@gajae-code/ai 0.13.2 → 0.14.0

package/src/auth-broker/client.ts

@@ -12,6 +12,7 @@ import type {
 	CredentialDisableRequest,
 	CredentialDisableResponse,
 	CredentialIfAbsentUploadResponse,
+	CredentialMetadataResponse,
 	CredentialRefreshRequest,
 	CredentialRefreshResponse,
 	CredentialUploadRequest,
@@ -24,6 +25,7 @@ import type {
 import {
 	credentialDisableResponseSchema,
 	credentialIfAbsentUploadResponseSchema,
+	credentialMetadataResponseSchema,
 	credentialRefreshResponseSchema,
 	credentialUploadResponseSchema,
 	healthzResponseSchema,
@@ -68,6 +70,14 @@ export class AuthBrokerStreamUnsupportedError extends AuthBrokerError {
 	}
 }
 
+/** Thrown when a broker responds 404 to `GET /v1/credentials/metadata`. */
+export class AuthBrokerCredentialMetadataUnsupportedError extends AuthBrokerError {
+	constructor(message = "Auth broker does not support /v1/credentials/metadata") {
+		super(message, { status: 404 });
+		this.name = "AuthBrokerCredentialMetadataUnsupportedError";
+	}
+}
+
 export interface FetchSnapshotOptions {
 	ifGenerationGt?: number;
 	waitMs?: number;
@@ -108,6 +118,11 @@ export class AuthBrokerClient {
 		this.#fetch = opts.fetchImpl ?? fetch;
 	}
 
+	/** Normalized broker origin used for non-secret local presentation partitioning. */
+	get baseUrl(): string {
+		return this.#baseUrl;
+	}
+
 	healthz(signal?: AbortSignal): Promise<HealthzResponse> {
 		return this.#request("GET", "/v1/healthz", { schema: healthzResponseSchema, auth: false, signal });
 	}
@@ -115,6 +130,21 @@ export class AuthBrokerClient {
 	async fetchSnapshot(opts: FetchSnapshotOptions = {}): Promise<FetchSnapshotResult> {
 		return this.#fetchSnapshotResult(opts);
 	}
+
+	/** Fetches the generation-aware, secret-free credential inventory projection. */
+	async fetchCredentialMetadata(signal?: AbortSignal): Promise<CredentialMetadataResponse> {
+		try {
+			return (await this.#request("GET", "/v1/credentials/metadata", {
+				schema: credentialMetadataResponseSchema,
+				signal,
+			})) as CredentialMetadataResponse;
+		} catch (error) {
+			if (error instanceof AuthBrokerError && error.status === 404) {
+				throw new AuthBrokerCredentialMetadataUnsupportedError();
+			}
+			throw error;
+		}
+	}
 	async #fetchSnapshotResult(opts: FetchSnapshotOptions): Promise<FetchSnapshotResult> {
 		const query = new URLSearchParams();
 		if (opts.waitMs !== undefined) query.set("wait", String(opts.waitMs));

package/src/auth-broker/redact.ts

@@ -0,0 +1,15 @@
+/**
+ * Keep provider and upstream failure text safe for less-trusted surfaces.
+ *
+ * This intentionally mirrors the bounded reason scrubber used by the account
+ * management CLI without taking a dependency on coding-agent.
+ */
+export function cleanReason(value: unknown): string | undefined {
+	if (value === undefined || value === null) return undefined;
+	let reason = value instanceof Error ? value.message : String(value);
+	reason = reason.replace(/bearer\s+[^\s,;]+/gi, "Bearer [redacted]");
+	reason = reason.replace(/(api[_-]?key|token|secret|authorization)[=:]\s*[^\s,;]+/gi, "$1=[redacted]");
+	reason = reason.replace(/[\r\n\t ]+/g, " ").trim();
+	if (reason.length > 256) reason = `${reason.slice(0, 253)}...`;
+	return reason || undefined;
+}

package/src/auth-broker/refresher.ts

@@ -11,6 +11,7 @@
  */
 import { logger } from "@gajae-code/utils";
 import type { AuthStorage } from "../auth-storage";
+import { cleanReason } from "./redact";
 import { DEFAULT_REFRESH_INTERVAL_MS, DEFAULT_REFRESH_SKEW_MS } from "./types";
 
 export interface AuthBrokerRefresherOptions {
@@ -113,8 +114,9 @@ export class AuthBrokerRefresher {
 		try {
 			await this.#storage.refreshCredentialById(id);
 		} catch (error) {
-			const errorMsg = String(error);
-			if (isDefinitiveFailure(errorMsg)) {
+			const rawErrorMsg = String(error);
+			const errorMsg = cleanReason(error) ?? "Unknown refresh failure";
+			if (isDefinitiveFailure(rawErrorMsg)) {
 				logger.warn("auth-broker refresh failed definitively; disabling credential", {
 					id,
 					error: errorMsg,