Installation

@deuz-sdk/core is a single package with zero runtime dependencies. Install it, and the chat core, the agentic tool loop, streaming, and the canonical UI wire are all available out of the box. Heavier or stateful capabilities (schema-typed objects, MCP, document parsing, real databases) pull in optional peers only when you actually use them.

The package also includes the optional native agent engine and swarm scheduler, since 2.2 the operations, persistent budget, evolve and schedule modules, and since 2.3 the MCP server, A2A, realtime, batch, goal and headless modules, and since 2.4 versioned memory, the context compiler, the goal runtime and the Docker runner (a preview). Existing generation APIs remain available. See What is new in 2.4 for upgrade notes.

Install

npm install @deuz-sdk/core

pnpm add @deuz-sdk/core

yarn add @deuz-sdk/core

bun add @deuz-sdk/core

Runtime requirements

The core is pure and web-first: it touches only Web APIs (fetch, Web Streams, TextDecoder, WebCrypto, atob/btoa). Anything stateful or non-deterministic — HTTP, clock, logging, metering, circuit-breaker, API keys, id generation — is injected through a single Dependencies seam, with no-op/in-memory defaults applied for you. As a result the same build runs unchanged on any runtime that has fetch plus Web Streams.

The browser guarantee is checked, not asserted: a release-gate step (tooling/check-runtime-compat.mjs) bundles consumers of the root entry, the /edge entry, the provider factories, the native agent and swarm entries, /ops, /goal, /evolve, /schedule, the in-memory budget store, /mcp/server, /realtime, /batch, /a2a and /testing for platform: 'browser', and fails if a single node: builtin — or a Node-only module — makes it into the graph. It also fails if one of the Node-only entries (the swarm and ops stores on SQLite, Postgres and Redis, /evolve/sqlite, /mcp/server/stdio, /headless) passes that boundary.

Node-only capabilities (filesystem skill sources, document parsers, the markdown memory vault, MCP stdio transport, the stdio MCP server, file workspace, compute sandbox, Playwright browser, JSONL run store, database store packs, the swarm and ops stores on SQLite, Postgres and Redis, evolve's SQLite store and the headless preview) live behind dedicated subpaths and never leak node:* imports into the edge-safe core.

Optional peer dependencies

The package ships nothing in dependencies. The chat core, resilience, metering, the four provider wires, the agentic loop and the UI wire all run on Web APIs alone. Everything below is declared optional in peerDependenciesMeta, so your package manager will not nag you for the ones you skip.

Install a peer only when you reach for the feature in its row. The last column is the part worth reading before you ship: skipping a peer is never silent, but the quality of the failure differs.

npm install zod @standard-community/standard-json

npm install @modelcontextprotocol/client   # MCP 2026-07-28
# or, for the 2025-11-25 line: npm install @modelcontextprotocol/sdk

npm install @modelcontextprotocol/server

npm install unpdf mammoth xlsx

npm install playwright && npx playwright install chromium

The RAG core (MIME sniffing, chunkers, retrieve/rerank, BM25, RRF) is edge-safe and needs no peers; only the Node document parsers do. Likewise the store seams are dependency-free — only the concrete Redis/Postgres packs want a driver, and SQLite wants a Node built-in rather than a package.

Subpath exports

Capabilities use separate subpaths as part of the tree-shaking contract. Every subpath is a separate build artifact with its own .d.ts, so a Cloudflare Worker that imports @deuz-sdk/core and @deuz-sdk/core/anthropic never pulls in Playwright glue, a Postgres schema or a 7 KB HTML report template. Three rules cover almost every case:

1. Free functions and types come from the root. streamChat, generateText, generateObject, streamObject, embed, createClient, the error classes, tool(), the stop conditions, and every canonical type.
2. One provider = one subpath. Import only the factories you actually call.
3. Node adapters use separate subpaths. A …/node suffix is one marker; the /sqlite and /postgres store subpaths are also Node-only. On an edge runtime, use the web-safe seam plus your own implementation.

Core surface

Providers

Agents and long-running work

State, retrieval and media

Verify it works

API keys are read from the environment at your app layer and passed into the provider factory — the SDK core never reads process.env itself.

import { streamChat } from '@deuz-sdk/core';
import { createAnthropic } from '@deuz-sdk/core/anthropic';

const anthropic = createAnthropic({ apiKey: process.env.ANTHROPIC_API_KEY! });

// streamChat returns synchronously; the request starts lazily on first access.
const res = streamChat({
  model: anthropic('claude-opus-4-8'),
  messages: [{ role: 'user', content: 'Say hello in one word.' }],
});

for await (const chunk of res.textStream) process.stdout.write(chunk);

const usage = await res.usage; // resolves when the stream finishes
console.log(`\n${usage.inputTokens} in / ${usage.outputTokens} out`);

res.textStream is an AsyncIterable<string> and res.usage is a Promise<Usage> — both are explained in streamChat.

Edge-safe subset

When you target Cloudflare Workers or Vercel Edge and want a build that is provably free of any Node API, import from the /edge entry. It re-exports streamChat / generateText / generateObject / streamObject, the stop conditions, createClient, tool(), createAgent, resolveModelProfile (2.3), the durable-session helpers, the chat reducers, request validation, the observers, the OTel bridge, everything /ops, /evolve and /schedule export, and all types. The edge page lists every name.

import { streamChat, validateChatRequest } from '@deuz-sdk/core/edge';
import { createAnthropic } from '@deuz-sdk/core/anthropic';
import { toDeuzStreamResponse } from '@deuz-sdk/core/ui';

export const runtime = 'edge';

const anthropic = createAnthropic({ apiKey: process.env.ANTHROPIC_API_KEY! });

export async function POST(req: Request): Promise<Response> {
  const parsed = validateChatRequest(await req.json());
  if (!parsed.ok) return Response.json({ issues: parsed.issues }, { status: 400 });

  const res = streamChat({
    model: anthropic('claude-opus-4-8'),
    messages: parsed.request.messages,
  });
  return toDeuzStreamResponse(res); // versioned Deuz UI wire
}

Two things /edge deliberately does not re-export, so do not go looking:

• The full error taxonomy. Only DeuzError, isDeuzError, NoObjectGeneratedError, BreakerOpenError, CheckpointNotFoundError, CheckpointVersionError (2.3), UnpricedModelError (2.3) and the three evolve errors are there. RateLimitError, AuthenticationError and friends come from the package root — which is itself edge-safe, so importing them costs you nothing.
• renderRunReport. It is pure and would be legal, but it carries roughly 7 KB gzip of inline HTML/CSS/JS for a local debugging workflow. Reach it from @deuz-sdk/core/observe instead.

The provider factories (/anthropic, /openai, …) are edge-safe too and are imported normally — /edge is about the orchestration surface, not the providers.

ESM and CJS

Every subpath ships both an ESM (import) and a CommonJS (require) build with matching .d.ts / .d.cts declarations, so the package resolves correctly under "moduleResolution": "Bundler", "Node16", or "NodeNext". It is authored against TypeScript strict mode (including noUncheckedIndexedAccess), so the public types are strict-ready in your project with no extra configuration.

import { generateText } from '@deuz-sdk/core';

const { generateText } = require('@deuz-sdk/core');

Next steps

• What is new in 2.4 — release scope, upgrade notes and known limits.
• Native agents and Swarm — opt-in validated runs and durable DAG scheduling.
• streamChat — the synchronous, never-throws streaming entry point.
• generateText — buffered text plus the agentic tool loop.
• generateObject — schema-typed structured output.
• Providers — Anthropic, OpenAI, xAI, Gemini, Vertex, Azure, Bedrock, Yunwu, Voyage.