@theokit/sdk 4.13.0 → 4.14.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 4.14.0
+
+### Minor Changes
+
+- Data-provider fleet (agent-builder M45): 9 new first-party builtins on a data-only `openAiCompatibleProfile` base — `google` (DIRECT Gemini via the OpenAI-compat endpoint, `GOOGLE_API_KEY`/`GEMINI_API_KEY`; distinct from the `gemini` OpenRouter passthrough), `mistral`, `groq`, `cohere` (via `api.cohere.ai/compatibility/v1`), `deepinfra`, `together` (alias `togetherai`), `xai` (alias `grok`), `perplexity`, `cerebras` — each ~10 lines with source-cited values. Two defects fixed: the chat_completions URL-join no longer doubles version segments (`…/v1/v1/chat/completions` — every version-suffixed catalog baseUrl was broken for streaming) via version-segment detection + a data-only `ProviderProfile.chatCompletionsPath` escape (existing builtins byte-identical, contract-asserted), and Google is finally reachable (the `google-gemini` catalog entry was silently skipped by an alias collision). The `anthropic_messages` transport now consumes `extraHeaders` + the provider `transform` (mirror of the M41 chat_completions wiring) and the anthropic builtin ships `anthropic-beta: interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14` (the sanctioned behavior delta); openrouter gains theokit's own attribution headers (`HTTP-Referer: https://usetheo.dev`, `X-Title: theokit`); cerebras sends `X-Cerebras-3rd-Party-Integration: theokit`. A table-driven contract suite asserts identity + the EXACT wire URL and headers per provider. Values adapted from OpenCode (MIT); see NOTICE.
+
+## 4.13.1
+
+### Patch Changes
+
+- M44 adversarial-review fixes for the model catalog: (B1) the provider registry + model-info index now live on `globalThis` via `Symbol.for` so every bundle copy (`dist/index.js`, `dist/models.js` — tsup bundles entries separately) shares the SAME state — previously `refreshModelCatalog` from `@theokit/sdk/models` patched a bundle-local index invisible to capability/pricing lookups and saw an empty registry (a published-artifact-only defect the src-level tests could not catch); (H2) a live models-dev patch is now a per-field MERGE that preserves theokit extension fields (`cache_control`, overlay `structured_output`) instead of a wholesale replace that wiped them; (H3) the runtime refresh gained the models.dev↔theokit id mapping (google↔google-gemini, zai↔zhipu, togetherai↔together, fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex) resolving against catalog entries (id + aliases) with a WARN for skipped unknowns — Google/Z.AI/Together/Fireworks now actually refresh; (M4) `refreshModelCatalog` self-initializes provider registration so the `/models` subpath works standalone; (M5) pricing provenance is honest post-refresh (`catalog-models-dev` vs `catalog-vendored`); (M6) the anthropic builtin defaults (opus-4-7 / sonnet-4-6 / haiku-4-5) now carry `cache_control: true` in the vendored catalog; (L8) the models-dev cache honors `THEOKIT_HOME`; (L9) a missing/corrupt vendored catalog degrades with WARN instead of throwing from `resolveModelCapabilities`, cache patch errors never delete a valid cache, and refresh never rejects; (L10) the pricing step-5 fallback also tries the date-stripped id; (L11) falsy `THEOKIT_DISABLE_MODELS_FETCH` values (`0`/`false`/empty) no longer disable the fetch.
+
 ## 4.13.0
 
 ### Minor Changes

package/dist/{cron-C7catiH8.d.ts → cron-DY0uC1ng.d.ts}

@@ -1230,6 +1230,13 @@ interface ProviderProfile {
     hostname?: string;
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
+    /**
+     * M45 — explicit chat-completions path override (data-only). Absent, the transport derives it: a baseUrl
+     * whose path already carries a version segment (`/v1`, `/v2beta`, …) gets `/chat/completions` appended;
+     * a host-only baseUrl keeps the legacy `/v1/chat/completions`. Set this for shapes neither rule expresses
+     * (e.g. Perplexity's unversioned `/chat/completions`).
+     */
+    chatCompletionsPath?: string;
     bodyOverrides?: Record<string, unknown>;
     /**
      * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile

package/dist/{cron-DK1WVZnI.d.cts → cron-ElTj1cSH.d.cts}

@@ -1230,6 +1230,13 @@ interface ProviderProfile {
     hostname?: string;
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
+    /**
+     * M45 — explicit chat-completions path override (data-only). Absent, the transport derives it: a baseUrl
+     * whose path already carries a version segment (`/v1`, `/v2beta`, …) gets `/chat/completions` appended;
+     * a host-only baseUrl keeps the legacy `/v1/chat/completions`. Set this for shapes neither rule expresses
+     * (e.g. Perplexity's unversioned `/chat/completions`).
+     */
+    chatCompletionsPath?: string;
     bodyOverrides?: Record<string, unknown>;
     /**
      * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile

package/dist/cron.cjs

@@ -10539,8 +10539,17 @@ var catalogModelSchema = zod.z.object({
 }).loose();
 
 // src/internal/providers/registry.ts
-var REGISTRY = /* @__PURE__ */ new Map();
-var ALIASES = /* @__PURE__ */ new Map();
+function globalSingleton(key, create) {
+  const g = globalThis;
+  const sym = Symbol.for(key);
+  if (g[sym] === void 0) g[sym] = create();
+  return g[sym];
+}
+var REGISTRY = globalSingleton(
+  "theokit-sdk.providers.registry",
+  () => /* @__PURE__ */ new Map()
+);
+var ALIASES = globalSingleton("theokit-sdk.providers.aliases", () => /* @__PURE__ */ new Map());
 function registerProvider(profile) {
   if (REGISTRY.has(profile.name)) {
     process.stderr.write(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
@@ -10565,18 +10574,43 @@ function getProviderProfile(name) {
 
 // src/internal/providers/catalog-loader.ts
 var __dirname_resolved = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cron.cjs', document.baseURI).href))));
-var modelInfoIndex = /* @__PURE__ */ new Map();
+function globalSingleton2(key, create) {
+  const g = globalThis;
+  const sym = Symbol.for(key);
+  if (g[sym] === void 0) g[sym] = create();
+  return g[sym];
+}
+var modelInfoIndex = globalSingleton2(
+  "theokit-sdk.providers.model-info-index",
+  () => /* @__PURE__ */ new Map()
+);
+var patchedModelKeys = globalSingleton2(
+  "theokit-sdk.providers.model-info-patched",
+  () => /* @__PURE__ */ new Set()
+);
+var indexState = globalSingleton2("theokit-sdk.providers.model-info-loaded", () => ({
+  loaded: false
+}));
 function getCatalogModelInfo(key) {
   ensureModelIndexLoaded();
   return modelInfoIndex.get(key);
 }
-var _modelIndexLoaded = false;
+function isPatchedModelKey(key) {
+  return patchedModelKeys.has(key);
+}
 function ensureModelIndexLoaded() {
-  if (_modelIndexLoaded) return;
-  _modelIndexLoaded = true;
-  const catalog = loadProviderCatalog();
-  for (const entry of Object.values(catalog)) {
-    indexEntryModels(entry);
+  if (indexState.loaded) return;
+  indexState.loaded = true;
+  try {
+    const catalog = loadProviderCatalog();
+    for (const entry of Object.values(catalog)) {
+      indexEntryModels(entry);
+    }
+  } catch (err) {
+    process.stderr.write(
+      `[theokit-sdk] WARN: provider catalog unavailable (${err.message}) \u2014 per-model data disabled
+`
+    );
   }
 }
 function indexEntryModels(entry) {
@@ -10829,8 +10863,10 @@ function getPricingEntry(opts) {
   return void 0;
 }
 function catalogCostFallback(provider, cleanedModel) {
-  const keys = [`${provider}/${cleanedModel}`, cleanedModel];
-  for (const key of keys) {
+  const stripped = stripDateSuffix(cleanedModel);
+  const candidates = [`${provider}/${cleanedModel}`, cleanedModel];
+  if (stripped !== cleanedModel) candidates.push(`${provider}/${stripped}`, stripped);
+  for (const key of candidates) {
     const info = getCatalogModelInfo(key);
     const cost = info?.cost;
     if (cost === void 0) continue;
@@ -10842,7 +10878,8 @@ function catalogCostFallback(provider, cleanedModel) {
       outputCostPerMillion: cost.output,
       ...cost.cache_read !== void 0 ? { cacheReadCostPerMillion: cost.cache_read } : {},
       ...cost.cache_write !== void 0 ? { cacheWriteCostPerMillion: cost.cache_write } : {},
-      pricingVersion: "catalog-vendored"
+      // M44 M5 fix — honest provenance: a key patched by the LIVE models-dev source is not "vendored".
+      pricingVersion: isPatchedModelKey(key) ? "catalog-models-dev" : "catalog-vendored"
     };
   }
   return void 0;
@@ -11370,7 +11407,13 @@ var ANTHROPIC = {
   baseUrl: "https://api.anthropic.com",
   modelsUrl: "https://api.anthropic.com/v1/models",
   hostname: "api.anthropic.com",
-  fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"]
+  fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"],
+  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An
+  // Anthropic API constant, adapted verbatim from OpenCode's anthropic plugin (MIT © 2025 opencode). The
+  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.
+  extraHeaders: {
+    "anthropic-beta": "interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14"
+  }
 };
 
 // src/internal/providers/builtin/bedrock.ts
@@ -11405,6 +11448,101 @@ function resolveBedrockBaseUrl(modelId) {
   return `https://bedrock-runtime.${region}.amazonaws.com`;
 }
 
+// src/internal/providers/builtin/openai-compatible.ts
+function openAiCompatibleProfile(p) {
+  return {
+    apiMode: "chat_completions",
+    authType: "api_key",
+    fallbackModels: [],
+    ...p
+  };
+}
+
+// src/internal/providers/builtin/cerebras.ts
+var CEREBRAS = openAiCompatibleProfile({
+  name: "cerebras",
+  baseUrl: "https://api.cerebras.ai/v1",
+  envVars: ["CEREBRAS_API_KEY"],
+  fallbackModels: ["gpt-oss-120b", "zai-glm-4.7"],
+  extraHeaders: { "X-Cerebras-3rd-Party-Integration": "theokit" },
+  hostname: "api.cerebras.ai"
+});
+
+// src/internal/providers/builtin/cohere.ts
+var COHERE = openAiCompatibleProfile({
+  name: "cohere",
+  baseUrl: "https://api.cohere.ai/compatibility/v1",
+  envVars: ["COHERE_API_KEY", "CO_API_KEY"],
+  fallbackModels: ["command-a-03-2025"],
+  hostname: "api.cohere.ai"
+});
+
+// src/internal/providers/builtin/deepinfra.ts
+var DEEPINFRA = openAiCompatibleProfile({
+  name: "deepinfra",
+  baseUrl: "https://api.deepinfra.com/v1/openai",
+  envVars: ["DEEPINFRA_API_KEY"],
+  fallbackModels: ["Qwen/Qwen3-32B"],
+  hostname: "api.deepinfra.com"
+});
+
+// src/internal/providers/builtin/google.ts
+var GOOGLE = openAiCompatibleProfile({
+  name: "google",
+  baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
+  envVars: ["GOOGLE_API_KEY", "GEMINI_API_KEY"],
+  fallbackModels: ["gemini-2.5-pro", "gemini-2.5-flash"],
+  hostname: "generativelanguage.googleapis.com"
+});
+
+// src/internal/providers/builtin/groq.ts
+var GROQ = openAiCompatibleProfile({
+  name: "groq",
+  baseUrl: "https://api.groq.com/openai/v1",
+  envVars: ["GROQ_API_KEY"],
+  fallbackModels: ["llama-3.3-70b-versatile", "llama-3.1-8b-instant"],
+  hostname: "api.groq.com"
+});
+
+// src/internal/providers/builtin/mistral.ts
+var MISTRAL = openAiCompatibleProfile({
+  name: "mistral",
+  baseUrl: "https://api.mistral.ai/v1",
+  envVars: ["MISTRAL_API_KEY"],
+  fallbackModels: ["mistral-large-latest", "codestral-latest"],
+  hostname: "api.mistral.ai"
+});
+
+// src/internal/providers/builtin/perplexity.ts
+var PERPLEXITY = openAiCompatibleProfile({
+  name: "perplexity",
+  baseUrl: "https://api.perplexity.ai",
+  chatCompletionsPath: "/chat/completions",
+  envVars: ["PERPLEXITY_API_KEY"],
+  fallbackModels: ["sonar-pro", "sonar"],
+  hostname: "api.perplexity.ai"
+});
+
+// src/internal/providers/builtin/together.ts
+var TOGETHER = openAiCompatibleProfile({
+  name: "together",
+  aliases: ["togetherai"],
+  baseUrl: "https://api.together.xyz/v1",
+  envVars: ["TOGETHER_API_KEY"],
+  fallbackModels: ["Qwen/Qwen2.5-7B-Instruct-Turbo"],
+  hostname: "api.together.xyz"
+});
+
+// src/internal/providers/builtin/xai.ts
+var XAI = openAiCompatibleProfile({
+  name: "xai",
+  aliases: ["grok"],
+  baseUrl: "https://api.x.ai/v1",
+  envVars: ["XAI_API_KEY"],
+  fallbackModels: ["grok-4.5", "grok-4.3"],
+  hostname: "api.x.ai"
+});
+
 // src/internal/providers/builtin/gemini.ts
 var GEMINI = {
   name: "gemini",
@@ -11829,7 +11967,11 @@ var OPENROUTER = {
   baseUrl: "https://openrouter.ai/api",
   modelsUrl: "https://openrouter.ai/api/v1/models",
   hostname: "openrouter.ai",
-  fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-3-haiku"]
+  // M45 — models refreshed (claude-3-haiku retired upstream).
+  fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-haiku-4-5"],
+  // M45 — OpenRouter app-attribution headers (mechanism from OpenCode's openrouter plugin, MIT; VALUES are
+  // theokit's own — copying another app's referer would misattribute traffic).
+  extraHeaders: { "HTTP-Referer": "https://usetheo.dev", "X-Title": "theokit" }
 };
 
 // src/internal/providers/builtin/vertex.ts
@@ -11878,6 +12020,15 @@ function registerBuiltins() {
   registerProvider(LLAMACPP);
   registerProvider(BEDROCK);
   registerProvider(VERTEX);
+  registerProvider(GOOGLE);
+  registerProvider(MISTRAL);
+  registerProvider(GROQ);
+  registerProvider(COHERE);
+  registerProvider(DEEPINFRA);
+  registerProvider(TOGETHER);
+  registerProvider(XAI);
+  registerProvider(PERPLEXITY);
+  registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
 
@@ -12145,14 +12296,16 @@ var AnthropicClient = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: HTTP+SSE handshake + accumulator is intentionally one block
   async *stream(request, signal) {
     const body = buildAnthropicBody(request);
+    const headers = {
+      "content-type": "application/json",
+      "x-api-key": this.options.apiKey,
+      "anthropic-version": this.options.version ?? "2023-06-01"
+    };
+    if (this.options.extraHeaders !== void 0) Object.assign(headers, this.options.extraHeaders);
     const response = await this.fetchImpl(`${this.baseUrl}/v1/messages`, {
       method: "POST",
       signal,
-      headers: {
-        "content-type": "application/json",
-        "x-api-key": this.options.apiKey,
-        "anthropic-version": this.options.version ?? "2023-06-01"
-      },
+      headers,
       body: JSON.stringify(body)
     });
     if (!response.ok) {
@@ -13029,11 +13182,13 @@ var OpenAIClient = class {
   constructor(options) {
     this.options = options;
     this.baseUrl = options.baseUrl ?? "https://api.openai.com";
+    this.chatPath = options.chatCompletionsPath ?? (/\/v\d+[a-z]*(\/|$)/.test(new URL(this.baseUrl).pathname) ? "/chat/completions" : "/v1/chat/completions");
     this.fetchImpl = options.fetch ?? fetch;
   }
   options;
   name = "openai";
   baseUrl;
+  chatPath;
   fetchImpl;
   /**
    * Whether this client recovers leaked Hermes tool-call dialect from assistant
@@ -13056,7 +13211,7 @@ var OpenAIClient = class {
     const providerId = this.options.providerName ?? this.name;
     let response;
     try {
-      response = await this.fetchImpl(`${this.baseUrl}/v1/chat/completions`, {
+      response = await this.fetchImpl(`${this.baseUrl}${this.chatPath}`, {
         method: "POST",
         signal,
         headers,
@@ -14153,6 +14308,9 @@ function selectTransport(profile, apiKey) {
     if (profile.extractToolCallsFromContent === true) {
       opts.extractToolCallsFromContent = true;
     }
+    if (profile.chatCompletionsPath !== void 0) {
+      opts.chatCompletionsPath = profile.chatCompletionsPath;
+    }
     if (profile.name === "openai" && process.env.OPENAI_ORGANIZATION !== void 0) {
       opts.organization = process.env.OPENAI_ORGANIZATION;
     }
@@ -14172,6 +14330,11 @@ function selectTransport(profile, apiKey) {
     }
     const opts = { apiKey };
     opts.baseUrl = process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
+    const t = applyTransform();
+    assertOAuthResolved(t);
+    if (t.fetch !== void 0) opts.fetch = t.fetch;
+    const merged = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
+    if (merged !== void 0) opts.extraHeaders = merged;
     return new AnthropicClient(opts);
   }
   if (profile.apiMode === "bedrock_anthropic") {