@node-llm/core 1.16.2 → 1.17.1

package/dist/providers/anthropic/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/anthropic/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAqDrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/anthropic/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAM3C,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAyDrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}

package/dist/providers/anthropic/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { Capabilities } from "./Capabilities.js";
 import { ModelRegistry } from "../../models/ModelRegistry.js";
 export class AnthropicModels {
@@ -9,14 +11,14 @@ export class AnthropicModels {
     }
     async execute() {
         try {
-            const response = await fetch(`${this.baseUrl}/models`, {
+            const response = await fetchWithTimeout(`${this.baseUrl}/models`, {
                 method: "GET",
                 headers: {
                     "x-api-key": this.apiKey,
                     "anthropic-version": "2023-06-01",
                     "content-type": "application/json"
                 }
-            });
+            }, config.requestTimeout);
             if (response.ok) {
                 const { data } = (await response.json());
                 return data.map((m) => {

package/dist/providers/bedrock/BedrockProvider.js

@@ -65,7 +65,7 @@ export class BedrockProvider extends BaseProvider {
         this.moderationHandler = new BedrockModeration(config);
     }
     apiBase() {
-        return getBedrockEndpoint(this.config.region);
+        return getBedrockEndpoint(this.config.region, this.config.apiBase);
     }
     headers() {
         // Headers are built dynamically based on auth mode

package/dist/providers/bedrock/Chat.js

@@ -20,7 +20,7 @@ export class BedrockChat {
     constructor(config) {
         this.config = config;
         this.authMode = validateBedrockConfig(config);
-        this.baseUrl = getBedrockEndpoint(config.region);
+        this.baseUrl = getBedrockEndpoint(config.region, config.apiBase);
     }
     /**
      * Execute a chat request against Bedrock Converse API.

package/dist/providers/bedrock/Embeddings.js

@@ -17,7 +17,7 @@ export class BedrockEmbeddings {
     constructor(config) {
         this.config = config;
         this.authMode = validateBedrockConfig(config);
-        this.baseUrl = getBedrockEndpoint(config.region);
+        this.baseUrl = getBedrockEndpoint(config.region, config.apiBase);
     }
     /**
      * Execute an embedding request against Bedrock InvokeModel API.

package/dist/providers/bedrock/Image.js

@@ -12,7 +12,7 @@ export class BedrockImage {
     baseUrl;
     constructor(config) {
         this.config = config;
-        this.baseUrl = getBedrockEndpoint(config.region);
+        this.baseUrl = getBedrockEndpoint(config.region, config.apiBase);
     }
     /**
      * Execute an image generation request.

package/dist/providers/bedrock/Moderation.js

@@ -15,7 +15,7 @@ export class BedrockModeration {
     constructor(config) {
         this.config = config;
         this.authMode = validateBedrockConfig(config);
-        this.baseUrl = getBedrockEndpoint(config.region);
+        this.baseUrl = getBedrockEndpoint(config.region, config.apiBase);
     }
     /**
      * Execute a moderation request against Bedrock Guardrails.

package/dist/providers/bedrock/Streaming.js

@@ -18,7 +18,7 @@ export class BedrockStreaming {
     constructor(config) {
         this.config = config;
         this.authMode = validateBedrockConfig(config);
-        this.baseUrl = getBedrockEndpoint(config.region);
+        this.baseUrl = getBedrockEndpoint(config.region, config.apiBase);
     }
     async *execute(request, controller) {
         const internalController = new AbortController();

package/dist/providers/bedrock/config.d.ts

@@ -37,6 +37,12 @@ export interface BedrockConfig {
      * Default: 120000 (2 minutes)
      */
     requestTimeout?: number;
+    /**
+     * Custom Bedrock Runtime endpoint override (e.g. for routing traffic
+     * through a proxy or private gateway). Defaults to the standard
+     * `https://bedrock-runtime.{region}.amazonaws.com` endpoint when unset.
+     */
+    apiBase?: string;
     /**
      * Default Bedrock Guardrail identifier (ID or ARN).
      */
@@ -52,6 +58,8 @@ export interface BedrockConfig {
 export declare function validateBedrockConfig(config: BedrockConfig): "apiKey" | "sigv4";
 /**
  * Build the Bedrock Runtime endpoint URL for a given region.
+ * Pass `apiBase` to route through a custom endpoint (e.g. a proxy/gateway)
+ * instead of the standard AWS Bedrock Runtime URL.
  */
-export declare function getBedrockEndpoint(region: string): string;
+export declare function getBedrockEndpoint(region: string, apiBase?: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/providers/bedrock/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/providers/bedrock/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAKf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAKhB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,CAuB/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/providers/bedrock/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAKf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAKhB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,CAuB/E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/providers/bedrock/config.js

@@ -27,7 +27,9 @@ export function validateBedrockConfig(config) {
 }
 /**
  * Build the Bedrock Runtime endpoint URL for a given region.
+ * Pass `apiBase` to route through a custom endpoint (e.g. a proxy/gateway)
+ * instead of the standard AWS Bedrock Runtime URL.
  */
-export function getBedrockEndpoint(region) {
-    return `https://bedrock-runtime.${region}.amazonaws.com`;
+export function getBedrockEndpoint(region, apiBase) {
+    return apiBase || `https://bedrock-runtime.${region}.amazonaws.com`;
 }

package/dist/providers/bedrock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/bedrock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,wBAAgB,uBAAuB,SAuBtC;AAED,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/bedrock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,wBAAgB,uBAAuB,SAwBtC;AAED,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,cAAc,YAAY,CAAC"}

package/dist/providers/bedrock/index.js

@@ -19,6 +19,7 @@ export function registerBedrockProvider() {
             accessKeyId: cfg.bedrockAccessKeyId,
             secretAccessKey: cfg.bedrockSecretAccessKey,
             sessionToken: cfg.bedrockSessionToken,
+            apiBase: cfg.bedrockApiBase,
             guardrailIdentifier: cfg.bedrockGuardrailIdentifier,
             guardrailVersion: cfg.bedrockGuardrailVersion
         };

package/dist/providers/deepseek/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/deepseek/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAe3C,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;CA+DtC"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/deepseek/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAiB3C,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;CAmEtC"}

package/dist/providers/deepseek/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { Capabilities } from "./Capabilities.js";
 import { ModelRegistry } from "../../models/ModelRegistry.js";
 export class DeepSeekModels {
@@ -8,12 +10,12 @@ export class DeepSeekModels {
         this.apiKey = apiKey;
     }
     async execute() {
-        const response = await fetch(`${this.baseUrl}/models`, {
+        const response = await fetchWithTimeout(`${this.baseUrl}/models`, {
             method: "GET",
             headers: {
                 Authorization: `Bearer ${this.apiKey}`
             }
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             // Fallback to local registry
             const localModels = ModelRegistry.all()

package/dist/providers/gemini/Embeddings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Embeddings.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Embeddings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA2CrE"}
+{"version":3,"file":"Embeddings.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Embeddings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOrE,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA+CrE"}

package/dist/providers/gemini/Embeddings.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { handleGeminiError } from "./Errors.js";
 import { logger } from "../../utils/logger.js";
 export class GeminiEmbeddings {
@@ -26,11 +28,11 @@ export class GeminiEmbeddings {
             })
         };
         logger.logRequest("Gemini", "POST", url, payload);
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(payload)
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             await handleGeminiError(response, modelId);
         }

package/dist/providers/gemini/Image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Image.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK7D,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;CAiE7D"}
+{"version":3,"file":"Image.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAO7D,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;CAqE7D"}

package/dist/providers/gemini/Image.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { handleGeminiError } from "./Errors.js";
 import { logger } from "../../utils/logger.js";
 import { BinaryUtils } from "../../utils/Binary.js";
@@ -36,13 +38,13 @@ export class GeminiImage {
             }
         };
         logger.logRequest("Gemini", "POST", url, body);
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json"
             },
             body: JSON.stringify(body)
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             await handleGeminiError(response, modelId);
         }

package/dist/providers/gemini/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAmDrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAO3C,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAuDrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}

package/dist/providers/gemini/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { Capabilities } from "./Capabilities.js";
 import { ModelRegistry } from "../../models/ModelRegistry.js";
 export class GeminiModels {
@@ -9,12 +11,12 @@ export class GeminiModels {
     }
     async execute() {
         try {
-            const response = await fetch(`${this.baseUrl}/models?key=${this.apiKey}`, {
+            const response = await fetchWithTimeout(`${this.baseUrl}/models?key=${this.apiKey}`, {
                 method: "GET",
                 headers: {
                     "Content-Type": "application/json"
                 }
-            });
+            }, config.requestTimeout);
             if (response.ok) {
                 const { models } = (await response.json());
                 return models.map((m) => {

package/dist/providers/gemini/Transcription.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Transcription.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Transcription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAM7E,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CACuC;gBAG1D,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA8D7E"}
+{"version":3,"file":"Transcription.d.ts","sourceRoot":"","sources":["../../../src/providers/gemini/Transcription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAQ7E,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CACuC;gBAG1D,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAkE7E"}

package/dist/providers/gemini/Transcription.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { handleGeminiError } from "./Errors.js";
 import { BinaryUtils } from "../../utils/Binary.js";
 import { logger } from "../../utils/logger.js";
@@ -44,13 +46,13 @@ export class GeminiTranscription {
             }
         };
         logger.logRequest("Gemini", "POST", url, payload);
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json"
             },
             body: JSON.stringify(payload)
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             await handleGeminiError(response, model);
         }

package/dist/providers/mistral/Embedding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Embedding.d.ts","sourceRoot":"","sources":["../../../src/providers/mistral/Embedding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAoBrE,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAwCrE"}
+{"version":3,"file":"Embedding.d.ts","sourceRoot":"","sources":["../../../src/providers/mistral/Embedding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAsBrE,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA4CrE"}

package/dist/providers/mistral/Embedding.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { logger } from "../../utils/logger.js";
 import { handleMistralError } from "./Errors.js";
 import { MistralCapabilities } from "./Capabilities.js";
@@ -20,7 +22,7 @@ export class MistralEmbedding {
         };
         const url = `${this.baseUrl}/embeddings`;
         logger.logRequest("Mistral Embeddings", "POST", url, body);
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: "POST",
             headers: {
                 Authorization: `Bearer ${this.apiKey}`,
@@ -28,7 +30,7 @@ export class MistralEmbedding {
                 Accept: "application/json"
             },
             body: JSON.stringify(body)
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             await handleMistralError(response, model);
         }

package/dist/providers/mistral/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/mistral/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAgB3C,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;CAmEtC"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/mistral/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAkB3C,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;CAuEtC"}

package/dist/providers/mistral/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { MistralCapabilities } from "./Capabilities.js";
 import { ModelRegistry } from "../../models/ModelRegistry.js";
 export class MistralModels {
@@ -8,13 +10,13 @@ export class MistralModels {
         this.apiKey = apiKey;
     }
     async execute() {
-        const response = await fetch(`${this.baseUrl}/models`, {
+        const response = await fetchWithTimeout(`${this.baseUrl}/models`, {
             method: "GET",
             headers: {
                 Authorization: `Bearer ${this.apiKey}`,
                 Accept: "application/json"
             }
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             // Fallback to local registry
             const localModels = ModelRegistry.all()

package/dist/providers/openai/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK3C,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM;IAClC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAGnC,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAMpD,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQ1D,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQ5D,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM;;;;IAKvC,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAKpD,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM;IAK9B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IA0DrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/openai/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAO3C,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM;IAClC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAGnC,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAMpD,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQ1D,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQ5D,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM;;;;IAKvC,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAKpD,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM;IAK9B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IA8DrC,IAAI,CAAC,OAAO,EAAE,MAAM;CAGrB"}

package/dist/providers/openai/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 import { Capabilities } from "./Capabilities.js";
 import { ModelRegistry } from "../../models/ModelRegistry.js";
 import { buildUrl } from "./utils.js";
@@ -42,13 +44,13 @@ export class OpenAIModels {
     async execute() {
         const provider = this.getProviderName();
         try {
-            const response = await fetch(buildUrl(this.baseUrl, "/models"), {
+            const response = await fetchWithTimeout(buildUrl(this.baseUrl, "/models"), {
                 method: "GET",
                 headers: {
                     Authorization: `Bearer ${this.apiKey}`,
                     "Content-Type": "application/json"
                 }
-            });
+            }, config.requestTimeout);
             if (response.ok) {
                 const { data } = (await response.json());
                 return data.map((m) => {

package/dist/providers/openrouter/Models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/openrouter/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAwB3C,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAiBrC,OAAO,CAAC,UAAU;IA0BlB,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,YAAY;CAgCrB"}
+{"version":3,"file":"Models.d.ts","sourceRoot":"","sources":["../../../src/providers/openrouter/Models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA0B3C,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAG3B,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAqBrC,OAAO,CAAC,UAAU;IA0BlB,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,YAAY;CAgCrB"}

package/dist/providers/openrouter/Models.js

@@ -1,3 +1,5 @@
+import { config } from "../../config.js";
+import { fetchWithTimeout } from "../../utils/fetch.js";
 export class OpenRouterModels {
     baseUrl;
     apiKey;
@@ -6,12 +8,12 @@ export class OpenRouterModels {
         this.apiKey = apiKey;
     }
     async execute() {
-        const response = await fetch(`${this.baseUrl}/models`, {
+        const response = await fetchWithTimeout(`${this.baseUrl}/models`, {
             headers: {
                 Authorization: `Bearer ${this.apiKey}`,
                 "Content-Type": "application/json"
             }
-        });
+        }, config.requestTimeout);
         if (!response.ok) {
             throw new Error(`OpenRouter API error: ${response.status}`);
         }

package/dist/utils/Binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Binary.d.ts","sourceRoot":"","sources":["../../src/utils/Binary.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,WAAW;IACtB;;OAEG;WACU,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IA0C9D;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAI7C;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAIjD,OAAO,CAAC,MAAM,CAAC,aAAa;CA0B7B"}
+{"version":3,"file":"Binary.d.ts","sourceRoot":"","sources":["../../src/utils/Binary.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,WAAW;IACtB;;OAEG;WACU,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAmD9D;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAI7C;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAIjD,OAAO,CAAC,MAAM,CAAC,aAAa;CA0B7B"}

package/dist/utils/Binary.js

@@ -1,6 +1,8 @@
 import fs from "fs";
 import path from "path";
 import { logger } from "./logger.js";
+/** Max size (bytes) for a remotely-fetched binary, buffered fully into memory. */
+const MAX_REMOTE_BYTES = 50 * 1024 * 1024;
 export class BinaryUtils {
     /**
      * Converts a URL (data:, http:, or local path) to a base64 string and mime type.
@@ -20,7 +22,16 @@ export class BinaryUtils {
                 const response = await fetch(url);
                 if (!response.ok)
                     return null;
+                const declared = Number(response.headers.get("content-length"));
+                if (Number.isFinite(declared) && declared > MAX_REMOTE_BYTES) {
+                    logger.error(`Remote file exceeds ${MAX_REMOTE_BYTES}-byte limit: ${url}`);
+                    return null;
+                }
                 const buffer = await response.arrayBuffer();
+                if (buffer.byteLength > MAX_REMOTE_BYTES) {
+                    logger.error(`Remote file exceeds ${MAX_REMOTE_BYTES}-byte limit: ${url}`);
+                    return null;
+                }
                 const base64 = Buffer.from(buffer).toString("base64");
                 const mimeType = response.headers.get("content-type") || this.guessMimeType(url);
                 return {

package/dist/utils/FileLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileLoader.d.ts","sourceRoot":"","sources":["../../src/utils/FileLoader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgEjD,qBAAa,UAAU;WACR,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAmF1D"}
+{"version":3,"file":"FileLoader.d.ts","sourceRoot":"","sources":["../../src/utils/FileLoader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAyFjD,qBAAa,UAAU;WACR,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAmF1D"}

package/dist/utils/FileLoader.js

@@ -1,5 +1,23 @@
 import { promises as fs } from "fs";
 import * as path from "path";
+/**
+ * Maximum size (bytes) for a remotely-fetched attachment. Caps memory use and
+ * limits the blast radius if an untrusted URL is ever passed here (the fetched
+ * body is buffered fully into memory as base64). 50 MB comfortably covers
+ * images, audio, and PDFs sent to providers.
+ */
+const MAX_REMOTE_BYTES = 50 * 1024 * 1024;
+async function readCapped(response, source) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_REMOTE_BYTES) {
+        throw new Error(`Remote file ${source} is ${declared} bytes, exceeding the ${MAX_REMOTE_BYTES}-byte limit.`);
+    }
+    const buffer = await response.arrayBuffer();
+    if (buffer.byteLength > MAX_REMOTE_BYTES) {
+        throw new Error(`Remote file ${source} is ${buffer.byteLength} bytes, exceeding the ${MAX_REMOTE_BYTES}-byte limit.`);
+    }
+    return buffer;
+}
 const MIME_TYPES = {
     ".jpg": "image/jpeg",
     ".jpeg": "image/jpeg",
@@ -50,7 +68,8 @@ const TEXT_EXTENSIONS = new Set([
     ".xml",
     ".yml",
     ".yaml",
-    ".env",
+    // ".env" intentionally excluded: silently inlining a dotenv file would leak
+    // secrets into the prompt sent to the provider.
     ".csv",
     ".go",
     ".java",
@@ -67,7 +86,7 @@ export class FileLoader {
                 const response = await fetch(filePath);
                 if (!response.ok)
                     throw new Error(`Failed to fetch file: ${response.statusText}`);
-                const buffer = await response.arrayBuffer();
+                const buffer = await readCapped(response, filePath);
                 const contentTypeFull = response.headers.get("content-type") || "image/jpeg";
                 const contentType = (contentTypeFull.split(";")[0] ?? "image/jpeg").trim();
                 const base64 = Buffer.from(buffer).toString("base64");

package/dist/utils/handler-stacking.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Combines a single "constructor-provided" handler with a list of handlers
+ * appended later (e.g. via fluent on*() calls), preserving registration order.
+ */
+export declare function collectHandlers<T>(single: T | undefined, list: T[] | undefined): T[];
+/**
+ * Runs every handler with the given args, awaiting each in order. Use for
+ * pure observers (onNewMessage, onEndMessage, onToolCallStart, onToolCallEnd)
+ * where every registered handler should fire and none of them return a value.
+ */
+export declare function runAllHandlers<Args extends unknown[]>(handlers: Array<(...args: Args) => unknown>, ...args: Args): Promise<void>;
+/**
+ * Runs every handler in order and returns the first defined (non-void)
+ * result, but still calls the remaining handlers so every one of them gets a
+ * chance to observe/react (mirrors the middleware-runner directive pattern).
+ * Use for onToolCallError, where the first STOP/RETRY/CONTINUE wins.
+ */
+export declare function runDirectiveHandlers<Args extends unknown[], R>(handlers: Array<(...args: Args) => R | void | Promise<R | void>>, ...args: Args): Promise<R | undefined>;
+/**
+ * Runs every handler in order, AND-ing boolean results together. Used for
+ * onConfirmToolCall: every registered handler must approve for the call to
+ * proceed. Short-circuits once a handler declines.
+ */
+export declare function runConfirmHandlers<Args extends unknown[]>(handlers: Array<(...args: Args) => Promise<boolean> | boolean>, ...args: Args): Promise<boolean>;
+/**
+ * Runs every handler in order, feeding each handler's (possibly transformed)
+ * output into the next as its input. Used for onBeforeRequest/onAfterResponse,
+ * where each handler may rewrite the value for downstream handlers.
+ */
+export declare function runChainHandlers<T>(handlers: Array<(value: T) => Promise<T | void> | T | void>, initial: T): Promise<T>;
+//# sourceMappingURL=handler-stacking.d.ts.map

package/dist/utils/handler-stacking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-stacking.d.ts","sourceRoot":"","sources":["../../src/utils/handler-stacking.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,GAAG,CAAC,EAAE,CAKpF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,SAAS,OAAO,EAAE,EACzD,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,EAC3C,GAAG,IAAI,EAAE,IAAI,GACZ,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,SAAS,OAAO,EAAE,EAAE,CAAC,EAClE,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAChE,GAAG,IAAI,EAAE,IAAI,GACZ,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CASxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,OAAO,EAAE,EAC7D,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,EAC9D,GAAG,IAAI,EAAE,IAAI,GACZ,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,EAC3D,OAAO,EAAE,CAAC,GACT,OAAO,CAAC,CAAC,CAAC,CASZ"}

package/dist/utils/handler-stacking.js

@@ -0,0 +1,66 @@
+/**
+ * Combines a single "constructor-provided" handler with a list of handlers
+ * appended later (e.g. via fluent on*() calls), preserving registration order.
+ */
+export function collectHandlers(single, list) {
+    const handlers = [];
+    if (single)
+        handlers.push(single);
+    if (list)
+        handlers.push(...list);
+    return handlers;
+}
+/**
+ * Runs every handler with the given args, awaiting each in order. Use for
+ * pure observers (onNewMessage, onEndMessage, onToolCallStart, onToolCallEnd)
+ * where every registered handler should fire and none of them return a value.
+ */
+export async function runAllHandlers(handlers, ...args) {
+    for (const handler of handlers) {
+        await handler(...args);
+    }
+}
+/**
+ * Runs every handler in order and returns the first defined (non-void)
+ * result, but still calls the remaining handlers so every one of them gets a
+ * chance to observe/react (mirrors the middleware-runner directive pattern).
+ * Use for onToolCallError, where the first STOP/RETRY/CONTINUE wins.
+ */
+export async function runDirectiveHandlers(handlers, ...args) {
+    let result;
+    for (const handler of handlers) {
+        const value = await handler(...args);
+        if (value !== undefined && result === undefined) {
+            result = value;
+        }
+    }
+    return result;
+}
+/**
+ * Runs every handler in order, AND-ing boolean results together. Used for
+ * onConfirmToolCall: every registered handler must approve for the call to
+ * proceed. Short-circuits once a handler declines.
+ */
+export async function runConfirmHandlers(handlers, ...args) {
+    for (const handler of handlers) {
+        const approved = await handler(...args);
+        if (approved === false)
+            return false;
+    }
+    return true;
+}
+/**
+ * Runs every handler in order, feeding each handler's (possibly transformed)
+ * output into the next as its input. Used for onBeforeRequest/onAfterResponse,
+ * where each handler may rewrite the value for downstream handlers.
+ */
+export async function runChainHandlers(handlers, initial) {
+    let value = initial;
+    for (const handler of handlers) {
+        const result = await handler(value);
+        if (result !== undefined) {
+            value = result;
+        }
+    }
+    return value;
+}

package/dist/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAEA,cAAM,MAAM;IACV,OAAO,CAAC,cAAc;IAItB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAO5C;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAS/E;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IASvF,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI3B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAI3C,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAG5B;AAED,eAAO,MAAM,MAAM,QAAe,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAUA,cAAM,MAAM;IACV,OAAO,CAAC,cAAc;IAItB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAO5C;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAS/E;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IASvF,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI3B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAI3C,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAG5B;AAED,eAAO,MAAM,MAAM,QAAe,CAAC"}

package/dist/utils/logger.js

@@ -1,4 +1,11 @@
 import { config } from "../config.js";
+/**
+ * Masks credentials passed as URL query parameters (e.g. Gemini's `?key=...`)
+ * so they never reach stdout or a log aggregator when debug logging is on.
+ */
+function redactUrl(url) {
+    return url.replace(/([?&](?:key|api_key|apikey|access_token|token)=)[^&#]+/gi, "$1[REDACTED]");
+}
 class Logger {
     isDebugEnabled() {
         return config.debug === true;
@@ -14,7 +21,7 @@ class Logger {
      */
     logRequest(provider, method, url, body) {
         if (this.isDebugEnabled()) {
-            console.log(`[NodeLLM] [${provider}] Request: ${method} ${url}`);
+            console.log(`[NodeLLM] [${provider}] Request: ${method} ${redactUrl(url)}`);
             if (body) {
                 console.log(JSON.stringify(body, null, 2));
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node-llm/core",
-  "version": "1.16.2",
+  "version": "1.17.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",