v4.3.0 — Verified chart filters and early validation

Adds verified AI Gateway chart filters for requests, cost, tokens and latency, pinning the already-published SDK 0.24.0 exactly.

• Shared SDK schema validates filters before CLI client creation and cost workspace resolution. CSV lists preserve OR semantics; distinct filters use AND. Token and cost bounds are inclusive, with zero and fractional cents preserved.
• Cost queries resolve workspace UUIDs to the required slug. Malformed day counts such as 7junk exit 2. Existing cost JSON/YAML cents/USD fields, pretty-dollar rendering and rolling-day windows remain compatible.
• All 1,127 tests, coverage gates, lint, formatting, typecheck and strict Docusaurus build pass. Remote CI passes. Independent packaged CLI checks cover all seven payload files, five distribution files, 19 library exports, version and inference/chart help.
• Candidate live validation passes 54/54 chart contracts, 8/8 inference checks, 3/3 empty-window checks and 12/12 cross-service reads/benign scan. Temporary keys are retired; read-only configuration remains unchanged. Actual sanitized captures are in the documentation; registry-installed validation follows publication.

AI Gateway direct upstream coverage remains 138/242 (57.02%), with 22 partial analytics operations. Existing provider, service, cleanup and authorization failures remain documented. This release does not claim 99% gateway coverage, successful realtime inference for the prescribed model, public WAN readiness or local container execution.

Telemetry examples
SDK conformance assessment

Post-publication verification

The independently npm-installed CLI passes 54/54 chart contracts, 8/8 inference and 3/3 empty-window checks. All seven payload files and 19 exports match; the user-installed airs is upgraded and passes 12/12 cross-service reads/benign scan. All 28 historical release-inference keys are independently confirmed absent. The first stale-metadata/missing-install attempt remains in history; the corrected harness now verifies the executable before creating a key.

Container publication passed with digest sha256:0776cbec1ea9df248ab2d5c0b9b20679da0b54e95931cc00be4039c0012a7c00. Public anonymous pull and local container execution are not certified.

The obsolete 4.2.2 publisher was subsequently cancelled after confirming a shared latest-tag collision. Only after cancellation completed, 4.3.0 publication was rerun successfully to reassert 4.3.0, 4.3 and latest: the current digest is sha256:d673943af4ec1c2c99893005d1f5a7801030cc534befe137dad5e192980d2cba. npm/Git release versions are unchanged.

Additional self-review remains open: the CLI production lockfile reports five high and one moderate advisory across js-yaml, nanoid and optional sharp; fresh npm resolution leaves sharp and its parent-package propagation. Native PNG/JPEG generation works, but dlp generate --output json prints a human-readable summary. These are explicitly documented failures/follow-ups, not a clean security or full-project completion claim. Current full-scope assessment remains 5/10.