@zenera/neo 1.1.28 → 1.1.29

package/dist/kernel.js

@@ -770,6 +770,21 @@ export async function createChildState(state, forkId, branch, env) {
     };
     const b = begin(child, env);
     if (prefix.length) {
+        // Gemini signs only a parallel turn's first call: answer the siblings so none is dropped.
+        const turn = prefix.findLast((n) => n.type === 'llm_call' && n.toolCalls.some((c) => c.callId === fork.callId));
+        const answered = new Set(prefix.flatMap((n) => (n.type === 'tool_result' ? [n.callId] : [])));
+        for (const c of turn?.toolCalls ?? []) {
+            if (c.callId === fork.callId || answered.has(c.callId)) {
+                continue;
+            }
+            b.add({
+                type: 'tool_result',
+                callId: c.callId,
+                name: c.name,
+                result: await put(env, 'Not run in this branch: the parent runs this call, and its result is not visible here.'),
+                isError: false,
+            });
+        }
         // The branch inherited the turn that called `fork`, so the honest way to
         // hand it its assignment is to answer that call: the model sees a tool
         // result for a tool it just called, instead of a second user message

package/dist/models/factory.d.ts

@@ -147,6 +147,8 @@ export interface ModelRequirement {
     satisfied: boolean;
     /** the SDK authenticates without a key, so `satisfied` says little */
     keyOptional: boolean;
+    /** set when the request goes through a gateway, whose key `apiKeyEnv` then names */
+    gateway?: string;
 }
 export declare const providerKinds: ProviderKind[];
 export declare function isProviderKind(name: string): name is ProviderKind;

package/dist/models/factory.js

@@ -6,6 +6,7 @@ import { OpenAIEmbedder } from "../embeddings/openai.js";
 import { OpenRouterEmbedder } from "../embeddings/openrouter.js";
 import { unfundedSymbol } from "../embeddings/rate-limit.js";
 import { AnthropicModel } from "./anthropic.js";
+import { GATEWAY_KEY_ENV, GATEWAY_KEY_HEADER, GATEWAY_NAME, GATEWAY_PATHS, GATEWAY_UPSTREAMS, gatewayOf, upstreamFetch, } from "./gateway.js";
 import { GeminiModel } from "./gemini.js";
 import { OpenAIModel } from "./openai-chat.js";
 import { OpenAIResponsesModel } from "./openai-responses.js";
@@ -128,6 +129,12 @@ function protocolOf(kind, model) {
 function apisOf(kind, protocol) {
     return kind === 'vertex' && protocol === 'openai' ? ['chat'] : KINDS[kind].apis;
 }
+/** Bifrost has no OpenRouter drop-in, so OpenRouter models go through its OpenAI one. */
+function gatewayProtocol(kind, model) {
+    const protocol = protocolOf(kind, model);
+    return protocol === 'openrouter' ? 'openai' : protocol;
+}
+const GATEWAY_APIS = ['chat', 'responses'];
 // ---------------------------------------------------------------------------
 // Tuning knobs
 // ---------------------------------------------------------------------------
@@ -265,6 +272,31 @@ export class ModelRegistry {
         this.#clients.set(name, built);
         return built;
     }
+    /**
+     * Gateway mode takes every provider, declared ones included; only a
+     * pre-built client stays put, since there is nothing in it to repoint.
+     */
+    #route(spec, name) {
+        const kind = this.kindOf(name);
+        const gateway = spec.client || this.#spec(name).client ? undefined : gatewayOf();
+        if (gateway) {
+            const protocol = gatewayProtocol(kind, spec.model);
+            return { protocol, apis: protocol === 'openai' ? GATEWAY_APIS : [], gateway };
+        }
+        const protocol = protocolOf(kind, spec.model);
+        return { protocol, apis: apisOf(kind, protocol) };
+    }
+    /** One client per provider and protocol, keyed by the gateway it points at. */
+    #gateway(name, protocol, at) {
+        const key = `${name}\0gateway\0${protocol}\0${at.baseURL}\0${at.apiKey ?? ''}`;
+        const existing = this.#clients.get(key);
+        if (existing) {
+            return existing;
+        }
+        const built = buildGatewayClient(name, this.kindOf(name), protocol, this.#spec(name), at);
+        this.#clients.set(key, built);
+        return built;
+    }
     /** A Vertex provider's Claude or partner client: built once, beside its GenAI one. */
     #partner(name, protocol, spec) {
         const key = `${name}\0${protocol}`;
@@ -304,14 +336,12 @@ export class ModelRegistry {
      */
     knobs(ref) {
         const spec = typeof ref === 'string' ? this.parse(ref) : ref;
-        const kind = this.kindOf(spec.provider ?? this.#default);
-        const protocol = protocolOf(kind, spec.model);
+        const { protocol, apis } = this.#route(spec, spec.provider ?? this.#default);
         if (protocol !== 'openai') {
             return unreadKnobs(spec, protocol);
         }
         // An api this vendor does not speak already has an error of its own;
         // answering about its knobs would only bury it.
-        const apis = apisOf(kind, protocol);
         const api = spec.api ?? apis[0];
         return api && apis.includes(api) ? unreadKnobs(spec, `openai/${api}`) : [];
     }
@@ -321,7 +351,7 @@ export class ModelRegistry {
         const name = spec.provider ?? this.#default;
         const provider = this.#spec(name);
         const kind = this.kindOf(name);
-        const protocol = protocolOf(kind, spec.model);
+        const { protocol, apis, gateway } = this.#route(spec, name);
         // Before the client, so a knob for the wrong vendor is reported as the
         // config mistake it is rather than behind a missing credential.
         const [stray] = this.knobs(spec);
@@ -333,15 +363,17 @@ export class ModelRegistry {
         // different connection, and handing back the memoized one would
         // silently ignore them.
         const client = spec.client ??
-            (protocol !== KINDS[kind].protocol
-                ? this.#partner(name, protocol, provider)
-                : hasCredentials(spec)
-                    ? buildClient(name, kind, spec, provider)
-                    : this.client(name));
+            (gateway
+                ? this.#gateway(name, protocol, gateway)
+                : protocol !== KINDS[kind].protocol
+                    ? this.#partner(name, protocol, provider)
+                    : hasCredentials(spec)
+                        ? buildClient(name, kind, spec, provider)
+                        : this.client(name));
         // The *resolved* name, not `spec.provider`: a bare ref carries none,
         // and a failure that cannot say which connection refused it is the
         // thing this is here to prevent.
-        const options = { ...spec, provider: name };
+        const options = { ...spec, provider: gateway ? `${name} via ${GATEWAY_NAME}` : name };
         // Every protocol but OpenAI's has exactly one API, so naming one is a
         // mistake worth reporting rather than a field to ignore.
         if (protocol !== 'openai') {
@@ -357,7 +389,6 @@ export class ModelRegistry {
                     return new OpenRouterModel(spec.model, client, options);
             }
         }
-        const apis = apisOf(kind, protocol);
         const api = spec.api ?? apis[0];
         if (!apis.includes(api)) {
             throw new TypeError(`provider "${name}" (${kind}) does not speak the "${api}" api ` +
@@ -377,16 +408,22 @@ export class ModelRegistry {
         const name = spec.provider ?? this.#default;
         const provider = this.#spec(name);
         const kind = this.kindOf(name);
+        const { protocol, gateway } = this.#route(spec, name);
         const client = spec.client ??
-            (hasCredentials(spec) ? buildClient(name, kind, spec, provider) : this.client(name));
+            (gateway
+                ? this.#gateway(name, protocol, gateway)
+                : hasCredentials(spec)
+                    ? buildClient(name, kind, spec, provider)
+                    : this.client(name));
         // Inline credentials are a different connection, and so a different
         // budget: they get pacing of their own rather than the provider's.
+        const own = hasCredentials(spec) && !gateway;
         const options = {
             ...spec,
-            provider: name,
-            limiter: spec.limiter ?? (hasCredentials(spec) ? undefined : this.#limiter(name)),
+            provider: gateway ? `${name} via ${GATEWAY_NAME}` : name,
+            limiter: spec.limiter ?? (own ? undefined : this.#limiter(name)),
         };
-        switch (KINDS[kind].protocol) {
+        switch (gateway ? protocol : KINDS[kind].protocol) {
             case 'openai':
                 return new OpenAIEmbedder(spec.model, client, options);
             case 'gemini':
@@ -410,6 +447,17 @@ export class ModelRegistry {
         const name = spec.provider ?? this.#default;
         const provider = this.#spec(name);
         const kind = this.kindOf(name);
+        const gateway = this.#route(spec, name).gateway;
+        if (gateway) {
+            return {
+                provider: name,
+                kind,
+                apiKeyEnv: GATEWAY_KEY_ENV,
+                satisfied: Boolean(gateway.apiKey),
+                keyOptional: false,
+                gateway: GATEWAY_NAME,
+            };
+        }
         const defaults = KINDS[kind];
         const creds = hasCredentials(spec) ? spec : provider;
         const apiKeyEnv = creds.apiKeyEnv ?? defaults.apiKeyEnv;
@@ -633,15 +681,12 @@ function buildOpenRouter(kind, apiKey, baseURL, headers, opts) {
  */
 function buildGenAI(kind, apiKey, baseURL, headers, opts, where) {
     const { GoogleGenAI } = sdk('@google/genai', kind);
-    // `attempts` counts the initial call, so a retry budget of zero is one
-    // attempt. Delays are fractions of a second here, unlike everywhere else.
-    const retryOptions = {
-        attempts: retriesOf(opts) + 1,
-        initialDelay: RETRY_INITIAL_MS / 1000,
-        maxDelay: RETRY_MAX_MS / 1000,
-        expBase: RETRY_EXPONENT,
+    const httpOptions = {
+        baseUrl: baseURL,
+        headers,
+        timeout: opts.timeoutMs,
+        retryOptions: genaiRetries(opts),
     };
-    const httpOptions = { baseUrl: baseURL, headers, timeout: opts.timeoutMs, retryOptions };
     if (kind !== 'vertex') {
         return new GoogleGenAI({ apiKey, httpOptions });
     }
@@ -664,6 +709,60 @@ function buildGenAI(kind, apiKey, baseURL, headers, opts, where) {
         httpOptions,
     });
 }
+/**
+ * `attempts` counts the initial call, so a retry budget of zero is one attempt.
+ * Delays are fractions of a second here, unlike everywhere else.
+ */
+function genaiRetries(opts) {
+    return {
+        attempts: retriesOf(opts) + 1,
+        initialDelay: RETRY_INITIAL_MS / 1000,
+        maxDelay: RETRY_MAX_MS / 1000,
+        expBase: RETRY_EXPONENT,
+    };
+}
+/**
+ * A client aimed at the gateway's drop-in endpoint for `protocol`, with the
+ * virtual key in place of the vendor's. The provider keeps its transport
+ * settings and headers; its own key and base url are what the gateway replaces.
+ */
+function buildGatewayClient(name, kind, protocol, opts, at) {
+    const baseURL = `${at.baseURL}${GATEWAY_PATHS[protocol]}`;
+    // Every SDK refuses to construct without a key, even for a gateway that wants none.
+    const apiKey = at.apiKey ?? GATEWAY_NAME;
+    const headers = {
+        ...expandHeaders(opts.headers, `provider "${name}"`),
+        ...(at.apiKey ? { [GATEWAY_KEY_HEADER]: at.apiKey } : {}),
+    };
+    const routed = upstreamFetch(GATEWAY_UPSTREAMS[kind], protocol);
+    if (protocol === 'gemini') {
+        const { GoogleGenAI } = sdk('@google/genai', kind);
+        return new GoogleGenAI({
+            apiKey,
+            httpOptions: {
+                baseUrl: baseURL,
+                headers,
+                timeout: opts.timeoutMs,
+                retryOptions: genaiRetries(opts),
+                fetch: routed,
+            },
+        });
+    }
+    const common = {
+        apiKey,
+        baseURL,
+        defaultHeaders: headers,
+        timeout: opts.timeoutMs,
+        maxRetries: retriesOf(opts),
+        fetch: funded(routed),
+    };
+    if (protocol === 'anthropic') {
+        const { Anthropic } = sdk('@anthropic-ai/sdk', kind);
+        return new Anthropic(common);
+    }
+    const { OpenAI } = sdk('openai', kind);
+    return new OpenAI(common);
+}
 /**
  * `project_id` out of a service-account key file, when one is named.
  *

package/dist/models/gateway.d.ts

@@ -0,0 +1,29 @@
+import type { ProviderKind } from './factory.ts';
+export declare const GATEWAY_NAME = "bifrost";
+export declare const GATEWAY_URL_ENV = "BIFROST_BASE_URL";
+export declare const GATEWAY_KEY_ENV = "BIFROST_API_KEY";
+/** Bifrost's own virtual-key header: still read when `Authorization` is taken by gateway login. */
+export declare const GATEWAY_KEY_HEADER = "x-bf-vk";
+export interface Gateway {
+    /** no trailing slash */
+    baseURL: string;
+    /** the virtual key; absent for a gateway that enforces none */
+    apiKey?: string;
+}
+/** The gateway this process is configured for, or undefined when vendors are called directly. */
+export declare function gatewayOf(): Gateway | undefined;
+/** The wire formats Bifrost has a drop-in endpoint for. */
+export type GatewayProtocol = 'openai' | 'anthropic' | 'gemini';
+export declare const GATEWAY_PATHS: Record<GatewayProtocol, string>;
+/** Bifrost's name for the upstream each kind reaches; it routes on `<upstream>/<model>`. */
+export declare const GATEWAY_UPSTREAMS: Record<ProviderKind, string>;
+/**
+ * Qualifies the model id on the wire only. A `Model`'s or `Embedder`'s id stays
+ * the one the config names, because a memory or an index records the embedder
+ * id and refuses a different one — flipping gateway mode must not orphan them.
+ *
+ * Gemini names its model in the url; the other two in the body. `inner` is
+ * resolved per call so a stubbed global `fetch` is honoured.
+ */
+export declare function upstreamFetch(upstream: string, protocol: GatewayProtocol, inner?: typeof fetch): typeof fetch;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/models/gateway.js

@@ -0,0 +1,99 @@
+// ---------------------------------------------------------------------------
+// Gateway mode
+//
+// With `BIFROST_BASE_URL` set, every provider is reached through one Bifrost
+// gateway and one virtual key, and `agents.yaml` does not change: a
+// `vertex:gemini-3.5-flash` still goes out through the GenAI SDK, in Gemini's
+// own wire format, only to Bifrost's `/genai` drop-in endpoint instead of to
+// Google. Keeping each vendor's protocol is the point — Bifrost's unified
+// chat-completions endpoint would cost the thinking budgets, thought signatures
+// and cache accounting the native adapters exist for.
+//
+// The switch is the environment rather than the config because it describes the
+// machine, not the project: the same project runs direct on a laptop with
+// vendor keys and through the gateway on a machine that only holds a virtual
+// key.
+// ---------------------------------------------------------------------------
+export const GATEWAY_NAME = 'bifrost';
+export const GATEWAY_URL_ENV = 'BIFROST_BASE_URL';
+export const GATEWAY_KEY_ENV = 'BIFROST_API_KEY';
+/** Bifrost's own virtual-key header: still read when `Authorization` is taken by gateway login. */
+export const GATEWAY_KEY_HEADER = 'x-bf-vk';
+/** The gateway this process is configured for, or undefined when vendors are called directly. */
+export function gatewayOf() {
+    const url = process.env[GATEWAY_URL_ENV]?.trim();
+    if (!url) {
+        return undefined;
+    }
+    const apiKey = process.env[GATEWAY_KEY_ENV]?.trim();
+    return { baseURL: url.replace(/\/+$/, ''), ...(apiKey ? { apiKey } : {}) };
+}
+export const GATEWAY_PATHS = {
+    openai: '/openai',
+    anthropic: '/anthropic',
+    gemini: '/genai',
+};
+/** Bifrost's name for the upstream each kind reaches; it routes on `<upstream>/<model>`. */
+export const GATEWAY_UPSTREAMS = {
+    openai: 'openai',
+    'openai-compatible': 'openai',
+    anthropic: 'anthropic',
+    google: 'gemini',
+    vertex: 'vertex',
+    openrouter: 'openrouter',
+};
+const MODEL_PATH = /\/models\/([^/:?]+):(\w+)/;
+/**
+ * Qualifies the model id on the wire only. A `Model`'s or `Embedder`'s id stays
+ * the one the config names, because a memory or an index records the embedder
+ * id and refuses a different one — flipping gateway mode must not orphan them.
+ *
+ * Gemini names its model in the url; the other two in the body. `inner` is
+ * resolved per call so a stubbed global `fetch` is honoured.
+ */
+export function upstreamFetch(upstream, protocol, inner) {
+    const prefix = `${upstream}/`;
+    const qualify = (id) => (id.startsWith(prefix) ? id : prefix + id);
+    return async (input, init) => {
+        const send = inner ?? fetch;
+        const body = typeof init?.body === 'string' ? qualifyBody(init.body, protocol, qualify) : init?.body;
+        if (protocol !== 'gemini') {
+            return send(input, body === init?.body ? init : { ...init, body });
+        }
+        const url = input instanceof Request ? input.url : String(input);
+        const routed = url.replace(MODEL_PATH, (_match, id, verb) => `/models/${qualify(id)}:${verb}`);
+        return send(routed, { ...init, body });
+    };
+}
+function qualifyBody(body, protocol, qualify) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return body;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return body;
+    }
+    const doc = parsed;
+    if (protocol !== 'gemini') {
+        if (typeof doc.model !== 'string') {
+            return body;
+        }
+        doc.model = qualify(doc.model);
+        return JSON.stringify(doc);
+    }
+    // batchEmbedContents repeats the model per request, as `models/<id>`.
+    if (!Array.isArray(doc.requests)) {
+        return body;
+    }
+    for (const request of doc.requests) {
+        const id = typeof request?.model === 'string' ? /^models\/(.+)$/.exec(request.model) : null;
+        if (id) {
+            request.model = `models/${qualify(id[1])}`;
+        }
+    }
+    return JSON.stringify(doc);
+}
+//# sourceMappingURL=gateway.js.map

package/dist/models/index.d.ts

@@ -1,5 +1,6 @@
 export * from './anthropic.ts';
 export * from './factory.ts';
+export * from './gateway.ts';
 export * from './gemini.ts';
 export * from './openai-chat.ts';
 export * from './openai-responses.ts';

package/dist/models/index.js

@@ -1,5 +1,6 @@
 export * from "./anthropic.js";
 export * from "./factory.js";
+export * from "./gateway.js";
 export * from "./gemini.js";
 export * from "./openai-chat.js";
 export * from "./openai-responses.js";

package/dist/project/config.d.ts

@@ -7,9 +7,9 @@ import { z } from 'zod';
 declare const provider: z.ZodObject<{
     kind: z.ZodOptional<z.ZodEnum<{
         openai: "openai";
+        anthropic: "anthropic";
         google: "google";
         vertex: "vertex";
-        anthropic: "anthropic";
         openrouter: "openrouter";
         "openai-compatible": "openai-compatible";
     }>>;
@@ -72,9 +72,9 @@ declare const modelSpec: z.ZodObject<{
     serviceTier: z.ZodOptional<z.ZodEnum<{
         default: "default";
         auto: "auto";
+        priority: "priority";
         fast: "fast";
         flex: "flex";
-        priority: "priority";
         scale: "scale";
     }>>;
     apiKey: z.ZodOptional<z.ZodString>;
@@ -184,9 +184,9 @@ export declare const projectSchema: z.ZodObject<{
     providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         kind: z.ZodOptional<z.ZodEnum<{
             openai: "openai";
+            anthropic: "anthropic";
             google: "google";
             vertex: "vertex";
-            anthropic: "anthropic";
             openrouter: "openrouter";
             "openai-compatible": "openai-compatible";
         }>>;
@@ -244,9 +244,9 @@ export declare const projectSchema: z.ZodObject<{
         serviceTier: z.ZodOptional<z.ZodEnum<{
             default: "default";
             auto: "auto";
+            priority: "priority";
             fast: "fast";
             flex: "flex";
-            priority: "priority";
             scale: "scale";
         }>>;
         apiKey: z.ZodOptional<z.ZodString>;
@@ -347,7 +347,7 @@ export declare const projectSchema: z.ZodObject<{
             autoRecall: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
                 limit: z.ZodDefault<z.ZodInt>;
             }, z.core.$strict>]>>;
-        }, z.core.$strict>>>>;
+        }, z.core.$strict>>, unknown>>;
         sandbox: z.ZodOptional<z.ZodObject<{
             image: z.ZodOptional<z.ZodString>;
             build: z.ZodOptional<z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/neo",
-    "version": "1.1.28",
+    "version": "1.1.29",
     "description": "A multi-agent runtime for Node.js: agents, models, tools, skills, memory and an append-only trajectory.",
     "keywords": [
         "agents",
@@ -63,8 +63,8 @@
     },
     "dependencies": {
         "graphology": "^0.26.0",
-        "yaml": "^2.9.0",
-        "zod": "^4.4.3"
+        "yaml": "^2.9.1",
+        "zod": "^4.6.7"
     },
     "peerDependencies": {
         "@anthropic-ai/sdk": "^0.120.0",
@@ -88,8 +88,8 @@
     },
     "devDependencies": {
         "@anthropic-ai/sdk": "^0.120.0",
-        "@google/genai": "^2.18.0",
-        "@openrouter/sdk": "^1.2.80",
+        "@google/genai": "^2.30.0",
+        "@openrouter/sdk": "^1.4.25",
         "openai": "^6.0.0"
     }
 }