feat: SDK updates with API changes, type safety improvements, and Biome config

[mattapperson]

Summary

This PR brings several improvements to the TypeScript SDK:

API Changes

• Updated OpenAPI specification with latest OpenRouter API features
• Added debug parameter with echoUpstreamBody option for chat generation
• New ChatCompletionFinishReason enum for better finish reason handling
• Added ChatStreamingChoice type for streaming responses
• New plugin types: PluginResponseHealing
• Added TTL support for cache control
• Updated response format union ordering for better type inference
• New Debug type for debugging options
• Added allowEmptyValue support in query encoding

Type Safety Improvements

• Replaced any types with unknown throughout tool-types.ts:
  • ZodType<any> → ZodType<unknown> in all tool interfaces
  • ToolWithExecute<any, any> → proper generic constraints
  • ToolWithGenerator<any, any> → proper generic constraints
• Improved type imports using import type where appropriate
• Better separation of type-only imports from value imports

Code Quality: Biome Configuration

Added comprehensive biome.json configuration to enforce code quality:

• Linting Rules:
  • noExplicitAny: "error" - Bans explicit any types
  • noUnusedImports: "error" - Removes dead imports
  • noConsole: "error" - Prevents console statements
  • noDoubleEquals: "error" - Enforces strict equality
  • useNodejsImportProtocol: "error" - Enforces node: protocol
• Style Rules:
  • useImportType with separated type imports
  • useConst, useBlockStatements, noParameterAssign
• Performance Rules:
  • noAccumulatingSpread: "error"
• Formatting:
  • 2-space indentation, 100 char line width
  • Single quotes, trailing commas
  • Organized imports with blank line separators

Note: ESLint configuration is still present in this repo. This PR introduces Biome as the new linting/formatting tool, but we cannot fully cut over yet. Follow-up PRs will complete the migration from ESLint to Biome.

Other Changes

• Switched to pnpm for package management
• Updated SDK version to 0.2.2
• Reformatted example files and tests to match new style

Test Plan

• Run pnpm install to verify dependency installation
• Run pnpm exec biome check to verify linting passes
• Run pnpm exec tsc to verify type checking passes
• Run existing tests to verify no regressions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​radix-ui/​react-slot@​1.2.4
	@​types/​react-dom@​19.2.2 ⏵ 19.2.3
	@​types/​react@​18.3.26 ⏵ 19.2.7				-1
	tailwindcss@​4.1.16 ⏵ 4.1.17
	tailwind-merge@​3.3.1 ⏵ 3.4.0			+1
	@​eslint/​eslintrc@​3.3.3
	eslint@​9.39.1
	@​tailwindcss/​postcss@​4.1.16 ⏵ 4.1.17				+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: examples/nextjs-example/package.json → npm/next@15.5.4 → npm/caniuse-lite@1.0.30001757 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001757. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report