v1.5.1 — Foundation Hardening

v1.5.1 is deliberately a foundation release, not a feature headline. It turns packaging, compatibility, streaming, provider behavior, and public API stability into release-blocking contracts so v1.6 and v1.7 can evolve without destabilizing the core.

Patch Changes

• CI and release pipeline — one gate, the same contract everywhere: CI now separates quality/API types, runtime, packed-artifact, and documentation checks. The runtime suite runs on Node.js 22 and 24 on Linux plus Node.js 22 on Windows. A single npm run release:verify command is shared by local and CI releases; the tag workflow requires vX.Y.Z to match package.json, reruns the complete gate, and is wired for npm provenance publishing only after verification succeeds. A normal push to main cannot publish a release.

• Packed package and export verification: releases are checked as the actual npm pack artifact rather than trusting the source tree. Every declared target must exist inside the tarball, stay under dist, and load through both ESM import and CommonJS require. Source, test, environment, smoke-test, and TypeScript build-state files are rejected from the package. publint --strict and Are the Types Wrong? remain mandatory. The gate verifies 26 public export entries and 50 runtime targets.

• Public API stabilization: a checked contract now protects 141 root API symbols and all 26 package export entries from accidental removal or drift. Contract changes must be reviewed explicitly instead of appearing as incidental build output, giving future v1.6/v1.7 work a stable compatibility floor.

• Browser, edge, and custom gateway compatibility: representative consumers of the root entry, /edge, and provider entries must bundle with esbuild's browser platform and an ES2022 target without pulling in Node built-ins. The jsdom/Web Streams suite exercises the Responses wire with custom gateways: baseURL: 'https://gateway.example' resolves to /responses, while an explicitly supplied /v1 prefix is preserved exactly once. The SDK never invents /v1 for a custom Responses base URL.

• Bundle-size regression budgets: minified browser consumers now have checked raw and gzip ceilings with narrow headroom. At release time the measured bundles are 74,898 B raw / 22,757 B gzip for core, 65,695 B / 20,251 B for /edge, and 596 B / 303 B for the OpenAI provider entry. Crossing the committed budget fails CI instead of silently growing the package.

• Stream protocol hardening: the shared SSE parser now covers LF, CRLF, and bare CR line endings; CRLF delimiters split between chunks; UTF-8 BOMs; arbitrary multibyte UTF-8 boundaries; comments and keep-alives; named events; multiline data: fields; and final events without a trailing blank line. Early consumer cancellation propagates to the underlying reader instead of leaving the transport open.

• Provider conformance infrastructure: Anthropic Messages, OpenAI Chat Completions, OpenAI Responses, and Google native streaming now run through one public-SDK contract suite. Every case verifies route, method, authentication and streaming shape, canonical text deltas, normalized usage, exactly one finish part, and typed error behavior. Provider-specific wire shapes remain explicit while their observable SDK semantics stay aligned.

• Standard error contract: OpenAI-compatible adapters retain the real provider id instead of reporting every compatible host as OpenAI. Exhausted DNS, TLS, and transport failures normalize to the new retryable NetworkError rather than leaking inconsistent low-level exceptions. isDeuzError() provides stable detection across duplicate package copies and realms, while DeuzError.toJSON() emits a predictable, secret-safe diagnostic shape that excludes raw causes, headers, bodies, and credentials. Stream errors surface consistently through the error part and the rejected usage and finishReason promises.

• Documentation structure: compatibility guarantees, stream protocol behavior, provider conformance requirements, and the release process now live in a dedicated Reference section. Error handling and edge/runtime guidance match the executable contracts, and every release requires MDX type generation plus a production documentation build. The README and benchmark presentation were also rebuilt around checked-in measurement scripts and result artifacts.

49 runtime test files · 447 tests green · Node 22/24 Linux + Node 22 Windows · 26 export entries / 50 runtime targets verified · 141 root API symbols locked · ESM/CJS, browser/edge, bundle-size, API-contract, and docs gates clean.

Full details are in CHANGELOG.md.

Full Changelog: v1.5.0...v1.5.1