR: "unknown-error";
+};

package/dist/constants.js

@@ -0,0 +1,27 @@
+export const TFY_METADATA_HEADER = 'x-tfy-metadata';
+export const TFY_RETRY_CONFIG_HEADER = 'x-tfy-retry-config';
+export const TFY_CONVERSATION_ID_HEADER = 'x-tfy-conversation-id';
+export const TFY_REQUEST_ID_HEADER = 'x-tfy-request-id';
+export const TFY_LOGGING_CONFIG_HEADER = 'x-tfy-logging-config';
+export const TFY_CACHE_CONFIG_HEADER = 'x-tfy-cache-config';
+export const TFY_CACHE_CONTROL_HEADER = 'x-tfy-cache-control';
+export const TFY_OPENAI_USE_RESPONSES_API_HEADER = 'x-tfy-openai-use-responses-api';
+export const TFY_DISABLE_WEB_SEARCH_HEADER = 'x-tfy-disable-web-search';
+export const TFY_HOST_HEADER = 'tfy-host';
+export const TFY_ASSUME_USER_HEADER = 'x-tfy-assume-user';
+export const TFY_ERROR_TYPES = {
+    RATE_LIMIT: 'tfy-rate-limit',
+    BUDGET_LIMIT: 'tfy-budget-limit',
+    TFY_FORBIDDEN: 'tfy-forbidden',
+    /** Model name is missing from the auth cache / cannot be resolved (still HTTP 403 to the client). */
+    MODEL_NOT_FOUND: 'tfy-model-not-found',
+    REQUEST_FAILURE: 'request-failure',
+    REQUEST_TIMEOUT: 'request-timeout',
+    CLIENT_DISCONNECTED: 'client-disconnected',
+    PROVIDER_STREAMING_TERMINATED: 'provider-streaming-terminated',
+    /** Provider reported a failure inside an HTTP 200 stream (e.g. a Responses `response.failed` frame). */
+    PROVIDER_STREAM_ERROR: 'provider-stream-error',
+    TTFT_TIMEOUT: 'ttft-timeout',
+    UNKNOWN_ERROR: 'unknown-error',
+};
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,mCAAmC,GAAG,gCAAgC,CAAC;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,aAAa,EAAE,eAAe;IAC9B,qGAAqG;IACrG,eAAe,EAAE,qBAAqB;IACtC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,6BAA6B,EAAE,+BAA+B;IAC9D,wGAAwG;IACxG,qBAAqB,EAAE,uBAAuB;IAC9C,YAAY,EAAE,cAAc;IAC5B,aAAa,EAAE,eAAe;CACtB,CAAC"}

package/dist/entities/Authentication.d.ts

@@ -0,0 +1,37 @@
+import { IdentityV2 } from '@truefoundry/tfy-cache-handler';
+export interface Session {
+    subjectId: string;
+    tenantName: string;
+    subjectSlug: string;
+    subjectType: SubjectType;
+    teams?: SessionTeam[];
+    emailForExternalIdentity?: string;
+    subjectExternalIdentitySlug?: string;
+    rolesWithResource?: RoleWithResource[];
+    roles?: string[];
+    subjectPatName?: string;
+    subjectPatOwnedByTeam?: string;
+    actor?: SessionActor;
+    identity?: IdentityV2;
+}
+export interface RoleWithResource {
+    roleId: string;
+    roleName: string;
+    resourceType: string;
+    resourceId: string;
+}
+export declare enum SubjectType {
+    USER = "user",
+    VIRTUAL_ACCOUNT = "virtualaccount",
+    SERVICE_ACCOUNT = "serviceaccount"
+}
+export declare enum ControllerNameForSystemUser {
+    TFY_AI_GATEWAY = "tfy-ai-gateway"
+}
+export interface SessionTeam {
+    name: string;
+    id: string;
+}
+export interface SessionActor {
+    organization?: string;
+}

package/dist/entities/Authentication.js

@@ -0,0 +1,11 @@
+export var SubjectType;
+(function (SubjectType) {
+    SubjectType["USER"] = "user";
+    SubjectType["VIRTUAL_ACCOUNT"] = "virtualaccount";
+    SubjectType["SERVICE_ACCOUNT"] = "serviceaccount";
+})(SubjectType || (SubjectType = {}));
+export var ControllerNameForSystemUser;
+(function (ControllerNameForSystemUser) {
+    ControllerNameForSystemUser["TFY_AI_GATEWAY"] = "tfy-ai-gateway";
+})(ControllerNameForSystemUser || (ControllerNameForSystemUser = {}));
+//# sourceMappingURL=Authentication.js.map

package/dist/entities/Authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authentication.js","sourceRoot":"","sources":["../../src/entities/Authentication.ts"],"names":[],"mappings":"AA8BA,MAAM,CAAN,IAAY,WAIX;AAJD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,iDAAkC,CAAA;IAClC,iDAAkC,CAAA;AACpC,CAAC,EAJW,WAAW,KAAX,WAAW,QAItB;AAED,MAAM,CAAN,IAAY,2BAEX;AAFD,WAAY,2BAA2B;IACrC,gEAAiC,CAAA;AACnC,CAAC,EAFW,2BAA2B,KAA3B,2BAA2B,QAEtC"}