1.0.12 — Migrate Gemini client to `@google/genai`, improve proxy support, and harden secret/error handling

Main changes

Gemini SDK migration (@google/generative-ai → @google/genai)

This release moves the provider implementation to Google’s unified GenAI SDK (@google/genai) and updates the request/response plumbing accordingly.

What this means in practice:

• Requests now use GoogleGenAI and the newer models.generateContent / chats.create(...).sendMessage(...) APIs.
• Multi-turn conversations are handled by building chat history and sending the final user message via a chat session when appropriate.
• Token usage is reported from the new SDK’s usageMetadata fields.

Structured output via JSON Schema: compatibility handling

When request.responseFormat?.type === 'json_schema', the provider now:

• Sets responseMimeType = 'application/json'
• Supplies responseJsonSchema, after stripping fields that Gemini’s schema support doesn’t accept (currently removing additionalProperties and $schema, and applying the same cleanup recursively to nested properties / items)

This reduces failures when passing “full” JSON Schemas commonly produced by validators/tools.

Proxy support for SDK traffic (via global fetch override during calls)

Because @google/genai uses the global fetch, proxying is implemented by temporarily replacing globalThis.fetch for the duration of the API call:

• Reads proxy URL from HTTPS_PROXY, HTTP_PROXY (and lowercase variants)
• Respects NO_PROXY / no_proxy hostname bypass rules (including * and domain suffix matching)
• Respects NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS verification in the proxy agent

If a proxy is configured, Gemini requests are routed through undici’s ProxyAgent; otherwise, normal execution is used.

Secret and error sanitization

The provider now proactively guards against API key leakage:

• Registers Gemini API key patterns with @utilarium/offrecord
• Uses @utilarium/spotclean to sanitize thrown errors (including optional stack trace sanitization in production)

This is intended to prevent accidentally logging or propagating Gemini API keys in error messages.

Dependency and tooling updates

• Adds/uses @google/genai (runtime dependency)
• Adds/uses @utilarium/offrecord and @utilarium/spotclean (runtime dependencies)
• Lockfile and dev dependency refresh (eslint/typescript/vitest/vite, etc.)
• Docs updated (README.md, guide/index.md) to reflect the new SDK and current model families

Breaking changes / important considerations

Potential breaking: Gemini SDK dependency change

If your application depended (directly or indirectly) on the older Gemini SDK (@google/generative-ai) behavior, note that this package now targets @google/genai. You should:

• Ensure @google/genai is available/resolvable in your environment
• Revalidate any assumptions about response fields and token usage reporting

Important: proxy implementation temporarily overrides globalThis.fetch

Proxy support works by swapping the global fetch inside withProxyFetch(...) and restoring it in a finally block. While scoped to the execution call, it is still a global side effect and may matter in highly concurrent environments that also rely on a custom global fetch.

Files/themes touched

• Provider implementation: src/index.ts (SDK migration, JSON schema prep, safer errors)
• Proxying: src/proxy.ts (NO_PROXY support, TLS handling, fetch override approach)
• Docs: README.md, guide/index.md
• Build/tests: vite.config.ts, tests/index.test.ts
• Deps: package.json, package-lock.json