typekro 0.32.1 → 0.33.0

package/dist/factories/envoy-ai-gateway/compositions/gateway.js

@@ -0,0 +1,773 @@
+import { createHash } from 'node:crypto';
+import { kubernetesComposition } from '../../../core/composition/imperative.js';
+import { setIncludeWhen } from '../../../core/metadata/resource-metadata.js';
+import { Cel } from '../../../core/references/cel.js';
+import { singleton } from '../../../core/singleton/singleton.js';
+import { isKubernetesRef } from '../../../utils/type-guards.js';
+import { configMap } from '../../kubernetes/config/config-map.js';
+import { namespace } from '../../kubernetes/core/namespace.js';
+import { DEFAULT_ENVOY_AI_GATEWAY_CLASS_NAME, DEFAULT_ENVOY_AI_GATEWAY_LISTENER_PORT, DEFAULT_ENVOY_AI_GATEWAY_VERSION, DEFAULT_ENVOY_GATEWAY_CONTROLLER_NAME, } from '../constants.js';
+import { envoyAIGatewayRoute, envoyAIServiceBackend, envoyBackend, envoyBackendSecurityPolicy, envoyBackendTLSPolicy, envoyBackendTrafficPolicy, envoyGateway, envoyGatewayConfig, } from '../resources/gateway.js';
+import { EnvoyAIGatewaySpecSchema, EnvoyAIGatewayStatusSchema } from '../types.js';
+import { makeEnvoyAIGatewayPlatformBootstrap } from './platform.js';
+/**
+ * Build one OpenAI-compatible internal gateway over a fixed, type-safe provider
+ * and logical-model topology. Provider graph shape is build-time; instance
+ * identity, namespace lifecycle, and listener port remain deploy-time values.
+ */
+export function makeEnvoyAIGateway(options) {
+    const providers = validateAndResolveProviders(options.providers);
+    validateModels(options, providers);
+    const rateLimit = validateRateLimit(options.rateLimit);
+    const requestCosts = validateRequestCosts(options.requestCosts ?? defaultRequestCosts());
+    const tokenCostMetadataKeys = resolveTokenCostMetadataKeys(requestCosts);
+    validateRateLimitMetadataReferences(rateLimit, tokenCostMetadataKeys);
+    const profile = options.profile ?? 'production';
+    const platformOptions = platformOptionsForGateway(options.platform, rateLimit, profile);
+    const platform = makeEnvoyAIGatewayPlatformBootstrap(platformOptions);
+    const gatewayClassName = platformOptions.gatewayClassName ?? DEFAULT_ENVOY_AI_GATEWAY_CLASS_NAME;
+    const aiGatewayVersion = platformOptions.aiGatewayVersion ?? DEFAULT_ENVOY_AI_GATEWAY_VERSION;
+    return kubernetesComposition({
+        name: 'envoy-ai-gateway',
+        kind: 'EnvoyAIGateway',
+        spec: EnvoyAIGatewaySpecSchema,
+        status: EnvoyAIGatewayStatusSchema,
+    }, (spec) => {
+        const lifecycle = spec.lifecycle ?? 'owned';
+        const listenerPort = spec.listenerPort ?? DEFAULT_ENVOY_AI_GATEWAY_LISTENER_PORT;
+        const gatewayNamespace = namespace({
+            metadata: {
+                name: spec.namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'envoy-ai-gateway',
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+            },
+            id: 'gatewayNamespace',
+        });
+        if (isKubernetesRef(spec.name)) {
+            setIncludeWhen(gatewayNamespace, [
+                Cel.expr('!has(schema.spec.lifecycle) || schema.spec.lifecycle == "owned"'),
+            ]);
+        }
+        else if (lifecycle === 'external') {
+            setIncludeWhen(gatewayNamespace, [false]);
+        }
+        configMap({
+            metadata: {
+                name: `${spec.name}-gateway-contract`,
+                namespace: spec.namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'envoy-ai-gateway',
+                    'app.kubernetes.io/instance': spec.name,
+                    'app.kubernetes.io/component': 'contract',
+                    'app.kubernetes.io/managed-by': 'typekro',
+                },
+            },
+            data: {
+                gatewayClassName,
+                providerCount: String(providers.length),
+                aiGatewayVersion,
+            },
+            id: 'gatewayContract',
+        });
+        const platformOwner = singleton(platform, {
+            id: 'envoy-ai-gateway-platform',
+            spec: { name: 'envoy-ai-gateway-platform' },
+        });
+        const gatewayConfig = envoyGatewayConfig({
+            name: spec.name,
+            namespace: spec.namespace,
+            spec: gatewayConfigSpec(options, profile, aiGatewayVersion, requestCosts),
+            id: 'gatewayConfig',
+        });
+        const gateway = envoyGateway({
+            name: spec.name,
+            namespace: spec.namespace,
+            spec: {
+                gatewayClassName,
+                listeners: [
+                    {
+                        name: 'http',
+                        protocol: 'HTTP',
+                        port: listenerPort,
+                    },
+                ],
+            },
+            id: 'gateway',
+        });
+        gateway.dependsOn(gatewayConfig);
+        const backendResources = new Map();
+        const providerResources = [];
+        const readinessResources = [];
+        const policyResources = [];
+        for (const provider of providers) {
+            const resourceId = providerResourceId(provider.name);
+            const backendName = `${spec.name}-${provider.name}`;
+            const backend = envoyBackend({
+                name: backendName,
+                namespace: spec.namespace,
+                spec: {
+                    endpoints: [
+                        {
+                            fqdn: {
+                                hostname: provider.hostname,
+                                port: provider.port,
+                            },
+                        },
+                    ],
+                },
+                id: `${resourceId}Backend`,
+            });
+            const aiBackend = envoyAIServiceBackend({
+                name: backendName,
+                namespace: spec.namespace,
+                spec: {
+                    schema: {
+                        name: provider.schema,
+                        ...(provider.prefix ? { prefix: provider.prefix } : {}),
+                    },
+                    backendRef: {
+                        name: backendName,
+                        kind: 'Backend',
+                        group: 'gateway.envoyproxy.io',
+                    },
+                },
+                id: `${resourceId}AIServiceBackend`,
+            });
+            aiBackend.dependsOn(backend);
+            backendResources.set(provider.name, aiBackend);
+            const providerResource = {
+                name: backendName,
+                status: aiBackend.status,
+                resourceId: `${resourceId}AIServiceBackend`,
+            };
+            providerResources.push(providerResource);
+            readinessResources.push(providerResource);
+            const securityPolicy = providerSecurityPolicy(provider, spec.namespace, backendName, `${resourceId}SecurityPolicy`);
+            if (securityPolicy) {
+                securityPolicy.dependsOn(aiBackend);
+                readinessResources.push({
+                    name: backendName,
+                    status: securityPolicy.status,
+                    resourceId: `${resourceId}SecurityPolicy`,
+                });
+            }
+            if (provider.tls) {
+                const tlsPolicy = envoyBackendTLSPolicy({
+                    name: backendName,
+                    namespace: spec.namespace,
+                    spec: {
+                        targetRefs: [
+                            {
+                                group: 'gateway.envoyproxy.io',
+                                kind: 'Backend',
+                                name: backendName,
+                            },
+                        ],
+                        validation: {
+                            wellKnownCACertificates: 'System',
+                            hostname: provider.hostname,
+                        },
+                    },
+                    id: `${resourceId}TLSPolicy`,
+                });
+                tlsPolicy.dependsOn(backend);
+                policyResources.push({ resourceId: `${resourceId}TLSPolicy` });
+            }
+        }
+        const route = envoyAIGatewayRoute({
+            name: spec.name,
+            namespace: spec.namespace,
+            spec: {
+                parentRefs: [
+                    {
+                        name: spec.name,
+                        kind: 'Gateway',
+                        group: 'gateway.networking.k8s.io',
+                    },
+                ],
+                rules: options.models.map((model) => ({
+                    matches: [
+                        {
+                            headers: [
+                                {
+                                    type: 'Exact',
+                                    name: 'x-ai-eg-model',
+                                    value: model.model,
+                                },
+                            ],
+                        },
+                    ],
+                    backendRefs: model.targets.map((target) => {
+                        const backend = backendResources.get(target.provider);
+                        if (!backend) {
+                            throw new Error(`Envoy AI Gateway model ${model.model} references unknown provider ${target.provider}.`);
+                        }
+                        return {
+                            name: `${spec.name}-${target.provider}`,
+                            ...(target.model ? { modelNameOverride: target.model } : {}),
+                            ...(target.weight !== undefined ? { weight: target.weight } : {}),
+                            ...(target.priority !== undefined ? { priority: target.priority } : {}),
+                        };
+                    }),
+                    timeouts: {
+                        request: model.requestTimeout ?? '60s',
+                    },
+                    ...(model.modelsOwnedBy ? { modelsOwnedBy: model.modelsOwnedBy } : {}),
+                })),
+            },
+            id: 'route',
+        });
+        route.dependsOn(gateway);
+        for (const backend of backendResources.values())
+            route.dependsOn(backend);
+        if (options.retry !== false) {
+            const retry = options.retry ?? {};
+            const policy = envoyBackendTrafficPolicy({
+                name: spec.name,
+                namespace: spec.namespace,
+                spec: {
+                    targetRefs: [
+                        {
+                            group: 'gateway.networking.k8s.io',
+                            kind: 'HTTPRoute',
+                            name: spec.name,
+                        },
+                    ],
+                    retry: {
+                        numAttemptsPerPriority: retry.attemptsPerPriority ?? 1,
+                        numRetries: retry.retries ?? Math.max(1, providers.length),
+                        perRetry: {
+                            timeout: retry.perRetryTimeout ?? '30s',
+                            backOff: {
+                                baseInterval: '100ms',
+                                maxInterval: '10s',
+                            },
+                        },
+                        retryOn: {
+                            httpStatusCodes: [...(retry.retryStatusCodes ?? [429, 500, 502, 503, 504])],
+                            triggers: [
+                                ...(retry.triggers ?? ['connect-failure', 'retriable-status-codes', 'reset']),
+                            ],
+                        },
+                    },
+                },
+                id: 'retryPolicy',
+            });
+            policy.dependsOn(route);
+            policyResources.push({ resourceId: 'retryPolicy' });
+        }
+        if (rateLimit) {
+            const policy = envoyBackendTrafficPolicy({
+                name: `${spec.name}-rate-limit`,
+                namespace: spec.namespace,
+                spec: {
+                    targetRefs: [
+                        {
+                            group: 'gateway.networking.k8s.io',
+                            kind: 'Gateway',
+                            name: spec.name,
+                        },
+                    ],
+                    rateLimit: {
+                        type: 'Global',
+                        global: {
+                            rules: rateLimit.rules.map((rule) => ({
+                                ...(rule.identityHeader
+                                    ? {
+                                        clientSelectors: [
+                                            {
+                                                headers: [
+                                                    {
+                                                        name: rule.identityHeader,
+                                                        type: 'Distinct',
+                                                    },
+                                                ],
+                                            },
+                                        ],
+                                    }
+                                    : {}),
+                                limit: {
+                                    requests: rule.requests,
+                                    unit: rule.unit,
+                                },
+                                ...(rule.cost && rule.cost !== 'request'
+                                    ? {
+                                        cost: {
+                                            request: {
+                                                from: 'Number',
+                                                number: 0,
+                                            },
+                                            response: {
+                                                from: 'Metadata',
+                                                metadata: {
+                                                    namespace: 'io.envoy.ai_gateway',
+                                                    key: requiredTokenCostMetadataKey(tokenCostMetadataKeys, rule.cost),
+                                                },
+                                            },
+                                        },
+                                    }
+                                    : {}),
+                            })),
+                        },
+                    },
+                },
+                id: 'rateLimitPolicy',
+            });
+            policy.dependsOn(gateway);
+            policyResources.push({ resourceId: 'rateLimitPolicy' });
+        }
+        const gatewayConfigAccepted = acceptedExpression('gatewayConfig');
+        const routeAccepted = acceptedExpression('route');
+        const gatewayProgrammed = Cel.expr('gateway.status.conditions.exists(c, c.type == "Accepted" && c.status == "True" && ' +
+            'c.observedGeneration == gateway.metadata.generation) && ' +
+            'gateway.status.conditions.exists(c, c.type == "Programmed" && c.status == "True" && ' +
+            'c.observedGeneration == gateway.metadata.generation)');
+        const readinessExpressions = readinessResources.map((resource) => acceptedExpressionFor(resource));
+        const allProvidersAccepted = Cel.expr(readinessExpressions.length === 0
+            ? 'true'
+            : readinessExpressions.map(({ expression }) => `(${expression})`).join(' && '));
+        const anyProviderFailed = Cel.expr(readinessResources.length === 0
+            ? 'false'
+            : readinessResources
+                .map((resource) => `${resourceIdForStatus(resource)}.status.conditions.exists(c, ` +
+                '((c.type == "NotAccepted" && c.status == "True") || ' +
+                '(c.type == "Accepted" && c.status == "False")) && ' +
+                currentConditionExpression(resourceIdForStatus(resource)) +
+                ')')
+                .map((expression) => `(${expression})`)
+                .join(' || '));
+        const allPoliciesAccepted = Cel.expr(policyResources.length === 0
+            ? 'true'
+            : policyResources
+                .map(({ resourceId }) => `(${policyAcceptedExpression(resourceId)})`)
+                .join(' && '));
+        const anyPolicyFailed = Cel.expr(policyResources.length === 0
+            ? 'false'
+            : policyResources
+                .map(({ resourceId }) => `(${policyFailedExpression(resourceId)})`)
+                .join(' || '));
+        const gatewayFailed = Cel.expr('gateway.status.conditions.exists(c, ' +
+            '(c.type == "Accepted" || c.type == "Programmed") && c.status == "False" && ' +
+            'c.observedGeneration == gateway.metadata.generation)');
+        const routeFailed = Cel.expr('route.status.conditions.exists(c, ' +
+            '((c.type == "NotAccepted" && c.status == "True") || ' +
+            '(c.type == "Accepted" && c.status == "False")) && ' +
+            currentConditionExpression('route') +
+            ')');
+        const platformReady = Cel.expr(platformOwner.status.ready);
+        const platformFailed = Cel.expr(platformOwner.status.failed);
+        const failed = Cel.expr(`(${platformFailed.expression}) || (${gatewayFailed.expression}) || ` +
+            `(${routeFailed.expression}) || (${anyProviderFailed.expression}) || ` +
+            `(${anyPolicyFailed.expression})`);
+        const ready = Cel.expr(`(${platformReady.expression}) && (${gatewayConfigAccepted.expression}) && ` +
+            `(${gatewayProgrammed.expression}) && (${routeAccepted.expression}) && ` +
+            `(${allProvidersAccepted.expression}) && (${allPoliciesAccepted.expression})`);
+        const acceptedProviderCount = Cel.expr(providerResources
+            .map((resource) => acceptedExpressionFor(resource))
+            .map(({ expression }) => `(${expression} ? 1 : 0)`)
+            .join(' + '));
+        return {
+            ready,
+            failed,
+            phase: Cel.expr(`${failed.expression} ? "Failed" : (${ready.expression} ? "Ready" : "Installing")`),
+            endpoint: Cel.expr('has(gateway.status.addresses) && size(gateway.status.addresses) > 0 ? "http://" + ' +
+                'string(gateway.status.addresses[0].value) + ":" + ' +
+                'string(gateway.spec.listeners[0].port) : ""'),
+            gatewayClassName: Cel.expr('gatewayContract.data.gatewayClassName'),
+            providerCount: Cel.expr('int(gatewayContract.data.providerCount)'),
+            acceptedProviderCount,
+            routeAccepted,
+            gatewayProgrammed,
+            aiGatewayVersion: Cel.expr('gatewayContract.data.aiGatewayVersion'),
+        };
+    });
+}
+function acceptedExpression(resourceId) {
+    return Cel.expr(`${resourceId}.status.conditions.exists(c, c.type == "Accepted" && c.status == "True" && ` +
+        `${currentConditionExpression(resourceId)})`);
+}
+function currentConditionExpression(resourceId) {
+    return `(has(c.observedGeneration) ? c.observedGeneration == ${resourceId}.metadata.generation : true)`;
+}
+function policyAcceptedExpression(resourceId) {
+    return (`has(${resourceId}.status.ancestors) && ${resourceId}.status.ancestors.exists(a, ` +
+        `has(a.controllerName) && a.controllerName == "${DEFAULT_ENVOY_GATEWAY_CONTROLLER_NAME}" && ` +
+        'has(a.conditions) && a.conditions.exists(c, ' +
+        'c.type == "Accepted" && c.status == "True" && ' +
+        `${currentConditionExpression(resourceId)}))`);
+}
+function policyFailedExpression(resourceId) {
+    return (`has(${resourceId}.status.ancestors) && ${resourceId}.status.ancestors.exists(a, ` +
+        `has(a.controllerName) && a.controllerName == "${DEFAULT_ENVOY_GATEWAY_CONTROLLER_NAME}" && ` +
+        'has(a.conditions) && a.conditions.exists(c, ' +
+        '((c.type == "Accepted" || c.type == "ResolvedRefs") && c.status == "False") && ' +
+        `${currentConditionExpression(resourceId)}))`);
+}
+function acceptedExpressionFor(resource) {
+    return acceptedExpression(resourceIdForStatus(resource));
+}
+function resourceIdForStatus(resource) {
+    return resource.resourceId;
+}
+function providerSecurityPolicy(provider, namespace, backendName, id) {
+    const targetRefs = [
+        {
+            group: 'aigateway.envoyproxy.io',
+            kind: 'AIServiceBackend',
+            name: backendName,
+        },
+    ];
+    let spec;
+    if (provider.security.type === 'none')
+        return undefined;
+    if (provider.security.type === 'api-key') {
+        spec = {
+            targetRefs,
+            type: 'APIKey',
+            apiKey: {
+                secretRef: {
+                    name: provider.security.secretName,
+                    namespace: provider.security.secretNamespace ?? namespace,
+                },
+            },
+        };
+    }
+    else if (provider.security.type === 'anthropic-api-key') {
+        spec = {
+            targetRefs,
+            type: 'AnthropicAPIKey',
+            anthropicAPIKey: {
+                secretRef: {
+                    name: provider.security.secretName,
+                    namespace: provider.security.secretNamespace ?? namespace,
+                },
+            },
+        };
+    }
+    else {
+        spec = {
+            targetRefs,
+            type: 'AWSCredentials',
+            awsCredentials: {
+                region: provider.security.region,
+                ...(provider.security.secretName
+                    ? {
+                        credentialsFile: {
+                            secretRef: {
+                                name: provider.security.secretName,
+                                namespace: provider.security.secretNamespace ?? namespace,
+                            },
+                            profile: provider.security.profile,
+                        },
+                    }
+                    : {}),
+            },
+        };
+    }
+    return envoyBackendSecurityPolicy({
+        name: backendName,
+        namespace,
+        spec,
+        id,
+    });
+}
+function gatewayConfigSpec(options, profile, platformVersion, requestCosts) {
+    const environment = [
+        {
+            name: 'TYPEKRO_ENVOY_AI_GATEWAY_VERSION',
+            value: platformVersion,
+        },
+        ...Object.entries(options.telemetry?.environment ?? {}).map(([name, value]) => ({
+            name,
+            value,
+        })),
+    ];
+    return {
+        extProc: {
+            kubernetes: {
+                ...(environment.length > 0 ? { env: environment } : {}),
+                resources: options.telemetry?.resources ??
+                    (profile === 'production'
+                        ? {
+                            requests: { cpu: '100m', memory: '128Mi' },
+                            limits: { cpu: '1', memory: '512Mi' },
+                        }
+                        : {}),
+            },
+        },
+        globalLLMRequestCosts: requestCosts,
+    };
+}
+function platformOptionsForGateway(platform, rateLimit, profile) {
+    if (platform?.profile && platform.profile !== profile) {
+        throw new Error(`Envoy AI Gateway profile ${profile} conflicts with nested platform profile ${platform.profile}.`);
+    }
+    if (rateLimit &&
+        platform?.rateLimitRedisUrl &&
+        platform.rateLimitRedisUrl !== rateLimit.redisUrl) {
+        throw new Error('Envoy AI Gateway rateLimit.redisUrl conflicts with platform.rateLimitRedisUrl.');
+    }
+    return {
+        ...platform,
+        profile,
+        ...(rateLimit ? { rateLimitRedisUrl: rateLimit.redisUrl } : {}),
+    };
+}
+function defaultRequestCosts() {
+    return [
+        { metadataKey: 'llm_input_token', type: 'InputToken' },
+        { metadataKey: 'llm_output_token', type: 'OutputToken' },
+        { metadataKey: 'llm_total_token', type: 'TotalToken' },
+        { metadataKey: 'llm_cached_input_token', type: 'CachedInputToken' },
+        {
+            metadataKey: 'llm_cache_creation_input_token',
+            type: 'CacheCreationInputToken',
+        },
+        { metadataKey: 'llm_reasoning_token', type: 'ReasoningToken' },
+    ];
+}
+function validateRequestCosts(costs) {
+    if (costs.length > 36) {
+        throw new Error('Envoy AI Gateway supports at most 36 request-cost dimensions.');
+    }
+    const metadataKeys = new Set();
+    const builtInTypes = new Set();
+    for (const cost of costs) {
+        if (cost.metadataKey.length === 0 || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(cost.metadataKey)) {
+            throw new Error(`Envoy AI Gateway request-cost metadata key ${JSON.stringify(cost.metadataKey)} must be a non-empty identifier.`);
+        }
+        if (metadataKeys.has(cost.metadataKey)) {
+            throw new Error(`Duplicate Envoy AI Gateway request-cost metadata key ${cost.metadataKey}.`);
+        }
+        metadataKeys.add(cost.metadataKey);
+        if (cost.type !== 'CEL') {
+            if (builtInTypes.has(cost.type)) {
+                throw new Error(`Duplicate Envoy AI Gateway request-cost type ${cost.type}.`);
+            }
+            builtInTypes.add(cost.type);
+        }
+        if (cost.type === 'CEL' && cost.cel.trim().length === 0) {
+            throw new Error(`Envoy AI Gateway CEL request cost ${cost.metadataKey} requires a non-empty expression.`);
+        }
+    }
+    return costs.map((cost) => ({ ...cost }));
+}
+function resolveTokenCostMetadataKeys(requestCosts) {
+    const byType = new Map(requestCosts
+        .filter((cost) => cost.type !== 'CEL')
+        .map((cost) => [cost.type, cost.metadataKey]));
+    return new Map([
+        ['input-tokens', 'InputToken'],
+        ['output-tokens', 'OutputToken'],
+        ['total-tokens', 'TotalToken'],
+        ['cached-input-tokens', 'CachedInputToken'],
+        ['cache-creation-input-tokens', 'CacheCreationInputToken'],
+        ['reasoning-tokens', 'ReasoningToken'],
+    ].flatMap(([tokenCost, requestCostType]) => {
+        const metadataKey = byType.get(requestCostType);
+        return metadataKey ? [[tokenCost, metadataKey]] : [];
+    }));
+}
+function validateRateLimitMetadataReferences(rateLimit, metadataKeys) {
+    for (const rule of rateLimit?.rules ?? []) {
+        if (!rule.cost || rule.cost === 'request')
+            continue;
+        if (!metadataKeys.has(rule.cost)) {
+            throw new Error(`Envoy AI Gateway rate-limit cost ${rule.cost} requires a matching requestCosts dimension.`);
+        }
+    }
+}
+function requiredTokenCostMetadataKey(metadataKeys, cost) {
+    const metadataKey = metadataKeys.get(cost);
+    if (!metadataKey) {
+        throw new Error(`Envoy AI Gateway rate-limit cost ${cost} requires a matching requestCosts dimension.`);
+    }
+    return metadataKey;
+}
+function validateRateLimit(rateLimit) {
+    if (!rateLimit)
+        return undefined;
+    if (rateLimit.redisUrl.trim().length === 0 || rateLimit.redisUrl.includes('://')) {
+        throw new Error('Envoy AI Gateway rateLimit.redisUrl must be a non-empty host:port endpoint without a URL scheme.');
+    }
+    if (rateLimit.rules.length === 0) {
+        throw new Error('Envoy AI Gateway rate limiting requires at least one rule.');
+    }
+    if (rateLimit.rules.length > 64) {
+        throw new Error('Envoy AI Gateway supports at most 64 rate-limit rules.');
+    }
+    for (const rule of rateLimit.rules) {
+        if (!Number.isSafeInteger(rule.requests) || rule.requests <= 0) {
+            throw new Error('Envoy AI Gateway rate-limit requests must be positive safe integers.');
+        }
+        if (rule.identityHeader !== undefined && rule.identityHeader.trim().length === 0) {
+            throw new Error('Envoy AI Gateway rate-limit identityHeader must be non-empty when supplied.');
+        }
+    }
+    return {
+        redisUrl: rateLimit.redisUrl,
+        rules: rateLimit.rules.map((rule) => ({
+            ...rule,
+            cost: rule.cost ?? 'total-tokens',
+        })),
+    };
+}
+function validateAndResolveProviders(providers) {
+    if (providers.length === 0) {
+        throw new Error('makeEnvoyAIGateway requires at least one provider.');
+    }
+    if (providers.length > 32) {
+        throw new Error('makeEnvoyAIGateway supports at most 32 providers per gateway.');
+    }
+    const names = new Set();
+    return providers.map((provider) => {
+        assertTopologyName('provider', provider.name, 20);
+        if (names.has(provider.name)) {
+            throw new Error(`Duplicate Envoy AI Gateway provider name ${provider.name}.`);
+        }
+        names.add(provider.name);
+        if (provider.kind === 'openai') {
+            const port = provider.port ?? 443;
+            assertKubernetesPort(`provider ${provider.name}`, port);
+            return {
+                name: provider.name,
+                hostname: provider.hostname ?? 'api.openai.com',
+                port,
+                tls: provider.tls ?? true,
+                schema: 'OpenAI',
+                ...(provider.prefix ? { prefix: provider.prefix } : {}),
+                security: {
+                    type: 'api-key',
+                    secretName: provider.credential.name,
+                    ...(provider.credential.namespace
+                        ? { secretNamespace: provider.credential.namespace }
+                        : {}),
+                },
+            };
+        }
+        if (provider.kind === 'anthropic') {
+            const port = provider.port ?? 443;
+            assertKubernetesPort(`provider ${provider.name}`, port);
+            return {
+                name: provider.name,
+                hostname: provider.hostname ?? 'api.anthropic.com',
+                port,
+                tls: provider.tls ?? true,
+                schema: 'Anthropic',
+                security: {
+                    type: 'anthropic-api-key',
+                    secretName: provider.credential.name,
+                    ...(provider.credential.namespace
+                        ? { secretNamespace: provider.credential.namespace }
+                        : {}),
+                },
+            };
+        }
+        if (provider.kind === 'aws-bedrock') {
+            if (provider.region.length === 0) {
+                throw new Error(`AWS Bedrock provider ${provider.name} requires a non-empty region.`);
+            }
+            return {
+                name: provider.name,
+                hostname: `bedrock-runtime.${provider.region}.amazonaws.com`,
+                port: 443,
+                tls: true,
+                schema: provider.api === 'anthropic' ? 'AWSAnthropic' : 'AWSBedrock',
+                security: provider.credential?.source === 'secret'
+                    ? {
+                        type: 'aws',
+                        region: provider.region,
+                        secretName: provider.credential.secret.name,
+                        ...(provider.credential.secret.namespace
+                            ? { secretNamespace: provider.credential.secret.namespace }
+                            : {}),
+                        profile: provider.credential.profile ?? 'default',
+                    }
+                    : {
+                        type: 'aws',
+                        region: provider.region,
+                        profile: 'default',
+                    },
+            };
+        }
+        const port = provider.port ?? (provider.tls === false ? 80 : 443);
+        assertKubernetesPort(`provider ${provider.name}`, port);
+        return {
+            name: provider.name,
+            hostname: provider.hostname,
+            port,
+            tls: provider.tls ?? true,
+            schema: 'OpenAI',
+            ...(provider.prefix ? { prefix: provider.prefix } : {}),
+            security: provider.credential
+                ? {
+                    type: 'api-key',
+                    secretName: provider.credential.name,
+                    ...(provider.credential.namespace
+                        ? { secretNamespace: provider.credential.namespace }
+                        : {}),
+                }
+                : { type: 'none' },
+        };
+    });
+}
+function validateModels(options, providers) {
+    if (options.models.length === 0) {
+        throw new Error('makeEnvoyAIGateway requires at least one logical model.');
+    }
+    if (options.models.length > 128) {
+        throw new Error('makeEnvoyAIGateway supports at most 128 logical models.');
+    }
+    const providerNames = new Set(providers.map(({ name }) => name));
+    const modelNames = new Set();
+    for (const model of options.models) {
+        if (model.model.length === 0) {
+            throw new Error('Envoy AI Gateway logical model names must be non-empty.');
+        }
+        if (modelNames.has(model.model)) {
+            throw new Error(`Duplicate Envoy AI Gateway logical model ${model.model}.`);
+        }
+        modelNames.add(model.model);
+        if (model.targets.length === 0) {
+            throw new Error(`Envoy AI Gateway model ${model.model} requires at least one target.`);
+        }
+        for (const target of model.targets) {
+            if (!providerNames.has(target.provider)) {
+                throw new Error(`Envoy AI Gateway model ${model.model} references unknown provider ${target.provider}.`);
+            }
+            if (target.weight !== undefined &&
+                (!Number.isSafeInteger(target.weight) || target.weight < 0)) {
+                throw new Error(`Envoy AI Gateway model ${model.model} target weights must be non-negative integers.`);
+            }
+            if (target.priority !== undefined &&
+                (!Number.isSafeInteger(target.priority) || target.priority < 0)) {
+                throw new Error(`Envoy AI Gateway model ${model.model} target priorities must be non-negative integers.`);
+            }
+        }
+    }
+}
+function assertTopologyName(label, value, maximumLength) {
+    if (value.length === 0 ||
+        value.length > maximumLength ||
+        !/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/u.test(value)) {
+        throw new Error(`Envoy AI Gateway ${label} name ${JSON.stringify(value)} must be a DNS-1123 label no longer than ${maximumLength} characters.`);
+    }
+}
+function assertKubernetesPort(label, value) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > 65_535) {
+        throw new Error(`Envoy AI Gateway ${label} port ${String(value)} must be an integer from 1 through 65535.`);
+    }
+}
+function providerResourceId(name) {
+    const readable = name
+        .split('-')
+        .filter((part) => part.length > 0)
+        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
+        .join('');
+    const digest = createHash('sha256').update(name, 'utf8').digest('hex').slice(0, 10);
+    return `provider${readable}${digest}`;
+}
+//# sourceMappingURL=gateway.js.map