@theokit/sdk 4.10.1 → 4.11.1

package/dist/index.cjs

@@ -16253,6 +16253,9 @@ function sentinelForNoAuth(profile) {
 function sentinelForLazyAuth(profile) {
   if (profile.authType === "aws_bearer") return "__bedrock_lazy_token__";
   if (profile.authType === "gcp_oauth") return "__vertex_lazy_token__";
+  if (profile.authType === "oauth_device_code" || profile.authType === "oauth_external") {
+    return "__oauth_lazy_token__";
+  }
   return void 0;
 }
 function filterPoolKeys(keys) {
@@ -16288,6 +16291,15 @@ function selectTransport(profile, apiKey) {
     const ctx = { apiKey };
     return { fetch: profile.transform.fetch?.(ctx), headers: profile.transform.headers?.(ctx) };
   };
+  const assertOAuthResolved = (t) => {
+    if (apiKey !== "__oauth_lazy_token__") return;
+    const auth = t.headers?.authorization ?? t.headers?.Authorization;
+    if (t.fetch === void 0 && auth === void 0) {
+      throw new exports.ConfigurationError(
+        `provider "${profile.name}" uses OAuth (authType: ${profile.authType}) but no credential was resolved. Register a ProviderProfile.transform whose fetch (or headers.authorization) supplies the bearer \u2014 typically via resolveCredential() from "@theokit/sdk/auth".`
+      );
+    }
+  };
   if (profile.apiMode === "chat_completions") {
     if (profile.name === "ollama") {
       const ollamaBase = process.env.OLLAMA_HOST ?? profile.baseUrl;
@@ -16305,6 +16317,7 @@ function selectTransport(profile, apiKey) {
     const envOverride = resolveBaseUrlEnvOverride(profile.name);
     if (envOverride !== void 0) opts.baseUrl = envOverride;
     const t = applyTransform();
+    assertOAuthResolved(t);
     if (t.fetch !== void 0) opts.fetch = t.fetch;
     const merged = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
     if (merged !== void 0) opts.extraHeaders = merged;
@@ -16325,6 +16338,7 @@ function selectTransport(profile, apiKey) {
   }
   if (profile.apiMode === "responses_api") {
     const t = applyTransform();
+    assertOAuthResolved(t);
     const mergedHeaders = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
     return new ResponsesApiClient({
       apiKey,