batchwork 1.0.0 → 1.1.0

package/dist/{chunk-kv3847wy.js → chunk-xtk2ycy6.js}

@@ -8,8 +8,8 @@ class BatchworkError extends Error {
 
 class UnsupportedProviderError extends BatchworkError {
   provider;
-  constructor(provider) {
-    super(`batchwork: provider "${provider}" is not supported yet. Supported providers: openai, anthropic, google, groq, mistral, together, xai.`);
+  constructor(provider, detail) {
+    super(detail ?? `batchwork: provider "${provider}" is not supported yet. Supported providers: openai, anthropic, google, groq, mistral, together, xai.`);
     this.name = "UnsupportedProviderError";
     this.provider = provider;
   }
@@ -36,11 +36,16 @@ var delay = (ms, signal) => new Promise((resolve, reject) => {
     reject(new BatchworkError("batchwork: wait aborted."));
     return;
   }
-  const timer = setTimeout(resolve, ms);
-  signal?.addEventListener("abort", () => {
+  let timer;
+  const onAbort = () => {
     clearTimeout(timer);
     reject(new BatchworkError("batchwork: wait aborted."));
-  }, { once: true });
+  };
+  timer = setTimeout(() => {
+    signal?.removeEventListener("abort", onAbort);
+    resolve();
+  }, ms);
+  signal?.addEventListener("abort", onAbort, { once: true });
 });
 
 class BatchJob {
@@ -103,28 +108,67 @@ class BatchJob {
   }
 }
 
-// src/http.ts
-var safeText = async (response) => {
-  try {
-    return await response.text();
-  } catch {
-    return "<no body>";
+// src/limits.ts
+var DEFAULT_LIMITS = {
+  captureConcurrency: 16,
+  maxRequestBytes: 20 * 1024 * 1024,
+  maxRequests: 50000,
+  maxUploadBytes: 200 * 1024 * 1024
+};
+var encoder = new TextEncoder;
+var positiveInteger = (name, value) => {
+  if (!(Number.isInteger(value) && value > 0)) {
+    throw new BatchworkError(`batchwork: limits.${name} must be a positive integer.`);
   }
+  return value;
+};
+var resolveBatchLimits = (limits) => ({
+  captureConcurrency: positiveInteger("captureConcurrency", limits?.captureConcurrency ?? DEFAULT_LIMITS.captureConcurrency),
+  maxRequestBytes: positiveInteger("maxRequestBytes", limits?.maxRequestBytes ?? DEFAULT_LIMITS.maxRequestBytes),
+  maxRequests: positiveInteger("maxRequests", limits?.maxRequests ?? DEFAULT_LIMITS.maxRequests),
+  maxUploadBytes: positiveInteger("maxUploadBytes", limits?.maxUploadBytes ?? DEFAULT_LIMITS.maxUploadBytes)
+});
+var byteLength = (value) => encoder.encode(value).length;
+var assertByteCount = (label, bytes, maxBytes) => {
+  if (bytes > maxBytes) {
+    throw new BatchworkError(`batchwork: ${label} is ${bytes} bytes, exceeding the ${maxBytes} byte limit.`);
+  }
+};
+var assertByteLength = (label, value, maxBytes) => {
+  assertByteCount(label, byteLength(value), maxBytes);
+};
+var mapWithConcurrency = async (items, concurrency, mapper) => {
+  const results = [];
+  results.length = items.length;
+  let nextIndex = 0;
+  const workerCount = Math.min(concurrency, items.length);
+  const runNext = async () => {
+    const index = nextIndex;
+    nextIndex += 1;
+    if (index >= items.length) {
+      return;
+    }
+    results[index] = await mapper(items[index]);
+    await runNext();
+  };
+  await Promise.all(Array.from({ length: workerCount }, () => runNext()));
+  return results;
 };
-var assertOk = async (url, init, response) => {
+
+// src/http.ts
+var assertOk = (url, init, response) => {
   if (!response.ok) {
-    const detail = await safeText(response);
-    throw new BatchworkError(`batchwork: ${init.method ?? "GET"} ${url} failed with ${response.status}: ${detail}`);
+    throw new BatchworkError(`batchwork: ${init.method ?? "GET"} ${url} failed with ${response.status}.`);
   }
 };
 var requestJson = async (url, init) => {
   const response = await fetch(url, init);
-  await assertOk(url, init, response);
+  assertOk(url, init, response);
   return await response.json();
 };
 var requestStream = async (url, init) => {
   const response = await fetch(url, init);
-  await assertOk(url, init, response);
+  assertOk(url, init, response);
   if (!response.body) {
     throw new BatchworkError(`batchwork: ${url} returned an empty body.`);
   }
@@ -134,12 +178,60 @@ var requestStream = async (url, init) => {
 // src/jsonl.ts
 var NEWLINE = `
 `;
-var encodeJsonl = (items) => {
+var DEFAULT_MAX_JSONL_LINE_BYTES = 20 * 1024 * 1024;
+var NEWLINE_BYTES = byteLength(NEWLINE);
+var resolveMaxLineBytes = (options) => {
+  const maxLineBytes = options?.maxLineBytes ?? DEFAULT_MAX_JSONL_LINE_BYTES;
+  if (!(Number.isInteger(maxLineBytes) && maxLineBytes > 0)) {
+    throw new BatchworkError("batchwork: JSONL maxLineBytes must be a positive integer.");
+  }
+  return maxLineBytes;
+};
+var assertLineSize = (line, lineNumber, maxLineBytes) => {
+  const bytes = byteLength(line);
+  if (bytes > maxLineBytes) {
+    throw new BatchworkError(`batchwork: JSONL line ${lineNumber} is ${bytes} bytes, exceeding the ${maxLineBytes} byte limit.`);
+  }
+};
+var parseLine = (line, lineNumber, maxLineBytes) => {
+  assertLineSize(line, lineNumber, maxLineBytes);
+  const trimmed = line.trim();
+  if (trimmed.length === 0) {
+    return;
+  }
+  try {
+    return JSON.parse(trimmed);
+  } catch (error) {
+    throw new BatchworkError(`batchwork: invalid JSONL at line ${lineNumber}.`, { cause: error });
+  }
+};
+var resolveMaxBytes = (options) => {
+  const maxBytes = options?.maxBytes;
+  if (maxBytes !== undefined && !(Number.isInteger(maxBytes) && maxBytes > 0)) {
+    throw new BatchworkError("batchwork: JSONL maxBytes must be a positive integer.");
+  }
+  return maxBytes;
+};
+var encodeJsonl = (items, options) => {
   if (items.length === 0) {
     return "";
   }
-  const body = items.map((item) => JSON.stringify(item)).join(NEWLINE);
-  return `${body}${NEWLINE}`;
+  const lines = [];
+  const maxBytes = resolveMaxBytes(options);
+  const label = options?.label ?? "JSONL";
+  let bytes = 0;
+  for (const item of items) {
+    const line = JSON.stringify(item);
+    if (line === undefined) {
+      throw new BatchworkError(`batchwork: ${label} contains a value that cannot be JSON encoded.`);
+    }
+    bytes += byteLength(line) + NEWLINE_BYTES;
+    if (maxBytes !== undefined) {
+      assertByteCount(label, bytes, maxBytes);
+    }
+    lines.push(line);
+  }
+  return `${lines.join(NEWLINE)}${NEWLINE}`;
 };
 var isReadableStream = (source) => ("getReader" in source) && typeof source.getReader === "function";
 async function* toByteIterable(source) {
@@ -160,28 +252,59 @@ async function* toByteIterable(source) {
   }
   yield* source;
 }
-async function* streamJsonl(source) {
+async function* streamJsonl(source, options) {
   const decoder = new TextDecoder;
+  const maxLineBytes = resolveMaxLineBytes(options);
   let buffer = "";
+  let lineNumber = 1;
   for await (const chunk of toByteIterable(source)) {
     buffer += decoder.decode(chunk, { stream: true });
     let newlineIndex = buffer.indexOf(NEWLINE);
     while (newlineIndex !== -1) {
-      const line = buffer.slice(0, newlineIndex).trim();
+      const line = buffer.slice(0, newlineIndex);
       buffer = buffer.slice(newlineIndex + 1);
-      if (line.length > 0) {
-        yield JSON.parse(line);
+      const parsed2 = parseLine(line, lineNumber, maxLineBytes);
+      if (parsed2 !== undefined) {
+        yield parsed2;
       }
+      lineNumber += 1;
       newlineIndex = buffer.indexOf(NEWLINE);
     }
+    assertLineSize(buffer, lineNumber, maxLineBytes);
   }
   buffer += decoder.decode();
-  const tail = buffer.trim();
-  if (tail.length > 0) {
-    yield JSON.parse(tail);
+  const parsed = parseLine(buffer, lineNumber, maxLineBytes);
+  if (parsed !== undefined) {
+    yield parsed;
   }
 }
 
+// src/payload.ts
+var encodeJsonArrayPayload = ({
+  items,
+  label,
+  maxBytes,
+  prefix,
+  suffix
+}) => {
+  const encodedItems = [];
+  let bytes = byteLength(prefix) + byteLength(suffix);
+  assertByteCount(label, bytes, maxBytes);
+  for (const [index, item] of items.entries()) {
+    const encoded = JSON.stringify(item);
+    if (encoded === undefined) {
+      throw new BatchworkError(`batchwork: ${label} contains a value that cannot be JSON encoded.`);
+    }
+    bytes += byteLength(encoded);
+    if (index > 0) {
+      bytes += 1;
+    }
+    assertByteCount(label, bytes, maxBytes);
+    encodedItems.push(encoded);
+  }
+  return `${prefix}${encodedItems.join(",")}${suffix}`;
+};
+
 // src/util.ts
 var asRecord = (value) => {
   if (typeof value === "object" && value !== null) {
@@ -192,6 +315,13 @@ var asRecord = (value) => {
 var asString = (value) => typeof value === "string" ? value : undefined;
 var asNumber = (value) => typeof value === "number" ? value : undefined;
 var asArray = (value) => Array.isArray(value) ? value : [];
+var asNumberArray = (value) => {
+  if (!Array.isArray(value) || value.length === 0) {
+    return;
+  }
+  const numbers = value.filter((item) => typeof item === "number");
+  return numbers.length === value.length ? numbers : undefined;
+};
 var omit = (obj, key) => {
   const result = {};
   for (const [k, v] of Object.entries(obj)) {
@@ -201,13 +331,30 @@ var omit = (obj, key) => {
   }
   return result;
 };
+var validDate = (date) => Number.isNaN(date.getTime()) ? undefined : date;
 var toDate = (value) => {
   if (typeof value === "string") {
-    return new Date(value);
+    return validDate(new Date(value));
   }
   if (typeof value === "number") {
-    return new Date(value * 1000);
+    return validDate(new Date(value * 1000));
+  }
+};
+
+// src/providers/ids.ts
+var SIMPLE_PROVIDER_ID = /^[A-Za-z0-9_-]+$/u;
+var assertSimpleProviderId = (label, id) => {
+  if (!SIMPLE_PROVIDER_ID.test(id)) {
+    throw new BatchworkError(`batchwork: invalid ${label}.`);
   }
+  return id;
+};
+var assertPrefixedProviderId = (label, id, prefix) => {
+  const [actualPrefix, value, ...rest] = id.split("/");
+  if (rest.length > 0 || actualPrefix !== prefix || !value || !SIMPLE_PROVIDER_ID.test(value)) {
+    throw new BatchworkError(`batchwork: invalid ${label}.`);
+  }
+  return id;
 };
 
 // src/providers/anthropic.ts
@@ -221,6 +368,25 @@ var apiKey = (credentials) => {
   return key;
 };
 var baseUrl = (credentials) => credentials.baseURL ?? ANTHROPIC_BASE;
+var validateResultsUrl = (rawUrl, credentials) => {
+  let resultsUrl;
+  let expectedBase;
+  try {
+    resultsUrl = new URL(rawUrl);
+    expectedBase = new URL(baseUrl(credentials));
+  } catch (error) {
+    throw new BatchworkError("batchwork: invalid Anthropic results_url.", {
+      cause: error
+    });
+  }
+  if (resultsUrl.origin !== expectedBase.origin) {
+    throw new BatchworkError("batchwork: Anthropic results_url must match the configured API origin.");
+  }
+  if (resultsUrl.username || resultsUrl.password) {
+    throw new BatchworkError("batchwork: Anthropic results_url must not include credentials.");
+  }
+  return resultsUrl.toString();
+};
 var headers = (credentials) => ({
   "anthropic-version": ANTHROPIC_VERSION,
   "content-type": "application/json",
@@ -313,19 +479,28 @@ var normalizeResult = (line) => {
   return { customId, status: "canceled" };
 };
 var submit = async (input) => {
+  const limits = resolveBatchLimits(input.limits);
   const requests = input.built.map((item) => ({
     custom_id: item.customId,
     params: omit(item.body, "stream")
   }));
+  const body = encodeJsonArrayPayload({
+    items: requests,
+    label: "batch upload payload",
+    maxBytes: limits.maxUploadBytes,
+    prefix: '{"requests":[',
+    suffix: "]}"
+  });
   const raw = await requestJson(`${baseUrl(input.credentials)}/v1/messages/batches`, {
-    body: JSON.stringify({ requests }),
+    body,
     headers: headers(input.credentials),
     method: "POST"
   });
   return normalizeSnapshot(raw);
 };
 var retrieve = async (id, credentials) => {
-  const raw = await requestJson(`${baseUrl(credentials)}/v1/messages/batches/${id}`, { headers: headers(credentials) });
+  const batchId = assertSimpleProviderId("Anthropic batch id", id);
+  const raw = await requestJson(`${baseUrl(credentials)}/v1/messages/batches/${batchId}`, { headers: headers(credentials) });
   return normalizeSnapshot(raw);
 };
 async function* results(id, credentials) {
@@ -334,15 +509,17 @@ async function* results(id, credentials) {
   if (!resultsUrl) {
     throw new BatchworkError(`batchwork: results are not ready for batch "${id}" (status: ${snapshot.status}).`);
   }
-  const stream = await requestStream(resultsUrl, {
-    headers: headers(credentials)
+  const stream = await requestStream(validateResultsUrl(resultsUrl, credentials), {
+    headers: headers(credentials),
+    redirect: "manual"
   });
   for await (const line of streamJsonl(stream)) {
     yield normalizeResult(line);
   }
 }
 var cancel = async (id, credentials) => {
-  await requestJson(`${baseUrl(credentials)}/v1/messages/batches/${id}/cancel`, {
+  const batchId = assertSimpleProviderId("Anthropic batch id", id);
+  await requestJson(`${baseUrl(credentials)}/v1/messages/batches/${batchId}/cancel`, {
     headers: headers(credentials),
     method: "POST"
   });
@@ -357,6 +534,7 @@ var anthropicAdapter = {
 
 // src/providers/google.ts
 var GOOGLE_BASE = "https://generativelanguage.googleapis.com/v1beta";
+var GOOGLE_BATCH_PREFIX = "batches";
 var apiKey2 = (credentials) => {
   const key = credentials.apiKey ?? process.env.GOOGLE_GENERATIVE_AI_API_KEY ?? process.env.GEMINI_API_KEY;
   if (!key) {
@@ -414,8 +592,9 @@ var normalizeSnapshot2 = (raw) => {
   const obj = asRecord(raw);
   const items = inlinedResponses(raw);
   const failed = items.filter((item) => asRecord(item).error).length;
+  const id = asString(obj.name) ?? "";
   return {
-    id: asString(obj.name) ?? "",
+    id: id ? assertPrefixedProviderId("Google operation id", id, GOOGLE_BATCH_PREFIX) : "",
     provider: "google",
     raw,
     requestCounts: {
@@ -431,6 +610,7 @@ var textFromResponse = (response) => {
   const text = asArray(asRecord(candidate.content).parts).map((part) => asString(asRecord(part).text) ?? "").join("");
   return text.length > 0 ? text : undefined;
 };
+var embeddingFromResponse = (response) => asNumberArray(asRecord(asRecord(response).embedding).values);
 var usageFromResponse = (response) => {
   const usage = asRecord(asRecord(response).usageMetadata);
   const inputTokens = asNumber(usage.promptTokenCount);
@@ -463,31 +643,61 @@ var normalizeResult2 = (item) => {
   }
   return {
     customId,
+    embedding: embeddingFromResponse(obj.response),
     response: obj.response,
     status: "succeeded",
     text: textFromResponse(obj.response),
     usage: usageFromResponse(obj.response)
   };
 };
+var EMBED_CONFIG_KEYS = new Set([
+  "outputDimensionality",
+  "taskType",
+  "title"
+]);
+var toEmbedRequest = (body) => {
+  const request = {};
+  const config = {};
+  for (const [key, value] of Object.entries(body)) {
+    if (EMBED_CONFIG_KEYS.has(key)) {
+      config[key] = value;
+    } else {
+      request[key] = value;
+    }
+  }
+  if (Object.keys(config).length > 0) {
+    request.embedContentConfig = config;
+  }
+  return request;
+};
 var submit2 = async (input) => {
-  const requests = input.built.map((item) => ({
-    metadata: { key: item.customId },
-    request: omit(item.body, "stream")
-  }));
-  const raw = await requestJson(`${baseUrl2(input.credentials)}/models/${input.modelId}:batchGenerateContent`, {
-    body: JSON.stringify({
-      batch: {
-        display_name: "batchwork",
-        input_config: { requests: { requests } }
-      }
-    }),
+  const limits = resolveBatchLimits(input.limits);
+  const isEmbedding = input.endpoint.toLowerCase().includes("embedcontent");
+  const method = isEmbedding ? "asyncBatchEmbedContent" : "batchGenerateContent";
+  const requests = input.built.map((item) => {
+    const payload = omit(item.body, "stream");
+    return {
+      metadata: { key: item.customId },
+      request: isEmbedding ? toEmbedRequest(payload) : payload
+    };
+  });
+  const body = encodeJsonArrayPayload({
+    items: requests,
+    label: "batch upload payload",
+    maxBytes: limits.maxUploadBytes,
+    prefix: '{"batch":{"display_name":"batchwork","input_config":{"requests":{"requests":[',
+    suffix: "]}}}}"
+  });
+  const raw = await requestJson(`${baseUrl2(input.credentials)}/models/${input.modelId}:${method}`, {
+    body,
     headers: headers2(input.credentials),
     method: "POST"
   });
   return normalizeSnapshot2(raw);
 };
 var retrieve2 = async (id, credentials) => {
-  const raw = await requestJson(`${baseUrl2(credentials)}/${id}`, {
+  const operationId = assertPrefixedProviderId("Google operation id", id, GOOGLE_BATCH_PREFIX);
+  const raw = await requestJson(`${baseUrl2(credentials)}/${operationId}`, {
     headers: headers2(credentials)
   });
   return normalizeSnapshot2(raw);
@@ -510,7 +720,8 @@ async function* results2(id, credentials) {
   }
 }
 var cancel2 = async (id, credentials) => {
-  await requestJson(`${baseUrl2(credentials)}/${id}:cancel`, {
+  const operationId = assertPrefixedProviderId("Google operation id", id, GOOGLE_BATCH_PREFIX);
+  await requestJson(`${baseUrl2(credentials)}/${operationId}:cancel`, {
     headers: headers2(credentials),
     method: "POST"
   });
@@ -544,6 +755,13 @@ var textFromBody = (body) => {
   }
   return asString(obj.output_text);
 };
+var embeddingFromBody = (body) => {
+  const data = asArray(asRecord(body).data);
+  if (data.length === 0) {
+    return;
+  }
+  return asNumberArray(asRecord(data[0]).embedding);
+};
 var usageFromBody = (body) => {
   const usage = asRecord(asRecord(body).usage);
   const inputTokens = asNumber(usage.prompt_tokens) ?? asNumber(usage.input_tokens);
@@ -584,6 +802,7 @@ var normalizeOpenAIResult = (line) => {
   if (statusCode >= HTTP_OK_MIN && statusCode < HTTP_OK_MAX) {
     return {
       customId,
+      embedding: embeddingFromBody(response.body),
       response: response.body,
       status: "succeeded",
       text: textFromBody(response.body),
@@ -607,13 +826,15 @@ var uploadInputFile = async (jsonl, baseUrl3, headers3, options = {}) => {
   const raw = await requestJson(`${baseUrl3}/files`, {
     body: form,
     headers: headers3,
-    method: "POST"
+    method: "POST",
+    redirect: "manual"
   });
   return raw.id;
 };
 async function* streamResultFile(fileId, baseUrl3, headers3) {
   const stream = await requestStream(`${baseUrl3}/files/${fileId}/content`, {
-    headers: headers3
+    headers: headers3,
+    redirect: "manual"
   });
   for await (const line of streamJsonl(stream)) {
     yield normalizeOpenAIResult(line);
@@ -669,6 +890,7 @@ var createOpenAICompatibleAdapter = (config) => {
     ...credentials.headers
   });
   const submit3 = async (input) => {
+    const limits = resolveBatchLimits(input.limits);
     const endpoint = config.normalizeEndpoint ? config.normalizeEndpoint(input.endpoint) : input.endpoint;
     const jsonl = encodeJsonl(input.built.map((item) => {
       const body = omit(item.body, "stream");
@@ -681,7 +903,7 @@ var createOpenAICompatibleAdapter = (config) => {
         method: "POST",
         url: endpoint
       };
-    }));
+    }), { label: "batch upload JSONL", maxBytes: limits.maxUploadBytes });
     const headers3 = authHeaders(input.credentials);
     const url = baseUrl3(input.credentials);
     const purpose = config.filePurpose ?? "batch";
@@ -699,7 +921,8 @@ var createOpenAICompatibleAdapter = (config) => {
     return normalizeSnapshot3(raw, config.id);
   };
   const retrieve3 = async (id, credentials) => {
-    const raw = await requestJson(`${baseUrl3(credentials)}/batches/${id}`, {
+    const batchId = assertSimpleProviderId(`${config.id} batch id`, id);
+    const raw = await requestJson(`${baseUrl3(credentials)}/batches/${batchId}`, {
       headers: authHeaders(credentials)
     });
     return normalizeSnapshot3(raw, config.id);
@@ -714,14 +937,15 @@ var createOpenAICompatibleAdapter = (config) => {
     }
     const headers3 = authHeaders(credentials);
     if (outputFileId) {
-      yield* streamResultFile(outputFileId, baseUrl3(credentials), headers3);
+      yield* streamResultFile(assertSimpleProviderId(`${config.id} output file id`, outputFileId), baseUrl3(credentials), headers3);
     }
     if (errorFileId) {
-      yield* streamResultFile(errorFileId, baseUrl3(credentials), headers3);
+      yield* streamResultFile(assertSimpleProviderId(`${config.id} error file id`, errorFileId), baseUrl3(credentials), headers3);
     }
   }
   const cancel3 = async (id, credentials) => {
-    await requestJson(`${baseUrl3(credentials)}/batches/${id}/cancel`, {
+    const batchId = assertSimpleProviderId(`${config.id} batch id`, id);
+    await requestJson(`${baseUrl3(credentials)}/batches/${batchId}/cancel`, {
       headers: authHeaders(credentials),
       method: "POST"
     });
@@ -776,10 +1000,11 @@ var normalizeSnapshot4 = (raw) => {
   const obj = asRecord(raw);
   const succeeded = asNumber(obj.succeeded_requests) ?? 0;
   const failed = asNumber(obj.failed_requests) ?? 0;
+  const id = asString(obj.id) ?? "";
   return {
     completedAt: toDate(obj.completed_at),
     createdAt: toDate(obj.created_at),
-    id: asString(obj.id) ?? "",
+    id: id ? assertSimpleProviderId("Mistral job id", id) : "",
     provider: "mistral",
     raw,
     requestCounts: {
@@ -791,10 +1016,11 @@ var normalizeSnapshot4 = (raw) => {
   };
 };
 var submit3 = async (input) => {
+  const limits = resolveBatchLimits(input.limits);
   const jsonl = encodeJsonl(input.built.map((item) => ({
     body: omit(omit(item.body, "stream"), "model"),
     custom_id: item.customId
-  })));
+  })), { label: "batch upload JSONL", maxBytes: limits.maxUploadBytes });
   const inputFileId = await uploadInputFile(jsonl, baseUrl3(input.credentials), authHeaders(input.credentials));
   const raw = await requestJson(`${baseUrl3(input.credentials)}/batch/jobs`, {
     body: JSON.stringify({
@@ -812,7 +1038,8 @@ var submit3 = async (input) => {
   return normalizeSnapshot4(raw);
 };
 var retrieve3 = async (id, credentials) => {
-  const raw = await requestJson(`${baseUrl3(credentials)}/batch/jobs/${id}`, {
+  const jobId = assertSimpleProviderId("Mistral job id", id);
+  const raw = await requestJson(`${baseUrl3(credentials)}/batch/jobs/${jobId}`, {
     headers: authHeaders(credentials)
   });
   return normalizeSnapshot4(raw);
@@ -824,17 +1051,18 @@ async function* results3(id, credentials) {
   const errorFileId = asString(raw.error_file);
   const headers3 = authHeaders(credentials);
   if (outputFileId) {
-    yield* streamResultFile(outputFileId, baseUrl3(credentials), headers3);
+    yield* streamResultFile(assertSimpleProviderId("Mistral output file id", outputFileId), baseUrl3(credentials), headers3);
   }
   if (errorFileId) {
-    yield* streamResultFile(errorFileId, baseUrl3(credentials), headers3);
+    yield* streamResultFile(assertSimpleProviderId("Mistral error file id", errorFileId), baseUrl3(credentials), headers3);
   }
   if (!(outputFileId || errorFileId)) {
     throw new BatchworkError(`batchwork: results are not ready for batch "${id}" (status: ${snapshot.status}).`);
   }
 }
 var cancel3 = async (id, credentials) => {
-  await requestJson(`${baseUrl3(credentials)}/batch/jobs/${id}/cancel`, {
+  const jobId = assertSimpleProviderId("Mistral job id", id);
+  await requestJson(`${baseUrl3(credentials)}/batch/jobs/${jobId}/cancel`, {
     headers: authHeaders(credentials),
     method: "POST"
   });
@@ -859,12 +1087,44 @@ var openaiAdapter = createOpenAICompatibleAdapter({
 // src/providers/together.ts
 var INPUT_FILE_NAME = "batchwork.jsonl";
 var HTTP_FOUND = 302;
-var safeText2 = async (response) => {
+var parseIpv4 = (host) => {
+  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(host)) {
+    return;
+  }
+  const parts = host.split(".").map(Number);
+  const valid = parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255);
+  return valid ? parts : undefined;
+};
+var isPrivateIpv4 = (parts) => {
+  const [a = 0, b = 0] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
+};
+var isPrivateIpv6 = (host) => {
+  const normalized = host.replace(/^\[/u, "").replace(/\]$/u, "").toLowerCase();
+  if (!normalized.includes(":")) {
+    return false;
+  }
+  return normalized === "::" || normalized === "::1" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:");
+};
+var validateUploadLocation = (location) => {
+  let url;
   try {
-    return await response.text();
-  } catch {
-    return "<no body>";
+    url = new URL(location);
+  } catch (error) {
+    throw new BatchworkError("batchwork: Together upload Location must be a valid URL.", { cause: error });
   }
+  if (url.protocol !== "https:") {
+    throw new BatchworkError("batchwork: Together upload Location must use https.");
+  }
+  if (url.username || url.password) {
+    throw new BatchworkError("batchwork: Together upload Location must not include credentials.");
+  }
+  const host = url.hostname.toLowerCase();
+  const ipv4 = parseIpv4(host);
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || ipv4 && isPrivateIpv4(ipv4) || isPrivateIpv6(host)) {
+    throw new BatchworkError("batchwork: Together upload Location must not target localhost or private networks.");
+  }
+  return url.toString();
 };
 var uploadTogetherFile = async (args) => {
   const metadata = new FormData;
@@ -880,17 +1140,23 @@ var uploadTogetherFile = async (args) => {
   const location = init.headers.get("location");
   const fileId = init.headers.get("x-together-file-id");
   if (init.status !== HTTP_FOUND || !(location && fileId)) {
-    throw new BatchworkError(`batchwork: Together upload could not be initiated (${init.status}): ${await safeText2(init)}`);
+    throw new BatchworkError(`batchwork: Together upload could not be initiated (${init.status}).`);
   }
-  const upload = await fetch(location, { body: args.jsonl, method: "PUT" });
+  const uploadLocation = validateUploadLocation(location);
+  const upload = await fetch(uploadLocation, {
+    body: args.jsonl,
+    method: "PUT",
+    redirect: "manual"
+  });
   if (!upload.ok) {
-    throw new BatchworkError(`batchwork: Together file upload failed (${upload.status}): ${await safeText2(upload)}`);
+    throw new BatchworkError(`batchwork: Together file upload failed (${upload.status}).`);
   }
-  await requestJson(`${args.baseUrl}/files/${fileId}/preprocess`, {
+  const safeFileId = assertSimpleProviderId("Together file id", fileId);
+  await requestJson(`${args.baseUrl}/files/${safeFileId}/preprocess`, {
     headers: args.headers,
     method: "POST"
   });
-  return fileId;
+  return safeFileId;
 };
 var togetherAdapter = createOpenAICompatibleAdapter({
   apiKeyEnv: "TOGETHER_API_KEY",
@@ -932,11 +1198,12 @@ var deriveStatus = (state) => {
 var normalizeSnapshot5 = (raw) => {
   const obj = asRecord(raw);
   const state = asRecord(obj.state);
+  const id = asString(obj.batch_id) ?? asString(obj.id) ?? "";
   return {
-    completedAt: toDate(obj.cancel_time),
+    completedAt: toDate(obj.finish_time ?? obj.completed_at),
     createdAt: toDate(obj.create_time),
     expiresAt: toDate(obj.expire_time ?? obj.expires_at),
-    id: asString(obj.batch_id) ?? asString(obj.id) ?? "",
+    id: id ? assertSimpleProviderId("xAI batch id", id) : "",
     provider: "xai",
     raw,
     requestCounts: {
@@ -977,12 +1244,13 @@ var normalizeResult3 = (item) => {
   };
 };
 var submit4 = async (input) => {
+  const limits = resolveBatchLimits(input.limits);
   const jsonl = encodeJsonl(input.built.map((item) => ({
     body: omit(item.body, "stream"),
     custom_id: item.customId,
     method: "POST",
     url: input.endpoint
-  })));
+  })), { label: "batch upload JSONL", maxBytes: limits.maxUploadBytes });
   const inputFileId = await uploadInputFile(jsonl, baseUrl4(input.credentials), authHeaders2(input.credentials), { purpose: null });
   const raw = await requestJson(`${baseUrl4(input.credentials)}/batches`, {
     body: JSON.stringify({ input_file_id: inputFileId, name: "batchwork" }),
@@ -995,12 +1263,14 @@ var submit4 = async (input) => {
   return normalizeSnapshot5(raw);
 };
 var retrieve4 = async (id, credentials) => {
-  const raw = await requestJson(`${baseUrl4(credentials)}/batches/${id}`, {
+  const batchId = assertSimpleProviderId("xAI batch id", id);
+  const raw = await requestJson(`${baseUrl4(credentials)}/batches/${batchId}`, {
     headers: authHeaders2(credentials)
   });
   return normalizeSnapshot5(raw);
 };
 async function* results4(id, credentials) {
+  const batchId = assertSimpleProviderId("xAI batch id", id);
   const headers3 = authHeaders2(credentials);
   let token;
   do {
@@ -1008,7 +1278,7 @@ async function* results4(id, credentials) {
     if (token) {
       query.set("pagination_token", token);
     }
-    const raw = await requestJson(`${baseUrl4(credentials)}/batches/${id}/results?${query.toString()}`, { headers: headers3 });
+    const raw = await requestJson(`${baseUrl4(credentials)}/batches/${batchId}/results?${query.toString()}`, { headers: headers3 });
     const page = asRecord(raw);
     for (const item of Array.isArray(page.results) ? page.results : []) {
       yield normalizeResult3(item);
@@ -1017,7 +1287,8 @@ async function* results4(id, credentials) {
   } while (token);
 }
 var cancel4 = async (id, credentials) => {
-  await requestJson(`${baseUrl4(credentials)}/batches/${id}:cancel`, {
+  const batchId = assertSimpleProviderId("xAI batch id", id);
+  await requestJson(`${baseUrl4(credentials)}/batches/${batchId}:cancel`, {
     headers: authHeaders2(credentials),
     method: "POST"
   });
@@ -1042,7 +1313,7 @@ var adapters = {
 };
 var getAdapter = (provider) => adapters[provider];
 
-export { BatchworkError, UnsupportedProviderError, MissingDependencyError, isTerminalStatus, BatchJob, getAdapter };
+export { BatchworkError, UnsupportedProviderError, MissingDependencyError, resolveBatchLimits, assertByteLength, mapWithConcurrency, isTerminalStatus, BatchJob, getAdapter };
 
-//# debugId=DA60AE45A8F12B3C64756E2164756E21
-//# sourceMappingURL=chunk-kv3847wy.js.map
+//# debugId=A771CB719D6F2AEA64756E2164756E21
+//# sourceMappingURL=chunk-xtk2ycy6.js.map