@moxxy/plugin-provider-zai 0.21.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Moxxy (moxxy.ai)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+import { glmModels } from './models.js';
+export { glmModels };
+/**
+ * z.ai in "API key" mode: the standard, pay-as-you-go endpoint, which speaks
+ * the OpenAI Chat Completions protocol. Reuses the shared
+ * {@link defineOpenAICompatProvider} with the vendor slug + base URL + GLM
+ * catalog forced on (so usage stats, provider events and error context
+ * attribute to `zai`, not `openai`).
+ *
+ * `resolveApiKey` refuses an absent/empty key rather than letting
+ * {@link OpenAIProvider} fall back to `process.env.OPENAI_API_KEY` — the
+ * baseURL is pinned to api.z.ai, so that fallback would silently ship the
+ * user's OpenAI credential to a third-party host on a misconfigured provider.
+ */
+export declare const zaiProviderDef: import("@moxxy/sdk").ProviderDef;
+/**
+ * z.ai in "plan" mode: the GLM Coding Plan, billed against a subscription and
+ * served over an Anthropic Messages-compatible endpoint (the same one Claude
+ * Code targets). Reuses {@link AnthropicProvider} with the GLM catalog and the
+ * z.ai base URL — only the credential + endpoint differ from the plain
+ * `anthropic` provider. No `validateKey`: z.ai's Anthropic endpoint exposes no
+ * free model-list probe, and the plan key is proven by the first request.
+ */
+export declare const zaiCodingPlanProviderDef: import("@moxxy/sdk").ProviderDef;
+export declare const zaiPlugin: import("@moxxy/sdk").Plugin;
+export default zaiPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAQrB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,kCAazB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,kCAsBnC,CAAC;AAEH,eAAO,MAAM,SAAS,6BAIpB,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,76 @@
+import { defineProvider, definePlugin } from '@moxxy/sdk';
+import { defineOpenAICompatProvider, pickOpenAICompatConfig } from '@moxxy/plugin-provider-openai';
+import { AnthropicProvider } from '@moxxy/plugin-provider-anthropic';
+import { glmModels } from './models.js';
+export { glmModels };
+/** Pay-as-you-go OpenAI-compatible endpoint (standard z.ai API key). */
+const ZAI_OPENAI_BASE_URL = 'https://api.z.ai/api/paas/v4';
+/** GLM Coding Plan — Anthropic Messages-compatible endpoint (the one Claude Code uses). */
+const ZAI_ANTHROPIC_BASE_URL = 'https://api.z.ai/api/anthropic';
+const ZAI_DEFAULT_MODEL = 'glm-4.6';
+/**
+ * z.ai in "API key" mode: the standard, pay-as-you-go endpoint, which speaks
+ * the OpenAI Chat Completions protocol. Reuses the shared
+ * {@link defineOpenAICompatProvider} with the vendor slug + base URL + GLM
+ * catalog forced on (so usage stats, provider events and error context
+ * attribute to `zai`, not `openai`).
+ *
+ * `resolveApiKey` refuses an absent/empty key rather than letting
+ * {@link OpenAIProvider} fall back to `process.env.OPENAI_API_KEY` — the
+ * baseURL is pinned to api.z.ai, so that fallback would silently ship the
+ * user's OpenAI credential to a third-party host on a misconfigured provider.
+ */
+export const zaiProviderDef = defineOpenAICompatProvider({
+    name: 'zai',
+    baseURL: ZAI_OPENAI_BASE_URL,
+    defaultModel: ZAI_DEFAULT_MODEL,
+    models: glmModels,
+    resolveApiKey: (cfg) => {
+        if (!cfg.apiKey)
+            throw new Error('zai requires an API key (set the zai provider apiKey or ZAI_API_KEY)');
+        return cfg.apiKey;
+    },
+    auth: {
+        kind: 'apiKey',
+        hint: 'z.ai API key (pay-as-you-go) from https://z.ai/manage-apikey/apikey-list',
+    },
+});
+/**
+ * z.ai in "plan" mode: the GLM Coding Plan, billed against a subscription and
+ * served over an Anthropic Messages-compatible endpoint (the same one Claude
+ * Code targets). Reuses {@link AnthropicProvider} with the GLM catalog and the
+ * z.ai base URL — only the credential + endpoint differ from the plain
+ * `anthropic` provider. No `validateKey`: z.ai's Anthropic endpoint exposes no
+ * free model-list probe, and the plan key is proven by the first request.
+ */
+export const zaiCodingPlanProviderDef = defineProvider({
+    name: 'zai-coding-plan',
+    models: [...glmModels],
+    createClient: (config) => {
+        const cfg = pickOpenAICompatConfig(config);
+        // Refuse to construct without a key: AnthropicProvider falls back to
+        // process.env.ANTHROPIC_API_KEY when apiKey is absent, while baseURL is
+        // pinned to z.ai's Anthropic endpoint — forwarding an empty key would
+        // silently exfiltrate the user's real Anthropic credential to api.z.ai.
+        if (!cfg.apiKey)
+            throw new Error('zai-coding-plan requires an API key (set the zai-coding-plan provider apiKey)');
+        return new AnthropicProvider({
+            apiKey: cfg.apiKey,
+            name: 'zai-coding-plan',
+            baseURL: cfg.baseURL ?? ZAI_ANTHROPIC_BASE_URL,
+            defaultModel: cfg.defaultModel ?? ZAI_DEFAULT_MODEL,
+            models: glmModels,
+        });
+    },
+    auth: {
+        kind: 'apiKey',
+        hint: 'z.ai GLM Coding Plan key (Anthropic-compatible endpoint, like Claude Code)',
+    },
+});
+export const zaiPlugin = definePlugin({
+    name: '@moxxy/plugin-provider-zai',
+    version: '0.0.0',
+    providers: [zaiProviderDef, zaiCodingPlanProviderDef],
+});
+export default zaiPlugin;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,2FAA2F;AAC3F,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAChE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;IACvD,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,mBAAmB;IAC5B,YAAY,EAAE,iBAAiB;IAC/B,MAAM,EAAE,SAAS;IACjB,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE;QACrB,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACzG,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,0EAA0E;KACjF;CACF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;IACrD,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;IACtB,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAClH,OAAO,IAAI,iBAAiB,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,sBAAsB;YAC9C,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,iBAAiB;YACnD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4EAA4E;KACnF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;IACpC,IAAI,EAAE,4BAA4B;IAClC,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACtD,CAAC,CAAC;AAEH,eAAe,SAAS,CAAC"}

package/dist/models.d.ts

@@ -0,0 +1,16 @@
+import type { ModelDescriptor } from '@moxxy/sdk';
+/**
+ * z.ai (Zhipu) GLM model catalog, as of 2026-06. Shared by both the
+ * pay-as-you-go `zai` provider (OpenAI-compatible endpoint) and the
+ * `zai-coding-plan` provider (Anthropic-compatible endpoint) — the GLM model
+ * ids are identical across both surfaces; only the transport/billing differ.
+ *
+ * Numbers are the documented limits as of June 2026 (verify against
+ * https://docs.z.ai/guides/llm). GLM-5.2 is the coding-first flagship with a
+ * usable 1M-token context (released 2026-06-13); the GLM-4.5 tier tops out at
+ * 128k. Only the `-v` (vision) variants accept image input. An unlisted model
+ * id still streams fine — it's passed straight through to the endpoint; the
+ * catalog only drives context-window budgets and capability gating.
+ */
+export declare const glmModels: ReadonlyArray<ModelDescriptor>;
+//# sourceMappingURL=models.d.ts.map

package/dist/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,aAAa,CAAC,eAAe,CAmBpD,CAAC"}

package/dist/models.js

@@ -0,0 +1,31 @@
+/**
+ * z.ai (Zhipu) GLM model catalog, as of 2026-06. Shared by both the
+ * pay-as-you-go `zai` provider (OpenAI-compatible endpoint) and the
+ * `zai-coding-plan` provider (Anthropic-compatible endpoint) — the GLM model
+ * ids are identical across both surfaces; only the transport/billing differ.
+ *
+ * Numbers are the documented limits as of June 2026 (verify against
+ * https://docs.z.ai/guides/llm). GLM-5.2 is the coding-first flagship with a
+ * usable 1M-token context (released 2026-06-13); the GLM-4.5 tier tops out at
+ * 128k. Only the `-v` (vision) variants accept image input. An unlisted model
+ * id still streams fine — it's passed straight through to the endpoint; the
+ * catalog only drives context-window budgets and capability gating.
+ */
+export const glmModels = [
+    // GLM-5 family: coding-first frontier. 5.2 carries a usable 1M context.
+    // These are reasoning models; the shared OpenAIProvider already streams their
+    // `reasoning_content` deltas, so supportsReasoning gates reasoning_effort +
+    // reasoning-stream surfacing on (without it the capability is dead upstream).
+    { id: 'glm-5.2', contextWindow: 1_000_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+    { id: 'glm-5.1', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+    { id: 'glm-5', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+    // GLM-4.6: prior flagship, 200k context, strong agentic-coding scores.
+    { id: 'glm-4.6', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+    // GLM-4.5 tier: general (4.5), lightweight (-air), free/fast (-flash).
+    { id: 'glm-4.5', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+    { id: 'glm-4.5-air', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+    { id: 'glm-4.5-flash', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+    // Vision-capable variant.
+    { id: 'glm-4.5v', contextWindow: 65_536, maxOutputTokens: 16_384, supportsTools: true, supportsStreaming: true, supportsImages: true },
+];
+//# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,SAAS,GAAmC;IACvD,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC5I,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC1I,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAExI,uEAAuE;IACvE,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAE1I,uEAAuE;IACvE,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAChH,EAAE,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IACpH,EAAE,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAEtH,0BAA0B;IAC1B,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;CACvI,CAAC"}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@moxxy/plugin-provider-zai",
+  "version": "0.21.1",
+  "description": "z.ai (Zhipu GLM) LLMProvider plugin for moxxy. Ships two providers: `zai` (pay-as-you-go, OpenAI-compatible endpoint) and `zai-coding-plan` (GLM Coding Plan, Anthropic-compatible endpoint).",
+  "keywords": [
+    "moxxy",
+    "agent",
+    "provider",
+    "zai",
+    "zhipu",
+    "glm",
+    "llm"
+  ],
+  "homepage": "https://moxxy.ai",
+  "bugs": {
+    "url": "https://github.com/moxxy-ai/moxxy/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moxxy-ai/moxxy.git",
+    "directory": "packages/plugin-provider-zai"
+  },
+  "author": "Michal Makowski <michal.makowski97@gmail.com>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "moxxy": {
+    "plugin": {
+      "entry": "./dist/index.js",
+      "kind": "provider"
+    }
+  },
+  "dependencies": {
+    "@moxxy/plugin-provider-anthropic": "0.21.1",
+    "@moxxy/plugin-provider-openai": "0.21.1",
+    "@moxxy/sdk": "0.21.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8",
+    "zod": "^3.24.0",
+    "@moxxy/tsconfig": "0.0.0",
+    "@moxxy/vitest-preset": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist .turbo"
+  }
+}

package/src/index.baseurl.test.ts

@@ -0,0 +1,107 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { DefineOpenAICompatProviderSpec } from '@moxxy/plugin-provider-openai';
+
+/**
+ * The whole point of this plugin is that traffic (and the z.ai key) goes to
+ * api.z.ai — the OpenAI-compatible endpoint for `zai`, the Anthropic-compatible
+ * endpoint for `zai-coding-plan` — and NEVER to openai.com / anthropic.com. The
+ * resolved base URLs are private inside the underlying SDK clients, so a
+ * refactor that dropped `ZAI_OPENAI_BASE_URL` / `ZAI_ANTHROPIC_BASE_URL` (or
+ * routed one mode through the wrong vendor) would ship the z.ai credential to
+ * the wrong host and still pass the rest of the suite.
+ *
+ * These tests pin the wiring at zai's own trust boundary: they mock zai's two
+ * direct workspace deps and assert that the z.ai base URLs (and slug/catalog)
+ * reach the construction call. The real `pickOpenAICompatConfig` narrowing is
+ * preserved so the `zai-coding-plan` config-handling stays exercised.
+ */
+
+const ZAI_OPENAI_BASE_URL = 'https://api.z.ai/api/paas/v4';
+const ZAI_ANTHROPIC_BASE_URL = 'https://api.z.ai/api/anthropic';
+
+/** Captured spec from the (mocked) defineOpenAICompatProvider call. */
+let compatSpec: DefineOpenAICompatProviderSpec | undefined;
+/** Captured config from the (mocked) AnthropicProvider construction. */
+let anthropicConfig: Record<string, unknown> | undefined;
+
+vi.mock('@moxxy/plugin-provider-openai', async (importActual) => {
+  const actual = await importActual<typeof import('@moxxy/plugin-provider-openai')>();
+  return {
+    ...actual,
+    // Capture the spec zai hands the shared factory, and return a tiny stub
+    // ProviderDef so importing index.ts doesn't construct a real SDK client.
+    defineOpenAICompatProvider: (spec: DefineOpenAICompatProviderSpec) => {
+      compatSpec = spec;
+      return {
+        name: spec.name,
+        models: [...spec.models],
+        createClient: () => ({ name: spec.name, models: spec.models }),
+        ...(spec.auth ? { auth: spec.auth } : {}),
+      };
+    },
+  };
+});
+
+vi.mock('@moxxy/plugin-provider-anthropic', () => ({
+  // Spy class: record the config zai passes, expose name/models like the real
+  // provider so any later assertions still see a usable shape.
+  AnthropicProvider: class {
+    name: string;
+    models: unknown;
+    constructor(config: Record<string, unknown>) {
+      anthropicConfig = config;
+      this.name = typeof config.name === 'string' ? config.name : 'anthropic';
+      this.models = config.models;
+    }
+  },
+}));
+
+describe('@moxxy/plugin-provider-zai base-URL pinning', () => {
+  beforeEach(() => {
+    compatSpec = undefined;
+    anthropicConfig = undefined;
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.resetModules();
+  });
+
+  it('`zai` is wired to the z.ai OpenAI-compatible endpoint, not openai.com', async () => {
+    const { zaiProviderDef } = await import('./index.js');
+    expect(zaiProviderDef.name).toBe('zai');
+    // The slug + base URL + default model + catalog reach the shared factory.
+    expect(compatSpec).toBeDefined();
+    expect(compatSpec?.name).toBe('zai');
+    expect(compatSpec?.baseURL).toBe(ZAI_OPENAI_BASE_URL);
+    expect(compatSpec?.baseURL).not.toContain('openai.com');
+    expect(compatSpec?.defaultModel).toBe('glm-4.6');
+    expect(compatSpec?.models.map((m) => m.id)).toContain('glm-5.2');
+  });
+
+  it('`zai-coding-plan` constructs AnthropicProvider against the z.ai Anthropic endpoint, not anthropic.com', async () => {
+    const { zaiCodingPlanProviderDef } = await import('./index.js');
+    const client = zaiCodingPlanProviderDef.createClient({ apiKey: 'plan-key' });
+    expect(client.name).toBe('zai-coding-plan');
+    expect(anthropicConfig).toBeDefined();
+    expect(anthropicConfig?.name).toBe('zai-coding-plan');
+    expect(anthropicConfig?.apiKey).toBe('plan-key');
+    expect(anthropicConfig?.baseURL).toBe(ZAI_ANTHROPIC_BASE_URL);
+    expect(String(anthropicConfig?.baseURL)).not.toContain('anthropic.com');
+    expect(anthropicConfig?.defaultModel).toBe('glm-4.6');
+  });
+
+  it('`zai-coding-plan` config may override the base URL but a wrong-typed override falls back to the z.ai endpoint', async () => {
+    const { zaiCodingPlanProviderDef } = await import('./index.js');
+
+    // A valid string override is honored (self-hosted / proxy).
+    zaiCodingPlanProviderDef.createClient({ apiKey: 'k', baseURL: 'https://proxy.internal/anthropic' });
+    expect(anthropicConfig?.baseURL).toBe('https://proxy.internal/anthropic');
+
+    // A wrong-typed baseURL is dropped by pickOpenAICompatConfig and must fall
+    // back to the pinned z.ai endpoint — never leak through as a bogus value.
+    anthropicConfig = undefined;
+    zaiCodingPlanProviderDef.createClient({ apiKey: 'k', baseURL: { not: 'a string' } } as Record<string, unknown>);
+    expect(anthropicConfig?.baseURL).toBe(ZAI_ANTHROPIC_BASE_URL);
+  });
+});

package/src/index.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, it } from 'vitest';
+import { zaiPlugin, zaiProviderDef, zaiCodingPlanProviderDef, glmModels } from './index.js';
+
+describe('@moxxy/plugin-provider-zai', () => {
+  it('registers the two GLM providers under the right names', () => {
+    expect(zaiPlugin.providers?.map((p) => p.name)).toEqual(['zai', 'zai-coding-plan']);
+  });
+
+  it('advertises the GLM catalog (including the 1M-context glm-5.2 flagship)', () => {
+    expect(zaiProviderDef.models).toEqual(glmModels);
+    expect(zaiCodingPlanProviderDef.models).toEqual(glmModels);
+    const flagship = glmModels.find((m) => m.id === 'glm-5.2');
+    expect(flagship).toMatchObject({ contextWindow: 1_000_000 });
+  });
+
+  it('createClient stamps the vendor slug so usage/errors attribute to z.ai, not openai/anthropic', () => {
+    const api = zaiProviderDef.createClient({ apiKey: 'test-key' });
+    expect(api.name).toBe('zai');
+    expect(api.models).toEqual(glmModels);
+
+    const plan = zaiCodingPlanProviderDef.createClient({ apiKey: 'test-key' });
+    expect(plan.name).toBe('zai-coding-plan');
+    expect(plan.models).toEqual(glmModels);
+  });
+
+  it('narrows the untyped registry config — wrong-typed fields do not crash createClient', () => {
+    // The registry hands createClient a `Record<string, unknown>`; the old
+    // blanket `config as OpenAIProviderConfig` would smuggle wrong-typed
+    // fields straight into the client. The runtime pick must drop non-string
+    // apiKey/baseURL/defaultModel (falling back to the z.ai defaults) rather
+    // than forward garbage, while still producing a usable client.
+    const messy: Record<string, unknown> = {
+      apiKey: 'test-key',
+      baseURL: { not: 'a string' },
+      defaultModel: ['nope'],
+      extraneous: 'ignored',
+    };
+    const api = zaiProviderDef.createClient(messy);
+    expect(api.name).toBe('zai');
+    expect(api.models).toEqual(glmModels);
+    expect(typeof api.stream).toBe('function');
+
+    const plan = zaiCodingPlanProviderDef.createClient(messy);
+    expect(plan.name).toBe('zai-coding-plan');
+    expect(plan.models).toEqual(glmModels);
+    expect(typeof plan.stream).toBe('function');
+  });
+
+  it('refuses to construct without a key (no env-fallback credential exfiltration to api.z.ai)', () => {
+    // baseURL is pinned to api.z.ai for both modes; if createClient forwarded
+    // an absent key, the underlying providers fall back to
+    // ANTHROPIC_API_KEY / OPENAI_API_KEY and ship the user's real credential to
+    // the third-party host. The guard must throw instead.
+    for (const empty of [{}, { apiKey: undefined }, { apiKey: '' }, { apiKey: 123 }] as Record<string, unknown>[]) {
+      expect(() => zaiProviderDef.createClient(empty)).toThrow(/api key/i);
+      expect(() => zaiCodingPlanProviderDef.createClient(empty)).toThrow(/api key/i);
+    }
+  });
+
+  it('exposes apiKey auth descriptors for both modes', () => {
+    expect(zaiProviderDef.auth).toMatchObject({ kind: 'apiKey' });
+    expect(zaiCodingPlanProviderDef.auth).toMatchObject({ kind: 'apiKey' });
+  });
+
+  it('the GLM-5 family + glm-4.6 advertise supportsReasoning so reasoning is requested', () => {
+    // Reasoning is gated upstream on descriptor.supportsReasoning; without it
+    // ProviderRequest.reasoning is always undefined for these reasoning models
+    // and the streamed reasoning summary the OpenAIProvider plumbs is never
+    // surfaced.
+    for (const id of ['glm-5.2', 'glm-5.1', 'glm-5', 'glm-4.6']) {
+      expect(glmModels.find((m) => m.id === id)?.supportsReasoning, id).toBe(true);
+    }
+  });
+});

package/src/index.ts

@@ -0,0 +1,79 @@
+import { defineProvider, definePlugin } from '@moxxy/sdk';
+import { defineOpenAICompatProvider, pickOpenAICompatConfig } from '@moxxy/plugin-provider-openai';
+import { AnthropicProvider } from '@moxxy/plugin-provider-anthropic';
+import { glmModels } from './models.js';
+
+export { glmModels };
+
+/** Pay-as-you-go OpenAI-compatible endpoint (standard z.ai API key). */
+const ZAI_OPENAI_BASE_URL = 'https://api.z.ai/api/paas/v4';
+/** GLM Coding Plan — Anthropic Messages-compatible endpoint (the one Claude Code uses). */
+const ZAI_ANTHROPIC_BASE_URL = 'https://api.z.ai/api/anthropic';
+const ZAI_DEFAULT_MODEL = 'glm-4.6';
+
+/**
+ * z.ai in "API key" mode: the standard, pay-as-you-go endpoint, which speaks
+ * the OpenAI Chat Completions protocol. Reuses the shared
+ * {@link defineOpenAICompatProvider} with the vendor slug + base URL + GLM
+ * catalog forced on (so usage stats, provider events and error context
+ * attribute to `zai`, not `openai`).
+ *
+ * `resolveApiKey` refuses an absent/empty key rather than letting
+ * {@link OpenAIProvider} fall back to `process.env.OPENAI_API_KEY` — the
+ * baseURL is pinned to api.z.ai, so that fallback would silently ship the
+ * user's OpenAI credential to a third-party host on a misconfigured provider.
+ */
+export const zaiProviderDef = defineOpenAICompatProvider({
+  name: 'zai',
+  baseURL: ZAI_OPENAI_BASE_URL,
+  defaultModel: ZAI_DEFAULT_MODEL,
+  models: glmModels,
+  resolveApiKey: (cfg) => {
+    if (!cfg.apiKey) throw new Error('zai requires an API key (set the zai provider apiKey or ZAI_API_KEY)');
+    return cfg.apiKey;
+  },
+  auth: {
+    kind: 'apiKey',
+    hint: 'z.ai API key (pay-as-you-go) from https://z.ai/manage-apikey/apikey-list',
+  },
+});
+
+/**
+ * z.ai in "plan" mode: the GLM Coding Plan, billed against a subscription and
+ * served over an Anthropic Messages-compatible endpoint (the same one Claude
+ * Code targets). Reuses {@link AnthropicProvider} with the GLM catalog and the
+ * z.ai base URL — only the credential + endpoint differ from the plain
+ * `anthropic` provider. No `validateKey`: z.ai's Anthropic endpoint exposes no
+ * free model-list probe, and the plan key is proven by the first request.
+ */
+export const zaiCodingPlanProviderDef = defineProvider({
+  name: 'zai-coding-plan',
+  models: [...glmModels],
+  createClient: (config) => {
+    const cfg = pickOpenAICompatConfig(config);
+    // Refuse to construct without a key: AnthropicProvider falls back to
+    // process.env.ANTHROPIC_API_KEY when apiKey is absent, while baseURL is
+    // pinned to z.ai's Anthropic endpoint — forwarding an empty key would
+    // silently exfiltrate the user's real Anthropic credential to api.z.ai.
+    if (!cfg.apiKey) throw new Error('zai-coding-plan requires an API key (set the zai-coding-plan provider apiKey)');
+    return new AnthropicProvider({
+      apiKey: cfg.apiKey,
+      name: 'zai-coding-plan',
+      baseURL: cfg.baseURL ?? ZAI_ANTHROPIC_BASE_URL,
+      defaultModel: cfg.defaultModel ?? ZAI_DEFAULT_MODEL,
+      models: glmModels,
+    });
+  },
+  auth: {
+    kind: 'apiKey',
+    hint: 'z.ai GLM Coding Plan key (Anthropic-compatible endpoint, like Claude Code)',
+  },
+});
+
+export const zaiPlugin = definePlugin({
+  name: '@moxxy/plugin-provider-zai',
+  version: '0.0.0',
+  providers: [zaiProviderDef, zaiCodingPlanProviderDef],
+});
+
+export default zaiPlugin;

package/src/models.ts

@@ -0,0 +1,35 @@
+import type { ModelDescriptor } from '@moxxy/sdk';
+
+/**
+ * z.ai (Zhipu) GLM model catalog, as of 2026-06. Shared by both the
+ * pay-as-you-go `zai` provider (OpenAI-compatible endpoint) and the
+ * `zai-coding-plan` provider (Anthropic-compatible endpoint) — the GLM model
+ * ids are identical across both surfaces; only the transport/billing differ.
+ *
+ * Numbers are the documented limits as of June 2026 (verify against
+ * https://docs.z.ai/guides/llm). GLM-5.2 is the coding-first flagship with a
+ * usable 1M-token context (released 2026-06-13); the GLM-4.5 tier tops out at
+ * 128k. Only the `-v` (vision) variants accept image input. An unlisted model
+ * id still streams fine — it's passed straight through to the endpoint; the
+ * catalog only drives context-window budgets and capability gating.
+ */
+export const glmModels: ReadonlyArray<ModelDescriptor> = [
+  // GLM-5 family: coding-first frontier. 5.2 carries a usable 1M context.
+  // These are reasoning models; the shared OpenAIProvider already streams their
+  // `reasoning_content` deltas, so supportsReasoning gates reasoning_effort +
+  // reasoning-stream surfacing on (without it the capability is dead upstream).
+  { id: 'glm-5.2', contextWindow: 1_000_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+  { id: 'glm-5.1', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+  { id: 'glm-5', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+
+  // GLM-4.6: prior flagship, 200k context, strong agentic-coding scores.
+  { id: 'glm-4.6', contextWindow: 200_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsReasoning: true },
+
+  // GLM-4.5 tier: general (4.5), lightweight (-air), free/fast (-flash).
+  { id: 'glm-4.5', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+  { id: 'glm-4.5-air', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+  { id: 'glm-4.5-flash', contextWindow: 131_072, maxOutputTokens: 98_304, supportsTools: true, supportsStreaming: true },
+
+  // Vision-capable variant.
+  { id: 'glm-4.5v', contextWindow: 65_536, maxOutputTokens: 16_384, supportsTools: true, supportsStreaming: true, supportsImages: true },
+];