@theokit/sdk 4.53.1 → 4.55.0

package/dist/{chunk-2FYEVT2B.cjs → chunk-HLPSLDGL.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
-var chunk3X6PM7DU_cjs = require('./chunk-3X6PM7DU.cjs');
-var chunk4JBHSLQO_cjs = require('./chunk-4JBHSLQO.cjs');
-var chunkSVO5WPZX_cjs = require('./chunk-SVO5WPZX.cjs');
+var chunkF3YZMOAU_cjs = require('./chunk-F3YZMOAU.cjs');
+var chunk4OTIXDMU_cjs = require('./chunk-4OTIXDMU.cjs');
+var chunkDQKERTND_cjs = require('./chunk-DQKERTND.cjs');
 var chunk6JSIEDKL_cjs = require('./chunk-6JSIEDKL.cjs');
 var chunkFRITRLZQ_cjs = require('./chunk-FRITRLZQ.cjs');
-var chunkY4AXQOT4_cjs = require('./chunk-Y4AXQOT4.cjs');
-var chunkADLLFY3H_cjs = require('./chunk-ADLLFY3H.cjs');
-var chunkVUKQL3L2_cjs = require('./chunk-VUKQL3L2.cjs');
-var chunkLPVIRJVF_cjs = require('./chunk-LPVIRJVF.cjs');
-var chunkBM6N4KHO_cjs = require('./chunk-BM6N4KHO.cjs');
+var chunkJHPGF3FP_cjs = require('./chunk-JHPGF3FP.cjs');
+var chunkXSX2UU6Y_cjs = require('./chunk-XSX2UU6Y.cjs');
+var chunkNIRE5CNO_cjs = require('./chunk-NIRE5CNO.cjs');
+var chunkK3FW2XZD_cjs = require('./chunk-K3FW2XZD.cjs');
+var chunkNUKRL3I6_cjs = require('./chunk-NUKRL3I6.cjs');
 var fs = require('fs');
 var promises = require('fs/promises');
 var os = require('os');
@@ -18,7 +18,7 @@ var url = require('url');
 var module$1 = require('module');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-var discoveryState = chunkVUKQL3L2_cjs.globalSingleton("theokit-sdk.providers.discovered", () => ({
+var discoveryState = chunkNIRE5CNO_cjs.globalSingleton("theokit-sdk.providers.discovered", () => ({
   done: false
 }));
 function pluginsRoot() {
@@ -40,19 +40,19 @@ function loadTrustedNames() {
           else discarded += 1;
         }
         if (discarded > 0) {
-          chunkBM6N4KHO_cjs.diag(
+          chunkNUKRL3I6_cjs.diag(
             `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
 `
           );
         }
       } else {
-        chunkBM6N4KHO_cjs.diag(
+        chunkNUKRL3I6_cjs.diag(
           `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
 `
         );
       }
     } catch {
-      chunkBM6N4KHO_cjs.diag(
+      chunkNUKRL3I6_cjs.diag(
         `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
 `
       );
@@ -78,7 +78,7 @@ async function discoverProviderPlugins() {
   const trusted = loadTrustedNames();
   for (const entry of entries) {
     if (!trusted.has(entry)) {
-      chunkBM6N4KHO_cjs.diag(
+      chunkNUKRL3I6_cjs.diag(
         `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
 `
       );
@@ -97,13 +97,13 @@ async function loadOne(dir, entryName) {
       if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
         const profile = plugin.profile;
         if (profile !== void 0 && typeof profile === "object") {
-          chunkVUKQL3L2_cjs.registerProvider(profile);
+          chunkNIRE5CNO_cjs.registerProvider(profile);
         }
       }
       return;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      chunkBM6N4KHO_cjs.diag(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+      chunkNUKRL3I6_cjs.diag(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
 `);
       return;
     }
@@ -115,7 +115,7 @@ function mapAnthropicError(args) {
   const { status, body, headers, endpoint } = args;
   const code = mapAnthropicStatusToCode(status, body);
   const message = formatMessage(status, code);
-  const metadata = chunkSVO5WPZX_cjs.buildErrorMetadata({
+  const metadata = chunkDQKERTND_cjs.buildErrorMetadata({
     provider: "anthropic",
     endpoint,
     code,
@@ -124,24 +124,24 @@ function mapAnthropicError(args) {
     body
   });
   if (status === 401 || status === 403) {
-    return new chunkLPVIRJVF_cjs.AuthenticationError(message, { code: "anthropic_auth_failed", metadata });
+    return new chunkK3FW2XZD_cjs.AuthenticationError(message, { code: "anthropic_auth_failed", metadata });
   }
   if (status === 429) {
-    return new chunkLPVIRJVF_cjs.RateLimitError(message, { code: "anthropic_rate_limit", metadata });
+    return new chunkK3FW2XZD_cjs.RateLimitError(message, { code: "anthropic_rate_limit", metadata });
   }
   if (status === 400) {
-    return new chunkLPVIRJVF_cjs.ConfigurationError(message, {
+    return new chunkK3FW2XZD_cjs.ConfigurationError(message, {
       code: `anthropic_${code}`,
       metadata
     });
   }
   if (status === 408) {
-    return new chunkLPVIRJVF_cjs.NetworkError(message, { code: "anthropic_timeout", metadata });
+    return new chunkK3FW2XZD_cjs.NetworkError(message, { code: "anthropic_timeout", metadata });
   }
   if (status >= 500 && status < 600) {
-    return new chunkLPVIRJVF_cjs.NetworkError(message, { code: "anthropic_server_error", metadata });
+    return new chunkK3FW2XZD_cjs.NetworkError(message, { code: "anthropic_server_error", metadata });
   }
-  return new chunkLPVIRJVF_cjs.UnknownAgentError(message, { code: "anthropic_unknown", metadata });
+  return new chunkK3FW2XZD_cjs.UnknownAgentError(message, { code: "anthropic_unknown", metadata });
 }
 function mapAnthropicStatusToCode(status, body) {
   if (status === 401 || status === 403) return "auth_failed";
@@ -190,17 +190,34 @@ function mapOpenAIFinish(reason) {
       return "end_turn";
   }
 }
+function asTokenCount(value) {
+  const n = typeof value === "string" ? Number(value) : value;
+  if (typeof n !== "number" || !Number.isFinite(n) || n < 0) return void 0;
+  return Math.floor(n);
+}
+function assign(finish, key, value) {
+  if (value === void 0) return;
+  const count = asTokenCount(value);
+  if (count === void 0) {
+    chunkNUKRL3I6_cjs.diag(
+      `[theokit-sdk] provider reported an unusable ${key} (${String(value)}) \u2014 dropping it. Usage and cost for this turn will be incomplete.
+`
+    );
+    return;
+  }
+  finish[key] = count;
+}
 function makeLlmFinish(state) {
   const finish = {
     stopReason: state.stopReason,
     text: state.text,
     toolCalls: state.toolCalls
   };
-  if (state.inputTokens !== void 0) finish.inputTokens = state.inputTokens;
-  if (state.outputTokens !== void 0) finish.outputTokens = state.outputTokens;
-  if (state.cacheReadTokens !== void 0) finish.cacheReadTokens = state.cacheReadTokens;
-  if (state.cacheWriteTokens !== void 0) finish.cacheWriteTokens = state.cacheWriteTokens;
-  if (state.reasoningTokens !== void 0) finish.reasoningTokens = state.reasoningTokens;
+  assign(finish, "inputTokens", state.inputTokens);
+  assign(finish, "outputTokens", state.outputTokens);
+  assign(finish, "cacheReadTokens", state.cacheReadTokens);
+  assign(finish, "cacheWriteTokens", state.cacheWriteTokens);
+  assign(finish, "reasoningTokens", state.reasoningTokens);
   if (state.thinking !== void 0) finish.thinking = state.thinking;
   return finish;
 }
@@ -212,7 +229,7 @@ function toBlockToolResultContent(content) {
 function toStringToolResultContent(content, providerName) {
   if (typeof content === "string") return content;
   if (content.some((block) => block.type === "image")) {
-    throw new chunkLPVIRJVF_cjs.ConfigurationError(
+    throw new chunkK3FW2XZD_cjs.ConfigurationError(
       `provider "${providerName}" does not support image content in tool results`
     );
   }
@@ -391,7 +408,7 @@ function readWithIdleTimeout(reader, idleTimeoutMs) {
     (resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new chunkLPVIRJVF_cjs.NetworkError(`SSE stream idle for ${idleTimeoutMs}ms \u2014 upstream stalled`, {
+          new chunkK3FW2XZD_cjs.NetworkError(`SSE stream idle for ${idleTimeoutMs}ms \u2014 upstream stalled`, {
             code: "stream_idle_timeout"
           })
         );
@@ -468,9 +485,9 @@ function ehAbort(err) {
 }
 function wrapTransportError(err, ctx) {
   if (ehAbort(err)) return err;
-  if (err instanceof chunkLPVIRJVF_cjs.NetworkError) return err;
+  if (err instanceof chunkK3FW2XZD_cjs.TheokitAgentError) return err;
   const detail = err instanceof Error ? err.message : String(err);
-  return new chunkLPVIRJVF_cjs.NetworkError(`${ctx.providerId} transport failure on ${ctx.endpoint}: ${detail}`, {
+  return new chunkK3FW2XZD_cjs.NetworkError(`${ctx.providerId} transport failure on ${ctx.endpoint}: ${detail}`, {
     code: "transport_failure",
     cause: err
   });
@@ -534,7 +551,7 @@ var AnthropicClient = class {
       for (const event of events) yield event;
     }
     if (!accumulator.finishReasonSeen) {
-      throw new chunkLPVIRJVF_cjs.NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
+      throw new chunkK3FW2XZD_cjs.NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
         code: "stream_truncated"
       });
     }
@@ -687,7 +704,7 @@ function classifyBedrockError(args, awsType, message) {
   return "unknown";
 }
 function buildBedrockMetadata(args, code) {
-  return chunkSVO5WPZX_cjs.buildErrorMetadata({
+  return chunkDQKERTND_cjs.buildErrorMetadata({
     provider: "bedrock",
     endpoint: args.endpoint,
     code,
@@ -704,19 +721,19 @@ function mapBedrockError(args) {
   const metadata = buildBedrockMetadata(args, code);
   switch (code) {
     case "rate_limit":
-      return new chunkLPVIRJVF_cjs.RateLimitError(`Bedrock throttled: ${message}`, { metadata });
+      return new chunkK3FW2XZD_cjs.RateLimitError(`Bedrock throttled: ${message}`, { metadata });
     case "auth_failed":
-      return new chunkLPVIRJVF_cjs.AuthenticationError(`Bedrock auth: ${message}`, { metadata });
+      return new chunkK3FW2XZD_cjs.AuthenticationError(`Bedrock auth: ${message}`, { metadata });
     case "invalid_request": {
       const friendly = message.includes("use case details") ? `Bedrock account setup required: ${message} (AWS Console \u2192 Bedrock \u2192 Model access \u2192 Anthropic \u2192 Submit use case form, then retry in 15 min.)` : `Bedrock validation: ${message}`;
-      return new chunkLPVIRJVF_cjs.ConfigurationError(friendly, { metadata });
+      return new chunkK3FW2XZD_cjs.ConfigurationError(friendly, { metadata });
     }
     case "timeout":
-      return new chunkLPVIRJVF_cjs.NetworkError(`Bedrock timeout: ${message}`, { metadata });
+      return new chunkK3FW2XZD_cjs.NetworkError(`Bedrock timeout: ${message}`, { metadata });
     case "server_error":
-      return new chunkLPVIRJVF_cjs.NetworkError(`Bedrock server error: ${message}`, { metadata });
+      return new chunkK3FW2XZD_cjs.NetworkError(`Bedrock server error: ${message}`, { metadata });
     default:
-      return new chunkLPVIRJVF_cjs.UnknownAgentError(`Bedrock unknown: ${message}`, { metadata });
+      return new chunkK3FW2XZD_cjs.UnknownAgentError(`Bedrock unknown: ${message}`, { metadata });
   }
 }
 function parseBody(body) {
@@ -740,7 +757,7 @@ async function resolveBedrockToken(region) {
     return cachedToken.value;
   }
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-2FYEVT2B.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-HLPSLDGL.cjs', document.baseURI).href)));
     const gen = r("@aws/bedrock-token-generator");
     if (typeof gen.getToken !== "function") return void 0;
     const providers = r("@aws-sdk/credential-providers");
@@ -768,16 +785,16 @@ var BedrockAnthropicClient = class {
     if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
     const fromEnv = await resolveBedrockToken(region);
     if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
-    throw new chunkLPVIRJVF_cjs.ConfigurationError(
+    throw new chunkK3FW2XZD_cjs.ConfigurationError(
       "Bedrock requires AWS_BEARER_TOKEN_BEDROCK env var, or install `@aws/bedrock-token-generator` for auto-refresh, or pass apiKey explicitly.",
       { code: "auth_failed" }
     );
   }
   async *stream(request, signal) {
-    const region = chunkVUKQL3L2_cjs.inferRegionFromModelId(request.model) ?? process.env.AWS_REGION ?? "us-east-1";
+    const region = chunkNIRE5CNO_cjs.inferRegionFromModelId(request.model) ?? process.env.AWS_REGION ?? "us-east-1";
     const token = await this.resolveTokenOrThrow(region);
-    const bareModel = chunkVUKQL3L2_cjs.stripBedrockPrefix(request.model);
-    const baseUrl = this.options.baseUrl ?? chunkVUKQL3L2_cjs.resolveBedrockBaseUrl(request.model);
+    const bareModel = chunkNIRE5CNO_cjs.stripBedrockPrefix(request.model);
+    const baseUrl = this.options.baseUrl ?? chunkNIRE5CNO_cjs.resolveBedrockBaseUrl(request.model);
     const endpoint = `/model/${encodeURIComponent(bareModel)}/invoke`;
     const url = `${baseUrl}${endpoint}`;
     const response = await postAnthropicRequest({
@@ -832,7 +849,7 @@ var FaultInjectingLlmClient = class {
       return yield* this.inner.stream(request, signal);
     }
     if (parsed.status >= 400) {
-      throw chunkSVO5WPZX_cjs.mapOpenAICompatibleError({
+      throw chunkDQKERTND_cjs.mapOpenAICompatibleError({
         providerId: this.name,
         status: parsed.status,
         body: parsed.body,
@@ -879,7 +896,7 @@ function parseOverrideOrWarnOnce() {
 function warnInvalidJsonOnce(_raw) {
   if (warnedInvalidJson) return;
   warnedInvalidJson = true;
-  chunkBM6N4KHO_cjs.diag(
+  chunkNUKRL3I6_cjs.diag(
     `[theokit-sdk] ${ENV_OVERRIDE_KEY} is set but value is not valid JSON of shape \`{"status": number, "body": object | string}\`. Falling back to real LLM call. This warning is shown once per process.
 `
   );
@@ -907,7 +924,7 @@ function mapOllamaTransportError(args) {
   if (args.providerId !== "ollama") return void 0;
   const causeCode = extractCauseCode(args.cause);
   if (causeCode !== "ECONNREFUSED" && causeCode !== "ENOTFOUND") return void 0;
-  const metadata = chunkSVO5WPZX_cjs.buildErrorMetadata({
+  const metadata = chunkDQKERTND_cjs.buildErrorMetadata({
     provider: "ollama",
     endpoint: args.endpoint,
     code: "network",
@@ -915,7 +932,7 @@ function mapOllamaTransportError(args) {
     headers: void 0,
     body: { cause: causeCode }
   });
-  return new chunkLPVIRJVF_cjs.ConfigurationError(
+  return new chunkK3FW2XZD_cjs.ConfigurationError(
     "Ollama is not reachable. Run `ollama serve` to start the local runtime, or set OLLAMA_HOST to point at a remote Ollama server.",
     { code: "ollama_unreachable", metadata }
   );
@@ -925,7 +942,7 @@ function mapOllamaHttpError(args) {
   const errString = extractErrorString(args.body).toLowerCase();
   if (args.status === 404 && errString.includes("not found") && errString.includes("pull")) {
     const modelHint = extractModelName(errString);
-    const metadata = chunkSVO5WPZX_cjs.buildErrorMetadata({
+    const metadata = chunkDQKERTND_cjs.buildErrorMetadata({
       provider: "ollama",
       endpoint: args.endpoint,
       code: "model_unavailable",
@@ -934,13 +951,13 @@ function mapOllamaHttpError(args) {
       body: args.body
     });
     const pullCmd = modelHint !== void 0 ? `ollama pull ${modelHint}` : "ollama pull <model>";
-    return new chunkLPVIRJVF_cjs.ConfigurationError(
+    return new chunkK3FW2XZD_cjs.ConfigurationError(
       `Ollama model is not pulled. Run \`${pullCmd}\` to download it first.`,
       { code: "ollama_model_not_pulled", metadata }
     );
   }
   if (args.status === 503 && errString.includes("model is loading")) {
-    const metadata = chunkSVO5WPZX_cjs.buildErrorMetadata({
+    const metadata = chunkDQKERTND_cjs.buildErrorMetadata({
       provider: "ollama",
       endpoint: args.endpoint,
       code: "server_error",
@@ -948,7 +965,7 @@ function mapOllamaHttpError(args) {
       headers: args.headers,
       body: args.body
     });
-    return new chunkLPVIRJVF_cjs.NetworkError(
+    return new chunkK3FW2XZD_cjs.NetworkError(
       "Ollama model is loading. Retry in a few seconds \u2014 Ollama is warming up the model into memory.",
       { code: "ollama_model_loading", metadata }
     );
@@ -1169,7 +1186,7 @@ function toOllamaMessages(message) {
   }
   if (message.role === "user") {
     if (message.content.some((p) => p.type === "image")) {
-      throw new chunkLPVIRJVF_cjs.ConfigurationError(
+      throw new chunkK3FW2XZD_cjs.ConfigurationError(
         "image input is not supported on the ollama-native provider; use an OpenAI/OpenRouter model for multimodal turns",
         { code: "ollama_image_unsupported" }
       );
@@ -1230,10 +1247,21 @@ function shouldUseFixtureMode(apiKey) {
   if (getConfiguredBaseUrl() !== void 0) return false;
   return isFixtureApiKey(apiKey);
 }
+var PROVIDER_CREDENTIAL_ENV_VARS = [
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY"
+];
+function presentProviderCredentialEnvVars() {
+  return PROVIDER_CREDENTIAL_ENV_VARS.filter((name) => {
+    const value = process.env[name];
+    return typeof value === "string" && value.length > 0;
+  });
+}
 function shouldUseRealLocalRuntime(apiKey) {
   if (isFixtureApiKey(apiKey)) return false;
   if (apiKey === void 0 || apiKey.length === 0) return false;
-  return typeof process.env.ANTHROPIC_API_KEY === "string" && process.env.ANTHROPIC_API_KEY.length > 0 || typeof process.env.OPENAI_API_KEY === "string" && process.env.OPENAI_API_KEY.length > 0 || typeof process.env.OPENROUTER_API_KEY === "string" && process.env.OPENROUTER_API_KEY.length > 0 || isAwsBedrockAuthAvailable() || isGcpVertexAuthAvailable() || isLocalNoAuthProviderAvailable();
+  return presentProviderCredentialEnvVars().length > 0 || isAwsBedrockAuthAvailable() || isGcpVertexAuthAvailable() || isLocalNoAuthProviderAvailable();
 }
 function isAwsBedrockAuthAvailable() {
   if (typeof process.env.AWS_BEARER_TOKEN_BEDROCK === "string" && process.env.AWS_BEARER_TOKEN_BEDROCK.length > 0) {
@@ -1298,7 +1326,7 @@ async function safeFetch(fetchFn, url, init) {
   try {
     return await fetchFn(url, init);
   } catch (cause) {
-    throw new chunkLPVIRJVF_cjs.NetworkError("HTTP request failed", { code: "network_error", cause });
+    throw new chunkK3FW2XZD_cjs.NetworkError("HTTP request failed", { code: "network_error", cause });
   }
 }
 async function safeParseJsonResponse(response) {
@@ -1325,7 +1353,7 @@ function mapHttpStatusToError(status, body) {
     cause: body
   };
   if (envelope.code === "integration_not_connected") {
-    return new chunkLPVIRJVF_cjs.IntegrationNotConnectedError(message, {
+    return new chunkK3FW2XZD_cjs.IntegrationNotConnectedError(message, {
       provider: envelope.provider ?? "unknown",
       helpUrl: envelope.helpUrl ?? "",
       code: envelope.code,
@@ -1333,18 +1361,18 @@ function mapHttpStatusToError(status, body) {
     });
   }
   if (status === 401 || status === 403) {
-    return new chunkLPVIRJVF_cjs.AuthenticationError(message, errorOptions);
+    return new chunkK3FW2XZD_cjs.AuthenticationError(message, errorOptions);
   }
   if (status === 429) {
-    return new chunkLPVIRJVF_cjs.RateLimitError(message, errorOptions);
+    return new chunkK3FW2XZD_cjs.RateLimitError(message, errorOptions);
   }
   if (status >= 400 && status < 500) {
-    return new chunkLPVIRJVF_cjs.ConfigurationError(message, errorOptions);
+    return new chunkK3FW2XZD_cjs.ConfigurationError(message, errorOptions);
   }
   if (status >= 500) {
-    return new chunkLPVIRJVF_cjs.NetworkError(message, errorOptions);
+    return new chunkK3FW2XZD_cjs.NetworkError(message, errorOptions);
   }
-  return new chunkLPVIRJVF_cjs.UnknownAgentError(message, errorOptions);
+  return new chunkK3FW2XZD_cjs.UnknownAgentError(message, errorOptions);
 }
 function extractErrorEnvelope(body) {
   if (!body || typeof body !== "object") return {};
@@ -1598,7 +1626,7 @@ var OpenAIClient = class {
         endpoint: "/v1/chat/completions"
       });
       if (ollamaMapped !== void 0) throw ollamaMapped;
-      throw chunkSVO5WPZX_cjs.mapOpenAICompatibleError({
+      throw chunkDQKERTND_cjs.mapOpenAICompatibleError({
         providerId,
         status: response.status,
         body,
@@ -1614,7 +1642,14 @@ var OpenAIClient = class {
       new Set(request.tools?.map((tool) => tool.name) ?? [])
     );
     let sawDone = false;
-    for await (const record of parseSseStream(response.body, signal)) {
+    const records = (async function* () {
+      try {
+        yield* parseSseStream(response.body, signal);
+      } catch (readErr) {
+        throw wrapTransportError(readErr, { providerId, endpoint: "/v1/chat/completions" });
+      }
+    })();
+    for await (const record of records) {
       if (record.data === "[DONE]") {
         sawDone = true;
         break;
@@ -1627,7 +1662,7 @@ var OpenAIClient = class {
       }
       if (chunk.error !== void 0 && chunk.error !== null) {
         const status = typeof chunk.error.code === "number" ? chunk.error.code : 502;
-        throw chunkSVO5WPZX_cjs.mapOpenAICompatibleError({
+        throw chunkDQKERTND_cjs.mapOpenAICompatibleError({
           providerId,
           status,
           body: chunk,
@@ -1639,7 +1674,7 @@ var OpenAIClient = class {
       for (const event of events) yield event;
     }
     if (!sawDone && !accumulator.finishReasonSeen) {
-      throw new chunkLPVIRJVF_cjs.NetworkError("SSE stream truncated (no finish_reason / [DONE])", {
+      throw new chunkK3FW2XZD_cjs.NetworkError("SSE stream truncated (no finish_reason / [DONE])", {
         code: "stream_truncated"
       });
     }
@@ -1771,13 +1806,13 @@ var OpenAIStreamAccumulator = class {
         toolCalls.push(...recovered.toolCalls);
         text = recovered.residualText;
         stopReason = "tool_use";
-        chunkBM6N4KHO_cjs.diag(
+        chunkNUKRL3I6_cjs.diag(
           `[theokit-sdk] recovered ${recovered.toolCalls.length} leaked tool call(s) from assistant content (provider="${this.providerName}", names=${recovered.toolCalls.map((c) => c.name).join(",")})
 `
         );
       }
       if (recovered.droppedNames.length > 0) {
-        chunkBM6N4KHO_cjs.diag(
+        chunkNUKRL3I6_cjs.diag(
           `[theokit-sdk] dropped ${recovered.droppedNames.length} leaked block(s) whose name is not a tool in the request (provider="${this.providerName}", names=${recovered.droppedNames.join(",")})
 `
         );
@@ -1899,10 +1934,10 @@ async function tryFirstEvent(client, request, signal, logFallback = false) {
     const firstResult = await generator.next();
     return { kind: "ok", generator, firstResult };
   } catch (cause) {
-    if (cause instanceof chunkLPVIRJVF_cjs.NetworkError || cause instanceof chunkLPVIRJVF_cjs.RateLimitError || cause instanceof chunkLPVIRJVF_cjs.AuthenticationError) {
+    if (cause instanceof chunkK3FW2XZD_cjs.NetworkError || cause instanceof chunkK3FW2XZD_cjs.RateLimitError || cause instanceof chunkK3FW2XZD_cjs.AuthenticationError) {
       if (logFallback) {
         const errCode = cause.metadata?.code ?? cause.code ?? "unknown";
-        chunkBM6N4KHO_cjs.diag(`[theokit-sdk] provider ${client.name} failed (${errCode}): falling back
+        chunkNUKRL3I6_cjs.diag(`[theokit-sdk] provider ${client.name} failed (${errCode}): falling back
 `);
       }
       return { kind: "handshake_error", error: cause };
@@ -1944,7 +1979,7 @@ var PoolAwareLlmClient = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stream() must serialize pool-select → build client → first-event probe → classify → retry/rotate/propagate. Extracting helpers fragments the linear narrative; the comments above each branch keep it readable.
   async *stream(request, signal) {
     if (this.breaker.shouldSkip(this.pool.provider)) {
-      throw new chunkLPVIRJVF_cjs.NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
+      throw new chunkK3FW2XZD_cjs.NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
         code: "circuit_open"
       });
     }
@@ -1963,7 +1998,7 @@ var PoolAwareLlmClient = class {
         }
         if (entry === null) {
           this.breaker.recordTimeout(this.pool.provider);
-          throw new chunkLPVIRJVF_cjs.CredentialPoolExhaustedError(
+          throw new chunkK3FW2XZD_cjs.CredentialPoolExhaustedError(
             `All ${this.pool.provider} credentials exhausted; next retry available at ${this.nextRetryHint() ?? "unknown"}`,
             { provider: this.pool.provider, nextRetryAt: this.nextRetryHint() }
           );
@@ -1977,13 +2012,13 @@ var PoolAwareLlmClient = class {
       }
       const decision = classifyAndDecide(attempt.error, hasRetried429);
       if (decision === "retry") {
-        const backoffMs = chunk3X6PM7DU_cjs.computeBackoffMs({
+        const backoffMs = chunkF3YZMOAU_cjs.computeBackoffMs({
           attempt: 0,
           ...this.backoffBaseMs !== void 0 ? { baseMs: this.backoffBaseMs } : {},
           ...this.rng !== void 0 ? { rng: this.rng } : {}
         });
         this.onRateLimit?.({ attempt: 1, retryAfterMs: backoffMs });
-        await chunk3X6PM7DU_cjs.sleepWithAbort(backoffMs, signal);
+        await chunkF3YZMOAU_cjs.sleepWithAbort(backoffMs, signal);
         hasRetried429 = true;
         continue;
       }
@@ -1995,7 +2030,7 @@ var PoolAwareLlmClient = class {
             ...parseRetryAfterMs(attempt.error) !== void 0 ? { resetAtMs: parseRetryAfterMs(attempt.error) } : {}
           });
         } catch (persistErr) {
-          chunkBM6N4KHO_cjs.diag(
+          chunkNUKRL3I6_cjs.diag(
             `[theokit-sdk] credential-pool: persist failed during rotate; continuing in-memory: ${persistErr instanceof Error ? persistErr.message : String(persistErr)}
 `
           );
@@ -2017,8 +2052,8 @@ var PoolAwareLlmClient = class {
   }
 };
 function classifyAndDecide(error, hasRetried429) {
-  if (error instanceof chunkLPVIRJVF_cjs.NetworkError) return "propagate";
-  if (error instanceof chunkLPVIRJVF_cjs.AuthenticationError) return "rotate";
+  if (error instanceof chunkK3FW2XZD_cjs.NetworkError) return "propagate";
+  if (error instanceof chunkK3FW2XZD_cjs.AuthenticationError) return "rotate";
   const status = error.metadata?.statusCode ?? 429;
   if (status === 402) return "rotate";
   return hasRetried429 ? "rotate" : "retry";
@@ -2031,8 +2066,8 @@ function parseRetryAfterMs(error) {
   return void 0;
 }
 function inferStatusCode(error) {
-  if (error instanceof chunkLPVIRJVF_cjs.AuthenticationError) return 401;
-  if (error instanceof chunkLPVIRJVF_cjs.RateLimitError) return 429;
+  if (error instanceof chunkK3FW2XZD_cjs.AuthenticationError) return 401;
+  if (error instanceof chunkK3FW2XZD_cjs.RateLimitError) return 429;
   return 0;
 }
 function abortError(signal) {
@@ -2041,7 +2076,7 @@ function abortError(signal) {
 }
 
 // src/internal/llm/responses.ts
-function messageToInputItems(message) {
+function messageToInputItems(message, reasoningByCallId) {
   const items = [];
   if (message.role === "user") {
     const content = [];
@@ -2068,6 +2103,14 @@ function messageToInputItems(message) {
       if (part.type === "text") {
         content.push({ type: "output_text", text: part.text });
       } else if (part.type === "tool_use") {
+        for (const reasoning of reasoningByCallId?.get(part.id) ?? []) {
+          items.push({
+            type: "reasoning",
+            id: reasoning.id,
+            encrypted_content: reasoning.encrypted_content,
+            summary: []
+          });
+        }
         items.push({
           type: "function_call",
           call_id: part.id,
@@ -2083,10 +2126,10 @@ function messageToInputItems(message) {
   if (text.length > 0) items.push({ role: "system", content: text });
   return items;
 }
-function buildResponsesBody(request) {
+function buildResponsesBody(request, options = {}) {
   const input = [];
   for (const message of request.messages) {
-    for (const item of messageToInputItems(message)) input.push(item);
+    for (const item of messageToInputItems(message, options.reasoningByCallId)) input.push(item);
   }
   const slash = request.model.lastIndexOf("/");
   const model = slash >= 0 ? request.model.slice(slash + 1) : request.model;
@@ -2103,9 +2146,21 @@ function buildResponsesBody(request) {
     strict: false
   }));
   if (tools.length > 0) body.tools = tools;
-  if (request.reasoning !== void 0) body.reasoning = { effort: request.reasoning.effort };
+  applyPromptCachingFields(body, request, options);
   return body;
 }
+function applyPromptCachingFields(body, request, options) {
+  const carryReasoning = options.encryptedReasoning === true;
+  if (request.reasoning !== void 0) {
+    body.reasoning = {
+      effort: request.reasoning.effort,
+      ...carryReasoning ? { context: "all_turns" } : {}
+    };
+  }
+  if (carryReasoning) body.include = ["reasoning.encrypted_content"];
+  if (request.promptCacheKey !== void 0) body.prompt_cache_key = request.promptCacheKey;
+}
+var MAX_REMEMBERED_REASONING_CALLS = 256;
 var ResponsesApiClient = class {
   constructor(options) {
     this.options = options;
@@ -2117,6 +2172,26 @@ var ResponsesApiClient = class {
   name;
   baseUrl;
   fetchImpl;
+  /**
+   * usetheokit/theokit-sdk#383 — reasoning ciphertext captured from earlier rounds, keyed by the
+   * `call_id` it preceded. Held on the CLIENT rather than threaded through `LlmRequest` because a
+   * round's reasoning is provider-shaped ciphertext with a provider-shaped ordering rule; the agent
+   * loop has no use for it and the same client instance serves every round of a turn. Insertion
+   * order is the eviction order (see {@link MAX_REMEMBERED_REASONING_CALLS}).
+   */
+  reasoningByCallId = /* @__PURE__ */ new Map();
+  /**
+   * usetheokit/theokit-sdk#383 — bind a batch of reasoning ciphertext to the tool call it produced,
+   * evicting the oldest binding once the cap is reached.
+   */
+  rememberReasoning(callId, items) {
+    this.reasoningByCallId.set(callId, [...items]);
+    while (this.reasoningByCallId.size > MAX_REMEMBERED_REASONING_CALLS) {
+      const oldest = this.reasoningByCallId.keys().next();
+      if (oldest.done === true) break;
+      this.reasoningByCallId.delete(oldest.value);
+    }
+  }
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: the SSE dispatch (text / reasoning / tool-call add+delta+done / terminal+usage / error) is one cohesive state machine, mirroring OpenAIStreamAccumulator.consume.
   async *stream(request, signal) {
     const providerId = this.options.providerName ?? "openai";
@@ -2131,7 +2206,15 @@ var ResponsesApiClient = class {
       method: "POST",
       signal,
       headers,
-      body: JSON.stringify(buildResponsesBody(request))
+      body: JSON.stringify(
+        // Both options ride the SAME flag on purpose: a provider that never declared support gets
+        // the byte-identical pre-#383 body, even in the impossible case where it returned ciphertext
+        // nobody asked for.
+        buildResponsesBody(
+          request,
+          this.options.encryptedReasoning === true ? { encryptedReasoning: true, reasoningByCallId: this.reasoningByCallId } : {}
+        )
+      )
     });
     if (!response.ok) {
       const text2 = await response.text().catch(() => "");
@@ -2140,7 +2223,7 @@ var ResponsesApiClient = class {
         body = JSON.parse(text2);
       } catch {
       }
-      throw chunkSVO5WPZX_cjs.mapOpenAICompatibleError({
+      throw chunkDQKERTND_cjs.mapOpenAICompatibleError({
         providerId,
         status: response.status,
         body,
@@ -2154,7 +2237,10 @@ var ResponsesApiClient = class {
     let inputTokens;
     let outputTokens;
     let reasoningTokens;
+    let cacheReadTokens;
+    let cacheWriteTokens;
     const pending = {};
+    let unclaimedReasoning = [];
     if (response.body !== null) {
       for await (const record of parseSseStream(response.body, signal)) {
         if (record.data === "[DONE]") break;
@@ -2174,6 +2260,12 @@ var ResponsesApiClient = class {
         } else if (t === "response.reasoning_summary_text.delta" || t === "response.reasoning_text.delta") {
           const d = event.delta ?? "";
           if (d.length > 0) yield { type: "reasoning_delta", text: d };
+        } else if (t === "response.output_item.done" && event.item?.type === "reasoning") {
+          const id = event.item.id;
+          const encrypted = event.item.encrypted_content;
+          if (id !== void 0 && encrypted !== void 0 && encrypted.length > 0) {
+            unclaimedReasoning.push({ id, encrypted_content: encrypted });
+          }
         } else if (t === "response.output_item.added" && event.item?.type === "function_call") {
           const id = event.item.id ?? event.item.call_id ?? "call-0";
           pending[id] = {
@@ -2199,6 +2291,10 @@ var ResponsesApiClient = class {
             input: parseToolArguments(rawArgs)
           };
           toolCalls.push(call);
+          if (unclaimedReasoning.length > 0) {
+            this.rememberReasoning(call.id, unclaimedReasoning);
+            unclaimedReasoning = [];
+          }
           delete pending[id];
         } else if (t === "response.completed" || t === "response.incomplete") {
           const usage = event.response?.usage;
@@ -2206,12 +2302,14 @@ var ResponsesApiClient = class {
             inputTokens = usage.input_tokens;
             outputTokens = usage.output_tokens;
             reasoningTokens = usage.output_tokens_details?.reasoning_tokens;
+            cacheReadTokens = usage.input_tokens_details?.cached_tokens;
+            cacheWriteTokens = usage.input_tokens_details?.cache_write_tokens;
           }
           stopReason = t === "response.incomplete" ? "max_tokens" : "end_turn";
         } else if (t === "response.failed" || t === "error") {
           const msg = event.response?.error?.message ?? event.message ?? "responses stream failed";
           yield { type: "error", message: msg };
-          throw chunkSVO5WPZX_cjs.mapOpenAICompatibleError({
+          throw chunkDQKERTND_cjs.mapOpenAICompatibleError({
             providerId,
             status: 502,
             body: { error: { message: msg } },
@@ -2228,7 +2326,9 @@ var ResponsesApiClient = class {
       toolCalls,
       inputTokens,
       outputTokens,
-      reasoningTokens
+      reasoningTokens,
+      cacheReadTokens,
+      cacheWriteTokens
     });
   }
 };
@@ -2242,14 +2342,14 @@ function abortError2(signal) {
 // src/internal/llm/retrying-client.ts
 var MAX_ATTEMPTS = 3;
 function isRetriableError(err) {
-  if (!chunkLPVIRJVF_cjs.isTransientError(err)) return false;
-  if (err instanceof chunkLPVIRJVF_cjs.CredentialPoolExhaustedError) return false;
-  if (err instanceof chunkLPVIRJVF_cjs.TheokitAgentError && err.code === "circuit_open") return false;
-  if (err instanceof chunkLPVIRJVF_cjs.RateLimitError && err.metadata?.statusCode === 402) return false;
+  if (!chunkK3FW2XZD_cjs.isTransientError(err)) return false;
+  if (err instanceof chunkK3FW2XZD_cjs.CredentialPoolExhaustedError) return false;
+  if (err instanceof chunkK3FW2XZD_cjs.TheokitAgentError && err.code === "circuit_open") return false;
+  if (err instanceof chunkK3FW2XZD_cjs.RateLimitError && err.metadata?.statusCode === 402) return false;
   return true;
 }
 function retryAfterHintMs(err) {
-  if (!(err instanceof chunkLPVIRJVF_cjs.RateLimitError)) return void 0;
+  if (!(err instanceof chunkK3FW2XZD_cjs.RateLimitError)) return void 0;
   const seconds = err.metadata?.retryAfter;
   return typeof seconds === "number" && seconds > 0 ? seconds * 1e3 : void 0;
 }
@@ -2295,16 +2395,16 @@ var RetryingLlmClient = class {
    */
   async #waitBackoff(err, attempt, signal) {
     const hint = retryAfterHintMs(err);
-    const ms = chunk3X6PM7DU_cjs.computeBackoffMs({
+    const ms = chunkF3YZMOAU_cjs.computeBackoffMs({
       attempt,
       ...hint !== void 0 ? { retryAfterMs: hint } : {},
       ...this.#rng !== void 0 ? { rng: this.#rng } : {}
     });
     const cause = err instanceof Error ? err.name : typeof err;
-    chunkBM6N4KHO_cjs.diag(
+    chunkNUKRL3I6_cjs.diag(
       `retry ${attempt + 1}/${MAX_ATTEMPTS} in ${String(ms)}ms \u2014 ${cause}` + (hint !== void 0 ? ` (Retry-After: ${String(hint)}ms)` : "")
     );
-    await chunk3X6PM7DU_cjs.sleepWithAbort(ms, signal);
+    await chunkF3YZMOAU_cjs.sleepWithAbort(ms, signal);
   }
   async *stream(request, signal) {
     let lastError;
@@ -2342,7 +2442,7 @@ function classifyVertexError(args, errStatus) {
   return "unknown";
 }
 function vertexMetadata(args, code) {
-  return chunkSVO5WPZX_cjs.buildErrorMetadata({
+  return chunkDQKERTND_cjs.buildErrorMetadata({
     provider: "vertex",
     endpoint: args.endpoint,
     code,
@@ -2352,23 +2452,23 @@ function vertexMetadata(args, code) {
   });
 }
 var VERTEX_ERROR_BUILDERS = {
-  rate_limit: (args, msg) => new chunkLPVIRJVF_cjs.RateLimitError(`Vertex quota exhausted: ${msg}`, {
+  rate_limit: (args, msg) => new chunkK3FW2XZD_cjs.RateLimitError(`Vertex quota exhausted: ${msg}`, {
     metadata: vertexMetadata(args, "rate_limit")
   }),
-  auth_unauthenticated: (args, msg) => new chunkLPVIRJVF_cjs.AuthenticationError(`Vertex unauthenticated: ${msg}`, {
+  auth_unauthenticated: (args, msg) => new chunkK3FW2XZD_cjs.AuthenticationError(`Vertex unauthenticated: ${msg}`, {
     metadata: vertexMetadata(args, "auth_failed")
   }),
-  auth_permission: (args, msg) => new chunkLPVIRJVF_cjs.AuthenticationError(`Vertex permission denied: ${msg}`, {
+  auth_permission: (args, msg) => new chunkK3FW2XZD_cjs.AuthenticationError(`Vertex permission denied: ${msg}`, {
     metadata: vertexMetadata(args, "auth_failed")
   }),
-  invalid_request: (args, msg) => new chunkLPVIRJVF_cjs.ConfigurationError(`Vertex validation: ${msg}`, {
+  invalid_request: (args, msg) => new chunkK3FW2XZD_cjs.ConfigurationError(`Vertex validation: ${msg}`, {
     metadata: vertexMetadata(args, "invalid_request")
   }),
-  timeout: (args, msg) => new chunkLPVIRJVF_cjs.NetworkError(`Vertex timeout: ${msg}`, { metadata: vertexMetadata(args, "timeout") }),
-  server_error: (args, msg) => new chunkLPVIRJVF_cjs.NetworkError(`Vertex server error: ${msg}`, {
+  timeout: (args, msg) => new chunkK3FW2XZD_cjs.NetworkError(`Vertex timeout: ${msg}`, { metadata: vertexMetadata(args, "timeout") }),
+  server_error: (args, msg) => new chunkK3FW2XZD_cjs.NetworkError(`Vertex server error: ${msg}`, {
     metadata: vertexMetadata(args, "server_error")
   }),
-  unknown: (args, msg) => new chunkLPVIRJVF_cjs.UnknownAgentError(`Vertex unknown: ${msg}`, { metadata: vertexMetadata(args, "unknown") })
+  unknown: (args, msg) => new chunkK3FW2XZD_cjs.UnknownAgentError(`Vertex unknown: ${msg}`, { metadata: vertexMetadata(args, "unknown") })
 };
 function mapVertexError(args) {
   const parsed = parseBody2(args.body);
@@ -2404,12 +2504,12 @@ async function resolveVertexAccessToken() {
 async function getAuthClientOrThrow() {
   let mod;
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-2FYEVT2B.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-HLPSLDGL.cjs', document.baseURI).href)));
     mod = r("google-auth-library");
   } catch (err) {
     const isModuleMissing = err instanceof Error && (err.message.includes("Cannot find module") || err.code === "MODULE_NOT_FOUND");
     if (isModuleMissing) {
-      throw new chunkLPVIRJVF_cjs.ConfigurationError(
+      throw new chunkK3FW2XZD_cjs.ConfigurationError(
         "Vertex provider requires `google-auth-library`. Install: `pnpm add google-auth-library`.",
         { code: "auth_failed", cause: err }
       );
@@ -2420,7 +2520,7 @@ async function getAuthClientOrThrow() {
     const auth = new mod.GoogleAuth({ scopes: [SCOPE_CLOUD_PLATFORM] });
     return await auth.getClient();
   } catch (err) {
-    chunkBM6N4KHO_cjs.diag(
+    chunkNUKRL3I6_cjs.diag(
       `[theokit-sdk] Vertex ADC initialization failed: ${err instanceof Error ? err.message : String(err)}
 `
     );
@@ -2446,7 +2546,7 @@ var VertexAnthropicClient = class {
   resolveProjectOrThrow() {
     const projectId = this.options.projectId ?? resolveVertexProjectId();
     if (projectId !== void 0) return projectId;
-    throw new chunkLPVIRJVF_cjs.ConfigurationError(
+    throw new chunkK3FW2XZD_cjs.ConfigurationError(
       "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
       { code: "auth_failed" }
     );
@@ -2456,7 +2556,7 @@ var VertexAnthropicClient = class {
     if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
     const fromAdc = await resolveVertexAccessToken();
     if (fromAdc !== void 0 && fromAdc.length > 0) return fromAdc;
-    throw new chunkLPVIRJVF_cjs.ConfigurationError(
+    throw new chunkK3FW2XZD_cjs.ConfigurationError(
       "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
       { code: "auth_failed" }
     );
@@ -2465,8 +2565,8 @@ var VertexAnthropicClient = class {
     const projectId = this.resolveProjectOrThrow();
     const location = this.options.location ?? resolveVertexLocation();
     const accessToken = await this.resolveTokenOrThrow();
-    const baseUrl = chunkVUKQL3L2_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "anthropic" });
-    const bareModel = chunkVUKQL3L2_cjs.stripVertexPrefix(request.model);
+    const baseUrl = chunkNIRE5CNO_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "anthropic" });
+    const bareModel = chunkNIRE5CNO_cjs.stripVertexPrefix(request.model);
     const endpoint = `/models/${encodeURIComponent(bareModel)}:rawPredict`;
     const url = `${baseUrl}${endpoint}`;
     const response = await postAnthropicRequest({
@@ -2502,7 +2602,7 @@ var VertexGeminiClient = class {
   async *stream(request, signal) {
     const projectId = this.options.projectId ?? resolveVertexProjectId();
     if (projectId === void 0) {
-      throw new chunkLPVIRJVF_cjs.ConfigurationError(
+      throw new chunkK3FW2XZD_cjs.ConfigurationError(
         "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
         { code: "auth_failed" }
       );
@@ -2510,19 +2610,15 @@ var VertexGeminiClient = class {
     const location = this.options.location ?? resolveVertexLocation();
     const accessToken = this.options.apiKey !== void 0 && this.options.apiKey.length > 0 ? this.options.apiKey : await resolveVertexAccessToken();
     if (accessToken === void 0 || accessToken.length === 0) {
-      throw new chunkLPVIRJVF_cjs.ConfigurationError(
+      throw new chunkK3FW2XZD_cjs.ConfigurationError(
         "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
         { code: "auth_failed" }
       );
     }
-    const baseUrl = chunkVUKQL3L2_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "gemini" });
+    const baseUrl = chunkNIRE5CNO_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "gemini" });
     const url = `${baseUrl}/chat/completions`;
     const innerFetch = this.options.fetch ?? fetch;
-    const rewriteFetch = (input, init) => {
-      const requested = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-      const targetUrl = requested.endsWith("/v1/chat/completions") ? url : requested;
-      return innerFetch(targetUrl, init);
-    };
+    const rewriteFetch = (_input, init) => innerFetch(url, init);
     const inner = new OpenAIClient({
       apiKey: accessToken,
       baseUrl: "https://_vertex_placeholder",
@@ -2541,7 +2637,7 @@ var VertexRouterClient = class {
   options;
   name = "vertex";
   async *stream(request, signal) {
-    const dialect = chunkVUKQL3L2_cjs.inferModelDialect(request.model);
+    const dialect = chunkNIRE5CNO_cjs.inferModelDialect(request.model);
     if (dialect === "anthropic") {
       const inner2 = new VertexAnthropicClient(this.options);
       return yield* inner2.stream(request, signal);
@@ -2553,73 +2649,73 @@ var VertexRouterClient = class {
 
 // src/internal/llm/router.ts
 function resolveProviderChain(options) {
-  chunkVUKQL3L2_cjs.registerBuiltins();
+  chunkNIRE5CNO_cjs.registerBuiltins();
   return buildChain(options);
 }
 function buildChain(options) {
   warnUnknownProvidersInApiKeys(options.apiKeys);
   const seen = /* @__PURE__ */ new Set();
   const clients = [];
-  const addClient = (name) => {
+  const addClient = (name, perCallBaseUrl) => {
     const lowered = name.toLowerCase();
     if (seen.has(lowered)) return;
     seen.add(lowered);
-    const client = buildClient(lowered, options);
+    const client = buildClient(lowered, options, perCallBaseUrl);
     if (client !== void 0) clients.push(maybeWrapWithFaultInjection(client));
   };
-  addClient(options.primary);
+  addClient(options.primary, options.baseUrl);
   for (const fallback of options.fallback ?? []) addClient(fallback);
   if (clients.length === 0) {
-    throw new chunkLPVIRJVF_cjs.ConfigurationError(
+    throw new chunkK3FW2XZD_cjs.ConfigurationError(
       `No provider client could be resolved (primary=${options.primary}). Set ANTHROPIC_API_KEY or OPENAI_API_KEY / OPENROUTER_API_KEY.`,
       { code: "provider_unresolved" }
     );
   }
   return clients;
 }
-function buildClient(name, routerOptions) {
-  const baseProfile = chunkVUKQL3L2_cjs.getProviderProfile(name);
+function buildClient(name, routerOptions, perCallBaseUrl) {
+  const baseProfile = chunkNIRE5CNO_cjs.getProviderProfile(name);
   if (baseProfile === void 0) return void 0;
   const profile = routerOptions.extractToolCallsFromContent === true && baseProfile.extractToolCallsFromContent !== true ? { ...baseProfile, extractToolCallsFromContent: true } : baseProfile;
   const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
-  const ambient = chunk3X6PM7DU_cjs.currentCredentialPool(name);
+  const ambient = chunkF3YZMOAU_cjs.currentCredentialPool(name);
   if (ambient !== void 0) {
     return new RetryingLlmClient(
       new PoolAwareLlmClient(
         ambient,
-        (apiKey) => selectTransport(profile, apiKey),
+        (apiKey) => selectTransport(profile, apiKey, perCallBaseUrl),
         void 0,
         resilience
       )
     );
   }
   const poolKeys = filterPoolKeys(routerOptions.apiKeys?.[name]);
-  const noAuthOverride = maybeBuildNoAuthTransport(profile, poolKeys);
+  const noAuthOverride = maybeBuildNoAuthTransport(profile, poolKeys, perCallBaseUrl);
   if (noAuthOverride !== void 0) return noAuthOverride;
-  return buildPoolOrSingle({ name, profile, poolKeys, routerOptions });
+  return buildPoolOrSingle({ name, profile, poolKeys, routerOptions, perCallBaseUrl });
 }
-function maybeBuildNoAuthTransport(profile, poolKeys) {
+function maybeBuildNoAuthTransport(profile, poolKeys, baseUrl) {
   if (profile.authType !== "none" || poolKeys === void 0 || poolKeys.length === 0) {
     return void 0;
   }
   warnNoAuthApiKeysIgnoredOnce(profile.name);
   const sentinel = sentinelForNoAuth(profile);
   if (sentinel === void 0) return void 0;
-  return selectTransport(profile, sentinel);
+  return selectTransport(profile, sentinel, baseUrl);
 }
 function buildPoolOrSingle(args) {
-  const { name, profile, poolKeys, routerOptions } = args;
+  const { name, profile, poolKeys, routerOptions, perCallBaseUrl } = args;
   if (poolKeys !== void 0 && poolKeys.length >= 2) {
     const strategy = routerOptions.credentialPoolStrategy?.[name] ?? "fill_first";
     const entries = poolKeys.map(
-      (accessToken, priority) => chunk3X6PM7DU_cjs.newPooledCredential({ provider: name, accessToken, priority, source: "manual" })
+      (accessToken, priority) => chunkF3YZMOAU_cjs.newPooledCredential({ provider: name, accessToken, priority, source: "manual" })
     );
-    const pool = new chunk3X6PM7DU_cjs.CredentialPool(name, entries, strategy);
+    const pool = new chunkF3YZMOAU_cjs.CredentialPool(name, entries, strategy);
     const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
     return new RetryingLlmClient(
       new PoolAwareLlmClient(
         pool,
-        (apiKey2) => selectTransport(profile, apiKey2),
+        (apiKey2) => selectTransport(profile, apiKey2, perCallBaseUrl),
         void 0,
         resilience
       )
@@ -2627,7 +2723,7 @@ function buildPoolOrSingle(args) {
   }
   const apiKey = poolKeys?.[0] ?? resolveApiKey(profile.envVars) ?? sentinelForNoAuth(profile) ?? sentinelForLazyAuth(profile);
   if (apiKey === void 0) return void 0;
-  return new RetryingLlmClient(selectTransport(profile, apiKey));
+  return new RetryingLlmClient(selectTransport(profile, apiKey, perCallBaseUrl));
 }
 function resolveBaseUrlEnvOverride(providerName) {
   switch (providerName) {
@@ -2635,8 +2731,6 @@ function resolveBaseUrlEnvOverride(providerName) {
       return process.env.OPENAI_API_BASE_URL;
     case "openrouter":
       return process.env.OPENROUTER_API_BASE_URL;
-    case "ollama":
-      return process.env.OLLAMA_HOST;
     case "lmstudio":
       return process.env.LMSTUDIO_HOST;
     case "llamacpp":
@@ -2649,7 +2743,7 @@ var warnedNoAuthApiKeys = /* @__PURE__ */ new Set();
 function warnNoAuthApiKeysIgnoredOnce(provider) {
   if (warnedNoAuthApiKeys.has(provider)) return;
   warnedNoAuthApiKeys.add(provider);
-  chunkBM6N4KHO_cjs.diag(
+  chunkNUKRL3I6_cjs.diag(
     `[theokit-sdk] provider "${provider}" has authType: "none" \u2014 apiKeys ignored (no auth required for local runtime).
 `
   );
@@ -2675,10 +2769,10 @@ function warnUnknownProvidersInApiKeys(apiKeys) {
   if (apiKeys === void 0) return;
   for (const name of Object.keys(apiKeys)) {
     if (warnedProviders.has(name)) continue;
-    const profile = chunkVUKQL3L2_cjs.getProviderProfile(name);
+    const profile = chunkNIRE5CNO_cjs.getProviderProfile(name);
     if (profile === void 0) {
       warnedProviders.add(name);
-      chunkBM6N4KHO_cjs.diag(
+      chunkNUKRL3I6_cjs.diag(
         `[theokit-sdk] credential-pool: unknown provider "${name}" in apiKeys (no profile registered)
 `
       );
@@ -2692,7 +2786,7 @@ function resolveApiKey(envVars) {
   }
   return void 0;
 }
-function selectTransport(profile, apiKey) {
+function selectTransport(profile, apiKey, baseUrl) {
   const applyTransform = () => {
     if (profile.transform === void 0) return {};
     const ctx = { apiKey };
@@ -2710,14 +2804,14 @@ function selectTransport(profile, apiKey) {
     if (apiKey !== "__oauth_lazy_token__") return;
     const auth = t.headers?.authorization ?? t.headers?.Authorization;
     if (t.fetch === void 0 && auth === void 0) {
-      throw new chunkLPVIRJVF_cjs.ConfigurationError(
+      throw new chunkK3FW2XZD_cjs.ConfigurationError(
         `provider "${profile.name}" uses OAuth (authType: ${profile.authType}) but no credential was resolved. Register a ProviderProfile.transform whose fetch (or headers.authorization) supplies the bearer \u2014 typically via resolveCredential() from "@theokit/sdk/auth".`
       );
     }
   };
   if (profile.apiMode === "chat_completions") {
     if (profile.name === "ollama") {
-      const ollamaBase = process.env.OLLAMA_HOST ?? profile.baseUrl;
+      const ollamaBase = baseUrl ?? process.env.OLLAMA_HOST ?? profile.baseUrl;
       return new OllamaNativeClient({ apiKey, baseUrl: ollamaBase });
     }
     const opts = { apiKey };
@@ -2734,6 +2828,7 @@ function selectTransport(profile, apiKey) {
     }
     const envOverride = resolveBaseUrlEnvOverride(profile.name);
     if (envOverride !== void 0) opts.baseUrl = envOverride;
+    if (baseUrl !== void 0) opts.baseUrl = baseUrl;
     return comTransform(opts, (o) => new OpenAIClient(o));
   }
   if (profile.apiMode === "anthropic_messages") {
@@ -2742,12 +2837,15 @@ function selectTransport(profile, apiKey) {
       return new VertexRouterClient(realKey !== void 0 ? { apiKey: realKey } : {});
     }
     const opts = { apiKey };
-    opts.baseUrl = process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
+    opts.baseUrl = baseUrl ?? process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
     return comTransform(opts, (o) => new AnthropicClient(o));
   }
   if (profile.apiMode === "bedrock_anthropic") {
     const realKey = apiKey === "__bedrock_lazy_token__" ? void 0 : apiKey;
-    return new BedrockAnthropicClient(realKey !== void 0 ? { apiKey: realKey } : {});
+    return new BedrockAnthropicClient({
+      ...realKey !== void 0 ? { apiKey: realKey } : {},
+      ...baseUrl !== void 0 ? { baseUrl } : {}
+    });
   }
   if (profile.apiMode === "responses_api") {
     const t = applyTransform();
@@ -2755,13 +2853,17 @@ function selectTransport(profile, apiKey) {
     const mergedHeaders = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
     return new ResponsesApiClient({
       apiKey,
-      ...profile.baseUrl !== void 0 ? { baseUrl: profile.baseUrl } : {},
+      // Per-call URL first, same contract as every other branch (B-150).
+      ...(baseUrl ?? profile.baseUrl) !== void 0 ? { baseUrl: baseUrl ?? profile.baseUrl } : {},
       ...mergedHeaders !== void 0 ? { extraHeaders: mergedHeaders } : {},
       ...t.fetch !== void 0 ? { fetch: t.fetch } : {},
+      // usetheokit/theokit-sdk#383 — forwarded only when the profile declares it, so a provider that
+      // has not been measured against `reasoning.context` keeps the request it had.
+      ...profile.encryptedReasoning === true ? { encryptedReasoning: true } : {},
       providerName: profile.name
     });
   }
-  throw new chunkLPVIRJVF_cjs.ConfigurationError(
+  throw new chunkK3FW2XZD_cjs.ConfigurationError(
     `Provider "${profile.name}" requires apiMode "${profile.apiMode}" but no transport is registered. Install a third-party transport plugin (@theokit-transport-${profile.apiMode}) or use a provider with apiMode "chat_completions" or "anthropic_messages".`,
     { code: "transport_unavailable" }
   );
@@ -2771,7 +2873,7 @@ function selectTransport(profile, apiKey) {
 function inferProviderFromApiKey(apiKey) {
   const provider = chunkFRITRLZQ_cjs.providerFromApiKeyPrefix(apiKey);
   if (provider === void 0) return void 0;
-  return chunkVUKQL3L2_cjs.getProviderProfile(provider) === void 0 ? void 0 : provider;
+  return chunkNIRE5CNO_cjs.getProviderProfile(provider) === void 0 ? void 0 : provider;
 }
 function detectPrimaryProvider() {
   if (process.env.ANTHROPIC_API_KEY !== void 0 && process.env.ANTHROPIC_API_KEY.length > 0) {
@@ -2785,6 +2887,17 @@ function detectPrimaryProvider() {
   }
   return "openai";
 }
+var warnedProviderPrecedence = /* @__PURE__ */ new Set();
+function warnProviderPrecedenceOnce(asked, used) {
+  if (asked === void 0 || asked === used) return;
+  const key = `${asked}->${used}`;
+  if (warnedProviderPrecedence.has(key)) return;
+  warnedProviderPrecedence.add(key);
+  chunkNUKRL3I6_cjs.diag(
+    `[theokit-sdk] model id names provider "${asked}", but "${used}" was used \u2014 an explicit \`providers.routes[0]\` or the API key's own prefix outranks the model id's prefix. Pass \`providers.routes\` to choose deliberately.
+`
+  );
+}
 
 // src/internal/runtime/compression/compression-model-registry.ts
 var EXACT_REGISTRY = /* @__PURE__ */ new Map([
@@ -2906,7 +3019,7 @@ function plainText(content) {
 }
 async function compactSessionTranscript(opts) {
   const prior = await opts.store.readRecords(opts.loc.agentId);
-  const history = chunkY4AXQOT4_cjs.reconstructMessages(prior);
+  const history = chunkJHPGF3FP_cjs.reconstructMessages(prior);
   const compressible = [];
   for (const m of history) {
     const text = plainText(m.content);
@@ -2914,14 +3027,14 @@ async function compactSessionTranscript(opts) {
       compressible.push({ role: m.role, content: text });
     }
   }
-  const preTokens = chunkADLLFY3H_cjs.estimateTokens(compressible.map((m) => m.content).join("\n"));
+  const preTokens = chunkXSX2UU6Y_cjs.estimateTokens(compressible.map((m) => m.content).join("\n"));
   const summaryBody = await opts.summarize(compressible);
   const preserved = [];
   let budget = 0;
   for (let i = compressible.length - 1; i >= 0; i--) {
     const m = compressible[i];
     if (m === void 0 || m.role !== "user" || isCompactSummary(m.content)) continue;
-    const cost = chunkADLLFY3H_cjs.estimateTokens(m.content);
+    const cost = chunkXSX2UU6Y_cjs.estimateTokens(m.content);
     if (budget + cost > COMPACT_USER_MESSAGE_MAX_TOKENS) {
       const remaining = COMPACT_USER_MESSAGE_MAX_TOKENS - budget;
       if (remaining > 50) {
@@ -2935,7 +3048,7 @@ async function compactSessionTranscript(opts) {
   }
   const summary = `${COMPACT_SUMMARY_MARKER}
 ${summaryBody}`;
-  const transcript = chunkY4AXQOT4_cjs.SessionTranscript.fromRecords(prior, {
+  const transcript = chunkJHPGF3FP_cjs.SessionTranscript.fromRecords(prior, {
     cwd: opts.loc.cwd,
     sessionId: opts.sessionId,
     model: opts.loc.model ?? "unknown"
@@ -2945,8 +3058,8 @@ ${summaryBody}`;
   transcript.appendUserTurn(summary);
   const delta = transcript.records().slice(prior.length);
   await opts.store.appendRecords(opts.loc.agentId, delta);
-  chunk4JBHSLQO_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
-  const postTokens = chunkADLLFY3H_cjs.estimateTokens([...preserved, summary].join("\n"));
+  chunk4OTIXDMU_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
+  const postTokens = chunkXSX2UU6Y_cjs.estimateTokens([...preserved, summary].join("\n"));
   return { preTokens, postTokens };
 }
 function resolveSummarizerRoute(opts) {
@@ -2955,9 +3068,9 @@ function resolveSummarizerRoute(opts) {
 }
 function buildDefaultSummarizer(opts) {
   return async (messages) => {
-    chunkVUKQL3L2_cjs.registerBuiltins();
+    chunkNIRE5CNO_cjs.registerBuiltins();
     const modelPrefix = opts.agentModel.includes("/") ? opts.agentModel.slice(0, opts.agentModel.indexOf("/")) : void 0;
-    const prefixProfile = modelPrefix !== void 0 ? chunkVUKQL3L2_cjs.getProviderProfile(modelPrefix) : void 0;
+    const prefixProfile = modelPrefix !== void 0 ? chunkNIRE5CNO_cjs.getProviderProfile(modelPrefix) : void 0;
     const prefixUsable = prefixProfile !== void 0 && (prefixProfile.authType !== "api_key" || prefixProfile.envVars.some((v) => (process.env[v] ?? "").length > 0));
     const route = resolveSummarizerRoute({
       keyProvider: inferProviderFromApiKey(opts.apiKey),
@@ -3028,7 +3141,7 @@ async function autoCompactIfNeeded(opts) {
     return true;
   } catch (cause) {
     const msg = cause instanceof Error ? cause.message : String(cause);
-    chunkBM6N4KHO_cjs.diag(`[theokit-sdk] auto-compaction failed (left transcript untouched): ${msg}
+    chunkNUKRL3I6_cjs.diag(`[theokit-sdk] auto-compaction failed (left transcript untouched): ${msg}
 `);
     return false;
   }
@@ -3050,6 +3163,7 @@ exports.isFixtureApiKey = isFixtureApiKey;
 exports.mapOllamaHttpError = mapOllamaHttpError;
 exports.mapOllamaTransportError = mapOllamaTransportError;
 exports.parseSseStream = parseSseStream;
+exports.presentProviderCredentialEnvVars = presentProviderCredentialEnvVars;
 exports.readErrorResponseBody = readErrorResponseBody;
 exports.relayStream = relayStream;
 exports.renderToolResultContentText = renderToolResultContentText;
@@ -3059,5 +3173,6 @@ exports.shouldAutoCompact = shouldAutoCompact;
 exports.shouldUseFixtureMode = shouldUseFixtureMode;
 exports.shouldUseRealLocalRuntime = shouldUseRealLocalRuntime;
 exports.tryFirstEvent = tryFirstEvent;
-//# sourceMappingURL=chunk-2FYEVT2B.cjs.map
-//# sourceMappingURL=chunk-2FYEVT2B.cjs.map
+exports.warnProviderPrecedenceOnce = warnProviderPrecedenceOnce;
+//# sourceMappingURL=chunk-HLPSLDGL.cjs.map
+//# sourceMappingURL=chunk-HLPSLDGL.cjs.map