langwatch 1.0.0 → 1.2.0

package/dist/index.mjs

@@ -1,15 +1,16 @@
 import {
   FilterableBatchSpanProcessor
-} from "./chunk-2O4ILSP5.mjs";
+} from "./chunk-LTDUROCE.mjs";
 import {
   createLangWatchSpan,
+  external_exports,
   getLangWatchTracer
-} from "./chunk-C323F5VC.mjs";
+} from "./chunk-SYJIEBJY.mjs";
 import {
-  ensureSetup
-} from "./chunk-ALPIFEXL.mjs";
+  ensureSetup,
+  resolveEndpoint
+} from "./chunk-PDNXHBSL.mjs";
 import {
-  DEFAULT_ENDPOINT,
   LANGWATCH_SDK_LANGUAGE,
   LANGWATCH_SDK_NAME_CLIENT,
   LANGWATCH_SDK_NAME_OBSERVABILITY,
@@ -19,10 +20,13 @@ import {
   buildAuthHeaders,
   getLangWatchLogger,
   version
-} from "./chunk-5Q2DUSMQ.mjs";
+} from "./chunk-JYTJEAOU.mjs";
 import {
   ConsoleLogger,
   NoOpLogger,
+  __asyncGenerator,
+  __await,
+  __forAwait,
   __objRest,
   __privateAdd,
   __privateGet,
@@ -30,13 +34,23 @@ import {
   __privateSet,
   __spreadProps,
   __spreadValues,
+  __yieldStar,
   attributes_exports,
   shouldCaptureInput,
   shouldCaptureOutput
-} from "./chunk-L5KBRKHS.mjs";
+} from "./chunk-CMZFFKLA.mjs";
 
-// src/client-sdk/services/prompts/prompts-api.service.ts
-import { z } from "zod";
+// src/internal/credentialContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+var fallbackHolder = {};
+function currentHolder() {
+  var _a;
+  return (_a = storage.getStore()) != null ? _a : fallbackHolder;
+}
+function scopedApiKey() {
+  return currentHolder().apiKey;
+}
 
 // src/cli/utils/responseFormat.ts
 var DEFAULT_TEXT_OUTPUT = {
@@ -381,7 +395,7 @@ var isBuiltInMethod = (prop) => {
 // src/internal/api/client.ts
 import openApiCreateClient from "openapi-fetch";
 
-// ../packages/langy/src/cards/handled-error.ts
+// ../../packages/langy/src/cards/handled-error.ts
 var SERVER_ERROR_STATUS = 500;
 var GENERIC_CODES = /* @__PURE__ */ new Set([
   "internal server error",
@@ -643,9 +657,9 @@ var handledErrorMiddleware = {
     if (handledError) throw handledError;
   }
 };
-var createLangWatchApiClient = (apiKey = ((_a) => (_a = process.env.LANGWATCH_API_KEY) != null ? _a : "")(), endpoint = ((_b) => (_b = process.env.LANGWATCH_ENDPOINT) != null ? _b : DEFAULT_ENDPOINT)(), projectId = process.env.LANGWATCH_PROJECT_ID) => {
+var createLangWatchApiClient = (apiKey = ((_b) => (_b = ((_a) => (_a = scopedApiKey()) != null ? _a : process.env.LANGWATCH_API_KEY)()) != null ? _b : "")(), endpoint, projectId = process.env.LANGWATCH_PROJECT_ID) => {
   const client = openApiCreateClient({
-    baseUrl: endpoint,
+    baseUrl: resolveEndpoint(endpoint),
     headers: __spreadProps(__spreadValues({}, buildAuthHeaders({ apiKey, projectId })), {
       "content-type": "application/json",
       "user-agent": `langwatch-sdk-node/${version}`,
@@ -843,22 +857,22 @@ function extractStatusFromResponse(value) {
 }
 
 // src/client-sdk/services/prompts/prompts-api.service.ts
-var syncActionSchema = z.enum([
+var syncActionSchema = external_exports.enum([
   "created",
   "updated",
   "conflict",
   "up_to_date"
 ]);
-var syncResultSchema = z.object({
+var syncResultSchema = external_exports.object({
   action: syncActionSchema,
   // `prompt` and `conflictInfo` are passed through untyped — they come from
   // the OpenAPI-derived shape which is already validated on the server side.
-  prompt: z.unknown().optional(),
-  conflictInfo: z.object({
-    localVersion: z.number(),
-    remoteVersion: z.number(),
-    differences: z.array(z.string()),
-    remoteConfigData: z.unknown()
+  prompt: external_exports.unknown().optional(),
+  conflictInfo: external_exports.object({
+    localVersion: external_exports.number(),
+    remoteVersion: external_exports.number(),
+    differences: external_exports.array(external_exports.string()),
+    remoteConfigData: external_exports.unknown()
   }).passthrough().optional()
 });
 var PromptsApiService = class {
@@ -1159,9 +1173,6 @@ var PromptsApiService = class {
 // src/client-sdk/services/prompts/prompt.ts
 import { Liquid } from "liquidjs";
 
-// src/client-sdk/services/prompts/schema/prompt.schema.ts
-import { z as z2 } from "zod";
-
 // src/client-sdk/services/prompts/constants.ts
 var PromptScope = {
   ORGANIZATION: "ORGANIZATION",
@@ -1169,34 +1180,34 @@ var PromptScope = {
 };
 
 // src/client-sdk/services/prompts/schema/prompt.schema.ts
-var messageSchema = z2.object({
-  role: z2.enum(["user", "assistant", "system"]),
-  content: z2.string()
+var messageSchema = external_exports.object({
+  role: external_exports.enum(["user", "assistant", "system"]),
+  content: external_exports.string()
 });
-var responseFormatSchema = z2.object({
-  type: z2.literal("json_schema"),
-  json_schema: z2.object({
-    name: z2.string(),
-    schema: z2.record(z2.string(), z2.unknown())
+var responseFormatSchema = external_exports.object({
+  type: external_exports.literal("json_schema"),
+  json_schema: external_exports.object({
+    name: external_exports.string(),
+    schema: external_exports.record(external_exports.string(), external_exports.unknown())
   }).nullable()
 }).optional();
-var corePromptDataSchema = z2.object({
-  model: z2.string().min(1, "Model cannot be empty"),
-  messages: z2.array(messageSchema).min(1, "At least one message is required"),
-  prompt: z2.string().optional(),
-  temperature: z2.number().min(0).max(2).optional(),
-  maxTokens: z2.number().positive().optional(),
+var corePromptDataSchema = external_exports.object({
+  model: external_exports.string().min(1, "Model cannot be empty"),
+  messages: external_exports.array(messageSchema).min(1, "At least one message is required"),
+  prompt: external_exports.string().optional(),
+  temperature: external_exports.number().min(0).max(2).optional(),
+  maxTokens: external_exports.number().positive().optional(),
   responseFormat: responseFormatSchema
 });
-var promptMetadataSchema = z2.object({
-  id: z2.string().optional(),
-  handle: z2.string().nullable().optional(),
-  version: z2.number().min(0).optional(),
-  versionId: z2.string().optional(),
-  scope: z2.enum(PromptScope).optional()
+var promptMetadataSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  handle: external_exports.string().nullable().optional(),
+  version: external_exports.number().min(0).optional(),
+  versionId: external_exports.string().optional(),
+  scope: external_exports.enum(PromptScope).optional()
 });
-var promptDataSchema = z2.object(__spreadProps(__spreadValues(__spreadValues({}, corePromptDataSchema.shape), promptMetadataSchema.shape), {
-  parameters: z2.record(z2.string(), z2.unknown()).optional()
+var promptDataSchema = external_exports.object(__spreadProps(__spreadValues(__spreadValues({}, corePromptDataSchema.shape), promptMetadataSchema.shape), {
+  parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
 }));
 
 // src/client-sdk/services/prompts/prompt.ts
@@ -1288,20 +1299,32 @@ import * as yaml from "js-yaml";
 import chalk from "chalk";
 
 // src/cli/types-prompt.ts
-import { z as z3 } from "zod";
-var localPromptConfigSchema = z3.object({
-  model: z3.string().min(1, "Model is required"),
-  modelParameters: z3.object({
-    temperature: z3.number().optional(),
-    max_tokens: z3.number().optional()
+var jsonValueSchema = external_exports.lazy(
+  () => external_exports.union([
+    external_exports.string(),
+    external_exports.number(),
+    external_exports.boolean(),
+    external_exports.null(),
+    external_exports.array(jsonValueSchema),
+    external_exports.record(external_exports.string(), jsonValueSchema)
+  ])
+);
+var localPromptConfigSchema = external_exports.object({
+  model: external_exports.string().min(1, "Model is required"),
+  modelParameters: external_exports.object({
+    temperature: external_exports.number().optional(),
+    max_tokens: external_exports.number().optional()
   }).loose().optional(),
-  messages: z3.array(
-    z3.object({
-      role: z3.enum(["system", "user", "assistant"]),
-      content: z3.string().min(1, "Message content cannot be empty")
+  messages: external_exports.array(
+    external_exports.object({
+      role: external_exports.enum(["system", "user", "assistant"]),
+      content: external_exports.string().min(1, "Message content cannot be empty")
     }).loose()
   ).min(1, "At least one message is required"),
-  parameters: z3.record(z3.string(), z3.unknown()).optional().default({})
+  // Parameters persist as JSON: parse them AS json so the value's type
+  // matches the API contract (the spec's recursive JsonValue) instead of
+  // laundering unknowns into a typed pipeline.
+  parameters: external_exports.record(external_exports.string(), jsonValueSchema).optional().default({})
 }).loose();
 
 // src/cli/utils/errors/prompt-not-found.error.ts
@@ -1863,7 +1886,7 @@ var tracer2 = getLangWatchTracer(`${LANGWATCH_SDK_NAME_CLIENT}.datasets`, LANGWA
 // src/client-sdk/services/datasets/dataset.service.ts
 var DatasetService = class {
   constructor(config) {
-    this.config = config;
+    this.config = __spreadProps(__spreadValues({}, config), { endpoint: resolveEndpoint(config.endpoint) });
     return createTracingProxy(this, tracer2);
   }
   /**
@@ -2141,7 +2164,7 @@ var DatasetService = class {
    */
   async fetchMultipart(path2, formData, operation, slugOrId) {
     const { endpoint, apiKey } = this.config;
-    const url = `${endpoint.replace(/\/$/, "")}${path2}`;
+    const url = `${endpoint}${path2}`;
     const response = await fetch(url, {
       method: "POST",
       headers: buildAuthHeaders({ apiKey }),
@@ -2474,7 +2497,7 @@ var DatasetsFacade = class {
 _datasetService = new WeakMap();
 
 // src/client-sdk/services/experiments/experiment.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import { trace, SpanStatusCode, ROOT_CONTEXT } from "@opentelemetry/api";
 
 // src/client-sdk/services/experiments/humanReadableId.ts
@@ -2683,8 +2706,8 @@ function printSummary(result) {
 // src/client-sdk/services/experiments/experiment.ts
 var DEFAULT_CONCURRENCY = 4;
 var DEBOUNCE_INTERVAL_MS = 1e3;
-var iterationContextStorage = new AsyncLocalStorage();
-var targetContextStorage = new AsyncLocalStorage();
+var iterationContextStorage = new AsyncLocalStorage2();
+var targetContextStorage = new AsyncLocalStorage2();
 var Experiment = class _Experiment {
   constructor(name, options) {
     this.initialized = false;
@@ -2718,7 +2741,7 @@ var Experiment = class _Experiment {
     this.experimentSlug = name;
     this.runId = (_a = options.runId) != null ? _a : generateHumanReadableId();
     this.apiClient = options.apiClient;
-    this.endpoint = options.endpoint;
+    this.endpoint = resolveEndpoint(options.endpoint);
     this.apiKey = options.apiKey;
     this.logger = options.logger;
     this.concurrency = (_b = options.concurrency) != null ? _b : DEFAULT_CONCURRENCY;
@@ -2764,7 +2787,7 @@ var Experiment = class _Experiment {
       const data = await response.json();
       this.experimentSlug = data.slug;
       const encodedRunId = encodeURIComponent(this.runId);
-      this.runUrl = `${this.endpoint.replace(/\/$/, "")}${data.path}?runId=${encodedRunId}`;
+      this.runUrl = `${this.endpoint}${data.path}?runId=${encodedRunId}`;
       console.log(`Follow results at: ${this.runUrl}`);
       this.initialized = true;
     } catch (error) {
@@ -4590,9 +4613,9 @@ var WorkflowsApiError = class extends Error {
 };
 var WorkflowsApiService = class {
   constructor(config) {
-    var _a, _b, _c;
-    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : createLangWatchApiClient();
-    this.endpoint = (_c = (_b = config == null ? void 0 : config.endpoint) != null ? _b : process.env.LANGWATCH_ENDPOINT) != null ? _c : "https://app.langwatch.ai";
+    var _a;
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
+    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : createLangWatchApiClient(void 0, this.endpoint);
     this.experimentsApiService = new ExperimentsApiService({
       langwatchApiClient: this.apiClient
     });
@@ -5149,9 +5172,9 @@ var MonitorsApiError = class extends Error {
 };
 var MonitorsApiService = class {
   constructor(config) {
-    var _a, _b, _c, _d;
-    this.apiKey = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : process.env.LANGWATCH_API_KEY) != null ? _b : "";
-    this.endpoint = (_d = (_c = config == null ? void 0 : config.endpoint) != null ? _c : process.env.LANGWATCH_ENDPOINT) != null ? _d : DEFAULT_ENDPOINT;
+    var _a, _b, _c;
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
   }
   async request(path2, options) {
     var _a, _b;
@@ -5224,9 +5247,9 @@ var SecretsApiError = class extends Error {
 };
 var SecretsApiService = class {
   constructor(config) {
-    var _a, _b, _c, _d;
-    this.apiKey = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : process.env.LANGWATCH_API_KEY) != null ? _b : "";
-    this.endpoint = (_d = (_c = config == null ? void 0 : config.endpoint) != null ? _c : process.env.LANGWATCH_ENDPOINT) != null ? _d : DEFAULT_ENDPOINT;
+    var _a, _b, _c;
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
   }
   async request(path2, options) {
     var _a, _b;
@@ -5282,6 +5305,1003 @@ var SecretsApiService = class {
   }
 };
 
+// src/client-sdk/services/_shared/collect-cursor-pages.ts
+var CURSOR_WALK_PAGE_SIZE = 200;
+var MAX_CURSOR_WALK_PAGES = 1e3;
+function walkCursorPages(options) {
+  return __asyncGenerator(this, null, function* () {
+    var _a;
+    const served = /* @__PURE__ */ new Set();
+    let cursor = options.startCursor;
+    let pagesRead = 0;
+    for (; ; ) {
+      const page = yield new __await(options.fetchPage(cursor));
+      pagesRead += 1;
+      yield page;
+      const next = (_a = options.nextCursorOf(page)) != null ? _a : null;
+      if (next === null) return;
+      if (served.has(next)) {
+        throw options.onEndlessWalk(
+          "the endpoint served the same page cursor twice, so the walk cannot advance"
+        );
+      }
+      if (pagesRead >= MAX_CURSOR_WALK_PAGES) {
+        throw options.onEndlessWalk(
+          `the walk passed ${MAX_CURSOR_WALK_PAGES} pages without the cursor coming back null`
+        );
+      }
+      served.add(next);
+      cursor = next;
+    }
+  });
+}
+async function collectCursorPages(options) {
+  const pages = [];
+  try {
+    for (var iter = __forAwait(walkCursorPages(options)), more, temp, error; more = !(temp = await iter.next()).done; more = false) {
+      const page = temp.value;
+      pages.push(page);
+    }
+  } catch (temp) {
+    error = [temp];
+  } finally {
+    try {
+      more && (temp = iter.return) && await temp.call(iter);
+    } finally {
+      if (error)
+        throw error[0];
+    }
+  }
+  return pages;
+}
+
+// src/client-sdk/services/_shared/mutation-options.ts
+var IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
+var IDEMPOTENT_REPLAY_HEADER = "X-Idempotent-Replay";
+function mutationInit(options) {
+  return (options == null ? void 0 : options.signal) ? { signal: options.signal } : {};
+}
+function idempotentCreateInit(options) {
+  const onIdempotentReplay = options == null ? void 0 : options.onIdempotentReplay;
+  return __spreadValues(__spreadValues(__spreadValues({}, mutationInit(options)), (options == null ? void 0 : options.idempotencyKey) !== void 0 ? { headers: { [IDEMPOTENCY_KEY_HEADER]: options.idempotencyKey } } : {}), onIdempotentReplay ? {
+    onResponse: (response) => {
+      if (response.headers.get(IDEMPOTENT_REPLAY_HEADER) === "true") {
+        onIdempotentReplay();
+      }
+    }
+  } : {});
+}
+
+// src/client-sdk/services/virtual-keys/virtual-keys-api.service.ts
+var VirtualKeysApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "VirtualKeysApiError";
+  }
+};
+var VirtualKeysApiService = class {
+  constructor(config) {
+    var _a, _b, _c, _d;
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+    this.projectId = (_d = config == null ? void 0 : config.projectId) != null ? _d : process.env.LANGWATCH_PROJECT_ID;
+  }
+  headers() {
+    return __spreadValues({
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json"
+    }, this.projectId ? { "X-Project-Id": this.projectId } : {});
+  }
+  async request(operation, path2, init) {
+    var _a, _b, _c;
+    const response = await fetch(`${this.endpoint}${path2}`, __spreadProps(__spreadValues({}, init), {
+      // A hung control plane must fail the command, not freeze it.
+      signal: (_a = init == null ? void 0 : init.signal) != null ? _a : AbortSignal.timeout(3e4),
+      headers: __spreadValues(__spreadValues({}, this.headers()), (_b = init == null ? void 0 : init.headers) != null ? _b : {})
+    }));
+    if (!response.ok) {
+      let parsedBody;
+      try {
+        parsedBody = await response.json();
+      } catch (e) {
+        parsedBody = await response.text();
+      }
+      const message = formatApiErrorForOperation({
+        operation,
+        error: parsedBody,
+        options: { status: response.status }
+      });
+      throwIfHandledError({
+        operation,
+        error: parsedBody,
+        status: response.status,
+        message
+      });
+      throw new VirtualKeysApiError(message, operation, parsedBody);
+    }
+    (_c = init == null ? void 0 : init.onResponse) == null ? void 0 : _c.call(init, response);
+    return await response.json();
+  }
+  /**
+   * ONE page of the virtual keys visible to the caller, newest first. Pass
+   * `next_cursor` back as `cursor` for the next page, verbatim: a cursor this
+   * endpoint did not issue answers 400 rather than restarting the walk.
+   *
+   * `limit` is the page size (server default 50, capped at 200), and it caps
+   * the rows READ, not the rows returned: the visibility filter runs on the
+   * page afterwards. Prefer `list()` unless you mean to page deliberately.
+   */
+  async listPage(options) {
+    const params = new URLSearchParams();
+    if (options == null ? void 0 : options.externalId) params.set("external_id", options.externalId);
+    if (options == null ? void 0 : options.cursor) params.set("cursor", options.cursor);
+    if ((options == null ? void 0 : options.limit) !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString() !== "" ? `?${params.toString()}` : "";
+    const { data, next_cursor } = await this.request("list virtual keys", `/api/gateway/v1/virtual-keys${query}`);
+    return { data, next_cursor: next_cursor != null ? next_cursor : null };
+  }
+  /**
+   * Every virtual key visible to the caller: keys scoped to this project, to
+   * its team, or to the whole organization.
+   *
+   * The endpoint pages; this follows `next_cursor` until it comes back null.
+   * Stopping on a short page would be wrong here specifically, because the
+   * server filters each page for visibility after reading it, so a page can
+   * hold fewer rows than the limit with more still to come.
+   *
+   * `limit` sizes each request in the walk, it does NOT cap what comes back.
+   * `cursor` resumes an interrupted walk. Take a single page with
+   * `listPage()`, or stream the walk with `iterate()`.
+   */
+  async list(options) {
+    const pages = await collectCursorPages({
+      startCursor: options == null ? void 0 : options.cursor,
+      nextCursorOf: (page) => page.next_cursor,
+      onEndlessWalk: (reason) => new VirtualKeysApiError(
+        `Failed to list virtual keys: ${reason}.`,
+        "list virtual keys"
+      ),
+      fetchPage: (cursor) => {
+        var _a;
+        return this.listPage({
+          cursor,
+          limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE,
+          externalId: options == null ? void 0 : options.externalId
+        });
+      }
+    });
+    return pages.flatMap((page) => page.data);
+  }
+  /**
+   * Every visible virtual key, one row at a time, fetching each page only
+   * when the consumer reaches it. Stop early and the rest is never read,
+   * which `list()` cannot offer because it materialises the whole listing
+   * first. Raises rather than looping forever on a cursor chain that never
+   * ends, exactly like `list()`.
+   */
+  iterate(options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options == null ? void 0 : options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new VirtualKeysApiError(
+          `Failed to list virtual keys: ${reason}.`,
+          "list virtual keys"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.listPage({
+            cursor,
+            limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE,
+            externalId: options == null ? void 0 : options.externalId
+          });
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  async get(id) {
+    const { virtual_key } = await this.request(
+      `get virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}`
+    );
+    return virtual_key;
+  }
+  /**
+   * Mint a key. The response carries the secret ONCE; nothing ever serves it
+   * again, so a create that times out is recovered with `idempotencyKey`
+   * rather than by listing.
+   */
+  async create(input, options) {
+    return this.request(
+      "create virtual key",
+      "/api/gateway/v1/virtual-keys",
+      __spreadValues({
+        method: "POST",
+        body: JSON.stringify(input)
+      }, idempotentCreateInit(options))
+    );
+  }
+  async update(id, input, options) {
+    const { virtual_key } = await this.request(
+      `update virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}`,
+      __spreadValues({ method: "PATCH", body: JSON.stringify(input) }, mutationInit(options))
+    );
+    return virtual_key;
+  }
+  async rotate(id, options) {
+    return this.request(
+      `rotate virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}/rotate`,
+      __spreadValues({ method: "POST" }, mutationInit(options))
+    );
+  }
+  async revoke(id, options) {
+    const { virtual_key } = await this.request(
+      `revoke virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}/revoke`,
+      __spreadValues({ method: "POST" }, mutationInit(options))
+    );
+    return virtual_key;
+  }
+  /** Reversible stop; enable() restores the key exactly as it was. */
+  async disable(id, options = {}) {
+    const { virtual_key } = await this.request(
+      `disable virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}/disable`,
+      __spreadValues({
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(options.reason ? { reason: options.reason } : {})
+      }, mutationInit(options))
+    );
+    return virtual_key;
+  }
+  async enable(id, options) {
+    const { virtual_key } = await this.request(
+      `enable virtual key "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}/enable`,
+      __spreadValues({ method: "POST" }, mutationInit(options))
+    );
+    return virtual_key;
+  }
+  /**
+   * Aggregate spend for one key over a window in epoch milliseconds.
+   * Defaults to the current UTC calendar month server-side. Reads the same
+   * cost path the dashboard reads, so this number and the UI agree by
+   * construction.
+   */
+  async spend(id, options) {
+    const params = new URLSearchParams();
+    if ((options == null ? void 0 : options.from) !== void 0) params.set("from", String(options.from));
+    if ((options == null ? void 0 : options.to) !== void 0) params.set("to", String(options.to));
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return this.request(
+      `read virtual key spend "${id}"`,
+      `/api/gateway/v1/virtual-keys/${encodeURIComponent(id)}/spend${query}`
+    );
+  }
+};
+
+// src/client-sdk/services/gateway-budgets/gateway-budgets-api.service.ts
+var GatewayBudgetsApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "GatewayBudgetsApiError";
+  }
+};
+var GatewayBudgetsApiService = class {
+  constructor(config) {
+    var _a, _b, _c, _d;
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+    this.projectId = (_d = config == null ? void 0 : config.projectId) != null ? _d : process.env.LANGWATCH_PROJECT_ID;
+  }
+  headers() {
+    return __spreadValues({
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json"
+    }, this.projectId ? { "X-Project-Id": this.projectId } : {});
+  }
+  async request(operation, path2, init) {
+    var _a, _b, _c;
+    const response = await fetch(`${this.endpoint}${path2}`, __spreadProps(__spreadValues({}, init), {
+      // A hung control plane must fail the command, not freeze it.
+      signal: (_a = init == null ? void 0 : init.signal) != null ? _a : AbortSignal.timeout(3e4),
+      headers: __spreadValues(__spreadValues({}, this.headers()), (_b = init == null ? void 0 : init.headers) != null ? _b : {})
+    }));
+    if (!response.ok) {
+      let parsedBody;
+      try {
+        parsedBody = await response.json();
+      } catch (e) {
+        parsedBody = await response.text();
+      }
+      const message = formatApiErrorForOperation({
+        operation,
+        error: parsedBody,
+        options: { status: response.status }
+      });
+      throwIfHandledError({
+        operation,
+        error: parsedBody,
+        status: response.status,
+        message
+      });
+      throw new GatewayBudgetsApiError(message, operation, parsedBody);
+    }
+    (_c = init == null ? void 0 : init.onResponse) == null ? void 0 : _c.call(init, response);
+    return await response.json();
+  }
+  /**
+   * ONE page of non-archived budgets, exactly as the wire serves it. Pass
+   * `next_cursor` back as `cursor` for the next page, verbatim: a cursor this
+   * endpoint did not issue answers 400 rather than restarting the walk.
+   *
+   * `limit` is the page size (server default 50, capped at 200). Prefer
+   * `list()` unless you mean to page deliberately: a full page is not a
+   * promise of more, and a null `next_cursor` is the only end of the walk.
+   */
+  async listPage(options) {
+    var _a;
+    const params = new URLSearchParams();
+    if (options == null ? void 0 : options.externalId) params.set("external_id", options.externalId);
+    if ((_a = options == null ? void 0 : options.scopeTypes) == null ? void 0 : _a.length) {
+      params.set("scope_type", options.scopeTypes.join(","));
+    }
+    if (options == null ? void 0 : options.cursor) params.set("cursor", options.cursor);
+    if ((options == null ? void 0 : options.limit) !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString() !== "" ? `?${params.toString()}` : "";
+    const { data, spend_available, next_cursor } = await this.request("list gateway budgets", `/api/gateway/v1/budgets${query}`);
+    return {
+      data,
+      spend_available,
+      next_cursor: next_cursor != null ? next_cursor : null
+    };
+  }
+  /**
+   * Every non-archived budget in the organization across all seven scope
+   * types, optionally filtered by `scopeTypes`.
+   *
+   * The endpoint pages; this follows `next_cursor` until it comes back null,
+   * so the result is the complete listing and carries no cursor of its own.
+   * Callers that count, total, or decide an all-clear on this list need that
+   * completeness for correctness, not just for display.
+   *
+   * `limit` sizes each request in the walk, it does NOT cap what comes back.
+   * `cursor` resumes an interrupted walk. Take a single page with
+   * `listPage()`, or stream the walk with `iterate()`.
+   *
+   * A plain array, like every other exhaustive `list()` in the SDK: a walk
+   * that ran to the end has no cursor left to report. Null `spent_usd` /
+   * `spent_nano_usd` on a row is not by itself "spend unavailable": an
+   * `attributed_user` template row serves null deliberately, because one
+   * allowance per person has no single total. Use `listPage()` when you need
+   * `spend_available` stated outright.
+   */
+  async list(options) {
+    const pages = await collectCursorPages({
+      startCursor: options == null ? void 0 : options.cursor,
+      nextCursorOf: (page) => page.next_cursor,
+      onEndlessWalk: (reason) => new GatewayBudgetsApiError(
+        `Failed to list gateway budgets: ${reason}.`,
+        "list gateway budgets"
+      ),
+      fetchPage: (cursor) => {
+        var _a;
+        return this.listPage({
+          scopeTypes: options == null ? void 0 : options.scopeTypes,
+          cursor,
+          limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE,
+          externalId: options == null ? void 0 : options.externalId
+        });
+      }
+    });
+    return pages.flatMap((page) => page.data);
+  }
+  /**
+   * Every non-archived budget, one row at a time, fetching each page only
+   * when the consumer reaches it.
+   *
+   * A null `spent_usd` means spend could not be totalled rather than that
+   * nothing was spent.
+   */
+  iterate(options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options == null ? void 0 : options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new GatewayBudgetsApiError(
+          `Failed to list gateway budgets: ${reason}.`,
+          "list gateway budgets"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.listPage({
+            scopeTypes: options == null ? void 0 : options.scopeTypes,
+            cursor,
+            limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE,
+            externalId: options == null ? void 0 : options.externalId
+          });
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  /**
+   * One budget by id, in the same row shape the listing serves.
+   *
+   * Archived budgets are not served, so a budget that existed yesterday can
+   * answer 404 today. A null `spent_usd` means spend could not be totalled
+   * rather than that nothing was spent, which is the same signal the listing
+   * carries as `spend_available`.
+   */
+  async get(id) {
+    const { budget } = await this.request(
+      `get gateway budget "${id}"`,
+      `/api/gateway/v1/budgets/${encodeURIComponent(id)}`
+    );
+    return budget;
+  }
+  async create(input, options) {
+    const { budget } = await this.request(
+      "create gateway budget",
+      "/api/gateway/v1/budgets",
+      __spreadValues({
+        method: "POST",
+        body: JSON.stringify(input)
+      }, idempotentCreateInit(options))
+    );
+    return budget;
+  }
+  async update(id, input, options) {
+    const { budget } = await this.request(
+      `update gateway budget "${id}"`,
+      `/api/gateway/v1/budgets/${encodeURIComponent(id)}`,
+      __spreadValues({ method: "PATCH", body: JSON.stringify(input) }, mutationInit(options))
+    );
+    return budget;
+  }
+  async archive(id, options) {
+    const { budget } = await this.request(
+      `archive gateway budget "${id}"`,
+      `/api/gateway/v1/budgets/${encodeURIComponent(id)}`,
+      __spreadValues({ method: "DELETE" }, mutationInit(options))
+    );
+    return budget;
+  }
+  /**
+   * Move the budget's period boundary to now. Recorded spend is never
+   * mutated; with `endUserId` only that end-user bucket's boundary moves.
+   */
+  async reset(id, options = {}) {
+    const query = options.endUserId ? `?end_user_id=${encodeURIComponent(options.endUserId)}` : "";
+    const { budget } = await this.request(
+      `reset gateway budget "${id}"`,
+      `/api/gateway/v1/budgets/${encodeURIComponent(id)}/reset${query}`,
+      __spreadValues({
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(options.reason ? { reason: options.reason } : {})
+      }, mutationInit(options))
+    );
+    return budget;
+  }
+};
+
+// src/client-sdk/services/spend-events/spend-events-api.service.ts
+var SpendEventsApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "SpendEventsApiError";
+  }
+};
+var SpendEventsApiService = class {
+  constructor(config) {
+    var _a, _b, _c;
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+  }
+  async request(operation, path2, init) {
+    var _a, _b;
+    const response = await fetch(`${this.endpoint}${path2}`, __spreadProps(__spreadValues({}, init), {
+      // A hung control plane must fail the command, not freeze it.
+      signal: (_a = init == null ? void 0 : init.signal) != null ? _a : AbortSignal.timeout(3e4),
+      headers: __spreadValues({
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json"
+      }, (_b = init == null ? void 0 : init.headers) != null ? _b : {})
+    }));
+    if (!response.ok) {
+      let parsedBody;
+      try {
+        parsedBody = await response.json();
+      } catch (e) {
+        parsedBody = await response.text();
+      }
+      const message = formatApiErrorForOperation({
+        operation,
+        error: parsedBody,
+        options: { status: response.status }
+      });
+      throwIfHandledError({
+        operation,
+        error: parsedBody,
+        status: response.status,
+        message
+      });
+      throw new SpendEventsApiError(message, operation, parsedBody);
+    }
+    return await response.json();
+  }
+  /**
+   * ONE page of the per-request spend ledger for a window. Pass `next_cursor`
+   * back as `cursor` for the next page, verbatim.
+   *
+   * A full page does NOT mean there is more and a short page does NOT mean
+   * there is no more: only a null cursor ends the walk. A reconciler that
+   * stops on the first page silently under-counts the window, so read every
+   * page or stream them with `iterate()`.
+   */
+  async listPage(options) {
+    const params = new URLSearchParams();
+    params.set("from", String(options.from));
+    params.set("to", String(options.to));
+    if (options.cursor) params.set("cursor", options.cursor);
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    if (options.virtualKeyId) params.set("virtual_key_id", options.virtualKeyId);
+    if (options.endUserId) params.set("end_user_id", options.endUserId);
+    if (options.projectId) params.set("project_id", options.projectId);
+    if (options.model) params.set("model", options.model);
+    if (options.status) params.set("status", options.status);
+    const qs = params.toString() !== "" ? `?${params.toString()}` : "";
+    return await this.request(
+      "list spend events",
+      `/api/gateway/v1/spend-events${qs}`
+    );
+  }
+  /**
+   * Every spend event in the window, one row at a time, fetching each page
+   * only when the consumer reaches it.
+   *
+   * This is how a reconciler reads a whole window without holding it: the
+   * ledger is unbounded, so there is deliberately no eager `list()` to
+   * collect it into an array. Raises rather than looping forever on a cursor
+   * chain that never ends.
+   */
+  iterate(options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new SpendEventsApiError(
+          `Failed to list spend events: ${reason}.`,
+          "list spend events"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.listPage(__spreadProps(__spreadValues({}, options), {
+            cursor,
+            limit: (_a = options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE
+          }));
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  /**
+   * ONE page of per-key spend rollups for a window, paged by group key
+   * ascending.
+   *
+   * The page is a step of a walk, not a whole answer: follow `next_cursor`
+   * until it comes back null, or stream the walk with `iterSummaries()`. A
+   * reconciler that reads only the first page silently under-counts every
+   * tenant past the limit.
+   */
+  async summariesPage(options) {
+    const params = new URLSearchParams();
+    params.set("group_by", options.groupBy);
+    params.set("from", String(options.from));
+    params.set("to", String(options.to));
+    if (options.projectId) params.set("project_id", options.projectId);
+    if (options.virtualKeyId)
+      params.set("virtual_key_id", options.virtualKeyId);
+    if (options.cursor) params.set("cursor", options.cursor);
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    return await this.request(
+      "read spend summaries",
+      `/api/gateway/v1/spend-summaries?${params.toString()}`
+    );
+  }
+  /**
+   * Every rollup row for the window, one at a time, fetching each page only
+   * when the consumer reaches it.
+   *
+   * The rollup has one row per tenant seen in the window, which no bound
+   * covers, so there is deliberately no eager whole-set read here either: a
+   * checksum that quietly covers part of the window is worse than none.
+   */
+  iterSummaries(options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new SpendEventsApiError(
+          `Failed to read spend summaries: ${reason}.`,
+          "read spend summaries"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.summariesPage(__spreadProps(__spreadValues({}, options), {
+            cursor,
+            limit: (_a = options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE
+          }));
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  /**
+   * Re-deliver a window's spend envelopes to ONE endpoint through the
+   * normal delivery path. Envelope ids are unchanged (your consumer's
+   * dedup key); mind your downstream billing system's finite dedup
+   * window before replaying old ranges. The window is capped server-side
+   * at 7 days per call.
+   */
+  async replay(options) {
+    const response = await this.request(
+      "replay spend events",
+      "/api/gateway/v1/spend-events/replay",
+      __spreadValues({
+        method: "POST",
+        body: JSON.stringify({
+          from: options.from,
+          to: options.to,
+          endpoint_id: options.endpointId
+        })
+      }, mutationInit(options))
+    );
+    return response.data;
+  }
+  async endUserSpend(endUserId, options) {
+    const params = new URLSearchParams();
+    if (options == null ? void 0 : options.window) params.set("window", options.window);
+    if ((options == null ? void 0 : options.from) !== void 0) params.set("from", String(options.from));
+    if ((options == null ? void 0 : options.to) !== void 0) params.set("to", String(options.to));
+    if (options == null ? void 0 : options.virtualKeyId) params.set("virtual_key_id", options.virtualKeyId);
+    const qs = params.toString() !== "" ? `?${params.toString()}` : "";
+    const res = await this.request(
+      "read end-user spend",
+      `/api/gateway/v1/end-users/${encodeURIComponent(endUserId)}/spend${qs}`
+    );
+    return res.data;
+  }
+};
+
+// src/client-sdk/services/webhooks/webhooks-api.service.ts
+var WebhooksApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "WebhooksApiError";
+  }
+};
+var WebhooksApiService = class {
+  constructor(config) {
+    var _a, _b, _c;
+    this.endpoint = resolveEndpoint(config == null ? void 0 : config.endpoint);
+    this.apiKey = (_c = (_b = (_a = config == null ? void 0 : config.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+  }
+  async request(operation, path2, init) {
+    var _a, _b, _c;
+    const response = await fetch(`${this.endpoint}${path2}`, __spreadProps(__spreadValues({}, init), {
+      // A hung control plane must fail the command, not freeze it.
+      signal: (_a = init == null ? void 0 : init.signal) != null ? _a : AbortSignal.timeout(3e4),
+      headers: __spreadValues({
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json"
+      }, (_b = init == null ? void 0 : init.headers) != null ? _b : {})
+    }));
+    if (!response.ok) {
+      let parsedBody;
+      try {
+        parsedBody = await response.json();
+      } catch (e) {
+        parsedBody = await response.text();
+      }
+      const message = formatApiErrorForOperation({
+        operation,
+        error: parsedBody,
+        options: { status: response.status }
+      });
+      throwIfHandledError({
+        operation,
+        error: parsedBody,
+        status: response.status,
+        message
+      });
+      throw new WebhooksApiError(message, operation, parsedBody);
+    }
+    (_c = init == null ? void 0 : init.onResponse) == null ? void 0 : _c.call(init, response);
+    return await response.json();
+  }
+  async list() {
+    const res = await this.request(
+      "list webhook endpoints",
+      "/api/webhooks/v1/endpoints"
+    );
+    return res.data;
+  }
+  async get(id) {
+    const res = await this.request(
+      "get webhook endpoint",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}`
+    );
+    return res.data;
+  }
+  /**
+   * The signing secret comes back on this response and never again, so a
+   * create that times out is recovered with `idempotencyKey`: the replay
+   * carries the same secret, and nothing else ever will.
+   */
+  async create(input, options) {
+    const res = await this.request(
+      "create webhook endpoint",
+      "/api/webhooks/v1/endpoints",
+      __spreadValues({
+        method: "POST",
+        body: JSON.stringify(input)
+      }, idempotentCreateInit(options))
+    );
+    return res.data;
+  }
+  async update(id, input, options) {
+    const res = await this.request(
+      "update webhook endpoint",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}`,
+      __spreadValues({ method: "PATCH", body: JSON.stringify(input) }, mutationInit(options))
+    );
+    return res.data;
+  }
+  /**
+   * Retire an endpoint: the server soft-archives the row, stamping
+   * `archived_at` and dropping the status to disabled, so the delivery
+   * history stays readable for audit while nothing more is ever sent. The
+   * row is archived, not removed, and `gatewayBudgets.archive()` already
+   * names that operation, so the billing surfaces agree on the verb.
+   *
+   * Nothing comes back: the response body carries only an `archived: true`
+   * acknowledgement, and a non-2xx already raises.
+   */
+  async archive(id, options) {
+    await this.request(
+      "archive webhook endpoint",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}`,
+      __spreadValues({ method: "DELETE" }, mutationInit(options))
+    );
+  }
+  async rollSecret(id, options) {
+    const res = await this.request(
+      "roll webhook endpoint secret",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}/roll-secret`,
+      __spreadValues({ method: "POST" }, mutationInit(options))
+    );
+    return res.data;
+  }
+  async test(id, options) {
+    const res = await this.request(
+      "test webhook endpoint",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}/test`,
+      __spreadValues({ method: "POST" }, mutationInit(options))
+    );
+    return res.data;
+  }
+  /**
+   * ONE page of the endpoint's delivery attempts, newest first.
+   *
+   * The cursor is why this is a page: the route has always served one, and
+   * dropping it truncated the delivery log at whatever the first page held,
+   * with nothing in the result to say the rest existed. Pass `next_cursor`
+   * back as `cursor`, or walk the whole log with `iterDeliveries()`.
+   */
+  async deliveriesPage(id, options) {
+    const params = new URLSearchParams();
+    if (options == null ? void 0 : options.cursor) params.set("cursor", options.cursor);
+    if ((options == null ? void 0 : options.limit) !== void 0) params.set("limit", String(options.limit));
+    const qs = params.toString() !== "" ? `?${params.toString()}` : "";
+    const { data, next_cursor } = await this.request(
+      "list webhook deliveries",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}/deliveries${qs}`
+    );
+    return { data, next_cursor: next_cursor != null ? next_cursor : null };
+  }
+  /**
+   * Every recorded delivery attempt for the endpoint, one at a time,
+   * fetching each page only when the consumer reaches it.
+   */
+  iterDeliveries(id, options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options == null ? void 0 : options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new WebhooksApiError(
+          `Failed to list webhook deliveries: ${reason}.`,
+          "list webhook deliveries"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.deliveriesPage(id, {
+            cursor,
+            limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE
+          });
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  async health(id) {
+    const res = await this.request(
+      "read webhook endpoint health",
+      `/api/webhooks/v1/endpoints/${encodeURIComponent(id)}/health`
+    );
+    return res.data;
+  }
+  async eventTypes() {
+    const res = await this.request(
+      "list webhook event types",
+      "/api/webhooks/v1/event-types"
+    );
+    return res.data;
+  }
+  /**
+   * ONE page of the organization's emitted-events log, newest first.
+   *
+   * Webhooks are a push over this log, never the only copy of it: a consumer
+   * that missed a delivery reads the window back from here. Walk the whole
+   * window with `iterEvents()`.
+   */
+  async eventsPage(options) {
+    const params = new URLSearchParams();
+    if (options == null ? void 0 : options.type) params.set("type", options.type);
+    if ((options == null ? void 0 : options.from) !== void 0) params.set("from", String(options.from));
+    if ((options == null ? void 0 : options.to) !== void 0) params.set("to", String(options.to));
+    if (options == null ? void 0 : options.cursor) params.set("cursor", options.cursor);
+    if ((options == null ? void 0 : options.limit) !== void 0) params.set("limit", String(options.limit));
+    const qs = params.toString() !== "" ? `?${params.toString()}` : "";
+    const { data, next_cursor } = await this.request("list emitted events", `/api/webhooks/v1/events${qs}`);
+    return { data, next_cursor: next_cursor != null ? next_cursor : null };
+  }
+  /**
+   * Every emitted event matching the filter, one at a time, fetching each
+   * page only when the consumer reaches it.
+   */
+  iterEvents(options) {
+    return __asyncGenerator(this, null, function* () {
+      const pages = walkCursorPages({
+        startCursor: options == null ? void 0 : options.cursor,
+        nextCursorOf: (page) => page.next_cursor,
+        onEndlessWalk: (reason) => new WebhooksApiError(
+          `Failed to list emitted events: ${reason}.`,
+          "list emitted events"
+        ),
+        fetchPage: (cursor) => {
+          var _a;
+          return this.eventsPage(__spreadProps(__spreadValues({}, options), {
+            cursor,
+            limit: (_a = options == null ? void 0 : options.limit) != null ? _a : CURSOR_WALK_PAGE_SIZE
+          }));
+        }
+      });
+      try {
+        for (var iter = __forAwait(pages), more, temp, error; more = !(temp = yield new __await(iter.next())).done; more = false) {
+          const page = temp.value;
+          yield* __yieldStar(page.data);
+        }
+      } catch (temp) {
+        error = [temp];
+      } finally {
+        try {
+          more && (temp = iter.return) && (yield new __await(temp.call(iter)));
+        } finally {
+          if (error)
+            throw error[0];
+        }
+      }
+    });
+  }
+  /**
+   * One emitted event by id, the envelope exactly as it was delivered.
+   *
+   * A 404 covers every reason the log cannot answer: never emitted, past the
+   * retention horizon, or belonging to another organization.
+   */
+  async getEvent(id) {
+    const res = await this.request(
+      "get emitted event",
+      `/api/webhooks/v1/events/${encodeURIComponent(id)}`
+    );
+    return res.data;
+  }
+};
+
 // src/client-sdk/services/traces/types.ts
 var TracesError = class extends Error {
   constructor(message, operation, originalError) {
@@ -5361,9 +6381,9 @@ var _LangWatch_instances, createInternalConfig_fn;
 var LangWatch = class {
   constructor(options = {}) {
     __privateAdd(this, _LangWatch_instances);
-    var _a, _b, _c, _d;
-    const apiKey = (_b = (_a = options.apiKey) != null ? _a : process.env.LANGWATCH_API_KEY) != null ? _b : "";
-    const endpoint = (_d = (_c = options.endpoint) != null ? _c : process.env.LANGWATCH_ENDPOINT) != null ? _d : DEFAULT_ENDPOINT;
+    var _a, _b, _c;
+    const apiKey = (_c = (_b = (_a = options.apiKey) != null ? _a : scopedApiKey()) != null ? _b : process.env.LANGWATCH_API_KEY) != null ? _c : "";
+    const endpoint = resolveEndpoint(options.endpoint);
     this.config = __privateMethod(this, _LangWatch_instances, createInternalConfig_fn).call(this, {
       apiKey,
       endpoint,
@@ -5405,6 +6425,10 @@ var LangWatch = class {
     this.simulationRuns = new SimulationRunsApiService(this.config);
     this.monitors = new MonitorsApiService({ apiKey, endpoint });
     this.secrets = new SecretsApiService({ apiKey, endpoint });
+    this.virtualKeys = new VirtualKeysApiService({ apiKey, endpoint });
+    this.gatewayBudgets = new GatewayBudgetsApiService({ apiKey, endpoint });
+    this.spendEvents = new SpendEventsApiService({ apiKey, endpoint });
+    this.webhooks = new WebhooksApiService({ apiKey, endpoint });
   }
   get apiClient() {
     return this.config.langwatchApiClient;
@@ -5425,6 +6449,87 @@ createInternalConfig_fn = function({
   };
 };
 
+// src/client-sdk/services/webhooks/verify-signature.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var WEBHOOK_SIGNATURE_HEADER = "X-LangWatch-Signature";
+var WEBHOOK_DELIVERY_ID_HEADER = "X-LangWatch-Delivery-Id";
+var WEBHOOK_EVENT_ID_HEADER = "X-LangWatch-Event-Id";
+var WEBHOOK_SIGNATURE_DEFAULT_TOLERANCE_SECONDS = 300;
+var WebhookSignatureVerificationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "WebhookSignatureVerificationError";
+    this.code = code;
+  }
+};
+function parseSignatureHeader(header) {
+  let timestamp;
+  const candidates = [];
+  for (const piece of header.split(",")) {
+    const eq = piece.indexOf("=");
+    if (eq <= 0) continue;
+    const key = piece.slice(0, eq).trim();
+    const value = piece.slice(eq + 1).trim();
+    if (key === "v1") candidates.push(value);
+    else if (key === "t" && value.length > 0) timestamp = Number(value);
+  }
+  return { timestamp, candidates };
+}
+function digestsMatch(expected, candidate) {
+  const a = Buffer.from(expected, "utf8");
+  const b = Buffer.from(candidate, "utf8");
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function signedPayload(timestamp, body) {
+  const prefix = Buffer.from(`${timestamp}.`, "utf8");
+  const bytes = typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body);
+  return Buffer.concat([prefix, bytes]);
+}
+function verifyWebhookSignature(options) {
+  var _a, _b;
+  const secrets = (typeof options.secret === "string" ? [options.secret] : options.secret).filter((secret) => typeof secret === "string" && secret.length > 0);
+  if (secrets.length === 0) {
+    throw new TypeError(
+      "verifyWebhookSignature needs at least one non-empty signing secret"
+    );
+  }
+  const tolerance = (_a = options.toleranceSeconds) != null ? _a : WEBHOOK_SIGNATURE_DEFAULT_TOLERANCE_SECONDS;
+  const now = (_b = options.nowSeconds) != null ? _b : Math.floor(Date.now() / 1e3);
+  const { timestamp, candidates } = parseSignatureHeader(options.header);
+  if (timestamp === void 0 || !Number.isFinite(timestamp)) {
+    throw new WebhookSignatureVerificationError(
+      "malformed_header",
+      `${WEBHOOK_SIGNATURE_HEADER} carries no readable t= timestamp, so the delivery cannot be checked for freshness`
+    );
+  }
+  if (candidates.length === 0) {
+    throw new WebhookSignatureVerificationError(
+      "malformed_header",
+      `${WEBHOOK_SIGNATURE_HEADER} carries no v1= signature, so there is nothing to compare`
+    );
+  }
+  if (Math.abs(now - timestamp) > tolerance) {
+    throw new WebhookSignatureVerificationError(
+      "stale_timestamp",
+      `the delivery was signed ${Math.abs(now - timestamp)}s from now, outside the ${tolerance}s tolerance`
+    );
+  }
+  const payload = signedPayload(timestamp, options.body);
+  let matched = false;
+  for (const secret of secrets) {
+    const expected = createHmac("sha256", secret).update(payload).digest("hex");
+    for (const candidate of candidates) {
+      if (digestsMatch(expected, candidate)) matched = true;
+    }
+  }
+  if (!matched) {
+    throw new WebhookSignatureVerificationError(
+      "invalid_signature",
+      `no v1 signature in ${WEBHOOK_SIGNATURE_HEADER} matched the ${secrets.length === 1 ? "secret" : "secrets"} held, so the body was signed with something else or changed in transit`
+    );
+  }
+}
+
 // src/index.ts
 var logger = {
   ConsoleLogger,
@@ -5452,15 +6557,31 @@ export {
   ExperimentsFacade,
   FetchPolicy,
   FilterableBatchSpanProcessor,
+  GatewayBudgetsApiError,
+  GatewayBudgetsApiService,
+  IDEMPOTENCY_KEY_HEADER,
+  IDEMPOTENT_REPLAY_HEADER,
   LangWatch,
   LangWatchApiError,
   LangWatchTraceExporter as LangWatchExporter,
   LangWatchHandledError,
+  SpendEventsApiError,
+  SpendEventsApiService,
   TargetMetadataConflictError,
+  VirtualKeysApiError,
+  VirtualKeysApiService,
+  WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_SIGNATURE_DEFAULT_TOLERANCE_SECONDS,
+  WEBHOOK_SIGNATURE_HEADER,
+  WebhookSignatureVerificationError,
+  WebhooksApiError,
+  WebhooksApiService,
   attributes_exports as attributes,
   getLangWatchLogger,
   getLangWatchTracer,
   isLangWatchHandledError,
-  logger
+  logger,
+  verifyWebhookSignature
 };
 //# sourceMappingURL=index.mjs.map