@nevescloud/pip 3.8.1 → 3.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nevescloud/pip",
-  "version": "3.8.1",
+  "version": "3.8.2",
   "description": "Floating assistant bubble + panel + chat runtime. ESM, no build.",
   "type": "module",
   "main": "pip-core.esm.js",

package/providers/anthropic.esm.js

@@ -23,8 +23,14 @@ export function anthropic({
   effort,
   cacheControl,
   extraHeaders = {},
+  // When true, the host is routing through a proxy/bridge that injects
+  // auth + version headers server-side. The provider then sends only
+  // content-type; this avoids the CORS preflight burden of x-api-key /
+  // anthropic-version / anthropic-dangerous-direct-browser-access on
+  // proxies that haven't allowlisted those headers.
+  proxied = false,
 } = {}) {
-  if (!apiKey) throw new Error('anthropic provider: apiKey is required');
+  if (!proxied && !apiKey) throw new Error('anthropic provider: apiKey is required (or set proxied: true when routing through a bridge that injects auth)');
 
   return async function* anthropicProvider({ messages, tools, system, signal }) {
     const body = {
@@ -45,15 +51,16 @@ export function anthropic({
     if (effort) body.output_config = { effort };
     if (cacheControl) body.cache_control = { type: cacheControl };
 
+    const headers = { 'content-type': 'application/json', ...extraHeaders };
+    if (!proxied) {
+      headers['x-api-key'] = apiKey;
+      headers['anthropic-version'] = ANTHROPIC_VERSION;
+      headers['anthropic-dangerous-direct-browser-access'] = 'true';
+    }
+
     const res = await fetch(`${baseUrl}/v1/messages`, {
       method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        'x-api-key': apiKey,
-        'anthropic-version': ANTHROPIC_VERSION,
-        'anthropic-dangerous-direct-browser-access': 'true',
-        ...extraHeaders,
-      },
+      headers,
       body: JSON.stringify(body),
       signal,
     });