@gajae-code/ai 0.13.2 → 0.14.0

package/dist/types/model-manager.d.ts

@@ -32,6 +32,8 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
     now?: () => number;
     /** Optional guard that must permit cache publication. Default: writes are permitted. */
     canPublishCache?: () => boolean;
+    /** Credential-and-endpoint identity required to reuse dynamic catalog IDs. */
+    cacheDynamicModelProvenance?: string;
 }
 /**
  * Resolution result.
@@ -44,8 +46,17 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 export interface ModelResolutionResult<TApi extends Api = Api> {
     models: Model<TApi>[];
     stale: boolean;
+    /** Whether the cache row consulted for this resolution was still within its TTL. */
+    cacheFresh: boolean;
+    /** Whether the consulted cache row was authoritative. */
+    cacheAuthoritative: boolean;
     /** Whether this resolution successfully fetched dynamic models. */
     fetched: boolean;
+    /**
+     * IDs returned by a current authoritative dynamic provider catalog. This is
+     * deliberately distinct from `models`, which merges static and cached data.
+     */
+    dynamicModelIds?: readonly string[];
 }
 /**
  * Stateful facade over provider model resolution.

package/dist/types/provider-models/openai-compat.d.ts

@@ -162,6 +162,11 @@ export interface LmStudioModelManagerConfig {
     baseUrl?: string;
 }
 export declare function lmStudioModelManagerOptions(config?: LmStudioModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface OmlxModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface SyntheticModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/provider-models/special.d.ts

@@ -21,3 +21,6 @@ export declare function glmZcodeModelManagerOptions(_config?: GlmZcodeModelManag
 export interface JetBrainsJunieModelManagerConfig {
 }
 export declare function jetbrainsJunieModelManagerOptions(_config?: JetBrainsJunieModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
+export interface KiroModelManagerConfig {
+}
+export declare function kiroModelManagerOptions(_config?: KiroModelManagerConfig): ModelManagerOptions<"kiro-codewhisperer-stream">;

package/dist/types/providers/anthropic.d.ts

@@ -1,6 +1,7 @@
 import Anthropic, { type ClientOptions as AnthropicSdkClientOptions } from "@anthropic-ai/sdk";
 import type { MessageCreateParamsStreaming, MessageParam } from "@anthropic-ai/sdk/resources/messages";
 import type { FetchImpl, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types";
+import { type RawHttpRequestDump } from "../utils/http-inspector";
 export type AnthropicHeaderOptions = {
     apiKey: string;
     baseUrl?: string;
@@ -76,6 +77,36 @@ export declare function isAnthropicMaskedProxyRejection(error: unknown): boolean
  * loud instead of being silently retried.
  */
 export declare function isAnthropicCacheBreakpointOverflowError(error: unknown): boolean;
+export type AnthropicContextManagementInjectionDiagnostic = {
+    strategy: string;
+    message: string;
+    captureNote: string;
+};
+/**
+ * Diagnose a context-management strategy named by an Anthropic 400 but absent
+ * from the body GJC sent. This mismatch is evidence of intermediary mutation,
+ * not permission to silently enable thinking or retry the request.
+ */
+export declare function diagnoseAnthropicContextManagementInjection(error: unknown, dump: RawHttpRequestDump | undefined): AnthropicContextManagementInjectionDiagnostic | undefined;
+export interface CpaToolAliasRestoreFailure {
+    /** The rejected tool-call name exactly as CPA quoted it. */
+    alias: string;
+    /**
+     * Base tool name parsed out of the alias (`mcp__<server>__<token>_<base>`
+     * → `<base>`), when the alias shape is well-formed. `undefined` for a
+     * malformed alias — callers must then fall back to direct discovery and
+     * never invent a name.
+     */
+    baseName?: string;
+}
+/**
+ * Classifies the CPA alias-restore signature and extracts the rejected alias
+ * plus its base tool name. Claims only statusless in-stream SSE error events
+ * and HTTP 5xx failures: a non-5xx status carrying this text is not the
+ * observed CPA delivery shape and is left to the other classifiers.
+ */
+export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
+export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
 export declare const claudeCodeVersion = "2.1.219";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;

package/dist/types/providers/cursor.d.ts

@@ -1,5 +1,5 @@
 import { type JsonValue } from "@bufbuild/protobuf";
-import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, StreamFunction, StreamOptions, ToolResultMessage } from "../types";
+import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, StreamFunction, StreamOptions, ToolCall, ToolResultMessage } from "../types";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
 export { CURSOR_CLIENT_VERSION };
@@ -12,11 +12,19 @@ export interface CursorOptions extends StreamOptions {
     onToolResult?: CursorToolResultHandler;
 }
 export declare const streamCursor: StreamFunction<"cursor-agent">;
+type ToolCallState = ToolCall & {
+    index: number;
+    partialJson?: string;
+    kind: "mcp" | "todo_write" | "native";
+};
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
 export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
     execResult: TResult;
     toolResult?: ToolResultMessage;
 }>;
+/** Exported for direct regression coverage of the JSON-safety boundary. */
+export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
+export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching

package/dist/types/providers/kiro-codewhisperer.d.ts

@@ -0,0 +1,8 @@
+import type { StreamFunction, StreamOptions } from "../types";
+export interface KiroCodeWhispererOptions extends StreamOptions {
+    /** AWS region for the CodeWhisperer streaming endpoint. */
+    region?: string;
+    /** Profile ARN for enterprise IAM Identity Center accounts. */
+    profileArn?: string;
+}
+export declare const streamKiroCodeWhisperer: StreamFunction<"kiro-codewhisperer-stream">;

package/dist/types/providers/mock.d.ts

@@ -62,6 +62,11 @@ export type MockContent = string | {
     arguments: Record<string, unknown> | string;
     /** Simulate a provider-flagged truncated call (cut off mid-arguments). */
     incompleteArguments?: boolean;
+    /** Typed reason matching `ToolCall.incompleteArgumentsReason`. Defaults to `"truncated"`. */
+    incompleteArgumentsReason?: "truncated" | "malformed" | "conflicting" | "ambiguous";
+    /** Simulate a provider-flagged `\uXXXX`-escaped non-ASCII argument payload. */
+    escapedNonAsciiArguments?: boolean;
+    thoughtSignature?: string;
 };
 /** One scripted response. */
 export interface MockResponse {
@@ -75,6 +80,9 @@ export interface MockResponse {
     };
     /** Pre-set responseId. */
     responseId?: string;
+    /** Optional provider metadata copied onto the final assistant message. */
+    disabledFeatures?: string[];
+    providerPayload?: AssistantMessage["providerPayload"];
     /** Optional typed provider failure metadata for retry/fallback tests. */
     transportFailure?: AssistantMessage["transportFailure"];
     /** If set, the stream emits a terminal error event instead of completing. */

package/dist/types/providers/register-builtins.d.ts

@@ -55,4 +55,5 @@ export declare const streamOpenAIResponses: (model: Model<"openai-responses">, c
 export declare const streamCursor: (model: Model<"cursor-agent">, context: Context, options: OptionsForApi<"cursor-agent">) => EventStreamImpl;
 export declare const streamOllama: (model: Model<"ollama-chat">, context: Context, options: OptionsForApi<"ollama-chat">) => EventStreamImpl;
 export declare const streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: OptionsForApi<"bedrock-converse-stream">) => EventStreamImpl;
+export declare const streamKiroCodeWhisperer: (model: Model<"kiro-codewhisperer-stream">, context: Context, options: OptionsForApi<"kiro-codewhisperer-stream">) => EventStreamImpl;
 export {};

package/dist/types/providers/transform-messages.d.ts

@@ -9,6 +9,24 @@ import type { Api, AssistantMessage, Message, Model } from "../types";
  * - Injects synthetic "aborted" tool results
  * - Adds a <turn-aborted> guidance marker for the model
  */
+/**
+ * Detect directly adjacent private thinking blocks inside one assistant message's
+ * content. `thinking` and `redacted_thinking` are one adjacency class: the
+ * Anthropic wire contract rejects a replayed assistant turn where two such blocks
+ * sit next to each other with no intervening `tool_use`/`text` block (#4416).
+ *
+ * This is a pure, allocation-free predicate used by defense-in-depth diagnostics
+ * (issue #4443): the write-time transcript assertion (coding-agent persistence)
+ * and the stream-assembler SSE diagnostic (anthropic stream completion). It never
+ * inspects block payloads — only the block-type sequence — so it cannot leak
+ * thinking text, signatures, or credentials.
+ *
+ * Blocks separated by any non-private block (`tool_use`, `text`, …) are ordinary
+ * interleaved-thinking shape and return `false`.
+ */
+export declare function hasAdjacentPrivateThinkingBlocks(content: {
+    type: string;
+}[]): boolean;
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, options?: {
     repairLatestAssistantThinking?: boolean;
     repairAllAssistantThinking?: boolean;

package/dist/types/types.d.ts

@@ -7,6 +7,7 @@ import type { DeleteArgs, DeleteResult, DiagnosticsArgs, DiagnosticsResult, Grep
 import type { GoogleOptions } from "./providers/google";
 import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli";
 import type { GoogleVertexOptions } from "./providers/google-vertex";
+import type { KiroCodeWhispererOptions } from "./providers/kiro-codewhisperer";
 import type { OllamaChatOptions } from "./providers/ollama";
 import type { OpenAICodexResponsesOptions } from "./providers/openai-codex-responses";
 import type { OpenAICompletionsOptions } from "./providers/openai-completions";
@@ -14,7 +15,7 @@ import type { OpenAIResponsesOptions } from "./providers/openai-responses";
 import type { AssistantMessageEventStream } from "./utils/event-stream";
 import type { FallbackAttemptToken, TransportFailureFacts } from "./utils/fallback-transport";
 export type { AssistantMessageEventStream } from "./utils/event-stream";
-export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent";
+export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "kiro-codewhisperer-stream";
 export type Api = KnownApi | (string & {});
 export interface ApiOptionsMap {
     "anthropic-messages": AnthropicOptions;
@@ -28,6 +29,7 @@ export interface ApiOptionsMap {
     "google-vertex": GoogleVertexOptions;
     "ollama-chat": OllamaChatOptions;
     "cursor-agent": CursorOptions;
+    "kiro-codewhisperer-stream": KiroCodeWhispererOptions;
 }
 export type OptionsForApi<TApi extends Api> = StreamOptions | (TApi extends keyof ApiOptionsMap ? ApiOptionsMap[TApi] : never);
 /** Canonical thinking transport used by a model. */
@@ -51,7 +53,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio"];
+export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio", "omlx"];
 export type KnownProvider = (typeof KNOWN_PROVIDERS)[number];
 export declare function isKnownProvider(provider: string): provider is KnownProvider;
 export type Provider = KnownProvider | string;
@@ -374,13 +376,37 @@ export interface ToolCall {
      */
     customWireName?: string;
     /**
-     * Set when the provider detected the argument JSON was truncated — the model
-     * hit its output-token limit (or the response was otherwise cut short) before
-     * emitting a complete arguments object. The `arguments` field then holds a
-     * best-effort partial parse and must not be executed as-is; the agent loop
-     * rejects the call with a retryable error instead.
+     * Set when the provider detected the argument JSON was not safely executable —
+     * the model hit its output-token limit (or the response was otherwise cut short)
+     * before emitting a complete arguments object, the terminal payload was malformed,
+     * the streamed and terminal payloads conflicted, or the tool-call identity was
+     * ambiguous on the wire. The `arguments` field then holds a best-effort partial
+     * parse and must not be executed as-is; the agent loop rejects the call with a
+     * retryable, reason-specific error instead.
      */
     incompleteArguments?: boolean;
+    /**
+     * When `incompleteArguments` is set, the typed cause so the agent loop can give
+     * reason-specific recovery guidance:
+     *  - `"truncated"`: the response was cut short mid-arguments (output-token limit).
+     *  - `"malformed"`: the terminal arguments did not decode to a valid JSON object.
+     *  - `"conflicting"`: the streamed and terminal argument payloads disagree.
+     *  - `"ambiguous"`: the tool-call identity could not be unambiguously resolved
+     *    (duplicate `call_id`, id/call_id collision, etc.), so attribution is unsafe.
+     * Absent when `incompleteArguments` is not set. Existing callers that read only
+     * `incompleteArguments` continue to work.
+     */
+    incompleteArgumentsReason?: "truncated" | "malformed" | "conflicting" | "ambiguous";
+    /**
+     * Set when the raw argument JSON spelled a printable non-ASCII character as a
+     * `\uXXXX` escape instead of literal UTF-8. Such a payload parses cleanly but
+     * is unverifiable: one mistyped hex digit decodes to a different, equally
+     * valid character, so the text can be silently wrong with no in-band evidence.
+     * The agent loop rejects the call with a retryable error instead of executing
+     * it. Escapes that are required (control characters) or unavoidable (lone
+     * surrogates) never set this.
+     */
+    escapedNonAsciiArguments?: boolean;
 }
 export interface Usage {
     /** Non-cached input tokens (matches the bucket the provider bills as new input). */
@@ -429,7 +455,7 @@ export interface Usage {
     };
 }
 export type StopReason = "stop" | "length" | "toolUse" | "error" | "aborted";
-export type AssistantErrorKind = "provider_safety_stop";
+export type AssistantErrorKind = "provider_safety_stop" | "local_snapshot_failure" | "local_buffer_overflow";
 export interface OpenAIResponsesHistoryPayload {
     type: "openaiResponsesHistory";
     provider?: string;

package/dist/types/usage/grok-cli.d.ts

@@ -4,7 +4,12 @@ interface BillingUsage {
     used: number;
     billingPeriodEnd: string;
 }
+interface WeeklyBillingUsage {
+    creditUsagePercent: number;
+    billingPeriodEnd: string;
+}
 export declare function parseGrokCliBillingUsage(payload: unknown): BillingUsage;
+export declare function parseGrokCliWeeklyBillingUsage(payload: unknown): WeeklyBillingUsage | undefined;
 /** Test seam: the usage access token as resolved from a credential plus trusted env. */
 export declare function resolveGrokAccessTokenForTest(params: UsageFetchParams): string | undefined;
 export declare const grokCliUsageProvider: UsageProvider;

package/dist/types/usage.d.ts

@@ -210,6 +210,11 @@ export interface UsageLogger {
     warn(message: string, meta?: Record<string, unknown>): void;
 }
 /** Credential bundle for usage endpoints. */
+/** MCP OAuth authority carried through usage-triggered refresh. */
+export interface UsageMCPOAuthBinding {
+    resourceOrigin: string;
+    tokenEndpoint: string;
+}
 export interface UsageCredential {
     type: "api_key" | "oauth";
     apiKey?: string;
@@ -220,6 +225,7 @@ export interface UsageCredential {
     projectId?: string;
     email?: string;
     enterpriseUrl?: string;
+    mcpBinding?: UsageMCPOAuthBinding;
     metadata?: Record<string, unknown>;
 }
 /** Parameters provided to a usage fetcher. */

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -65,6 +65,11 @@ export interface FetchOpenAICompatibleModelsOptions<TApi extends Api> {
      */
     mapModel?: (entry: OpenAICompatibleModelRecord, defaults: Model<TApi>, context: OpenAICompatibleModelMapperContext<TApi>) => Model<TApi> | null;
 }
+/**
+ * Resolves an endpoint for an implicit local provider without allowing an
+ * environment override to turn its keyless discovery into a remote request.
+ */
+export declare function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string;
 /**
  * Fetches and normalizes an OpenAI-compatible `/models` catalog.
  *

package/dist/types/utils/event-stream.d.ts

@@ -11,7 +11,7 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     rejectFinalResult: (err: unknown) => void;
     isComplete: (event: T) => boolean;
     extractResult: (event: T) => R;
-    constructor(isComplete: (event: T) => boolean, extractResult: (event: T) => R);
+    constructor(isComplete: (event: T) => boolean, extractResult: (event: T) => R, onConsumerClose?: () => void);
     /**
      * Read-only snapshot of the not-yet-consumed events. Always a fresh copy:
      * external code can never mutate internal queue state or observe head-index
@@ -20,6 +20,8 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     get queue(): T[];
     /** Read-only test seam for outstanding consumer-drain waiters. */
     get pendingConsumerDrainCountForTests(): number;
+    /** Whether an async iterator is currently consuming this stream. */
+    get hasActiveConsumer(): boolean;
     push(event: T): void;
     deliver(event: T): void;
     /**
@@ -35,5 +37,5 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     result(): Promise<R>;
 }
 export declare class AssistantMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {
-    constructor();
+    constructor(onConsumerClose?: () => void);
 }

package/dist/types/utils/fallback-transport.d.ts

@@ -44,6 +44,16 @@ export interface TransportFailureFacts {
     /** OpenAI's typed `error.code`, preserved separately at the transport boundary. */
     openaiErrorCode?: string;
     headers?: Record<string, string>;
+    /** Safe request-size observation for retry amplification policy. Never contains body content. */
+    requestBytes?: number;
+    /** Time spent waiting for the first semantic stream event on the failed request. */
+    firstEventElapsedMs?: number;
+    /** Configured first-event window before any bounded endpoint grace. */
+    firstEventTimeoutMs?: number;
+    /** Coarse endpoint class; deliberately excludes host, path, credentials, and query parameters. */
+    endpointClass?: "canonical" | "custom";
+    /** Provider-supplied ceiling for total attempts, including the initial request. */
+    retryMaxAttempts?: number;
 }
 /** Opaque per-invocation marker required by managed fallback transport calls. */
 export interface FallbackAttemptToken {

package/dist/types/utils/http-inspector.d.ts

@@ -6,6 +6,7 @@ export type RawHttpRequestDump = {
     url?: string;
     headers?: Record<string, string>;
     body?: unknown;
+    diagnostics?: Record<string, unknown>;
 };
 export type CapturedHttpErrorResponse = {
     status: number;

package/dist/types/utils/idle-iterator.d.ts

@@ -48,9 +48,21 @@ export declare function getStreamFirstEventTimeoutMs(idleTimeoutMs?: number, fal
  */
 export declare function resolveOpenAISdkRequestTimeoutMs(provider: string, streamFirstEventTimeoutOverride?: number): number | undefined;
 export type Watchdog = NodeJS.Timeout | undefined;
+export interface FirstEventTimeoutFacts {
+    requestBytes?: number;
+    firstEventElapsedMs?: number;
+    firstEventTimeoutMs?: number;
+    endpointClass?: "canonical" | "custom";
+    retryMaxAttempts?: number;
+}
 export declare class FirstEventTimeoutError extends Error {
     readonly providerCode = "stream_first_event_timeout";
-    constructor(message: string);
+    readonly requestBytes?: number;
+    readonly firstEventElapsedMs?: number;
+    readonly firstEventTimeoutMs?: number;
+    readonly endpointClass?: "canonical" | "custom";
+    readonly retryMaxAttempts?: number;
+    constructor(message: string, facts?: FirstEventTimeoutFacts);
 }
 /**
  * Starts a watchdog that aborts a request if no first stream event arrives in time.

package/dist/types/utils/json-parse.d.ts

@@ -1,4 +1,23 @@
 export declare function repairJson(json: string): string;
+/**
+ * First unnecessary `\uXXXX` escape in a JSON document, or `undefined` when the
+ * document contains none.
+ *
+ * "Unnecessary" means the escape encodes a character JSON can carry literally:
+ * any non-ASCII printable character. Control characters (< U+0020) MUST be
+ * escaped, and an unpaired surrogate CANNOT be written literally, so neither
+ * counts. A `\\uXXXX` sequence is a literal backslash followed by `u` — the
+ * intended source syntax when the model is writing code or a nested JSON
+ * document — and is skipped, which is why this scans the raw text with the same
+ * string/escape state machine as {@link repairJson} instead of using a regex.
+ *
+ * Models that spell non-ASCII text as hand-written hex instead of literal UTF-8
+ * mistype the digits, and every mistyped nibble silently decodes to a different
+ * but perfectly valid character (`\uc7a5` vs `\uc7a4`). The resulting arguments
+ * parse cleanly and cannot be repaired after the fact, so the escape itself is
+ * the only observable evidence that the payload is untrustworthy.
+ */
+export declare function findUnnecessaryUnicodeEscape(json: string): string | undefined;
 export declare function parseJsonWithRepair<T>(json: string): T;
 /**
  * Attempts to parse potentially incomplete JSON during streaming.

package/dist/types/utils/oauth/callback-server.d.ts

@@ -18,6 +18,17 @@ export interface OAuthCallbackFlowOptions {
      * `onManualCodeInput` handler on the controller.
      */
     skipCallbackServer?: boolean;
+    /**
+     * Expected authorization-server issuer recorded from validated metadata
+     * (RFC 9207 / MCP 2026-07-28). When set, a present `iss` that differs
+     * rejects the response before any other parameter is acted on.
+     */
+    expectedIssuer?: string;
+    /**
+     * `authorization_response_iss_parameter_supported` from the same metadata.
+     * When true, a response WITHOUT `iss` is rejected.
+     */
+    issuerResponseIssSupported?: boolean;
 }
 /**
  * Abstract base class for OAuth flows with local callback servers.
@@ -30,6 +41,8 @@ export declare abstract class OAuthCallbackFlow {
     callbackHostname: string;
     callbackBindHostname: string;
     redirectUri?: string;
+    expectedIssuer?: string;
+    issuerResponseIssSupported?: boolean;
     constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
     /**
      * Generate provider-specific authorization URL.

package/dist/types/utils/oauth/kiro.d.ts

@@ -0,0 +1,71 @@
+import type { OAuthCredentials } from "./types";
+interface StartDeviceAuthorizationResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    interval: number;
+    expiresIn: number;
+}
+interface CreateTokenSuccess {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken?: string;
+}
+interface ClientRegistration {
+    clientId: string;
+    clientSecret: string;
+    expiresAt: number;
+}
+/**
+ * Register a public SSO OIDC client. Registration responses include an expiry
+ * timestamp (`clientSecretExpiresAt`); we cache until then to avoid re-registering
+ * on every login attempt.
+ *
+ * The SSO OIDC `RegisterClient` endpoint is public (no authentication required).
+ */
+export declare function registerClient(region: string, startUrl: string, signal?: AbortSignal): Promise<ClientRegistration>;
+/** Drop cached client registration — used by tests. */
+export declare function clearClientRegistrationCache(): void;
+/**
+ * Start device authorization. The SSO OIDC `StartDeviceAuthorization` endpoint
+ * is public (requires registered clientId/clientSecret, not SigV4).
+ */
+export declare function startDeviceAuthorization(region: string, startUrl: string, registration: ClientRegistration, signal?: AbortSignal): Promise<StartDeviceAuthorizationResponse>;
+/**
+ * Poll `CreateToken` until the user completes authorization or the device code
+ * expires. Handles `authorization_pending` (continue polling) and `slow_down`
+ * (increase interval) per the published SSO OIDC model.
+ */
+export declare function pollForToken(region: string, registration: ClientRegistration, deviceCode: string, intervalSeconds: number, expiresInSeconds: number, signal?: AbortSignal): Promise<CreateTokenSuccess>;
+/**
+ * Refresh an expired access token using the stored refresh token via
+ * `CreateToken` with `grantType: "refresh_token"`.
+ *
+ * Rotation is published behavior: the response includes a new `refreshToken`.
+ * If the server does not return a new one, the old refresh token is retained.
+ */
+export declare function refreshKiroToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+export interface KiroLoginOptions {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    /** Override for tests. */
+    fetchImpl?: typeof globalThis.fetch;
+}
+export declare function loginKiro(options: KiroLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Attempt to import a cached SSO access token from `~/.aws/sso/cache/`.
+ * Returns the token if a valid (non-expired) one exists, otherwise undefined.
+ *
+ * This reuses the documented AWS CLI SSO cache location, not any third-party
+ * credential store.
+ */
+export declare function importSsoCacheToken(): OAuthCredentials | undefined;
+export {};

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
+export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/dist/types/utils/parse-bind.d.ts

@@ -1,8 +1,3 @@
-/**
- * Shared `host:port` parser used by the auth-broker and auth-gateway boot
- * paths. Centralized so the two servers can't drift on what they accept (the
- * gateway used to silently allow empty hostnames; this fixes it).
- */
 export interface ParsedBind {
     hostname: string;
     port: number;
@@ -21,3 +16,11 @@ export interface ParsedBind {
  *   - non-integer / out-of-range port
  */
 export declare function parseBind(raw: string): ParsedBind;
+/** True for loopback-only hostnames the auth servers may bind without credentials. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Fail closed when an unauthenticated auth server (empty bearer token set)
+ * would bind a non-loopback address: that exposes credential operations to the
+ * network with no proof of possession.
+ */
+export declare function assertAuthenticatedOrLoopback(bind: ParsedBind, bearerTokenCount: number, serverName: string): void;

package/dist/types/utils/tool-call-healing.d.ts

@@ -20,6 +20,13 @@ export interface HealedToolCall {
     readonly id: string;
     readonly name: string;
     readonly arguments: string;
+    /**
+     * Whether the raw leaked payload spelled a printable non-ASCII character as a
+     * `\uXXXX` escape. Captured BEFORE the normalizing round-trip below, which
+     * decodes escapes into literal characters and would otherwise erase the only
+     * evidence that the text is unverifiable.
+     */
+    readonly escapedNonAsciiArguments: boolean;
 }
 /**
  * State machine that consumes streamed text, emits visible text with all

package/dist/types/utils/tool-choice-capability.d.ts

@@ -16,6 +16,17 @@ export declare function toolChoiceRegistryKey(model: Model<Api>): string;
 export declare function getToolChoiceCapabilityOverride(model: Model<Api>): ToolChoiceSupport | undefined;
 /** Clears runtime tool-choice capability overrides for tests. */
 export declare function clearToolChoiceIncapabilityRegistryForTests(): void;
+/** Overrides durable-cache dependencies for isolated tests. */
+export declare function configureToolChoiceCapabilityCacheForTests(options?: {
+    path?: string;
+    now?: () => number;
+    beforeExpiredDelete?: () => void;
+    beforeMalformedDelete?: () => void;
+    onCacheOpen?: () => void;
+    simulateOperationError?: () => Error | undefined;
+    beforeCorruptRetire?: () => void;
+    beforeLockExactUnlink?: (lockPath: string) => void;
+}): void;
 /** Records a discovered maximum supported tool-choice level for a model. */
 export declare function markToolChoiceIncapability(model: Model<Api>, maxSupport: ToolChoiceSupport, reason?: string): void;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.13.2",
+	"version": "0.14.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.13.2",
+		"@gajae-code/natives": "0.14.0",
+		"@gajae-code/utils": "0.14.0",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"