@gajae-code/ai 0.13.3 → 0.14.0

package/dist/types/model-manager.d.ts

@@ -32,6 +32,8 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
     now?: () => number;
     /** Optional guard that must permit cache publication. Default: writes are permitted. */
     canPublishCache?: () => boolean;
+    /** Credential-and-endpoint identity required to reuse dynamic catalog IDs. */
+    cacheDynamicModelProvenance?: string;
 }
 /**
  * Resolution result.
@@ -44,8 +46,17 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 export interface ModelResolutionResult<TApi extends Api = Api> {
     models: Model<TApi>[];
     stale: boolean;
+    /** Whether the cache row consulted for this resolution was still within its TTL. */
+    cacheFresh: boolean;
+    /** Whether the consulted cache row was authoritative. */
+    cacheAuthoritative: boolean;
     /** Whether this resolution successfully fetched dynamic models. */
     fetched: boolean;
+    /**
+     * IDs returned by a current authoritative dynamic provider catalog. This is
+     * deliberately distinct from `models`, which merges static and cached data.
+     */
+    dynamicModelIds?: readonly string[];
 }
 /**
  * Stateful facade over provider model resolution.

package/dist/types/provider-models/openai-compat.d.ts

@@ -162,6 +162,11 @@ export interface LmStudioModelManagerConfig {
     baseUrl?: string;
 }
 export declare function lmStudioModelManagerOptions(config?: LmStudioModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface OmlxModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface SyntheticModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/anthropic.d.ts

@@ -1,6 +1,7 @@
 import Anthropic, { type ClientOptions as AnthropicSdkClientOptions } from "@anthropic-ai/sdk";
 import type { MessageCreateParamsStreaming, MessageParam } from "@anthropic-ai/sdk/resources/messages";
 import type { FetchImpl, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types";
+import { type RawHttpRequestDump } from "../utils/http-inspector";
 export type AnthropicHeaderOptions = {
     apiKey: string;
     baseUrl?: string;
@@ -76,6 +77,36 @@ export declare function isAnthropicMaskedProxyRejection(error: unknown): boolean
  * loud instead of being silently retried.
  */
 export declare function isAnthropicCacheBreakpointOverflowError(error: unknown): boolean;
+export type AnthropicContextManagementInjectionDiagnostic = {
+    strategy: string;
+    message: string;
+    captureNote: string;
+};
+/**
+ * Diagnose a context-management strategy named by an Anthropic 400 but absent
+ * from the body GJC sent. This mismatch is evidence of intermediary mutation,
+ * not permission to silently enable thinking or retry the request.
+ */
+export declare function diagnoseAnthropicContextManagementInjection(error: unknown, dump: RawHttpRequestDump | undefined): AnthropicContextManagementInjectionDiagnostic | undefined;
+export interface CpaToolAliasRestoreFailure {
+    /** The rejected tool-call name exactly as CPA quoted it. */
+    alias: string;
+    /**
+     * Base tool name parsed out of the alias (`mcp__<server>__<token>_<base>`
+     * → `<base>`), when the alias shape is well-formed. `undefined` for a
+     * malformed alias — callers must then fall back to direct discovery and
+     * never invent a name.
+     */
+    baseName?: string;
+}
+/**
+ * Classifies the CPA alias-restore signature and extracts the rejected alias
+ * plus its base tool name. Claims only statusless in-stream SSE error events
+ * and HTTP 5xx failures: a non-5xx status carrying this text is not the
+ * observed CPA delivery shape and is left to the other classifiers.
+ */
+export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
+export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
 export declare const claudeCodeVersion = "2.1.219";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;

package/dist/types/providers/cursor.d.ts

@@ -1,5 +1,5 @@
 import { type JsonValue } from "@bufbuild/protobuf";
-import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, StreamFunction, StreamOptions, ToolResultMessage } from "../types";
+import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, StreamFunction, StreamOptions, ToolCall, ToolResultMessage } from "../types";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
 export { CURSOR_CLIENT_VERSION };
@@ -12,11 +12,19 @@ export interface CursorOptions extends StreamOptions {
     onToolResult?: CursorToolResultHandler;
 }
 export declare const streamCursor: StreamFunction<"cursor-agent">;
+type ToolCallState = ToolCall & {
+    index: number;
+    partialJson?: string;
+    kind: "mcp" | "todo_write" | "native";
+};
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
 export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
     execResult: TResult;
     toolResult?: ToolResultMessage;
 }>;
+/** Exported for direct regression coverage of the JSON-safety boundary. */
+export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
+export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching

package/dist/types/providers/mock.d.ts

@@ -62,8 +62,11 @@ export type MockContent = string | {
     arguments: Record<string, unknown> | string;
     /** Simulate a provider-flagged truncated call (cut off mid-arguments). */
     incompleteArguments?: boolean;
-    /** Simulate a provider-flagged `\uXXXX`-escaped-arguments call. */
+    /** Typed reason matching `ToolCall.incompleteArgumentsReason`. Defaults to `"truncated"`. */
+    incompleteArgumentsReason?: "truncated" | "malformed" | "conflicting" | "ambiguous";
+    /** Simulate a provider-flagged `\uXXXX`-escaped non-ASCII argument payload. */
     escapedNonAsciiArguments?: boolean;
+    thoughtSignature?: string;
 };
 /** One scripted response. */
 export interface MockResponse {
@@ -77,6 +80,9 @@ export interface MockResponse {
     };
     /** Pre-set responseId. */
     responseId?: string;
+    /** Optional provider metadata copied onto the final assistant message. */
+    disabledFeatures?: string[];
+    providerPayload?: AssistantMessage["providerPayload"];
     /** Optional typed provider failure metadata for retry/fallback tests. */
     transportFailure?: AssistantMessage["transportFailure"];
     /** If set, the stream emits a terminal error event instead of completing. */

package/dist/types/providers/transform-messages.d.ts

@@ -9,6 +9,24 @@ import type { Api, AssistantMessage, Message, Model } from "../types";
  * - Injects synthetic "aborted" tool results
  * - Adds a <turn-aborted> guidance marker for the model
  */
+/**
+ * Detect directly adjacent private thinking blocks inside one assistant message's
+ * content. `thinking` and `redacted_thinking` are one adjacency class: the
+ * Anthropic wire contract rejects a replayed assistant turn where two such blocks
+ * sit next to each other with no intervening `tool_use`/`text` block (#4416).
+ *
+ * This is a pure, allocation-free predicate used by defense-in-depth diagnostics
+ * (issue #4443): the write-time transcript assertion (coding-agent persistence)
+ * and the stream-assembler SSE diagnostic (anthropic stream completion). It never
+ * inspects block payloads — only the block-type sequence — so it cannot leak
+ * thinking text, signatures, or credentials.
+ *
+ * Blocks separated by any non-private block (`tool_use`, `text`, …) are ordinary
+ * interleaved-thinking shape and return `false`.
+ */
+export declare function hasAdjacentPrivateThinkingBlocks(content: {
+    type: string;
+}[]): boolean;
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, options?: {
     repairLatestAssistantThinking?: boolean;
     repairAllAssistantThinking?: boolean;

package/dist/types/types.d.ts

@@ -53,7 +53,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio"];
+export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio", "omlx"];
 export type KnownProvider = (typeof KNOWN_PROVIDERS)[number];
 export declare function isKnownProvider(provider: string): provider is KnownProvider;
 export type Provider = KnownProvider | string;
@@ -376,21 +376,35 @@ export interface ToolCall {
      */
     customWireName?: string;
     /**
-     * Set when the provider detected the argument JSON was truncated — the model
-     * hit its output-token limit (or the response was otherwise cut short) before
-     * emitting a complete arguments object. The `arguments` field then holds a
-     * best-effort partial parse and must not be executed as-is; the agent loop
-     * rejects the call with a retryable error instead.
+     * Set when the provider detected the argument JSON was not safely executable —
+     * the model hit its output-token limit (or the response was otherwise cut short)
+     * before emitting a complete arguments object, the terminal payload was malformed,
+     * the streamed and terminal payloads conflicted, or the tool-call identity was
+     * ambiguous on the wire. The `arguments` field then holds a best-effort partial
+     * parse and must not be executed as-is; the agent loop rejects the call with a
+     * retryable, reason-specific error instead.
      */
     incompleteArguments?: boolean;
     /**
-     * Set when the provider saw the argument JSON spell a printable non-ASCII
-     * character as a `\uXXXX` escape instead of literal UTF-8. Hand-written hex
-     * is where models mistype digits, and a mistyped nibble decodes to a
-     * different but equally valid character, so the decoded arguments cannot be
-     * verified or repaired after parsing. The agent loop treats such a turn as a
-     * sampling accident: managed runs discard and re-request it, and execution
-     * rejects the call rather than running on silently corrupted text.
+     * When `incompleteArguments` is set, the typed cause so the agent loop can give
+     * reason-specific recovery guidance:
+     *  - `"truncated"`: the response was cut short mid-arguments (output-token limit).
+     *  - `"malformed"`: the terminal arguments did not decode to a valid JSON object.
+     *  - `"conflicting"`: the streamed and terminal argument payloads disagree.
+     *  - `"ambiguous"`: the tool-call identity could not be unambiguously resolved
+     *    (duplicate `call_id`, id/call_id collision, etc.), so attribution is unsafe.
+     * Absent when `incompleteArguments` is not set. Existing callers that read only
+     * `incompleteArguments` continue to work.
+     */
+    incompleteArgumentsReason?: "truncated" | "malformed" | "conflicting" | "ambiguous";
+    /**
+     * Set when the raw argument JSON spelled a printable non-ASCII character as a
+     * `\uXXXX` escape instead of literal UTF-8. Such a payload parses cleanly but
+     * is unverifiable: one mistyped hex digit decodes to a different, equally
+     * valid character, so the text can be silently wrong with no in-band evidence.
+     * The agent loop rejects the call with a retryable error instead of executing
+     * it. Escapes that are required (control characters) or unavoidable (lone
+     * surrogates) never set this.
      */
     escapedNonAsciiArguments?: boolean;
 }
@@ -441,7 +455,7 @@ export interface Usage {
     };
 }
 export type StopReason = "stop" | "length" | "toolUse" | "error" | "aborted";
-export type AssistantErrorKind = "provider_safety_stop";
+export type AssistantErrorKind = "provider_safety_stop" | "local_snapshot_failure" | "local_buffer_overflow";
 export interface OpenAIResponsesHistoryPayload {
     type: "openaiResponsesHistory";
     provider?: string;

package/dist/types/usage/grok-cli.d.ts

@@ -4,7 +4,12 @@ interface BillingUsage {
     used: number;
     billingPeriodEnd: string;
 }
+interface WeeklyBillingUsage {
+    creditUsagePercent: number;
+    billingPeriodEnd: string;
+}
 export declare function parseGrokCliBillingUsage(payload: unknown): BillingUsage;
+export declare function parseGrokCliWeeklyBillingUsage(payload: unknown): WeeklyBillingUsage | undefined;
 /** Test seam: the usage access token as resolved from a credential plus trusted env. */
 export declare function resolveGrokAccessTokenForTest(params: UsageFetchParams): string | undefined;
 export declare const grokCliUsageProvider: UsageProvider;

package/dist/types/usage.d.ts

@@ -210,6 +210,11 @@ export interface UsageLogger {
     warn(message: string, meta?: Record<string, unknown>): void;
 }
 /** Credential bundle for usage endpoints. */
+/** MCP OAuth authority carried through usage-triggered refresh. */
+export interface UsageMCPOAuthBinding {
+    resourceOrigin: string;
+    tokenEndpoint: string;
+}
 export interface UsageCredential {
     type: "api_key" | "oauth";
     apiKey?: string;
@@ -220,6 +225,7 @@ export interface UsageCredential {
     projectId?: string;
     email?: string;
     enterpriseUrl?: string;
+    mcpBinding?: UsageMCPOAuthBinding;
     metadata?: Record<string, unknown>;
 }
 /** Parameters provided to a usage fetcher. */

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -65,6 +65,11 @@ export interface FetchOpenAICompatibleModelsOptions<TApi extends Api> {
      */
     mapModel?: (entry: OpenAICompatibleModelRecord, defaults: Model<TApi>, context: OpenAICompatibleModelMapperContext<TApi>) => Model<TApi> | null;
 }
+/**
+ * Resolves an endpoint for an implicit local provider without allowing an
+ * environment override to turn its keyless discovery into a remote request.
+ */
+export declare function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string;
 /**
  * Fetches and normalizes an OpenAI-compatible `/models` catalog.
  *

package/dist/types/utils/event-stream.d.ts

@@ -11,7 +11,7 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     rejectFinalResult: (err: unknown) => void;
     isComplete: (event: T) => boolean;
     extractResult: (event: T) => R;
-    constructor(isComplete: (event: T) => boolean, extractResult: (event: T) => R);
+    constructor(isComplete: (event: T) => boolean, extractResult: (event: T) => R, onConsumerClose?: () => void);
     /**
      * Read-only snapshot of the not-yet-consumed events. Always a fresh copy:
      * external code can never mutate internal queue state or observe head-index
@@ -20,6 +20,8 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     get queue(): T[];
     /** Read-only test seam for outstanding consumer-drain waiters. */
     get pendingConsumerDrainCountForTests(): number;
+    /** Whether an async iterator is currently consuming this stream. */
+    get hasActiveConsumer(): boolean;
     push(event: T): void;
     deliver(event: T): void;
     /**
@@ -35,5 +37,5 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     result(): Promise<R>;
 }
 export declare class AssistantMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {
-    constructor();
+    constructor(onConsumerClose?: () => void);
 }

package/dist/types/utils/fallback-transport.d.ts

@@ -44,6 +44,16 @@ export interface TransportFailureFacts {
     /** OpenAI's typed `error.code`, preserved separately at the transport boundary. */
     openaiErrorCode?: string;
     headers?: Record<string, string>;
+    /** Safe request-size observation for retry amplification policy. Never contains body content. */
+    requestBytes?: number;
+    /** Time spent waiting for the first semantic stream event on the failed request. */
+    firstEventElapsedMs?: number;
+    /** Configured first-event window before any bounded endpoint grace. */
+    firstEventTimeoutMs?: number;
+    /** Coarse endpoint class; deliberately excludes host, path, credentials, and query parameters. */
+    endpointClass?: "canonical" | "custom";
+    /** Provider-supplied ceiling for total attempts, including the initial request. */
+    retryMaxAttempts?: number;
 }
 /** Opaque per-invocation marker required by managed fallback transport calls. */
 export interface FallbackAttemptToken {

package/dist/types/utils/http-inspector.d.ts

@@ -6,6 +6,7 @@ export type RawHttpRequestDump = {
     url?: string;
     headers?: Record<string, string>;
     body?: unknown;
+    diagnostics?: Record<string, unknown>;
 };
 export type CapturedHttpErrorResponse = {
     status: number;

package/dist/types/utils/idle-iterator.d.ts

@@ -48,9 +48,21 @@ export declare function getStreamFirstEventTimeoutMs(idleTimeoutMs?: number, fal
  */
 export declare function resolveOpenAISdkRequestTimeoutMs(provider: string, streamFirstEventTimeoutOverride?: number): number | undefined;
 export type Watchdog = NodeJS.Timeout | undefined;
+export interface FirstEventTimeoutFacts {
+    requestBytes?: number;
+    firstEventElapsedMs?: number;
+    firstEventTimeoutMs?: number;
+    endpointClass?: "canonical" | "custom";
+    retryMaxAttempts?: number;
+}
 export declare class FirstEventTimeoutError extends Error {
     readonly providerCode = "stream_first_event_timeout";
-    constructor(message: string);
+    readonly requestBytes?: number;
+    readonly firstEventElapsedMs?: number;
+    readonly firstEventTimeoutMs?: number;
+    readonly endpointClass?: "canonical" | "custom";
+    readonly retryMaxAttempts?: number;
+    constructor(message: string, facts?: FirstEventTimeoutFacts);
 }
 /**
  * Starts a watchdog that aborts a request if no first stream event arrives in time.

package/dist/types/utils/oauth/callback-server.d.ts

@@ -18,6 +18,17 @@ export interface OAuthCallbackFlowOptions {
      * `onManualCodeInput` handler on the controller.
      */
     skipCallbackServer?: boolean;
+    /**
+     * Expected authorization-server issuer recorded from validated metadata
+     * (RFC 9207 / MCP 2026-07-28). When set, a present `iss` that differs
+     * rejects the response before any other parameter is acted on.
+     */
+    expectedIssuer?: string;
+    /**
+     * `authorization_response_iss_parameter_supported` from the same metadata.
+     * When true, a response WITHOUT `iss` is rejected.
+     */
+    issuerResponseIssSupported?: boolean;
 }
 /**
  * Abstract base class for OAuth flows with local callback servers.
@@ -30,6 +41,8 @@ export declare abstract class OAuthCallbackFlow {
     callbackHostname: string;
     callbackBindHostname: string;
     redirectUri?: string;
+    expectedIssuer?: string;
+    issuerResponseIssSupported?: boolean;
     constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
     /**
      * Generate provider-specific authorization URL.

package/dist/types/utils/parse-bind.d.ts

@@ -1,8 +1,3 @@
-/**
- * Shared `host:port` parser used by the auth-broker and auth-gateway boot
- * paths. Centralized so the two servers can't drift on what they accept (the
- * gateway used to silently allow empty hostnames; this fixes it).
- */
 export interface ParsedBind {
     hostname: string;
     port: number;
@@ -21,3 +16,11 @@ export interface ParsedBind {
  *   - non-integer / out-of-range port
  */
 export declare function parseBind(raw: string): ParsedBind;
+/** True for loopback-only hostnames the auth servers may bind without credentials. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Fail closed when an unauthenticated auth server (empty bearer token set)
+ * would bind a non-loopback address: that exposes credential operations to the
+ * network with no proof of possession.
+ */
+export declare function assertAuthenticatedOrLoopback(bind: ParsedBind, bearerTokenCount: number, serverName: string): void;

package/dist/types/utils/tool-call-healing.d.ts

@@ -20,6 +20,13 @@ export interface HealedToolCall {
     readonly id: string;
     readonly name: string;
     readonly arguments: string;
+    /**
+     * Whether the raw leaked payload spelled a printable non-ASCII character as a
+     * `\uXXXX` escape. Captured BEFORE the normalizing round-trip below, which
+     * decodes escapes into literal characters and would otherwise erase the only
+     * evidence that the text is unverifiable.
+     */
+    readonly escapedNonAsciiArguments: boolean;
 }
 /**
  * State machine that consumes streamed text, emits visible text with all

package/dist/types/utils/tool-choice-capability.d.ts

@@ -16,6 +16,17 @@ export declare function toolChoiceRegistryKey(model: Model<Api>): string;
 export declare function getToolChoiceCapabilityOverride(model: Model<Api>): ToolChoiceSupport | undefined;
 /** Clears runtime tool-choice capability overrides for tests. */
 export declare function clearToolChoiceIncapabilityRegistryForTests(): void;
+/** Overrides durable-cache dependencies for isolated tests. */
+export declare function configureToolChoiceCapabilityCacheForTests(options?: {
+    path?: string;
+    now?: () => number;
+    beforeExpiredDelete?: () => void;
+    beforeMalformedDelete?: () => void;
+    onCacheOpen?: () => void;
+    simulateOperationError?: () => Error | undefined;
+    beforeCorruptRetire?: () => void;
+    beforeLockExactUnlink?: (lockPath: string) => void;
+}): void;
 /** Records a discovered maximum supported tool-choice level for a model. */
 export declare function markToolChoiceIncapability(model: Model<Api>, maxSupport: ToolChoiceSupport, reason?: string): void;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.13.3",
+	"version": "0.14.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.13.3",
+		"@gajae-code/natives": "0.14.0",
+		"@gajae-code/utils": "0.14.0",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/client.ts

@@ -12,6 +12,7 @@ import type {
 	CredentialDisableRequest,
 	CredentialDisableResponse,
 	CredentialIfAbsentUploadResponse,
+	CredentialMetadataResponse,
 	CredentialRefreshRequest,
 	CredentialRefreshResponse,
 	CredentialUploadRequest,
@@ -24,6 +25,7 @@ import type {
 import {
 	credentialDisableResponseSchema,
 	credentialIfAbsentUploadResponseSchema,
+	credentialMetadataResponseSchema,
 	credentialRefreshResponseSchema,
 	credentialUploadResponseSchema,
 	healthzResponseSchema,
@@ -68,6 +70,14 @@ export class AuthBrokerStreamUnsupportedError extends AuthBrokerError {
 	}
 }
 
+/** Thrown when a broker responds 404 to `GET /v1/credentials/metadata`. */
+export class AuthBrokerCredentialMetadataUnsupportedError extends AuthBrokerError {
+	constructor(message = "Auth broker does not support /v1/credentials/metadata") {
+		super(message, { status: 404 });
+		this.name = "AuthBrokerCredentialMetadataUnsupportedError";
+	}
+}
+
 export interface FetchSnapshotOptions {
 	ifGenerationGt?: number;
 	waitMs?: number;
@@ -108,6 +118,11 @@ export class AuthBrokerClient {
 		this.#fetch = opts.fetchImpl ?? fetch;
 	}
 
+	/** Normalized broker origin used for non-secret local presentation partitioning. */
+	get baseUrl(): string {
+		return this.#baseUrl;
+	}
+
 	healthz(signal?: AbortSignal): Promise<HealthzResponse> {
 		return this.#request("GET", "/v1/healthz", { schema: healthzResponseSchema, auth: false, signal });
 	}
@@ -115,6 +130,21 @@ export class AuthBrokerClient {
 	async fetchSnapshot(opts: FetchSnapshotOptions = {}): Promise<FetchSnapshotResult> {
 		return this.#fetchSnapshotResult(opts);
 	}
+
+	/** Fetches the generation-aware, secret-free credential inventory projection. */
+	async fetchCredentialMetadata(signal?: AbortSignal): Promise<CredentialMetadataResponse> {
+		try {
+			return (await this.#request("GET", "/v1/credentials/metadata", {
+				schema: credentialMetadataResponseSchema,
+				signal,
+			})) as CredentialMetadataResponse;
+		} catch (error) {
+			if (error instanceof AuthBrokerError && error.status === 404) {
+				throw new AuthBrokerCredentialMetadataUnsupportedError();
+			}
+			throw error;
+		}
+	}
 	async #fetchSnapshotResult(opts: FetchSnapshotOptions): Promise<FetchSnapshotResult> {
 		const query = new URLSearchParams();
 		if (opts.waitMs !== undefined) query.set("wait", String(opts.waitMs));

package/src/auth-broker/redact.ts

@@ -0,0 +1,15 @@
+/**
+ * Keep provider and upstream failure text safe for less-trusted surfaces.
+ *
+ * This intentionally mirrors the bounded reason scrubber used by the account
+ * management CLI without taking a dependency on coding-agent.
+ */
+export function cleanReason(value: unknown): string | undefined {
+	if (value === undefined || value === null) return undefined;
+	let reason = value instanceof Error ? value.message : String(value);
+	reason = reason.replace(/bearer\s+[^\s,;]+/gi, "Bearer [redacted]");
+	reason = reason.replace(/(api[_-]?key|token|secret|authorization)[=:]\s*[^\s,;]+/gi, "$1=[redacted]");
+	reason = reason.replace(/[\r\n\t ]+/g, " ").trim();
+	if (reason.length > 256) reason = `${reason.slice(0, 253)}...`;
+	return reason || undefined;
+}

package/src/auth-broker/refresher.ts

@@ -11,6 +11,7 @@
  */
 import { logger } from "@gajae-code/utils";
 import type { AuthStorage } from "../auth-storage";
+import { cleanReason } from "./redact";
 import { DEFAULT_REFRESH_INTERVAL_MS, DEFAULT_REFRESH_SKEW_MS } from "./types";
 
 export interface AuthBrokerRefresherOptions {
@@ -113,8 +114,9 @@ export class AuthBrokerRefresher {
 		try {
 			await this.#storage.refreshCredentialById(id);
 		} catch (error) {
-			const errorMsg = String(error);
-			if (isDefinitiveFailure(errorMsg)) {
+			const rawErrorMsg = String(error);
+			const errorMsg = cleanReason(error) ?? "Unknown refresh failure";
+			if (isDefinitiveFailure(rawErrorMsg)) {
 				logger.warn("auth-broker refresh failed definitively; disabling credential", {
 					id,
 					error: errorMsg,