[LLM] add system-one endpoint for TypeSafe AI jev

[pmilliotte]

Description

Adds a third endpoint kind, system_one, alongside stream and batch, with one endpoint on it:
TypeSafe AI's jev-latest. It answers named yes/no, choice and score questions about a piece of
state in a single round trip, so it fits neither StreamEndpoint (no token stream) nor
BatchEndpoint (no job lifecycle) — SystemOneEndpoint extends Client directly and wraps
@typesafe-ai/sdk.

Two knock-on changes come from adding a Lab, both forced by the typechecker:

• PassthroughLab is defined by Exclude, so a new lab opts into provider passthrough by
  default. typesafe_ai joins the exclusion list: system one is single-shot, so there is no
  assistant turn to replay verbatim.
• LAB_TO_PROVIDER_ID is a total Record<Lab, ModelProviderIdType> and typesafe_ai has no
  legacy provider id. The key is narrowed and reads go through labToProviderId, which asserts
  instead of persisting a stand-in id on a usage row.

Nothing calls the endpoint yet, so the dust layer (lib/llms/system_one/), a registry, and any
STATIC_MODEL_IDS / pricing / tier entries are deliberately out of scope — jev is not a chat
model and does not belong in the picker. contextSize, maxOutputTokens and tokenPricing carry
TODOs naming the missing source rather than invented numbers.

Tests

Nine unit tests covering the answer mapping, usage normalization, request shape, and the error
table (401, 500, refused connection, client-side rejection). They drive the SDK through an injected
fetch, so no network. Two of them pin the new security contract: the API key comes from the
passed Credentials and never from an ambient TYPESAFE_API_KEY — the SDK silently falls back to
that env var when apiKey is undefined, which would serve a BYOK workspace on a Dust key.

Risk

Low. The only change to an existing path is labToProviderId, whose assert fires on a lab that
cannot reach a stream or batch transition.

Deploy Plan

• Standard deploy, no migration needed
• Deploy main on front
• TYPESAFE_AI_API_KEY is read from the environment but is not set anywhere yet; nothing calls the
  endpoint, so it can be provisioned before the first caller lands

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
playground	Ignored		Sep 20, 2026 3:54pm UTC
storybook	Ignored		Sep 20, 2026 3:54pm UTC