@theokit/sdk 4.13.1 → 4.14.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 4.14.1
+
+### Patch Changes
+
+- M45 adversarial-review fixes: (H1) a malformed `baseUrl` (scheme-less host, empty env var) no longer throws an untyped `TypeError` from the OpenAIClient CONSTRUCTOR — poisoning the whole provider chain at `resolveProviderChain` time even when only a fallback was misconfigured; the URL parse now degrades to the legacy `/v1/chat/completions` path (byte-identical to pre-M45) and fails typed at fetch time. (M2) re-running `registerBuiltins()` across bundle copies (`@theokit/sdk` + `@theokit/sdk/models`) no longer emits 19 bogus `overridden by user plugin` WARNs — the guard lives on `globalThis` like the registry itself. (M3) a trailing-slash versioned baseUrl (`…/v1/`) now joins cleanly (no `/v1//chat/completions`). (L1) the `google` builtin also honors `GOOGLE_GENERATIVE_AI_API_KEY` (the ai-sdk convention). (L4) `getCatalogCapabilities` resolves entry aliases (e.g. `google`). NOTICE extended for the M45 adaptations. **Migration note (M1):** the chat-completions URL-join now detects version segments ANYWHERE in the baseUrl path — a gateway mounting an OpenAI-compat surface under a versioned prefix (e.g. `https://gw.corp/v2/tenants/x`) that previously got `/v1/chat/completions` appended now gets `/chat/completions`; declare `chatCompletionsPath` on the profile to pin an exact path.
+
+## 4.14.0
+
+### Minor Changes
+
+- Data-provider fleet (agent-builder M45): 9 new first-party builtins on a data-only `openAiCompatibleProfile` base — `google` (DIRECT Gemini via the OpenAI-compat endpoint, `GOOGLE_API_KEY`/`GEMINI_API_KEY`; distinct from the `gemini` OpenRouter passthrough), `mistral`, `groq`, `cohere` (via `api.cohere.ai/compatibility/v1`), `deepinfra`, `together` (alias `togetherai`), `xai` (alias `grok`), `perplexity`, `cerebras` — each ~10 lines with source-cited values. Two defects fixed: the chat_completions URL-join no longer doubles version segments (`…/v1/v1/chat/completions` — every version-suffixed catalog baseUrl was broken for streaming) via version-segment detection + a data-only `ProviderProfile.chatCompletionsPath` escape (existing builtins byte-identical, contract-asserted), and Google is finally reachable (the `google-gemini` catalog entry was silently skipped by an alias collision). The `anthropic_messages` transport now consumes `extraHeaders` + the provider `transform` (mirror of the M41 chat_completions wiring) and the anthropic builtin ships `anthropic-beta: interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14` (the sanctioned behavior delta); openrouter gains theokit's own attribution headers (`HTTP-Referer: https://usetheo.dev`, `X-Title: theokit`); cerebras sends `X-Cerebras-3rd-Party-Integration: theokit`. A table-driven contract suite asserts identity + the EXACT wire URL and headers per provider. Values adapted from OpenCode (MIT); see NOTICE.
+
 ## 4.13.1
 
 ### Patch Changes

package/dist/{cron-C7catiH8.d.ts → cron-DY0uC1ng.d.ts}

@@ -1230,6 +1230,13 @@ interface ProviderProfile {
     hostname?: string;
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
+    /**
+     * M45 — explicit chat-completions path override (data-only). Absent, the transport derives it: a baseUrl
+     * whose path already carries a version segment (`/v1`, `/v2beta`, …) gets `/chat/completions` appended;
+     * a host-only baseUrl keeps the legacy `/v1/chat/completions`. Set this for shapes neither rule expresses
+     * (e.g. Perplexity's unversioned `/chat/completions`).
+     */
+    chatCompletionsPath?: string;
     bodyOverrides?: Record<string, unknown>;
     /**
      * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile

package/dist/{cron-DK1WVZnI.d.cts → cron-ElTj1cSH.d.cts}

@@ -1230,6 +1230,13 @@ interface ProviderProfile {
     hostname?: string;
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
+    /**
+     * M45 — explicit chat-completions path override (data-only). Absent, the transport derives it: a baseUrl
+     * whose path already carries a version segment (`/v1`, `/v2beta`, …) gets `/chat/completions` appended;
+     * a host-only baseUrl keeps the legacy `/v1/chat/completions`. Set this for shapes neither rule expresses
+     * (e.g. Perplexity's unversioned `/chat/completions`).
+     */
+    chatCompletionsPath?: string;
     bodyOverrides?: Record<string, unknown>;
     /**
      * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile

package/dist/cron.cjs

@@ -752,13 +752,13 @@ function setAgentFacade(facade) {
   globalThis[FACADE_KEY] = facade;
 }
 function getAgentFacade() {
-  const registered3 = globalThis[FACADE_KEY];
-  if (registered3 === void 0) {
+  const registered2 = globalThis[FACADE_KEY];
+  if (registered2 === void 0) {
     throw new Error(
       "internal: Agent facade not registered. The `agent.ts` module must be loaded before internal subsystems (LocalAgent.runUntil/fork, eval, scorers, cron) invoke it."
     );
   }
-  return registered3;
+  return registered2;
 }
 var FACADE_KEY;
 var init_agent_factory_registry = __esm({
@@ -11407,7 +11407,13 @@ var ANTHROPIC = {
   baseUrl: "https://api.anthropic.com",
   modelsUrl: "https://api.anthropic.com/v1/models",
   hostname: "api.anthropic.com",
-  fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"]
+  fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"],
+  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An
+  // Anthropic API constant, adapted verbatim from OpenCode's anthropic plugin (MIT © 2025 opencode). The
+  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.
+  extraHeaders: {
+    "anthropic-beta": "interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14"
+  }
 };
 
 // src/internal/providers/builtin/bedrock.ts
@@ -11442,6 +11448,44 @@ function resolveBedrockBaseUrl(modelId) {
   return `https://bedrock-runtime.${region}.amazonaws.com`;
 }
 
+// src/internal/providers/builtin/openai-compatible.ts
+function openAiCompatibleProfile(p) {
+  return {
+    apiMode: "chat_completions",
+    authType: "api_key",
+    fallbackModels: [],
+    ...p
+  };
+}
+
+// src/internal/providers/builtin/cerebras.ts
+var CEREBRAS = openAiCompatibleProfile({
+  name: "cerebras",
+  baseUrl: "https://api.cerebras.ai/v1",
+  envVars: ["CEREBRAS_API_KEY"],
+  fallbackModels: ["gpt-oss-120b", "zai-glm-4.7"],
+  extraHeaders: { "X-Cerebras-3rd-Party-Integration": "theokit" },
+  hostname: "api.cerebras.ai"
+});
+
+// src/internal/providers/builtin/cohere.ts
+var COHERE = openAiCompatibleProfile({
+  name: "cohere",
+  baseUrl: "https://api.cohere.ai/compatibility/v1",
+  envVars: ["COHERE_API_KEY", "CO_API_KEY"],
+  fallbackModels: ["command-a-03-2025"],
+  hostname: "api.cohere.ai"
+});
+
+// src/internal/providers/builtin/deepinfra.ts
+var DEEPINFRA = openAiCompatibleProfile({
+  name: "deepinfra",
+  baseUrl: "https://api.deepinfra.com/v1/openai",
+  envVars: ["DEEPINFRA_API_KEY"],
+  fallbackModels: ["Qwen/Qwen3-32B"],
+  hostname: "api.deepinfra.com"
+});
+
 // src/internal/providers/builtin/gemini.ts
 var GEMINI = {
   name: "gemini",
@@ -11453,6 +11497,24 @@ var GEMINI = {
   fallbackModels: ["google/gemini-2.0-flash-001"]
 };
 
+// src/internal/providers/builtin/google.ts
+var GOOGLE = openAiCompatibleProfile({
+  name: "google",
+  baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
+  envVars: ["GOOGLE_API_KEY", "GEMINI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+  fallbackModels: ["gemini-2.5-pro", "gemini-2.5-flash"],
+  hostname: "generativelanguage.googleapis.com"
+});
+
+// src/internal/providers/builtin/groq.ts
+var GROQ = openAiCompatibleProfile({
+  name: "groq",
+  baseUrl: "https://api.groq.com/openai/v1",
+  envVars: ["GROQ_API_KEY"],
+  fallbackModels: ["llama-3.3-70b-versatile", "llama-3.1-8b-instant"],
+  hostname: "api.groq.com"
+});
+
 // src/internal/providers/builtin/llamacpp.ts
 var LLAMACPP = {
   name: "llamacpp",
@@ -11479,6 +11541,15 @@ var LMSTUDIO = {
   fallbackModels: ["loaded-model"]
 };
 
+// src/internal/providers/builtin/mistral.ts
+var MISTRAL = openAiCompatibleProfile({
+  name: "mistral",
+  baseUrl: "https://api.mistral.ai/v1",
+  envVars: ["MISTRAL_API_KEY"],
+  fallbackModels: ["mistral-large-latest", "codestral-latest"],
+  hostname: "api.mistral.ai"
+});
+
 // src/internal/providers/builtin/ollama.ts
 var OLLAMA = {
   name: "ollama",
@@ -11866,9 +11937,33 @@ var OPENROUTER = {
   baseUrl: "https://openrouter.ai/api",
   modelsUrl: "https://openrouter.ai/api/v1/models",
   hostname: "openrouter.ai",
-  fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-3-haiku"]
+  // M45 — models refreshed (claude-3-haiku retired upstream).
+  fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-haiku-4-5"],
+  // M45 — OpenRouter app-attribution headers (mechanism from OpenCode's openrouter plugin, MIT; VALUES are
+  // theokit's own — copying another app's referer would misattribute traffic).
+  extraHeaders: { "HTTP-Referer": "https://usetheo.dev", "X-Title": "theokit" }
 };
 
+// src/internal/providers/builtin/perplexity.ts
+var PERPLEXITY = openAiCompatibleProfile({
+  name: "perplexity",
+  baseUrl: "https://api.perplexity.ai",
+  chatCompletionsPath: "/chat/completions",
+  envVars: ["PERPLEXITY_API_KEY"],
+  fallbackModels: ["sonar-pro", "sonar"],
+  hostname: "api.perplexity.ai"
+});
+
+// src/internal/providers/builtin/together.ts
+var TOGETHER = openAiCompatibleProfile({
+  name: "together",
+  aliases: ["togetherai"],
+  baseUrl: "https://api.together.xyz/v1",
+  envVars: ["TOGETHER_API_KEY"],
+  fallbackModels: ["Qwen/Qwen2.5-7B-Instruct-Turbo"],
+  hostname: "api.together.xyz"
+});
+
 // src/internal/providers/builtin/vertex.ts
 var VERTEX = {
   name: "vertex",
@@ -11900,11 +11995,26 @@ function stripVertexPrefix(modelId) {
   return modelId.replace(/^vertex\/(anthropic|google)\//, "");
 }
 
+// src/internal/providers/builtin/xai.ts
+var XAI = openAiCompatibleProfile({
+  name: "xai",
+  aliases: ["grok"],
+  baseUrl: "https://api.x.ai/v1",
+  envVars: ["XAI_API_KEY"],
+  fallbackModels: ["grok-4.5", "grok-4.3"],
+  hostname: "api.x.ai"
+});
+
 // src/internal/providers/builtin/index.ts
-var registered2 = false;
+var _registeredState = (() => {
+  const g = globalThis;
+  const sym = /* @__PURE__ */ Symbol.for("theokit-sdk.providers.builtins-registered");
+  if (g[sym] === void 0) g[sym] = { done: false };
+  return g[sym];
+})();
 function registerBuiltins() {
-  if (registered2) return;
-  registered2 = true;
+  if (_registeredState.done) return;
+  _registeredState.done = true;
   registerProvider(ANTHROPIC);
   registerProvider(OPENAI);
   registerProvider(OPENAI_CHATGPT);
@@ -11915,6 +12025,15 @@ function registerBuiltins() {
   registerProvider(LLAMACPP);
   registerProvider(BEDROCK);
   registerProvider(VERTEX);
+  registerProvider(GOOGLE);
+  registerProvider(MISTRAL);
+  registerProvider(GROQ);
+  registerProvider(COHERE);
+  registerProvider(DEEPINFRA);
+  registerProvider(TOGETHER);
+  registerProvider(XAI);
+  registerProvider(PERPLEXITY);
+  registerProvider(CEREBRAS);
   registerCatalogProviders();
 }
 
@@ -12182,14 +12301,16 @@ var AnthropicClient = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: HTTP+SSE handshake + accumulator is intentionally one block
   async *stream(request, signal) {
     const body = buildAnthropicBody(request);
+    const headers = {
+      "content-type": "application/json",
+      "x-api-key": this.options.apiKey,
+      "anthropic-version": this.options.version ?? "2023-06-01"
+    };
+    if (this.options.extraHeaders !== void 0) Object.assign(headers, this.options.extraHeaders);
     const response = await this.fetchImpl(`${this.baseUrl}/v1/messages`, {
       method: "POST",
       signal,
-      headers: {
-        "content-type": "application/json",
-        "x-api-key": this.options.apiKey,
-        "anthropic-version": this.options.version ?? "2023-06-01"
-      },
+      headers,
       body: JSON.stringify(body)
     });
     if (!response.ok) {
@@ -13062,15 +13183,24 @@ var StreamSuppressionBuffer = class {
 };
 
 // src/internal/llm/openai.ts
+function deriveChatPath(baseUrl) {
+  try {
+    return /\/v\d+[a-z]*(\/|$)/.test(new URL(baseUrl).pathname) ? "/chat/completions" : "/v1/chat/completions";
+  } catch {
+    return "/v1/chat/completions";
+  }
+}
 var OpenAIClient = class {
   constructor(options) {
     this.options = options;
-    this.baseUrl = options.baseUrl ?? "https://api.openai.com";
+    this.baseUrl = (options.baseUrl ?? "https://api.openai.com").replace(/\/+$/, "");
+    this.chatPath = options.chatCompletionsPath ?? deriveChatPath(this.baseUrl);
     this.fetchImpl = options.fetch ?? fetch;
   }
   options;
   name = "openai";
   baseUrl;
+  chatPath;
   fetchImpl;
   /**
    * Whether this client recovers leaked Hermes tool-call dialect from assistant
@@ -13093,7 +13223,7 @@ var OpenAIClient = class {
     const providerId = this.options.providerName ?? this.name;
     let response;
     try {
-      response = await this.fetchImpl(`${this.baseUrl}/v1/chat/completions`, {
+      response = await this.fetchImpl(`${this.baseUrl}${this.chatPath}`, {
         method: "POST",
         signal,
         headers,
@@ -14190,6 +14320,9 @@ function selectTransport(profile, apiKey) {
     if (profile.extractToolCallsFromContent === true) {
       opts.extractToolCallsFromContent = true;
     }
+    if (profile.chatCompletionsPath !== void 0) {
+      opts.chatCompletionsPath = profile.chatCompletionsPath;
+    }
     if (profile.name === "openai" && process.env.OPENAI_ORGANIZATION !== void 0) {
       opts.organization = process.env.OPENAI_ORGANIZATION;
     }
@@ -14209,6 +14342,11 @@ function selectTransport(profile, apiKey) {
     }
     const opts = { apiKey };
     opts.baseUrl = process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
+    const t = applyTransform();
+    assertOAuthResolved(t);
+    if (t.fetch !== void 0) opts.fetch = t.fetch;
+    const merged = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
+    if (merged !== void 0) opts.extraHeaders = merged;
     return new AnthropicClient(opts);
   }
   if (profile.apiMode === "bedrock_anthropic") {
@@ -14526,12 +14664,12 @@ function resolveMcpCwd(configCwd) {
 
 // src/internal/providers/register-plugin-providers.ts
 function registerPluginProviderProfiles(entries) {
-  let registered3 = 0;
+  let registered2 = 0;
   for (const entry of entries) {
     registerProvider(entry.profile);
-    registered3 += 1;
+    registered2 += 1;
   }
-  return registered3;
+  return registered2;
 }
 
 // src/internal/local-agent/real-local-run.ts
@@ -14856,12 +14994,12 @@ var pluginProvidersAnnounced = false;
 function resolveRunProvider(options) {
   registerBuiltins();
   const profiles = options.pluginManager?.aggregated.providerProfiles ?? [];
-  const registered3 = registerPluginProviderProfiles(profiles);
-  if (registered3 > 0 && !pluginProvidersAnnounced) {
+  const registered2 = registerPluginProviderProfiles(profiles);
+  if (registered2 > 0 && !pluginProvidersAnnounced) {
     pluginProvidersAnnounced = true;
     const names = profiles.map((e) => e.profile.name).join(", ");
     process.stderr.write(
-      `[theokit-sdk] registered ${registered3} plugin provider profile(s): ${names}
+      `[theokit-sdk] registered ${registered2} plugin provider profile(s): ${names}
 `
     );
   }