langwatch 0.31.0 → 0.32.0

package/dist/chunk-VBJAWDW3.js

@@ -1,101 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _chunkGAWNPFFXjs = require('./chunk-GAWNPFFX.js');
-
-
-
-var _chunkC5Y772G7js = require('./chunk-C5Y772G7.js');
-
-// src/client-sdk/services/evaluators/errors.ts
-var EvaluatorsApiError = class extends Error {
-  constructor(message, operation, originalError) {
-    super(message);
-    this.operation = operation;
-    this.originalError = originalError;
-    this.name = "EvaluatorsApiError";
-  }
-};
-
-// src/client-sdk/services/evaluators/evaluators-api.service.ts
-var EvaluatorsApiService = class {
-  constructor(config) {
-    var _a;
-    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : _chunkGAWNPFFXjs.createLangWatchApiClient.call(void 0, );
-  }
-  handleApiError(operation, error) {
-    const message = _chunkC5Y772G7js.formatApiErrorForOperation.call(void 0, { operation, error, options: {
-      status: _chunkC5Y772G7js.extractStatusFromResponse.call(void 0, error)
-    } });
-    throw new EvaluatorsApiError(message, operation, error);
-  }
-  /**
-   * Fetches all evaluators for the project.
-   */
-  async getAll() {
-    const { data, error } = await this.apiClient.GET("/api/evaluators");
-    if (error) this.handleApiError("fetch all evaluators", error);
-    return data;
-  }
-  /**
-   * Fetches a single evaluator by its ID or slug.
-   */
-  async get(idOrSlug) {
-    const { data, error } = await this.apiClient.GET(
-      "/api/evaluators/{idOrSlug}",
-      {
-        params: { path: { idOrSlug } }
-      }
-    );
-    if (error)
-      this.handleApiError(
-        `fetch evaluator with ID or slug "${idOrSlug}"`,
-        error
-      );
-    return data;
-  }
-  /**
-   * Creates a new evaluator.
-   */
-  async create(params) {
-    const { data, error } = await this.apiClient.POST("/api/evaluators", {
-      body: params
-    });
-    if (error) this.handleApiError("create evaluator", error);
-    return data;
-  }
-  /**
-   * Updates an evaluator by its ID.
-   */
-  async update(id, params) {
-    const { data, error } = await this.apiClient.PUT(
-      "/api/evaluators/{id}",
-      {
-        params: { path: { id } },
-        body: params
-      }
-    );
-    if (error)
-      this.handleApiError(`update evaluator with ID "${id}"`, error);
-    return data;
-  }
-  /**
-   * Deletes (archives) an evaluator by its ID.
-   */
-  async delete(id) {
-    const { data, error } = await this.apiClient.DELETE(
-      "/api/evaluators/{id}",
-      {
-        params: { path: { id } }
-      }
-    );
-    if (error)
-      this.handleApiError(`delete evaluator with ID "${id}"`, error);
-    return data;
-  }
-};
-
-
-
-
-exports.EvaluatorsApiError = EvaluatorsApiError; exports.EvaluatorsApiService = EvaluatorsApiService;
-//# sourceMappingURL=chunk-VBJAWDW3.js.map

package/dist/chunk-VBJAWDW3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-VBJAWDW3.js","../src/client-sdk/services/evaluators/errors.ts","../src/client-sdk/services/evaluators/evaluators-api.service.ts"],"names":[],"mappings":"AAAA;AACE;AACF,sDAA4B;AAC5B;AACE;AACA;AACF,sDAA4B;AAC5B;AACA;ACRO,IAAM,mBAAA,EAAN,MAAA,QAAiC,MAAM;AAAA,EAC5C,WAAA,CACE,OAAA,EACgB,SAAA,EACA,aAAA,EAChB;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAHG,IAAA,IAAA,CAAA,UAAA,EAAA,SAAA;AACA,IAAA,IAAA,CAAA,cAAA,EAAA,aAAA;AAGhB,IAAA,IAAA,CAAK,KAAA,EAAO,oBAAA;AAAA,EACd;AACF,CAAA;ADQA;AACA;AEIO,IAAM,qBAAA,EAAN,MAA2B;AAAA,EAGhC,WAAA,CAAY,MAAA,EAAqD;AAzBnE,IAAA,IAAA,EAAA;AA0BI,IAAA,IAAA,CAAK,UAAA,EAAA,CAAY,GAAA,EAAA,OAAA,GAAA,KAAA,EAAA,KAAA,EAAA,EAAA,MAAA,CAAQ,kBAAA,EAAA,GAAR,KAAA,EAAA,GAAA,EAA8B,uDAAA,CAAyB;AAAA,EAC1E;AAAA,EAEQ,cAAA,CAAe,SAAA,EAAmB,KAAA,EAAuB;AAC/D,IAAA,MAAM,QAAA,EAAU,yDAAA,EAA6B,SAAA,EAAsB,KAAA,EAAc,OAAA,EAAS;AAAA,MACxF,MAAA,EAAQ,wDAAA,KAA+B;AAAA,IACzC,EAAE,CAAC,CAAA;AACH,IAAA,MAAM,IAAI,kBAAA,CAAmB,OAAA,EAAS,SAAA,EAAW,KAAK,CAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAA,EAAuC;AAC3C,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,iBAAiB,CAAA;AAClE,IAAA,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,sBAAA,EAAwB,KAAK,CAAA;AAC5D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,GAAA,CAAI,QAAA,EAA8C;AACtD,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MAC3C,4BAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,SAAS,EAAE;AAAA,MAC/B;AAAA,IACF,CAAA;AACA,IAAA,GAAA,CAAI,KAAA;AACF,MAAA,IAAA,CAAK,cAAA;AAAA,QACH,CAAA,iCAAA,EAAoC,QAAQ,CAAA,CAAA,CAAA;AAAA,QAC5C;AAAA,MACF,CAAA;AACF,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,MAAA,EAAyD;AACpE,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,iBAAA,EAAmB;AAAA,MACnE,IAAA,EAAM;AAAA,IACR,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,KAAA,EAAO,IAAA,CAAK,cAAA,CAAe,kBAAA,EAAoB,KAAK,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAyD;AAChF,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA;AAAA,MAC3C,sBAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,GAAG,EAAE,CAAA;AAAA,QACvB,IAAA,EAAM;AAAA,MACR;AAAA,IACF,CAAA;AACA,IAAA,GAAA,CAAI,KAAA;AACF,MAAA,IAAA,CAAK,cAAA,CAAe,CAAA,0BAAA,EAA6B,EAAE,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,EAAA,EAA8C;AACzD,IAAA,MAAM,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA;AAAA,MAC3C,sBAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,GAAG,EAAE;AAAA,MACzB;AAAA,IACF,CAAA;AACA,IAAA,GAAA,CAAI,KAAA;AACF,MAAA,IAAA,CAAK,cAAA,CAAe,CAAA,0BAAA,EAA6B,EAAE,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AFTA;AACA;AACE;AACA;AACF,qGAAC","file":"/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-VBJAWDW3.js","sourcesContent":[null,"export class EvaluatorsApiError extends Error {\n  constructor(\n    message: string,\n    public readonly operation: string,\n    public readonly originalError?: unknown,\n  ) {\n    super(message);\n    this.name = \"EvaluatorsApiError\";\n  }\n}\n","import type {\n  CreateEvaluatorBody,\n  DeleteEvaluatorResponse,\n  EvaluatorResponse,\n  UpdateEvaluatorBody,\n} from \"./types\";\nimport {\n  createLangWatchApiClient,\n  type LangwatchApiClient,\n} from \"@/internal/api/client\";\nimport { type InternalConfig } from \"@/client-sdk/types\";\nimport { EvaluatorsApiError } from \"./errors\";\nimport {\n  extractStatusFromResponse,\n  formatApiErrorForOperation,\n} from \"@/client-sdk/services/_shared/format-api-error\";\n\n/**\n * Service for retrieving evaluator resources via the LangWatch API.\n *\n * Provides read-only access to project evaluators with computed fields.\n */\nexport class EvaluatorsApiService {\n  private readonly apiClient: LangwatchApiClient;\n\n  constructor(config?: Pick<InternalConfig, \"langwatchApiClient\">) {\n    this.apiClient = config?.langwatchApiClient ?? createLangWatchApiClient();\n  }\n\n  private handleApiError(operation: string, error: unknown): never {\n    const message = formatApiErrorForOperation({ operation: operation, error: error, options: {\n      status: extractStatusFromResponse(error),\n    } });\n    throw new EvaluatorsApiError(message, operation, error);\n  }\n\n  /**\n   * Fetches all evaluators for the project.\n   */\n  async getAll(): Promise<EvaluatorResponse[]> {\n    const { data, error } = await this.apiClient.GET(\"/api/evaluators\");\n    if (error) this.handleApiError(\"fetch all evaluators\", error);\n    return data;\n  }\n\n  /**\n   * Fetches a single evaluator by its ID or slug.\n   */\n  async get(idOrSlug: string): Promise<EvaluatorResponse> {\n    const { data, error } = await this.apiClient.GET(\n      \"/api/evaluators/{idOrSlug}\",\n      {\n        params: { path: { idOrSlug } },\n      },\n    );\n    if (error)\n      this.handleApiError(\n        `fetch evaluator with ID or slug \"${idOrSlug}\"`,\n        error,\n      );\n    return data;\n  }\n\n  /**\n   * Creates a new evaluator.\n   */\n  async create(params: CreateEvaluatorBody): Promise<EvaluatorResponse> {\n    const { data, error } = await this.apiClient.POST(\"/api/evaluators\", {\n      body: params,\n    });\n    if (error) this.handleApiError(\"create evaluator\", error);\n    return data;\n  }\n\n  /**\n   * Updates an evaluator by its ID.\n   */\n  async update(id: string, params: UpdateEvaluatorBody): Promise<EvaluatorResponse> {\n    const { data, error } = await this.apiClient.PUT(\n      \"/api/evaluators/{id}\",\n      {\n        params: { path: { id } },\n        body: params,\n      },\n    );\n    if (error)\n      this.handleApiError(`update evaluator with ID \"${id}\"`, error);\n    return data;\n  }\n\n  /**\n   * Deletes (archives) an evaluator by its ID.\n   */\n  async delete(id: string): Promise<DeleteEvaluatorResponse> {\n    const { data, error } = await this.apiClient.DELETE(\n      \"/api/evaluators/{id}\",\n      {\n        params: { path: { id } },\n      },\n    );\n    if (error)\n      this.handleApiError(`delete evaluator with ID \"${id}\"`, error);\n    return data;\n  }\n}\n"]}

package/dist/chunk-VFXRMLPF.mjs

@@ -1,66 +0,0 @@
-import {
-  createDatasetService,
-  handleDatasetCommandError
-} from "./chunk-7IX4CELY.mjs";
-import {
-  checkApiKey
-} from "./chunk-IDTCVMLK.mjs";
-
-// src/cli/commands/dataset/create.ts
-import chalk from "chalk";
-import ora from "ora";
-var parseColumns = (columnsStr) => {
-  return columnsStr.split(",").map((pair) => {
-    var _a, _b;
-    const parts = pair.trim().split(":");
-    if (parts.length !== 2 || !((_a = parts[0]) == null ? void 0 : _a.trim()) || !((_b = parts[1]) == null ? void 0 : _b.trim())) {
-      throw new Error(
-        `Invalid column format: "${pair.trim()}". Expected "name:type" (e.g. "input:string")`
-      );
-    }
-    return { name: parts[0].trim(), type: parts[1].trim() };
-  });
-};
-var createCommand = async (name, options) => {
-  checkApiKey();
-  let columnTypes = [];
-  if (options.columns) {
-    try {
-      columnTypes = parseColumns(options.columns);
-    } catch (error) {
-      console.error(
-        chalk.red(error instanceof Error ? error.message : "Invalid columns format")
-      );
-      process.exit(1);
-    }
-  }
-  const service = createDatasetService();
-  const spinner = ora(`Creating dataset "${name}"...`).start();
-  try {
-    const dataset = await service.createDataset({ name, columnTypes });
-    spinner.succeed(`Dataset created: ${chalk.cyan(dataset.slug)}`);
-    if (options.format === "json") {
-      console.log(JSON.stringify(dataset, null, 2));
-      return;
-    }
-    console.log();
-    console.log(`  ${chalk.bold("ID:")}    ${dataset.id}`);
-    console.log(`  ${chalk.bold("Slug:")}  ${dataset.slug}`);
-    if (dataset.columnTypes.length > 0) {
-      const colStr = dataset.columnTypes.map((c) => `${c.name}:${c.type}`).join(", ");
-      console.log(`  ${chalk.bold("Columns:")} ${colStr}`);
-    }
-    const viewUrl = dataset.platformUrl;
-    if (viewUrl) {
-      console.log(`  ${chalk.bold("View:")}  ${chalk.underline(viewUrl)}`);
-    }
-  } catch (error) {
-    handleDatasetCommandError({ spinner, error, context: "create dataset" });
-  }
-};
-
-export {
-  parseColumns,
-  createCommand
-};
-//# sourceMappingURL=chunk-VFXRMLPF.mjs.map

package/dist/chunk-VGZOUL5J.mjs

@@ -1,285 +0,0 @@
-import {
-  runDeviceFlowLogin
-} from "./chunk-6MVAXO5A.mjs";
-import {
-  getCliBootstrap
-} from "./chunk-7KTDTNXT.mjs";
-import {
-  isLoggedIn,
-  loadConfig,
-  saveConfig
-} from "./chunk-VW3GTPRE.mjs";
-import {
-  __spreadValues
-} from "./chunk-BAX4W3AY.mjs";
-
-// src/cli/utils/governance/wrapper.ts
-import { spawn } from "child_process";
-
-// src/cli/utils/governance/budget.ts
-async function checkBudget(cfg, opts = {}) {
-  var _a, _b;
-  if (!cfg.access_token) return null;
-  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
-  const url = cfg.control_plane_url.replace(/\/+$/, "") + "/api/auth/cli/budget/status";
-  let res;
-  try {
-    res = await f(url, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${cfg.access_token}`,
-        Accept: "application/json"
-      }
-    });
-  } catch (e) {
-    return null;
-  }
-  if (res.status === 200) return null;
-  if (res.status === 404) return null;
-  if (res.status === 402) {
-    try {
-      const body = await res.json();
-      if (((_b = body.error) == null ? void 0 : _b.type) && body.error.scope) return body.error;
-    } catch (e) {
-    }
-  }
-  return null;
-}
-var PERIOD_LABEL = {
-  minute: "per-minute",
-  hour: "hourly",
-  day: "daily",
-  week: "weekly",
-  month: "monthly",
-  total: "total"
-};
-function renderBudgetExceeded(e) {
-  var _a;
-  const period = (e.period || "month").toLowerCase();
-  const periodLabel = (_a = PERIOD_LABEL[period]) != null ? _a : period;
-  const lines = [];
-  lines.push("\u26A0  Budget limit reached");
-  lines.push("");
-  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);
-  lines.push("   To continue, ask your team admin to raise your limit.");
-  lines.push("");
-  if (e.admin_email) {
-    lines.push(`   Admin: ${e.admin_email}`);
-    lines.push("");
-  }
-  lines.push("   Need urgent access? Run:");
-  lines.push("     langwatch request-increase");
-  return lines.join("\n") + "\n";
-}
-
-// src/cli/utils/governance/wrapper.ts
-function envForTool(cfg, tool) {
-  var _a;
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const auth = (_a = cfg.default_personal_vk) == null ? void 0 : _a.secret;
-  if (!auth) return { vars: {} };
-  switch (tool) {
-    case "claude":
-      return {
-        vars: {
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        }
-      };
-    case "codex":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth
-        }
-      };
-    case "cursor":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        }
-      };
-    case "gemini":
-      return {
-        vars: {
-          GOOGLE_GENAI_API_BASE: gw,
-          GEMINI_API_KEY: auth
-        }
-      };
-    case "opencode":
-      return {
-        vars: {
-          OPENAI_BASE_URL: gw,
-          OPENAI_API_KEY: auth,
-          ANTHROPIC_BASE_URL: gw,
-          ANTHROPIC_AUTH_TOKEN: auth
-        }
-      };
-    default:
-      return { vars: {} };
-  }
-}
-var TOOL_PROVIDER_FAMILIES = {
-  claude: ["anthropic"],
-  codex: ["openai"],
-  cursor: ["anthropic", "openai"],
-  gemini: ["google", "gemini"],
-  opencode: ["anthropic", "openai"]
-};
-function renderContactFooter(adminEmail) {
-  if (adminEmail) {
-    return `Need help? Contact your LangWatch admin: ${adminEmail}
-`;
-  }
-  return `If you need help, contact your LangWatch admin.
-`;
-}
-async function preflightWrapper(cfg, tool, opts = {}) {
-  var _a, _b, _c, _d, _e;
-  const cp = cfg.control_plane_url.replace(/\/+$/, "");
-  const bootstrap = await ((_a = opts.bootstrapImpl) != null ? _a : getCliBootstrap)(cfg).catch(
-    () => null
-  );
-  const adminEmail = (_b = bootstrap == null ? void 0 : bootstrap.adminEmail) != null ? _b : null;
-  if (!((_c = cfg.default_personal_vk) == null ? void 0 : _c.secret)) {
-    return {
-      ok: false,
-      message: `No personal virtual key on this account.
-Your organization needs at least one AI provider configured before
-\`langwatch ${tool}\` can route requests.
-If you're an admin, set one up at
-  ${cp}/settings/model-providers
-then run \`langwatch login --device\` to refresh your credentials.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const gw = cfg.gateway_url.replace(/\/+$/, "");
-  const f = (_d = opts.fetchImpl) != null ? _d : fetch;
-  const timeoutMs = (_e = opts.timeoutMs) != null ? _e : 3e3;
-  try {
-    const res = await f(`${gw}/healthz`, {
-      method: "GET",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (!res.ok) {
-      return {
-        ok: false,
-        message: `AI Gateway at ${gw} returned HTTP ${res.status}.
-The wrapper cannot route \`langwatch ${tool}\` requests until the
-data plane is healthy. Check that the LangWatch gateway is running.
-` + renderContactFooter(adminEmail)
-      };
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      message: `Cannot reach AI Gateway at ${gw}
-  ${err.message}
-Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL
-if you've deployed it elsewhere.
-` + renderContactFooter(adminEmail)
-    };
-  }
-  const need = TOOL_PROVIDER_FAMILIES[tool];
-  if (need && need.length > 0 && bootstrap && Array.isArray(bootstrap.providers)) {
-    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));
-    const matches = need.filter((n) => have.has(n));
-    if (matches.length === 0) {
-      const list = need.map((n) => `\`${n}\``).join(" or ");
-      return {
-        ok: false,
-        message: `No ${list} provider is configured for your organization.
-\`langwatch ${tool}\` needs at least one to route requests through the gateway.
-If you're an admin, configure one at
-  ${cp}/settings/model-providers
-` + renderContactFooter(adminEmail)
-      };
-    }
-  }
-  return { ok: true };
-}
-function shouldAutoLogin() {
-  const flag = process.env.LANGWATCH_AUTO_LOGIN;
-  if (flag === "1" || flag === "true") return true;
-  if (flag === "0" || flag === "false") return false;
-  return Boolean(process.stdin.isTTY);
-}
-async function runWrapped(tool, args) {
-  var _a, _b;
-  let cfg = loadConfig();
-  if (!isLoggedIn(cfg)) {
-    if (!shouldAutoLogin()) {
-      process.stderr.write(
-        "Not logged in. Run `langwatch login --device` first.\n"
-      );
-      process.exit(1);
-    }
-    process.stderr.write(
-      "Not logged in. Starting device-flow login...\n"
-    );
-    try {
-      cfg = await runDeviceFlowLogin({ cfg });
-    } catch (err) {
-      process.stderr.write(
-        `login failed: ${(_a = err.message) != null ? _a : "unknown error"}
-`
-      );
-      process.exit(1);
-    }
-    if (!isLoggedIn(cfg)) {
-      process.stderr.write("login did not complete \u2014 exiting\n");
-      process.exit(1);
-    }
-  }
-  const exceeded = await checkBudget(cfg);
-  if (exceeded) {
-    process.stderr.write(renderBudgetExceeded(exceeded));
-    if (exceeded.request_increase_url) {
-      cfg.last_request_increase_url = exceeded.request_increase_url;
-      try {
-        saveConfig(cfg);
-      } catch (e) {
-      }
-    }
-    process.exit(2);
-  }
-  const probe = await preflightWrapper(cfg, tool);
-  if (!probe.ok) {
-    process.stderr.write((_b = probe.message) != null ? _b : "preflight failed\n");
-    process.exit(2);
-  }
-  const env = __spreadValues(__spreadValues({}, process.env), envForTool(cfg, tool).vars);
-  const child = spawn(tool, args, {
-    stdio: "inherit",
-    env,
-    shell: process.platform === "win32"
-  });
-  child.on("error", (err) => {
-    if (err.code === "ENOENT") {
-      process.stderr.write(
-        `${tool} not found in PATH \u2014 install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)
-`
-      );
-      process.exit(127);
-    }
-    process.stderr.write(`exec ${tool}: ${err.message}
-`);
-    process.exit(1);
-  });
-  await new Promise((resolve) => {
-    child.on("close", (code) => {
-      process.exit(code != null ? code : 1);
-      resolve();
-    });
-  });
-  process.exit(0);
-}
-
-export {
-  envForTool,
-  runWrapped
-};
-//# sourceMappingURL=chunk-VGZOUL5J.mjs.map

package/dist/chunk-VGZOUL5J.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/utils/governance/wrapper.ts","../src/cli/utils/governance/budget.ts"],"sourcesContent":["/**\n * exec wrapper helper for `langwatch claude` / `codex` / `cursor` /\n * `gemini`. Loads the persisted device-flow config, optionally\n * pre-checks the budget (Screen-8 box + exit 2 if exceeded),\n * computes the right env-var pair for the tool, and spawns the\n * underlying binary inheriting stdio so the user keeps their\n * familiar UX.\n *\n * On Unix we use spawn() with stdio:'inherit'; signals (Ctrl-C,\n * SIGTERM) propagate via the child process group. We do NOT use\n * execve replacement — Node's child_process never replaces the\n * current process, but this is functionally equivalent for the\n * end-user (same exit code, same terminal handling) and works on\n * Windows where execve doesn't exist.\n */\n\nimport { spawn } from \"node:child_process\";\nimport type { GovernanceConfig } from \"./config\";\nimport { loadConfig, saveConfig, isLoggedIn } from \"./config\";\nimport { checkBudget, renderBudgetExceeded } from \"./budget\";\nimport { getCliBootstrap } from \"./cli-api\";\nimport { runDeviceFlowLogin } from \"./login-flow\";\n\nexport interface ToolEnv {\n  /** Env-var name → value pairs to inject into the child process. */\n  vars: Record<string, string>;\n}\n\n/**\n * Mirror of the Go CLI's env-injection map. The wrapped tools\n * read these standard env vars (Anthropic, OpenAI, Google) and\n * route through the gateway with the user's personal VK as bearer.\n */\nexport function envForTool(cfg: GovernanceConfig, tool: string): ToolEnv {\n  const gw = cfg.gateway_url.replace(/\\/+$/, \"\");\n  const auth = cfg.default_personal_vk?.secret;\n  if (!auth) return { vars: {} };\n  switch (tool) {\n    case \"claude\":\n      return {\n        vars: {\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    case \"codex\":\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n        },\n      };\n    case \"cursor\":\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    case \"gemini\":\n      return {\n        vars: {\n          GOOGLE_GENAI_API_BASE: gw,\n          GEMINI_API_KEY: auth,\n        },\n      };\n    case \"opencode\":\n      // opencode is multi-provider — it reads the standard\n      // OPENAI_*/ANTHROPIC_* env vars depending on which model the\n      // user selected at the prompt. Mirror cursor's both-pairs\n      // injection so any provider the user hops to lands at our gw.\n      return {\n        vars: {\n          OPENAI_BASE_URL: gw,\n          OPENAI_API_KEY: auth,\n          ANTHROPIC_BASE_URL: gw,\n          ANTHROPIC_AUTH_TOKEN: auth,\n        },\n      };\n    default:\n      return { vars: {} };\n  }\n}\n\n/**\n * Provider families the tool needs upstream. Used by `preflightWrapper`\n * to verify the org has at least one matching provider configured —\n * otherwise the gateway can authenticate the VK but has nothing to\n * route the request to, surfacing as a confusing tool-side error.\n *\n * Multi-provider tools (cursor, opencode) match any listed family.\n */\nconst TOOL_PROVIDER_FAMILIES: Record<string, string[]> = {\n  claude: [\"anthropic\"],\n  codex: [\"openai\"],\n  cursor: [\"anthropic\", \"openai\"],\n  gemini: [\"google\", \"gemini\"],\n  opencode: [\"anthropic\", \"openai\"],\n};\n\nexport interface PreflightResult {\n  ok: boolean;\n  /** Human-readable, action-oriented message rendered to stderr on failure. */\n  message?: string;\n}\n\nexport interface PreflightOptions {\n  fetchImpl?: typeof fetch;\n  bootstrapImpl?: typeof getCliBootstrap;\n  /** Per-probe timeout, ms. Default 3000. */\n  timeoutMs?: number;\n}\n\n/**\n * Render the \"who to talk to\" footer attached to every preflight\n * failure message. Single source of truth so the admin-mailto format\n * stays consistent across the three failure shapes. Bootstrap is the\n * source of `adminEmail`; on legacy servers or unreachable control\n * planes it'll be null and we fall back to a generic line.\n */\nfunction renderContactFooter(adminEmail: string | null | undefined): string {\n  if (adminEmail) {\n    return `Need help? Contact your LangWatch admin: ${adminEmail}\\n`;\n  }\n  return `If you need help, contact your LangWatch admin.\\n`;\n}\n\n/**\n * Pre-exec probe for `langwatch <tool>` wrappers. Three layered checks,\n * each gracefully degrading rather than blocking on transient hiccups:\n *\n *   1. `cfg.default_personal_vk?.secret` present — without it the\n *      wrapper would silently inject no env vars and the underlying\n *      tool would call the upstream provider directly (api.anthropic.com\n *      etc.), surfacing as the wrong error or — when there's stale\n *      env from a prior session — a confusing ConnectionRefused\n *      against a stale base URL.\n *   2. `GET <gateway_url>/healthz` reachable. Catches \"data plane not\n *      running\" and bad `LANGWATCH_GATEWAY_URL` overrides. Fatal: if\n *      the gateway isn't reachable the tool will spin in a retry loop\n *      and there's no recovery. We don't name a specific run command\n *      (`make`, helm chart, docker compose, `npx @langwatch/server`,\n *      etc.) because deployments vary; point the user at the admin\n *      contact instead.\n *   3. `getCliBootstrap()` providers cover the tool's family. Catches\n *      the shape where login succeeds but the org has no AI provider\n *      configured yet, so the gateway has nothing to route to. 404 /\n *      missing-providers data passes through (older self-hosted\n *      servers without the endpoint).\n *\n * Bootstrap is fetched up-front (it lives on the control plane,\n * independent of the gateway data plane) so every failure message can\n * embed the org admin's email as a real contact path. A bootstrap\n * error is non-fatal; we just lose the admin mailto and continue.\n */\nexport async function preflightWrapper(\n  cfg: GovernanceConfig,\n  tool: string,\n  opts: PreflightOptions = {},\n): Promise<PreflightResult> {\n  const cp = cfg.control_plane_url.replace(/\\/+$/, \"\");\n  const bootstrap = await (opts.bootstrapImpl ?? getCliBootstrap)(cfg).catch(\n    () => null,\n  );\n  const adminEmail = bootstrap?.adminEmail ?? null;\n\n  if (!cfg.default_personal_vk?.secret) {\n    return {\n      ok: false,\n      message:\n        `No personal virtual key on this account.\\n` +\n        `Your organization needs at least one AI provider configured before\\n` +\n        `\\`langwatch ${tool}\\` can route requests.\\n` +\n        `If you're an admin, set one up at\\n` +\n        `  ${cp}/settings/model-providers\\n` +\n        `then run \\`langwatch login --device\\` to refresh your credentials.\\n` +\n        renderContactFooter(adminEmail),\n    };\n  }\n\n  const gw = cfg.gateway_url.replace(/\\/+$/, \"\");\n  const f = opts.fetchImpl ?? fetch;\n  const timeoutMs = opts.timeoutMs ?? 3000;\n  try {\n    const res = await f(`${gw}/healthz`, {\n      method: \"GET\",\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n    if (!res.ok) {\n      return {\n        ok: false,\n        message:\n          `AI Gateway at ${gw} returned HTTP ${res.status}.\\n` +\n          `The wrapper cannot route \\`langwatch ${tool}\\` requests until the\\n` +\n          `data plane is healthy. Check that the LangWatch gateway is running.\\n` +\n          renderContactFooter(adminEmail),\n      };\n    }\n  } catch (err) {\n    return {\n      ok: false,\n      message:\n        `Cannot reach AI Gateway at ${gw}\\n` +\n        `  ${(err as Error).message}\\n` +\n        `Check that the LangWatch gateway is running, or set LANGWATCH_GATEWAY_URL\\n` +\n        `if you've deployed it elsewhere.\\n` +\n        renderContactFooter(adminEmail),\n    };\n  }\n\n  const need = TOOL_PROVIDER_FAMILIES[tool];\n  if (\n    need &&\n    need.length > 0 &&\n    bootstrap &&\n    Array.isArray(bootstrap.providers)\n  ) {\n    const have = new Set(bootstrap.providers.map((p) => p.name.toLowerCase()));\n    const matches = need.filter((n) => have.has(n));\n    if (matches.length === 0) {\n      const list = need.map((n) => `\\`${n}\\``).join(\" or \");\n      return {\n        ok: false,\n        message:\n          `No ${list} provider is configured for your organization.\\n` +\n          `\\`langwatch ${tool}\\` needs at least one to route requests through the gateway.\\n` +\n          `If you're an admin, configure one at\\n` +\n          `  ${cp}/settings/model-providers\\n` +\n          renderContactFooter(adminEmail),\n      };\n    }\n  }\n\n  return { ok: true };\n}\n\n/**\n * When the wrapper is invoked without a usable config, decide whether to\n * auto-trigger the device-flow login inline or to fail fast. The device\n * flow needs a TTY (the user has to copy a code or click a browser link),\n * so default ON only when stdin is a TTY. CI/scripted callers can opt in\n * explicitly via `LANGWATCH_AUTO_LOGIN=1`, or opt out via\n * `LANGWATCH_AUTO_LOGIN=0` even on an interactive shell.\n */\nfunction shouldAutoLogin(): boolean {\n  const flag = process.env.LANGWATCH_AUTO_LOGIN;\n  if (flag === \"1\" || flag === \"true\") return true;\n  if (flag === \"0\" || flag === \"false\") return false;\n  return Boolean(process.stdin.isTTY);\n}\n\n/**\n * Run the named tool routed through the gateway. Inherits stdio so\n * the user gets the same interactive UX they'd have invoking the\n * tool directly. Exits the parent process with the child's exit\n * code (or 2 if the budget pre-check fired).\n */\nexport async function runWrapped(tool: string, args: string[]): Promise<never> {\n  let cfg = loadConfig();\n  if (!isLoggedIn(cfg)) {\n    if (!shouldAutoLogin()) {\n      process.stderr.write(\n        \"Not logged in. Run `langwatch login --device` first.\\n\",\n      );\n      process.exit(1);\n    }\n    process.stderr.write(\n      \"Not logged in. Starting device-flow login...\\n\",\n    );\n    try {\n      cfg = await runDeviceFlowLogin({ cfg });\n    } catch (err) {\n      process.stderr.write(\n        `login failed: ${(err as Error).message ?? \"unknown error\"}\\n`,\n      );\n      process.exit(1);\n    }\n    if (!isLoggedIn(cfg)) {\n      process.stderr.write(\"login did not complete — exiting\\n\");\n      process.exit(1);\n    }\n  }\n\n  // Budget pre-check — render Screen-8 box + exit 2 BEFORE exec.\n  const exceeded = await checkBudget(cfg);\n  if (exceeded) {\n    process.stderr.write(renderBudgetExceeded(exceeded));\n    if (exceeded.request_increase_url) {\n      cfg.last_request_increase_url = exceeded.request_increase_url;\n      try {\n        saveConfig(cfg);\n      } catch {\n        // Config write failure shouldn't change the spec'd exit\n        // code — the next `langwatch request-increase` falls back\n        // to the static page.\n      }\n    }\n    process.exit(2);\n  }\n\n  const probe = await preflightWrapper(cfg, tool);\n  if (!probe.ok) {\n    process.stderr.write(probe.message ?? \"preflight failed\\n\");\n    process.exit(2);\n  }\n\n  const env = { ...process.env, ...envForTool(cfg, tool).vars };\n  // npm installs claude/codex/cursor/gemini as `.cmd` shims on Windows;\n  // bare spawn() can't resolve them without a shell. shell:true is safe\n  // here because `tool` is whitelisted (claude/codex/cursor/gemini) and\n  // `args` is forwarded from the user's own terminal invocation — same\n  // trust boundary as if they'd typed `claude …` directly.\n  const child = spawn(tool, args, {\n    stdio: \"inherit\",\n    env,\n    shell: process.platform === \"win32\",\n  });\n  child.on(\"error\", (err) => {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      process.stderr.write(\n        `${tool} not found in PATH — install it first (https://docs.langwatch.ai/ai-gateway/governance/admin-setup#cli-device-flow-rest-api)\\n`,\n      );\n      process.exit(127);\n    }\n    process.stderr.write(`exec ${tool}: ${err.message}\\n`);\n    process.exit(1);\n  });\n  await new Promise<void>((resolve) => {\n    child.on(\"close\", (code) => {\n      process.exit(code ?? 1);\n      resolve();\n    });\n  });\n  // unreachable\n  process.exit(0);\n}\n","/**\n * Pre-exec budget probe + Screen-8 ASCII renderer for the langwatch\n * wrappers (`langwatch claude` / `codex` / `cursor` / `gemini`).\n *\n * Per `specs/ai-gateway/governance/budget-exceeded.feature`: before\n * any wrapped command exec's the underlying tool, the CLI hits\n * `GET /api/auth/cli/budget/status`. On 402, render the spec\n * canonical box and exit 2 (configuration / quota error) without\n * spawning the tool.\n */\n\nimport { type GovernanceConfig } from \"./config\";\n\nexport interface BudgetExceededPayload {\n  type: string;\n  scope: \"user\" | \"team\" | \"org\" | \"project\";\n  limit_usd: string;\n  spent_usd: string;\n  period: string; // \"month\" | \"week\" | \"day\" | ...\n  request_increase_url?: string;\n  admin_email?: string;\n}\n\nexport interface CheckBudgetOptions {\n  fetchImpl?: typeof fetch;\n}\n\n/**\n * Returns the 402 payload if the user is currently blocked, null\n * otherwise. 404 is treated as \"older self-hosted server doesn't\n * expose this endpoint yet — pass through\" so the CLI degrades\n * gracefully against legacy deploys. Network/5xx/etc. also\n * pass-through (the gateway's own 402 will surface via the wrapped\n * tool's error rendering as a fallback).\n */\nexport async function checkBudget(\n  cfg: GovernanceConfig,\n  opts: CheckBudgetOptions = {},\n): Promise<BudgetExceededPayload | null> {\n  if (!cfg.access_token) return null;\n  const f = opts.fetchImpl ?? fetch;\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + \"/api/auth/cli/budget/status\";\n  let res: Response;\n  try {\n    res = await f(url, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${cfg.access_token}`,\n        Accept: \"application/json\",\n      },\n    });\n  } catch {\n    return null; // network error — never block the user on this check\n  }\n  if (res.status === 200) return null;\n  if (res.status === 404) return null; // older server, no endpoint yet\n  if (res.status === 402) {\n    try {\n      const body = (await res.json()) as { error?: BudgetExceededPayload };\n      if (body.error?.type && body.error.scope) return body.error;\n    } catch {\n      // malformed payload — fall through, let the underlying tool's\n      // error render whatever the gateway returns\n    }\n  }\n  return null;\n}\n\n/**\n * Spec-canonical Screen-8 box. ASCII only — no ANSI codes — so\n * piping `langwatch claude | tee log` doesn't litter the log with\n * escape sequences. Lines match the budget-exceeded.feature\n * scenario character-for-character.\n */\n// Gateway emits root-form periods from the `GatewayBudgetWindow` Prisma\n// enum lowercased (\"month\", \"week\", \"day\", \"hour\", \"minute\", \"total\").\n// Naive `${period}ly` produces \"dayly\" / \"totally\" / \"minutely\" — map\n// explicitly. Unknown periods (e.g. older server adds \"rolling_24h\")\n// fall through to the raw value rather than render gibberish.\nconst PERIOD_LABEL: Record<string, string> = {\n  minute: \"per-minute\",\n  hour: \"hourly\",\n  day: \"daily\",\n  week: \"weekly\",\n  month: \"monthly\",\n  total: \"total\",\n};\n\nexport function renderBudgetExceeded(e: BudgetExceededPayload): string {\n  const period = (e.period || \"month\").toLowerCase();\n  const periodLabel = PERIOD_LABEL[period] ?? period;\n  const lines: string[] = [];\n  lines.push(\"⚠  Budget limit reached\");\n  lines.push(\"\");\n  lines.push(`   You've used $${e.spent_usd} of your $${e.limit_usd} ${periodLabel} budget.`);\n  lines.push(\"   To continue, ask your team admin to raise your limit.\");\n  lines.push(\"\");\n  if (e.admin_email) {\n    lines.push(`   Admin: ${e.admin_email}`);\n    lines.push(\"\");\n  }\n  lines.push(\"   Need urgent access? Run:\");\n  lines.push(\"     langwatch request-increase\");\n  return lines.join(\"\\n\") + \"\\n\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,SAAS,aAAa;;;ACmBtB,eAAsB,YACpB,KACA,OAA2B,CAAC,GACW;AAtCzC;AAuCE,MAAI,CAAC,IAAI,aAAc,QAAO;AAC9B,QAAM,KAAI,UAAK,cAAL,YAAkB;AAC5B,QAAM,MAAM,IAAI,kBAAkB,QAAQ,QAAQ,EAAE,IAAI;AACxD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,EAAE,KAAK;AAAA,MACjB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,IAAI,YAAY;AAAA,QACzC,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,SAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,IAAI,WAAW,KAAK;AACtB,QAAI;AACF,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,YAAI,UAAK,UAAL,mBAAY,SAAQ,KAAK,MAAM,MAAO,QAAO,KAAK;AAAA,IACxD,SAAQ;AAAA,IAGR;AAAA,EACF;AACA,SAAO;AACT;AAaA,IAAM,eAAuC;AAAA,EAC3C,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO;AACT;AAEO,SAAS,qBAAqB,GAAkC;AAxFvE;AAyFE,QAAM,UAAU,EAAE,UAAU,SAAS,YAAY;AACjD,QAAM,eAAc,kBAAa,MAAM,MAAnB,YAAwB;AAC5C,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,8BAAyB;AACpC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,mBAAmB,EAAE,SAAS,aAAa,EAAE,SAAS,IAAI,WAAW,UAAU;AAC1F,QAAM,KAAK,0DAA0D;AACrE,QAAM,KAAK,EAAE;AACb,MAAI,EAAE,aAAa;AACjB,UAAM,KAAK,aAAa,EAAE,WAAW,EAAE;AACvC,UAAM,KAAK,EAAE;AAAA,EACf;AACA,QAAM,KAAK,6BAA6B;AACxC,QAAM,KAAK,iCAAiC;AAC5C,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;;;ADvEO,SAAS,WAAW,KAAuB,MAAuB;AAjCzE;AAkCE,QAAM,KAAK,IAAI,YAAY,QAAQ,QAAQ,EAAE;AAC7C,QAAM,QAAO,SAAI,wBAAJ,mBAAyB;AACtC,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,CAAC,EAAE;AAC7B,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,QACL,MAAM;AAAA,UACJ,oBAAoB;AAAA,UACpB,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,MAAM;AAAA,UACJ,iBAAiB;AAAA,UACjB,gBAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,MAAM;AAAA,UACJ,iBAAiB;AAAA,UACjB,gBAAgB;AAAA,UAChB,oBAAoB;AAAA,UACpB,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,MAAM;AAAA,UACJ,uBAAuB;AAAA,UACvB,gBAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF,KAAK;AAKH,aAAO;AAAA,QACL,MAAM;AAAA,UACJ,iBAAiB;AAAA,UACjB,gBAAgB;AAAA,UAChB,oBAAoB;AAAA,UACpB,sBAAsB;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AACE,aAAO,EAAE,MAAM,CAAC,EAAE;AAAA,EACtB;AACF;AAUA,IAAM,yBAAmD;AAAA,EACvD,QAAQ,CAAC,WAAW;AAAA,EACpB,OAAO,CAAC,QAAQ;AAAA,EAChB,QAAQ,CAAC,aAAa,QAAQ;AAAA,EAC9B,QAAQ,CAAC,UAAU,QAAQ;AAAA,EAC3B,UAAU,CAAC,aAAa,QAAQ;AAClC;AAsBA,SAAS,oBAAoB,YAA+C;AAC1E,MAAI,YAAY;AACd,WAAO,4CAA4C,UAAU;AAAA;AAAA,EAC/D;AACA,SAAO;AAAA;AACT;AA8BA,eAAsB,iBACpB,KACA,MACA,OAAyB,CAAC,GACA;AAjK5B;AAkKE,QAAM,KAAK,IAAI,kBAAkB,QAAQ,QAAQ,EAAE;AACnD,QAAM,YAAY,QAAO,UAAK,kBAAL,YAAsB,iBAAiB,GAAG,EAAE;AAAA,IACnE,MAAM;AAAA,EACR;AACA,QAAM,cAAa,4CAAW,eAAX,YAAyB;AAE5C,MAAI,GAAC,SAAI,wBAAJ,mBAAyB,SAAQ;AACpC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SACE;AAAA;AAAA,cAEe,IAAI;AAAA;AAAA,IAEd,EAAE;AAAA;AAAA,IAEP,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,KAAK,IAAI,YAAY,QAAQ,QAAQ,EAAE;AAC7C,QAAM,KAAI,UAAK,cAAL,YAAkB;AAC5B,QAAM,aAAY,UAAK,cAAL,YAAkB;AACpC,MAAI;AACF,UAAM,MAAM,MAAM,EAAE,GAAG,EAAE,YAAY;AAAA,MACnC,QAAQ;AAAA,MACR,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SACE,iBAAiB,EAAE,kBAAkB,IAAI,MAAM;AAAA,uCACP,IAAI;AAAA;AAAA,IAE5C,oBAAoB,UAAU;AAAA,MAClC;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SACE,8BAA8B,EAAE;AAAA,IAC1B,IAAc,OAAO;AAAA;AAAA;AAAA,IAG3B,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,OAAO,uBAAuB,IAAI;AACxC,MACE,QACA,KAAK,SAAS,KACd,aACA,MAAM,QAAQ,UAAU,SAAS,GACjC;AACA,UAAM,OAAO,IAAI,IAAI,UAAU,UAAU,IAAI,CAAC,MAAM,EAAE,KAAK,YAAY,CAAC,CAAC;AACzE,UAAM,UAAU,KAAK,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC9C,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM;AACpD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SACE,MAAM,IAAI;AAAA,cACK,IAAI;AAAA;AAAA,IAEd,EAAE;AAAA,IACP,oBAAoB,UAAU;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;AAUA,SAAS,kBAA2B;AAClC,QAAM,OAAO,QAAQ,IAAI;AACzB,MAAI,SAAS,OAAO,SAAS,OAAQ,QAAO;AAC5C,MAAI,SAAS,OAAO,SAAS,QAAS,QAAO;AAC7C,SAAO,QAAQ,QAAQ,MAAM,KAAK;AACpC;AAQA,eAAsB,WAAW,MAAc,MAAgC;AAnQ/E;AAoQE,MAAI,MAAM,WAAW;AACrB,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,QAAI,CAAC,gBAAgB,GAAG;AACtB,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,mBAAmB,EAAE,IAAI,CAAC;AAAA,IACxC,SAAS,KAAK;AACZ,cAAQ,OAAO;AAAA,QACb,kBAAkB,SAAc,YAAd,YAAyB,eAAe;AAAA;AAAA,MAC5D;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI,CAAC,WAAW,GAAG,GAAG;AACpB,cAAQ,OAAO,MAAM,yCAAoC;AACzD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,WAAW,MAAM,YAAY,GAAG;AACtC,MAAI,UAAU;AACZ,YAAQ,OAAO,MAAM,qBAAqB,QAAQ,CAAC;AACnD,QAAI,SAAS,sBAAsB;AACjC,UAAI,4BAA4B,SAAS;AACzC,UAAI;AACF,mBAAW,GAAG;AAAA,MAChB,SAAQ;AAAA,MAIR;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,QAAQ,MAAM,iBAAiB,KAAK,IAAI;AAC9C,MAAI,CAAC,MAAM,IAAI;AACb,YAAQ,OAAO,OAAM,WAAM,YAAN,YAAiB,oBAAoB;AAC1D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,MAAM,kCAAK,QAAQ,MAAQ,WAAW,KAAK,IAAI,EAAE;AAMvD,QAAM,QAAQ,MAAM,MAAM,MAAM;AAAA,IAC9B,OAAO;AAAA,IACP;AAAA,IACA,OAAO,QAAQ,aAAa;AAAA,EAC9B,CAAC;AACD,QAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,QAAK,IAA8B,SAAS,UAAU;AACpD,cAAQ,OAAO;AAAA,QACb,GAAG,IAAI;AAAA;AAAA,MACT;AACA,cAAQ,KAAK,GAAG;AAAA,IAClB;AACA,YAAQ,OAAO,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO;AAAA,CAAI;AACrD,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,cAAQ,KAAK,sBAAQ,CAAC;AACtB,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AAED,UAAQ,KAAK,CAAC;AAChB;","names":[]}

package/dist/chunk-VW3GTPRE.mjs

@@ -1,67 +0,0 @@
-import {
-  __spreadValues
-} from "./chunk-BAX4W3AY.mjs";
-
-// src/cli/utils/governance/config.ts
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-function defaults() {
-  var _a;
-  const cp = (_a = process.env.LANGWATCH_ENDPOINT) != null ? _a : "https://app.langwatch.ai";
-  const explicitGw = process.env.LANGWATCH_GATEWAY_URL;
-  const gw = explicitGw != null ? explicitGw : /^https?:\/\/(localhost|127\.0\.0\.1)/.test(cp) ? "http://localhost:5563" : "https://gateway.langwatch.ai";
-  return { gateway_url: gw, control_plane_url: cp };
-}
-var VK_SECRET_PREFIX = "vk-lw-";
-function isCanonicalVkSecret(secret) {
-  return !!secret && secret.startsWith(VK_SECRET_PREFIX);
-}
-function configPath() {
-  const env = process.env.LANGWATCH_CLI_CONFIG;
-  if (env) return env;
-  return path.join(os.homedir(), ".langwatch", "config.json");
-}
-function loadConfig() {
-  const p = configPath();
-  if (!fs.existsSync(p)) return defaults();
-  try {
-    const text = fs.readFileSync(p, "utf8");
-    const parsed = JSON.parse(text);
-    const cfg = __spreadValues(__spreadValues({}, defaults()), parsed);
-    if (cfg.default_personal_vk && !isCanonicalVkSecret(cfg.default_personal_vk.secret)) {
-      delete cfg.default_personal_vk;
-    }
-    return cfg;
-  } catch (err) {
-    throw new Error(`Failed to parse ${p}: ${err.message}`);
-  }
-}
-function saveConfig(cfg) {
-  const p = configPath();
-  const dir = path.dirname(p);
-  fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = p + ".tmp";
-  fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2), { mode: 384 });
-  fs.renameSync(tmp, p);
-}
-function clearConfig() {
-  const p = configPath();
-  try {
-    fs.unlinkSync(p);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-}
-function isLoggedIn(cfg) {
-  return !!cfg && !!cfg.access_token;
-}
-
-export {
-  configPath,
-  loadConfig,
-  saveConfig,
-  clearConfig,
-  isLoggedIn
-};
-//# sourceMappingURL=chunk-VW3GTPRE.mjs.map

package/dist/chunk-VW3GTPRE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/utils/governance/config.ts"],"sourcesContent":["/**\n * Persists langwatch CLI governance credentials at\n * ~/.langwatch/config.json. The file is mode 0600 (atomic rename\n * on save). The shape mirrors what `POST /api/auth/cli/exchange`\n * returns plus a few client-side fields.\n */\n\nimport * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nexport interface GovernanceConfig {\n  /** AI Gateway base URL (e.g. https://gateway.langwatch.ai). */\n  gateway_url: string;\n  /** Control plane base URL (e.g. https://app.langwatch.ai). */\n  control_plane_url: string;\n\n  /** Short-lived bearer for the gateway. */\n  access_token?: string;\n  /** Long-lived token for refreshing access_token. */\n  refresh_token?: string;\n  /** Unix epoch (seconds) when access_token expires. */\n  expires_at?: number;\n\n  user?: { id?: string; email?: string; name?: string };\n  organization?: { id?: string; slug?: string; name?: string };\n  default_personal_vk?: { id?: string; secret?: string; prefix?: string };\n\n  /**\n   * Most-recent signed `request_increase_url` returned by the\n   * gateway in a 402 budget_exceeded payload — cached so\n   * `langwatch request-increase` opens the exact URL the gateway\n   * produced (with HMAC'd user/limit/spent params).\n   */\n  last_request_increase_url?: string;\n}\n\nfunction defaults(): GovernanceConfig {\n  // Note: the single source of truth for endpoint resolution at command\n  // boundaries is `resolveControlPlaneEndpoint()` in resolveEndpoint.ts.\n  // This function only seeds the *initial* GovernanceConfig shape when\n  // no file exists yet — at boot, before the user has logged in.\n  // `LANGWATCH_URL` legacy alias intentionally NOT read (was undocumented;\n  // dropped per rchaves directive 2026-05-05).\n  const cp = process.env.LANGWATCH_ENDPOINT ?? \"https://app.langwatch.ai\";\n  const explicitGw = process.env.LANGWATCH_GATEWAY_URL;\n  // Self-hosted detection: when the user pointed `LANGWATCH_ENDPOINT` at\n  // localhost (the standard `make dev` shape) and didn't override the\n  // gateway URL, default to the local AI gateway port (5563 per\n  // langwatch/CLAUDE.md `make service svc=aigateway`). Without this,\n  // `langwatch login` + `whoami` printed the production gateway URL on\n  // self-hosted installs and the user's `langwatch claude` calls would\n  // route at the wrong place (Ariana QA — same shape as the /me tile\n  // base-URL bug Sergey c45e69987 / Alexis 30e52a718 fixed on the\n  // control-plane side).\n  const gw =\n    explicitGw ??\n    (/^https?:\\/\\/(localhost|127\\.0\\.0\\.1)/.test(cp)\n      ? \"http://localhost:5563\"\n      : \"https://gateway.langwatch.ai\");\n  return { gateway_url: gw, control_plane_url: cp };\n}\n\n/**\n * Canonical personal-VK secret prefix. Mirrors the control plane's\n * `vk-lw-<ULID>` minting format (langwatch virtualKey.crypto.ts). The\n * gateway rejects anything else as malformed_key before any DB lookup,\n * so a config carrying a legacy-format secret (older `lw_vk_live_*`\n * logins) routes every `langwatch <tool>` call straight to a 401.\n */\nconst VK_SECRET_PREFIX = \"vk-lw-\";\n\n/**\n * Whether a stored secret is in the format the current gateway can\n * parse. Legacy secrets minted before the format change fail this and\n * must be re-issued via a fresh login.\n */\nexport function isCanonicalVkSecret(secret: string | undefined): boolean {\n  return !!secret && secret.startsWith(VK_SECRET_PREFIX);\n}\n\n/**\n * Returns the absolute path to the config file. Override with\n * LANGWATCH_CLI_CONFIG for tests / non-default homes.\n */\nexport function configPath(): string {\n  const env = process.env.LANGWATCH_CLI_CONFIG;\n  if (env) return env;\n  return path.join(os.homedir(), \".langwatch\", \"config.json\");\n}\n\n/** Read the config from disk, merging in defaults for missing keys. */\nexport function loadConfig(): GovernanceConfig {\n  const p = configPath();\n  if (!fs.existsSync(p)) return defaults();\n  try {\n    const text = fs.readFileSync(p, \"utf8\");\n    const parsed = JSON.parse(text) as Partial<GovernanceConfig>;\n    const cfg = { ...defaults(), ...parsed };\n    // Drop a legacy-format personal VK secret on load. Keeping it would\n    // route every `langwatch <tool>` call to a malformed_key 401; once\n    // dropped, the wrapper preflight tells the user to re-login and the\n    // next login persists a fresh `vk-lw-` secret. A valid canonical\n    // secret is never touched, so this won't wipe a working credential.\n    if (\n      cfg.default_personal_vk &&\n      !isCanonicalVkSecret(cfg.default_personal_vk.secret)\n    ) {\n      delete cfg.default_personal_vk;\n    }\n    return cfg;\n  } catch (err) {\n    throw new Error(`Failed to parse ${p}: ${(err as Error).message}`);\n  }\n}\n\n/** Write the config atomically (tmp file + rename) with mode 0600. */\nexport function saveConfig(cfg: GovernanceConfig): void {\n  const p = configPath();\n  const dir = path.dirname(p);\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  const tmp = p + \".tmp\";\n  fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2), { mode: 0o600 });\n  fs.renameSync(tmp, p);\n}\n\n/** Delete the config file; idempotent. */\nexport function clearConfig(): void {\n  const p = configPath();\n  try {\n    fs.unlinkSync(p);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n  }\n}\n\n/** Whether a loaded config has live credentials. */\nexport function isLoggedIn(cfg: GovernanceConfig | null | undefined): boolean {\n  return !!cfg && !!cfg.access_token;\n}\n"],"mappings":";;;;;AAOA,YAAY,QAAQ;AACpB,YAAY,QAAQ;AACpB,YAAY,UAAU;AA4BtB,SAAS,WAA6B;AArCtC;AA4CE,QAAM,MAAK,aAAQ,IAAI,uBAAZ,YAAkC;AAC7C,QAAM,aAAa,QAAQ,IAAI;AAU/B,QAAM,KACJ,kCACC,uCAAuC,KAAK,EAAE,IAC3C,0BACA;AACN,SAAO,EAAE,aAAa,IAAI,mBAAmB,GAAG;AAClD;AASA,IAAM,mBAAmB;AAOlB,SAAS,oBAAoB,QAAqC;AACvE,SAAO,CAAC,CAAC,UAAU,OAAO,WAAW,gBAAgB;AACvD;AAMO,SAAS,aAAqB;AACnC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,IAAK,QAAO;AAChB,SAAY,UAAQ,WAAQ,GAAG,cAAc,aAAa;AAC5D;AAGO,SAAS,aAA+B;AAC7C,QAAM,IAAI,WAAW;AACrB,MAAI,CAAI,cAAW,CAAC,EAAG,QAAO,SAAS;AACvC,MAAI;AACF,UAAM,OAAU,gBAAa,GAAG,MAAM;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAM,MAAM,kCAAK,SAAS,IAAM;AAMhC,QACE,IAAI,uBACJ,CAAC,oBAAoB,IAAI,oBAAoB,MAAM,GACnD;AACA,aAAO,IAAI;AAAA,IACb;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,IAAI,MAAM,mBAAmB,CAAC,KAAM,IAAc,OAAO,EAAE;AAAA,EACnE;AACF;AAGO,SAAS,WAAW,KAA6B;AACtD,QAAM,IAAI,WAAW;AACrB,QAAM,MAAW,aAAQ,CAAC;AAC1B,EAAG,aAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAClD,QAAM,MAAM,IAAI;AAChB,EAAG,iBAAc,KAAK,KAAK,UAAU,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnE,EAAG,cAAW,KAAK,CAAC;AACtB;AAGO,SAAS,cAAoB;AAClC,QAAM,IAAI,WAAW;AACrB,MAAI;AACF,IAAG,cAAW,CAAC;AAAA,EACjB,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,EAC9D;AACF;AAGO,SAAS,WAAW,KAAmD;AAC5E,SAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI;AACxB;","names":[]}