@theokit/sdk 5.9.1 → 5.9.2

package/dist/chunk-R3ZQBPA5.cjs

@@ -1,18 +0,0 @@
-'use strict';
-
-var chunkYRJA2POB_cjs = require('./chunk-YRJA2POB.cjs');
-
-// src/providers.ts
-function listProviders2() {
-  chunkYRJA2POB_cjs.registerBuiltins();
-  return chunkYRJA2POB_cjs.listProviders();
-}
-function getProviderProfile2(name) {
-  chunkYRJA2POB_cjs.registerBuiltins();
-  return chunkYRJA2POB_cjs.getProviderProfile(name);
-}
-
-exports.getProviderProfile = getProviderProfile2;
-exports.listProviders = listProviders2;
-//# sourceMappingURL=chunk-R3ZQBPA5.cjs.map
-//# sourceMappingURL=chunk-R3ZQBPA5.cjs.map

package/dist/chunk-RA7IE4NK.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/auth/oauth-engine.ts","../src/internal/auth/resolve-credential.ts"],"names":["AuthCallbackError","writeCredential","authFilePath","readStoredOAuth","fresh","readAuthFile"],"mappings":";;;;;;AAyBA,IAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,kBAAA,CAAmB,MAAe,GAAA,EAA0B;AACnE,EAAA,MAAM,CAAA,GAAI,IAAA;AAMV,EAAA,IAAI,OAAO,CAAA,CAAE,YAAA,KAAiB,YAAY,CAAA,CAAE,YAAA,CAAa,WAAW,CAAA,EAAG;AACrE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,aAAA,KAAkB,YAAY,CAAA,CAAE,aAAA,CAAc,WAAW,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAY,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,UAAA,GAAa,IAAA;AACpE,EAAA,OAAO;AAAA,IACL,QAAQ,CAAA,CAAE,YAAA;AAAA,IACV,SAAS,CAAA,CAAE,aAAA;AAAA,IACX,OAAA,EAAS,MAAM,SAAA,GAAY,GAAA;AAAA,IAC3B,GAAI,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW,GAAI;AAAC,GACxE;AACF;AAGA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB,IAAI,EAAE,QAAA;AAAS,KAC1C,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,+BAAA,EAAmC,IAAc,OAAO,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAGX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,IAAI,MAAM,CAAA;AAAA,KAC5C;AAAA,EACF;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,6BAAA,EAA+B,mCAAmC,CAAA;AAAA,EAChG;AACA,EAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,CAAA;AAC5C;AAGO,SAAS,YAAA,CACd,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,UAAA,EAAY,oBAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,MAAA,CAAO,WAAA;AAAA,MACrB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,eAAe,KAAA,CAAM;AAAA,KACvB;AAAA,IACA;AAAA,GACF;AACF;AAGO,SAAS,kBAAA,CACd,MAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,UAAA,EAAY,eAAA,EAAiB,eAAe,OAAA,EAAS,SAAA,EAAW,OAAO,QAAA,EAAS;AAAA,IAClF;AAAA,GACF;AACF;AAGO,SAAS,mBACd,QAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAOC,iCAAA;AAAA,IACL;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,QAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,GAAI,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,UAAA,EAAY,MAAA,CAAO,SAAA,EAAU,GAAI;AAAC,KAC3E;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACF;AAQA,IAAM,eAAA,uBAAsB,GAAA,EAAkC;AAQ9D,eAAsB,qBAAA,CACpB,QAAA,EACA,IAAA,EAKA,IAAA,EAC6B;AAC7B,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,OAAA,EAAS,OAAO,QAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAS,SAAA,KAAc,MAAA,IAAa,QAAA,CAAS,SAAA,GAAY,MAAM,eAAA,EAAiB;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,IAAA,GAAOC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACzC,EAAA,IAAI,OAAA,GAAU,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAA,GAAA,CAAW,YAAkC;AAC3C,MAAA,MAAM,MAAA,GAASC,iCAAA,CAAgB,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC9C,MAAA,IAAI,WAAW,MAAA,EAAW;AAExB,QAAA,MAAM,IAAIH,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAMI,SAAQ,MAAM,kBAAA,CAAmB,KAAK,MAAA,EAAQ,MAAA,CAAO,SAAS,IAAI,CAAA;AAKxE,MAAA,MAAM,MAAA,GAAsB;AAAA,QAC1B,GAAGA,MAAAA;AAAA,QACH,SAAA,EAAWA,MAAAA,CAAM,SAAA,IAAa,MAAA,CAAO;AAAA,OACvC;AACA,MAAA,kBAAA,CAAmB,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,OAAO,GAAG,CAAA;AAC7D,MAAA,OAAO,MAAA;AAAA,IACT,CAAA,GAAG;AACH,IAAA,eAAA,CAAgB,GAAA,CAAI,MAAM,OAAO,CAAA;AACjC,IAAA,OAAA,CAAQ,OAAA,CAAQ,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,QAAQ,MAAM,OAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;AC5JA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,GAAA,EACyC;AACzC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC/B,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,MAAA,CAAO;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACrC,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,KAAA,EAAO,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AAAA,IAC3B,KAAK,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI;AAAA,GACzC;AACA,EAAA,OAAO,qBAAA,CAAsB,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAI,EAAG,IAAI,CAAA;AACzF;AAMA,eAAsB,kBACpB,IAAA,EACyC;AACzC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,MAAA,GAASC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC3C,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAEjC,EAAA,MAAM,IAAA,GAAOH,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAS;AAC3B,IAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACxC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,OAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF","file":"chunk-RA7IE4NK.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth engine. Promoted DOWN from agent-builder's hardened `agents/lib/oauth.ts` +\n * `oauth-device.ts` (M37), generalized to `provider: string` + a caller-supplied {@link CredentialStoreConfig}\n * (no hardcoded client IDs — the caller declares its provider's endpoints). Ported VERBATIM (ADR D3): the\n * refresh coalescing lock, the no-token-in-error discipline, and the RFC 8628 device grant.\n *\n * Reuses the SDK's typed error taxonomy (`AuthCallbackError` from `server/auth`) for exchange/refresh\n * failures. All network I/O + clock + sleep are INJECTED so the flow is deterministic.\n *\n * The device flows follow their published specs: the RFC 8628 device grant (device_code →\n * authorization_pending / slow_down) and OpenAI's two-step headless flow with JWT-claim account attribution.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { authFilePath, readStoredOAuth, writeCredential } from \"./credential-store.js\";\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  OAuthTokens,\n  ResolvedCredential,\n} from \"./types.js\";\n\n/** Refresh a token this many ms BEFORE it actually expires (avoid a last-second, mid-request expiry). */\nconst REFRESH_SKEW_MS = 60_000;\n\n/** Parse an OAuth token endpoint response into our token triple. Throws a typed error on a bad shape. */\nfunction parseTokenResponse(body: unknown, now: number): OAuthTokens {\n  const b = body as {\n    access_token?: unknown;\n    refresh_token?: unknown;\n    expires_in?: unknown;\n    account_id?: unknown;\n  };\n  if (typeof b.access_token !== \"string\" || b.access_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no access_token\",\n    );\n  }\n  if (typeof b.refresh_token !== \"string\" || b.refresh_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no refresh_token\",\n    );\n  }\n  const expiresIn = typeof b.expires_in === \"number\" ? b.expires_in : 3600;\n  return {\n    access: b.access_token,\n    refresh: b.refresh_token,\n    expires: now + expiresIn * 1000,\n    ...(typeof b.account_id === \"string\" ? { accountId: b.account_id } : {}),\n  };\n}\n\n/** POST a form-encoded grant to the token endpoint; return the parsed JSON or throw a typed error. */\nasync function postGrant(\n  config: OAuthProviderConfig,\n  form: Record<string, string>,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams(form).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    // The body may carry an OAuth `error` code, but never echo it verbatim — it can contain a token in\n    // some providers' error payloads. Report the status only.\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint returned HTTP ${res.status}`,\n    );\n  }\n  let json: unknown;\n  try {\n    json = await res.json();\n  } catch {\n    // Do NOT echo the parser message — on a 200 non-JSON body it embeds a snippet of the response, which\n    // in a token context can contain access/refresh material.\n    throw new AuthCallbackError(\"oauth_token_exchange_failed\", \"token response was not valid JSON\");\n  }\n  return parseTokenResponse(json, deps.now());\n}\n\n/** Exchange an authorization `code` (+ PKCE verifier) for the token pair. */\nexport function exchangeCode(\n  config: OAuthProviderConfig,\n  input: { code: string; verifier: string },\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    {\n      grant_type: \"authorization_code\",\n      code: input.code,\n      redirect_uri: config.redirectUri,\n      client_id: config.clientId,\n      code_verifier: input.verifier,\n    },\n    deps,\n  );\n}\n\n/** Swap a refresh token for a fresh access (and possibly rotated refresh) token. */\nexport function refreshOAuthTokens(\n  config: OAuthProviderConfig,\n  refresh: string,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    { grant_type: \"refresh_token\", refresh_token: refresh, client_id: config.clientId },\n    deps,\n  );\n}\n\n/** Persist a token triple to the store's oauth variant through the hardened 0600 writer. */\nexport function persistOAuthTokens(\n  provider: string,\n  tokens: OAuthTokens,\n  store: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return writeCredential(\n    {\n      type: \"oauth\",\n      provider,\n      access: tokens.access,\n      refresh: tokens.refresh,\n      expires: tokens.expires,\n      ...(tokens.accountId !== undefined ? { account_id: tokens.accountId } : {}),\n    },\n    store,\n    env,\n  );\n}\n\n/**\n * In-flight refreshes, keyed by the auth-file path. Refresh tokens ROTATE (single-use) on many providers,\n * so two concurrent turns must NOT both POST the same refresh token — the second would present an\n * already-consumed token and fail. This coalesces concurrent refreshes of the same store onto one promise.\n * Process-local — the single-credential store is per-user; a cross-process lock would be over-engineering.\n */\nconst inFlightRefresh = new Map<string, Promise<OAuthTokens>>();\n\n/**\n * Return a credential guaranteed fresh enough to use. An `api` credential passes through untouched. An\n * `oauth` credential still valid (beyond the skew window) passes through; an expired one is refreshed,\n * re-persisted 0600, and returned with the new access token. Concurrent refreshes of the same store are\n * coalesced (single-use refresh tokens); the rejected promise is evicted so a failure is not cached-poison.\n */\nexport async function ensureFreshCredential(\n  resolved: ResolvedCredential,\n  opts: {\n    config: OAuthProviderConfig;\n    store: CredentialStoreConfig;\n    env?: Record<string, string | undefined>;\n  },\n  deps: HttpDeps,\n): Promise<ResolvedCredential> {\n  if (resolved.kind !== \"oauth\") return resolved;\n\n  const now = deps.now();\n  if (resolved.expiresAt !== undefined && resolved.expiresAt > now + REFRESH_SKEW_MS) {\n    return resolved; // still valid — no network, no rewrite\n  }\n\n  const env = opts.env ?? {};\n  const path = authFilePath(opts.store, env);\n  let refresh = inFlightRefresh.get(path);\n  if (refresh === undefined) {\n    refresh = (async (): Promise<OAuthTokens> => {\n      const stored = readStoredOAuth(opts.store, env);\n      if (stored === undefined) {\n        // The resolved credential said oauth but the store no longer holds it — do not fabricate; surface it.\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"no stored oauth credential to refresh\",\n        );\n      }\n      const fresh = await refreshOAuthTokens(opts.config, stored.refresh, deps);\n      // M43 D4 fix #1 — the OAuth refresh response returns JWTs, not a top-level `account_id`, so\n      // `parseTokenResponse` leaves `fresh.accountId` undefined. Prefer a freshly-derived id, else PRESERVE\n      // the stored one (account_id is stable) — otherwise the Codex `ChatGPT-Account-Id` header empties after\n      // the first refresh and the backend 401/403s.\n      const merged: OAuthTokens = {\n        ...fresh,\n        accountId: fresh.accountId ?? stored.account_id,\n      };\n      persistOAuthTokens(resolved.provider, merged, opts.store, env);\n      return merged;\n    })();\n    inFlightRefresh.set(path, refresh);\n    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {});\n  }\n\n  const fresh = await refresh;\n  return {\n    kind: \"oauth\",\n    provider: resolved.provider,\n    apiKey: fresh.access,\n    source: resolved.source,\n    inferred: false,\n    expiresAt: fresh.expires,\n  };\n}\n","/**\n * M42 — `resolveCredential`: the public composition entrypoint over the credential store + oauth engine.\n * Given a provider name + a {@link CredentialStoreConfig} (and, for oauth, an {@link OAuthProviderConfig}),\n * read the store and return a FRESH `ResolvedCredential` — an api credential passes through by identity; an\n * oauth credential is transparently refreshed when its access token is within the skew window. Returns\n * `undefined` when the store holds no credential for `provider` (the caller then falls back to env / apiKeys).\n *\n * Mirrors agent-builder's `resolveFreshCredential` composition (store read → oauth → ensureFreshCredential),\n * defaulting `fetch`/`now` to globals. This is the async surface an oauth provider's M41 `transform.fetch`\n * calls at stream time, so a mid-turn token expiry refreshes without rebuilding the agent.\n *\n * Re-exported from `@theokit/sdk/auth`, and therefore PUBLIC, under semver.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport { authFilePath, readAuthFile } from \"./credential-store.js\";\nimport { ensureFreshCredential } from \"./oauth-engine.js\";\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  ResolvedCredential,\n} from \"./types.js\";\n\n/**\n * Input to `resolveCredential`: which provider, which store, and what to inject.\n *\n * `env` and `deps` exist so nothing here reads ambient state. Omitting `env` does NOT fall back to\n * `process.env` — the store's `homeEnvVar` override simply goes unread, so a credential written\n * under a relocated home resolves as absent rather than as an error.\n *\n * `oauth` is required only to REFRESH an oauth credential. Without it an expired oauth entry cannot\n * be renewed, and an api-key-only store needs it never.\n *\n * PUBLIC and under semver, despite the `internal/` directory: `src/auth/index.ts` re-exports this\n * type, and `package.json` publishes that barrel as the '@theokit/sdk/auth' subpath. The directory\n * name is not the authority — the `exports` map is. The semver-exempt class is the sub-paths\n * declared under '@theokit/sdk/internal/*' ('internal/persistence', 'internal/security',\n * 'internal/memory-adapters'); no `exports` entry reaches this file that way.\n */\nexport interface ResolveCredentialOptions {\n  /** The provider whose stored credential to resolve. */\n  provider: string;\n  /** Where the credential store lives. */\n  store: CredentialStoreConfig;\n  /** Env for the store's optional `homeEnvVar` override. Never an ambient read. */\n  env?: Record<string, string | undefined>;\n  /** Required to refresh an oauth credential; omit for an api-only store. */\n  oauth?: OAuthProviderConfig;\n  /** Injected HTTP + clock for deterministic tests; default globals. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/** Resolve (and, when a config is supplied, refresh) the oauth variant for the requested provider. */\nasync function resolveOAuth(\n  stored: { provider: string; access: string; expires: number },\n  path: string,\n  opts: ResolveCredentialOptions,\n  env: Record<string, string | undefined>,\n): Promise<ResolvedCredential | undefined> {\n  if (stored.provider !== opts.provider) return undefined;\n  const base: ResolvedCredential = {\n    kind: \"oauth\",\n    provider: opts.provider,\n    apiKey: stored.access,\n    source: path,\n    inferred: false,\n    expiresAt: stored.expires,\n  };\n  if (opts.oauth === undefined) return base; // no config to refresh with — return the stored access token\n  const deps: HttpDeps = {\n    fetch: opts.deps?.fetch ?? fetch,\n    now: opts.deps?.now ?? (() => Date.now()),\n  };\n  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);\n}\n\n/**\n * Resolve a fresh credential for `provider` from the store, or `undefined` if the store holds none for it.\n * oauth credentials are auto-refreshed when `opts.oauth` is supplied; api credentials pass through.\n */\nexport async function resolveCredential(\n  opts: ResolveCredentialOptions,\n): Promise<ResolvedCredential | undefined> {\n  const env = opts.env ?? {};\n  const stored = readAuthFile(opts.store, env);\n  if (stored === undefined) return undefined;\n\n  const path = authFilePath(opts.store, env);\n\n  if (stored.type === \"oauth\") {\n    return resolveOAuth(stored, path, opts, env);\n  }\n\n  // api variant: require the stored `provider` to MATCH the requested provider (M42 review MEDIUM-2).\n  // The generic SDK cannot infer a provider from a key prefix (that was agent-builder app policy), so a\n  // provider-less or mismatched stored key is NOT attributed to the requested provider — otherwise a legacy\n  // `{api_key:\"sk-ant-…\"}` file could be POSTed to the wrong vendor's endpoint (cross-vendor key exposure).\n  // Fail-closed: credential resolution never attributes a key across providers.\n  if (stored.api_key.length === 0) return undefined;\n  if (stored.provider !== opts.provider) return undefined;\n  return {\n    kind: \"api\",\n    provider: opts.provider,\n    apiKey: stored.api_key,\n    source: path,\n    inferred: false,\n  };\n}\n"]}

package/dist/chunk-YRJA2POB.cjs

@@ -1,601 +0,0 @@
-'use strict';
-
-var chunkNVXXWAU7_cjs = require('./chunk-NVXXWAU7.cjs');
-var chunkRA7IE4NK_cjs = require('./chunk-RA7IE4NK.cjs');
-var chunkNAGPKWOD_cjs = require('./chunk-NAGPKWOD.cjs');
-var chunkUNFBHV46_cjs = require('./chunk-UNFBHV46.cjs');
-var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
-var fs = require('fs');
-var path = require('path');
-var url = require('url');
-var zod = require('zod');
-var os = require('os');
-
-var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-// src/internal/providers/registry.ts
-var REGISTRY = chunkNVXXWAU7_cjs.globalSingleton(
-  "theokit-sdk.providers.registry",
-  () => /* @__PURE__ */ new Map()
-);
-var ALIASES = chunkNVXXWAU7_cjs.globalSingleton("theokit-sdk.providers.aliases", () => /* @__PURE__ */ new Map());
-function registerProvider(profile) {
-  if (REGISTRY.has(profile.name)) {
-    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
-`);
-  }
-  REGISTRY.set(profile.name, profile);
-  for (const alias of profile.aliases ?? []) {
-    const previous = ALIASES.get(alias);
-    if (previous !== void 0 && previous !== profile.name) {
-      chunk6LHQPOMI_cjs.diag(`[theokit-sdk] Alias "${alias}" collision: was "${previous}", now "${profile.name}".
-`);
-    }
-    ALIASES.set(alias, profile.name);
-  }
-}
-function getProviderProfile(name) {
-  const canonical = ALIASES.get(name) ?? name;
-  return REGISTRY.get(canonical);
-}
-function listProviders() {
-  return Array.from(REGISTRY.values());
-}
-var MODALITIES = ["text", "audio", "image", "video", "pdf"];
-var costSchema = zod.z.object({
-  /** USD per 1M tokens (models.dev convention). */
-  input: zod.z.number().nonnegative(),
-  output: zod.z.number().nonnegative(),
-  cache_read: zod.z.number().nonnegative().optional(),
-  cache_write: zod.z.number().nonnegative().optional()
-}).loose();
-var limitSchema = zod.z.object({
-  context: zod.z.number().positive(),
-  input: zod.z.number().positive().optional(),
-  output: zod.z.number().positive().optional()
-}).loose();
-var modalitiesSchema = zod.z.object({
-  input: zod.z.array(zod.z.enum(MODALITIES)).optional(),
-  output: zod.z.array(zod.z.enum(MODALITIES)).optional()
-}).loose();
-var catalogModelSchema = zod.z.object({
-  name: zod.z.string().optional(),
-  release_date: zod.z.string().optional(),
-  attachment: zod.z.boolean().optional(),
-  reasoning: zod.z.boolean().optional(),
-  temperature: zod.z.boolean().optional(),
-  tool_call: zod.z.boolean().optional(),
-  /** theokit extension — maps to ModelCapabilities.supportsStructuredOutput. */
-  structured_output: zod.z.boolean().optional(),
-  /** theokit extension — maps to ModelCapabilities.supportsCacheControl. */
-  cache_control: zod.z.boolean().optional(),
-  cost: costSchema.optional(),
-  limit: limitSchema.optional(),
-  modalities: modalitiesSchema.optional(),
-  status: zod.z.enum(["alpha", "beta", "deprecated"]).optional()
-}).loose();
-var catalogEntrySchema = zod.z.object({
-  id: zod.z.string().min(1),
-  displayName: zod.z.string().min(1),
-  apiMode: zod.z.enum([
-    "chat_completions",
-    "anthropic_messages",
-    "responses_api",
-    "bedrock",
-    "bedrock_anthropic"
-  ]),
-  authType: zod.z.enum([
-    "api_key",
-    "oauth_device_code",
-    "oauth_external",
-    "aws_sdk",
-    "aws_bearer",
-    "gcp_oauth",
-    "none"
-  ]),
-  baseUrl: zod.z.string(),
-  envVars: zod.z.array(zod.z.string()),
-  fallbackModels: zod.z.array(zod.z.string()),
-  capabilities: zod.z.object({
-    supportsToolUse: zod.z.boolean(),
-    supportsVision: zod.z.boolean(),
-    supportsStructuredOutput: zod.z.boolean(),
-    supportsStreaming: zod.z.boolean(),
-    supportsCacheControl: zod.z.boolean(),
-    maxContextTokens: zod.z.number().int().positive().optional(),
-    maxOutputTokens: zod.z.number().int().positive().optional()
-  }),
-  aliases: zod.z.array(zod.z.string()).optional(),
-  modelsUrl: zod.z.string().optional(),
-  hostname: zod.z.string().optional(),
-  extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-  models: zod.z.record(zod.z.string(), catalogModelSchema).optional()
-}).loose();
-
-// src/internal/providers/catalog-loader.ts
-var __dirname_resolved = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-YRJA2POB.cjs', document.baseURI).href))));
-var modelInfoIndex = chunkNVXXWAU7_cjs.globalSingleton(
-  "theokit-sdk.providers.model-info-index",
-  () => /* @__PURE__ */ new Map()
-);
-var patchedModelKeys = chunkNVXXWAU7_cjs.globalSingleton(
-  "theokit-sdk.providers.model-info-patched",
-  () => /* @__PURE__ */ new Set()
-);
-var indexState = chunkNVXXWAU7_cjs.globalSingleton("theokit-sdk.providers.model-info-loaded", () => ({
-  loaded: false
-}));
-function getCatalogModelInfo(key) {
-  ensureModelIndexLoaded();
-  return modelInfoIndex.get(key);
-}
-function isPatchedModelKey(key) {
-  return patchedModelKeys.has(key);
-}
-function patchModelInfo(key, model) {
-  ensureModelIndexLoaded();
-  const existing = modelInfoIndex.get(key);
-  modelInfoIndex.set(key, existing === void 0 ? model : { ...existing, ...model });
-  patchedModelKeys.add(key);
-}
-function ensureModelIndexLoaded() {
-  if (indexState.loaded) return;
-  indexState.loaded = true;
-  try {
-    const catalog = loadProviderCatalog();
-    for (const entry of Object.values(catalog)) {
-      indexEntryModels(entry);
-    }
-  } catch (err) {
-    chunk6LHQPOMI_cjs.diag(
-      `[theokit-sdk] WARN: provider catalog unavailable (${err.message}) \u2014 per-model data disabled
-`
-    );
-  }
-}
-function indexEntryModels(entry) {
-  if (entry.models === void 0 || typeof entry.models !== "object") return;
-  for (const [modelId, raw] of Object.entries(entry.models)) {
-    const parsed = catalogModelSchema.safeParse(raw);
-    if (!parsed.success) {
-      chunk6LHQPOMI_cjs.diag(
-        `[theokit-sdk] WARN: Skipping malformed catalog model "${entry.id}/${modelId}": ${parsed.error.issues[0]?.message ?? "invalid"}
-`
-      );
-      continue;
-    }
-    modelInfoIndex.set(`${entry.id}/${modelId}`, parsed.data);
-    for (const alias of entry.aliases ?? []) {
-      const key = `${alias}/${modelId}`;
-      if (!modelInfoIndex.has(key)) modelInfoIndex.set(key, parsed.data);
-    }
-  }
-}
-function validateEntry(raw) {
-  const parsed = catalogEntrySchema.safeParse(raw);
-  return parsed.success ? parsed.data : null;
-}
-function loadProviderCatalog(opts) {
-  const catalogPath = path.join(__dirname_resolved, "provider-catalog.json");
-  const rawText = fs.readFileSync(catalogPath, "utf-8");
-  let entries = JSON.parse(rawText);
-  if (opts?._testInjectMalformed) {
-    entries = [
-      ...entries,
-      { id: "malformed-provider", displayName: "Bad" }
-    ];
-  }
-  const result = {};
-  for (const raw of entries) {
-    const validated = validateEntry(raw);
-    if (validated === null) {
-      chunk6LHQPOMI_cjs.diag(
-        `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}
-`
-      );
-      continue;
-    }
-    result[validated.id] = validated;
-  }
-  return result;
-}
-var _capabilitiesCache = null;
-function getCatalogCapabilities(providerId) {
-  if (_capabilitiesCache === null) {
-    const catalog = loadProviderCatalog();
-    _capabilitiesCache = {};
-    for (const entry of Object.values(catalog)) {
-      _capabilitiesCache[entry.id] = entry.capabilities;
-      for (const alias of entry.aliases ?? []) {
-        if (_capabilitiesCache[alias] === void 0) _capabilitiesCache[alias] = entry.capabilities;
-      }
-    }
-  }
-  return _capabilitiesCache[providerId];
-}
-function registerCatalogProviders(opts) {
-  const catalog = loadProviderCatalog(opts);
-  for (const entry of Object.values(catalog)) {
-    if (getProviderProfile(entry.id) !== void 0) continue;
-    if (entry.aliases?.some((a) => getProviderProfile(a) !== void 0)) continue;
-    const profile = {
-      name: entry.id,
-      apiMode: entry.apiMode,
-      authType: entry.authType,
-      baseUrl: entry.baseUrl,
-      envVars: entry.envVars,
-      fallbackModels: entry.fallbackModels,
-      displayName: entry.displayName,
-      aliases: entry.aliases,
-      modelsUrl: entry.modelsUrl,
-      hostname: entry.hostname,
-      extraHeaders: entry.extraHeaders
-    };
-    registerProvider(profile);
-  }
-}
-
-// src/internal/providers/builtin/anthropic.ts
-var ANTHROPIC = {
-  name: "anthropic",
-  apiMode: "anthropic_messages",
-  envVars: ["ANTHROPIC_API_KEY"],
-  authType: "api_key",
-  baseUrl: "https://api.anthropic.com",
-  modelsUrl: "https://api.anthropic.com/v1/models",
-  hostname: "api.anthropic.com",
-  fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"],
-  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An
-  // Anthropic API constant. The
-  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.
-  extraHeaders: {
-    "anthropic-beta": "interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14"
-  }
-};
-
-// src/internal/providers/builtin/bedrock.ts
-var BEDROCK = {
-  name: "bedrock",
-  apiMode: "bedrock_anthropic",
-  envVars: ["AWS_BEARER_TOKEN_BEDROCK"],
-  authType: "aws_bearer",
-  baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
-  modelsUrl: void 0,
-  hostname: "bedrock-runtime.amazonaws.com",
-  fallbackModels: [
-    "bedrock/us.anthropic.claude-sonnet-4-5-v1:0",
-    "bedrock/us.anthropic.claude-opus-4-7-v1:0",
-    "bedrock/global.anthropic.claude-haiku-4-5-v1:0"
-  ]
-};
-function stripBedrockPrefix(modelId) {
-  return modelId.replace(/^bedrock\//, "");
-}
-function inferRegionFromModelId(modelId) {
-  const id = stripBedrockPrefix(modelId);
-  if (id.startsWith("global.")) return "us-east-1";
-  if (id.startsWith("us.")) return process.env.AWS_REGION ?? "us-east-1";
-  if (id.startsWith("eu.")) return process.env.AWS_REGION ?? "eu-west-1";
-  if (id.startsWith("apac.")) return process.env.AWS_REGION ?? "ap-southeast-1";
-  if (id.startsWith("jp.")) return "ap-northeast-1";
-  return void 0;
-}
-function resolveBedrockBaseUrl(modelId) {
-  const region = inferRegionFromModelId(modelId) ?? process.env.AWS_REGION ?? "us-east-1";
-  return `https://bedrock-runtime.${region}.amazonaws.com`;
-}
-
-// src/internal/providers/builtin/openai-compatible.ts
-function openAiCompatibleProfile(p) {
-  return {
-    apiMode: "chat_completions",
-    authType: "api_key",
-    fallbackModels: [],
-    ...p
-  };
-}
-
-// src/internal/providers/builtin/cerebras.ts
-var CEREBRAS = openAiCompatibleProfile({
-  name: "cerebras",
-  baseUrl: "https://api.cerebras.ai/v1",
-  envVars: ["CEREBRAS_API_KEY"],
-  fallbackModels: ["gpt-oss-120b", "zai-glm-4.7"],
-  extraHeaders: { "X-Cerebras-3rd-Party-Integration": "theokit" },
-  hostname: "api.cerebras.ai"
-});
-
-// src/internal/providers/builtin/cohere.ts
-var COHERE = openAiCompatibleProfile({
-  name: "cohere",
-  baseUrl: "https://api.cohere.ai/compatibility/v1",
-  envVars: ["COHERE_API_KEY", "CO_API_KEY"],
-  fallbackModels: ["command-a-03-2025"],
-  hostname: "api.cohere.ai"
-});
-
-// src/internal/providers/builtin/deepinfra.ts
-var DEEPINFRA = openAiCompatibleProfile({
-  name: "deepinfra",
-  baseUrl: "https://api.deepinfra.com/v1/openai",
-  envVars: ["DEEPINFRA_API_KEY"],
-  fallbackModels: ["Qwen/Qwen3-32B"],
-  hostname: "api.deepinfra.com"
-});
-
-// src/internal/providers/builtin/gemini.ts
-var GEMINI = {
-  name: "gemini",
-  apiMode: "chat_completions",
-  envVars: ["OPENROUTER_API_KEY"],
-  authType: "api_key",
-  baseUrl: "https://openrouter.ai/api",
-  hostname: "openrouter.ai",
-  fallbackModels: ["google/gemini-2.0-flash-001"]
-};
-
-// src/internal/providers/builtin/google.ts
-var GOOGLE = openAiCompatibleProfile({
-  name: "google",
-  baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
-  envVars: ["GOOGLE_API_KEY", "GEMINI_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
-  fallbackModels: ["gemini-2.5-pro", "gemini-2.5-flash"],
-  hostname: "generativelanguage.googleapis.com"
-});
-
-// src/internal/providers/builtin/groq.ts
-var GROQ = openAiCompatibleProfile({
-  name: "groq",
-  baseUrl: "https://api.groq.com/openai/v1",
-  envVars: ["GROQ_API_KEY"],
-  fallbackModels: ["llama-3.3-70b-versatile", "llama-3.1-8b-instant"],
-  hostname: "api.groq.com"
-});
-
-// src/internal/providers/builtin/llamacpp.ts
-var LLAMACPP = {
-  name: "llamacpp",
-  aliases: ["llama-cpp", "llama.cpp"],
-  apiMode: "chat_completions",
-  envVars: ["LLAMACPP_API_KEY"],
-  authType: "none",
-  baseUrl: "http://localhost:8080",
-  modelsUrl: "http://localhost:8080/v1/models",
-  hostname: "localhost",
-  fallbackModels: ["loaded-model"]
-};
-
-// src/internal/providers/builtin/lmstudio.ts
-var LMSTUDIO = {
-  name: "lmstudio",
-  aliases: ["lm-studio", "lm_studio"],
-  apiMode: "chat_completions",
-  envVars: ["LMSTUDIO_API_KEY"],
-  authType: "none",
-  baseUrl: "http://localhost:1234",
-  modelsUrl: "http://localhost:1234/v1/models",
-  hostname: "localhost",
-  fallbackModels: ["loaded-model"]
-};
-
-// src/internal/providers/builtin/mistral.ts
-var MISTRAL = openAiCompatibleProfile({
-  name: "mistral",
-  baseUrl: "https://api.mistral.ai/v1",
-  envVars: ["MISTRAL_API_KEY"],
-  fallbackModels: ["mistral-large-latest", "codestral-latest"],
-  hostname: "api.mistral.ai"
-});
-
-// src/internal/providers/builtin/ollama.ts
-var OLLAMA = {
-  name: "ollama",
-  apiMode: "chat_completions",
-  envVars: ["OLLAMA_API_KEY"],
-  authType: "none",
-  baseUrl: "http://localhost:11434",
-  modelsUrl: "http://localhost:11434/v1/models",
-  hostname: "localhost",
-  fallbackModels: ["llama3.2", "qwen2.5", "mistral"]
-};
-
-// src/internal/providers/builtin/openai.ts
-var OPENAI = {
-  name: "openai",
-  apiMode: "chat_completions",
-  envVars: ["OPENAI_API_KEY"],
-  authType: "api_key",
-  baseUrl: "https://api.openai.com",
-  modelsUrl: "https://api.openai.com/v1/models",
-  hostname: "api.openai.com",
-  fallbackModels: ["gpt-4o", "gpt-4o-mini"]
-};
-var DEFAULT_STORE = {
-  home: os.homedir(),
-  dirName: ".theokit",
-  fileName: "auth.json",
-  homeEnvVar: "THEOKIT_AUTH_HOME"
-};
-var OPENAI_OAUTH_CONFIG = {
-  provider: "openai",
-  authorizeEndpoint: "https://auth.openai.com/oauth/authorize",
-  tokenEndpoint: "https://auth.openai.com/oauth/token",
-  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-  scopes: ["openid", "profile", "email", "offline_access"],
-  redirectUri: "https://auth.openai.com/deviceauth/callback"
-};
-function codexFetch() {
-  return (async (input, init) => {
-    const env = process.env;
-    const resolved = await chunkRA7IE4NK_cjs.resolveCredential({
-      provider: "openai",
-      store: DEFAULT_STORE,
-      oauth: OPENAI_OAUTH_CONFIG,
-      env
-    });
-    if (resolved === void 0) {
-      throw new chunkUNFBHV46_cjs.AuthenticationError(
-        'openai-chatgpt: no ChatGPT credential found \u2014 run the OpenAI device login (e.g. "/login openai") first.',
-        { code: "missing_credential" }
-      );
-    }
-    const accountId = chunkNAGPKWOD_cjs.readStoredOAuth(DEFAULT_STORE, env)?.account_id;
-    const headers = new Headers(init?.headers);
-    headers.set("authorization", `Bearer ${resolved.apiKey}`);
-    if (accountId !== void 0) headers.set("ChatGPT-Account-Id", accountId);
-    return fetch(input, { ...init, headers });
-  });
-}
-var OPENAI_CHATGPT = {
-  name: "openai-chatgpt",
-  apiMode: "responses_api",
-  authType: "oauth_device_code",
-  baseUrl: "https://chatgpt.com/backend-api/codex",
-  envVars: [],
-  fallbackModels: [
-    "openai-chatgpt/gpt-5.4",
-    "openai-chatgpt/gpt-5.4-mini",
-    "openai-chatgpt/gpt-5.5"
-  ],
-  // #165 — this shipped as `codex_cli_rs`, another vendor's client identifier. Claiming to be a different
-  // vendor's client is a false statement of identity. Third-party clients send their OWN name against
-  // this same endpoint, which also shows the route is not restricted to the official client.
-  extraHeaders: { originator: "theokit" },
-  // usetheokit/theokit-sdk#383 — carry the model's encrypted reasoning between the rounds of a turn.
-  // On for THIS profile and no other because this is the endpoint the issue measured: OpenAI Codex
-  // sends `include: ["reasoning.encrypted_content"]` with `reasoning.context: "all_turns"` to the
-  // same backend, same model, on the same account, so acceptance is observed rather than assumed.
-  // The issue's measurement — a third of our bytes, 2.8x our tokens — is what this closes together
-  // with `prompt_cache_key`.
-  encryptedReasoning: true,
-  transform: {
-    // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.
-    fetch: () => codexFetch()
-  }
-};
-
-// src/internal/providers/builtin/openrouter.ts
-var OPENROUTER = {
-  name: "openrouter",
-  apiMode: "chat_completions",
-  aliases: ["or"],
-  // Ordered fallback (EC-10): OPENROUTER_API_KEY preferred, OPENAI_API_KEY as compat.
-  envVars: ["OPENROUTER_API_KEY", "OPENAI_API_KEY"],
-  authType: "api_key",
-  baseUrl: "https://openrouter.ai/api",
-  modelsUrl: "https://openrouter.ai/api/v1/models",
-  hostname: "openrouter.ai",
-  // M45 — models refreshed (claude-3-haiku retired upstream).
-  fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-haiku-4-5"],
-  // M45 — OpenRouter app-attribution headers. VALUES are
-  // theokit's own — copying another app's referer would misattribute traffic).
-  extraHeaders: { "HTTP-Referer": "https://usetheo.dev", "X-Title": "theokit" }
-};
-
-// src/internal/providers/builtin/perplexity.ts
-var PERPLEXITY = openAiCompatibleProfile({
-  name: "perplexity",
-  baseUrl: "https://api.perplexity.ai",
-  chatCompletionsPath: "/chat/completions",
-  envVars: ["PERPLEXITY_API_KEY"],
-  fallbackModels: ["sonar-pro", "sonar"],
-  hostname: "api.perplexity.ai"
-});
-
-// src/internal/providers/builtin/together.ts
-var TOGETHER = openAiCompatibleProfile({
-  name: "together",
-  aliases: ["togetherai"],
-  baseUrl: "https://api.together.xyz/v1",
-  envVars: ["TOGETHER_API_KEY"],
-  fallbackModels: ["Qwen/Qwen2.5-7B-Instruct-Turbo"],
-  hostname: "api.together.xyz"
-});
-
-// src/internal/providers/builtin/vertex.ts
-var VERTEX = {
-  name: "vertex",
-  apiMode: "anthropic_messages",
-  // sub-dispatched in selectTransport by profile.name
-  envVars: ["GOOGLE_APPLICATION_CREDENTIALS"],
-  authType: "gcp_oauth",
-  baseUrl: "https://us-central1-aiplatform.googleapis.com",
-  modelsUrl: void 0,
-  hostname: "aiplatform.googleapis.com",
-  fallbackModels: [
-    "vertex/anthropic/claude-sonnet-4-5@20250929",
-    "vertex/google/gemini-2.0-flash-001"
-  ]
-};
-function resolveVertexBaseUrl(opts) {
-  const host = opts.location === "global" ? "aiplatform.googleapis.com" : `${opts.location}-aiplatform.googleapis.com`;
-  if (opts.modelDialect === "gemini") {
-    return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/endpoints/openapi`;
-  }
-  return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/publishers/anthropic`;
-}
-function inferModelDialect(modelId) {
-  if (modelId.includes("/anthropic/")) return "anthropic";
-  if (modelId.includes("/google/")) return "gemini";
-  return "gemini";
-}
-function stripVertexPrefix(modelId) {
-  return modelId.replace(/^vertex\/(anthropic|google)\//, "");
-}
-
-// src/internal/providers/builtin/xai.ts
-var XAI = openAiCompatibleProfile({
-  name: "xai",
-  aliases: ["grok"],
-  baseUrl: "https://api.x.ai/v1",
-  envVars: ["XAI_API_KEY"],
-  fallbackModels: ["grok-4.5", "grok-4.3"],
-  hostname: "api.x.ai"
-});
-
-// src/internal/providers/builtin/index.ts
-var _registeredState = chunkNVXXWAU7_cjs.globalSingleton("theokit-sdk.providers.builtins-registered", () => ({
-  done: false
-}));
-function registerBuiltins() {
-  if (_registeredState.done) return;
-  _registeredState.done = true;
-  registerProvider(ANTHROPIC);
-  registerProvider(OPENAI);
-  registerProvider(OPENAI_CHATGPT);
-  registerProvider(OPENROUTER);
-  registerProvider(GEMINI);
-  registerProvider(OLLAMA);
-  registerProvider(LMSTUDIO);
-  registerProvider(LLAMACPP);
-  registerProvider(BEDROCK);
-  registerProvider(VERTEX);
-  registerProvider(GOOGLE);
-  registerProvider(MISTRAL);
-  registerProvider(GROQ);
-  registerProvider(COHERE);
-  registerProvider(DEEPINFRA);
-  registerProvider(TOGETHER);
-  registerProvider(XAI);
-  registerProvider(PERPLEXITY);
-  registerProvider(CEREBRAS);
-  registerCatalogProviders();
-}
-
-exports.catalogModelSchema = catalogModelSchema;
-exports.getCatalogCapabilities = getCatalogCapabilities;
-exports.getCatalogModelInfo = getCatalogModelInfo;
-exports.getProviderProfile = getProviderProfile;
-exports.inferModelDialect = inferModelDialect;
-exports.inferRegionFromModelId = inferRegionFromModelId;
-exports.isPatchedModelKey = isPatchedModelKey;
-exports.listProviders = listProviders;
-exports.loadProviderCatalog = loadProviderCatalog;
-exports.patchModelInfo = patchModelInfo;
-exports.registerBuiltins = registerBuiltins;
-exports.registerProvider = registerProvider;
-exports.resolveBedrockBaseUrl = resolveBedrockBaseUrl;
-exports.resolveVertexBaseUrl = resolveVertexBaseUrl;
-exports.stripBedrockPrefix = stripBedrockPrefix;
-exports.stripVertexPrefix = stripVertexPrefix;
-//# sourceMappingURL=chunk-YRJA2POB.cjs.map
-//# sourceMappingURL=chunk-YRJA2POB.cjs.map