@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/{chunk-KYAJINUI.cjs → chunk-2HPNT6HH.cjs}

@@ -1,16 +1,19 @@
 'use strict';
 
-var chunkO7DK5PBJ_cjs = require('./chunk-O7DK5PBJ.cjs');
-var chunk4OTIXDMU_cjs = require('./chunk-4OTIXDMU.cjs');
-var chunkUGT7GK7I_cjs = require('./chunk-UGT7GK7I.cjs');
-var chunk6JSIEDKL_cjs = require('./chunk-6JSIEDKL.cjs');
+var chunkFUSDYC2B_cjs = require('./chunk-FUSDYC2B.cjs');
+var chunkYJNYDJ2T_cjs = require('./chunk-YJNYDJ2T.cjs');
+var chunk24SYBZPL_cjs = require('./chunk-24SYBZPL.cjs');
+var chunkQOGNZMHD_cjs = require('./chunk-QOGNZMHD.cjs');
+var chunkYSTXFWQE_cjs = require('./chunk-YSTXFWQE.cjs');
 var chunkFRITRLZQ_cjs = require('./chunk-FRITRLZQ.cjs');
-var chunk5HEG4CQH_cjs = require('./chunk-5HEG4CQH.cjs');
-var chunkDXGZ2NUG_cjs = require('./chunk-DXGZ2NUG.cjs');
-var chunkHCZD23VS_cjs = require('./chunk-HCZD23VS.cjs');
-var chunkXJCXEKMD_cjs = require('./chunk-XJCXEKMD.cjs');
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
-var chunkEG4QM7ZJ_cjs = require('./chunk-EG4QM7ZJ.cjs');
+var chunkGZV6AVRL_cjs = require('./chunk-GZV6AVRL.cjs');
+var chunkATT276RD_cjs = require('./chunk-ATT276RD.cjs');
+var chunk3EE6LVWT_cjs = require('./chunk-3EE6LVWT.cjs');
+var chunkQC55H6RJ_cjs = require('./chunk-QC55H6RJ.cjs');
+var chunkNVXXWAU7_cjs = require('./chunk-NVXXWAU7.cjs');
+var chunkEXTRW7GW_cjs = require('./chunk-EXTRW7GW.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 var fs = require('fs');
 var promises = require('fs/promises');
 var os = require('os');
@@ -19,7 +22,7 @@ var url = require('url');
 var module$1 = require('module');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-var discoveryState = chunkHCZD23VS_cjs.globalSingleton("theokit-sdk.providers.discovered", () => ({
+var discoveryState = chunkNVXXWAU7_cjs.globalSingleton("theokit-sdk.providers.discovered", () => ({
   done: false
 }));
 function pluginsRoot() {
@@ -41,19 +44,19 @@ function loadTrustedNames() {
           else discarded += 1;
         }
         if (discarded > 0) {
-          chunkEG4QM7ZJ_cjs.diag(
+          chunk6LHQPOMI_cjs.diag(
             `[theokit-sdk] WARN: ${path} contains ${discarded} non-string entr${discarded === 1 ? "y" : "ies"} \u2014 discarded (entries must be plugin-name strings)
 `
           );
         }
       } else {
-        chunkEG4QM7ZJ_cjs.diag(
+        chunk6LHQPOMI_cjs.diag(
           `[theokit-sdk] WARN: ${path} is not a JSON array \u2014 trusting NO provider plugins (fail-closed)
 `
         );
       }
     } catch {
-      chunkEG4QM7ZJ_cjs.diag(
+      chunk6LHQPOMI_cjs.diag(
         `[theokit-sdk] WARN: ${path} is not valid JSON \u2014 trusting NO provider plugins (fail-closed)
 `
       );
@@ -79,7 +82,7 @@ async function discoverProviderPlugins() {
   const trusted = loadTrustedNames();
   for (const entry of entries) {
     if (!trusted.has(entry)) {
-      chunkEG4QM7ZJ_cjs.diag(
+      chunk6LHQPOMI_cjs.diag(
         `[theokit-sdk] WARN: provider plugin "${entry}" is present but NOT trusted \u2014 skipped. To trust it, add "${entry}" to ${trustFilePath()} (JSON array of names) or THEOKIT_TRUSTED_PROVIDERS (comma-separated), then restart the process.
 `
       );
@@ -98,13 +101,13 @@ async function loadOne(dir, entryName) {
       if (plugin !== null && typeof plugin === "object" && plugin.kind === "model-provider") {
         const profile = plugin.profile;
         if (profile !== void 0 && typeof profile === "object") {
-          chunkHCZD23VS_cjs.registerProvider(profile);
+          chunkQC55H6RJ_cjs.registerProvider(profile);
         }
       }
       return;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      chunkEG4QM7ZJ_cjs.diag(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
+      chunk6LHQPOMI_cjs.diag(`[theokit-sdk] failed to load provider plugin "${entryName}": ${msg}
 `);
       return;
     }
@@ -116,7 +119,7 @@ function mapAnthropicError(args) {
   const { status, body, headers, endpoint } = args;
   const code = mapAnthropicStatusToCode(status, body);
   const message = formatMessage(status, code);
-  const metadata = chunkUGT7GK7I_cjs.buildErrorMetadata({
+  const metadata = chunk24SYBZPL_cjs.buildErrorMetadata({
     provider: "anthropic",
     endpoint,
     code,
@@ -125,29 +128,26 @@ function mapAnthropicError(args) {
     body
   });
   if (status === 401 || status === 403) {
-    return new chunk4ZHTIJNE_cjs.AuthenticationError(message, { code: "anthropic_auth_failed", metadata });
+    return new chunkJ7J7J2GN_cjs.AuthenticationError(message, { code: "anthropic_auth_failed", metadata });
   }
   if (status === 429) {
-    return new chunk4ZHTIJNE_cjs.RateLimitError(message, { code: "anthropic_rate_limit", metadata });
+    return new chunkJ7J7J2GN_cjs.RateLimitError(message, { code: "anthropic_rate_limit", metadata });
   }
   if (status === 400) {
-    return new chunk4ZHTIJNE_cjs.ConfigurationError(message, {
+    return new chunkJ7J7J2GN_cjs.ConfigurationError(message, {
       code: `anthropic_${code}`,
       metadata
     });
   }
   if (status === 408) {
-    return new chunk4ZHTIJNE_cjs.NetworkError(message, { code: "anthropic_timeout", metadata });
+    return new chunkJ7J7J2GN_cjs.NetworkError(message, { code: "anthropic_timeout", metadata });
   }
   if (status >= 500 && status < 600) {
-    return new chunk4ZHTIJNE_cjs.NetworkError(message, { code: "anthropic_server_error", metadata });
+    return new chunkJ7J7J2GN_cjs.NetworkError(message, { code: "anthropic_server_error", metadata });
   }
-  return new chunk4ZHTIJNE_cjs.UnknownAgentError(message, { code: "anthropic_unknown", metadata });
+  return new chunkJ7J7J2GN_cjs.UnknownAgentError(message, { code: "anthropic_unknown", metadata });
 }
 function mapAnthropicStatusToCode(status, body) {
-  if (status === 401 || status === 403) return "auth_failed";
-  if (status === 429) return "rate_limit";
-  if (status === 408) return "timeout";
   if (status === 400) {
     const text = JSON.stringify(body ?? "").toLowerCase();
     if (text.includes("context") && (text.includes("too long") || text.includes("too_long") || text.includes("length"))) {
@@ -158,8 +158,7 @@ function mapAnthropicStatusToCode(status, body) {
     }
     return "invalid_request";
   }
-  if (status >= 500 && status < 600) return "server_error";
-  return "unknown";
+  return chunk24SYBZPL_cjs.httpStatusToErrorCode(status);
 }
 function formatMessage(status, code) {
   return `Anthropic API error: ${code} (HTTP ${status})`;
@@ -176,8 +175,8 @@ function parseToolArguments(buffered) {
   try {
     return JSON.parse(buffered);
   } catch {
-    const repaired = chunk6JSIEDKL_cjs.tryJson(buffered, true);
-    if (chunk6JSIEDKL_cjs.isPlainObject(repaired)) return repaired;
+    const repaired = chunkYSTXFWQE_cjs.tryJson(buffered, true);
+    if (chunkYSTXFWQE_cjs.isPlainObject(repaired)) return repaired;
     return { raw: buffered };
   }
 }
@@ -200,7 +199,7 @@ function assign(finish, key, value) {
   if (value === void 0) return;
   const count = asTokenCount(value);
   if (count === void 0) {
-    chunkEG4QM7ZJ_cjs.diag(
+    chunk6LHQPOMI_cjs.diag(
       `[theokit-sdk] provider reported an unusable ${key} (${String(value)}) \u2014 dropping it. Usage and cost for this turn will be incomplete.
 `
     );
@@ -230,7 +229,7 @@ function toBlockToolResultContent(content) {
 function toStringToolResultContent(content, providerName) {
   if (typeof content === "string") return content;
   if (content.some((block) => block.type === "image")) {
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       `provider "${providerName}" does not support image content in tool results`
     );
   }
@@ -409,7 +408,7 @@ function readWithIdleTimeout(reader, idleTimeoutMs) {
     (resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new chunk4ZHTIJNE_cjs.NetworkError(`SSE stream idle for ${idleTimeoutMs}ms \u2014 upstream stalled`, {
+          new chunkJ7J7J2GN_cjs.NetworkError(`SSE stream idle for ${idleTimeoutMs}ms \u2014 upstream stalled`, {
             code: "stream_idle_timeout"
           })
         );
@@ -479,16 +478,16 @@ function releaseReader(reader) {
 }
 
 // src/internal/llm/transport-error.ts
-function ehAbort(err) {
+function isAbortError(err) {
   if (typeof err !== "object" || err === null) return false;
-  const nome = err.name;
-  return nome === "AbortError" || nome === "TimeoutError";
+  const name = err.name;
+  return name === "AbortError" || name === "TimeoutError";
 }
 function wrapTransportError(err, ctx) {
-  if (ehAbort(err)) return err;
-  if (err instanceof chunk4ZHTIJNE_cjs.TheokitAgentError) return err;
+  if (isAbortError(err)) return err;
+  if (err instanceof chunkJ7J7J2GN_cjs.TheokitAgentError) return err;
   const detail = err instanceof Error ? err.message : String(err);
-  return new chunk4ZHTIJNE_cjs.NetworkError(`${ctx.providerId} transport failure on ${ctx.endpoint}: ${detail}`, {
+  return new chunkJ7J7J2GN_cjs.NetworkError(`${ctx.providerId} transport failure on ${ctx.endpoint}: ${detail}`, {
     code: "transport_failure",
     cause: err
   });
@@ -552,7 +551,7 @@ var AnthropicClient = class {
       for (const event of events) yield event;
     }
     if (!accumulator.finishReasonSeen) {
-      throw new chunk4ZHTIJNE_cjs.NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
+      throw new chunkJ7J7J2GN_cjs.NetworkError("Anthropic SSE stream truncated (no stop_reason)", {
         code: "stream_truncated"
       });
     }
@@ -691,21 +690,20 @@ function buildAnthropicBody(request) {
 
 // src/internal/error-mappers/bedrock.ts
 function classifyBedrockError(args, awsType, message) {
-  if (args.status === 429 || awsType.includes("Throttling") || awsType.includes("TooManyRequests")) {
+  if (awsType.includes("Throttling") || awsType.includes("TooManyRequests")) {
     return "rate_limit";
   }
-  if (args.status === 401 || args.status === 403 || awsType.includes("AccessDenied") || awsType.includes("UnauthorizedOperation")) {
+  if (awsType.includes("AccessDenied") || awsType.includes("UnauthorizedOperation")) {
     return "auth_failed";
   }
-  if (args.status === 400 || args.status === 404 || awsType.includes("ValidationException") || awsType.includes("ResourceNotFound") || message.includes("use case details")) {
+  if (args.status === 404 || awsType.includes("ValidationException") || awsType.includes("ResourceNotFound") || message.includes("use case details")) {
     return "invalid_request";
   }
-  if (args.status === 408 || awsType.includes("Timeout")) return "timeout";
-  if (args.status >= 500) return "server_error";
-  return "unknown";
+  if (awsType.includes("Timeout")) return "timeout";
+  return chunk24SYBZPL_cjs.httpStatusToErrorCode(args.status);
 }
 function buildBedrockMetadata(args, code) {
-  return chunkUGT7GK7I_cjs.buildErrorMetadata({
+  return chunk24SYBZPL_cjs.buildErrorMetadata({
     provider: "bedrock",
     endpoint: args.endpoint,
     code,
@@ -715,39 +713,30 @@ function buildBedrockMetadata(args, code) {
   });
 }
 function mapBedrockError(args) {
-  const parsed = parseBody(args.body);
+  const parsed = chunk24SYBZPL_cjs.parseErrorBody(args.body);
   const awsType = parsed.__type ?? "";
   const message = parsed.message ?? parsed.Message ?? "Bedrock request failed";
   const code = classifyBedrockError(args, awsType, message);
   const metadata = buildBedrockMetadata(args, code);
   switch (code) {
     case "rate_limit":
-      return new chunk4ZHTIJNE_cjs.RateLimitError(`Bedrock throttled: ${message}`, { metadata });
+      return new chunkJ7J7J2GN_cjs.RateLimitError(`Bedrock throttled: ${message}`, { metadata });
     case "auth_failed":
-      return new chunk4ZHTIJNE_cjs.AuthenticationError(`Bedrock auth: ${message}`, { metadata });
+      return new chunkJ7J7J2GN_cjs.AuthenticationError(`Bedrock auth: ${message}`, { metadata });
     case "invalid_request": {
       const friendly = message.includes("use case details") ? `Bedrock account setup required: ${message} (AWS Console \u2192 Bedrock \u2192 Model access \u2192 Anthropic \u2192 Submit use case form, then retry in 15 min.)` : `Bedrock validation: ${message}`;
-      return new chunk4ZHTIJNE_cjs.ConfigurationError(friendly, { metadata });
+      return new chunkJ7J7J2GN_cjs.ConfigurationError(friendly, { metadata });
     }
+    case "quota_exceeded":
+      return new chunkJ7J7J2GN_cjs.RateLimitError(`Bedrock quota exceeded: ${message}`, { metadata });
     case "timeout":
-      return new chunk4ZHTIJNE_cjs.NetworkError(`Bedrock timeout: ${message}`, { metadata });
+      return new chunkJ7J7J2GN_cjs.NetworkError(`Bedrock timeout: ${message}`, { metadata });
     case "server_error":
-      return new chunk4ZHTIJNE_cjs.NetworkError(`Bedrock server error: ${message}`, { metadata });
+      return new chunkJ7J7J2GN_cjs.NetworkError(`Bedrock server error: ${message}`, { metadata });
     default:
-      return new chunk4ZHTIJNE_cjs.UnknownAgentError(`Bedrock unknown: ${message}`, { metadata });
+      return new chunkJ7J7J2GN_cjs.UnknownAgentError(`Bedrock unknown: ${message}`, { metadata });
   }
 }
-function parseBody(body) {
-  if (body !== null && typeof body === "object") return body;
-  if (typeof body === "string") {
-    try {
-      return JSON.parse(body);
-    } catch {
-      return {};
-    }
-  }
-  return {};
-}
 var cachedToken = null;
 var CACHE_TTL_MS = 90 * 60 * 1e3;
 async function resolveBedrockToken(region) {
@@ -758,7 +747,7 @@ async function resolveBedrockToken(region) {
     return cachedToken.value;
   }
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-KYAJINUI.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-2HPNT6HH.cjs', document.baseURI).href)));
     const gen = r("@aws/bedrock-token-generator");
     if (typeof gen.getToken !== "function") return void 0;
     const providers = r("@aws-sdk/credential-providers");
@@ -786,16 +775,16 @@ var BedrockAnthropicClient = class {
     if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
     const fromEnv = await resolveBedrockToken(region);
     if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       "Bedrock requires AWS_BEARER_TOKEN_BEDROCK env var, or install `@aws/bedrock-token-generator` for auto-refresh, or pass apiKey explicitly.",
       { code: "auth_failed" }
     );
   }
   async *stream(request, signal) {
-    const region = chunkHCZD23VS_cjs.inferRegionFromModelId(request.model) ?? process.env.AWS_REGION ?? "us-east-1";
+    const region = chunkQC55H6RJ_cjs.inferRegionFromModelId(request.model) ?? process.env.AWS_REGION ?? "us-east-1";
     const token = await this.resolveTokenOrThrow(region);
-    const bareModel = chunkHCZD23VS_cjs.stripBedrockPrefix(request.model);
-    const baseUrl = this.options.baseUrl ?? chunkHCZD23VS_cjs.resolveBedrockBaseUrl(request.model);
+    const bareModel = chunkQC55H6RJ_cjs.stripBedrockPrefix(request.model);
+    const baseUrl = this.options.baseUrl ?? chunkQC55H6RJ_cjs.resolveBedrockBaseUrl(request.model);
     const endpoint = `/model/${encodeURIComponent(bareModel)}/invoke`;
     const url = `${baseUrl}${endpoint}`;
     const response = await postAnthropicRequest({
@@ -850,7 +839,7 @@ var FaultInjectingLlmClient = class {
       return yield* this.inner.stream(request, signal);
     }
     if (parsed.status >= 400) {
-      throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
+      throw chunk24SYBZPL_cjs.mapOpenAICompatibleError({
         providerId: this.name,
         status: parsed.status,
         body: parsed.body,
@@ -897,7 +886,7 @@ function parseOverrideOrWarnOnce() {
 function warnInvalidJsonOnce(_raw) {
   if (warnedInvalidJson) return;
   warnedInvalidJson = true;
-  chunkEG4QM7ZJ_cjs.diag(
+  chunk6LHQPOMI_cjs.diag(
     `[theokit-sdk] ${ENV_OVERRIDE_KEY} is set but value is not valid JSON of shape \`{"status": number, "body": object | string}\`. Falling back to real LLM call. This warning is shown once per process.
 `
   );
@@ -925,7 +914,7 @@ function mapOllamaTransportError(args) {
   if (args.providerId !== "ollama") return void 0;
   const causeCode = extractCauseCode(args.cause);
   if (causeCode !== "ECONNREFUSED" && causeCode !== "ENOTFOUND") return void 0;
-  const metadata = chunkUGT7GK7I_cjs.buildErrorMetadata({
+  const metadata = chunk24SYBZPL_cjs.buildErrorMetadata({
     provider: "ollama",
     endpoint: args.endpoint,
     code: "network",
@@ -933,7 +922,7 @@ function mapOllamaTransportError(args) {
     headers: void 0,
     body: { cause: causeCode }
   });
-  return new chunk4ZHTIJNE_cjs.ConfigurationError(
+  return new chunkJ7J7J2GN_cjs.ConfigurationError(
     "Ollama is not reachable. Run `ollama serve` to start the local runtime, or set OLLAMA_HOST to point at a remote Ollama server.",
     { code: "ollama_unreachable", metadata }
   );
@@ -943,7 +932,7 @@ function mapOllamaHttpError(args) {
   const errString = extractErrorString(args.body).toLowerCase();
   if (args.status === 404 && errString.includes("not found") && errString.includes("pull")) {
     const modelHint = extractModelName(errString);
-    const metadata = chunkUGT7GK7I_cjs.buildErrorMetadata({
+    const metadata = chunk24SYBZPL_cjs.buildErrorMetadata({
       provider: "ollama",
       endpoint: args.endpoint,
       code: "model_unavailable",
@@ -952,13 +941,13 @@ function mapOllamaHttpError(args) {
       body: args.body
     });
     const pullCmd = modelHint !== void 0 ? `ollama pull ${modelHint}` : "ollama pull <model>";
-    return new chunk4ZHTIJNE_cjs.ConfigurationError(
+    return new chunkJ7J7J2GN_cjs.ConfigurationError(
       `Ollama model is not pulled. Run \`${pullCmd}\` to download it first.`,
       { code: "ollama_model_not_pulled", metadata }
     );
   }
   if (args.status === 503 && errString.includes("model is loading")) {
-    const metadata = chunkUGT7GK7I_cjs.buildErrorMetadata({
+    const metadata = chunk24SYBZPL_cjs.buildErrorMetadata({
       provider: "ollama",
       endpoint: args.endpoint,
       code: "server_error",
@@ -966,7 +955,7 @@ function mapOllamaHttpError(args) {
       headers: args.headers,
       body: args.body
     });
-    return new chunk4ZHTIJNE_cjs.NetworkError(
+    return new chunkJ7J7J2GN_cjs.NetworkError(
       "Ollama model is loading. Retry in a few seconds \u2014 Ollama is warming up the model into memory.",
       { code: "ollama_model_loading", metadata }
     );
@@ -1028,7 +1017,7 @@ var OllamaNativeClient = class {
         endpoint: "/api/chat"
       });
       if (mapped !== void 0) throw mapped;
-      throw fetchErr;
+      throw wrapTransportError(fetchErr, { providerId: "ollama", endpoint: "/api/chat" });
     }
     if (!response.ok) {
       const text = await response.text().catch(() => "");
@@ -1045,7 +1034,13 @@ var OllamaNativeClient = class {
         endpoint: "/api/chat"
       });
       if (mapped !== void 0) throw mapped;
-      throw new Error(`Ollama /api/chat HTTP ${response.status}: ${text.slice(0, 200)}`);
+      throw chunk24SYBZPL_cjs.mapOpenAICompatibleError({
+        providerId: "ollama",
+        status: response.status,
+        body: bodyJson,
+        headers: response.headers,
+        endpoint: "/api/chat"
+      });
     }
     const accumulator = new OllamaStreamAccumulator();
     if (response.body === null) {
@@ -1187,7 +1182,7 @@ function toOllamaMessages(message) {
   }
   if (message.role === "user") {
     if (message.content.some((p) => p.type === "image")) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         "image input is not supported on the ollama-native provider; use an OpenAI/OpenRouter model for multimodal turns",
         { code: "ollama_image_unsupported" }
       );
@@ -1234,83 +1229,13 @@ function toOllamaTools(tools) {
     }
   }));
 }
-var FIXTURE_API_KEY_PREFIX = "theo_test_";
-function isFixtureApiKey(apiKey) {
-  if (apiKey === void 0) return false;
-  return apiKey.startsWith(FIXTURE_API_KEY_PREFIX);
-}
+
+// src/internal/base-url.ts
 function getConfiguredBaseUrl() {
   const value = process.env.THEOKIT_API_BASE_URL;
   if (value === void 0 || value.length === 0) return void 0;
   return value;
 }
-function shouldUseFixtureMode(apiKey) {
-  if (getConfiguredBaseUrl() !== void 0) return false;
-  return isFixtureApiKey(apiKey);
-}
-var PROVIDER_CREDENTIAL_ENV_VARS = [
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-  "OPENROUTER_API_KEY"
-];
-function presentProviderCredentialEnvVars() {
-  return PROVIDER_CREDENTIAL_ENV_VARS.filter((name) => {
-    const value = process.env[name];
-    return typeof value === "string" && value.length > 0;
-  });
-}
-function shouldUseRealLocalRuntime(apiKey) {
-  if (isFixtureApiKey(apiKey)) return false;
-  if (isStoredOAuthAvailable()) return true;
-  if (apiKey === void 0 || apiKey.length === 0) return false;
-  return presentProviderCredentialEnvVars().length > 0 || isAwsBedrockAuthAvailable() || isGcpVertexAuthAvailable() || isLocalNoAuthProviderAvailable();
-}
-var AMBIENT_STORE = {
-  home: os.homedir(),
-  dirName: ".theokit",
-  fileName: "auth.json",
-  homeEnvVar: "THEOKIT_AUTH_HOME"
-};
-function isStoredOAuthAvailable(env = process.env) {
-  try {
-    return chunkXJCXEKMD_cjs.readStoredOAuth(AMBIENT_STORE, env) !== void 0;
-  } catch {
-    return false;
-  }
-}
-function isAwsBedrockAuthAvailable() {
-  if (typeof process.env.AWS_BEARER_TOKEN_BEDROCK === "string" && process.env.AWS_BEARER_TOKEN_BEDROCK.length > 0) {
-    return true;
-  }
-  if (typeof process.env.AWS_ACCESS_KEY_ID === "string" && process.env.AWS_ACCESS_KEY_ID.length > 0) {
-    return true;
-  }
-  if (typeof process.env.AWS_PROFILE === "string" && process.env.AWS_PROFILE.length > 0) {
-    return true;
-  }
-  return awsCredentialsFileExists();
-}
-function awsCredentialsFileExists() {
-  try {
-    const home = process.env.HOME ?? process.env.USERPROFILE;
-    if (home === void 0 || home.length === 0) return false;
-    return fs.existsSync(`${home}/.aws/credentials`) || fs.existsSync(`${home}/.aws/config`);
-  } catch {
-    return false;
-  }
-}
-function isGcpVertexAuthAvailable() {
-  if (typeof process.env.GOOGLE_APPLICATION_CREDENTIALS === "string" && process.env.GOOGLE_APPLICATION_CREDENTIALS.length > 0) {
-    return true;
-  }
-  if (typeof process.env.GOOGLE_CLOUD_PROJECT === "string" && process.env.GOOGLE_CLOUD_PROJECT.length > 0) {
-    return true;
-  }
-  return false;
-}
-function isLocalNoAuthProviderAvailable() {
-  return true;
-}
 
 // src/internal/http.ts
 var DEFAULT_BASE_URL = "https://api.usetheo.dev";
@@ -1341,7 +1266,7 @@ async function safeFetch(fetchFn, url, init) {
   try {
     return await fetchFn(url, init);
   } catch (cause) {
-    throw new chunk4ZHTIJNE_cjs.NetworkError("HTTP request failed", { code: "network_error", cause });
+    throw new chunkJ7J7J2GN_cjs.NetworkError("HTTP request failed", { code: "network_error", cause });
   }
 }
 async function safeParseJsonResponse(response) {
@@ -1368,26 +1293,32 @@ function mapHttpStatusToError(status, body) {
     cause: body
   };
   if (envelope.code === "integration_not_connected") {
-    return new chunk4ZHTIJNE_cjs.IntegrationNotConnectedError(message, {
+    return new chunkJ7J7J2GN_cjs.IntegrationNotConnectedError(message, {
       provider: envelope.provider ?? "unknown",
       helpUrl: envelope.helpUrl ?? "",
       code: envelope.code,
       cause: body
     });
   }
+  return statusToError(status, message, errorOptions);
+}
+function statusToError(status, message, errorOptions) {
   if (status === 401 || status === 403) {
-    return new chunk4ZHTIJNE_cjs.AuthenticationError(message, errorOptions);
+    return new chunkJ7J7J2GN_cjs.AuthenticationError(message, errorOptions);
   }
   if (status === 429) {
-    return new chunk4ZHTIJNE_cjs.RateLimitError(message, errorOptions);
+    return new chunkJ7J7J2GN_cjs.RateLimitError(message, errorOptions);
+  }
+  if (status === 408) {
+    return new chunkJ7J7J2GN_cjs.NetworkError(message, { ...errorOptions, code: errorOptions.code ?? "timeout" });
   }
   if (status >= 400 && status < 500) {
-    return new chunk4ZHTIJNE_cjs.ConfigurationError(message, errorOptions);
+    return new chunkJ7J7J2GN_cjs.ConfigurationError(message, errorOptions);
   }
   if (status >= 500) {
-    return new chunk4ZHTIJNE_cjs.NetworkError(message, errorOptions);
+    return new chunkJ7J7J2GN_cjs.NetworkError(message, errorOptions);
   }
-  return new chunk4ZHTIJNE_cjs.UnknownAgentError(message, errorOptions);
+  return new chunkJ7J7J2GN_cjs.UnknownAgentError(message, errorOptions);
 }
 function extractErrorEnvelope(body) {
   if (!body || typeof body !== "object") return {};
@@ -1444,7 +1375,7 @@ function parseHermesParams(inner) {
     if (key === void 0 || value === void 0) continue;
     input[key.trim()] = value;
   }
-  return chunk6JSIEDKL_cjs.sanitizeToolInput(input, { trim: true }).value;
+  return chunkYSTXFWQE_cjs.sanitizeToolInput(input, { trim: true }).value;
 }
 var STREAM_MARKER = "<function=";
 var DEFAULT_STREAM_BUFFER_CAP = 8192;
@@ -1641,7 +1572,7 @@ var OpenAIClient = class {
         endpoint: "/v1/chat/completions"
       });
       if (ollamaMapped !== void 0) throw ollamaMapped;
-      throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
+      throw chunk24SYBZPL_cjs.mapOpenAICompatibleError({
         providerId,
         status: response.status,
         body,
@@ -1677,7 +1608,7 @@ var OpenAIClient = class {
       }
       if (chunk.error !== void 0 && chunk.error !== null) {
         const status = typeof chunk.error.code === "number" ? chunk.error.code : 502;
-        throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
+        throw chunk24SYBZPL_cjs.mapOpenAICompatibleError({
           providerId,
           status,
           body: chunk,
@@ -1689,7 +1620,7 @@ var OpenAIClient = class {
       for (const event of events) yield event;
     }
     if (!sawDone && !accumulator.finishReasonSeen) {
-      throw new chunk4ZHTIJNE_cjs.NetworkError("SSE stream truncated (no finish_reason / [DONE])", {
+      throw new chunkJ7J7J2GN_cjs.NetworkError("SSE stream truncated (no finish_reason / [DONE])", {
         code: "stream_truncated"
       });
     }
@@ -1821,13 +1752,13 @@ var OpenAIStreamAccumulator = class {
         toolCalls.push(...recovered.toolCalls);
         text = recovered.residualText;
         stopReason = "tool_use";
-        chunkEG4QM7ZJ_cjs.diag(
+        chunk6LHQPOMI_cjs.diag(
           `[theokit-sdk] recovered ${recovered.toolCalls.length} leaked tool call(s) from assistant content (provider="${this.providerName}", names=${recovered.toolCalls.map((c) => c.name).join(",")})
 `
         );
       }
       if (recovered.droppedNames.length > 0) {
-        chunkEG4QM7ZJ_cjs.diag(
+        chunk6LHQPOMI_cjs.diag(
           `[theokit-sdk] dropped ${recovered.droppedNames.length} leaked block(s) whose name is not a tool in the request (provider="${this.providerName}", names=${recovered.droppedNames.join(",")})
 `
         );
@@ -1900,7 +1831,7 @@ function encodeOpenAIResponseFormat(rf) {
   };
 }
 
-// src/internal/resilience/circuit-breaker.ts
+// src/internal/retry/circuit-breaker.ts
 var DEFAULT_MAX_TIMEOUTS = 3;
 var DEFAULT_COOLDOWN_MS = 6e4;
 var CircuitBreaker = class {
@@ -1942,6 +1873,12 @@ var CircuitBreaker = class {
   }
 };
 
+// src/internal/llm/abort-error.ts
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  return new Error(signal.reason !== void 0 ? String(signal.reason) : "aborted");
+}
+
 // src/internal/llm/stream-relay.ts
 async function tryFirstEvent(client, request, signal, logFallback = false) {
   const generator = client.stream(request, signal);
@@ -1949,10 +1886,10 @@ async function tryFirstEvent(client, request, signal, logFallback = false) {
     const firstResult = await generator.next();
     return { kind: "ok", generator, firstResult };
   } catch (cause) {
-    if (cause instanceof chunk4ZHTIJNE_cjs.NetworkError || cause instanceof chunk4ZHTIJNE_cjs.RateLimitError || cause instanceof chunk4ZHTIJNE_cjs.AuthenticationError) {
+    if (cause instanceof chunkJ7J7J2GN_cjs.NetworkError || cause instanceof chunkJ7J7J2GN_cjs.RateLimitError || cause instanceof chunkJ7J7J2GN_cjs.AuthenticationError) {
       if (logFallback) {
         const errCode = cause.metadata?.code ?? cause.code ?? "unknown";
-        chunkEG4QM7ZJ_cjs.diag(`[theokit-sdk] provider ${client.name} failed (${errCode}): falling back
+        chunk6LHQPOMI_cjs.diag(`[theokit-sdk] provider ${client.name} failed (${errCode}): falling back
 `);
       }
       return { kind: "handshake_error", error: cause };
@@ -1994,7 +1931,7 @@ var PoolAwareLlmClient = class {
   // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stream() must serialize pool-select → build client → first-event probe → classify → retry/rotate/propagate. Extracting helpers fragments the linear narrative; the comments above each branch keep it readable.
   async *stream(request, signal) {
     if (this.breaker.shouldSkip(this.pool.provider)) {
-      throw new chunk4ZHTIJNE_cjs.NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
+      throw new chunkJ7J7J2GN_cjs.NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
         code: "circuit_open"
       });
     }
@@ -2013,7 +1950,7 @@ var PoolAwareLlmClient = class {
         }
         if (entry === null) {
           this.breaker.recordTimeout(this.pool.provider);
-          throw new chunk4ZHTIJNE_cjs.CredentialPoolExhaustedError(
+          throw new chunkJ7J7J2GN_cjs.CredentialPoolExhaustedError(
             `All ${this.pool.provider} credentials exhausted; next retry available at ${this.nextRetryHint() ?? "unknown"}`,
             { provider: this.pool.provider, nextRetryAt: this.nextRetryHint() }
           );
@@ -2027,13 +1964,13 @@ var PoolAwareLlmClient = class {
       }
       const decision = classifyAndDecide(attempt.error, hasRetried429);
       if (decision === "retry") {
-        const backoffMs = chunkO7DK5PBJ_cjs.computeBackoffMs({
+        const backoffMs = chunkQOGNZMHD_cjs.computeBackoffMs({
           attempt: 0,
           ...this.backoffBaseMs !== void 0 ? { baseMs: this.backoffBaseMs } : {},
           ...this.rng !== void 0 ? { rng: this.rng } : {}
         });
         this.onRateLimit?.({ attempt: 1, retryAfterMs: backoffMs });
-        await chunkO7DK5PBJ_cjs.sleepWithAbort(backoffMs, signal);
+        await chunkQOGNZMHD_cjs.sleepWithAbort(backoffMs, signal);
         hasRetried429 = true;
         continue;
       }
@@ -2045,7 +1982,7 @@ var PoolAwareLlmClient = class {
             ...parseRetryAfterMs(attempt.error) !== void 0 ? { resetAtMs: parseRetryAfterMs(attempt.error) } : {}
           });
         } catch (persistErr) {
-          chunkEG4QM7ZJ_cjs.diag(
+          chunk6LHQPOMI_cjs.diag(
             `[theokit-sdk] credential-pool: persist failed during rotate; continuing in-memory: ${persistErr instanceof Error ? persistErr.message : String(persistErr)}
 `
           );
@@ -2067,8 +2004,8 @@ var PoolAwareLlmClient = class {
   }
 };
 function classifyAndDecide(error, hasRetried429) {
-  if (error instanceof chunk4ZHTIJNE_cjs.NetworkError) return "propagate";
-  if (error instanceof chunk4ZHTIJNE_cjs.AuthenticationError) return "rotate";
+  if (error instanceof chunkJ7J7J2GN_cjs.NetworkError) return "propagate";
+  if (error instanceof chunkJ7J7J2GN_cjs.AuthenticationError) return "rotate";
   const status = error.metadata?.statusCode ?? 429;
   if (status === 402) return "rotate";
   return hasRetried429 ? "rotate" : "retry";
@@ -2081,14 +2018,10 @@ function parseRetryAfterMs(error) {
   return void 0;
 }
 function inferStatusCode(error) {
-  if (error instanceof chunk4ZHTIJNE_cjs.AuthenticationError) return 401;
-  if (error instanceof chunk4ZHTIJNE_cjs.RateLimitError) return 429;
+  if (error instanceof chunkJ7J7J2GN_cjs.AuthenticationError) return 401;
+  if (error instanceof chunkJ7J7J2GN_cjs.RateLimitError) return 429;
   return 0;
 }
-function abortError(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  return new Error("AbortError");
-}
 
 // src/internal/llm/responses.ts
 function messageToInputItems(message, reasoningByCallId) {
@@ -2175,6 +2108,142 @@ function applyPromptCachingFields(body, request, options) {
   if (carryReasoning) body.include = ["reasoning.encrypted_content"];
   if (request.promptCacheKey !== void 0) body.prompt_cache_key = request.promptCacheKey;
 }
+var ResponsesStreamAccumulator = class {
+  constructor(rememberReasoning) {
+    this.rememberReasoning = rememberReasoning;
+  }
+  rememberReasoning;
+  text = "";
+  toolCalls = [];
+  stopReason = "end_turn";
+  inputTokens;
+  outputTokens;
+  reasoningTokens;
+  cacheReadTokens;
+  cacheWriteTokens;
+  /** Function-call accumulation keyed by the streamed output-item id. */
+  pending = {};
+  /**
+   * usetheokit/theokit-sdk#383 — reasoning items seen so far in THIS response and not yet claimed
+   * by a tool call. Claimed (and cleared) when the next `function_call` completes, which is what
+   * binds each batch to the call it produced.
+   */
+  unclaimedReasoning = [];
+  /** The message of a terminal failure event, or `undefined` when this is not one. */
+  static failureMessage(event) {
+    if (event.type !== "response.failed" && event.type !== "error") return void 0;
+    return event.response?.error?.message ?? event.message ?? "responses stream failed";
+  }
+  consume(event) {
+    return this.applyDelta(event) ?? this.applyStructural(event) ?? [];
+  }
+  /** The three event kinds that produce an event for the consumer. */
+  applyDelta(event) {
+    const t = event.type;
+    if (t === "response.output_text.delta") {
+      const d = event.delta ?? "";
+      if (d.length === 0) return [];
+      this.text += d;
+      return [{ type: "text_delta", text: d }];
+    }
+    if (t === "response.reasoning_summary_text.delta" || t === "response.reasoning_text.delta") {
+      const d = event.delta ?? "";
+      return d.length > 0 ? [{ type: "reasoning_delta", text: d }] : [];
+    }
+    return void 0;
+  }
+  /** The event kinds that only move accumulator state. Routing only — each arm is its own method. */
+  applyStructural(event) {
+    const t = event.type;
+    if (t === "response.output_item.added" || t === "response.output_item.done") {
+      this.applyOutputItem(t, event);
+      return [];
+    }
+    if (t === "response.function_call_arguments.delta") {
+      this.appendArguments(event);
+      return [];
+    }
+    if (t === "response.completed" || t === "response.incomplete") {
+      this.applyTerminal(t, event);
+      return [];
+    }
+    return void 0;
+  }
+  appendArguments(event) {
+    const c = event.item_id !== void 0 ? this.pending[event.item_id] : void 0;
+    if (c !== void 0) c.args += event.delta ?? "";
+  }
+  applyTerminal(t, event) {
+    this.applyUsage(event.response?.usage);
+    this.stopReason = t === "response.incomplete" ? "max_tokens" : "end_turn";
+  }
+  finish() {
+    const stopReason = this.toolCalls.length > 0 && this.stopReason === "end_turn" ? "tool_use" : this.stopReason;
+    return makeLlmFinish({
+      stopReason,
+      text: this.text,
+      toolCalls: this.toolCalls,
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      reasoningTokens: this.reasoningTokens,
+      cacheReadTokens: this.cacheReadTokens,
+      cacheWriteTokens: this.cacheWriteTokens
+    });
+  }
+  applyOutputItem(t, event) {
+    const item = event.item;
+    if (item === void 0) return;
+    if (t === "response.output_item.added") {
+      if (item.type === "function_call") this.beginFunctionCall(item);
+      return;
+    }
+    if (item.type === "reasoning") this.applyReasoningItem(item);
+    else if (item.type === "function_call") this.applyFunctionCallDone(item);
+  }
+  beginFunctionCall(item) {
+    const id = item.id ?? item.call_id ?? "call-0";
+    this.pending[id] = {
+      callId: item.call_id ?? id,
+      name: item.name ?? "",
+      args: item.arguments ?? ""
+    };
+  }
+  applyReasoningItem(item) {
+    const id = item.id;
+    const encrypted = item.encrypted_content;
+    if (id !== void 0 && encrypted !== void 0 && encrypted.length > 0) {
+      this.unclaimedReasoning.push({ id, encrypted_content: encrypted });
+    }
+  }
+  applyFunctionCallDone(item) {
+    const id = item.id ?? item.call_id ?? "call-0";
+    const c = this.pending[id] ?? {
+      callId: item.call_id ?? id,
+      name: item.name ?? "",
+      args: item.arguments ?? ""
+    };
+    const call = {
+      type: "tool_use",
+      id: c.callId,
+      name: c.name.length > 0 ? c.name : item.name ?? "",
+      input: parseToolArguments(item.arguments ?? c.args)
+    };
+    this.toolCalls.push(call);
+    if (this.unclaimedReasoning.length > 0) {
+      this.rememberReasoning(call.id, this.unclaimedReasoning);
+      this.unclaimedReasoning = [];
+    }
+    delete this.pending[id];
+  }
+  applyUsage(usage) {
+    if (usage === void 0) return;
+    this.inputTokens = usage.input_tokens;
+    this.outputTokens = usage.output_tokens;
+    this.reasoningTokens = usage.output_tokens_details?.reasoning_tokens;
+    this.cacheReadTokens = usage.input_tokens_details?.cached_tokens;
+    this.cacheWriteTokens = usage.input_tokens_details?.cache_write_tokens;
+  }
+};
 var MAX_REMEMBERED_REASONING_CALLS = 256;
 var ResponsesApiClient = class {
   constructor(options) {
@@ -2207,20 +2276,17 @@ var ResponsesApiClient = class {
       this.reasoningByCallId.delete(oldest.value);
     }
   }
-  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: the SSE dispatch (text / reasoning / tool-call add+delta+done / terminal+usage / error) is one cohesive state machine, mirroring OpenAIStreamAccumulator.consume.
-  async *stream(request, signal) {
-    const providerId = this.options.providerName ?? "openai";
-    const headers = {
-      "content-type": "application/json",
-      accept: "text/event-stream",
-      authorization: `Bearer ${this.options.apiKey}`,
-      ...this.options.extraHeaders ?? {}
-    };
-    const url = `${this.baseUrl}/responses`;
-    const response = await this.fetchImpl(url, {
+  /** Issues the streaming request. Separated so `stream()` reads as fetch → check → consume. */
+  async post(request, signal) {
+    return await this.fetchImpl(`${this.baseUrl}/responses`, {
       method: "POST",
       signal,
-      headers,
+      headers: {
+        "content-type": "application/json",
+        accept: "text/event-stream",
+        authorization: `Bearer ${this.options.apiKey}`,
+        ...this.options.extraHeaders ?? {}
+      },
       body: JSON.stringify(
         // Both options ride the SAME flag on purpose: a provider that never declared support gets
         // the byte-identical pre-#383 body, even in the impossible case where it returned ciphertext
@@ -2231,140 +2297,78 @@ var ResponsesApiClient = class {
         )
       )
     });
-    if (!response.ok) {
-      const text2 = await response.text().catch(() => "");
-      let body = text2;
+  }
+  /** Maps a non-2xx response to a typed error. Returns it rather than throwing, so the caller's
+   * control flow stays visible at the call site. */
+  async errorFor(response, providerId) {
+    const text = await response.text().catch(() => "");
+    let body = text;
+    try {
+      body = JSON.parse(text);
+    } catch {
+    }
+    return chunk24SYBZPL_cjs.mapOpenAICompatibleError({
+      providerId,
+      status: response.status,
+      body,
+      headers: response.headers,
+      endpoint: "/responses"
+    });
+  }
+  /**
+   * SSE frames → parsed events, stopping at `[DONE]`. A frame that is not JSON is skipped rather
+   * than fatal: a provider that emits a keep-alive or a comment frame must not end the response.
+   */
+  async *decode(body, signal) {
+    for await (const record of parseSseStream(body, signal)) {
+      if (record.data === "[DONE]") return;
+      let event;
       try {
-        body = JSON.parse(text2);
+        event = JSON.parse(record.data);
       } catch {
+        continue;
       }
-      throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
-        providerId,
-        status: response.status,
-        body,
-        headers: response.headers,
-        endpoint: "/responses"
-      });
+      yield event;
     }
-    let text = "";
-    const toolCalls = [];
-    let stopReason = "end_turn";
-    let inputTokens;
-    let outputTokens;
-    let reasoningTokens;
-    let cacheReadTokens;
-    let cacheWriteTokens;
-    const pending = {};
-    let unclaimedReasoning = [];
+  }
+  async *stream(request, signal) {
+    const providerId = this.options.providerName ?? "openai";
+    const response = await this.post(request, signal);
+    if (!response.ok) throw await this.errorFor(response, providerId);
+    const acc = new ResponsesStreamAccumulator(
+      (callId, items) => this.rememberReasoning(callId, items)
+    );
     if (response.body !== null) {
-      for await (const record of parseSseStream(response.body, signal)) {
-        if (record.data === "[DONE]") break;
-        let event;
-        try {
-          event = JSON.parse(record.data);
-        } catch {
-          continue;
-        }
-        const t = event.type;
-        if (t === "response.output_text.delta") {
-          const d = event.delta ?? "";
-          if (d.length > 0) {
-            text += d;
-            yield { type: "text_delta", text: d };
-          }
-        } else if (t === "response.reasoning_summary_text.delta" || t === "response.reasoning_text.delta") {
-          const d = event.delta ?? "";
-          if (d.length > 0) yield { type: "reasoning_delta", text: d };
-        } else if (t === "response.output_item.done" && event.item?.type === "reasoning") {
-          const id = event.item.id;
-          const encrypted = event.item.encrypted_content;
-          if (id !== void 0 && encrypted !== void 0 && encrypted.length > 0) {
-            unclaimedReasoning.push({ id, encrypted_content: encrypted });
-          }
-        } else if (t === "response.output_item.added" && event.item?.type === "function_call") {
-          const id = event.item.id ?? event.item.call_id ?? "call-0";
-          pending[id] = {
-            callId: event.item.call_id ?? id,
-            name: event.item.name ?? "",
-            args: event.item.arguments ?? ""
-          };
-        } else if (t === "response.function_call_arguments.delta") {
-          const c = event.item_id !== void 0 ? pending[event.item_id] : void 0;
-          if (c !== void 0) c.args += event.delta ?? "";
-        } else if (t === "response.output_item.done" && event.item?.type === "function_call") {
-          const id = event.item.id ?? event.item.call_id ?? "call-0";
-          const c = pending[id] ?? {
-            callId: event.item.call_id ?? id,
-            name: event.item.name ?? "",
-            args: event.item.arguments ?? ""
-          };
-          const rawArgs = event.item.arguments ?? c.args;
-          const call = {
-            type: "tool_use",
-            id: c.callId,
-            name: c.name.length > 0 ? c.name : event.item.name ?? "",
-            input: parseToolArguments(rawArgs)
-          };
-          toolCalls.push(call);
-          if (unclaimedReasoning.length > 0) {
-            this.rememberReasoning(call.id, unclaimedReasoning);
-            unclaimedReasoning = [];
-          }
-          delete pending[id];
-        } else if (t === "response.completed" || t === "response.incomplete") {
-          const usage = event.response?.usage;
-          if (usage !== void 0) {
-            inputTokens = usage.input_tokens;
-            outputTokens = usage.output_tokens;
-            reasoningTokens = usage.output_tokens_details?.reasoning_tokens;
-            cacheReadTokens = usage.input_tokens_details?.cached_tokens;
-            cacheWriteTokens = usage.input_tokens_details?.cache_write_tokens;
-          }
-          stopReason = t === "response.incomplete" ? "max_tokens" : "end_turn";
-        } else if (t === "response.failed" || t === "error") {
-          const msg = event.response?.error?.message ?? event.message ?? "responses stream failed";
-          yield { type: "error", message: msg };
-          throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
+      for await (const event of this.decode(response.body, signal)) {
+        const failure = ResponsesStreamAccumulator.failureMessage(event);
+        if (failure !== void 0) {
+          yield { type: "error", message: failure };
+          throw chunk24SYBZPL_cjs.mapOpenAICompatibleError({
             providerId,
             status: 502,
-            body: { error: { message: msg } },
+            body: { error: { message: failure } },
             headers: response.headers,
             endpoint: "/responses"
           });
         }
+        yield* acc.consume(event);
       }
     }
-    if (toolCalls.length > 0 && stopReason === "end_turn") stopReason = "tool_use";
-    return makeLlmFinish({
-      stopReason,
-      text,
-      toolCalls,
-      inputTokens,
-      outputTokens,
-      reasoningTokens,
-      cacheReadTokens,
-      cacheWriteTokens
-    });
+    return acc.finish();
   }
 };
 
-// src/internal/llm/abort-error.ts
-function abortError2(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  return new Error(signal.reason !== void 0 ? String(signal.reason) : "aborted");
-}
-
 // src/internal/llm/retrying-client.ts
 var MAX_ATTEMPTS = 3;
 function isRetriableError(err) {
-  if (!chunk4ZHTIJNE_cjs.isTransientError(err)) return false;
-  if (err instanceof chunk4ZHTIJNE_cjs.CredentialPoolExhaustedError) return false;
-  if (err instanceof chunk4ZHTIJNE_cjs.TheokitAgentError && err.code === "circuit_open") return false;
-  if (err instanceof chunk4ZHTIJNE_cjs.RateLimitError && err.metadata?.statusCode === 402) return false;
+  if (!chunkJ7J7J2GN_cjs.isTransientError(err)) return false;
+  if (err instanceof chunkJ7J7J2GN_cjs.CredentialPoolExhaustedError) return false;
+  if (err instanceof chunkJ7J7J2GN_cjs.TheokitAgentError && err.code === "circuit_open") return false;
+  if (err instanceof chunkJ7J7J2GN_cjs.RateLimitError && err.metadata?.statusCode === 402) return false;
   return true;
 }
 function retryAfterHintMs(err) {
-  if (!(err instanceof chunk4ZHTIJNE_cjs.RateLimitError)) return void 0;
+  if (!(err instanceof chunkJ7J7J2GN_cjs.RateLimitError)) return void 0;
   const seconds = err.metadata?.retryAfter;
   return typeof seconds === "number" && seconds > 0 ? seconds * 1e3 : void 0;
 }
@@ -2410,21 +2414,21 @@ var RetryingLlmClient = class {
    */
   async #waitBackoff(err, attempt, signal) {
     const hint = retryAfterHintMs(err);
-    const ms = chunkO7DK5PBJ_cjs.computeBackoffMs({
+    const ms = chunkQOGNZMHD_cjs.computeBackoffMs({
       attempt,
       ...hint !== void 0 ? { retryAfterMs: hint } : {},
       ...this.#rng !== void 0 ? { rng: this.#rng } : {}
     });
     const cause = err instanceof Error ? err.name : typeof err;
-    chunkEG4QM7ZJ_cjs.diag(
+    chunk6LHQPOMI_cjs.diag(
       `retry ${attempt + 1}/${MAX_ATTEMPTS} in ${String(ms)}ms \u2014 ${cause}` + (hint !== void 0 ? ` (Retry-After: ${String(hint)}ms)` : "")
     );
-    await chunkO7DK5PBJ_cjs.sleepWithAbort(ms, signal);
+    await chunkQOGNZMHD_cjs.sleepWithAbort(ms, signal);
   }
   async *stream(request, signal) {
     let lastError;
     for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
-      if (signal.aborted) throw lastError ?? abortError2(signal);
+      if (signal.aborted) throw lastError ?? abortError(signal);
       const state = { emitted: false };
       try {
         return yield* consume(this.#inner.stream(request, signal), state);
@@ -2447,17 +2451,17 @@ var VERTEX_RULES = [
     test: (s, e) => s === 400 || e === "INVALID_ARGUMENT" || e === "FAILED_PRECONDITION" || e === "NOT_FOUND",
     code: "invalid_request"
   },
-  { test: (s, e) => s === 408 || e === "DEADLINE_EXCEEDED", code: "timeout" },
-  { test: (s) => s >= 500, code: "server_error" }
+  { test: (s, e) => s === 408 || e === "DEADLINE_EXCEEDED", code: "timeout" }
 ];
 function classifyVertexError(args, errStatus) {
   for (const rule of VERTEX_RULES) {
     if (rule.test(args.status, errStatus)) return rule.code;
   }
-  return "unknown";
+  const shared = chunk24SYBZPL_cjs.httpStatusToErrorCode(args.status);
+  return shared === "auth_failed" ? "auth_permission" : shared;
 }
 function vertexMetadata(args, code) {
-  return chunkUGT7GK7I_cjs.buildErrorMetadata({
+  return chunk24SYBZPL_cjs.buildErrorMetadata({
     provider: "vertex",
     endpoint: args.endpoint,
     code,
@@ -2467,42 +2471,34 @@ function vertexMetadata(args, code) {
   });
 }
 var VERTEX_ERROR_BUILDERS = {
-  rate_limit: (args, msg) => new chunk4ZHTIJNE_cjs.RateLimitError(`Vertex quota exhausted: ${msg}`, {
+  rate_limit: (args, msg) => new chunkJ7J7J2GN_cjs.RateLimitError(`Vertex quota exhausted: ${msg}`, {
     metadata: vertexMetadata(args, "rate_limit")
   }),
-  auth_unauthenticated: (args, msg) => new chunk4ZHTIJNE_cjs.AuthenticationError(`Vertex unauthenticated: ${msg}`, {
+  auth_unauthenticated: (args, msg) => new chunkJ7J7J2GN_cjs.AuthenticationError(`Vertex unauthenticated: ${msg}`, {
     metadata: vertexMetadata(args, "auth_failed")
   }),
-  auth_permission: (args, msg) => new chunk4ZHTIJNE_cjs.AuthenticationError(`Vertex permission denied: ${msg}`, {
+  auth_permission: (args, msg) => new chunkJ7J7J2GN_cjs.AuthenticationError(`Vertex permission denied: ${msg}`, {
     metadata: vertexMetadata(args, "auth_failed")
   }),
-  invalid_request: (args, msg) => new chunk4ZHTIJNE_cjs.ConfigurationError(`Vertex validation: ${msg}`, {
+  invalid_request: (args, msg) => new chunkJ7J7J2GN_cjs.ConfigurationError(`Vertex validation: ${msg}`, {
     metadata: vertexMetadata(args, "invalid_request")
   }),
-  timeout: (args, msg) => new chunk4ZHTIJNE_cjs.NetworkError(`Vertex timeout: ${msg}`, { metadata: vertexMetadata(args, "timeout") }),
-  server_error: (args, msg) => new chunk4ZHTIJNE_cjs.NetworkError(`Vertex server error: ${msg}`, {
+  quota_exceeded: (args, msg) => new chunkJ7J7J2GN_cjs.RateLimitError(`Vertex quota exceeded: ${msg}`, {
+    metadata: vertexMetadata(args, "quota_exceeded")
+  }),
+  timeout: (args, msg) => new chunkJ7J7J2GN_cjs.NetworkError(`Vertex timeout: ${msg}`, { metadata: vertexMetadata(args, "timeout") }),
+  server_error: (args, msg) => new chunkJ7J7J2GN_cjs.NetworkError(`Vertex server error: ${msg}`, {
     metadata: vertexMetadata(args, "server_error")
   }),
-  unknown: (args, msg) => new chunk4ZHTIJNE_cjs.UnknownAgentError(`Vertex unknown: ${msg}`, { metadata: vertexMetadata(args, "unknown") })
+  unknown: (args, msg) => new chunkJ7J7J2GN_cjs.UnknownAgentError(`Vertex unknown: ${msg}`, { metadata: vertexMetadata(args, "unknown") })
 };
 function mapVertexError(args) {
-  const parsed = parseBody2(args.body);
+  const parsed = chunk24SYBZPL_cjs.parseErrorBody(args.body);
   const errStatus = parsed.error?.status ?? "";
   const message = parsed.error?.message ?? "Vertex request failed";
   const code = classifyVertexError(args, errStatus);
   return VERTEX_ERROR_BUILDERS[code](args, message);
 }
-function parseBody2(body) {
-  if (body !== null && typeof body === "object") return body;
-  if (typeof body === "string") {
-    try {
-      return JSON.parse(body);
-    } catch {
-      return {};
-    }
-  }
-  return {};
-}
 var cachedAuthClient;
 var SCOPE_CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";
 async function resolveVertexAccessToken() {
@@ -2519,12 +2515,12 @@ async function resolveVertexAccessToken() {
 async function getAuthClientOrThrow() {
   let mod;
   try {
-    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-KYAJINUI.cjs', document.baseURI).href)));
+    const r = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-2HPNT6HH.cjs', document.baseURI).href)));
     mod = r("google-auth-library");
   } catch (err) {
     const isModuleMissing = err instanceof Error && (err.message.includes("Cannot find module") || err.code === "MODULE_NOT_FOUND");
     if (isModuleMissing) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         "Vertex provider requires `google-auth-library`. Install: `pnpm add google-auth-library`.",
         { code: "auth_failed", cause: err }
       );
@@ -2535,7 +2531,7 @@ async function getAuthClientOrThrow() {
     const auth = new mod.GoogleAuth({ scopes: [SCOPE_CLOUD_PLATFORM] });
     return await auth.getClient();
   } catch (err) {
-    chunkEG4QM7ZJ_cjs.diag(
+    chunk6LHQPOMI_cjs.diag(
       `[theokit-sdk] Vertex ADC initialization failed: ${err instanceof Error ? err.message : String(err)}
 `
     );
@@ -2561,7 +2557,7 @@ var VertexAnthropicClient = class {
   resolveProjectOrThrow() {
     const projectId = this.options.projectId ?? resolveVertexProjectId();
     if (projectId !== void 0) return projectId;
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
       { code: "auth_failed" }
     );
@@ -2571,7 +2567,7 @@ var VertexAnthropicClient = class {
     if (fromOpts !== void 0 && fromOpts.length > 0) return fromOpts;
     const fromAdc = await resolveVertexAccessToken();
     if (fromAdc !== void 0 && fromAdc.length > 0) return fromAdc;
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
       { code: "auth_failed" }
     );
@@ -2580,8 +2576,8 @@ var VertexAnthropicClient = class {
     const projectId = this.resolveProjectOrThrow();
     const location = this.options.location ?? resolveVertexLocation();
     const accessToken = await this.resolveTokenOrThrow();
-    const baseUrl = chunkHCZD23VS_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "anthropic" });
-    const bareModel = chunkHCZD23VS_cjs.stripVertexPrefix(request.model);
+    const baseUrl = chunkQC55H6RJ_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "anthropic" });
+    const bareModel = chunkQC55H6RJ_cjs.stripVertexPrefix(request.model);
     const endpoint = `/models/${encodeURIComponent(bareModel)}:rawPredict`;
     const url = `${baseUrl}${endpoint}`;
     const response = await postAnthropicRequest({
@@ -2617,7 +2613,7 @@ var VertexGeminiClient = class {
   async *stream(request, signal) {
     const projectId = this.options.projectId ?? resolveVertexProjectId();
     if (projectId === void 0) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         "Vertex requires a project id. Set GOOGLE_CLOUD_PROJECT env var or run `gcloud config set project <id>`.",
         { code: "auth_failed" }
       );
@@ -2625,12 +2621,12 @@ var VertexGeminiClient = class {
     const location = this.options.location ?? resolveVertexLocation();
     const accessToken = this.options.apiKey !== void 0 && this.options.apiKey.length > 0 ? this.options.apiKey : await resolveVertexAccessToken();
     if (accessToken === void 0 || accessToken.length === 0) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         "Vertex could not resolve an access token. Run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON path.",
         { code: "auth_failed" }
       );
     }
-    const baseUrl = chunkHCZD23VS_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "gemini" });
+    const baseUrl = chunkQC55H6RJ_cjs.resolveVertexBaseUrl({ projectId, location, modelDialect: "gemini" });
     const url = `${baseUrl}/chat/completions`;
     const innerFetch = this.options.fetch ?? fetch;
     const rewriteFetch = (_input, init) => innerFetch(url, init);
@@ -2652,7 +2648,7 @@ var VertexRouterClient = class {
   options;
   name = "vertex";
   async *stream(request, signal) {
-    const dialect = chunkHCZD23VS_cjs.inferModelDialect(request.model);
+    const dialect = chunkQC55H6RJ_cjs.inferModelDialect(request.model);
     if (dialect === "anthropic") {
       const inner2 = new VertexAnthropicClient(this.options);
       return yield* inner2.stream(request, signal);
@@ -2664,7 +2660,7 @@ var VertexRouterClient = class {
 
 // src/internal/llm/router.ts
 function resolveProviderChain(options) {
-  chunkHCZD23VS_cjs.registerBuiltins();
+  chunkQC55H6RJ_cjs.registerBuiltins();
   return buildChain(options);
 }
 function buildChain(options) {
@@ -2681,27 +2677,25 @@ function buildChain(options) {
   addClient(options.primary, options.baseUrl);
   for (const fallback of options.fallback ?? []) addClient(fallback);
   if (clients.length === 0) {
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       `No provider client could be resolved (primary=${options.primary}). Set ANTHROPIC_API_KEY or OPENAI_API_KEY / OPENROUTER_API_KEY.`,
       { code: "provider_unresolved" }
     );
   }
   return clients;
 }
-function buildClient(name, routerOptions, perCallBaseUrl) {
-  const baseProfile = chunkHCZD23VS_cjs.getProviderProfile(name);
+function buildTransport(name, routerOptions, perCallBaseUrl) {
+  const baseProfile = chunkQC55H6RJ_cjs.getProviderProfile(name);
   if (baseProfile === void 0) return void 0;
   const profile = routerOptions.extractToolCallsFromContent === true && baseProfile.extractToolCallsFromContent !== true ? { ...baseProfile, extractToolCallsFromContent: true } : baseProfile;
   const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
-  const ambient = chunkO7DK5PBJ_cjs.currentCredentialPool(name);
+  const ambient = chunkFUSDYC2B_cjs.currentCredentialPool(name);
   if (ambient !== void 0) {
-    return new RetryingLlmClient(
-      new PoolAwareLlmClient(
-        ambient,
-        (apiKey) => selectTransport(profile, apiKey, perCallBaseUrl),
-        void 0,
-        resilience
-      )
+    return new PoolAwareLlmClient(
+      ambient,
+      (apiKey) => selectTransport(profile, apiKey, perCallBaseUrl),
+      void 0,
+      resilience
     );
   }
   const poolKeys = filterPoolKeys(routerOptions.apiKeys?.[name]);
@@ -2709,6 +2703,10 @@ function buildClient(name, routerOptions, perCallBaseUrl) {
   if (noAuthOverride !== void 0) return noAuthOverride;
   return buildPoolOrSingle({ name, profile, poolKeys, routerOptions, perCallBaseUrl });
 }
+function buildClient(name, routerOptions, perCallBaseUrl) {
+  const transport = buildTransport(name, routerOptions, perCallBaseUrl);
+  return transport === void 0 ? void 0 : new RetryingLlmClient(transport);
+}
 function maybeBuildNoAuthTransport(profile, poolKeys, baseUrl) {
   if (profile.authType !== "none" || poolKeys === void 0 || poolKeys.length === 0) {
     return void 0;
@@ -2723,22 +2721,20 @@ function buildPoolOrSingle(args) {
   if (poolKeys !== void 0 && poolKeys.length >= 2) {
     const strategy = routerOptions.credentialPoolStrategy?.[name] ?? "fill_first";
     const entries = poolKeys.map(
-      (accessToken, priority) => chunkO7DK5PBJ_cjs.newPooledCredential({ provider: name, accessToken, priority, source: "manual" })
+      (accessToken, priority) => chunkFUSDYC2B_cjs.newPooledCredential({ provider: name, accessToken, priority, source: "manual" })
     );
-    const pool = new chunkO7DK5PBJ_cjs.CredentialPool(name, entries, strategy);
+    const pool = new chunkFUSDYC2B_cjs.CredentialPool(name, entries, strategy);
     const resilience = routerOptions.onRateLimit !== void 0 ? { onRateLimit: routerOptions.onRateLimit } : {};
-    return new RetryingLlmClient(
-      new PoolAwareLlmClient(
-        pool,
-        (apiKey2) => selectTransport(profile, apiKey2, perCallBaseUrl),
-        void 0,
-        resilience
-      )
+    return new PoolAwareLlmClient(
+      pool,
+      (apiKey2) => selectTransport(profile, apiKey2, perCallBaseUrl),
+      void 0,
+      resilience
     );
   }
   const apiKey = poolKeys?.[0] ?? resolveApiKey(profile.envVars) ?? sentinelForNoAuth(profile) ?? sentinelForLazyAuth(profile);
   if (apiKey === void 0) return void 0;
-  return new RetryingLlmClient(selectTransport(profile, apiKey, perCallBaseUrl));
+  return selectTransport(profile, apiKey, perCallBaseUrl);
 }
 function resolveBaseUrlEnvOverride(providerName) {
   switch (providerName) {
@@ -2758,7 +2754,7 @@ var warnedNoAuthApiKeys = /* @__PURE__ */ new Set();
 function warnNoAuthApiKeysIgnoredOnce(provider) {
   if (warnedNoAuthApiKeys.has(provider)) return;
   warnedNoAuthApiKeys.add(provider);
-  chunkEG4QM7ZJ_cjs.diag(
+  chunk6LHQPOMI_cjs.diag(
     `[theokit-sdk] provider "${provider}" has authType: "none" \u2014 apiKeys ignored (no auth required for local runtime).
 `
   );
@@ -2784,10 +2780,10 @@ function warnUnknownProvidersInApiKeys(apiKeys) {
   if (apiKeys === void 0) return;
   for (const name of Object.keys(apiKeys)) {
     if (warnedProviders.has(name)) continue;
-    const profile = chunkHCZD23VS_cjs.getProviderProfile(name);
+    const profile = chunkQC55H6RJ_cjs.getProviderProfile(name);
     if (profile === void 0) {
       warnedProviders.add(name);
-      chunkEG4QM7ZJ_cjs.diag(
+      chunk6LHQPOMI_cjs.diag(
         `[theokit-sdk] credential-pool: unknown provider "${name}" in apiKeys (no profile registered)
 `
       );
@@ -2807,7 +2803,7 @@ function selectTransport(profile, apiKey, baseUrl) {
     const ctx = { apiKey };
     return { fetch: profile.transform.fetch?.(ctx), headers: profile.transform.headers?.(ctx) };
   };
-  const comTransform = (opts, construct) => {
+  const withTransform = (opts, construct) => {
     const t = applyTransform();
     assertOAuthResolved(t);
     if (t.fetch !== void 0) opts.fetch = t.fetch;
@@ -2819,7 +2815,7 @@ function selectTransport(profile, apiKey, baseUrl) {
     if (apiKey !== "__oauth_lazy_token__") return;
     const auth = t.headers?.authorization ?? t.headers?.Authorization;
     if (t.fetch === void 0 && auth === void 0) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         `provider "${profile.name}" uses OAuth (authType: ${profile.authType}) but no credential was resolved. Register a ProviderProfile.transform whose fetch (or headers.authorization) supplies the bearer \u2014 typically via resolveCredential() from "@theokit/sdk/auth".`
       );
     }
@@ -2844,7 +2840,7 @@ function selectTransport(profile, apiKey, baseUrl) {
     const envOverride = resolveBaseUrlEnvOverride(profile.name);
     if (envOverride !== void 0) opts.baseUrl = envOverride;
     if (baseUrl !== void 0) opts.baseUrl = baseUrl;
-    return comTransform(opts, (o) => new OpenAIClient(o));
+    return withTransform(opts, (o) => new OpenAIClient(o));
   }
   if (profile.apiMode === "anthropic_messages") {
     if (profile.name === "vertex") {
@@ -2853,7 +2849,7 @@ function selectTransport(profile, apiKey, baseUrl) {
     }
     const opts = { apiKey };
     opts.baseUrl = baseUrl ?? process.env.ANTHROPIC_API_BASE_URL ?? profile.baseUrl;
-    return comTransform(opts, (o) => new AnthropicClient(o));
+    return withTransform(opts, (o) => new AnthropicClient(o));
   }
   if (profile.apiMode === "bedrock_anthropic") {
     const realKey = apiKey === "__bedrock_lazy_token__" ? void 0 : apiKey;
@@ -2878,17 +2874,172 @@ function selectTransport(profile, apiKey, baseUrl) {
       providerName: profile.name
     });
   }
-  throw new chunk4ZHTIJNE_cjs.ConfigurationError(
-    `Provider "${profile.name}" requires apiMode "${profile.apiMode}" but no transport is registered. Install a third-party transport plugin (@theokit-transport-${profile.apiMode}) or use a provider with apiMode "chat_completions" or "anthropic_messages".`,
+  throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+    `Provider "${profile.name}" declares apiMode "${profile.apiMode}", which this SDK has no transport for. Transports are built in and cannot be extended by a plugin; the supported modes are "chat_completions", "anthropic_messages", "bedrock_anthropic" and "responses_api". Change the provider's apiMode to one of those, or open an issue if the provider genuinely speaks a fifth protocol.`,
     { code: "transport_unavailable" }
   );
 }
 
+// src/internal/auth/api-key-validator.ts
+var FIXTURE_KEY_PREFIX = "theo_test_";
+var LOCAL_RUNTIME_MOCK_KEY = "local";
+var MIN_KEY_LENGTH = 16;
+var KNOWN_PROVIDER_PREFIXES = [
+  { provider: "openai", prefix: "sk-" },
+  { provider: "anthropic", prefix: "sk-ant-" },
+  { provider: "openrouter", prefix: "sk-or-" }
+];
+function validateApiKeyShape(key, options = {}) {
+  const opts = typeof options === "string" ? { provider: options } : options;
+  const tier1 = checkTier1(key);
+  if (tier1.malformed) return tier1;
+  const validKey = key;
+  if (validKey.startsWith(FIXTURE_KEY_PREFIX) || validKey === LOCAL_RUNTIME_MOCK_KEY) {
+    return { malformed: false };
+  }
+  if (opts.strict === false) return { malformed: false };
+  return checkTier2(validKey, opts.provider);
+}
+function checkTier1(key) {
+  if (key === void 0 || key.length === 0) {
+    return { malformed: true, reason: "empty", message: "API key is empty." };
+  }
+  if (key.trim().length === 0) {
+    return {
+      malformed: true,
+      reason: "whitespace_only",
+      message: "API key contains only whitespace."
+    };
+  }
+  if (key.length < 4) {
+    return {
+      malformed: true,
+      reason: "too_short",
+      message: `API key must be at least 4 chars (got ${key.length}).`
+    };
+  }
+  return { malformed: false };
+}
+function checkTier2(key, provider) {
+  if (key.length < MIN_KEY_LENGTH) {
+    return {
+      malformed: true,
+      reason: "too_short",
+      message: `API key must be at least ${MIN_KEY_LENGTH} chars (got ${key.length}).`
+    };
+  }
+  if (/\s/.test(key)) {
+    return {
+      malformed: true,
+      reason: "embedded_whitespace",
+      message: "API key contains embedded whitespace."
+    };
+  }
+  return checkProviderPrefix(key, provider);
+}
+function checkProviderPrefix(key, provider) {
+  if (provider === void 0) return { malformed: false };
+  const hint = KNOWN_PROVIDER_PREFIXES.find((p) => p.provider === provider.toLowerCase());
+  if (hint === void 0) return { malformed: false };
+  if (!key.startsWith(hint.prefix)) {
+    return {
+      malformed: true,
+      reason: "missing_known_prefix",
+      message: `API key for provider "${hint.provider}" expected to start with "${hint.prefix}".`
+    };
+  }
+  return { malformed: false };
+}
+
+// src/internal/providers/register-plugin-providers.ts
+function registerPluginProviderProfiles(entries) {
+  let registered = 0;
+  for (const entry of entries) {
+    chunkQC55H6RJ_cjs.registerProvider(entry.profile);
+    registered += 1;
+  }
+  return registered;
+}
+var PROVIDER_CREDENTIAL_ENV_VARS = [
+  "ANTHROPIC_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY"
+];
+function presentProviderCredentialEnvVars() {
+  return PROVIDER_CREDENTIAL_ENV_VARS.filter((name) => {
+    const value = process.env[name];
+    return typeof value === "string" && value.length > 0;
+  });
+}
+var AMBIENT_STORE = {
+  home: os.homedir(),
+  dirName: ".theokit",
+  fileName: "auth.json",
+  homeEnvVar: "THEOKIT_AUTH_HOME"
+};
+function isStoredOAuthAvailable(env = process.env) {
+  try {
+    return chunkEXTRW7GW_cjs.readStoredOAuth(AMBIENT_STORE, env) !== void 0;
+  } catch {
+    return false;
+  }
+}
+function isAwsBedrockAuthAvailable() {
+  if (typeof process.env.AWS_BEARER_TOKEN_BEDROCK === "string" && process.env.AWS_BEARER_TOKEN_BEDROCK.length > 0) {
+    return true;
+  }
+  if (typeof process.env.AWS_ACCESS_KEY_ID === "string" && process.env.AWS_ACCESS_KEY_ID.length > 0) {
+    return true;
+  }
+  if (typeof process.env.AWS_PROFILE === "string" && process.env.AWS_PROFILE.length > 0) {
+    return true;
+  }
+  return awsCredentialsFileExists();
+}
+function awsCredentialsFileExists() {
+  try {
+    const home = process.env.HOME ?? process.env.USERPROFILE;
+    if (home === void 0 || home.length === 0) return false;
+    return fs.existsSync(`${home}/.aws/credentials`) || fs.existsSync(`${home}/.aws/config`);
+  } catch {
+    return false;
+  }
+}
+function isGcpVertexAuthAvailable() {
+  if (typeof process.env.GOOGLE_APPLICATION_CREDENTIALS === "string" && process.env.GOOGLE_APPLICATION_CREDENTIALS.length > 0) {
+    return true;
+  }
+  if (typeof process.env.GOOGLE_CLOUD_PROJECT === "string" && process.env.GOOGLE_CLOUD_PROJECT.length > 0) {
+    return true;
+  }
+  return false;
+}
+function isLocalNoAuthProviderAvailable() {
+  return true;
+}
+
+// src/internal/runtime/fixtures/fixture-mode.ts
+var FIXTURE_API_KEY_PREFIX = "theo_test_";
+function isFixtureApiKey(apiKey) {
+  if (apiKey === void 0) return false;
+  return apiKey.startsWith(FIXTURE_API_KEY_PREFIX);
+}
+function shouldUseFixtureMode(apiKey) {
+  if (getConfiguredBaseUrl() !== void 0) return false;
+  return isFixtureApiKey(apiKey);
+}
+function shouldUseRealLocalRuntime(apiKey) {
+  if (isFixtureApiKey(apiKey)) return false;
+  if (isStoredOAuthAvailable()) return true;
+  if (apiKey === void 0 || apiKey.length === 0) return false;
+  return presentProviderCredentialEnvVars().length > 0 || isAwsBedrockAuthAvailable() || isGcpVertexAuthAvailable() || isLocalNoAuthProviderAvailable();
+}
+
 // src/internal/local-agent/real-local-run-provider.ts
 function inferProviderFromApiKey(apiKey) {
   const provider = chunkFRITRLZQ_cjs.providerFromApiKeyPrefix(apiKey);
   if (provider === void 0) return void 0;
-  return chunkHCZD23VS_cjs.getProviderProfile(provider) === void 0 ? void 0 : provider;
+  return chunkQC55H6RJ_cjs.getProviderProfile(provider) === void 0 ? void 0 : provider;
 }
 function detectPrimaryProvider() {
   if (process.env.ANTHROPIC_API_KEY !== void 0 && process.env.ANTHROPIC_API_KEY.length > 0) {
@@ -2908,11 +3059,37 @@ function warnProviderPrecedenceOnce(asked, used) {
   const key = `${asked}->${used}`;
   if (warnedProviderPrecedence.has(key)) return;
   warnedProviderPrecedence.add(key);
-  chunkEG4QM7ZJ_cjs.diag(
+  chunk6LHQPOMI_cjs.diag(
     `[theokit-sdk] model id names provider "${asked}", but "${used}" was used \u2014 an explicit \`providers.routes[0]\` or the API key's own prefix outranks the model id's prefix. Pass \`providers.routes\` to choose deliberately.
 `
   );
 }
+var pluginProvidersAnnounced = false;
+function resolveRunProvider(options) {
+  chunkQC55H6RJ_cjs.registerBuiltins();
+  const profiles = options.pluginManager?.aggregated.providerProfiles ?? [];
+  const registered = registerPluginProviderProfiles(profiles);
+  if (registered > 0 && !pluginProvidersAnnounced) {
+    pluginProvidersAnnounced = true;
+    const names = profiles.map((e) => e.profile.name).join(", ");
+    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] registered ${registered} plugin provider profile(s): ${names}
+`);
+  }
+  const parsedModel = chunk3EE6LVWT_cjs.parseModelId(options.model?.id);
+  const modelInferredProvider = parsedModel.provider !== void 0 && chunkQC55H6RJ_cjs.getProviderProfile(parsedModel.provider) !== void 0 ? parsedModel.provider : void 0;
+  const keyInferredProvider = inferProviderFromApiKey(options.agentOptions.apiKey);
+  const primary = options.agentOptions.providers?.routes?.[0]?.provider ?? keyInferredProvider ?? modelInferredProvider ?? detectPrimaryProvider();
+  warnProviderPrecedenceOnce(modelInferredProvider, primary);
+  const effectiveModelId = modelInferredProvider !== void 0 && modelInferredProvider === primary ? parsedModel.name : options.model?.id ?? "claude-sonnet-4-6";
+  return { primary, effectiveModelId };
+}
+function mergeExplicitApiKey(pools, primary, apiKey) {
+  if (apiKey === void 0 || apiKey.length === 0) return pools;
+  if (isFixtureApiKey(apiKey) || apiKey === LOCAL_RUNTIME_MOCK_KEY) return pools;
+  const existing = pools?.[primary];
+  if (existing !== void 0 && existing.length > 0) return pools;
+  return { ...pools ?? {}, [primary]: [apiKey] };
+}
 
 // src/internal/runtime/compression/compression-model-registry.ts
 var EXACT_REGISTRY = /* @__PURE__ */ new Map([
@@ -2949,12 +3126,13 @@ var WILDCARD_REGISTRY = [
   ["bedrock/anthropic.claude-3-5-sonnet*", "bedrock/anthropic.claude-3-5-haiku*"]
 ];
 var NO_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["ollama", "lmstudio", "llamacpp"]);
-var CompressionModelUnresolvedError = class extends Error {
+var CompressionModelUnresolvedError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   name = "CompressionModelUnresolvedError";
   agentModel;
   constructor(agentModel) {
     super(
-      `Could not resolve a same-family-cheaper-tier compression model for "${agentModel}". Provide Agent.create({compression: {model: "<your-cheaper-model>"}}) OR add "${agentModel}" to the compression-model-registry (see ADR D440).`
+      `Could not resolve a same-family-cheaper-tier compression model for "${agentModel}". Provide Agent.create({compression: {model: "<your-cheaper-model>"}}) OR add "${agentModel}" to the compression-model-registry (see ADR D440).`,
+      { code: "compression_model_unresolved", isRetryable: false }
     );
     this.agentModel = agentModel;
   }
@@ -2984,8 +3162,11 @@ function isNoAuthProvider(agentModel) {
 }
 
 // src/internal/runtime/compression/compression-summarizer.ts
-var CompressionFailedError = class extends Error {
+var CompressionFailedError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   name = "CompressionFailedError";
+  constructor(message, options = {}) {
+    super(message, { ...options, code: "compression_failed", isRetryable: true });
+  }
 };
 function buildCompressionPrompt(messages) {
   const formatted = messages.map((m) => `[${m.role}]: ${m.content}`).join("\n\n");
@@ -3034,7 +3215,7 @@ function plainText(content) {
 }
 async function compactSessionTranscript(opts) {
   const prior = await opts.store.readRecords(opts.loc.agentId);
-  const history = chunk5HEG4CQH_cjs.reconstructMessages(prior);
+  const history = chunkGZV6AVRL_cjs.reconstructMessages(prior);
   const compressible = [];
   for (const m of history) {
     const text = plainText(m.content);
@@ -3042,14 +3223,14 @@ async function compactSessionTranscript(opts) {
       compressible.push({ role: m.role, content: text });
     }
   }
-  const preTokens = chunkDXGZ2NUG_cjs.estimateTokens(compressible.map((m) => m.content).join("\n"));
+  const preTokens = chunkATT276RD_cjs.estimateTokens(compressible.map((m) => m.content).join("\n"));
   const summaryBody = await opts.summarize(compressible);
   const preserved = [];
   let budget = 0;
   for (let i = compressible.length - 1; i >= 0; i--) {
     const m = compressible[i];
     if (m === void 0 || m.role !== "user" || isCompactSummary(m.content)) continue;
-    const cost = chunkDXGZ2NUG_cjs.estimateTokens(m.content);
+    const cost = chunkATT276RD_cjs.estimateTokens(m.content);
     if (budget + cost > COMPACT_USER_MESSAGE_MAX_TOKENS) {
       const remaining = COMPACT_USER_MESSAGE_MAX_TOKENS - budget;
       if (remaining > 50) {
@@ -3063,7 +3244,7 @@ async function compactSessionTranscript(opts) {
   }
   const summary = `${COMPACT_SUMMARY_MARKER}
 ${summaryBody}`;
-  const transcript = chunk5HEG4CQH_cjs.SessionTranscript.fromRecords(prior, {
+  const transcript = chunkGZV6AVRL_cjs.SessionTranscript.fromRecords(prior, {
     cwd: opts.loc.cwd,
     sessionId: opts.sessionId,
     model: opts.loc.model ?? "unknown"
@@ -3073,8 +3254,8 @@ ${summaryBody}`;
   transcript.appendUserTurn(summary);
   const delta = transcript.records().slice(prior.length);
   await opts.store.appendRecords(opts.loc.agentId, delta);
-  chunk4OTIXDMU_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
-  const postTokens = chunkDXGZ2NUG_cjs.estimateTokens([...preserved, summary].join("\n"));
+  chunkYJNYDJ2T_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
+  const postTokens = chunkATT276RD_cjs.estimateTokens([...preserved, summary].join("\n"));
   return { preTokens, postTokens };
 }
 function resolveSummarizerRoute(opts) {
@@ -3083,9 +3264,9 @@ function resolveSummarizerRoute(opts) {
 }
 function buildDefaultSummarizer(opts) {
   return async (messages) => {
-    chunkHCZD23VS_cjs.registerBuiltins();
+    chunkQC55H6RJ_cjs.registerBuiltins();
     const modelPrefix = opts.agentModel.includes("/") ? opts.agentModel.slice(0, opts.agentModel.indexOf("/")) : void 0;
-    const prefixProfile = modelPrefix !== void 0 ? chunkHCZD23VS_cjs.getProviderProfile(modelPrefix) : void 0;
+    const prefixProfile = modelPrefix !== void 0 ? chunkQC55H6RJ_cjs.getProviderProfile(modelPrefix) : void 0;
     const prefixUsable = prefixProfile !== void 0 && (prefixProfile.authType !== "api_key" || prefixProfile.envVars.some((v) => (process.env[v] ?? "").length > 0));
     const route = resolveSummarizerRoute({
       keyProvider: inferProviderFromApiKey(opts.apiKey),
@@ -3134,12 +3315,10 @@ function shouldAutoCompact(opts) {
   if (opts.usageTotal <= 0 || opts.contextWindow <= 0) return false;
   return opts.usageTotal >= Math.floor(opts.contextWindow * 9 / 10);
 }
-var autoCompactAttempts = (() => {
-  const g = globalThis;
-  const sym = /* @__PURE__ */ Symbol.for("theokit-sdk.session.auto-compact-attempts");
-  if (g[sym] === void 0) g[sym] = /* @__PURE__ */ new Map();
-  return g[sym];
-})();
+var autoCompactAttempts = chunkNVXXWAU7_cjs.globalSingleton(
+  "theokit-sdk.session.auto-compact-attempts",
+  () => /* @__PURE__ */ new Map()
+);
 async function autoCompactIfNeeded(opts) {
   if (!shouldAutoCompact(opts)) return false;
   const key = `${opts.loc.cwd}::${opts.loc.agentId}`;
@@ -3156,7 +3335,7 @@ async function autoCompactIfNeeded(opts) {
     return true;
   } catch (cause) {
     const msg = cause instanceof Error ? cause.message : String(cause);
-    chunkEG4QM7ZJ_cjs.diag(`[theokit-sdk] auto-compaction failed (left transcript untouched): ${msg}
+    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] auto-compaction failed (left transcript untouched): ${msg}
 `);
     return false;
   }
@@ -3165,29 +3344,30 @@ async function autoCompactIfNeeded(opts) {
 exports.COMPACT_SUMMARY_MARKER = COMPACT_SUMMARY_MARKER;
 exports.COMPACT_USER_MESSAGE_MAX_TOKENS = COMPACT_USER_MESSAGE_MAX_TOKENS;
 exports.CircuitBreaker = CircuitBreaker;
+exports.abortError = abortError;
 exports.autoCompactIfNeeded = autoCompactIfNeeded;
 exports.buildDefaultSummarizer = buildDefaultSummarizer;
 exports.compactSessionTranscript = compactSessionTranscript;
-exports.detectPrimaryProvider = detectPrimaryProvider;
 exports.discoverProviderPlugins = discoverProviderPlugins;
 exports.getConfiguredBaseUrl = getConfiguredBaseUrl;
 exports.httpRequest = httpRequest;
-exports.inferProviderFromApiKey = inferProviderFromApiKey;
 exports.isCompactSummary = isCompactSummary;
 exports.isFixtureApiKey = isFixtureApiKey;
 exports.mapOllamaHttpError = mapOllamaHttpError;
 exports.mapOllamaTransportError = mapOllamaTransportError;
+exports.mergeExplicitApiKey = mergeExplicitApiKey;
 exports.parseSseStream = parseSseStream;
 exports.presentProviderCredentialEnvVars = presentProviderCredentialEnvVars;
 exports.readErrorResponseBody = readErrorResponseBody;
 exports.relayStream = relayStream;
 exports.renderToolResultContentText = renderToolResultContentText;
 exports.resolveProviderChain = resolveProviderChain;
+exports.resolveRunProvider = resolveRunProvider;
 exports.resolveSummarizerRoute = resolveSummarizerRoute;
 exports.shouldAutoCompact = shouldAutoCompact;
 exports.shouldUseFixtureMode = shouldUseFixtureMode;
 exports.shouldUseRealLocalRuntime = shouldUseRealLocalRuntime;
 exports.tryFirstEvent = tryFirstEvent;
-exports.warnProviderPrecedenceOnce = warnProviderPrecedenceOnce;
-//# sourceMappingURL=chunk-KYAJINUI.cjs.map
-//# sourceMappingURL=chunk-KYAJINUI.cjs.map
+exports.validateApiKeyShape = validateApiKeyShape;
+//# sourceMappingURL=chunk-2HPNT6HH.cjs.map
+//# sourceMappingURL=chunk-2HPNT6HH.cjs.map