Changelog

Changes that affect you: SDK and CLI releases, gateway behaviour, and model catalog updates. Internal infrastructure work is deliberately omitted.

@ai-setu/client

0.16.1

• docs: update package READMEs for #208 Connection-slug routing. The client README now teaches @<slug>/<model> + the connection option + connectionSlug (replacing a stale label/model example that would 400 and the deprecated workspaceCredential); admin/cli/mcp READMEs document slug and the new CLI connections verbs. README-only — no code change.

0.16.0

• feat(client): Connection-slug routing (#208). RoutingInfo now exposes connectionSlug (the #208 name for the BYOK routing handle), parsed from the new X-AI-Setu-Credential-Slug header with a fall back to the existing X-AI-Setu-Credential-Label (which has always carried the slug value); credentialLabel is kept as a deprecated alias carrying the same value. A new connection: '@slug' constructor option pins a default Connection for the client (a leading @ is accepted and stripped); workspaceCredential is deprecated but still honoured, with connection winning when both are set. Additive — no behaviour change for callers that read neither.

0.15.0

• feat(client): surface BYOK attribution from the gateway. The gateway now stamps X-AI-Setu-BYOK, X-AI-Setu-Credential-Id, and X-AI-Setu-Credential-Label on every inference response, and the SDK parses them into a new RoutingInfo exposed via the onRouting callback and the synchronous client.lastRouting getter. This lets a runtime agent verify, per request, that its own BYOK key actually served — and catch the silent fallback where a typo'd credential label quietly serves on the platform key (byok: false). Additive; no behaviour change for callers that don't read it.

0.11.0

• Replace floating "latest" dependency ranges with exact pinned versions across all workspace manifests. Each "latest" entry was pinned to the version already resolved in pnpm-lock.yaml, so installs are now reproducible with zero version change to the dependency graph. Closes #33.

0.9.1

• Release automation + CI/CD modernization. No SDK API changes — this is an infrastructure and release-process release:
  • Releases are now fully PR-driven and automatic with zero human touchpoint: the changesets "chore: release" PR opens on its own, and merging it publishes to npm, then — in the same workflow run — builds once, deploys all services to production, and cosign-signs the release. No extra tokens or secrets required.
  • Migrated CI/CD from CircleCI to GitHub Actions: images are built once on native arm64 and reused by immutable digest across scan, preview, and deploy.
  • Added per-PR ephemeral preview environments. Multi-provider routing (Google Gemini, model-based routing) already shipped in 0.9.0; this release brings the modernized pipeline that deploys it.

0.6.0

• Rewrite all four client-facing package READMEs agent-first. Primary audience is AI builders / coding agents (humans secondary): each README now leads with a "read this first" orientation + a copy-paste TL;DR, a terse "Rules for agent" block of imperatives, and front-loaded minimal working examples. All code blocks, commands, env-var names, model strings, and method names are unchanged and copy-paste exact — only the surrounding prose was rewritten. No API or behavior change.

0.2.3

• Pair the shared undici dispatcher with undici's own fetch. A dispatcher created from the npm undici package is incompatible with Node's built-in fetch (mismatched internal undici versions): Node 24 rejects the request outright (UND_ERR_INVALID_ARG: invalid onRequestStart method) and Node 26 silently returns responses with empty headers — which broke JSON content-type detection (chat completions resolved to a raw string instead of a parsed object) and suppressed the onBalanceUpdate /lastBalance balance signal. Both SDKs now resolve the underlying fetch from the same undici module whenever a dispatcher rides the fetch options; an explicit user-supplied fetch still always wins.

0.2.2

• The gateway now honours the documented <provider>/<model> prefix routing on /v1/chat/completions: anthropic/* models are translated (request, response, and SSE stream) between the OpenAI chat-completions shape and Anthropic's Messages API, so @ai-setu/client works with Anthropic models out of the box. Unknown provider prefixes return an explicit 400. Balance headers (X-AI-Setu-Balance-*) now ride every successful response (they were previously written after the status line and silently dropped), and versioned model ids (…-20251001) price as their alias instead of falling through to the flat per-request fee.

0.2.1

• READMEs: document that the GitHub Release tarball URL needs auth while the repo is private (download via gh release download first). Ships alongside two server-side fixes found in the 2026-06-11 prod live test: the gateway now also accepts the api-convention AI_OPENAI_API_KEY / AI_ANTHROPIC_API_KEY env names for platform provider keys (the shared infra secret map injects them under those names, leaving the gateway blind to a configured key — every inference 502'd "provider credential unavailable"), and the anonymous auth endpoints return 400 VALIDATION_ERROR instead of 500 on missing body fields.

@ai-setu/cli

0.16.1

• docs: update package READMEs for #208 Connection-slug routing. The client README now teaches @<slug>/<model> + the connection option + connectionSlug (replacing a stale label/model example that would 400 and the deprecated workspaceCredential); admin/cli/mcp READMEs document slug and the new CLI connections verbs. README-only — no code change.

0.16.0

• feat(cli): ai-setu connections (alias credentials) verbs — list / add / test / revoke for BYOK Connections (the @<slug>/<model> routing handles), backed by the admin SDK. add takes --provider --slug --key plus the per-provider extras (--base-url, --workspace, --default-model, --daily-cap-usd, Azure/AWS/Vertex flags); --daily-cap-usd converts to micros. Closes the CLI gap where credentials/connections had no verbs.

0.11.0

• Replace floating "latest" dependency ranges with exact pinned versions across all workspace manifests. Each "latest" entry was pinned to the version already resolved in pnpm-lock.yaml, so installs are now reproducible with zero version change to the dependency graph. Closes #33.

0.6.0

• Rewrite all four client-facing package READMEs agent-first. Primary audience is AI builders / coding agents (humans secondary): each README now leads with a "read this first" orientation + a copy-paste TL;DR, a terse "Rules for agent" block of imperatives, and front-loaded minimal working examples. All code blocks, commands, env-var names, model strings, and method names are unchanged and copy-paste exact — only the surrounding prose was rewritten. No API or behavior change.

0.2.1

• READMEs: document that the GitHub Release tarball URL needs auth while the repo is private (download via gh release download first). Ships alongside two server-side fixes found in the 2026-06-11 prod live test: the gateway now also accepts the api-convention AI_OPENAI_API_KEY / AI_ANTHROPIC_API_KEY env names for platform provider keys (the shared infra secret map injects them under those names, leaving the gateway blind to a configured key — every inference 502'd "provider credential unavailable"), and the anonymous auth endpoints return 400 VALIDATION_ERROR instead of 500 on missing body fields.

@ai-setu/mcp

0.16.1

• docs: update package READMEs for #208 Connection-slug routing. The client README now teaches @<slug>/<model> + the connection option + connectionSlug (replacing a stale label/model example that would 400 and the deprecated workspaceCredential); admin/cli/mcp READMEs document slug and the new CLI connections verbs. README-only — no code change.

0.16.0

• feat(admin,mcp): surface the Connection slug (#208). The admin SDK ProviderCredential now carries slug (the per-tenant-unique @<slug>/<model> routing handle), and providerCredentials.upsert accepts an optional slug alongside the now-optional label (slug wins; label still works as an alias). The MCP set_provider_credential tool gains an optional slug argument and list_provider_credentials surfaces it. Additive + back-compat.

0.14.0

• Add Stripe billing operations to the admin SDK and a top-up tool to the MCP server (two-way Stripe integration, Stripe as the source of truth). Backfills the changeset omitted from #179.

0.11.0

• Replace floating "latest" dependency ranges with exact pinned versions across all workspace manifests. Each "latest" entry was pinned to the version already resolved in pnpm-lock.yaml, so installs are now reproducible with zero version change to the dependency graph. Closes #33.

0.10.0

• feat(orgs): honor and persist referral attribution tag on org creation (#47) Threads an optional referral non-PII source tag through the full org-creation stack — MCP tool arg → REST body → auth service validation → orgs service → ai_setu_orgs.referral column (new varchar(64), set-once at insert).
  • create_org MCP tool accepts referral?: string (charset ^[a-z0-9._-]+$, max 64 chars). Set AI_SETU_REFERRAL env var to stamp every call automatically.
  • POST /auth/org/create body forwards referral to AuthService, which normalizes (trim; absent/empty → null) and validates (charset + length) at the trust boundary. Value is never logged.
  • OrgsService.provisionAiSetuExtras writes the referral on the initial ai_setu_orgs insert; set-once semantics are preserved by the existing create-only insert path.
  • Platform-admin Tier-1 (/admin/graphql) now returns referral on both PlatformOrgSummary.orgs and orgBySlug queries.
  • Migration: ALTER TABLE ai_setu_orgs ADD COLUMN IF NOT EXISTS referral varchar(64).

0.8.0

• BYOK provider credentials over MCP. The MCP server gains four tools — set_provider_credential, list_provider_credentials, test_provider_credential, and remove_provider_credential — so an agent can configure a tenant's own upstream keys end-to-end (signup → keys → top-up → BYOK) without leaving MCP. Secrets are guarded: every secret field has a *_env twin (pass the name of an env var the server reads, keeping raw keys out of the tool-call arguments), the tool descriptions warn against echoing keys, and listing only ever returns a keyHint. @ai-setu/admin now expresses the full provider set: the UpsertProviderCredentialInput shape carries the Vertex fields (gcpServiceAccountJson, vertexProject, vertexRegion) and the ProviderCredentialKind enum includes bedrockMantle and vertex. providerCredentials.upsert accepts the friendly bedrock-mantle alias and maps it to the bedrockMantle GraphQL enum member, so callers use one spelling everywhere.

0.7.0

• Tier-1 agent-native provisioning. A liable parent mints a server-side provisioning key (tt_prov_…, scope provision:write) and provisions child tenants programmatically — no inbox, no second signup.
  • @ai-setu/admin: admin.tenants.provision({ name, region?, billingMode? }) calls POST /provision/tenant and returns { tenantId, workspaceId, apiKey, topUpUrl } once. Requires a provisioning key (AI_SETU_PROVISIONING_KEY env or { provisioningKey } constructor option) — a PAT cannot provision.
  • @ai-setu/mcp: new provision_tenant tool, registered only when AI_SETU_PROVISIONING_KEY is set on the MCP server env. Billing defaults to delegated (child self-funds via topUpUrl); pooled (parent-balance draw) is not yet implemented. See docs/AGENT_PROVISIONING.md.

0.6.0

• Rewrite all four client-facing package READMEs agent-first. Primary audience is AI builders / coding agents (humans secondary): each README now leads with a "read this first" orientation + a copy-paste TL;DR, a terse "Rules for agent" block of imperatives, and front-loaded minimal working examples. All code blocks, commands, env-var names, model strings, and method names are unchanged and copy-paste exact — only the surrounding prose was rewritten. No API or behavior change.

0.2.1

• READMEs: document that the GitHub Release tarball URL needs auth while the repo is private (download via gh release download first). Ships alongside two server-side fixes found in the 2026-06-11 prod live test: the gateway now also accepts the api-convention AI_OPENAI_API_KEY / AI_ANTHROPIC_API_KEY env names for platform provider keys (the shared infra secret map injects them under those names, leaving the gateway blind to a configured key — every inference 502'd "provider credential unavailable"), and the anonymous auth endpoints return 400 VALIDATION_ERROR instead of 500 on missing body fields.

@ai-setu/admin

0.16.1

• docs: update package READMEs for #208 Connection-slug routing. The client README now teaches @<slug>/<model> + the connection option + connectionSlug (replacing a stale label/model example that would 400 and the deprecated workspaceCredential); admin/cli/mcp READMEs document slug and the new CLI connections verbs. README-only — no code change.

0.16.0

• feat(admin,mcp): surface the Connection slug (#208). The admin SDK ProviderCredential now carries slug (the per-tenant-unique @<slug>/<model> routing handle), and providerCredentials.upsert accepts an optional slug alongside the now-optional label (slug wins; label still works as an alias). The MCP set_provider_credential tool gains an optional slug argument and list_provider_credentials surfaces it. Additive + back-compat.

0.14.0

• Add Stripe billing operations to the admin SDK and a top-up tool to the MCP server (two-way Stripe integration, Stripe as the source of truth). Backfills the changeset omitted from #179.

0.11.0

• Replace floating "latest" dependency ranges with exact pinned versions across all workspace manifests. Each "latest" entry was pinned to the version already resolved in pnpm-lock.yaml, so installs are now reproducible with zero version change to the dependency graph. Closes #33.

0.8.0

• BYOK provider credentials over MCP. The MCP server gains four tools — set_provider_credential, list_provider_credentials, test_provider_credential, and remove_provider_credential — so an agent can configure a tenant's own upstream keys end-to-end (signup → keys → top-up → BYOK) without leaving MCP. Secrets are guarded: every secret field has a *_env twin (pass the name of an env var the server reads, keeping raw keys out of the tool-call arguments), the tool descriptions warn against echoing keys, and listing only ever returns a keyHint. @ai-setu/admin now expresses the full provider set: the UpsertProviderCredentialInput shape carries the Vertex fields (gcpServiceAccountJson, vertexProject, vertexRegion) and the ProviderCredentialKind enum includes bedrockMantle and vertex. providerCredentials.upsert accepts the friendly bedrock-mantle alias and maps it to the bedrockMantle GraphQL enum member, so callers use one spelling everywhere.
• Native Google Gemini provider. Models prefixed gemini/ (e.g. gemini/gemini-2.5-pro) route through a new gateway adapter that translates the OpenAI chat-completions / embeddings shape to Gemini's generateContent API and back (request, non-stream response, SSE stream, tool/function-calling round-trip, and JSON/structured output). BYOK is supported: the provider_credential_kind enum gains gemini, upsertProviderCredential accepts provider: gemini with a standard apiKey, and the credential test probe verifies it against the Generative Language models endpoint with the x-goog-api-key header.

0.7.0

• Tier-1 agent-native provisioning. A liable parent mints a server-side provisioning key (tt_prov_…, scope provision:write) and provisions child tenants programmatically — no inbox, no second signup.
  • @ai-setu/admin: admin.tenants.provision({ name, region?, billingMode? }) calls POST /provision/tenant and returns { tenantId, workspaceId, apiKey, topUpUrl } once. Requires a provisioning key (AI_SETU_PROVISIONING_KEY env or { provisioningKey } constructor option) — a PAT cannot provision.
  • @ai-setu/mcp: new provision_tenant tool, registered only when AI_SETU_PROVISIONING_KEY is set on the MCP server env. Billing defaults to delegated (child self-funds via topUpUrl); pooled (parent-balance draw) is not yet implemented. See docs/AGENT_PROVISIONING.md.

0.6.0

• Add admin.providerCredentials for BYOK credential management: availability, list, upsert, test, and revoke. upsert accepts an OpenAI/Anthropic apiKey or, for provider: 'bedrock', the awsAccessKeyId / awsSecretAccessKey / awsRegion triple; test runs the upstream probe (STS GetCallerIdentity for Bedrock). Secrets are write-only — responses carry just a keyHint.
• Pin the optional undici dependency to ^7.16.0 (was latest). The floating latest range resolved to undici 8.x, which requires Node ≥22.19 and so silently broke the package's advertised engines.node: ">=20" support. Pinning to ^7.16.0 matches @ai-setu/client, restores Node 20 compatibility, and makes the published artifact reproducible.
• Rewrite all four client-facing package READMEs agent-first. Primary audience is AI builders / coding agents (humans secondary): each README now leads with a "read this first" orientation + a copy-paste TL;DR, a terse "Rules for agent" block of imperatives, and front-loaded minimal working examples. All code blocks, commands, env-var names, model strings, and method names are unchanged and copy-paste exact — only the surrounding prose was rewritten. No API or behavior change.

0.5.0

• BYOK for AWS Bedrock: upsertProviderCredential accepts provider: bedrock with awsAccessKeyId / awsSecretAccessKey / awsRegion (no apiKey). The pair is sealed in the same encrypted envelope as other providers, the credential test probe verifies it via a SigV4-signed STS GetCallerIdentity call, and the gateway signs tenant Bedrock traffic with the stored keys instead of the platform role when a bedrock credential matches the request.

0.3.0

• Cache operations and intelligence (issue #121 Phase C). The admin SDK gains cache.purge({ workspaceId, namespace? }) backed by a new purgeGatewayCache mutation — flushes a workspace's (or one namespace's) cached responses across both layers: Redis exact-cache entries (the key layout now carries workspace and namespace segments for bounded SCAN deletion) and pgvector semantic rows. The gateway adds semantic-cache telemetry (search counters by outcome + a similarity histogram for threshold tuning) and an adaptive depth valve: each workspace's semantic searches are capped at the conversation depth that still produces hits, learned from per-depth-bucket hit-rate stats — unprofitable deep searches stop paying the embedding round-trip. Gateway-induced latency remains sub-millisecond (cache-hit handler path ~70µs in-process; valve cap reads are served from an in-process cache).

0.2.3

• Pair the shared undici dispatcher with undici's own fetch. A dispatcher created from the npm undici package is incompatible with Node's built-in fetch (mismatched internal undici versions): Node 24 rejects the request outright (UND_ERR_INVALID_ARG: invalid onRequestStart method) and Node 26 silently returns responses with empty headers — which broke JSON content-type detection (chat completions resolved to a raw string instead of a parsed object) and suppressed the onBalanceUpdate /lastBalance balance signal. Both SDKs now resolve the underlying fetch from the same undici module whenever a dispatcher rides the fetch options; an explicit user-supplied fetch still always wins.

0.2.1

• READMEs: document that the GitHub Release tarball URL needs auth while the repo is private (download via gh release download first). Ships alongside two server-side fixes found in the 2026-06-11 prod live test: the gateway now also accepts the api-convention AI_OPENAI_API_KEY / AI_ANTHROPIC_API_KEY env names for platform provider keys (the shared infra secret map injects them under those names, leaving the gateway blind to a configured key — every inference 502'd "provider credential unavailable"), and the anonymous auth endpoints return 400 VALIDATION_ERROR instead of 500 on missing body fields.