Installation

@deuz-sdk/core is a single package with zero runtime dependencies. Install it, and the chat core, the agentic tool loop, streaming, and the canonical UI wire are all available out of the box. Heavier or stateful capabilities (schema-typed objects, MCP, document parsing, real databases) pull in optional peers only when you actually use them.

Install

npm install @deuz-sdk/core

pnpm add @deuz-sdk/core

yarn add @deuz-sdk/core

bun add @deuz-sdk/core

Runtime requirements

The core is pure and web-first: it touches only Web APIs (fetch, Web Streams, TextDecoder, WebCrypto, atob/btoa). Anything stateful or non-deterministic — HTTP, clock, logging, metering, circuit-breaker, API keys, id generation — is injected through a single Dependencies seam, with no-op/in-memory defaults applied for you. As a result the same build runs unchanged on any runtime that has fetch plus Web Streams.

The browser guarantee is checked, not asserted: a release-gate step bundles the root entry, the /edge entry and the provider factories for platform: 'browser' and fails if a single node: builtin — or a Node-only module — makes it into the graph.

Node-only capabilities (filesystem skill sources, document parsers, the markdown memory vault, MCP stdio transport, file workspace, compute sandbox, Playwright browser, JSONL run store, the SQLite/Redis/Postgres store packs) live behind dedicated …/node subpaths and never leak node:* imports into the edge-safe core.

Optional peer dependencies

The package ships nothing in dependencies. The chat core, resilience, metering, the four provider wires, the agentic loop and the UI wire all run on Web APIs alone. Everything below is declared optional in peerDependenciesMeta, so your package manager will not nag you for the ones you skip.

Install a peer only when you reach for the feature in its row. The last column is the part worth reading before you ship: skipping a peer is never silent, but the quality of the failure differs.

npm install zod @standard-community/standard-json

npm install @modelcontextprotocol/sdk

npm install unpdf mammoth xlsx

npm install playwright && npx playwright install chromium

The RAG core (MIME sniffing, chunkers, retrieve/rerank, BM25, RRF) is edge-safe and needs no peers; only the Node document parsers do. Likewise the store seams are dependency-free — only the concrete Redis/Postgres packs want a driver, and SQLite wants a Node built-in rather than a package.

Subpath exports

There are 52 deep subpaths plus the root. That is not API sprawl — it is the tree-shaking contract. Every subpath is a separate build artifact with its own .d.ts, so a Cloudflare Worker that imports @deuz-sdk/core and @deuz-sdk/core/anthropic never pulls in Playwright glue, a Postgres schema or a 7 KB HTML report template. Three rules cover almost every case:

1. Free functions and types come from the root. streamChat, generateText, generateObject, streamObject, embed, createClient, the error classes, tool(), the stop conditions, and every canonical type.
2. One provider = one subpath. Import only the factories you actually call.
3. A …/node suffix means Node built-ins. If you are on an edge runtime and reaching for one, you want the seam (the plain subpath) plus your own implementation instead.

Core surface

Providers

Agents and long-running work

State, retrieval and media

Verify it works

API keys are read from the environment at your app layer and passed into the provider factory — the SDK core never reads process.env itself.

import { streamChat } from '@deuz-sdk/core';
import { createAnthropic } from '@deuz-sdk/core/anthropic';

const anthropic = createAnthropic({ apiKey: process.env.ANTHROPIC_API_KEY! });

// streamChat returns synchronously; the request starts lazily on first access.
const res = streamChat({
  model: anthropic('claude-opus-4-8'),
  messages: [{ role: 'user', content: 'Say hello in one word.' }],
});

for await (const chunk of res.textStream) process.stdout.write(chunk);

const usage = await res.usage; // resolves when the stream finishes
console.log(`\n${usage.inputTokens} in / ${usage.outputTokens} out`);

res.textStream is an AsyncIterable<string> and res.usage is a Promise<Usage> — both are explained in streamChat.

Edge-safe subset

When you target Cloudflare Workers or Vercel Edge and want a build that is provably free of any Node API, import from the /edge entry. It re-exports streamChat / generateText / generateObject / streamObject, the stop conditions, createClient, tool(), createAgent, the durable-session helpers, the chat reducers, request validation, the observers, the OTel bridge, and all types.

import { streamChat, validateChatRequest } from '@deuz-sdk/core/edge';
import { createAnthropic } from '@deuz-sdk/core/anthropic';
import { toDeuzStreamResponse } from '@deuz-sdk/core/ui';

export const runtime = 'edge';

const anthropic = createAnthropic({ apiKey: process.env.ANTHROPIC_API_KEY! });

export async function POST(req: Request): Promise<Response> {
  const parsed = validateChatRequest(await req.json());
  if (!parsed.ok) return Response.json({ issues: parsed.issues }, { status: 400 });

  const res = streamChat({ model: anthropic('claude-opus-4-8'), messages: parsed.request.messages });
  return toDeuzStreamResponse(res); // versioned Deuz UI wire
}

Two things /edge deliberately does not re-export, so do not go looking:

• The full error taxonomy. Only DeuzError, isDeuzError, NoObjectGeneratedError and BreakerOpenError are there. RateLimitError, AuthenticationError and friends come from the package root — which is itself edge-safe, so importing them costs you nothing.
• renderRunReport. It is pure and would be legal, but it carries roughly 7 KB gzip of inline HTML/CSS/JS for a local debugging workflow. Reach it from @deuz-sdk/core/observe instead.

The provider factories (/anthropic, /openai, …) are edge-safe too and are imported normally — /edge is about the orchestration surface, not the providers.

ESM and CJS

Every subpath ships both an ESM (import) and a CommonJS (require) build with matching .d.ts / .d.cts declarations, so the package resolves correctly under "moduleResolution": "Bundler", "Node16", or "NodeNext". It is authored against TypeScript strict mode (including noUncheckedIndexedAccess), so the public types are strict-ready in your project with no extra configuration.

import { generateText } from '@deuz-sdk/core';

const { generateText } = require('@deuz-sdk/core');

Next steps

• streamChat — the synchronous, never-throws streaming entry point.
• generateText — buffered text plus the agentic tool loop.
• generateObject — schema-typed structured output.
• Providers — Anthropic, OpenAI, xAI, Gemini, Vertex, Azure, Bedrock, Yunwu, Voyage.