chore(deps): pin AI client to Fleet canonical versions

[sarthakagrawal927]

Converges rolepatch onto the Fleet canonical model-calling standard, ratified 2026-08-29 by owner decision on sass-maker/saas-maker#61. The standard lives at tooling/config/ai-client-standard.json in sass-maker/saas-maker; this PR closes its rolepatch-pin-convergence follow-up, which was blocked on ratification. rolepatch was the fleet's only drifted project — it declared ranges rather than exact pins.

Version moves

package	before	after
ai	^6.0.97	6.0.168
@ai-sdk/openai-compatible	^2.0.41	2.0.41

@ai-sdk/openai-compatible was already at the canonical version — only the range caret is removed. ai is a real version move of 71 patch releases. @ai-sdk/react is not a dependency of this repo, so the companion pin does not apply.

pnpm-lock.yaml is regenerated. The lockfile diff is confined to ai and its transitive deps (@ai-sdk/gateway, @ai-sdk/provider-utils, and a dropped eventsource-parser); nothing else moved.

Was the SDK bump clean?

Clean — no source changes were needed. The repo's use of the SDK is narrow: generateObject and generateText from ai, plus createOpenAICompatible and the LanguageModel type. None of those signatures changed across 6.0.97 → 6.0.168, and every check passes on the bumped version.

$ pnpm typecheck        # tsc --noEmit — clean, no output
$ pnpm lint             # biome check . — Checked 294 files in 2s. No fixes applied.
$ pnpm test             # Test Files 75 passed (75) / Tests 442 passed (442)
$ pnpm build            # ✓ Compiled successfully in 3.4s
                        # ✓ Generating static pages using 17 workers (38/38)

The same four commands were run on main before the change to establish a baseline; they were green there too, so nothing here is masking a pre-existing failure.

One unrelated pre-existing peer warning shows during install (landing-astro's astro → tsconfck / zod-to-ts want typescript@^5, resolve 6.0.3). It predates this change and is untouched.

Direct-provider call sites: none found — deliberately left alone

The fleet audit recorded rolepatch with 2 provider-host files. Both are false positives from the text scan. They are not call sites:

• src/components/ai-settings.tsx:96 — placeholder={placeholders.endpointUrl ?? 'https://api.openai.com/v1'}
• src/components/settings-form.tsx:43 — endpointUrl: 'https://api.openai.com/v1', the placeholders prop passed into that same component

Both are the greyed-out placeholder text of the "Endpoint URL" input in the bring-your-own-key Settings form. No request is ever made to that string — it is an example format shown in an empty text box that the user types their own provider URL into.

A repo-wide grep for every provider API host in the standard's providerApiHosts list returns only those two lines, and a grep for every package in providerSdkPackages returns nothing. There is no provider SDK and no direct provider call anywhere in rolepatch.

The actual model-calling path is already compliant. src/lib/ai-cloudflare.ts builds every model through createOpenAICompatible and defaults to the gateway:

const FALLBACK_GATEWAY_BASE_URL = 'https://ai-gateway.sassmaker.com/v1';

overridable by AI_BASE_URL, with an x-gateway-project-id: resume-tailor header. The only way a request leaves for a non-gateway host is if an end user pastes their own endpoint and key into Settings — a deliberate BYO-key product feature, not a hard-coded provider host.

I left both placeholder strings as they are. Swapping them for the gateway URL would be a one-word string edit, but it is a product/UX decision, not a mechanical convergence: the field exists precisely so a user can point at their own provider, and showing the fleet gateway as the suggested value in a BYO-key box would be misleading. It also changes nothing about compliance, since neither line is a call site. Flagging it here so it can be scoped separately if the owner wants the copy changed.

Two smaller notes:

• The env var is AI_BASE_URL, while the standard names AI_GATEWAY_BASE_URL as canonical.baseUrlEnv. Renaming it touches deployment secrets, so it is out of scope for a mechanical pin PR — worth a separate follow-up.
• The standard's stale-next-standalone-copy follow-up mentions a vendored .next/standalone/package.json. It is build output and is not tracked by git in this repo, so there is nothing to converge and nothing was hand-edited.

Not done here

No deploy. This is dependency + lockfile only.

🤖 Generated with Claude Code