@theokit/sdk 4.24.0 → 4.26.0

package/dist/chunk-NRSH7RJY.js

@@ -0,0 +1,2841 @@
+import { currentCredentialPool, computeBackoffMs, sleepWithAbort, newPooledCredential, CredentialPool } from './chunk-6CLRANZA.js';
+import { invalidateSessionCache } from './chunk-EEZ7CFMM.js';
+import { tryJson, isPlainObject, sanitizeToolInput } from './chunk-U54XCYG3.js';
+import { reconstructMessages, SessionTranscript } from './chunk-ZZWTY3RX.js';
+import { estimateTokens } from './chunk-WA3FO4R7.js';
+import { globalSingleton, registerProvider, registerBuiltins, getProviderProfile, inferModelDialect, inferRegionFromModelId, stripBedrockPrefix, resolveBedrockBaseUrl, resolveVertexBaseUrl, stripVertexPrefix } from './chunk-KAP4GJHO.js';
+import { NetworkError, AuthenticationError, RateLimitError, ConfigurationError, UnknownAgentError, CredentialPoolExhaustedError } from './chunk-WLKFWQSJ.js';
+import { redactSecrets } from './chunk-JTFYYKDT.js';
+import { existsSync, readFileSync } from 'fs';
+import { readdir } from 'fs/promises';
+import { homedir } from 'os';
+import { join } from 'path';
+import { pathToFileURL } from 'url';
+import { createRequire } from 'module';
+
+var discoveryState = globalSingleton("theokit-sdk.providers.discovered", () => ({
+  done: false
+}));
+function pluginsRoot() {
+  return join(homedir(), ".theokit", "plugins", "model-providers");
+}
+function trustFilePath() {
+  return join(homedir(), ".theokit", "plugins", "trusted-providers.json");
+}
+function loadTrustedNames() {
+  const trusted = /* @__PURE__ */ new Set();
+  const path = trustFilePath();
+  if (existsSync(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf-8"));
+      if (Array.isArray(parsed)) {
+        let discarded = 0;
+        for (const name of parsed) {
+          if (typeof name === "string" && name.length > 0) trusted.add(name);
+          else discarded += 1;
+        }
+        if (discarded > 0) {
+          process.stderr.write(
+            `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
+`
+          );
+        }
+      } else {
+        process.stderr.write(
+          `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
+`
+        );
+      }
+    } catch {
+      process.stderr.write(
+        `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
+`
+      );
+    }
+  }
+  for (const name of (process.env.THEOKIT_TRUSTED_PROVIDERS ?? "").split(",")) {
+    const trimmed = name.trim();
+    if (trimmed.length > 0) trusted.add(trimmed);
+  }
+  return trusted;
+}
+async function discoverProviderPlugins() {
+  if (discoveryState.done) return;
+  discoveryState.done = true;
+  const root = pluginsRoot();
+  if (!existsSync(root)) return;
+  let entries;
+  try {
+    entries = await readdir(root);
+  } catch {
+    return;
+  }
+  const trusted = loadTrustedNames();
+  for (const entry of entries) {
+    if (!trusted.has(entry)) {
+      process.stderr.write(
+        `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
+`
+      );
+      continue;
+    }
+    await loadOne(join(root, entry), entry);
+  }
+}
+async function loadOne(dir, entryName) {
+  for (const ext of ["index.mjs", "index.js"]) {
+    const indexPath = join(dir, ext);
+    if (!existsSync(indexPath)) continue;
+    try {
+      const mod = await import(pathToFileURL(indexPath).href);
+      const plugin = mod.default ?? mod[entryName] ?? mod;
+      if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
+        const profile = plugin.profile;
+        if (profile !== void 0 && typeof profile === "object") {
+          registerProvider(profile);
+        }
+      }
+      return;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+`);
+      return;
+    }
+  }
+}
+
+// src/internal/error-mappers/shared.ts
+var RAW_MAX_BYTES = 2048;
+function parseRetryAfter(headers) {
+  if (headers === void 0) return void 0;
+  const raw = headers.get("retry-after");
+  if (raw === null) return void 0;
+  const n = Number(raw);
+  if (Number.isFinite(n) && n >= 0) return Math.ceil(n);
+  const dateMs = Date.parse(raw);
+  if (Number.isFinite(dateMs)) return Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
+  return void 0;
+}
+function truncateRaw(body) {
+  if (body === null || body === void 0) return void 0;
+  const s = typeof body === "string" ? body : JSON.stringify(body);
+  const truncated = s.length <= RAW_MAX_BYTES ? s : `${s.slice(0, RAW_MAX_BYTES)}\u2026`;
+  return redactSecrets(truncated);
+}
+function buildErrorMetadata(args) {
+  const retryAfter = parseRetryAfter(args.headers);
+  const raw = truncateRaw(args.body);
+  return {
+    provider: args.provider,
+    endpoint: args.endpoint,
+    code: args.code,
+    statusCode: args.status,
+    ...retryAfter !== void 0 ? { retryAfter } : {},
+    ...raw !== void 0 ? { raw } : {}
+  };
+}
+
+// src/internal/error-mappers/anthropic.ts
+function mapAnthropicError(args) {
+  const { status, body, headers, endpoint } = args;
+  const code = mapAnthropicStatusToCode(status, body);
+  const message = formatMessage(status, code);
+  const metadata = buildErrorMetadata({
+    provider: "anthropic",
+    endpoint,
+    code,
+    status,
+    headers,
+    body
+  });
+  if (status === 401 || status === 403) {
+    return new AuthenticationError(message, { code: "anthropic_auth_failed", metadata });
+  }
+  if (status === 429) {
+    return new RateLimitError(message, { code: "anthropic_rate_limit", metadata });
+  }
+  if (status === 400) {
+    return new ConfigurationError(message, {
+      code: `anthropic_${code}`,
+      metadata
+    });
+  }
+  if (status === 408) {
+    return new NetworkError(message, { code: "anthropic_timeout", metadata });
+  }
+  if (status >= 500 && status < 600) {
+    return new NetworkError(message, { code: "anthropic_server_error", metadata });
+  }
+  return new UnknownAgentError(message, { code: "anthropic_unknown", metadata });
+}
+function mapAnthropicStatusToCode(status, body) {
+  if (status === 401 || status === 403) return "auth_failed";
+  if (status === 429) return "rate_limit";
+  if (status === 408) return "timeout";
+  if (status === 400) {
+    const text = JSON.stringify(body ?? "").toLowerCase();
+    if (text.includes("context") && (text.includes("too long") || text.includes("too_long") || text.includes("length"))) {
+      return "context_too_long";
+    }
+    if (text.includes("filtered") || text.includes("content policy") || text.includes("content_policy")) {
+      return "content_filtered";
+    }
+    return "invalid_request";
+  }
+  if (status >= 500 && status < 600) return "server_error";
+  return "unknown";
+}
+function formatMessage(status, code) {
+  return `Anthropic API error: ${code} (HTTP ${status})`;
+}
+
+// src/internal/llm/finish.ts
+function collapseSystemText(system) {
+  if (system === void 0) return "";
+  if (typeof system === "string") return system;
+  return system.map((b) => b.text).join("\n\n");
+}
+function parseToolArguments(buffered) {
+  if (buffered === void 0 || buffered.length === 0) return {};
+  try {
+    return JSON.parse(buffered);
+  } catch {
+    const repaired = tryJson(buffered, true);
+    if (isPlainObject(repaired)) return repaired;
+    return { raw: buffered };
+  }
+}
+function mapOpenAIFinish(reason) {
+  switch (reason) {
+    case "tool_calls":
+      return "tool_use";
+    case "length":
+      return "max_tokens";
+    default:
+      return "end_turn";
+  }
+}
+function makeLlmFinish(state) {
+  const finish = {
+    stopReason: state.stopReason,
+    text: state.text,
+    toolCalls: state.toolCalls
+  };
+  if (state.inputTokens !== void 0) finish.inputTokens = state.inputTokens;
+  if (state.outputTokens !== void 0) finish.outputTokens = state.outputTokens;
+  if (state.cacheReadTokens !== void 0) finish.cacheReadTokens = state.cacheReadTokens;
+  if (state.cacheWriteTokens !== void 0) finish.cacheWriteTokens = state.cacheWriteTokens;
+  if (state.reasoningTokens !== void 0) finish.reasoningTokens = state.reasoningTokens;
+  return finish;
+}
+
+// src/internal/llm/tool-result-content.ts
+function toBlockToolResultContent(content) {
+  return content;
+}
+function toStringToolResultContent(content, providerName) {
+  if (typeof content === "string") return content;
+  if (content.some((block) => block.type === "image")) {
+    throw new ConfigurationError(
+      `provider "${providerName}" does not support image content in tool results`
+    );
+  }
+  return content.filter(
+    (block) => block.type === "text"
+  ).map((block) => block.text).join("\n");
+}
+function renderToolResultContentText(content, fn) {
+  if (typeof content === "string") return fn(content);
+  return content.map(
+    (block) => block.type === "text" ? { type: "text", text: fn(block.text) } : block
+  );
+}
+
+// src/internal/llm/anthropic-shared.ts
+function extractAnthropicText(response) {
+  return (response.content ?? []).filter((c) => c.type === "text").map((c) => c.text).join("");
+}
+function extractAnthropicToolCalls(response) {
+  return (response.content ?? []).filter(
+    (c) => c.type === "tool_use"
+  ).map((c) => ({
+    type: "tool_use",
+    id: c.id,
+    name: c.name,
+    input: parseToolArguments(JSON.stringify(c.input))
+  }));
+}
+function mapAnthropicStopReason(reason) {
+  switch (reason) {
+    case "tool_use":
+      return "tool_use";
+    case "max_tokens":
+      return "max_tokens";
+    case "stop_sequence":
+      return "stop_sequence";
+    case "end_turn":
+    case null:
+      return "end_turn";
+    default:
+      return "end_turn";
+  }
+}
+function toAnthropicWireMessage(message) {
+  const role = message.role === "system" ? "user" : message.role;
+  const content = message.content.map((part) => {
+    if (part.type === "text") return { type: "text", text: part.text };
+    if (part.type === "tool_use") {
+      return { type: "tool_use", id: part.id, name: part.name, input: part.input };
+    }
+    if (part.type === "image") {
+      return { type: "image", source: part.source };
+    }
+    return {
+      type: "tool_result",
+      tool_use_id: part.toolUseId,
+      // SE7 — this wire is block-capable: strings pass through, structured
+      // text/image blocks are forwarded natively.
+      content: toBlockToolResultContent(part.content),
+      ...part.isError === true ? { is_error: true } : {}
+    };
+  });
+  return { role, content };
+}
+function postAnthropicRequest(args) {
+  return args.fetchImpl(args.url, {
+    method: "POST",
+    signal: args.signal,
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${args.token}`
+    },
+    body: JSON.stringify(args.body)
+  });
+}
+async function handleAnthropicResponse(args) {
+  if (!args.response.ok) {
+    throw args.errorMapper({
+      status: args.response.status,
+      body: await parseHttpErrorBody(args.response),
+      headers: args.response.headers,
+      endpoint: args.endpoint
+    });
+  }
+  return consumeAnthropicResponse(args.response);
+}
+async function consumeAnthropicResponse(response) {
+  const data = await response.json();
+  return {
+    text: extractAnthropicText(data),
+    toolCalls: extractAnthropicToolCalls(data),
+    stopReason: mapAnthropicStopReason(data.stop_reason ?? null),
+    inputTokens: data.usage?.input_tokens,
+    outputTokens: data.usage?.output_tokens
+  };
+}
+async function parseHttpErrorBody(response) {
+  const text = await response.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function buildAnthropicCommonBody(request) {
+  const body = {
+    max_tokens: request.maxTokens ?? 4096,
+    messages: request.messages.map(toAnthropicWireMessage)
+  };
+  const wireSystem = encodeAnthropicSystem(request.system);
+  if (wireSystem !== void 0) body.system = wireSystem;
+  if (request.temperature !== void 0) body.temperature = request.temperature;
+  if (request.tools !== void 0 && request.tools.length > 0) {
+    body.tools = request.tools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      input_schema: tool.inputSchema
+    }));
+  }
+  return body;
+}
+function encodeAnthropicSystem(system) {
+  if (system === void 0) return void 0;
+  if (typeof system === "string") return system;
+  if (system.length === 0) return void 0;
+  return system.map((block) => {
+    const wire = { type: "text", text: block.text };
+    if (block.cacheable === true) wire.cache_control = { type: "ephemeral" };
+    return wire;
+  });
+}
+
+// src/internal/llm/sse.ts
+var DEFAULT_SSE_IDLE_MS = 6e4;
+async function* parseSseStream(body, signal, idleTimeoutMs = DEFAULT_SSE_IDLE_MS) {
+  if (body === null) return;
+  const reader = body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  const state = { buffer: "", event: "message", data: "" };
+  try {
+    for await (const chunk of readChunks(reader, signal, idleTimeoutMs)) {
+      state.buffer += decoder.decode(chunk, { stream: true });
+      for (const record of drainCompleteRecords(state)) yield record;
+    }
+    if (state.data.length > 0) yield { event: state.event, data: state.data };
+  } finally {
+    await cancelReaderQuietly(reader);
+    releaseReader(reader);
+  }
+}
+async function* readChunks(reader, signal, idleTimeoutMs) {
+  while (true) {
+    if (signal.aborted) return;
+    const { value, done } = await readWithIdleTimeout(reader, idleTimeoutMs);
+    if (done) return;
+    if (value !== void 0) yield value;
+  }
+}
+function readWithIdleTimeout(reader, idleTimeoutMs) {
+  if (idleTimeoutMs <= 0) return reader.read();
+  return new Promise(
+    (resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new NetworkError(`SSE stream idle for ${idleTimeoutMs}ms \u2014 upstream stalled`, {
+            code: "stream_idle_timeout"
+          })
+        );
+      }, idleTimeoutMs);
+      reader.read().then(
+        (result) => {
+          clearTimeout(timer);
+          resolve(result);
+        },
+        (err) => {
+          clearTimeout(timer);
+          reject(err);
+        }
+      );
+    }
+  );
+}
+async function cancelReaderQuietly(reader) {
+  try {
+    await reader.cancel();
+  } catch {
+  }
+}
+function drainCompleteRecords(state) {
+  const out = [];
+  let newlineIndex = state.buffer.indexOf("\n");
+  while (newlineIndex !== -1) {
+    const line = state.buffer.slice(0, newlineIndex).replace(/\r$/, "");
+    state.buffer = state.buffer.slice(newlineIndex + 1);
+    const finished = applyLine(state, line);
+    if (finished !== void 0) out.push(finished);
+    newlineIndex = state.buffer.indexOf("\n");
+  }
+  return out;
+}
+function applyLine(state, line) {
+  if (line === "") {
+    if (state.data.length === 0) {
+      state.event = "message";
+      return void 0;
+    }
+    const record = { event: state.event, data: state.data };
+    state.event = "message";
+    state.data = "";
+    return record;
+  }
+  if (line.startsWith(":")) return void 0;
+  if (line.startsWith("event:")) {
+    state.event = stripOneLeadingSpace(line.slice(6));
+    return void 0;
+  }
+  if (line.startsWith("data:")) {
+    const piece = stripOneLeadingSpace(line.slice(5));
+    state.data = state.data.length === 0 ? piece : `${state.data}
+${piece}`;
+  }
+  return void 0;
+}
+function stripOneLeadingSpace(value) {
+  return value.startsWith(" ") ? value.slice(1) : value;
+}
+function releaseReader(reader) {
+  try {
+    reader.releaseLock();
+  } catch {
+  }
+}
+
+// src/internal/llm/anthropic.ts
+var AnthropicClient = class {
+  constructor(options) {
+    this.options = options;
+    this.baseUrl = options.baseUrl ?? "https://api.anthropic.com";
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name = "anthropic";
+  baseUrl;
+  fetchImpl;
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: HTTP+SSE handshake + accumulator is intentionally one block
+  async *stream(request, signal) {
+    const body = buildAnthropicBody(request);
+    const headers = {
+      "content-type": "application/json",
+      "x-api-key": this.options.apiKey,
+      "anthropic-version": this.options.version ?? "2023-06-01"
+    };
+    if (this.options.extraHeaders !== void 0) Object.assign(headers, this.options.extraHeaders);
+    const response = await this.fetchImpl(`${this.baseUrl}/v1/messages`, {
+      method: "POST",
+      signal,
+      headers,
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      let body2 = text;
+      try {
+        body2 = JSON.parse(text);
+      } catch {
+      }
+      throw mapAnthropicError({
+        status: response.status,
+        body: body2,
+        headers: response.headers,
+        endpoint: "/v1/messages"
+      });
+    }
+    const accumulator = new AnthropicStreamAccumulator();
+    for await (const record of parseSseStream(response.body, signal)) {
+      if (record.event === "ping" || record.event === "message_start") continue;
+      let parsed;
+      try {
+        parsed = JSON.parse(record.data);
+      } catch {
+        continue;
+      }
+      const events = accumulator.consume(parsed);
+      for (const event of events) yield event;
+    }
+    if (!accumulator.finishReasonSeen) {
+      throw new NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
+        code: "stream_truncated"
+      });
+    }
+    return accumulator.finish();
+  }
+};
+var AnthropicStreamAccumulator = class {
+  text = "";
+  stopReason = "end_turn";
+  /**
+   * M2 #61 — whether a `message_delta` carrying a real `stop_reason` was seen.
+   * A stream that closes before it is a truncation (server FIN / proxy hiccup),
+   * not a clean `end_turn` — the caller throws `stream_truncated` on `false`.
+   */
+  sawStopReason = false;
+  inputTokens;
+  outputTokens;
+  cacheReadTokens;
+  cacheWriteTokens;
+  toolCalls = /* @__PURE__ */ new Map();
+  toolBuffers = /* @__PURE__ */ new Map();
+  consume(event) {
+    if (event.type === "content_block_start") {
+      this.handleToolStart(event);
+      return [];
+    }
+    if (event.type === "content_block_delta") {
+      return this.handleContentDelta(event);
+    }
+    if (event.type === "message_delta") {
+      this.handleMessageDelta(event);
+    }
+    return [];
+  }
+  handleToolStart(start) {
+    if (start.content_block.type !== "tool_use") return;
+    this.toolCalls.set(start.index, {
+      type: "tool_use",
+      id: start.content_block.id,
+      name: start.content_block.name,
+      input: { ...start.content_block.input }
+    });
+    this.toolBuffers.set(start.index, "");
+  }
+  handleContentDelta(delta) {
+    if (delta.delta.type === "text_delta") {
+      const text = delta.delta.text;
+      this.text += text;
+      return [{ type: "text_delta", text }];
+    }
+    const idx = delta.index;
+    const existing = this.toolBuffers.get(idx) ?? "";
+    this.toolBuffers.set(idx, existing + delta.delta.partial_json);
+    return [];
+  }
+  /**
+   * T3.8 — extract token counters from Anthropic's `message_delta` usage.
+   * Public on the class so the test seam can drive it directly without
+   * spinning the SSE parser.
+   */
+  handleMessageDelta(md) {
+    if (md.delta.stop_reason !== void 0 && md.delta.stop_reason !== null) {
+      this.sawStopReason = true;
+    }
+    this.stopReason = mapAnthropicStopReason(md.delta.stop_reason);
+    if (md.usage?.input_tokens !== void 0) this.inputTokens = md.usage.input_tokens;
+    if (md.usage?.output_tokens !== void 0) this.outputTokens = md.usage.output_tokens;
+    if (md.usage?.cache_creation_input_tokens !== void 0 && md.usage.cache_creation_input_tokens > 0) {
+      this.cacheWriteTokens = md.usage.cache_creation_input_tokens;
+    }
+    if (md.usage?.cache_read_input_tokens !== void 0 && md.usage.cache_read_input_tokens > 0) {
+      this.cacheReadTokens = md.usage.cache_read_input_tokens;
+    }
+  }
+  /** M2 #61 — whether the terminal `message_delta` (stop_reason) was seen. */
+  get finishReasonSeen() {
+    return this.sawStopReason;
+  }
+  finish() {
+    const toolCalls = [];
+    for (const [index, tool] of this.toolCalls.entries()) {
+      const buffered = this.toolBuffers.get(index);
+      const parsed = parseToolArguments(buffered);
+      if (Object.keys(parsed).length > 0) tool.input = parsed;
+      toolCalls.push(tool);
+    }
+    return makeLlmFinish({
+      stopReason: this.stopReason,
+      text: this.text,
+      toolCalls,
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      // T3.8 — surface Anthropic native cache-token counters when the
+      // request used `cache_control: {type:"ephemeral"}` on system blocks.
+      cacheReadTokens: this.cacheReadTokens,
+      cacheWriteTokens: this.cacheWriteTokens
+    });
+  }
+};
+function buildAnthropicBody(request) {
+  return {
+    model: request.model,
+    stream: true,
+    ...buildAnthropicCommonBody(request)
+  };
+}
+
+// src/internal/error-mappers/bedrock.ts
+function classifyBedrockError(args, awsType, message) {
+  if (args.status === 429 || awsType.includes("Throttling") || awsType.includes("TooManyRequests")) {
+    return "rate_limit";
+  }
+  if (args.status === 401 || args.status === 403 || awsType.includes("AccessDenied") || awsType.includes("UnauthorizedOperation")) {
+    return "auth_failed";
+  }
+  if (args.status === 400 || args.status === 404 || awsType.includes("ValidationException") || awsType.includes("ResourceNotFound") || message.includes("use case details")) {
+    return "invalid_request";
+  }
+  if (args.status === 408 || awsType.includes("Timeout")) return "timeout";
+  if (args.status >= 500) return "server_error";
+  return "unknown";
+}
+function buildBedrockMetadata(args, code) {
+  return buildErrorMetadata({
+    provider: "bedrock",
+    endpoint: args.endpoint,
+    code,
+    status: args.status,
+    headers: args.headers,
+    body: args.body
+  });
+}
+function mapBedrockError(args) {
+  const parsed = parseBody(args.body);
+  const awsType = parsed.__type ?? "";
+  const message = parsed.message ?? parsed.Message ?? "Bedrock request failed";
+  const code = classifyBedrockError(args, awsType, message);
+  const metadata = buildBedrockMetadata(args, code);
+  switch (code) {
+    case "rate_limit":
+      return new RateLimitError(`Bedrock throttled: ${message}`, { metadata });
+    case "auth_failed":
+      return new AuthenticationError(`Bedrock auth: ${message}`, { metadata });
+    case "invalid_request": {
+      const friendly = message.includes("use case details") ? `Bedrock account setup required: ${message} (AWS Console \u2192 Bedrock \u2192 Model access \u2192 Anthropic \u2192 Submit use case form, then retry in 15 min.)` : `Bedrock validation: ${message}`;
+      return new ConfigurationError(friendly, { metadata });
+    }
+    case "timeout":
+      return new NetworkError(`Bedrock timeout: ${message}`, { metadata });
+    case "server_error":
+      return new NetworkError(`Bedrock server error: ${message}`, { metadata });
+    default:
+      return new UnknownAgentError(`Bedrock unknown: ${message}`, { metadata });
+  }
+}
+function parseBody(body) {
+  if (body !== null && typeof body === "object") return body;
+  if (typeof body === "string") {
+    try {
+      return JSON.parse(body);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+var cachedToken = null;
+var CACHE_TTL_MS = 90 * 60 * 1e3;
+async function resolveBedrockToken(region) {
+  const env = process.env.AWS_BEARER_TOKEN_BEDROCK;
+  if (env !== void 0 && env.length > 0) return env;
+  const now = Date.now();
+  if (cachedToken !== null && cachedToken.expiresAt > now) {
+    return cachedToken.value;
+  }
+  try {
+    const r = createRequire(import.meta.url);
+    const gen = r("@aws/bedrock-token-generator");
+    if (typeof gen.getToken !== "function") return void 0;
+    const providers = r("@aws-sdk/credential-providers");
+    if (typeof providers.fromNodeProviderChain !== "function") return void 0;
+    const credentialProvider = providers.fromNodeProviderChain();
+    const token = await gen.getToken({ credentials: credentialProvider, region });
+    cachedToken = { value: token, expiresAt: now + CACHE_TTL_MS };
+    return token;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/internal/llm/bedrock-anthropic.ts
+var BedrockAnthropicClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name = "bedrock";
+  fetchImpl;
+  async resolveTokenOrThrow(region) {
+    const fromOpts = this.options.apiKey;
+    if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
+    const fromEnv = await resolveBedrockToken(region);
+    if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
+    throw new ConfigurationError(
+      "Bedrock requires AWS_BEARER_TOKEN_BEDROCK env var, or install `@aws/bedrock-token-generator` for auto-refresh, or pass apiKey explicitly.",
+      { code: "auth_failed" }
+    );
+  }
+  async *stream(request, signal) {
+    const region = inferRegionFromModelId(request.model) ?? process.env.AWS_REGION ?? "us-east-1";
+    const token = await this.resolveTokenOrThrow(region);
+    const bareModel = stripBedrockPrefix(request.model);
+    const baseUrl = this.options.baseUrl ?? resolveBedrockBaseUrl(request.model);
+    const endpoint = `/model/${encodeURIComponent(bareModel)}/invoke`;
+    const url = `${baseUrl}${endpoint}`;
+    const response = await postAnthropicRequest({
+      fetchImpl: this.fetchImpl,
+      url,
+      token,
+      body: buildBedrockBody(request),
+      signal
+    });
+    const consumed = await handleAnthropicResponse({
+      response,
+      endpoint,
+      errorMapper: mapBedrockError
+    });
+    if (consumed.text.length > 0) yield { type: "text_delta", text: consumed.text };
+    return makeLlmFinish(consumed);
+  }
+};
+function buildBedrockBody(request) {
+  return {
+    anthropic_version: "bedrock-2023-05-31",
+    ...buildAnthropicCommonBody(request)
+  };
+}
+
+// src/internal/error-mappers/openai-compatible.ts
+function mapOpenAICompatibleError(args) {
+  const { providerId, status, body, headers, endpoint } = args;
+  const code = mapOpenAiStatusToCode(status, body);
+  const message = formatMessage2(providerId, status, code);
+  const metadata = buildErrorMetadata({
+    provider: providerId,
+    endpoint,
+    code,
+    status,
+    headers,
+    body
+  });
+  if (status === 401 || status === 403) {
+    return new AuthenticationError(message, { code: `${providerId}_auth_failed`, metadata });
+  }
+  if (status === 429) {
+    return new RateLimitError(message, { code: `${providerId}_rate_limit`, metadata });
+  }
+  if (status === 400) {
+    return new ConfigurationError(message, { code: `${providerId}_${code}`, metadata });
+  }
+  if (status === 408) {
+    return new NetworkError(message, { code: `${providerId}_timeout`, metadata });
+  }
+  if (status >= 500 && status < 600) {
+    return new NetworkError(message, { code: `${providerId}_server_error`, metadata });
+  }
+  return new UnknownAgentError(message, { code: `${providerId}_unknown`, metadata });
+}
+function extractOpenAiErrorCode(body) {
+  if (body === null || typeof body !== "object") return void 0;
+  const err = body.error;
+  if (err === void 0 || err === null) return void 0;
+  if (typeof err.code === "string") return err.code;
+  if (typeof err.type === "string") return err.type;
+  return void 0;
+}
+function mapOpenAiStatusToCode(status, body) {
+  const rawCode = extractOpenAiErrorCode(body)?.toLowerCase() ?? "";
+  if (rawCode.includes("context_length") || rawCode.includes("context_window") || rawCode.includes("too_many_tokens") || rawCode.includes("max_tokens")) {
+    return "context_too_long";
+  }
+  if (rawCode.includes("content_filter") || rawCode.includes("content_policy") || rawCode.includes("safety")) {
+    return "content_filtered";
+  }
+  if (rawCode.includes("model_not_found") || rawCode.includes("model_unavailable") || rawCode.includes("invalid_model")) {
+    return "model_unavailable";
+  }
+  if (status === 402 || rawCode.includes("insufficient_quota") || rawCode.includes("quota_exceeded")) {
+    return "quota_exceeded";
+  }
+  if (status === 401 || status === 403) return "auth_failed";
+  if (status === 429) return "rate_limit";
+  if (status === 408) return "timeout";
+  if (status === 400) return "invalid_request";
+  if (status >= 500 && status < 600) return "server_error";
+  return "unknown";
+}
+function formatMessage2(providerId, status, code) {
+  return `${providerId} API error: ${code} (HTTP ${status})`;
+}
+
+// src/internal/llm/fault-injection.ts
+var ENV_GATE_KEY = "NODE_ENV";
+var ENV_GATE_VALUE = "test";
+var ENV_OVERRIDE_KEY = "THEOKIT_TEST_RESPONSE_OVERRIDE";
+function maybeWrapWithFaultInjection(client) {
+  if (!isGateOn()) return client;
+  return new FaultInjectingLlmClient(client);
+}
+var FaultInjectingLlmClient = class {
+  name;
+  /**
+   * Inner (real) client. Exposed so layered transport assertions (router
+   * pool-wiring tests, telemetry inspectors) can walk one level deep —
+   * same pattern PoolAwareLlmClient uses for its inner transport.
+   */
+  inner;
+  constructor(inner) {
+    this.inner = inner;
+    this.name = inner.name;
+  }
+  async *stream(request, signal) {
+    if (!isGateOn()) {
+      return yield* this.inner.stream(request, signal);
+    }
+    const parsed = parseOverrideOrWarnOnce();
+    if (parsed === void 0) {
+      return yield* this.inner.stream(request, signal);
+    }
+    if (parsed.status >= 400) {
+      throw mapOpenAICompatibleError({
+        providerId: this.name,
+        status: parsed.status,
+        body: parsed.body,
+        headers: void 0,
+        endpoint: "/v1/chat/completions"
+      });
+    }
+    const text = extractText(parsed.body);
+    yield { type: "text_delta", text };
+    yield { type: "stop", reason: "end_turn" };
+    return {
+      stopReason: "end_turn",
+      text,
+      toolCalls: [],
+      inputTokens: 0,
+      outputTokens: 0
+    };
+  }
+};
+function isGateOn() {
+  return process.env[ENV_GATE_KEY] === ENV_GATE_VALUE;
+}
+var warnedInvalidJson = false;
+function parseOverrideOrWarnOnce() {
+  const raw = process.env[ENV_OVERRIDE_KEY];
+  if (raw === void 0 || raw.length === 0) return void 0;
+  let candidate;
+  try {
+    candidate = JSON.parse(raw);
+  } catch (_err) {
+    warnInvalidJsonOnce();
+    return void 0;
+  }
+  if (candidate === null || typeof candidate !== "object") {
+    warnInvalidJsonOnce();
+    return void 0;
+  }
+  const obj = candidate;
+  if (typeof obj.status !== "number" || !Number.isFinite(obj.status)) {
+    warnInvalidJsonOnce();
+    return void 0;
+  }
+  return { status: obj.status, body: obj.body };
+}
+function warnInvalidJsonOnce(_raw) {
+  if (warnedInvalidJson) return;
+  warnedInvalidJson = true;
+  process.stderr.write(
+    `[theokit-sdk] ${ENV_OVERRIDE_KEY} is set but value is not valid JSON of shape \`{"status": number, "body": object | string}\`. Falling back to real LLM call. This warning is shown once per process.
+`
+  );
+}
+function extractText(body) {
+  if (typeof body === "string") return body;
+  if (body === null || typeof body !== "object") return "";
+  const fromOpenAi = readOpenAiContent(body);
+  if (fromOpenAi !== void 0) return fromOpenAi;
+  const obj = body;
+  if (typeof obj.text === "string") return obj.text;
+  return "";
+}
+function readOpenAiContent(body) {
+  const obj = body;
+  if (!Array.isArray(obj.choices) || obj.choices.length === 0) return void 0;
+  const first = obj.choices[0];
+  const content = first?.message?.content;
+  if (typeof content === "string") return content;
+  return void 0;
+}
+
+// src/internal/error-mappers/ollama.ts
+function mapOllamaTransportError(args) {
+  if (args.providerId !== "ollama") return void 0;
+  const causeCode = extractCauseCode(args.cause);
+  if (causeCode !== "ECONNREFUSED" && causeCode !== "ENOTFOUND") return void 0;
+  const metadata = buildErrorMetadata({
+    provider: "ollama",
+    endpoint: args.endpoint,
+    code: "network",
+    status: 0,
+    headers: void 0,
+    body: { cause: causeCode }
+  });
+  return new ConfigurationError(
+    "Ollama is not reachable. Run `ollama serve` to start the local runtime, or set OLLAMA_HOST to point at a remote Ollama server.",
+    { code: "ollama_unreachable", metadata }
+  );
+}
+function mapOllamaHttpError(args) {
+  if (args.providerId !== "ollama") return void 0;
+  const errString = extractErrorString(args.body).toLowerCase();
+  if (args.status === 404 && errString.includes("not found") && errString.includes("pull")) {
+    const modelHint = extractModelName(errString);
+    const metadata = buildErrorMetadata({
+      provider: "ollama",
+      endpoint: args.endpoint,
+      code: "model_unavailable",
+      status: args.status,
+      headers: args.headers,
+      body: args.body
+    });
+    const pullCmd = modelHint !== void 0 ? `ollama pull ${modelHint}` : "ollama pull <model>";
+    return new ConfigurationError(
+      `Ollama model is not pulled. Run \`${pullCmd}\` to download it first.`,
+      { code: "ollama_model_not_pulled", metadata }
+    );
+  }
+  if (args.status === 503 && errString.includes("model is loading")) {
+    const metadata = buildErrorMetadata({
+      provider: "ollama",
+      endpoint: args.endpoint,
+      code: "server_error",
+      status: args.status,
+      headers: args.headers,
+      body: args.body
+    });
+    return new NetworkError(
+      "Ollama model is loading. Retry in a few seconds \u2014 Ollama is warming up the model into memory.",
+      { code: "ollama_model_loading", metadata }
+    );
+  }
+  return void 0;
+}
+function extractCauseCode(cause) {
+  if (cause === null || typeof cause !== "object") return void 0;
+  const directCode = cause.code;
+  if (typeof directCode === "string") return directCode;
+  const nested = cause.cause;
+  if (nested !== void 0) return extractCauseCode(nested);
+  return void 0;
+}
+function extractErrorString(body) {
+  if (typeof body === "string") return body;
+  if (body === null || typeof body !== "object") return "";
+  const err = body.error;
+  if (typeof err === "string") return err;
+  return "";
+}
+function extractModelName(errString) {
+  const match = errString.match(/'([^']+)'/);
+  return match?.[1];
+}
+
+// src/internal/llm/ollama-native.ts
+var OllamaNativeClient = class {
+  constructor(options) {
+    this.options = options;
+    const raw = (options.baseUrl ?? "http://localhost:11434").replace(/\/+$/, "");
+    this.baseUrl = raw.replace(/\/v1$/i, "");
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name = "ollama";
+  baseUrl;
+  fetchImpl;
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: HTTP+NDJSON handshake + accumulator is intentionally one block (mirrors openai.ts)
+  async *stream(request, signal) {
+    const headers = { "content-type": "application/json" };
+    if (this.options.apiKey !== void 0 && this.options.apiKey.length > 0) {
+      headers.authorization = `Bearer ${this.options.apiKey}`;
+    }
+    const body = buildOllamaChatBody(request);
+    const url = `${this.baseUrl}/api/chat`;
+    let response;
+    try {
+      response = await this.fetchImpl(url, {
+        method: "POST",
+        signal,
+        headers,
+        body: JSON.stringify(body)
+      });
+    } catch (fetchErr) {
+      const mapped = mapOllamaTransportError({
+        providerId: "ollama",
+        cause: fetchErr,
+        endpoint: "/api/chat"
+      });
+      if (mapped !== void 0) throw mapped;
+      throw fetchErr;
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      let bodyJson = text;
+      try {
+        bodyJson = JSON.parse(text);
+      } catch {
+      }
+      const mapped = mapOllamaHttpError({
+        providerId: "ollama",
+        status: response.status,
+        body: bodyJson,
+        headers: response.headers,
+        endpoint: "/api/chat"
+      });
+      if (mapped !== void 0) throw mapped;
+      throw new Error(`Ollama /api/chat HTTP ${response.status}: ${text.slice(0, 200)}`);
+    }
+    const accumulator = new OllamaStreamAccumulator();
+    if (response.body === null) {
+      return accumulator.finish();
+    }
+    for await (const chunk of parseNdjsonStream(response.body, signal)) {
+      const events = accumulator.consume(chunk);
+      for (const event of events) yield event;
+      if (chunk.done === true) break;
+    }
+    return accumulator.finish();
+  }
+};
+var OllamaStreamAccumulator = class {
+  text = "";
+  stopReason = "end_turn";
+  inputTokens;
+  outputTokens;
+  toolCalls = [];
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: NDJSON chunk dispatch — text delta + tool_call append + finish-reason mapping is one cohesive accumulator (mirrors openai.ts OpenAIStreamAccumulator.consume).
+  consume(chunk) {
+    const events = [];
+    if (chunk.prompt_eval_count !== void 0) this.inputTokens = chunk.prompt_eval_count;
+    if (chunk.eval_count !== void 0) this.outputTokens = chunk.eval_count;
+    const msg = chunk.message;
+    if (msg?.content !== void 0 && msg.content.length > 0) {
+      this.text += msg.content;
+      events.push({ type: "text_delta", text: msg.content });
+    }
+    if (msg?.tool_calls !== void 0) {
+      for (const call of msg.tool_calls) {
+        const input = typeof call.function.arguments === "string" ? parseOllamaToolArguments(call.function.arguments) : call.function.arguments;
+        this.toolCalls.push({
+          type: "tool_use",
+          id: `ollama_call_${this.toolCalls.length + 1}`,
+          name: call.function.name,
+          input
+        });
+      }
+    }
+    if (chunk.done === true && chunk.done_reason !== void 0) {
+      this.stopReason = mapOllamaDoneReason(chunk.done_reason, this.toolCalls.length > 0);
+    }
+    return events;
+  }
+  finish() {
+    if (this.toolCalls.length > 0 && this.stopReason === "end_turn") {
+      this.stopReason = "tool_use";
+    }
+    return makeLlmFinish({
+      stopReason: this.stopReason,
+      text: this.text,
+      toolCalls: this.toolCalls,
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens
+    });
+  }
+};
+function parseOllamaToolArguments(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function mapOllamaDoneReason(reason, hasToolCalls) {
+  if (hasToolCalls) return "tool_use";
+  if (reason === "length") return "max_tokens";
+  if (reason === "stop") return "end_turn";
+  return "end_turn";
+}
+async function* parseNdjsonStream(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  let buffer = "";
+  try {
+    while (true) {
+      if (signal.aborted) return;
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0) continue;
+        try {
+          yield JSON.parse(trimmed);
+        } catch {
+        }
+      }
+    }
+    const tail = buffer.trim();
+    if (tail.length > 0) {
+      try {
+        yield JSON.parse(tail);
+      } catch {
+      }
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {
+    }
+    reader.releaseLock();
+  }
+}
+var ollamaSystemText = collapseSystemText;
+function buildOllamaChatBody(request) {
+  const messages = [];
+  const systemText = ollamaSystemText(request.system);
+  if (systemText.length > 0) {
+    messages.push({ role: "system", content: systemText });
+  }
+  for (const message of request.messages) {
+    for (const out of toOllamaMessages(message)) messages.push(out);
+  }
+  const tools = toOllamaTools(request.tools);
+  const body = {
+    model: request.model,
+    stream: true,
+    messages,
+    // ADR D192: 24h keep_alive prevents Ollama from evicting the chat model
+    // when other models (embeddings, judges) are loaded between turns.
+    // Cuts cold-load latency from 20-30s to single-digit ms per turn.
+    keep_alive: process.env.OLLAMA_KEEP_ALIVE ?? "24h"
+  };
+  if (tools.length > 0) body.tools = tools;
+  const opts = {};
+  if (request.maxTokens !== void 0) opts.num_predict = request.maxTokens;
+  if (request.temperature !== void 0) opts.temperature = request.temperature;
+  if (Object.keys(opts).length > 0) body.options = opts;
+  return body;
+}
+function toOllamaMessages(message) {
+  if (message.role === "system") {
+    return [{ role: "system", content: joinTextParts(message) }];
+  }
+  if (message.role === "user") {
+    if (message.content.some((p) => p.type === "image")) {
+      throw new ConfigurationError(
+        "image input is not supported on the ollama-native provider; use an OpenAI/OpenRouter model for multimodal turns",
+        { code: "ollama_image_unsupported" }
+      );
+    }
+    const out = [];
+    for (const part of message.content) {
+      if (part.type === "tool_result") {
+        out.push({
+          role: "tool",
+          // SE7 — string-only tool role: text blocks flatten; image fails fast.
+          content: toStringToolResultContent(part.content, "ollama"),
+          tool_name: part.toolUseId
+        });
+      }
+    }
+    const userText = joinTextParts(message);
+    if (userText.length > 0) out.push({ role: "user", content: userText });
+    return out;
+  }
+  const text = joinTextParts(message);
+  const toolCalls = [];
+  for (const part of message.content) {
+    if (part.type === "tool_use") {
+      toolCalls.push({
+        function: { name: part.name, arguments: part.input }
+      });
+    }
+  }
+  const msg = { role: "assistant", content: text };
+  if (toolCalls.length > 0) msg.tool_calls = toolCalls;
+  return [msg];
+}
+function joinTextParts(message) {
+  return message.content.filter((p) => p.type === "text").map((p) => p.text).join("\n");
+}
+function toOllamaTools(tools) {
+  if (tools === void 0 || tools.length === 0) return [];
+  return tools.map((tool) => ({
+    type: "function",
+    function: {
+      name: tool.name,
+      description: tool.description,
+      parameters: tool.inputSchema
+    }
+  }));
+}
+
+// src/internal/llm/hermes-tool-extract.ts
+var HERMES_BLOCK = /<function=\s*([^>\s]+)\s*>([\s\S]*?)<\/tool_call>/g;
+var HERMES_PARAM = /<parameter=\s*([^>\s]+)\s*>([\s\S]*?)<\/parameter>/g;
+function extractHermesToolCalls(content, makeId, allowedToolNames) {
+  const isPromoted = (name) => name.length > 0 && (allowedToolNames === void 0 || allowedToolNames.has(name));
+  const toolCalls = [];
+  const droppedNames = [];
+  for (const block of content.matchAll(HERMES_BLOCK)) {
+    const name = (block[1] ?? "").trim();
+    if (!isPromoted(name)) {
+      if (name.length > 0 && allowedToolNames !== void 0) droppedNames.push(name);
+      continue;
+    }
+    toolCalls.push({
+      type: "tool_use",
+      id: makeId(),
+      name,
+      input: parseHermesParams(block[2] ?? "")
+    });
+  }
+  const residualText = toolCalls.length === 0 ? content : content.replace(
+    HERMES_BLOCK,
+    (full, rawName) => isPromoted((rawName ?? "").trim()) ? "" : full
+  ).trim();
+  return { toolCalls, residualText, droppedNames };
+}
+function parseHermesParams(inner) {
+  const input = {};
+  for (const param of inner.matchAll(HERMES_PARAM)) {
+    const key = param[1];
+    const value = param[2];
+    if (key === void 0 || value === void 0) continue;
+    input[key.trim()] = value;
+  }
+  return sanitizeToolInput(input, { trim: true }).value;
+}
+var STREAM_MARKER = "<function=";
+var DEFAULT_STREAM_BUFFER_CAP = 8192;
+var isStreamWs = (c) => c === " " || c === "	" || c === "\n" || c === "\r";
+function streamToolCallBufferState(held, allowedToolNames, cap = DEFAULT_STREAM_BUFFER_CAP) {
+  if (allowedToolNames.size === 0) return "impossible";
+  const t = held.trimStart();
+  if (t.length < STREAM_MARKER.length) {
+    return STREAM_MARKER.startsWith(t) ? "possible" : "impossible";
+  }
+  if (!t.startsWith(STREAM_MARKER)) return "impossible";
+  const parsed = parseStreamMarkerName(t);
+  if (parsed === "building") return "possible";
+  if (parsed === "invalid") return "impossible";
+  const nameOk = parsed.complete ? allowedToolNames.has(parsed.name) : someToolNameStartsWith(allowedToolNames, parsed.name);
+  if (!nameOk) return "impossible";
+  return held.length > cap ? "impossible" : "possible";
+}
+function parseStreamMarkerName(t) {
+  let cursor = STREAM_MARKER.length;
+  while (cursor < t.length && isStreamWs(t[cursor])) cursor += 1;
+  const nameStart = cursor;
+  while (cursor < t.length && t[cursor] !== ">" && !isStreamWs(t[cursor])) cursor += 1;
+  const name = t.slice(nameStart, cursor);
+  if (name.length === 0) return cursor >= t.length ? "building" : "invalid";
+  return { name, complete: cursor < t.length && t[cursor] === ">" };
+}
+function someToolNameStartsWith(allowedToolNames, prefix) {
+  for (const name of allowedToolNames) {
+    if (name.startsWith(prefix)) return true;
+  }
+  return false;
+}
+function firstPossibleMarkerStart(held, allowedToolNames) {
+  for (let i = held.indexOf("<"); i !== -1; i = held.indexOf("<", i + 1)) {
+    if (streamToolCallBufferState(held.slice(i), allowedToolNames) === "possible") return i;
+  }
+  return -1;
+}
+var StreamSuppressionBuffer = class {
+  constructor(allowedToolNames) {
+    this.allowedToolNames = allowedToolNames;
+  }
+  allowedToolNames;
+  #held = "";
+  /** Feed a content delta; returns the text to emit as a `text_delta` now, or `undefined` to hold. */
+  push(content) {
+    this.#held += content;
+    if (streamToolCallBufferState(this.#held, this.allowedToolNames) === "possible")
+      return void 0;
+    const holdStart = firstPossibleMarkerStart(this.#held, this.allowedToolNames);
+    if (holdStart > 0) {
+      const flush2 = this.#held.slice(0, holdStart);
+      this.#held = this.#held.slice(holdStart);
+      return flush2;
+    }
+    const flush = this.#held;
+    this.#held = "";
+    return flush;
+  }
+  /** Drain the held buffer at stream end. `hasNativeCalls` mirrors `finish()`'s size-guard: when
+   *  native `tool_calls` exist, `finish()` won't strip the leaked block, so stream the held text WHOLE
+   *  (keeping `accumulatedText == finish.text`); otherwise strip the recoverable blocks. Idempotent. */
+  drain(hasNativeCalls) {
+    if (this.#held.length === 0) return void 0;
+    const held = this.#held;
+    this.#held = "";
+    if (hasNativeCalls) return held;
+    const residual = extractHermesToolCalls(held, () => "held", this.allowedToolNames).residualText;
+    return residual.length > 0 ? residual : void 0;
+  }
+};
+
+// src/internal/llm/openai-messages.ts
+function toOpenAIMessages(message) {
+  if (message.role === "system") return [systemMessage(message)];
+  if (message.role === "user") return userOrToolMessages(message);
+  return [assistantMessage(message)];
+}
+function systemMessage(message) {
+  return { role: "system", content: joinTextParts2(message) };
+}
+function joinTextParts2(message) {
+  return message.content.filter((part) => part.type === "text").map((part) => part.text).join("\n");
+}
+function userOrToolMessages(message) {
+  const out = [];
+  for (const part of message.content) {
+    if (part.type === "tool_result") {
+      out.push({
+        role: "tool",
+        tool_call_id: part.toolUseId,
+        // SE7 — this wire's tool role is string-only: text blocks flatten; an
+        // image block fails fast (ConfigurationError).
+        content: toStringToolResultContent(part.content, "openai")
+      });
+    }
+  }
+  const userText = joinTextParts2(message);
+  const imageParts = message.content.filter(
+    (p) => p.type === "image"
+  );
+  if (imageParts.length > 0) {
+    const content = [];
+    if (userText.length > 0) content.push({ type: "text", text: userText });
+    for (const img of imageParts) {
+      const url = img.source.type === "base64" ? `data:${img.source.media_type};base64,${img.source.data}` : img.source.url;
+      content.push({ type: "image_url", image_url: { url } });
+    }
+    out.push({ role: "user", content });
+  } else if (userText.length > 0) {
+    out.push({ role: "user", content: userText });
+  }
+  return out;
+}
+function assistantMessage(message) {
+  const text = joinTextParts2(message);
+  const toolCalls = message.content.filter((part) => part.type === "tool_use").map((part) => {
+    const tc = part;
+    return {
+      id: tc.id,
+      type: "function",
+      function: { name: tc.name, arguments: JSON.stringify(tc.input) }
+    };
+  });
+  const result = { role: "assistant", content: text };
+  if (toolCalls.length > 0) result.tool_calls = toolCalls;
+  return result;
+}
+
+// src/internal/llm/openai.ts
+function deriveChatPath(baseUrl) {
+  try {
+    return /\/v\d+[a-z]*(\/|$)/.test(new URL(baseUrl).pathname) ? "/chat/completions" : "/v1/chat/completions";
+  } catch {
+    return "/v1/chat/completions";
+  }
+}
+var OpenAIClient = class {
+  constructor(options) {
+    this.options = options;
+    this.baseUrl = (options.baseUrl ?? "https://api.openai.com").replace(/\/+$/, "");
+    this.chatPath = options.chatCompletionsPath ?? deriveChatPath(this.baseUrl);
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name = "openai";
+  baseUrl;
+  chatPath;
+  fetchImpl;
+  /**
+   * Whether this client recovers leaked Hermes tool-call dialect from assistant
+   * text (theokit#58 follow-up). Observability for the route→client wiring of
+   * `extractToolCallsFromContent`. @internal
+   */
+  get recoversLeakedToolCalls() {
+    return this.options.extractToolCallsFromContent ?? false;
+  }
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: HTTP+SSE handshake + accumulator is intentionally one block
+  async *stream(request, signal) {
+    const headers = {
+      "content-type": "application/json",
+      authorization: `Bearer ${this.options.apiKey}`
+    };
+    if (this.options.organization !== void 0) {
+      headers["openai-organization"] = this.options.organization;
+    }
+    if (this.options.extraHeaders !== void 0) Object.assign(headers, this.options.extraHeaders);
+    const providerId = this.options.providerName ?? this.name;
+    let response;
+    try {
+      response = await this.fetchImpl(`${this.baseUrl}${this.chatPath}`, {
+        method: "POST",
+        signal,
+        headers,
+        body: JSON.stringify(buildOpenAIBody(request, providerId))
+      });
+    } catch (fetchErr) {
+      const mapped = mapOllamaTransportError({
+        providerId,
+        cause: fetchErr,
+        endpoint: "/v1/chat/completions"
+      });
+      if (mapped !== void 0) throw mapped;
+      throw fetchErr;
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      let body = text;
+      try {
+        body = JSON.parse(text);
+      } catch {
+      }
+      const ollamaMapped = mapOllamaHttpError({
+        providerId,
+        status: response.status,
+        body,
+        headers: response.headers,
+        endpoint: "/v1/chat/completions"
+      });
+      if (ollamaMapped !== void 0) throw ollamaMapped;
+      throw mapOpenAICompatibleError({
+        providerId,
+        status: response.status,
+        body,
+        headers: response.headers,
+        endpoint: "/v1/chat/completions"
+      });
+    }
+    const accumulator = new OpenAIStreamAccumulator(
+      this.options.extractToolCallsFromContent ?? false,
+      providerId,
+      // R5: request-scoped allowlist — leaked recovery only promotes a block whose name is a tool the
+      // model was actually given. Empty set (no tools) recovers nothing.
+      new Set(request.tools?.map((tool) => tool.name) ?? [])
+    );
+    let sawDone = false;
+    for await (const record of parseSseStream(response.body, signal)) {
+      if (record.data === "[DONE]") {
+        sawDone = true;
+        break;
+      }
+      let chunk;
+      try {
+        chunk = JSON.parse(record.data);
+      } catch {
+        continue;
+      }
+      if (chunk.error !== void 0 && chunk.error !== null) {
+        const status = typeof chunk.error.code === "number" ? chunk.error.code : 502;
+        throw mapOpenAICompatibleError({
+          providerId,
+          status,
+          body: chunk,
+          headers: response.headers,
+          endpoint: "/v1/chat/completions"
+        });
+      }
+      const events = accumulator.consume(chunk);
+      for (const event of events) yield event;
+    }
+    if (!sawDone && !accumulator.finishReasonSeen) {
+      throw new NetworkError("SSE stream truncated (no finish_reason / [DONE])", {
+        code: "stream_truncated"
+      });
+    }
+    const drainEvent = accumulator.finalizeHeldText();
+    if (drainEvent !== void 0) yield drainEvent;
+    return accumulator.finish();
+  }
+};
+var OpenAIStreamAccumulator = class {
+  /**
+   * @param extractFromContent opt-in leaked-dialect safe-parse (theokit#58). Default false.
+   * @param providerName provider id, used only to label the recovery log line.
+   * @param allowedToolNames R5 request-scoped allowlist — built from `request.tools` at `stream()`;
+   *   leaked recovery in `finish()` only promotes a block whose name is in this set. `undefined`
+   *   (direct construction) recovers all (back-compat); an empty set recovers nothing.
+   */
+  constructor(extractFromContent = false, providerName = "openai", allowedToolNames) {
+    this.extractFromContent = extractFromContent;
+    this.providerName = providerName;
+    this.allowedToolNames = allowedToolNames;
+    this.suppress = extractFromContent && allowedToolNames !== void 0 && allowedToolNames.size > 0 ? new StreamSuppressionBuffer(allowedToolNames) : void 0;
+  }
+  extractFromContent;
+  providerName;
+  allowedToolNames;
+  text = "";
+  stopReason = "end_turn";
+  inputTokens;
+  outputTokens;
+  cacheReadTokens;
+  cacheWriteTokens;
+  reasoningTokens;
+  toolCalls = /* @__PURE__ */ new Map();
+  /** R7: present only when recovery is enabled AND the request declares tools — holds suspected
+   *  leaked-dialect content back from the `text_delta` stream. `undefined` ⇒ stream immediately. */
+  suppress;
+  consume(chunk) {
+    const events = [];
+    this.applyUsage(chunk.usage);
+    for (const choice of chunk.choices ?? []) {
+      events.push(...this.applyChoice(choice));
+    }
+    return events;
+  }
+  applyChoice(choice) {
+    const events = [];
+    const reasoningEvent = this.applyReasoningDelta(
+      choice.delta?.reasoning ?? choice.delta?.reasoning_content
+    );
+    if (reasoningEvent !== void 0) events.push(reasoningEvent);
+    const textEvent = this.applyContentDelta(choice.delta?.content);
+    if (textEvent !== void 0) events.push(textEvent);
+    this.mergeToolCallDeltas(choice.delta?.tool_calls);
+    this.applyFinishReason(choice.finish_reason);
+    if (choice.finish_reason !== void 0 && choice.finish_reason !== null) {
+      const flushEvent = this.finalizeHeldText();
+      if (flushEvent !== void 0) events.push(flushEvent);
+    }
+    return events;
+  }
+  applyReasoningDelta(reasoning) {
+    if (typeof reasoning !== "string" || reasoning.length === 0) return void 0;
+    return { type: "reasoning_delta", text: reasoning };
+  }
+  applyUsage(usage) {
+    if (usage?.prompt_tokens !== void 0) this.inputTokens = usage.prompt_tokens;
+    if (usage?.completion_tokens !== void 0) this.outputTokens = usage.completion_tokens;
+    const cachedDetail = usage?.prompt_tokens_details?.cached_tokens;
+    if (cachedDetail !== void 0) this.cacheReadTokens = cachedDetail;
+    const reasoningDetail = usage?.completion_tokens_details?.reasoning_tokens;
+    if (reasoningDetail !== void 0) this.reasoningTokens = reasoningDetail;
+    if (usage?.cache_read_input_tokens !== void 0) {
+      this.cacheReadTokens = usage.cache_read_input_tokens;
+    }
+    if (usage?.cache_creation_input_tokens !== void 0) {
+      this.cacheWriteTokens = usage.cache_creation_input_tokens;
+    }
+  }
+  applyContentDelta(content) {
+    if (typeof content !== "string" || content.length === 0) return void 0;
+    this.text += content;
+    if (this.suppress === void 0) return { type: "text_delta", text: content };
+    const emit = this.suppress.push(content);
+    return emit !== void 0 ? { type: "text_delta", text: emit } : void 0;
+  }
+  /** R7 held-buffer finalizer, called at the `finish_reason` chunk (in `applyChoice`) AND after the
+   *  SSE loop in `stream()` — so a stream that omits a `finish_reason` terminal never silently drops
+   *  held text. `toolCalls.size > 0` (native calls present) makes `finish()` skip recovery, so the
+   *  buffer streams the held text whole. Idempotent once drained. */
+  finalizeHeldText() {
+    const emit = this.suppress?.drain(this.toolCalls.size > 0);
+    return emit !== void 0 ? { type: "text_delta", text: emit } : void 0;
+  }
+  mergeToolCallDeltas(deltas) {
+    for (const call of deltas ?? []) {
+      const existing = this.toolCalls.get(call.index) ?? { id: "", name: "", args: "" };
+      if (call.id !== void 0) existing.id = call.id;
+      if (call.function?.name !== void 0) existing.name = call.function.name;
+      if (call.function?.arguments !== void 0) existing.args += call.function.arguments;
+      this.toolCalls.set(call.index, existing);
+    }
+  }
+  /** M2 #61 — true once any chunk carried a non-null `finish_reason` (else a
+   *  stream ending without `[DONE]` is a truncation, not a clean end). */
+  sawFinishReason = false;
+  get finishReasonSeen() {
+    return this.sawFinishReason;
+  }
+  applyFinishReason(reason) {
+    if (reason === void 0 || reason === null) return;
+    this.sawFinishReason = true;
+    this.stopReason = mapOpenAIFinish(reason);
+  }
+  finish() {
+    const toolCalls = [];
+    for (const call of this.toolCalls.values()) {
+      const input = parseToolArguments(call.args);
+      toolCalls.push({ type: "tool_use", id: call.id, name: call.name, input });
+    }
+    let text = this.text;
+    let stopReason = this.stopReason;
+    if (this.extractFromContent && toolCalls.length === 0) {
+      const recovered = extractHermesToolCalls(
+        this.text,
+        () => `hermes-${globalThis.crypto.randomUUID()}`,
+        this.allowedToolNames
+      );
+      if (recovered.toolCalls.length > 0) {
+        toolCalls.push(...recovered.toolCalls);
+        text = recovered.residualText;
+        stopReason = "tool_use";
+        process.stderr.write(
+          `[theokit-sdk] recovered ${recovered.toolCalls.length} leaked tool call(s) from assistant content (provider="${this.providerName}", names=${recovered.toolCalls.map((c) => c.name).join(",")})
+`
+        );
+      }
+      if (recovered.droppedNames.length > 0) {
+        process.stderr.write(
+          `[theokit-sdk] dropped ${recovered.droppedNames.length} leaked block(s) whose name is not a tool in the request (provider="${this.providerName}", names=${recovered.droppedNames.join(",")})
+`
+        );
+      }
+    }
+    return makeLlmFinish({
+      stopReason,
+      text,
+      toolCalls,
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      cacheReadTokens: this.cacheReadTokens,
+      cacheWriteTokens: this.cacheWriteTokens,
+      reasoningTokens: this.reasoningTokens
+    });
+  }
+};
+function applyReasoningRequest(body, effort, providerName) {
+  if (providerName === "openai") {
+    body.reasoning_effort = effort;
+    return;
+  }
+  body.reasoning = { effort };
+}
+function applyToolsRequest(body, request) {
+  if (request.tools === void 0 || request.tools.length === 0) return;
+  body.tools = request.tools.map((tool) => ({
+    type: "function",
+    function: { name: tool.name, description: tool.description, parameters: tool.inputSchema }
+  }));
+  if (request.toolChoice !== void 0) body.tool_choice = request.toolChoice;
+}
+function buildOpenAIBody(request, providerName) {
+  const messages = [];
+  const systemText = openAISystemText(request.system);
+  if (systemText.length > 0) {
+    messages.push({ role: "system", content: systemText });
+  }
+  for (const message of request.messages) {
+    for (const out of toOpenAIMessages(message)) messages.push(out);
+  }
+  const body = {
+    model: request.model,
+    stream: true,
+    // D376: opt-in to OpenAI's final-chunk usage record (no-op for providers
+    // that don't honor it; OpenRouter / OpenAI both respect it).
+    stream_options: { include_usage: true },
+    messages
+  };
+  if (request.maxTokens !== void 0) body.max_tokens = request.maxTokens;
+  if (request.temperature !== void 0) body.temperature = request.temperature;
+  if (request.reasoning?.effort !== void 0)
+    applyReasoningRequest(body, request.reasoning.effort, providerName);
+  applyToolsRequest(body, request);
+  const responseFormat = encodeOpenAIResponseFormat(request.responseFormat);
+  if (responseFormat !== void 0) body.response_format = responseFormat;
+  return body;
+}
+var openAISystemText = collapseSystemText;
+function encodeOpenAIResponseFormat(rf) {
+  if (rf === void 0) return void 0;
+  if (rf.type === "json_object") return { type: "json_object" };
+  return {
+    type: "json_schema",
+    json_schema: {
+      name: rf.jsonSchema.name,
+      schema: rf.jsonSchema.schema,
+      strict: rf.jsonSchema.strict ?? true
+    }
+  };
+}
+
+// src/internal/resilience/circuit-breaker.ts
+var DEFAULT_MAX_TIMEOUTS = 3;
+var DEFAULT_COOLDOWN_MS = 6e4;
+var CircuitBreaker = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  opts;
+  states = /* @__PURE__ */ new Map();
+  /** @returns true when the breaker is open and the call should be skipped. */
+  shouldSkip(key) {
+    const state = this.states.get(key);
+    if (state === void 0) return false;
+    if (state.cooldownUntilMs === 0) return false;
+    if (this.now() < state.cooldownUntilMs) return true;
+    state.cooldownUntilMs = 0;
+    state.consecutiveTimeouts = 0;
+    return false;
+  }
+  recordSuccess(key) {
+    const state = this.states.get(key);
+    if (state === void 0) return;
+    state.consecutiveTimeouts = 0;
+    state.cooldownUntilMs = 0;
+  }
+  recordTimeout(key) {
+    const state = this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
+    state.consecutiveTimeouts += 1;
+    if (state.consecutiveTimeouts >= (this.opts.maxTimeouts ?? DEFAULT_MAX_TIMEOUTS)) {
+      state.cooldownUntilMs = this.now() + (this.opts.cooldownMs ?? DEFAULT_COOLDOWN_MS);
+    }
+    this.states.set(key, state);
+  }
+  /** @internal — tests inspect counter state. */
+  inspect(key) {
+    return this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
+  }
+  now() {
+    return this.opts.now?.() ?? Date.now();
+  }
+};
+
+// src/internal/llm/stream-relay.ts
+async function tryFirstEvent(client, request, signal, logFallback = false) {
+  const generator = client.stream(request, signal);
+  try {
+    const firstResult = await generator.next();
+    return { kind: "ok", generator, firstResult };
+  } catch (cause) {
+    if (cause instanceof NetworkError || cause instanceof RateLimitError || cause instanceof AuthenticationError) {
+      if (logFallback) {
+        const errCode = cause.metadata?.code ?? cause.code ?? "unknown";
+        process.stderr.write(
+          `[theokit-sdk] provider ${client.name} failed (${errCode}): falling back
+`
+        );
+      }
+      return { kind: "handshake_error", error: cause };
+    }
+    throw cause;
+  }
+}
+async function* relayStream(generator, firstResult) {
+  if (firstResult.done === true) return firstResult.value;
+  yield firstResult.value;
+  while (true) {
+    const next = await generator.next();
+    if (next.done === true) return next.value;
+    yield next.value;
+  }
+}
+
+// src/internal/llm/pool-aware-client.ts
+var PoolAwareLlmClient = class {
+  constructor(pool, buildClient2, waitForAvailableMs = 3e4, resilience = {}) {
+    this.pool = pool;
+    this.buildClient = buildClient2;
+    this.waitForAvailableMs = waitForAvailableMs;
+    this.name = `pool-aware:${pool.provider}`;
+    this.breaker = resilience.breaker ?? new CircuitBreaker();
+    this.backoffBaseMs = resilience.backoffBaseMs;
+    this.rng = resilience.rng;
+    this.onRateLimit = resilience.onRateLimit;
+  }
+  pool;
+  buildClient;
+  waitForAvailableMs;
+  name;
+  onRateLimit;
+  /** M2 #60 — provider-level circuit breaker (consecutive-failure). */
+  breaker;
+  backoffBaseMs;
+  rng;
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stream() must serialize pool-select → build client → first-event probe → classify → retry/rotate/propagate. Extracting helpers fragments the linear narrative; the comments above each branch keep it readable.
+  async *stream(request, signal) {
+    if (this.breaker.shouldSkip(this.pool.provider)) {
+      throw new NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
+        code: "circuit_open"
+      });
+    }
+    let hasRetried429 = false;
+    while (true) {
+      if (signal.aborted) throw abortError(signal);
+      let entry = await this.pool.select();
+      if (entry === null) {
+        if (this.waitForAvailableMs > 0) {
+          const available = await this.pool.waitForAvailable(signal, {
+            maxWaitMs: this.waitForAvailableMs
+          });
+          if (available) {
+            entry = await this.pool.select();
+          }
+        }
+        if (entry === null) {
+          this.breaker.recordTimeout(this.pool.provider);
+          throw new CredentialPoolExhaustedError(
+            `All ${this.pool.provider} credentials exhausted; next retry available at ${this.nextRetryHint() ?? "unknown"}`,
+            { provider: this.pool.provider, nextRetryAt: this.nextRetryHint() }
+          );
+        }
+      }
+      const realClient = this.buildClient(entry.accessToken);
+      const attempt = await tryFirstEvent(realClient, request, signal);
+      if (attempt.kind === "ok") {
+        this.breaker.recordSuccess(this.pool.provider);
+        return yield* relayStream(attempt.generator, attempt.firstResult);
+      }
+      const decision = classifyAndDecide(attempt.error, hasRetried429);
+      if (decision === "retry") {
+        const backoffMs = computeBackoffMs({
+          attempt: 0,
+          ...this.backoffBaseMs !== void 0 ? { baseMs: this.backoffBaseMs } : {},
+          ...this.rng !== void 0 ? { rng: this.rng } : {}
+        });
+        this.onRateLimit?.({ attempt: 1, retryAfterMs: backoffMs });
+        await sleepWithAbort(backoffMs, signal);
+        hasRetried429 = true;
+        continue;
+      }
+      if (decision === "rotate") {
+        try {
+          await this.pool.markExhaustedAndRotate({
+            entryId: entry.id,
+            statusCode: attempt.error.metadata?.statusCode ?? inferStatusCode(attempt.error),
+            ...parseRetryAfterMs(attempt.error) !== void 0 ? { resetAtMs: parseRetryAfterMs(attempt.error) } : {}
+          });
+        } catch (persistErr) {
+          process.stderr.write(
+            `[theokit-sdk] credential-pool: persist failed during rotate; continuing in-memory: ${persistErr instanceof Error ? persistErr.message : String(persistErr)}
+`
+          );
+        }
+        hasRetried429 = false;
+        continue;
+      }
+      this.breaker.recordTimeout(this.pool.provider);
+      throw attempt.error;
+    }
+  }
+  /**
+   * Earliest epoch ms among entries' `lastErrorResetAt` — best estimate
+   * for the caller's `CredentialPoolExhaustedError.nextRetryAt`.
+   */
+  nextRetryHint() {
+    const resets = this.pool.list().map((e) => e.lastErrorResetAt).filter((v) => v !== void 0);
+    return resets.length === 0 ? void 0 : Math.min(...resets);
+  }
+};
+function classifyAndDecide(error, hasRetried429) {
+  if (error instanceof NetworkError) return "propagate";
+  if (error instanceof AuthenticationError) return "rotate";
+  const status = error.metadata?.statusCode ?? 429;
+  if (status === 402) return "rotate";
+  return hasRetried429 ? "rotate" : "retry";
+}
+function parseRetryAfterMs(error) {
+  const seconds = error.metadata?.retryAfter;
+  if (typeof seconds === "number" && seconds > 0) {
+    return Date.now() + seconds * 1e3;
+  }
+  return void 0;
+}
+function inferStatusCode(error) {
+  if (error instanceof AuthenticationError) return 401;
+  if (error instanceof RateLimitError) return 429;
+  return 0;
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  return new Error("AbortError");
+}
+
+// src/internal/llm/responses.ts
+function messageToInputItems(message) {
+  const items = [];
+  if (message.role === "user") {
+    const content = [];
+    for (const part of message.content) {
+      if (part.type === "text") {
+        content.push({ type: "input_text", text: part.text });
+      } else if (part.type === "image") {
+        const url = part.source.type === "base64" ? `data:${part.source.media_type};base64,${part.source.data}` : part.source.url;
+        content.push({ type: "input_image", image_url: url });
+      } else if (part.type === "tool_result") {
+        items.push({
+          type: "function_call_output",
+          call_id: part.toolUseId,
+          output: toStringToolResultContent(part.content, "openai-responses")
+        });
+      }
+    }
+    if (content.length > 0) items.push({ role: "user", content });
+    return items;
+  }
+  if (message.role === "assistant") {
+    const content = [];
+    for (const part of message.content) {
+      if (part.type === "text") {
+        content.push({ type: "output_text", text: part.text });
+      } else if (part.type === "tool_use") {
+        items.push({
+          type: "function_call",
+          call_id: part.id,
+          name: part.name,
+          arguments: JSON.stringify(part.input)
+        });
+      }
+    }
+    if (content.length > 0) items.push({ role: "assistant", content });
+    return items;
+  }
+  const text = message.content.filter((p) => p.type === "text").map((p) => p.text).join("\n");
+  if (text.length > 0) items.push({ role: "system", content: text });
+  return items;
+}
+function buildResponsesBody(request) {
+  const input = [];
+  for (const message of request.messages) {
+    for (const item of messageToInputItems(message)) input.push(item);
+  }
+  const slash = request.model.lastIndexOf("/");
+  const model = slash >= 0 ? request.model.slice(slash + 1) : request.model;
+  const body = { model, input, stream: true, store: false };
+  const instructions = collapseSystemText(request.system);
+  if (instructions.length > 0) body.instructions = instructions;
+  if (request.maxTokens !== void 0) body.max_output_tokens = request.maxTokens;
+  if (request.temperature !== void 0) body.temperature = request.temperature;
+  const tools = (request.tools ?? []).map((tool) => ({
+    type: "function",
+    name: tool.name,
+    description: tool.description,
+    parameters: tool.inputSchema,
+    strict: false
+  }));
+  if (tools.length > 0) body.tools = tools;
+  if (request.reasoning !== void 0) body.reasoning = { effort: request.reasoning.effort };
+  return body;
+}
+var ResponsesApiClient = class {
+  constructor(options) {
+    this.options = options;
+    this.name = options.providerName ?? "openai-responses";
+    this.baseUrl = (options.baseUrl ?? "https://api.openai.com/v1").replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name;
+  baseUrl;
+  fetchImpl;
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: the SSE dispatch (text / reasoning / tool-call add+delta+done / terminal+usage / error) is one cohesive state machine, mirroring OpenAIStreamAccumulator.consume.
+  async *stream(request, signal) {
+    const providerId = this.options.providerName ?? "openai";
+    const headers = {
+      "content-type": "application/json",
+      accept: "text/event-stream",
+      authorization: `Bearer ${this.options.apiKey}`,
+      ...this.options.extraHeaders ?? {}
+    };
+    const url = `${this.baseUrl}/responses`;
+    const response = await this.fetchImpl(url, {
+      method: "POST",
+      signal,
+      headers,
+      body: JSON.stringify(buildResponsesBody(request))
+    });
+    if (!response.ok) {
+      const text2 = await response.text().catch(() => "");
+      let body = text2;
+      try {
+        body = JSON.parse(text2);
+      } catch {
+      }
+      throw mapOpenAICompatibleError({
+        providerId,
+        status: response.status,
+        body,
+        headers: response.headers,
+        endpoint: "/responses"
+      });
+    }
+    let text = "";
+    const toolCalls = [];
+    let stopReason = "end_turn";
+    let inputTokens;
+    let outputTokens;
+    let reasoningTokens;
+    const pending = {};
+    if (response.body !== null) {
+      for await (const record of parseSseStream(response.body, signal)) {
+        if (record.data === "[DONE]") break;
+        let event;
+        try {
+          event = JSON.parse(record.data);
+        } catch {
+          continue;
+        }
+        const t = event.type;
+        if (t === "response.output_text.delta") {
+          const d = event.delta ?? "";
+          if (d.length > 0) {
+            text += d;
+            yield { type: "text_delta", text: d };
+          }
+        } else if (t === "response.reasoning_summary_text.delta" || t === "response.reasoning_text.delta") {
+          const d = event.delta ?? "";
+          if (d.length > 0) yield { type: "reasoning_delta", text: d };
+        } else if (t === "response.output_item.added" && event.item?.type === "function_call") {
+          const id = event.item.id ?? event.item.call_id ?? "call-0";
+          pending[id] = {
+            callId: event.item.call_id ?? id,
+            name: event.item.name ?? "",
+            args: event.item.arguments ?? ""
+          };
+        } else if (t === "response.function_call_arguments.delta") {
+          const c = event.item_id !== void 0 ? pending[event.item_id] : void 0;
+          if (c !== void 0) c.args += event.delta ?? "";
+        } else if (t === "response.output_item.done" && event.item?.type === "function_call") {
+          const id = event.item.id ?? event.item.call_id ?? "call-0";
+          const c = pending[id] ?? {
+            callId: event.item.call_id ?? id,
+            name: event.item.name ?? "",
+            args: event.item.arguments ?? ""
+          };
+          const rawArgs = event.item.arguments ?? c.args;
+          const call = {
+            type: "tool_use",
+            id: c.callId,
+            name: c.name.length > 0 ? c.name : event.item.name ?? "",
+            input: parseToolArguments(rawArgs)
+          };
+          toolCalls.push(call);
+          delete pending[id];
+          yield { type: "tool_use", id: call.id, name: call.name, input: call.input };
+        } else if (t === "response.completed" || t === "response.incomplete") {
+          const usage = event.response?.usage;
+          if (usage !== void 0) {
+            inputTokens = usage.input_tokens;
+            outputTokens = usage.output_tokens;
+            reasoningTokens = usage.output_tokens_details?.reasoning_tokens;
+          }
+          stopReason = t === "response.incomplete" ? "max_tokens" : "end_turn";
+        } else if (t === "response.failed" || t === "error") {
+          const msg = event.response?.error?.message ?? event.message ?? "responses stream failed";
+          yield { type: "error", message: msg };
+          throw mapOpenAICompatibleError({
+            providerId,
+            status: 502,
+            body: { error: { message: msg } },
+            headers: response.headers,
+            endpoint: "/responses"
+          });
+        }
+      }
+    }
+    if (toolCalls.length > 0 && stopReason === "end_turn") stopReason = "tool_use";
+    yield { type: "stop", reason: stopReason };
+    return makeLlmFinish({
+      stopReason,
+      text,
+      toolCalls,
+      inputTokens,
+      outputTokens,
+      reasoningTokens
+    });
+  }
+};
+
+// src/internal/error-mappers/vertex.ts
+var VERTEX_RULES = [
+  { test: (s, e) => s === 429 || e === "RESOURCE_EXHAUSTED", code: "rate_limit" },
+  { test: (s, e) => s === 401 || e === "UNAUTHENTICATED", code: "auth_unauthenticated" },
+  { test: (s, e) => s === 403 || e === "PERMISSION_DENIED", code: "auth_permission" },
+  {
+    test: (s, e) => s === 400 || e === "INVALID_ARGUMENT" || e === "FAILED_PRECONDITION" || e === "NOT_FOUND",
+    code: "invalid_request"
+  },
+  { test: (s, e) => s === 408 || e === "DEADLINE_EXCEEDED", code: "timeout" },
+  { test: (s) => s >= 500, code: "server_error" }
+];
+function classifyVertexError(args, errStatus) {
+  for (const rule of VERTEX_RULES) {
+    if (rule.test(args.status, errStatus)) return rule.code;
+  }
+  return "unknown";
+}
+function vertexMetadata(args, code) {
+  return buildErrorMetadata({
+    provider: "vertex",
+    endpoint: args.endpoint,
+    code,
+    status: args.status,
+    headers: args.headers,
+    body: args.body
+  });
+}
+var VERTEX_ERROR_BUILDERS = {
+  rate_limit: (args, msg) => new RateLimitError(`Vertex quota exhausted: ${msg}`, {
+    metadata: vertexMetadata(args, "rate_limit")
+  }),
+  auth_unauthenticated: (args, msg) => new AuthenticationError(`Vertex unauthenticated: ${msg}`, {
+    metadata: vertexMetadata(args, "auth_failed")
+  }),
+  auth_permission: (args, msg) => new AuthenticationError(`Vertex permission denied: ${msg}`, {
+    metadata: vertexMetadata(args, "auth_failed")
+  }),
+  invalid_request: (args, msg) => new ConfigurationError(`Vertex validation: ${msg}`, {
+    metadata: vertexMetadata(args, "invalid_request")
+  }),
+  timeout: (args, msg) => new NetworkError(`Vertex timeout: ${msg}`, { metadata: vertexMetadata(args, "timeout") }),
+  server_error: (args, msg) => new NetworkError(`Vertex server error: ${msg}`, {
+    metadata: vertexMetadata(args, "server_error")
+  }),
+  unknown: (args, msg) => new UnknownAgentError(`Vertex unknown: ${msg}`, { metadata: vertexMetadata(args, "unknown") })
+};
+function mapVertexError(args) {
+  const parsed = parseBody2(args.body);
+  const errStatus = parsed.error?.status ?? "";
+  const message = parsed.error?.message ?? "Vertex request failed";
+  const code = classifyVertexError(args, errStatus);
+  return VERTEX_ERROR_BUILDERS[code](args, message);
+}
+function parseBody2(body) {
+  if (body !== null && typeof body === "object") return body;
+  if (typeof body === "string") {
+    try {
+      return JSON.parse(body);
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+var cachedAuthClient;
+var SCOPE_CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";
+async function resolveVertexAccessToken() {
+  if (cachedAuthClient === void 0) {
+    cachedAuthClient = await getAuthClientOrThrow();
+  }
+  try {
+    const result = await cachedAuthClient.getAccessToken();
+    return result.token ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function getAuthClientOrThrow() {
+  let mod;
+  try {
+    const r = createRequire(import.meta.url);
+    mod = r("google-auth-library");
+  } catch (err) {
+    const isModuleMissing = err instanceof Error && (err.message.includes("Cannot find module") || err.code === "MODULE_NOT_FOUND");
+    if (isModuleMissing) {
+      throw new ConfigurationError(
+        "Vertex provider requires `google-auth-library`. Install: `pnpm add google-auth-library`.",
+        { code: "auth_failed", cause: err }
+      );
+    }
+    throw err;
+  }
+  try {
+    const auth = new mod.GoogleAuth({ scopes: [SCOPE_CLOUD_PLATFORM] });
+    return await auth.getClient();
+  } catch (err) {
+    process.stderr.write(
+      `[theokit-sdk] Vertex ADC initialization failed: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return { getAccessToken: async () => ({ token: null }) };
+  }
+}
+function resolveVertexProjectId() {
+  return process.env.GOOGLE_CLOUD_PROJECT ?? process.env.GOOGLE_CLOUD_PROJECT_ID ?? process.env.GCLOUD_PROJECT;
+}
+function resolveVertexLocation() {
+  return process.env.GOOGLE_CLOUD_LOCATION ?? process.env.CLOUD_ML_REGION ?? "us-central1";
+}
+
+// src/internal/llm/vertex-anthropic.ts
+var VertexAnthropicClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  options;
+  name = "vertex_anthropic";
+  fetchImpl;
+  resolveProjectOrThrow() {
+    const projectId = this.options.projectId ?? resolveVertexProjectId();
+    if (projectId !== void 0) return projectId;
+    throw new ConfigurationError(
+      "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
+      { code: "auth_failed" }
+    );
+  }
+  async resolveTokenOrThrow() {
+    const fromOpts = this.options.apiKey;
+    if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
+    const fromAdc = await resolveVertexAccessToken();
+    if (fromAdc !== void 0 && fromAdc.length > 0) return fromAdc;
+    throw new ConfigurationError(
+      "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
+      { code: "auth_failed" }
+    );
+  }
+  async *stream(request, signal) {
+    const projectId = this.resolveProjectOrThrow();
+    const location = this.options.location ?? resolveVertexLocation();
+    const accessToken = await this.resolveTokenOrThrow();
+    const baseUrl = resolveVertexBaseUrl({ projectId, location, modelDialect: "anthropic" });
+    const bareModel = stripVertexPrefix(request.model);
+    const endpoint = `/models/${encodeURIComponent(bareModel)}:rawPredict`;
+    const url = `${baseUrl}${endpoint}`;
+    const response = await postAnthropicRequest({
+      fetchImpl: this.fetchImpl,
+      url,
+      token: accessToken,
+      body: buildVertexAnthropicBody(request),
+      signal
+    });
+    const consumed = await handleAnthropicResponse({
+      response,
+      endpoint,
+      errorMapper: mapVertexError
+    });
+    if (consumed.text.length > 0) yield { type: "text_delta", text: consumed.text };
+    return makeLlmFinish(consumed);
+  }
+};
+function buildVertexAnthropicBody(request) {
+  return {
+    anthropic_version: "vertex-2023-10-16",
+    ...buildAnthropicCommonBody(request)
+  };
+}
+
+// src/internal/llm/vertex-gemini.ts
+var VertexGeminiClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  name = "vertex_gemini";
+  async *stream(request, signal) {
+    const projectId = this.options.projectId ?? resolveVertexProjectId();
+    if (projectId === void 0) {
+      throw new ConfigurationError(
+        "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
+        { code: "auth_failed" }
+      );
+    }
+    const location = this.options.location ?? resolveVertexLocation();
+    const accessToken = this.options.apiKey !== void 0 && this.options.apiKey.length > 0 ? this.options.apiKey : await resolveVertexAccessToken();
+    if (accessToken === void 0 || accessToken.length === 0) {
+      throw new ConfigurationError(
+        "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
+        { code: "auth_failed" }
+      );
+    }
+    const baseUrl = resolveVertexBaseUrl({ projectId, location, modelDialect: "gemini" });
+    const url = `${baseUrl}/chat/completions`;
+    const innerFetch = this.options.fetch ?? fetch;
+    const rewriteFetch = (input, init) => {
+      const requested = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      const targetUrl = requested.endsWith("/v1/chat/completions") ? url : requested;
+      return innerFetch(targetUrl, init);
+    };
+    const inner = new OpenAIClient({
+      apiKey: accessToken,
+      baseUrl: "https://_vertex_placeholder",
+      providerName: "vertex",
+      fetch: rewriteFetch
+    });
+    return yield* inner.stream(request, signal);
+  }
+};
+
+// src/internal/llm/vertex-router.ts
+var VertexRouterClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  name = "vertex";
+  async *stream(request, signal) {
+    const dialect = inferModelDialect(request.model);
+    if (dialect === "anthropic") {
+      const inner2 = new VertexAnthropicClient(this.options);
+      return yield* inner2.stream(request, signal);
+    }
+    const inner = new VertexGeminiClient(this.options);
+    return yield* inner.stream(request, signal);
+  }
+};
+
+// src/internal/llm/router.ts
+function resolveProviderChain(options) {
+  registerBuiltins();
+  return buildChain(options);
+}
+function buildChain(options) {
+  warnUnknownProvidersInApiKeys(options.apiKeys);
+  const seen = /* @__PURE__ */ new Set();
+  const clients = [];
+  const addClient = (name) => {
+    const lowered = name.toLowerCase();
+    if (seen.has(lowered)) return;
+    seen.add(lowered);
+    const client = buildClient(lowered, options);
+    if (client !== void 0) clients.push(maybeWrapWithFaultInjection(client));
+  };
+  addClient(options.primary);
+  for (const fallback of options.fallback ?? []) addClient(fallback);
+  if (clients.length === 0) {
+    throw new ConfigurationError(
+      `No provider client could be resolved (primary=${options.primary}). Set ANTHROPIC_API_KEY or OPENAI_API_KEY / OPENROUTER_API_KEY.`,
+      { code: "provider_unresolved" }
+    );
+  }
+  return clients;
+}
+function buildClient(name, routerOptions) {
+  const baseProfile = getProviderProfile(name);
+  if (baseProfile === void 0) return void 0;
+  const profile = routerOptions.extractToolCallsFromContent === true && baseProfile.extractToolCallsFromContent !== true ? { ...baseProfile, extractToolCallsFromContent: true } : baseProfile;
+  const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
+  const ambient = currentCredentialPool(name);
+  if (ambient !== void 0) {
+    return new PoolAwareLlmClient(
+      ambient,
+      (apiKey) => selectTransport(profile, apiKey),
+      void 0,
+      resilience
+    );
+  }
+  const poolKeys = filterPoolKeys(routerOptions.apiKeys?.[name]);
+  const noAuthOverride = maybeBuildNoAuthTransport(profile, poolKeys);
+  if (noAuthOverride !== void 0) return noAuthOverride;
+  return buildPoolOrSingle({ name, profile, poolKeys, routerOptions });
+}
+function maybeBuildNoAuthTransport(profile, poolKeys) {
+  if (profile.authType !== "none" || poolKeys === void 0 || poolKeys.length === 0) {
+    return void 0;
+  }
+  warnNoAuthApiKeysIgnoredOnce(profile.name);
+  const sentinel = sentinelForNoAuth(profile);
+  if (sentinel === void 0) return void 0;
+  return selectTransport(profile, sentinel);
+}
+function buildPoolOrSingle(args) {
+  const { name, profile, poolKeys, routerOptions } = args;
+  if (poolKeys !== void 0 && poolKeys.length >= 2) {
+    const strategy = routerOptions.credentialPoolStrategy?.[name] ?? "fill_first";
+    const entries = poolKeys.map(
+      (accessToken, priority) => newPooledCredential({ provider: name, accessToken, priority, source: "manual" })
+    );
+    const pool = new CredentialPool(name, entries, strategy);
+    const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
+    return new PoolAwareLlmClient(
+      pool,
+      (apiKey2) => selectTransport(profile, apiKey2),
+      void 0,
+      resilience
+    );
+  }
+  const apiKey = poolKeys?.[0] ?? resolveApiKey(profile.envVars) ?? sentinelForNoAuth(profile) ?? sentinelForLazyAuth(profile);
+  if (apiKey === void 0) return void 0;
+  return selectTransport(profile, apiKey);
+}
+function resolveBaseUrlEnvOverride(providerName) {
+  switch (providerName) {
+    case "openai":
+      return process.env.OPENAI_API_BASE_URL;
+    case "openrouter":
+      return process.env.OPENROUTER_API_BASE_URL;
+    case "ollama":
+      return process.env.OLLAMA_HOST;
+    case "lmstudio":
+      return process.env.LMSTUDIO_HOST;
+    case "llamacpp":
+      return process.env.LLAMACPP_HOST;
+    default:
+      return void 0;
+  }
+}
+var warnedNoAuthApiKeys = /* @__PURE__ */ new Set();
+function warnNoAuthApiKeysIgnoredOnce(provider) {
+  if (warnedNoAuthApiKeys.has(provider)) return;
+  warnedNoAuthApiKeys.add(provider);
+  process.stderr.write(
+    `[theokit-sdk] provider "${provider}" has authType: "none" \u2014 apiKeys ignored (no auth required for local runtime).
+`
+  );
+}
+function sentinelForNoAuth(profile) {
+  return profile.authType === "none" ? profile.name : void 0;
+}
+function sentinelForLazyAuth(profile) {
+  if (profile.authType === "aws_bearer") return "__bedrock_lazy_token__";
+  if (profile.authType === "gcp_oauth") return "__vertex_lazy_token__";
+  if (profile.authType === "oauth_device_code" || profile.authType === "oauth_external") {
+    return "__oauth_lazy_token__";
+  }
+  return void 0;
+}
+function filterPoolKeys(keys) {
+  if (keys === void 0) return void 0;
+  const cleaned = keys.filter((k) => typeof k === "string" && k.length > 0);
+  return cleaned.length === 0 ? void 0 : cleaned;
+}
+var warnedProviders = /* @__PURE__ */ new Set();
+function warnUnknownProvidersInApiKeys(apiKeys) {
+  if (apiKeys === void 0) return;
+  for (const name of Object.keys(apiKeys)) {
+    if (warnedProviders.has(name)) continue;
+    const profile = getProviderProfile(name);
+    if (profile === void 0) {
+      warnedProviders.add(name);
+      process.stderr.write(
+        `[theokit-sdk] credential-pool: unknown provider "${name}" in apiKeys (no profile registered)
+`
+      );
+    }
+  }
+}
+function resolveApiKey(envVars) {
+  for (const v of envVars) {
+    const value = process.env[v];
+    if (value !== void 0 && value.length > 0) return value;
+  }
+  return void 0;
+}
+function selectTransport(profile, apiKey) {
+  const applyTransform = () => {
+    if (profile.transform === void 0) return {};
+    const ctx = { apiKey };
+    return { fetch: profile.transform.fetch?.(ctx), headers: profile.transform.headers?.(ctx) };
+  };
+  const comTransform = (opts, criar) => {
+    const t = applyTransform();
+    assertOAuthResolved(t);
+    if (t.fetch !== void 0) opts.fetch = t.fetch;
+    const merged = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
+    if (merged !== void 0) opts.extraHeaders = merged;
+    return criar(opts);
+  };
+  const assertOAuthResolved = (t) => {
+    if (apiKey !== "__oauth_lazy_token__") return;
+    const auth = t.headers?.authorization ?? t.headers?.Authorization;
+    if (t.fetch === void 0 && auth === void 0) {
+      throw new ConfigurationError(
+        `provider "${profile.name}" uses OAuth (authType: ${profile.authType}) but no credential was resolved. Register a ProviderProfile.transform whose fetch (or headers.authorization) supplies the bearer \u2014 typically via resolveCredential() from "@theokit/sdk/auth".`
+      );
+    }
+  };
+  if (profile.apiMode === "chat_completions") {
+    if (profile.name === "ollama") {
+      const ollamaBase = process.env.OLLAMA_HOST ?? profile.baseUrl;
+      return new OllamaNativeClient({ apiKey, baseUrl: ollamaBase });
+    }
+    const opts = { apiKey };
+    opts.baseUrl = profile.baseUrl;
+    opts.providerName = profile.name;
+    if (profile.extractToolCallsFromContent === true) {
+      opts.extractToolCallsFromContent = true;
+    }
+    if (profile.chatCompletionsPath !== void 0) {
+      opts.chatCompletionsPath = profile.chatCompletionsPath;
+    }
+    if (profile.name === "openai" && process.env.OPENAI_ORGANIZATION !== void 0) {
+      opts.organization = process.env.OPENAI_ORGANIZATION;
+    }
+    const envOverride = resolveBaseUrlEnvOverride(profile.name);
+    if (envOverride !== void 0) opts.baseUrl = envOverride;
+    return comTransform(opts, (o) => new OpenAIClient(o));
+  }
+  if (profile.apiMode === "anthropic_messages") {
+    if (profile.name === "vertex") {
+      const realKey = apiKey === "__vertex_lazy_token__" ? void 0 : apiKey;
+      return new VertexRouterClient(realKey !== void 0 ? { apiKey: realKey } : {});
+    }
+    const opts = { apiKey };
+    opts.baseUrl = process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
+    return comTransform(opts, (o) => new AnthropicClient(o));
+  }
+  if (profile.apiMode === "bedrock_anthropic") {
+    const realKey = apiKey === "__bedrock_lazy_token__" ? void 0 : apiKey;
+    return new BedrockAnthropicClient(realKey !== void 0 ? { apiKey: realKey } : {});
+  }
+  if (profile.apiMode === "responses_api") {
+    const t = applyTransform();
+    assertOAuthResolved(t);
+    const mergedHeaders = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
+    return new ResponsesApiClient({
+      apiKey,
+      ...profile.baseUrl !== void 0 ? { baseUrl: profile.baseUrl } : {},
+      ...mergedHeaders !== void 0 ? { extraHeaders: mergedHeaders } : {},
+      ...t.fetch !== void 0 ? { fetch: t.fetch } : {},
+      providerName: profile.name
+    });
+  }
+  throw new ConfigurationError(
+    `Provider "${profile.name}" requires apiMode "${profile.apiMode}" but no transport is registered. Install a third-party transport plugin (@theokit-transport-${profile.apiMode}) or use a provider with apiMode "chat_completions" or "anthropic_messages".`,
+    { code: "transport_unavailable" }
+  );
+}
+
+// src/internal/local-agent/real-local-run-provider.ts
+function inferProviderFromApiKey(apiKey) {
+  if (apiKey === void 0 || apiKey.length === 0) return void 0;
+  const byPrefix = [
+    { provider: "openrouter", prefix: "sk-or-" },
+    { provider: "anthropic", prefix: "sk-ant-" },
+    { provider: "openai", prefix: "sk-" }
+  ];
+  for (const { provider, prefix } of byPrefix) {
+    if (apiKey.startsWith(prefix) && getProviderProfile(provider) !== void 0) {
+      return provider;
+    }
+  }
+  return void 0;
+}
+function detectPrimaryProvider() {
+  if (process.env.ANTHROPIC_API_KEY !== void 0 && process.env.ANTHROPIC_API_KEY.length > 0) {
+    return "anthropic";
+  }
+  if (process.env.OPENAI_API_KEY !== void 0 && process.env.OPENAI_API_KEY.length > 0) {
+    return "openai";
+  }
+  if (process.env.OPENROUTER_API_KEY !== void 0 && process.env.OPENROUTER_API_KEY.length > 0) {
+    return "openrouter";
+  }
+  return "openai";
+}
+
+// src/internal/runtime/compression/compression-model-registry.ts
+var EXACT_REGISTRY = /* @__PURE__ */ new Map([
+  // OpenAI family
+  ["openai/gpt-4o", "openai/gpt-4o-mini"],
+  ["openai/gpt-4-turbo", "openai/gpt-4o-mini"],
+  ["openai/gpt-4", "openai/gpt-4o-mini"],
+  ["openai/o1-preview", "openai/gpt-4o-mini"],
+  ["openai/o1", "openai/gpt-4o-mini"],
+  ["openai/o3", "openai/gpt-4o-mini"],
+  ["openai/o3-mini", "openai/gpt-4o-mini"],
+  // Anthropic family
+  ["anthropic/claude-opus-4", "anthropic/claude-3-5-haiku-latest"],
+  ["anthropic/claude-sonnet-4", "anthropic/claude-3-5-haiku-latest"],
+  ["anthropic/claude-3-5-sonnet", "anthropic/claude-3-5-haiku-latest"],
+  ["anthropic/claude-3-5-sonnet-latest", "anthropic/claude-3-5-haiku-latest"],
+  ["anthropic/claude-3-opus", "anthropic/claude-3-haiku"],
+  ["anthropic/claude-3-sonnet", "anthropic/claude-3-haiku"],
+  // Vertex (Gemini + Anthropic-on-Vertex)
+  ["vertex/gemini-1.5-pro", "vertex/gemini-1.5-flash"],
+  ["vertex/gemini-2.0-pro", "vertex/gemini-1.5-flash"],
+  ["vertex/claude-3-5-sonnet", "vertex/claude-3-5-haiku"],
+  ["vertex/claude-3-opus", "vertex/claude-3-haiku"],
+  // OpenRouter (preserve openrouter prefix, swap tier within same vendor)
+  ["openrouter/openai/gpt-4o", "openrouter/openai/gpt-4o-mini"],
+  ["openrouter/openai/gpt-4-turbo", "openrouter/openai/gpt-4o-mini"],
+  ["openrouter/anthropic/claude-3-5-sonnet", "openrouter/anthropic/claude-3-5-haiku"],
+  ["openrouter/anthropic/claude-opus-4", "openrouter/anthropic/claude-3-5-haiku"]
+]);
+var WILDCARD_REGISTRY = [
+  // Bedrock Anthropic: us.anthropic.claude-sonnet-* → us.anthropic.claude-3-haiku-*
+  ["bedrock/anthropic.claude-sonnet*", "bedrock/anthropic.claude-3-haiku*"],
+  ["bedrock/anthropic.claude-opus*", "bedrock/anthropic.claude-3-haiku*"],
+  ["bedrock/anthropic.claude-3-5-sonnet*", "bedrock/anthropic.claude-3-5-haiku*"]
+];
+var NO_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["ollama", "lmstudio", "llamacpp"]);
+var CompressionModelUnresolvedError = class extends Error {
+  name = "CompressionModelUnresolvedError";
+  agentModel;
+  constructor(agentModel) {
+    super(
+      `Could not resolve a same-family-cheaper-tier compression model for "${agentModel}". Provide Agent.create({compression: {model: "<your-cheaper-model>"}}) OR add "${agentModel}" to the compression-model-registry (see ADR D440).`
+    );
+    this.agentModel = agentModel;
+  }
+};
+function resolveCompressionModel(agentModel) {
+  const exact = EXACT_REGISTRY.get(agentModel);
+  if (exact !== void 0) return exact;
+  const wildcard = matchWildcard(agentModel);
+  if (wildcard !== null) return wildcard;
+  if (isNoAuthProvider(agentModel)) return agentModel;
+  throw new CompressionModelUnresolvedError(agentModel);
+}
+function matchWildcard(agentModel) {
+  for (const [pattern, replacement] of WILDCARD_REGISTRY) {
+    const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
+    if (!agentModel.startsWith(prefix)) continue;
+    const suffix = agentModel.slice(prefix.length);
+    const replPrefix = replacement.endsWith("*") ? replacement.slice(0, -1) : replacement;
+    return `${replPrefix}${suffix}`;
+  }
+  return null;
+}
+function isNoAuthProvider(agentModel) {
+  const slashIdx = agentModel.indexOf("/");
+  if (slashIdx <= 0) return false;
+  return NO_AUTH_PROVIDERS.has(agentModel.slice(0, slashIdx));
+}
+
+// src/internal/runtime/compression/compression-summarizer.ts
+var CompressionFailedError = class extends Error {
+  name = "CompressionFailedError";
+};
+function buildCompressionPrompt(messages) {
+  const formatted = messages.map((m) => `[${m.role}]: ${m.content}`).join("\n\n");
+  return `Summarize the following ${messages.length} conversation messages into a concise summary that preserves ALL facts, decisions, user preferences, and context needed for the conversation to continue naturally. The summary will replace these messages in the context window. Be thorough but concise.
+
+--- CONVERSATION TO SUMMARIZE ---
+${formatted}
+--- END ---`;
+}
+var COMPRESSION_SYSTEM = "You are a conversation summarizer. Produce a concise factual summary. Preserve all decisions, preferences, code snippets, and action items. Do not add commentary or opinions. Output ONLY the summary text.";
+async function compressConversationWindow(opts) {
+  const userPrompt = buildCompressionPrompt(opts.messages);
+  let summary;
+  try {
+    summary = await opts.callLlm(opts.model, COMPRESSION_SYSTEM, userPrompt);
+  } catch (cause) {
+    throw new CompressionFailedError(
+      `Compression LLM call failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+      { cause: cause instanceof Error ? cause : void 0 }
+    );
+  }
+  if (!summary || summary.trim().length === 0) {
+    throw new CompressionFailedError(
+      "Compression LLM returned empty summary \u2014 reduction ineffective."
+    );
+  }
+  return {
+    role: "system",
+    content: `[Compressed conversation summary]: ${summary.trim()}`
+  };
+}
+
+// src/internal/session/compact-session.ts
+var COMPACT_SUMMARY_MARKER = "[[theokit:compact-summary]]";
+var COMPACT_USER_MESSAGE_MAX_TOKENS = 2e4;
+function isCompactSummary(content) {
+  return content.startsWith(COMPACT_SUMMARY_MARKER) || content.startsWith("[[theokit:goal-continuation]]");
+}
+function plainText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return void 0;
+  const texts = content.filter(
+    (p) => p !== null && typeof p === "object" && p.type === "text" && typeof p.text === "string"
+  ).map((p) => p.text);
+  return texts.length > 0 ? texts.join("\n") : void 0;
+}
+async function compactSessionTranscript(opts) {
+  const prior = await opts.store.readRecords(opts.loc.agentId);
+  const history = reconstructMessages(prior);
+  const compressible = [];
+  for (const m of history) {
+    const text = plainText(m.content);
+    if (text !== void 0 && (m.role === "user" || m.role === "assistant" || m.role === "system")) {
+      compressible.push({ role: m.role, content: text });
+    }
+  }
+  const preTokens = estimateTokens(compressible.map((m) => m.content).join("\n"));
+  const summaryBody = await opts.summarize(compressible);
+  const preserved = [];
+  let budget = 0;
+  for (let i = compressible.length - 1; i >= 0; i--) {
+    const m = compressible[i];
+    if (m === void 0 || m.role !== "user" || isCompactSummary(m.content)) continue;
+    const cost = estimateTokens(m.content);
+    if (budget + cost > COMPACT_USER_MESSAGE_MAX_TOKENS) {
+      const remaining = COMPACT_USER_MESSAGE_MAX_TOKENS - budget;
+      if (remaining > 50) {
+        preserved.unshift(`${m.content.slice(0, remaining * 4)}
+[...truncated for compaction...]`);
+      }
+      break;
+    }
+    budget += cost;
+    preserved.unshift(m.content);
+  }
+  const summary = `${COMPACT_SUMMARY_MARKER}
+${summaryBody}`;
+  const transcript = SessionTranscript.fromRecords(prior, {
+    cwd: opts.loc.cwd,
+    sessionId: opts.sessionId,
+    model: opts.loc.model ?? "unknown"
+  });
+  transcript.appendCompactBoundary({ preTokens, trigger: opts.trigger });
+  for (const text of preserved) transcript.appendUserTurn(text);
+  transcript.appendUserTurn(summary);
+  const delta = transcript.records().slice(prior.length);
+  await opts.store.appendRecords(opts.loc.agentId, delta);
+  invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
+  const postTokens = estimateTokens([...preserved, summary].join("\n"));
+  return { preTokens, postTokens };
+}
+function resolveSummarizerRoute(opts) {
+  const provider = opts.keyProvider ?? (opts.prefixHasProfile && opts.modelPrefix !== void 0 ? opts.modelPrefix : opts.envProvider);
+  return { provider, fullSlug: provider !== opts.modelPrefix };
+}
+function buildDefaultSummarizer(opts) {
+  return async (messages) => {
+    registerBuiltins();
+    const modelPrefix = opts.agentModel.includes("/") ? opts.agentModel.slice(0, opts.agentModel.indexOf("/")) : void 0;
+    const prefixProfile = modelPrefix !== void 0 ? getProviderProfile(modelPrefix) : void 0;
+    const prefixUsable = prefixProfile !== void 0 && (prefixProfile.authType !== "api_key" || prefixProfile.envVars.some((v) => (process.env[v] ?? "").length > 0));
+    const route = resolveSummarizerRoute({
+      keyProvider: inferProviderFromApiKey(opts.apiKey),
+      modelPrefix,
+      prefixHasProfile: prefixUsable,
+      envProvider: detectPrimaryProvider()
+    });
+    const provider = route.provider;
+    let model;
+    if (route.fullSlug) {
+      model = opts.agentModel;
+    } else {
+      try {
+        model = resolveCompressionModel(opts.agentModel);
+      } catch {
+        model = opts.agentModel;
+      }
+    }
+    const callLlm = async (m, system, user) => {
+      const chain = resolveProviderChain({
+        primary: provider,
+        ...opts.apiKey !== void 0 ? { apiKeys: { [provider]: [opts.apiKey] } } : {}
+      });
+      const client = chain[0];
+      if (client === void 0) throw new Error(`no LLM client for provider "${provider}"`);
+      const controller = new AbortController();
+      let text = "";
+      const stream = client.stream(
+        { model: m, system, messages: [{ role: "user", content: [{ type: "text", text: user }] }] },
+        controller.signal
+      );
+      for (; ; ) {
+        const step = await stream.next();
+        if (step.done === true) break;
+        if (step.value.type === "text_delta") text += step.value.text;
+        if (step.value.type === "error") throw new Error(step.value.message);
+      }
+      return text;
+    };
+    const summary = await compressConversationWindow({ messages: [...messages], model, callLlm });
+    return summary.content;
+  };
+}
+function shouldAutoCompact(opts) {
+  if (opts.usageTotal === void 0 || opts.contextWindow === void 0) return false;
+  if (opts.usageTotal <= 0 || opts.contextWindow <= 0) return false;
+  return opts.usageTotal >= Math.floor(opts.contextWindow * 9 / 10);
+}
+var autoCompactAttempts = (() => {
+  const g = globalThis;
+  const sym = /* @__PURE__ */ Symbol.for("theokit-sdk.session.auto-compact-attempts");
+  if (g[sym] === void 0) g[sym] = /* @__PURE__ */ new Map();
+  return g[sym];
+})();
+async function autoCompactIfNeeded(opts) {
+  if (!shouldAutoCompact(opts)) return false;
+  const key = `${opts.loc.cwd}::${opts.loc.agentId}`;
+  if (autoCompactAttempts.get(key) === opts.turnCount) return false;
+  autoCompactAttempts.set(key, opts.turnCount);
+  try {
+    await compactSessionTranscript({
+      store: opts.store,
+      loc: opts.loc,
+      sessionId: opts.sessionId,
+      trigger: "auto",
+      summarize: opts.summarize
+    });
+    return true;
+  } catch (cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    process.stderr.write(
+      `[theokit-sdk] auto-compaction failed (left transcript untouched): ${msg}
+`
+    );
+    return false;
+  }
+}
+
+export { COMPACT_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, CircuitBreaker, autoCompactIfNeeded, buildDefaultSummarizer, compactSessionTranscript, detectPrimaryProvider, discoverProviderPlugins, inferProviderFromApiKey, isCompactSummary, mapOllamaHttpError, mapOllamaTransportError, mapOpenAICompatibleError, parseSseStream, relayStream, renderToolResultContentText, resolveProviderChain, resolveSummarizerRoute, shouldAutoCompact, tryFirstEvent };
+//# sourceMappingURL=chunk-NRSH7RJY.js.map
+//# sourceMappingURL=chunk-NRSH7RJY.js.map