@verevoir/review 0.3.0 → 0.3.2

package/node_modules/@verevoir/llm/dist/samba/catalog.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @verevoir/llm/samba's model catalogue — PURE DATA, no SDK import.
+ *
+ * Split out of `./index.ts` (STDIO — "catalog without the SDK") so a consumer
+ * that only wants to RESOLVE a model term never has to import `openai` (the
+ * SDK `./index.ts` uses to actually call SambaNova's OpenAI-compatible
+ * endpoint) just to read this array. `./index.ts` still imports this file and
+ * registers it exactly as before. See `../catalog.ts` for the SDK-free
+ * registration entry point this file exists to serve.
+ *
+ * Model ids verified against the live SambaNova `/models` catalogue (2026-06):
+ * it hosts a small rotating set (Llama-3.3-70B, DeepSeek-V3.x, gpt-oss, gemma,
+ * MiniMax). Defaults: reasoning → Llama-3.3-70B, extraction → DeepSeek-V3.2
+ * (both tool-capable). Pricing is approximate worst-case USD/Mtok; refresh when
+ * SambaNova republishes. Decisions key on provider/family, so the exact id is
+ * reporting metadata and a new V3 point-release still normalises via the prefix.
+ */
+import type { ModelCatalogEntry, ProviderConnection } from '../index.js';
+export declare const PROVIDER = "samba";
+/** SambaNova's OpenAI-compatible base URL. */
+export declare const BASE_URL = "https://api.sambanova.ai/v1";
+export declare const CONNECTION: ProviderConnection;
+export declare const CATALOG: ModelCatalogEntry[];
+//# sourceMappingURL=catalog.d.ts.map

package/node_modules/@verevoir/llm/dist/samba/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/samba/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,eAAO,MAAM,QAAQ,UAAU,CAAC;AAEhC,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,gCAAgC,CAAC;AAItD,eAAO,MAAM,UAAU,EAAE,kBAKxB,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,iBAAiB,EAmBtC,CAAC"}

package/node_modules/@verevoir/llm/dist/samba/catalog.js

@@ -0,0 +1,49 @@
+/**
+ * @verevoir/llm/samba's model catalogue — PURE DATA, no SDK import.
+ *
+ * Split out of `./index.ts` (STDIO — "catalog without the SDK") so a consumer
+ * that only wants to RESOLVE a model term never has to import `openai` (the
+ * SDK `./index.ts` uses to actually call SambaNova's OpenAI-compatible
+ * endpoint) just to read this array. `./index.ts` still imports this file and
+ * registers it exactly as before. See `../catalog.ts` for the SDK-free
+ * registration entry point this file exists to serve.
+ *
+ * Model ids verified against the live SambaNova `/models` catalogue (2026-06):
+ * it hosts a small rotating set (Llama-3.3-70B, DeepSeek-V3.x, gpt-oss, gemma,
+ * MiniMax). Defaults: reasoning → Llama-3.3-70B, extraction → DeepSeek-V3.2
+ * (both tool-capable). Pricing is approximate worst-case USD/Mtok; refresh when
+ * SambaNova republishes. Decisions key on provider/family, so the exact id is
+ * reporting metadata and a new V3 point-release still normalises via the prefix.
+ */
+export const PROVIDER = 'samba';
+/** SambaNova's OpenAI-compatible base URL. */
+export const BASE_URL = 'https://api.sambanova.ai/v1';
+// Pure data — see src/anthropic/catalog.ts's CONNECTION comment for why this
+// is registered both here and by ../catalog.ts.
+export const CONNECTION = {
+    provider: PROVIDER,
+    apiKeyEnv: 'SAMBA_NOVA_API_KEY',
+    baseUrlEnv: 'SAMBA_NOVA_BASE_URL',
+    defaultBaseUrl: BASE_URL,
+};
+export const CATALOG = [
+    {
+        provider: PROVIDER,
+        family: 'llama-70b',
+        modelClass: 'reasoning',
+        currentId: 'Meta-Llama-3.3-70B-Instruct',
+        rates: [0.6, 1.2],
+        label: 'Llama 3.3 70B',
+        prefixes: ['Meta-Llama-3.3-70B'],
+    },
+    {
+        provider: PROVIDER,
+        family: 'deepseek-v3',
+        modelClass: 'extraction',
+        currentId: 'DeepSeek-V3.2',
+        rates: [0.6, 1.5],
+        label: 'DeepSeek V3.2',
+        prefixes: ['DeepSeek-V3'],
+    },
+];
+//# sourceMappingURL=catalog.js.map

package/node_modules/@verevoir/llm/dist/samba/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/samba/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC;AAEhC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAEtD,6EAA6E;AAC7E,gDAAgD;AAChD,MAAM,CAAC,MAAM,UAAU,GAAuB;IAC5C,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,oBAAoB;IAC/B,UAAU,EAAE,qBAAqB;IACjC,cAAc,EAAE,QAAQ;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAwB;IAC1C;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW;QACnB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,6BAA6B;QACxC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;QACjB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,CAAC,oBAAoB,CAAC;KACjC;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;QACjB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,CAAC,aAAa,CAAC;KAC1B;CACF,CAAC"}

package/node_modules/@verevoir/llm/dist/samba/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @verevoir/llm/samba — SambaNova adapter (OpenAI-compatible).
+ *
+ * SambaNova serves open models behind an OpenAI-compatible Chat Completions
+ * API, so this adapter is built from the shared {@link createOpenAICompatAdapter}
+ * factory. Importing this subpath requires `openai` as a peer dependency. Auth
+ * via `SAMBA_NOVA_API_KEY` (or a per-call `apiKey`). Ships `chat()` only.
+ *
+ * SambaNova hosts a rotating catalogue of open models; the ids + pricing below
+ * are sensible defaults — verify against the current SambaNova catalogue. Since
+ * decisions key on `provider/family` (STDIO-332), the exact version id is
+ * reporting metadata, and a new version of a listed family still normalises via
+ * its prefix.
+ */
+import { PROVIDER, BASE_URL } from './catalog.js';
+export { PROVIDER, BASE_URL };
+export declare const models: Readonly<Record<import("../index.js").ModelClass, string>>;
+export declare const rates: Readonly<Record<string, import("../index.js").RateTuple>>;
+export declare const chat: (options: import("../index.js").ChatOptions) => Promise<import("../index.js").ChatReply>;
+export declare const chatWithTools: (options: import("../index.js").ChatWithToolsOptions) => Promise<import("../index.js").ChatWithToolsResult>;
+export declare const chatWithToolLoop: (options: import("../index.js").ChatWithToolLoopOptions) => Promise<import("../index.js").ChatWithToolLoopResult>;
+/** Namespaced form for callers that prefer `samba.chat(...)`. */
+export declare const samba: import("../openai-compat.js").OpenAICompatAdapter;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@verevoir/llm/dist/samba/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/samba/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,QAAQ,EAAW,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAU9B,eAAO,MAAM,MAAM,4DAAiB,CAAC;AACrC,eAAO,MAAM,KAAK,2DAAgB,CAAC;AACnC,eAAO,MAAM,IAAI,0FAAe,CAAC;AACjC,eAAO,MAAM,aAAa,6GAAwB,CAAC;AACnD,eAAO,MAAM,gBAAgB,mHAA2B,CAAC;AAEzD,iEAAiE;AACjE,eAAO,MAAM,KAAK,mDAAU,CAAC"}

package/node_modules/@verevoir/llm/dist/samba/index.js

@@ -0,0 +1,32 @@
+/**
+ * @verevoir/llm/samba — SambaNova adapter (OpenAI-compatible).
+ *
+ * SambaNova serves open models behind an OpenAI-compatible Chat Completions
+ * API, so this adapter is built from the shared {@link createOpenAICompatAdapter}
+ * factory. Importing this subpath requires `openai` as a peer dependency. Auth
+ * via `SAMBA_NOVA_API_KEY` (or a per-call `apiKey`). Ships `chat()` only.
+ *
+ * SambaNova hosts a rotating catalogue of open models; the ids + pricing below
+ * are sensible defaults — verify against the current SambaNova catalogue. Since
+ * decisions key on `provider/family` (STDIO-332), the exact version id is
+ * reporting metadata, and a new version of a listed family still normalises via
+ * its prefix.
+ */
+import { createOpenAICompatAdapter } from '../openai-compat.js';
+import { PROVIDER, CATALOG, BASE_URL } from './catalog.js';
+export { PROVIDER, BASE_URL };
+const adapter = createOpenAICompatAdapter({
+    provider: PROVIDER,
+    baseURL: BASE_URL,
+    baseUrlEnv: 'SAMBA_NOVA_BASE_URL',
+    apiKeyEnv: 'SAMBA_NOVA_API_KEY',
+    catalog: CATALOG,
+});
+export const models = adapter.models;
+export const rates = adapter.rates;
+export const chat = adapter.chat;
+export const chatWithTools = adapter.chatWithTools;
+export const chatWithToolLoop = adapter.chatWithToolLoop;
+/** Namespaced form for callers that prefer `samba.chat(...)`. */
+export const samba = adapter;
+//# sourceMappingURL=index.js.map

package/node_modules/@verevoir/llm/dist/samba/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/samba/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAE9B,MAAM,OAAO,GAAG,yBAAyB,CAAC;IACxC,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,oBAAoB;IAC/B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;AACnC,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AAEzD,iEAAiE;AACjE,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC"}

package/node_modules/@verevoir/llm/llms.txt

@@ -0,0 +1,218 @@
+# @verevoir/llm
+
+Provider-agnostic LLM call surface with token + cost accounting.
+
+## Purpose
+
+Lets a downstream project make LLM calls with retry-friendly errors, token
+accounting, per-direction cost tracking, and tool-calling, without coupling to a
+specific provider SDK. Pick the provider you use via a subpath import; the unused
+SDK does not enter your bundle.
+
+## Subpaths
+
+- `@verevoir/llm` — core types, the `chat()` / tool-calling contracts, cost
+  accounting, and the model catalog + provider-routing helpers. No SDK dependency.
+- `@verevoir/llm/anthropic` — Anthropic SDK adapter (`chat`, `chatWithTools`,
+  `chatWithToolLoop`, live `onProgress`). Requires `@anthropic-ai/sdk`.
+- `@verevoir/llm/google` — Google Gemini SDK adapter (`chat`, `chatWithTools`,
+  `chatWithToolLoop` as of 0.13.0). Requires `@google/genai`.
+- `@verevoir/llm/openai` — OpenAI adapter via the Responses API
+  (`chat`; `chatWithTools` + `chatWithToolLoop` via the OpenAI-compatible factory).
+  Requires `openai`. The only keyless-capable adapter: a base-URL override with a
+  blank key points it at a local server (LM Studio / Ollama / vLLM).
+- `@verevoir/llm/deepseek` — DeepSeek adapter, OpenAI-compatible via the Chat
+  Completions API at `https://api.deepseek.com`. Reuses the `openai` peer — no
+  separate SDK. `chat` + tool-calling.
+- `@verevoir/llm/samba` — SambaNova adapter (`SAMBA_NOVA_API_KEY`),
+  OpenAI-compatible. `chat` + tool-calling.
+- `@verevoir/llm/mistral` — Mistral adapter (`MISTRAL_API_KEY`),
+  OpenAI-compatible. `chat` + tool-calling.
+- `@verevoir/llm/claude-cli` — shells out to the real Claude Code CLI
+  (`claude -p`) as a subscription-only substrate, for a caller that must run on
+  a subscription credential rather than a billed API key (imitating Claude Code
+  to the raw Messages API is not a sanctioned route). Provider id `'claude-cli'`,
+  deliberately distinct from `'anthropic'`; never registered into the model
+  catalog or connection registry — `resolveModel`/`resolveModelByTerm` can never
+  silently substitute it, a caller wanting this substrate imports and calls it
+  directly. `chat()` only. No SDK dependency — it spawns a subprocess, and
+  that subprocess's environment is built from an allowlist — only `PATH`,
+  `HOME`, `TMPDIR`, and the CLI's own subscription-credential env var
+  (`CLAUDE_CODE_OAUTH_TOKEN`) ever reach it; nothing else in the caller's
+  environment, billed credential or not, is passed through. Replaced an
+  earlier denylist that had already missed one live credential vector
+  (`ANTHROPIC_AUTH_TOKEN`) in an earlier version — a denylist can only
+  exclude names someone thought of; the allowlist doesn't need to.
+  Fresh-spawn `chat()` calls are bounded by an IDLE-output timeout (not
+  wall-clock — resets on every stdout/stderr chunk, including tool-call
+  activity, so tool time never counts as silence): default 10 minutes,
+  override per call via `idleTimeoutMs` or process-wide via
+  `CLAUDE_CLI_IDLE_TIMEOUT_MS`. On expiry the child is killed and the call
+  rejects with `.code === 'CLAUDE_CLI_IDLE_TIMEOUT'` plus `.timeoutMs`.
+
+Every provider in the matrix (Anthropic, Google, OpenAI, DeepSeek, SambaNova,
+Mistral) can now drive the tool loop. `claude-cli` is a separate, deliberately
+non-interchangeable substrate and is not part of that matrix.
+
+- `@verevoir/llm/catalog` — registers every catalogued provider's model
+  catalogue (anthropic, mistral, samba) AND connection (env var names only) as
+  an import side effect, with **no SDK import anywhere in its import graph** —
+  unlike the real adapter subpaths above, each of which requires its SDK as a
+  peer dependency. For a consumer that only needs `resolveModelByTerm`, a
+  label, or a rate (never a real call) — e.g. selecting a reviewer model by
+  name — importing this subpath resolves it with zero SDK as a transitive
+  dependency. Also re-exports the raw `ANTHROPIC_CATALOG` / `MISTRAL_CATALOG` /
+  `SAMBA_CATALOG` arrays for a consumer that wants the data directly. The real
+  adapter subpaths are unchanged for an existing consumer — each still
+  registers its own catalogue + connection itself, idempotently, so importing
+  both this subpath and a real adapter is a no-op the second time, not a
+  conflict. `/openai`, `/deepseek`, `/google` are not included — they never
+  used `ModelCatalogEntry`/`registerModelCatalog` in the first place. `/claude-cli`
+  stays deliberately unregistered, per its own design.
+
+## Install
+
+```bash
+npm install @verevoir/llm @anthropic-ai/sdk
+```
+
+The package's `peerDependencies` are marked optional — install only the SDK(s)
+you import (`@anthropic-ai/sdk`, `@google/genai`, `openai`; the OpenAI-compatible
+providers share `openai`).
+
+## Canonical usage
+
+```ts
+import { anthropic } from '@verevoir/llm/anthropic';
+
+const reply = await anthropic.chat({
+  systemPrompt: '...',
+  turns: [{ role: 'user', content: '...' }],
+  // Omit apiKey when auth is ambient: it resolves from the env
+  // (CLAUDE_CODE_OAUTH_TOKEN preferred, else ANTHROPIC_API_KEY). Pass apiKey
+  // ONLY to force a specific key (BYOK) — an explicit key short-circuits OAuth.
+  modelClass: 'reasoning', // 'reasoning' | 'drafting' | 'extraction'
+});
+
+// reply.content: string
+// reply.usage:   { provider, model, direction, inputTokens, outputTokens, ... }
+```
+
+## Tool calling
+
+Each adapter exposes, alongside `chat()`:
+- `chatWithTools(options)` — single-shot; surfaces the model's `ToolUse[]` for
+  the caller to execute.
+- `chatWithToolLoop(options)` — runs model → execute tools → feed results back →
+  repeat, to a `maxIterations` cap. Takes a `ToolExecutor`
+  (`(toolUse) => Promise<string | ContentBlock[]>`) plus per-iteration
+  `onUsage` / `onIteration` hooks; usage is summed across the loop.
+
+Provider-agnostic types `ToolDef`, `ToolUse`, `ToolExecutor`, `ContentBlock`
+(`text` | `tool_use` | `tool_result` | `image` | `document`), plus
+`UnsupportedContentBlockError` and `collapseContentToText(provider, content)`:
+a provider that cannot carry a block type (only `@verevoir/llm/anthropic`
+carries `image`/`document`) throws this error, naming the provider and
+block type. Inside a tool executor's result it becomes a named `is_error`
+tool_result; inside a user turn the caller built, it throws. The
+`ChatWithTools*` / `ChatWithToolLoop*` option/result shapes live on the
+core export.
+
+## Cost accounting
+
+Every call returns a `TokenUsage` typed
+`{ provider, model, direction, route, inputTokens, outputTokens, ... }` (with
+optional `substrateVersion` — which version of an external substrate, e.g. the
+`claude` CLI, served the call, `undefined` for a direct API adapter — and
+optional `cacheRead` / `cacheWrite` so prompt-cache savings price at their own
+rates). `route` (`CredentialRoute`, a core export: `'api-key'` |
+`'subscription-oauth'` | `'mixed'`) reports which credential mechanism actually
+served a call, positively, never left to be inferred from what's absent. The
+core export ships `sumUsages` / `parseUsage` to roll up across calls,
+`totalTokens`, `formatTokensCompact` for compact displays, and
+`createPriceBook` / `book.costOf(...)` — the cost API, pricing from
+LiteLLM's live price table (a bundled snapshot as fallback) and reporting an
+unmatched model as `unpriced`, never `0`. The older `estimateCostUSD`,
+`RatesTable` / `RateTuple`, `catalogEntryFor`, and `uncoveredModels` are kept
+for back-compat but `@deprecated` — new code should use `createPriceBook`.
+
+The `direction` field carries the model-class semantic (`reasoning` /
+`drafting` / `extraction`) so per-conversation / per-project rollups can break
+down "spent X on reasoning + Y on extraction" natively.
+
+For auditing, `setModelSpanSink(sink)` (core export) registers an optional
+process-wide sink that receives a `ModelSpan` — the call's `TokenUsage` plus the
+emitting `scope`, e.g. `samba.chatWithToolLoop` — once per underlying model call,
+from **every** adapter and every entry point (`chat`, `chatWithTools`, and
+`chatWithToolLoop`). A `chatWithToolLoop` call emits one span per iteration with
+that iteration's own usage, so expect multiple spans from a single loop call.
+Off by default; fail-soft; pass `null` to detach.
+
+## Advisor pair
+
+`withAdvisor(tools, executor, advisor)` (core export, SDK-free) wraps a tool
+set + executor so a cheap executor model can consult a stronger advisor
+mid-loop: it appends a `consult_advisor` ToolDef (question required, context
+optional; input never mutated, name collision throws at wrap time) and routes
+consult calls to the injected `advisor.chat` — any adapter's `chat`, bound by
+the caller — with the advisor's `systemPrompt` and `modelClass: 'reasoning'`.
+The advisor guides, it never certifies: its reply returns as an ordinary tool
+result. A failing advisor yields a legible "advisor unavailable" result rather
+than a throw, so a dead advisor never kills the work; a missing or empty
+question returns a legible ask-again result without calling the advisor.
+Optional `onConsult`
+hook (fail-soft, not fired on advisor failure) reports each consult's
+question/context/answer/usage for consult-rate metrics; the advisor's own
+adapter emits its model span as usual.
+
+## Model catalog + provider routing
+
+Model identity is de-brittled — decisions key on `provider/family`, not the exact
+version string, so a version bump doesn't zero a model's cost.
+
+- `registerModelCatalog(entries)` / `ModelCatalogEntry` — an adapter declares each
+  family once; `models` / `rates` / labels derive from it. `normalizeModelId(id)`
+  resolves a drifted version forward to `{ provider, family }`; `catalogEntryFor`,
+  `modelLabel`, `registerModelLabels` round it out.
+- Provider connection registry — adapters register their connection on import, so
+  routing can answer `isProviderConfigured` / `configuredProviders`,
+  `providersForFamily(family)` (the inverse index), and `resolveModel({ family?, modelClass?, configuredOnly?, prefer? })`
+  (cheapest configured by default). `resolveModelByTerm(term, opts)` resolves a
+  loose human term ("deepseek") to a catalog entry; `modelConnection(term, opts)`
+  returns a ready OpenAI-compatible `{ provider, modelId, baseUrl, apiKey }`.
+  A connection may also declare `altKeyEnvs` — additional env vars whose presence makes
+  the provider usable, because the credential CHECK must recognise every credential the
+  CALL path accepts. Anthropic declares `CLAUDE_CODE_OAUTH_TOKEN`, so the subscription
+  token alone configures it, with no `ANTHROPIC_API_KEY` needed.
+- `<PROVIDER>_BASE_URL` overrides — every adapter honours an env override for its
+  endpoint (`OPENAI_BASE_URL`, `ANTHROPIC_BASE_URL`, `GEMINI_BASE_URL` /
+  `GOOGLE_BASE_URL`, `MISTRAL_BASE_URL`, `DEEPSEEK_BASE_URL`, `SAMBA_NOVA_BASE_URL`),
+  so a provider can be pointed at a gateway / proxy / regional / self-hosted
+  endpoint without a code change. The override is keyed by **provider/endpoint,
+  not model**: running DeepSeek-V3 *via SambaNova* uses `SAMBA_NOVA_*`, not
+  `DEEPSEEK_*`. Setting only `OPENAI_BASE_URL` with no key is treated as a
+  **keyless local endpoint** (LM Studio / Ollama / vLLM) — the generic OpenAI
+  client builds with a placeholder key and routing counts it usable. Every other
+  hosted provider (Anthropic, Gemini, SambaNova, Mistral, DeepSeek) always needs
+  its key; a base-URL override alone does not make it configured. Routing sees
+  only providers whose subpath has been imported.
+- Anthropic subscription auth — the Anthropic adapter prefers
+  `CLAUDE_CODE_OAUTH_TOKEN` (a Claude subscription token from `claude setup-token`)
+  over the metered `ANTHROPIC_API_KEY`, sending it as a bearer token with the
+  required `anthropic-beta` flag + a Claude-Code system identity (both overridable
+  via `ANTHROPIC_OAUTH_BETA` / `ANTHROPIC_OAUTH_SYSTEM`). Precedence: an explicit
+  per-call `apiKey` → `CLAUDE_CODE_OAUTH_TOKEN` → `ANTHROPIC_API_KEY` (fallback
+  only), so a set subscription token means the metered key is never billed.
+
+## Status
+
+Pre-stable: the `0.x` line communicates that the API surface can shift before
+`1.0`. Track changes in the repo's CHANGELOG.
+
+## Repository
+
+`git@github.com:verevoir/llm.git`
+
+## License
+
+Apache-2.0.

package/node_modules/@verevoir/llm/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "@verevoir/llm",
+  "version": "0.35.0",
+  "description": "Provider-agnostic LLM call surface with token + cost accounting. SDK adapters in subpaths.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./catalog": {
+      "types": "./dist/catalog.d.ts",
+      "import": "./dist/catalog.js"
+    },
+    "./anthropic": {
+      "types": "./dist/anthropic/index.d.ts",
+      "import": "./dist/anthropic/index.js"
+    },
+    "./google": {
+      "types": "./dist/google/index.d.ts",
+      "import": "./dist/google/index.js"
+    },
+    "./openai": {
+      "types": "./dist/openai/index.d.ts",
+      "import": "./dist/openai/index.js"
+    },
+    "./deepseek": {
+      "types": "./dist/deepseek/index.d.ts",
+      "import": "./dist/deepseek/index.js"
+    },
+    "./samba": {
+      "types": "./dist/samba/index.d.ts",
+      "import": "./dist/samba/index.js"
+    },
+    "./mistral": {
+      "types": "./dist/mistral/index.d.ts",
+      "import": "./dist/mistral/index.js"
+    },
+    "./claude-cli": {
+      "types": "./dist/claude-cli/index.d.ts",
+      "import": "./dist/claude-cli/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "llms.txt",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "prettier --check .",
+    "format": "prettier --write .",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build && node scripts/check-dist-esm.mjs"
+  },
+  "peerDependencies": {
+    "@anthropic-ai/sdk": "*",
+    "@google/genai": "*",
+    "@opentelemetry/api": "^1.9.0",
+    "openai": "*"
+  },
+  "peerDependenciesMeta": {
+    "@anthropic-ai/sdk": {
+      "optional": true
+    },
+    "@google/genai": {
+      "optional": true
+    },
+    "openai": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@anthropic-ai/sdk": "^0.95.1",
+    "@google/genai": "^2.4.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.11.0",
+    "@types/node": "^25.8.0",
+    "openai": "^6.38.0",
+    "prettier": "^3",
+    "typescript": "^5",
+    "vitest": "^4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/verevoir/llm.git"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "overrides": {
+    "vite": "^8.0.16",
+    "protobufjs": "^7.6.5",
+    "postcss": "^8.5.18"
+  }
+}

package/node_modules/fast-sha256/LICENSE

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org>

package/node_modules/fast-sha256/README.md

@@ -0,0 +1,127 @@
+fast-sha256-js
+==============
+
+SHA-256 implementation for JavaScript/TypeScript with typed arrays
+that works in modern browsers and Node.js.
+Implements the hash function, HMAC, and PBKDF2.
+
+Public domain. No warranty.
+
+[![Build Status](https://travis-ci.org/dchest/fast-sha256-js.svg?branch=master)
+](https://travis-ci.org/dchest/fast-sha256-js)
+
+
+Installation
+------------
+
+You can install fast-sha256-js via [NPM](https://www.npmjs.org/):
+
+    $ npm install fast-sha256
+
+or [download source code](https://github.com/dchest/fast-sha256-js/releases).
+
+
+Usage
+-----
+
+Functions accept and return `Uint8Array`s.
+To convert strings, use external library (for example,
+[nacl.util](https://github.com/dchest/tweetnacl-util-js/)).
+
+### sha256(message)
+
+Returns a SHA-256 hash of the message.
+
+
+### sha256.hmac(key, message)
+
+Returns an HMAC-SHA-256 of the message for the key.
+
+
+### sha256.pbkdf2(password, salt, rounds, dkLen)
+
+Returns a key of length dkLen derived using PBKDF2-HMAC-SHA256
+from the given password, salt, and the number of rounds.
+
+
+### sha256.hkdf(key, salt, info?, length?)
+
+Returns a key of the given length derived using HKDF as
+described in RFC 5869.
+
+There are also classes `Hash` and `HMAC`:
+
+### new sha256.Hash()
+
+Constructor for hash instance. Should be used with `new`.
+Available methods: `update()`, `digest()`, `reset()`, etc.
+
+### new sha256.HMAC(key)
+
+Constructor for HMAC instance. Should be used with `new`.
+Available methods: `update()`, `digest()`, `reset()`, etc.
+
+See comments in `src/sha256.ts` for details.
+
+
+Usage with TypeScript
+---------------------
+
+```typescript
+import sha256, { Hash, HMAC } from "fast-sha256";
+
+sha256(data) // default export is hash
+
+const h = new HMAC(key); // also Hash and HMAC classes
+const mac = h.update(data).digest();
+
+// alternatively:
+
+import * as sha256 from "fast-sha256";
+
+sha256.pbkdf2(password, salt, iterations, dkLen); // returns derived key
+sha256.hash(data)
+
+const hasher = new sha256.Hash();
+hasher.update(data1);
+hasher.update(data2);
+const result = hasher.digest();
+```
+
+
+Testing and building
+--------------------
+
+Install development dependencies:
+
+    $ npm install
+
+Build JavaScript, minified version, and typings:
+
+    $ npm run build
+
+Run tests:
+
+    $ npm test
+
+Run tests on a different source file:
+
+    $ SHA256_SRC=sha256.min.js npm test
+
+Run benchmark:
+
+    $ npm run bench
+
+(or in a browser, open `tests/bench.html`).
+
+Lint:
+
+    $ npm run lint
+
+
+Notes
+-----
+
+While this implementation is pretty fast compared to previous generation
+implementations, if you need an even faster one, check out
+[asmCrypto](https://github.com/vibornoff/asmcrypto.js).

package/node_modules/fast-sha256/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "fast-sha256",
+  "version": "1.3.0",
+  "description": "SHA-256, HMAC and PBKDF2 implementation with typed arrays for modern browsers and Node.js",
+  "main": "sha256.js",
+  "files": [
+    "sha256.js",
+    "sha256.min.js",
+    "sha256.d.ts"
+  ],
+  "typings": "sha256",
+  "directories": {
+    "test": "test"
+  },
+  "scripts": {
+    "build": "tsc && echo '});' | cat build/umd-prelude.js build/sha256.js - > sha256.js && rm build/sha256.js && uglifyjs sha256.js -c -m -o sha256.min.js && mv build/sha256.d.ts ./",
+    "test": "tape test/test.js | faucet",
+    "bench": "node test/bench.js",
+    "lint": "tslint src/*.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dchest/fast-sha256-js"
+  },
+  "keywords": [
+    "hash",
+    "sha256",
+    "pbkdf2",
+    "cryptography",
+    "crypto",
+    "hmac"
+  ],
+  "author": "Dmitry Chestnykh",
+  "license": "Unlicense",
+  "devDependencies": {
+    "faucet": "0.x.x",
+    "tape": "4.11.0",
+    "tslint": "^5.20.0",
+    "typescript": "^3.6.4",
+    "uglify-js": "^3.1.9"
+  }
+}