@theokit/sdk 4.9.0 → 4.10.0

package/dist/{cron-D_0p_gXd.d.ts → cron-BF_AI5NP.d.ts}

@@ -1185,6 +1185,32 @@ interface MemoryProvider {
  */
 type ApiMode = "chat_completions" | "anthropic_messages" | "responses_api" | "bedrock" | "bedrock_anthropic";
 type AuthType = "api_key" | "oauth_device_code" | "oauth_external" | "aws_sdk" | "aws_bearer" | "gcp_oauth" | "none";
+/**
+ * M41 (agent-builder provider framework) — the context a provider's `transform` receives per request. An
+ * object from day one so it can grow without breaking (M42 adds the resolved `credential`).
+ *
+ * @public
+ */
+interface ProviderTransformContext {
+    /** The bearer the router resolved for this request (env var, injected key, or an oauth access token). */
+    apiKey: string;
+}
+/**
+ * M41 — the one OPTIONAL behavior seam on a provider profile. It lets a provider own its per-request auth:
+ * `fetch` is the universal seam (a provider that returns its own fetch fully controls headers + refresh, for
+ * every transport that accepts a fetch); `headers` is a convenience merged over `extraHeaders` on transports
+ * that carry them (responses_api). This is the CONTRACT-shape adaptation of OpenCode's provider `auth.loader`
+ * (MIT © 2025 opencode — `packages/core/src/plugin/provider/*.ts`), retargeted to theokit's transport model.
+ * Closes the gap where a `ProviderProfile` could only declare STATIC headers.
+ *
+ * @public
+ */
+interface ProviderTransform {
+    /** Dynamic per-request headers, merged OVER the profile's static `extraHeaders`. */
+    headers?(ctx: ProviderTransformContext): Record<string, string>;
+    /** A fetch to use for this provider's requests (refresh-aware / fully provider-controlled). */
+    fetch?(ctx: ProviderTransformContext): typeof fetch;
+}
 interface ProviderProfile {
     name: string;
     apiMode: ApiMode;
@@ -1200,6 +1226,11 @@ interface ProviderProfile {
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
     bodyOverrides?: Record<string, unknown>;
+    /**
+     * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile
+     * is pure data and takes the static path byte-for-byte. See {@link ProviderTransform}.
+     */
+    transform?: ProviderTransform;
     /**
      * Opt-in leaked-dialect safe-parse (theokit#58 follow-up). When `true`, a chat_completions finish
      * with ZERO native `tool_calls` has its assistant content scanned for the Hermes

package/dist/{cron-26WH1n7o.d.cts → cron-DXEhagMa.d.cts}

@@ -1185,6 +1185,32 @@ interface MemoryProvider {
  */
 type ApiMode = "chat_completions" | "anthropic_messages" | "responses_api" | "bedrock" | "bedrock_anthropic";
 type AuthType = "api_key" | "oauth_device_code" | "oauth_external" | "aws_sdk" | "aws_bearer" | "gcp_oauth" | "none";
+/**
+ * M41 (agent-builder provider framework) — the context a provider's `transform` receives per request. An
+ * object from day one so it can grow without breaking (M42 adds the resolved `credential`).
+ *
+ * @public
+ */
+interface ProviderTransformContext {
+    /** The bearer the router resolved for this request (env var, injected key, or an oauth access token). */
+    apiKey: string;
+}
+/**
+ * M41 — the one OPTIONAL behavior seam on a provider profile. It lets a provider own its per-request auth:
+ * `fetch` is the universal seam (a provider that returns its own fetch fully controls headers + refresh, for
+ * every transport that accepts a fetch); `headers` is a convenience merged over `extraHeaders` on transports
+ * that carry them (responses_api). This is the CONTRACT-shape adaptation of OpenCode's provider `auth.loader`
+ * (MIT © 2025 opencode — `packages/core/src/plugin/provider/*.ts`), retargeted to theokit's transport model.
+ * Closes the gap where a `ProviderProfile` could only declare STATIC headers.
+ *
+ * @public
+ */
+interface ProviderTransform {
+    /** Dynamic per-request headers, merged OVER the profile's static `extraHeaders`. */
+    headers?(ctx: ProviderTransformContext): Record<string, string>;
+    /** A fetch to use for this provider's requests (refresh-aware / fully provider-controlled). */
+    fetch?(ctx: ProviderTransformContext): typeof fetch;
+}
 interface ProviderProfile {
     name: string;
     apiMode: ApiMode;
@@ -1200,6 +1226,11 @@ interface ProviderProfile {
     fallbackModels: ReadonlyArray<string>;
     extraHeaders?: Record<string, string>;
     bodyOverrides?: Record<string, unknown>;
+    /**
+     * M41 — the optional per-request behavior seam (dynamic headers + refresh-aware fetch). Absent ⇒ the profile
+     * is pure data and takes the static path byte-for-byte. See {@link ProviderTransform}.
+     */
+    transform?: ProviderTransform;
     /**
      * Opt-in leaked-dialect safe-parse (theokit#58 follow-up). When `true`, a chat_completions finish
      * with ZERO native `tool_calls` has its assistant content scanned for the Hermes

package/dist/cron.cjs

@@ -12953,6 +12953,172 @@ function assistantMessage(message) {
   return result;
 }
 
+// src/internal/llm/pool-aware-client.ts
+init_errors();
+
+// src/internal/resilience/circuit-breaker.ts
+var DEFAULT_MAX_TIMEOUTS = 3;
+var DEFAULT_COOLDOWN_MS2 = 6e4;
+var CircuitBreaker = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  opts;
+  states = /* @__PURE__ */ new Map();
+  /** @returns true when the breaker is open and the call should be skipped. */
+  shouldSkip(key) {
+    const state3 = this.states.get(key);
+    if (state3 === void 0) return false;
+    if (state3.cooldownUntilMs === 0) return false;
+    if (this.now() < state3.cooldownUntilMs) return true;
+    state3.cooldownUntilMs = 0;
+    state3.consecutiveTimeouts = 0;
+    return false;
+  }
+  recordSuccess(key) {
+    const state3 = this.states.get(key);
+    if (state3 === void 0) return;
+    state3.consecutiveTimeouts = 0;
+    state3.cooldownUntilMs = 0;
+  }
+  recordTimeout(key) {
+    const state3 = this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
+    state3.consecutiveTimeouts += 1;
+    if (state3.consecutiveTimeouts >= (this.opts.maxTimeouts ?? DEFAULT_MAX_TIMEOUTS)) {
+      state3.cooldownUntilMs = this.now() + (this.opts.cooldownMs ?? DEFAULT_COOLDOWN_MS2);
+    }
+    this.states.set(key, state3);
+  }
+  /** @internal — tests inspect counter state. */
+  inspect(key) {
+    return this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
+  }
+  now() {
+    return this.opts.now?.() ?? Date.now();
+  }
+};
+
+// src/internal/llm/pool-aware-client.ts
+init_retry();
+var PoolAwareLlmClient = class {
+  constructor(pool, buildClient2, waitForAvailableMs = 3e4, resilience = {}) {
+    this.pool = pool;
+    this.buildClient = buildClient2;
+    this.waitForAvailableMs = waitForAvailableMs;
+    this.name = `pool-aware:${pool.provider}`;
+    this.breaker = resilience.breaker ?? new CircuitBreaker();
+    this.backoffBaseMs = resilience.backoffBaseMs;
+    this.rng = resilience.rng;
+    this.onRateLimit = resilience.onRateLimit;
+  }
+  pool;
+  buildClient;
+  waitForAvailableMs;
+  name;
+  onRateLimit;
+  /** M2 #60 — provider-level circuit breaker (consecutive-failure). */
+  breaker;
+  backoffBaseMs;
+  rng;
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stream() must serialize pool-select → build client → first-event probe → classify → retry/rotate/propagate. Extracting helpers fragments the linear narrative; the comments above each branch keep it readable.
+  async *stream(request, signal) {
+    if (this.breaker.shouldSkip(this.pool.provider)) {
+      throw new NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
+        code: "circuit_open"
+      });
+    }
+    let hasRetried429 = false;
+    while (true) {
+      if (signal.aborted) throw abortError2(signal);
+      let entry = await this.pool.select();
+      if (entry === null) {
+        if (this.waitForAvailableMs > 0) {
+          const available = await this.pool.waitForAvailable(signal, {
+            maxWaitMs: this.waitForAvailableMs
+          });
+          if (available) {
+            entry = await this.pool.select();
+          }
+        }
+        if (entry === null) {
+          this.breaker.recordTimeout(this.pool.provider);
+          throw new CredentialPoolExhaustedError(
+            `All ${this.pool.provider} credentials exhausted; next retry available at ${this.nextRetryHint() ?? "unknown"}`,
+            { provider: this.pool.provider, nextRetryAt: this.nextRetryHint() }
+          );
+        }
+      }
+      const realClient = this.buildClient(entry.accessToken);
+      const attempt = await tryFirstEvent(realClient, request, signal);
+      if (attempt.kind === "ok") {
+        this.breaker.recordSuccess(this.pool.provider);
+        return yield* relayStream(attempt.generator, attempt.firstResult);
+      }
+      const decision = classifyAndDecide(attempt.error, hasRetried429);
+      if (decision === "retry") {
+        const backoffMs = computeBackoffMs({
+          attempt: 0,
+          ...this.backoffBaseMs !== void 0 ? { baseMs: this.backoffBaseMs } : {},
+          ...this.rng !== void 0 ? { rng: this.rng } : {}
+        });
+        this.onRateLimit?.({ attempt: 1, retryAfterMs: backoffMs });
+        await sleepWithAbort(backoffMs, signal);
+        hasRetried429 = true;
+        continue;
+      }
+      if (decision === "rotate") {
+        try {
+          await this.pool.markExhaustedAndRotate({
+            entryId: entry.id,
+            statusCode: attempt.error.metadata?.statusCode ?? inferStatusCode(attempt.error),
+            ...parseRetryAfterMs(attempt.error) !== void 0 ? { resetAtMs: parseRetryAfterMs(attempt.error) } : {}
+          });
+        } catch (persistErr) {
+          process.stderr.write(
+            `[theokit-sdk] credential-pool: persist failed during rotate; continuing in-memory: ${persistErr instanceof Error ? persistErr.message : String(persistErr)}
+`
+          );
+        }
+        hasRetried429 = false;
+        continue;
+      }
+      this.breaker.recordTimeout(this.pool.provider);
+      throw attempt.error;
+    }
+  }
+  /**
+   * Earliest epoch ms among entries' `lastErrorResetAt` — best estimate
+   * for the caller's `CredentialPoolExhaustedError.nextRetryAt`.
+   */
+  nextRetryHint() {
+    const resets = this.pool.list().map((e) => e.lastErrorResetAt).filter((v) => v !== void 0);
+    return resets.length === 0 ? void 0 : Math.min(...resets);
+  }
+};
+function classifyAndDecide(error, hasRetried429) {
+  if (error instanceof NetworkError) return "propagate";
+  if (error instanceof AuthenticationError) return "rotate";
+  const status = error.metadata?.statusCode ?? 429;
+  if (status === 402) return "rotate";
+  return hasRetried429 ? "rotate" : "retry";
+}
+function parseRetryAfterMs(error) {
+  const seconds = error.metadata?.retryAfter;
+  if (typeof seconds === "number" && seconds > 0) {
+    return Date.now() + seconds * 1e3;
+  }
+  return void 0;
+}
+function inferStatusCode(error) {
+  if (error instanceof AuthenticationError) return 401;
+  if (error instanceof RateLimitError) return 429;
+  return 0;
+}
+function abortError2(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  return new Error("AbortError");
+}
+
 // src/internal/llm/responses.ts
 function messageToInputItems(message) {
   const items = [];
@@ -13001,7 +13167,9 @@ function buildResponsesBody(request) {
   for (const message of request.messages) {
     for (const item of messageToInputItems(message)) input.push(item);
   }
-  const body = { model: request.model, input, stream: true, store: false };
+  const slash = request.model.lastIndexOf("/");
+  const model = slash >= 0 ? request.model.slice(slash + 1) : request.model;
+  const body = { model, input, stream: true, store: false };
   const instructions = collapseSystemText(request.system);
   if (instructions.length > 0) body.instructions = instructions;
   if (request.maxTokens !== void 0) body.max_output_tokens = request.maxTokens;
@@ -13135,175 +13303,16 @@ var ResponsesApiClient = class {
     }
     if (toolCalls.length > 0 && stopReason === "end_turn") stopReason = "tool_use";
     yield { type: "stop", reason: stopReason };
-    return makeLlmFinish({ stopReason, text, toolCalls, inputTokens, outputTokens, reasoningTokens });
-  }
-};
-
-// src/internal/llm/pool-aware-client.ts
-init_errors();
-
-// src/internal/resilience/circuit-breaker.ts
-var DEFAULT_MAX_TIMEOUTS = 3;
-var DEFAULT_COOLDOWN_MS2 = 6e4;
-var CircuitBreaker = class {
-  constructor(opts = {}) {
-    this.opts = opts;
-  }
-  opts;
-  states = /* @__PURE__ */ new Map();
-  /** @returns true when the breaker is open and the call should be skipped. */
-  shouldSkip(key) {
-    const state3 = this.states.get(key);
-    if (state3 === void 0) return false;
-    if (state3.cooldownUntilMs === 0) return false;
-    if (this.now() < state3.cooldownUntilMs) return true;
-    state3.cooldownUntilMs = 0;
-    state3.consecutiveTimeouts = 0;
-    return false;
-  }
-  recordSuccess(key) {
-    const state3 = this.states.get(key);
-    if (state3 === void 0) return;
-    state3.consecutiveTimeouts = 0;
-    state3.cooldownUntilMs = 0;
-  }
-  recordTimeout(key) {
-    const state3 = this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
-    state3.consecutiveTimeouts += 1;
-    if (state3.consecutiveTimeouts >= (this.opts.maxTimeouts ?? DEFAULT_MAX_TIMEOUTS)) {
-      state3.cooldownUntilMs = this.now() + (this.opts.cooldownMs ?? DEFAULT_COOLDOWN_MS2);
-    }
-    this.states.set(key, state3);
-  }
-  /** @internal — tests inspect counter state. */
-  inspect(key) {
-    return this.states.get(key) ?? { consecutiveTimeouts: 0, cooldownUntilMs: 0 };
-  }
-  now() {
-    return this.opts.now?.() ?? Date.now();
-  }
-};
-
-// src/internal/llm/pool-aware-client.ts
-init_retry();
-var PoolAwareLlmClient = class {
-  constructor(pool, buildClient2, waitForAvailableMs = 3e4, resilience = {}) {
-    this.pool = pool;
-    this.buildClient = buildClient2;
-    this.waitForAvailableMs = waitForAvailableMs;
-    this.name = `pool-aware:${pool.provider}`;
-    this.breaker = resilience.breaker ?? new CircuitBreaker();
-    this.backoffBaseMs = resilience.backoffBaseMs;
-    this.rng = resilience.rng;
-    this.onRateLimit = resilience.onRateLimit;
-  }
-  pool;
-  buildClient;
-  waitForAvailableMs;
-  name;
-  onRateLimit;
-  /** M2 #60 — provider-level circuit breaker (consecutive-failure). */
-  breaker;
-  backoffBaseMs;
-  rng;
-  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stream() must serialize pool-select → build client → first-event probe → classify → retry/rotate/propagate. Extracting helpers fragments the linear narrative; the comments above each branch keep it readable.
-  async *stream(request, signal) {
-    if (this.breaker.shouldSkip(this.pool.provider)) {
-      throw new NetworkError(`${this.pool.provider} circuit open \u2014 failing fast`, {
-        code: "circuit_open"
-      });
-    }
-    let hasRetried429 = false;
-    while (true) {
-      if (signal.aborted) throw abortError2(signal);
-      let entry = await this.pool.select();
-      if (entry === null) {
-        if (this.waitForAvailableMs > 0) {
-          const available = await this.pool.waitForAvailable(signal, {
-            maxWaitMs: this.waitForAvailableMs
-          });
-          if (available) {
-            entry = await this.pool.select();
-          }
-        }
-        if (entry === null) {
-          this.breaker.recordTimeout(this.pool.provider);
-          throw new CredentialPoolExhaustedError(
-            `All ${this.pool.provider} credentials exhausted; next retry available at ${this.nextRetryHint() ?? "unknown"}`,
-            { provider: this.pool.provider, nextRetryAt: this.nextRetryHint() }
-          );
-        }
-      }
-      const realClient = this.buildClient(entry.accessToken);
-      const attempt = await tryFirstEvent(realClient, request, signal);
-      if (attempt.kind === "ok") {
-        this.breaker.recordSuccess(this.pool.provider);
-        return yield* relayStream(attempt.generator, attempt.firstResult);
-      }
-      const decision = classifyAndDecide(attempt.error, hasRetried429);
-      if (decision === "retry") {
-        const backoffMs = computeBackoffMs({
-          attempt: 0,
-          ...this.backoffBaseMs !== void 0 ? { baseMs: this.backoffBaseMs } : {},
-          ...this.rng !== void 0 ? { rng: this.rng } : {}
-        });
-        this.onRateLimit?.({ attempt: 1, retryAfterMs: backoffMs });
-        await sleepWithAbort(backoffMs, signal);
-        hasRetried429 = true;
-        continue;
-      }
-      if (decision === "rotate") {
-        try {
-          await this.pool.markExhaustedAndRotate({
-            entryId: entry.id,
-            statusCode: attempt.error.metadata?.statusCode ?? inferStatusCode(attempt.error),
-            ...parseRetryAfterMs(attempt.error) !== void 0 ? { resetAtMs: parseRetryAfterMs(attempt.error) } : {}
-          });
-        } catch (persistErr) {
-          process.stderr.write(
-            `[theokit-sdk] credential-pool: persist failed during rotate; continuing in-memory: ${persistErr instanceof Error ? persistErr.message : String(persistErr)}
-`
-          );
-        }
-        hasRetried429 = false;
-        continue;
-      }
-      this.breaker.recordTimeout(this.pool.provider);
-      throw attempt.error;
-    }
-  }
-  /**
-   * Earliest epoch ms among entries' `lastErrorResetAt` — best estimate
-   * for the caller's `CredentialPoolExhaustedError.nextRetryAt`.
-   */
-  nextRetryHint() {
-    const resets = this.pool.list().map((e) => e.lastErrorResetAt).filter((v) => v !== void 0);
-    return resets.length === 0 ? void 0 : Math.min(...resets);
+    return makeLlmFinish({
+      stopReason,
+      text,
+      toolCalls,
+      inputTokens,
+      outputTokens,
+      reasoningTokens
+    });
   }
 };
-function classifyAndDecide(error, hasRetried429) {
-  if (error instanceof NetworkError) return "propagate";
-  if (error instanceof AuthenticationError) return "rotate";
-  const status = error.metadata?.statusCode ?? 429;
-  if (status === 402) return "rotate";
-  return hasRetried429 ? "rotate" : "retry";
-}
-function parseRetryAfterMs(error) {
-  const seconds = error.metadata?.retryAfter;
-  if (typeof seconds === "number" && seconds > 0) {
-    return Date.now() + seconds * 1e3;
-  }
-  return void 0;
-}
-function inferStatusCode(error) {
-  if (error instanceof AuthenticationError) return 401;
-  if (error instanceof RateLimitError) return 429;
-  return 0;
-}
-function abortError2(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  return new Error("AbortError");
-}
 
 // src/internal/llm/vertex-anthropic.ts
 init_errors();
@@ -13676,6 +13685,9 @@ function resolveApiKey2(envVars) {
   return void 0;
 }
 function selectTransport(profile, apiKey) {
+  const transformCtx = { apiKey };
+  const transformFetch = profile.transform?.fetch?.(transformCtx);
+  const transformHeaders = profile.transform?.headers?.(transformCtx);
   if (profile.apiMode === "chat_completions") {
     if (profile.name === "ollama") {
       const ollamaBase = process.env.OLLAMA_HOST ?? profile.baseUrl;
@@ -13692,6 +13704,7 @@ function selectTransport(profile, apiKey) {
     }
     const envOverride = resolveBaseUrlEnvOverride(profile.name);
     if (envOverride !== void 0) opts.baseUrl = envOverride;
+    if (transformFetch !== void 0) opts.fetch = transformFetch;
     return new OpenAIClient(opts);
   }
   if (profile.apiMode === "anthropic_messages") {
@@ -13708,10 +13721,12 @@ function selectTransport(profile, apiKey) {
     return new BedrockAnthropicClient(realKey !== void 0 ? { apiKey: realKey } : {});
   }
   if (profile.apiMode === "responses_api") {
+    const mergedHeaders = profile.extraHeaders !== void 0 || transformHeaders !== void 0 ? { ...profile.extraHeaders, ...transformHeaders } : void 0;
     return new ResponsesApiClient({
       apiKey,
       ...profile.baseUrl !== void 0 ? { baseUrl: profile.baseUrl } : {},
-      ...profile.extraHeaders !== void 0 ? { extraHeaders: profile.extraHeaders } : {},
+      ...mergedHeaders !== void 0 ? { extraHeaders: mergedHeaders } : {},
+      ...transformFetch !== void 0 ? { fetch: transformFetch } : {},
       providerName: profile.name
     });
   }