langwatch 0.29.0 → 0.30.0

package/dist/chunk-YN2GYHG3.js

@@ -0,0 +1,285 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkA7T4DZKCjs = require('./chunk-A7T4DZKC.js');
+
+
+var _chunk5B7IKUNGjs = require('./chunk-5B7IKUNG.js');
+
+
+
+
+var _chunkIBUFY5TJjs = require('./chunk-IBUFY5TJ.js');
+
+
+var _chunkBRPEG3YQjs = require('./chunk-BRPEG3YQ.js');
+
+// src/cli/utils/governance/wrapper.ts
+var _child_process = require('child_process');
+
+// src/cli/utils/governance/budget.ts
+async function checkBudget(cfg, opts = {}) {
+  var _a, _b;
+  if (!cfg.access_token) return null;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
+  let res;
+  try {
+    res = await f(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${cfg.access_token}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (e) {
+    return null;
+  }
+  if (res.status === 200) return null;
+  if (res.status === 404) return null;
+  if (res.status === 402) {
+    try {
+      const body = await res.json();
+      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
+    } catch (e) {
+    }
+  }
+  return null;
+}
+var PERIOD_LABEL = {
+  minute: "per-minute",
+  hour: "hourly",
+  day: "daily",
+  week: "weekly",
+  month: "monthly",
+  total: "total"
+};
+function renderBudgetExceeded(e) {
+  var _a;
+  const period = (e.period || "month").toLowerCase();
+  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
+  const lines = [];
+  lines.push("\u26A0  Budget limit reached");
+  lines.push("");
+  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
+  lines.push("   To continue, ask your team admin to raise your limit.");
+  lines.push("");
+  if (e.admin_email) {
+    lines.push(`   Admin: ${e.admin_email}`);
+    lines.push("");
+  }
+  lines.push("   Need urgent access? Run:");
+  lines.push("     langwatch request-increase");
+  return lines.join("\n") + "\n";
+}
+
+// src/cli/utils/governance/wrapper.ts
+function envForTool(cfg, tool) {
+  var _a;
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
+  if (!auth) return { vars: {} };
+  switch (tool) {
+    case "claude":
+      return {
+        vars: {
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        }
+      };
+    case "codex":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth
+        }
+      };
+    case "cursor":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        }
+      };
+    case "gemini":
+      return {
+        vars: {
+          GOOGLE_GENAI_API_BASE: gw,
+          GEMINI_API_KEY: auth
+        }
+      };
+    case "opencode":
+      return {
+        vars: {
+          OPENAI_BASE_URL: gw,
+          OPENAI_API_KEY: auth,
+          ANTHROPIC_BASE_URL: gw,
+          ANTHROPIC_AUTH_TOKEN: auth
+        }
+      };
+    default:
+      return { vars: {} };
+  }
+}
+var TOOL_PROVIDER_FAMILIES = {
+  claude: ["anthropic"],
+  codex: ["openai"],
+  cursor: ["anthropic", "openai"],
+  gemini: ["google", "gemini"],
+  opencode: ["anthropic", "openai"]
+};
+function renderContactFooter(adminEmail) {
+  if (adminEmail) {
+    return `Need help? Contact your LangWatch admin: ${adminEmail}
+`;
+  }
+  return `If you need help, contact your LangWatch admin.
+`;
+}
+async function preflightWrapper(cfg, tool, opts = {}) {
+  var _a, _b, _c, _d, _e;
+  const cp = cfg.control_plane_url.replace(/\/+$/, "");
+  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : (0, _chunk5B7IKUNGjs.getCliBootstrap))(cfg).catch(
+    () => null
+  );
+  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
+  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
+    return {
+      ok: false,
+      message: `No personal virtual key on this account.
+Your organization needs at least one AI provider configured before
+\`langwatch ${tool}\` can route requests.
+If you're an admin, set one up at
+  ${cp}/settings/model-providers
+then run \`langwatch login --device\` to refresh your credentials.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  const gw = cfg.gateway_url.replace(/\/+$/, "");
+  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
+  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
+  try {
+    const res = await f(`${gw}/healthz`, {
+      method: "GET",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) {
+      return {
+        ok: false,
+        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
+The wrapper cannot route \`langwatch ${tool}\` requests until the
+data plane is healthy. Check that the LangWatch gateway is running.
+` + renderContactFooter(adminEmail)
+      };
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Cannot reach AI Gateway at ${gw}
+  ${err.message}
+Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
+if you've deployed it elsewhere.
+` + renderContactFooter(adminEmail)
+    };
+  }
+  const need = TOOL_PROVIDER_FAMILIES[tool];
+  if (need && need.length > 0 && bootstrap && Array.isArray(bootstrap.providers)) {
+    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));
+    const matches = need.filter((n) => have.has(n));
+    if (matches.length === 0) {
+      const list = need.map((n) => `\`${n}\``).join(" or ");
+      return {
+        ok: false,
+        message: `No ${list} provider is configured for your organization.
+\`langwatch ${tool}\` needs at least one to route requests through the gateway.
+If you're an admin, configure one at
+  ${cp}/settings/model-providers
+` + renderContactFooter(adminEmail)
+      };
+    }
+  }
+  return { ok: true };
+}
+function shouldAutoLogin() {
+  const flag = process.env.LANGWATCH_AUTO_LOGIN;
+  if (flag === "1" || flag === "true") return true;
+  if (flag === "0" || flag === "false") return false;
+  return Boolean(process.stdin.isTTY);
+}
+async function runWrapped(tool, args) {
+  var _a, _b;
+  let cfg = _chunkIBUFY5TJjs.loadConfig.call(void 0, );
+  if (!_chunkIBUFY5TJjs.isLoggedIn.call(void 0, cfg)) {
+    if (!shouldAutoLogin()) {
+      process.stderr.write(
+        "Not logged in. Run `langwatch login --device` first.\n"
+      );
+      process.exit(1);
+    }
+    process.stderr.write(
+      "Not logged in. Starting device-flow login...\n"
+    );
+    try {
+      cfg = await _chunkA7T4DZKCjs.runDeviceFlowLogin.call(void 0, { cfg });
+    } catch (err) {
+      process.stderr.write(
+        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
+`
+      );
+      process.exit(1);
+    }
+    if (!_chunkIBUFY5TJjs.isLoggedIn.call(void 0, cfg)) {
+      process.stderr.write("login did not complete \u2014 exiting\n");
+      process.exit(1);
+    }
+  }
+  const exceeded = await checkBudget(cfg);
+  if (exceeded) {
+    process.stderr.write(renderBudgetExceeded(exceeded));
+    if (exceeded.request_increase_url) {
+      cfg.last_request_increase_url = exceeded.request_increase_url;
+      try {
+        _chunkIBUFY5TJjs.saveConfig.call(void 0, cfg);
+      } catch (e) {
+      }
+    }
+    process.exit(2);
+  }
+  const probe = await preflightWrapper(cfg, tool);
+  if (!probe.ok) {
+    process.stderr.write((_b = probe.message) != null ? _b : "preflight failed\n");
+    process.exit(2);
+  }
+  const env = _chunkBRPEG3YQjs.__spreadValues.call(void 0, _chunkBRPEG3YQjs.__spreadValues.call(void 0, {}, process.env), envForTool(cfg, tool).vars);
+  const child = _child_process.spawn.call(void 0, tool, args, {
+    stdio: "inherit",
+    env,
+    shell: process.platform === "win32"
+  });
+  child.on("error", (err) => {
+    if (err.code === "ENOENT") {
+      process.stderr.write(
+        `${tool} not found in PATH \u2014 install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)
+`
+      );
+      process.exit(127);
+    }
+    process.stderr.write(`exec ${tool}: ${err.message}
+`);
+    process.exit(1);
+  });
+  await new Promise((resolve) => {
+    child.on("close", (code) => {
+      process.exit(code != null ? code : 1);
+      resolve();
+    });
+  });
+  process.exit(0);
+}
+
+
+
+
+exports.envForTool = envForTool; exports.runWrapped = runWrapped;
+//# sourceMappingURL=chunk-YN2GYHG3.js.map

package/dist/chunk-YN2GYHG3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-YN2GYHG3.js","../src/cli/utils/governance/wrapper.ts","../src/cli/utils/governance/budget.ts"],"names":[],"mappings":"AAAA;AACE;AACF,sDAA4B;AAC5B;AACE;AACF,sDAA4B;AAC5B;AACE;AACA;AACA;AACF,sDAA4B;AAC5B;AACE;AACF,sDAA4B;AAC5B;AACA;ACCA,8CAAsB;ADCtB;AACA;AEiBA,MAAA,SAAsB,WAAA,CACpB,GAAA,EACA,KAAA,EAA2B,CAAC,CAAA,EACW;AAtCzC,EAAA,IAAA,EAAA,EAAA,EAAA;AAuCE,EAAA,GAAA,CAAI,CAAC,GAAA,CAAI,YAAA,EAAc,OAAO,IAAA;AAC9B,EAAA,MAAM,EAAA,EAAA,CAAI,GAAA,EAAA,IAAA,CAAK,SAAA,EAAA,GAAL,KAAA,EAAA,GAAA,EAAkB,KAAA;AAC5B,EAAA,MAAM,IAAA,EAAM,GAAA,CAAI,iBAAA,CAAkB,OAAA,CAAQ,MAAA,EAAQ,EAAE,EAAA,EAAI,6BAAA;AACxD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,EAAM,MAAM,CAAA,CAAE,GAAA,EAAK;AAAA,MACjB,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,GAAA,CAAI,YAAY,CAAA,CAAA;AACjC,QAAA;AACV,MAAA;AACD,IAAA;AACK,EAAA;AACC,IAAA;AACT,EAAA;AAC+B,EAAA;AACA,EAAA;AACP,EAAA;AAClB,IAAA;AAC2B,MAAA;AACzB,MAAA;AACE,IAAA;AAGR,IAAA;AACF,EAAA;AACO,EAAA;AACT;AAa6C;AACnC,EAAA;AACF,EAAA;AACD,EAAA;AACC,EAAA;AACC,EAAA;AACA,EAAA;AACT;AAEuE;AAxFvE,EAAA;AAyFuC,EAAA;AACE,EAAA;AACd,EAAA;AACW,EAAA;AACvB,EAAA;AAC4B,EAAA;AAC9B,EAAA;AACE,EAAA;AACM,EAAA;AACsB,IAAA;AAC1B,IAAA;AACf,EAAA;AACwC,EAAA;AACI,EAAA;AAClB,EAAA;AAC5B;AF/BkD;AACA;ACzCuB;AAjCzE,EAAA;AAkC+C,EAAA;AAChC,EAAA;AACgB,EAAA;AACf,EAAA;AACP,IAAA;AACI,MAAA;AACC,QAAA;AACgB,UAAA;AACE,UAAA;AACxB,QAAA;AACF,MAAA;AACG,IAAA;AACI,MAAA;AACC,QAAA;AACa,UAAA;AACD,UAAA;AAClB,QAAA;AACF,MAAA;AACG,IAAA;AACI,MAAA;AACC,QAAA;AACa,UAAA;AACD,UAAA;AACI,UAAA;AACE,UAAA;AACxB,QAAA;AACF,MAAA;AACG,IAAA;AACI,MAAA;AACC,QAAA;AACmB,UAAA;AACP,UAAA;AAClB,QAAA;AACF,MAAA;AACG,IAAA;AAKI,MAAA;AACC,QAAA;AACa,UAAA;AACD,UAAA;AACI,UAAA;AACE,UAAA;AACxB,QAAA;AACF,MAAA;AACF,IAAA;AACoB,MAAA;AACtB,EAAA;AACF;AAUyD;AACnC,EAAA;AACJ,EAAA;AACc,EAAA;AACH,EAAA;AACK,EAAA;AAClC;AAsB4E;AAC1D,EAAA;AACP,IAAA;AAAsD;AAC/D,EAAA;AACO,EAAA;AAAA;AACT;AAiC2B;AAhK3B,EAAA;AAkK2C,EAAA;AACX,EAAA;AACtB,IAAA;AACR,EAAA;AACmB,EAAA;AAEd,EAAA;AACI,IAAA;AACD,MAAA;AAEF,MAAA;AAAA;AAEmB,YAAA;AAAA;AAEZ,EAAA;AAAA;AAEuB;AAClC,IAAA;AACF,EAAA;AAE6C,EAAA;AACjB,EAAA;AACV,EAAA;AACd,EAAA;AACmC,IAAA;AAC3B,MAAA;AAC6B,MAAA;AACtC,IAAA;AACY,IAAA;AACJ,MAAA;AACD,QAAA;AAEiB,QAAA;AACyB,qCAAA;AAAA;AAEd;AAClC,MAAA;AACF,IAAA;AACY,EAAA;AACL,IAAA;AACD,MAAA;AAE8B,MAAA;AACL,EAAA;AAAA;AAAA;AAGG;AAClC,IAAA;AACF,EAAA;AAEwC,EAAA;AAKtC,EAAA;AAE8C,IAAA;AACA,IAAA;AACpB,IAAA;AACiB,MAAA;AAClC,MAAA;AACD,QAAA;AAEQ,QAAA;AACS,YAAA;AAAA;AAEZ,EAAA;AACuB;AAClC,MAAA;AACF,IAAA;AACF,EAAA;AAEkB,EAAA;AACpB;AAUoC;AACT,EAAA;AACmB,EAAA;AACC,EAAA;AACX,EAAA;AACpC;AAQ+E;AAnQ/E,EAAA;AAoQuB,EAAA;AACC,EAAA;AACI,IAAA;AACP,MAAA;AACb,QAAA;AACF,MAAA;AACc,MAAA;AAChB,IAAA;AACe,IAAA;AACb,MAAA;AACF,IAAA;AACI,IAAA;AACoC,MAAA;AAC1B,IAAA;AACG,MAAA;AACK,QAAA;AAAwC;AAC5D,MAAA;AACc,MAAA;AAChB,IAAA;AACsB,IAAA;AACC,MAAA;AACP,MAAA;AAChB,IAAA;AACF,EAAA;AAGsC,EAAA;AACxB,EAAA;AAC8B,IAAA;AACP,IAAA;AACQ,MAAA;AACrC,MAAA;AACY,QAAA;AACR,MAAA;AAIR,MAAA;AACF,IAAA;AACc,IAAA;AAChB,EAAA;AAE8C,EAAA;AAC/B,EAAA;AACQ,IAAA;AACP,IAAA;AAChB,EAAA;AAEiB,EAAA;AAMe,EAAA;AACvB,IAAA;AACP,IAAA;AAC4B,IAAA;AAC7B,EAAA;AAC0B,EAAA;AAC6B,IAAA;AACrC,MAAA;AACN,QAAA;AAAA;AACT,MAAA;AACgB,MAAA;AAClB,IAAA;AAC0C,IAAA;AAAW;AACvC,IAAA;AACf,EAAA;AACoC,EAAA;AACP,IAAA;AACJ,MAAA;AACd,MAAA;AACT,IAAA;AACF,EAAA;AAEa,EAAA;AAChB;AD1DkD;AACA;AACA;AACA;AACA","file":"/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-YN2GYHG3.js","sourcesContent":[null,"/**\n * exec wrapper helper for `langwatch claude` / `codex` / `cursor` /\n * `gemini`. Loads the persisted device-flow config, optionally\n * pre-checks the budget (Screen-8 box + exit 2 if exceeded),\n * computes the right env-var pair for the tool, and spawns the\n * underlying binary inheriting stdio so the user keeps their\n * familiar UX.\n *\n * On Unix we use spawn() with stdio:'inherit'; signals (Ctrl-C,\n * SIGTERM) propagate via the child process group. We do NOT use\n * execve replacement — Node's child_process never replaces the\n * current process, but this is functionally equivalent for the\n * end-user (same exit code, same terminal handling) and works on\n * Windows where execve doesn't exist.\n */\n\nimport { spawn } from \"node:child_process\";\nimport type { GovernanceConfig } from \"./config\";\nimport { loadConfig, saveConfig, isLoggedIn } from \"./config\";\nimport { checkBudget, renderBudgetExceeded } from \"./budget\";\nimport { getCliBootstrap } from \"./cli-api\";\nimport { runDeviceFlowLogin } from \"./login-flow\";\n\nexport interface ToolEnv {\n  /** Env-var name → value pairs to inject into the child process. */\n  vars: Record<string, string>;\n}\n\n/**\n * Mirror of the Go CLI's env-injection map. The wrapped tools\n * read these standard env vars (Anthropic, OpenAI, Google) and\n * route through the gateway with the user's personal VK as bearer.\n */\nexport function envForTool(cfg: GovernanceConfig, tool: string): ToolEnv {\n  const gw = cfg.gateway_url.replace(/\\/+$/, \"\");\n  const auth = cfg.default_personal_vk?.secret;\n  if (!auth) return { vars: {} };\n  switch (tool) {\n    case \"claude\":\n      return {\n        vars: {\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    case \"codex\":\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n        },\n      };\n    case \"cursor\":\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    case \"gemini\":\n      return {\n        vars: {\n          GOOGLE_GENAI_API_BASE: gw,\n          GEMINI_API_KEY: auth,\n        },\n      };\n    case \"opencode\":\n      // opencode is multi-provider — it reads the standard\n      // OPENAI_*/ANTHROPIC_* env vars depending on which model the\n      // user selected at the prompt. Mirror cursor's both-pairs\n      // injection so any provider the user hops to lands at our gw.\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    default:\n      return { vars: {} };\n  }\n}\n\n/**\n * Provider families the tool needs upstream. Used by `preflightWrapper`\n * to verify the org has at least one matching provider configured —\n * otherwise the gateway can authenticate the VK but has nothing to\n * route the request to, surfacing as a confusing tool-side error.\n *\n * Multi-provider tools (cursor, opencode) match any listed family.\n */\nconst TOOL_PROVIDER_FAMILIES: Record<string, string[]> = {\n  claude: [\"anthropic\"],\n  codex: [\"openai\"],\n  cursor: [\"anthropic\", \"openai\"],\n  gemini: [\"google\", \"gemini\"],\n  opencode: [\"anthropic\", \"openai\"],\n};\n\nexport interface PreflightResult {\n  ok: boolean;\n  /** Human-readable, action-oriented message rendered to stderr on failure. */\n  message?: string;\n}\n\nexport interface PreflightOptions {\n  fetchImpl?: typeof fetch;\n  bootstrapImpl?: typeof getCliBootstrap;\n  /** Per-probe timeout, ms. Default 3000. */\n  timeoutMs?: number;\n}\n\n/**\n * Render the \"who to talk to\" footer attached to every preflight\n * failure message. Single source of truth so the admin-mailto format\n * stays consistent across the three failure shapes. Bootstrap is the\n * source of `adminEmail`; on legacy servers or unreachable control\n * planes it'll be null and we fall back to a generic line.\n */\nfunction renderContactFooter(adminEmail: string | null | undefined): string {\n  if (adminEmail) {\n    return `Need help? Contact your LangWatch admin: ${adminEmail}\\n`;\n  }\n  return `If you need help, contact your LangWatch admin.\\n`;\n}\n\n/**\n * Pre-exec probe for `langwatch <tool>` wrappers. Three layered checks,\n * each gracefully degrading rather than blocking on transient hiccups:\n *\n *   1. `cfg.default_personal_vk?.secret` present — without it the\n *      wrapper would silently inject no env vars and the underlying\n *      tool would call the upstream provider directly (api.anthropic.com\n *      etc.), surfacing as the wrong error or — when there's stale\n *      env from a prior session — a confusing ConnectionRefused\n *      against a stale base URL.\n *   2. `GET <gateway_url>/healthz` reachable. Catches \"data plane not\n *      running\" and bad `LANGWATCH_GATEWAY_URL` overrides. Fatal: if\n *      the gateway isn't reachable the tool will spin in a retry loop\n *      and there's no recovery. We don't name a specific run command\n *      (`make`, helm chart, docker compose, `npx @langwatch/server`,\n *      etc.) because deployments vary; point the user at the admin\n *      contact instead.\n *   3. `getCliBootstrap()` providers cover the tool's family. Catches\n *      the shape where login succeeds but the org has no AI provider\n *      configured yet, so the gateway has nothing to route to. 404 /\n *      missing-providers data passes through (older self-hosted\n *      servers without the endpoint).\n *\n * Bootstrap is fetched up-front (it lives on the control plane,\n * independent of the gateway data plane) so every failure message can\n * embed the org admin's email as a real contact path. A bootstrap\n * error is non-fatal; we just lose the admin mailto and continue.\n */\nexport async function preflightWrapper(\n  cfg: GovernanceConfig,\n  tool: string,\n  opts: PreflightOptions = {},\n): Promise<PreflightResult> {\n  const cp = cfg.control_plane_url.replace(/\\/+$/, \"\");\n  const bootstrap = await (opts.bootstrapImpl ?? getCliBootstrap)(cfg).catch(\n    () => null,\n  );\n  const adminEmail = bootstrap?.adminEmail ?? null;\n\n  if (!cfg.default_personal_vk?.secret) {\n    return {\n      ok: false,\n      message:\n        `No personal virtual key on this account.\\n` +\n        `Your organization needs at least one AI provider configured before\\n` +\n        `\\`langwatch ${tool}\\` can route requests.\\n` +\n        `If you're an admin, set one up at\\n` +\n        `  ${cp}/settings/model-providers\\n` +\n        `then run \\`langwatch login --device\\` to refresh your credentials.\\n` +\n        renderContactFooter(adminEmail),\n    };\n  }\n\n  const gw = cfg.gateway_url.replace(/\\/+$/, \"\");\n  const f = opts.fetchImpl ?? fetch;\n  const timeoutMs = opts.timeoutMs ?? 3000;\n  try {\n    const res = await f(`${gw}/healthz`, {\n      method: \"GET\",\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n    if (!res.ok) {\n      return {\n        ok: false,\n        message:\n          `AI Gateway at ${gw} returned HTTP ${res.status}.\\n` +\n          `The wrapper cannot route \\`langwatch ${tool}\\` requests until the\\n` +\n          `data plane is healthy. Check that the LangWatch gateway is running.\\n` +\n          renderContactFooter(adminEmail),\n      };\n    }\n  } catch (err) {\n    return {\n      ok: false,\n      message:\n        `Cannot reach AI Gateway at ${gw}\\n` +\n        `  ${(err as Error).message}\\n` +\n        `Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL\\n` +\n        `if you've deployed it elsewhere.\\n` +\n        renderContactFooter(adminEmail),\n    };\n  }\n\n  const need = TOOL_PROVIDER_FAMILIES[tool];\n  if (\n    need &&\n    need.length > 0 &&\n    bootstrap &&\n    Array.isArray(bootstrap.providers)\n  ) {\n    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));\n    const matches = need.filter((n) => have.has(n));\n    if (matches.length === 0) {\n      const list = need.map((n) => `\\`${n}\\``).join(\" or \");\n      return {\n        ok: false,\n        message:\n          `No ${list} provider is configured for your organization.\\n` +\n          `\\`langwatch ${tool}\\` needs at least one to route requests through the gateway.\\n` +\n          `If you're an admin, configure one at\\n` +\n          `  ${cp}/settings/model-providers\\n` +\n          renderContactFooter(adminEmail),\n      };\n    }\n  }\n\n  return { ok: true };\n}\n\n/**\n * When the wrapper is invoked without a usable config, decide whether to\n * auto-trigger the device-flow login inline or to fail fast. The device\n * flow needs a TTY (the user has to copy a code or click a browser link),\n * so default ON only when stdin is a TTY. CI/scripted callers can opt in\n * explicitly via `LANGWATCH_AUTO_LOGIN=1`, or opt out via\n * `LANGWATCH_AUTO_LOGIN=0` even on an interactive shell.\n */\nfunction shouldAutoLogin(): boolean {\n  const flag = process.env.LANGWATCH_AUTO_LOGIN;\n  if (flag === \"1\" || flag === \"true\") return true;\n  if (flag === \"0\" || flag === \"false\") return false;\n  return Boolean(process.stdin.isTTY);\n}\n\n/**\n * Run the named tool routed through the gateway. Inherits stdio so\n * the user gets the same interactive UX they'd have invoking the\n * tool directly. Exits the parent process with the child's exit\n * code (or 2 if the budget pre-check fired).\n */\nexport async function runWrapped(tool: string, args: string[]): Promise<never> {\n  let cfg = loadConfig();\n  if (!isLoggedIn(cfg)) {\n    if (!shouldAutoLogin()) {\n      process.stderr.write(\n        \"Not logged in. Run `langwatch login --device` first.\\n\",\n      );\n      process.exit(1);\n    }\n    process.stderr.write(\n      \"Not logged in. Starting device-flow login...\\n\",\n    );\n    try {\n      cfg = await runDeviceFlowLogin({ cfg });\n    } catch (err) {\n      process.stderr.write(\n        `login failed: ${(err as Error).message ?? \"unknown error\"}\\n`,\n      );\n      process.exit(1);\n    }\n    if (!isLoggedIn(cfg)) {\n      process.stderr.write(\"login did not complete — exiting\\n\");\n      process.exit(1);\n    }\n  }\n\n  // Budget pre-check — render Screen-8 box + exit 2 BEFORE exec.\n  const exceeded = await checkBudget(cfg);\n  if (exceeded) {\n    process.stderr.write(renderBudgetExceeded(exceeded));\n    if (exceeded.request_increase_url) {\n      cfg.last_request_increase_url = exceeded.request_increase_url;\n      try {\n        saveConfig(cfg);\n      } catch {\n        // Config write failure shouldn't change the spec'd exit\n        // code — the next `langwatch request-increase` falls back\n        // to the static page.\n      }\n    }\n    process.exit(2);\n  }\n\n  const probe = await preflightWrapper(cfg, tool);\n  if (!probe.ok) {\n    process.stderr.write(probe.message ?? \"preflight failed\\n\");\n    process.exit(2);\n  }\n\n  const env = { ...process.env, ...envForTool(cfg, tool).vars };\n  // npm installs claude/codex/cursor/gemini as `.cmd` shims on Windows;\n  // bare spawn() can't resolve them without a shell. shell:true is safe\n  // here because `tool` is whitelisted (claude/codex/cursor/gemini) and\n  // `args` is forwarded from the user's own terminal invocation — same\n  // trust boundary as if they'd typed `claude …` directly.\n  const child = spawn(tool, args, {\n    stdio: \"inherit\",\n    env,\n    shell: process.platform === \"win32\",\n  });\n  child.on(\"error\", (err) => {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      process.stderr.write(\n        `${tool} not found in PATH — install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)\\n`,\n      );\n      process.exit(127);\n    }\n    process.stderr.write(`exec ${tool}: ${err.message}\\n`);\n    process.exit(1);\n  });\n  await new Promise<void>((resolve) => {\n    child.on(\"close\", (code) => {\n      process.exit(code ?? 1);\n      resolve();\n    });\n  });\n  // unreachable\n  process.exit(0);\n}\n","/**\n * Pre-exec budget probe + Screen-8 ASCII renderer for the langwatch\n * wrappers (`langwatch claude` / `codex` / `cursor` / `gemini`).\n *\n * Per `specs/ai-gateway/governance/budget-exceeded.feature`: before\n * any wrapped command exec's the underlying tool, the CLI hits\n * `GET /api/auth/cli/budget/status`. On 402, render the spec\n * canonical box and exit 2 (configuration / quota error) without\n * spawning the tool.\n */\n\nimport { type GovernanceConfig } from \"./config\";\n\nexport interface BudgetExceededPayload {\n  type: string;\n  scope: \"user\" | \"team\" | \"org\" | \"project\";\n  limit_usd: string;\n  spent_usd: string;\n  period: string; // \"month\" | \"week\" | \"day\" | ...\n  request_increase_url?: string;\n  admin_email?: string;\n}\n\nexport interface CheckBudgetOptions {\n  fetchImpl?: typeof fetch;\n}\n\n/**\n * Returns the 402 payload if the user is currently blocked, null\n * otherwise. 404 is treated as \"older self-hosted server doesn't\n * expose this endpoint yet — pass through\" so the CLI degrades\n * gracefully against legacy deploys. Network/5xx/etc. also\n * pass-through (the gateway's own 402 will surface via the wrapped\n * tool's error rendering as a fallback).\n */\nexport async function checkBudget(\n  cfg: GovernanceConfig,\n  opts: CheckBudgetOptions = {},\n): Promise<BudgetExceededPayload | null> {\n  if (!cfg.access_token) return null;\n  const f = opts.fetchImpl ?? fetch;\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + \"/api/auth/cli/budget/status\";\n  let res: Response;\n  try {\n    res = await f(url, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${cfg.access_token}`,\n        Accept: \"application/json\",\n      },\n    });\n  } catch {\n    return null; // network error — never block the user on this check\n  }\n  if (res.status === 200) return null;\n  if (res.status === 404) return null; // older server, no endpoint yet\n  if (res.status === 402) {\n    try {\n      const body = (await res.json()) as { error?: BudgetExceededPayload };\n      if (body.error?.type && body.error.scope) return body.error;\n    } catch {\n      // malformed payload — fall through, let the underlying tool's\n      // error render whatever the gateway returns\n    }\n  }\n  return null;\n}\n\n/**\n * Spec-canonical Screen-8 box. ASCII only — no ANSI codes — so\n * piping `langwatch claude | tee log` doesn't litter the log with\n * escape sequences. Lines match the budget-exceeded.feature\n * scenario character-for-character.\n */\n// Gateway emits root-form periods from the `GatewayBudgetWindow` Prisma\n// enum lowercased (\"month\", \"week\", \"day\", \"hour\", \"minute\", \"total\").\n// Naive `${period}ly` produces \"dayly\" / \"totally\" / \"minutely\" — map\n// explicitly. Unknown periods (e.g. older server adds \"rolling_24h\")\n// fall through to the raw value rather than render gibberish.\nconst PERIOD_LABEL: Record<string, string> = {\n  minute: \"per-minute\",\n  hour: \"hourly\",\n  day: \"daily\",\n  week: \"weekly\",\n  month: \"monthly\",\n  total: \"total\",\n};\n\nexport function renderBudgetExceeded(e: BudgetExceededPayload): string {\n  const period = (e.period || \"month\").toLowerCase();\n  const periodLabel = PERIOD_LABEL[period] ?? period;\n  const lines: string[] = [];\n  lines.push(\"⚠  Budget limit reached\");\n  lines.push(\"\");\n  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);\n  lines.push(\"   To continue, ask your team admin to raise your limit.\");\n  lines.push(\"\");\n  if (e.admin_email) {\n    lines.push(`   Admin: ${e.admin_email}`);\n    lines.push(\"\");\n  }\n  lines.push(\"   Need urgent access? Run:\");\n  lines.push(\"     langwatch request-increase\");\n  return lines.join(\"\\n\") + \"\\n\";\n}\n"]}

package/dist/chunk-ZRCDO3D5.mjs

@@ -0,0 +1,92 @@
+import {
+  buildAuthHeaders
+} from "./chunk-SIXSSID3.mjs";
+import {
+  DEFAULT_ENDPOINT
+} from "./chunk-WKK33HHX.mjs";
+import {
+  formatApiErrorMessage
+} from "./chunk-J3KM7ZO7.mjs";
+import {
+  __spreadProps,
+  __spreadValues
+} from "./chunk-BAX4W3AY.mjs";
+
+// src/client-sdk/services/model-defaults/model-defaults-api.service.ts
+var ModelDefaultsApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "ModelDefaultsApiError";
+  }
+};
+var ModelDefaultsApiService = class {
+  constructor(config) {
+    var _a, _b, _c, _d;
+    this.apiKey = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : process.env.LANGWATCH_API_KEY) != null ? _b : "";
+    this.endpoint = (_d = (_c = config == null ? void 0 : config.endpoint) != null ? _c : process.env.LANGWATCH_ENDPOINT) != null ? _d : DEFAULT_ENDPOINT;
+  }
+  async request(path, options) {
+    var _a;
+    const response = await fetch(`${this.endpoint}${path}`, __spreadProps(__spreadValues({}, options), {
+      headers: __spreadValues(__spreadProps(__spreadValues({}, buildAuthHeaders({ apiKey: this.apiKey })), {
+        "Content-Type": "application/json"
+      }), options == null ? void 0 : options.headers)
+    }));
+    if (!response.ok) {
+      const errorText = await response.text();
+      let parsed = errorText;
+      try {
+        parsed = JSON.parse(errorText);
+      } catch (e) {
+      }
+      const message = formatApiErrorMessage({
+        error: parsed,
+        options: { status: response.status }
+      });
+      throw new ModelDefaultsApiError(
+        `HTTP ${response.status}: ${message}`,
+        (_a = options == null ? void 0 : options.method) != null ? _a : "GET",
+        parsed
+      );
+    }
+    if (response.status === 204 || (options == null ? void 0 : options.allowNoContent)) {
+      return void 0;
+    }
+    return response.json();
+  }
+  async getSnapshot() {
+    return this.request("/api/model-defaults");
+  }
+  async createConfig(body) {
+    return this.request("/api/model-defaults", {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  async updateConfig(id, body) {
+    await this.request(
+      `/api/model-defaults/${encodeURIComponent(id)}`,
+      {
+        method: "PUT",
+        body: JSON.stringify(body),
+        allowNoContent: true
+      }
+    );
+  }
+  async deleteConfig(id) {
+    await this.request(
+      `/api/model-defaults/${encodeURIComponent(id)}`,
+      {
+        method: "DELETE",
+        allowNoContent: true
+      }
+    );
+  }
+};
+
+export {
+  ModelDefaultsApiService
+};
+//# sourceMappingURL=chunk-ZRCDO3D5.mjs.map

package/dist/chunk-ZWCPSY4D.mjs

@@ -0,0 +1,85 @@
+import {
+  createLangWatchApiClient
+} from "./chunk-FJHSBSAP.mjs";
+import {
+  extractStatusFromResponse,
+  formatApiErrorForOperation
+} from "./chunk-J3KM7ZO7.mjs";
+
+// src/client-sdk/services/suites/suites-api.service.ts
+var SuitesApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "SuitesApiError";
+  }
+};
+var SuitesApiService = class {
+  constructor(config) {
+    var _a;
+    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : createLangWatchApiClient();
+  }
+  handleApiError(operation, error) {
+    const message = formatApiErrorForOperation({ operation, error, options: {
+      status: extractStatusFromResponse(error)
+    } });
+    throw new SuitesApiError(message, operation, error);
+  }
+  async getAll() {
+    const { data, error } = await this.apiClient.GET("/api/suites");
+    if (error) this.handleApiError("list suites", error);
+    return data;
+  }
+  async get(id) {
+    const { data, error } = await this.apiClient.GET("/api/suites/{id}", {
+      params: { path: { id } }
+    });
+    if (error) this.handleApiError(`get suite "${id}"`, error);
+    return data;
+  }
+  async create(params) {
+    const { data, error } = await this.apiClient.POST("/api/suites", {
+      body: params
+    });
+    if (error) this.handleApiError("create suite", error);
+    return data;
+  }
+  async update(id, params) {
+    const { data, error } = await this.apiClient.PATCH("/api/suites/{id}", {
+      params: { path: { id } },
+      body: params
+    });
+    if (error) this.handleApiError(`update suite "${id}"`, error);
+    return data;
+  }
+  async duplicate(id) {
+    const { data, error } = await this.apiClient.POST("/api/suites/{id}/duplicate", {
+      params: { path: { id } }
+    });
+    if (error) this.handleApiError(`duplicate suite "${id}"`, error);
+    return data;
+  }
+  async run(id, idempotencyKey) {
+    const { data, error } = await this.apiClient.POST("/api/suites/{id}/run", {
+      params: { path: { id } },
+      body: {
+        idempotencyKey: idempotencyKey != null ? idempotencyKey : `cli-${Date.now()}-${Math.random().toString(36).slice(2)}`
+      }
+    });
+    if (error) this.handleApiError(`run suite "${id}"`, error);
+    return data;
+  }
+  async delete(id) {
+    const { data, error } = await this.apiClient.DELETE("/api/suites/{id}", {
+      params: { path: { id } }
+    });
+    if (error) this.handleApiError(`delete suite "${id}"`, error);
+    return data;
+  }
+};
+
+export {
+  SuitesApiService
+};
+//# sourceMappingURL=chunk-ZWCPSY4D.mjs.map