feat: textToSfx, videoToSfx and task polling (v0.2.0)

[spencer-zqian]

Adds the three new SFX endpoints to the JS/TS SDK, mirroring sonilo-ai/sonilo-python#3, and fixes a set of bugs found along the way — several of which affect the already-shipped music endpoints too.

What's new

SFX is submit-then-poll (unlike the streaming music endpoints), so the SDK wraps the polling but keeps the primitives exposed:

import { SoniloClient, download } from "sonilo";

const client = new SoniloClient();
const result = await client.textToSfx.generate({ prompt: "glass shattering", duration: 5 });
await writeFile("sfx.m4a", await download(result.audio));

const task = await client.videoToSfx.submit({
  video: "clip.mp4",                        // or videoUrl: "..."
  segments: [{ start: 0, end: 2.5, prompt: "footsteps on gravel" }],
  audioFormat: "wav",
});
const result = await client.tasks.wait(task.task_id);   // or tasks.get() for a single poll

• textToSfx / videoToSfx: submit() (returns SfxTask) and generate() (= submit + wait).
• tasks: get() (single fetch, never throws on a failed task) and wait() (polls to a terminal state).
• download(media) fetches the presigned R2 URL; no API key is ever sent to the R2 host.
• New errors: TaskFailedError (with .code, .refunded), TaskTimeoutError (resumable), RequestTimeoutError.
• Params are camelCase; response fields stay snake_case, matching the existing convention.

Bug fixes (several pre-date this branch)

The SDK was parsing an error field the API never sends. The public /v1/* routes return {"code", "message"} (see the backend's app/errors.py), not FastAPI's {"detail"} — so every API error degraded to HTTP 400: Bad Request and the real cause was discarded. This affected the shipped music endpoints too. APIError now exposes .code and .errors (422 validation details), and BadRequestError.detail works again.

Also fixed, all with regression tests:

• No timeout anywhere: fetch has no default timeout, so a stalled connection hung wait()/generate() forever. Added a configurable 600s request timeout (SoniloClientOptions.timeout) via AbortSignal, surfaced as a typed RequestTimeoutError rather than a raw DOMException. Streaming music generation deliberately opts out — an absolute signal would kill a healthy long-running stream — and TextToMusicParams/VideoToMusicParams now accept a signal so callers can cancel one themselves (the README previously pointed at two APIs that didn't exist).
• A malformed audio_chunk was silently dropped as an unknown event, so generate() returned a "successful" Track with empty/truncated audio and no error. Now throws GenerationError.
• A bare null NDJSON line crashed with an untyped TypeError.
• download() threw a raw TypeError when handed the media of a task that hadn't finished.
• wait() used wall-clock Date.now() for its deadline (an NTP correction or laptop sleep could fire a spurious timeout), slept past its own deadline, and busy-looped against the API on a negative pollInterval (169 requests in 200ms). All fixed.

Verification

npm test: 99 passing. tsc --noEmit and tsup clean.

End-to-end against production: text-to-sfx and video-to-sfx (multipart upload, including a real 30s video) both generate, poll, download and save real audio/video — downloaded bytes match the reported file_size, WAV/MP4 headers validate, and the muxed video carries the generated audio track. Error mapping, validation, 404s and path-injection guards verified live, and behaviour matches the Python SDK case-for-case.

Version bumped 0.1.0 → 0.2.0.