@gajae-code/ai 0.18.11 → 0.19.0

package/dist/types/providers/anthropic.d.ts

@@ -51,6 +51,16 @@ export declare function isAnthropicThinkingBlockMutationError(error: unknown): b
  * than only the latest one.
  */
 export declare function isAnthropicThinkingSignatureInvalidError(error: unknown): boolean;
+/**
+ * 400 shape where Anthropic cannot decode one of the request's images:
+ * `{"type":"invalid_request_error","message":"Could not process image"}`.
+ * Observed for a truncated JPEG (no end-of-image marker) that local resizing
+ * also failed to decode and therefore forwarded unchanged. The body names no
+ * image, and the image stays in history, so without omission every later
+ * request of the session draws the same rejection.
+ */
+export declare function isAnthropicImageUnprocessableError(error: unknown): boolean;
+export declare const ANTHROPIC_OMITTED_IMAGE_PLACEHOLDER = "[Image omitted: Anthropic could not process this image. The file may be corrupt or truncated; re-export or convert it before attaching it again.]";
 /**
  * CLIProxyAPI replaces Anthropic's rejection body wholesale instead of forwarding
  * it: the client only ever sees
@@ -107,6 +117,14 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
+/**
+ * How many breakpoints we are still willing to generate after a gateway has
+ * rejected a previous attempt. `explicit` mode normally emits two (a reusable
+ * prefix anchor on the last assistant turn plus a refresh point on the current
+ * user turn), so stepping down to one still caches the prefix, and only the
+ * final step gives caching up entirely.
+ */
+type GeneratedCacheBudget = 2 | 1 | 0;
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
@@ -218,6 +236,8 @@ export type AnthropicClientOptionsResult = {
     fetchOptions?: AnthropicSdkClientOptions["fetchOptions"];
 };
 export declare function resolveGlmZcodeAnthropicBaseUrl(): string;
+/** Compresses request bodies with gzip for first-party Anthropic endpoints only. */
+export declare function wrapAnthropicFetchForGzip(baseFetch: FetchImpl): FetchImpl;
 export declare function isProviderRetryableError(error: unknown, provider?: string): boolean;
 export type AnthropicUsageLike = {
     cache_creation?: {
@@ -251,6 +271,11 @@ type SystemBlockOptions = {
 export declare function buildAnthropicSystemBlocks(systemPrompt: readonly string[] | undefined, options?: SystemBlockOptions): AnthropicSystemBlock[] | undefined;
 export declare function normalizeExtraBetas(betas?: string[] | string): string[];
 export declare function buildAnthropicClientOptions(args: AnthropicClientOptionsArgs): AnthropicClientOptionsResult;
+type AnthropicCacheParams = MessageCreateParamsStreaming & {
+    cache_control?: AnthropicCacheControl;
+};
+type AnthropicCacheMode = "automatic" | "explicit" | "none";
+export declare function applyPromptCaching(params: AnthropicCacheParams, cacheMode: AnthropicCacheMode, cacheControl?: AnthropicCacheControl, budget?: GeneratedCacheBudget): void;
 export declare function normalizeCacheControlTtlOrdering(params: MessageCreateParamsStreaming): void;
 export declare function convertAnthropicMessages(messages: Message[], model: Model<"anthropic-messages">, isOAuthToken: boolean, options?: {
     repairLatestAssistantThinking?: boolean;

package/dist/types/providers/aws-credential-config.d.ts

@@ -1,3 +1,4 @@
+import type { FetchImpl } from "../types";
 import type { AwsCredentials } from "./aws-sigv4";
 export type AwsIniFile = Record<string, Record<string, string>>;
 export interface AwsCredentialSourceOptions {
@@ -16,4 +17,8 @@ export declare function classifyAwsProfileCapability(profile: string, credential
 export declare function hasResolvableAwsProfileSource(options?: AwsCredentialSourceOptions & {
     onScan?: () => void;
 }, now?: number): boolean;
+/** Probe only the IMDSv2 token and role endpoints; never request role credentials for status. */
+export declare function hasAwsInstanceProfileCredentialSource(options?: {
+    fetch?: FetchImpl;
+}): Promise<boolean>;
 export declare function isValidBedrockBearerToken(token: string | undefined): token is string;

package/dist/types/providers/google-auth.d.ts

@@ -14,8 +14,15 @@
  * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
  */
 import type { FetchImpl } from "../types";
+export type VertexCredentialSource = "explicit-file" | "default-file" | "metadata-server";
+/** Match the region-label constraint used before Vertex interpolates a location into the request host. */
+export declare function isValidVertexLocation(location: string): boolean;
 /** Test seam: the ADC credentials file path as resolved from trusted env. */
 export declare function resolveAdcCredentialsPathForTest(): string | undefined;
+/** Resolve the source of a currently usable ADC credential without acquiring an access token. */
+export declare function getVertexCredentialSource(options?: {
+    fetch?: FetchImpl;
+}): Promise<VertexCredentialSource | undefined>;
 /**
  * Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
  * The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.

package/dist/types/providers/google-gemini-headers.d.ts

@@ -29,15 +29,20 @@ export declare const ANTIGRAVITY_SYSTEM_INSTRUCTION = "You are Antigravity, a po
 /**
  * Antigravity / Cloud Code Assist user agent.
  *
- * Disassembly-confirmed: getUserAgentName() @ 0x5ecb1dd loads "antigravity-ide"
- * via LEA RDX, [RIP-0x284fc90] → 0x367b554 = "antigravity-ide"
+ * Field-evidence-based default: A/B/A test on Windows+Ultra (subscriber) confirmed that
+ * 'antigravity/cli/1.3.4 (os_type=darwin; arch=arm64; aidev_client; auth_method=oauth)'
+ * unlocks Gemini 4 Argon (low/medium/high) and Gemini 3.8 Flash (low/medium/high) models,
+ * plus Opus 5.5. Reverting to 'antigravity-ide' hides Argon models again. Pro accounts
+ * receive 'gemini-4-argon-disabled' with disabled:true, confirming the UA gates model
+ * visibility by account tier. The darwin/arm64 values were tested on Windows and worked,
+ * suggesting this is not platform-specific but rather a client identity string.
  *
- * The LS sets HTTP headers via: fmt.Sprintf("User-Agent: %s", getUserAgentName())
- * So the final header is: User-Agent: antigravity-ide
+ * Historical note: Disassembly (0x5ecb1dd) showed the IDE binary loads 'antigravity-ide';
+ * this appears to be outdated or a fallback for older clients.
  *
- * -override_user_agent flag can override this (confirmed at 0x5ecbc37).
+ * Overridable via PI_AI_ANTIGRAVITY_USER_AGENT environment variable.
  */
-export declare let getAntigravityUserAgent: () => string;
+export declare function getAntigravityUserAgent(): string;
 export declare const getAntigravityRequestHeaders: () => {
     "User-Agent": string;
 };

package/dist/types/providers/kiro-api-key.d.ts

@@ -38,6 +38,11 @@ type KiroStreamEvent = {
         inputTokens?: number;
         outputTokens?: number;
     };
+} | {
+    type: "completion";
+    data: {
+        stopReason: "COMPLETED" | "TOOL_USE";
+    };
 } | {
     type: "refusal";
     data: {

package/dist/types/providers/openai-chat-server-schema.d.ts

@@ -1707,7 +1707,8 @@ export declare const openaiChatRequestSchema: z.ZodObject<{
         flex: "flex";
         priority: "priority";
         scale: "scale";
-    }>>>, z.ZodTransform<NonNullable<"auto" | "default" | "flex" | "priority" | "scale"> | undefined, "auto" | "default" | "flex" | "priority" | "scale" | null | undefined>>;
+        ultrafast: "ultrafast";
+    }>>>, z.ZodTransform<NonNullable<"auto" | "default" | "flex" | "priority" | "scale" | "ultrafast"> | undefined, "auto" | "default" | "flex" | "priority" | "scale" | "ultrafast" | null | undefined>>;
     metadata: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>, z.ZodTransform<Record<string, unknown> | undefined, Record<string, unknown> | null | undefined>>;
     logprobs: z.ZodOptional<z.ZodUnknown>;
     top_logprobs: z.ZodOptional<z.ZodUnknown>;

package/dist/types/providers/openai-completions.d.ts

@@ -33,7 +33,7 @@ export interface OpenAICompletionsOptions extends StreamOptions {
     repetitionGuard?: RepetitionGuardOptions;
 }
 export declare const streamOpenAICompletions: StreamFunction<"openai-completions">;
-export declare function parseChunkUsage(rawUsage: object, model: Model<"openai-completions">, premiumRequests: number | undefined): AssistantMessage["usage"];
+export declare function parseChunkUsage(rawUsage: object, model: Model<"openai-completions">, premiumRequests: number | undefined, serviceTier?: ServiceTier): AssistantMessage["usage"];
 export declare function convertMessages(model: Model<"openai-completions">, context: Context, compat: ResolvedOpenAICompat): ChatCompletionMessageParam[];
 /**
  * Detect compatibility settings from provider and baseUrl for known providers.

package/dist/types/providers/openai-responses-shared.d.ts

@@ -43,6 +43,7 @@ export declare function appendResponsesToolResultMessages<TApi extends Api>(mess
 export interface ProcessResponsesStreamOptions {
     onFirstToken?: () => void;
     onOutputItemDone?: (item: ResponseOutputItem) => void;
+    serviceTier?: ServiceTier;
 }
 export declare function processResponsesStream<TApi extends Api>(openaiStream: AsyncIterable<OpenAI.Responses.ResponseStreamEvent>, output: AssistantMessage, stream: AssistantMessageEventStream, model: Model<TApi>, options?: ProcessResponsesStreamOptions): Promise<boolean>;
 /**
@@ -99,7 +100,7 @@ type CommonSamplingOptions = Pick<StreamOptions, "temperature" | "topP" | "topK"
  * Apply the common `StreamOptions` → Responses sampling-parameter mapping (max output tokens,
  * temperature, top-p/k, min-p, presence/repetition penalties, service tier). Mutates `params`.
  */
-export declare function applyCommonResponsesSamplingParams<P extends CommonResponsesParams>(params: P, options: CommonSamplingOptions | undefined, provider: string, supportsServiceTier?: boolean): void;
+export declare function applyCommonResponsesSamplingParams<P extends CommonResponsesParams>(params: P, options: CommonSamplingOptions | undefined, provider: string, supportsServiceTier?: boolean, modelSupportsUltrafastTier?: boolean): void;
 type ReasoningOptions = {
     reasoning?: string;
     reasoningSummary?: "auto" | "detailed" | "concise" | null;

package/dist/types/stream.d.ts

@@ -1,7 +1,19 @@
 import type { Effort } from "./model-thinking";
 import type { AnthropicOptions } from "./providers/anthropic";
-import type { Api, AssistantMessage, Context, Model, OptionsForApi, SimpleStreamOptions, ToolChoice } from "./types";
+import type { Api, AssistantMessage, Context, FetchImpl, Model, OptionsForApi, SimpleStreamOptions, ToolChoice } from "./types";
 import { AssistantMessageEventStream } from "./utils/event-stream";
+export type EnvApiKeyCredentialSource = {
+    kind: "environment";
+    name: string;
+} | {
+    kind: "google-adc";
+    source: "explicit-file" | "default-file" | "metadata-server";
+} | {
+    kind: "aws";
+    source: "bearer-token" | "environment-credentials" | "profile" | "instance-profile";
+} | {
+    kind: "unknown";
+};
 /**
  * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.
  *
@@ -9,6 +21,26 @@ import { AssistantMessageEventStream } from "./utils/event-stream";
  * loaded into $env for app/tool execution, but must not silently fund GJC model requests.
  */
 export declare function getEnvApiKey(provider: string): string | undefined;
+/**
+ * List configured environment variable names consulted for a provider's
+ * environment credential. Values are never returned. This intentionally uses
+ * the same credential-only environment reader as {@link getEnvApiKey}.
+ */
+export declare function getEnvApiKeyEnvNames(provider: string): string[];
+/** Describe the selected source without exposing credential values or unvalidated ADC files. */
+export declare function getEnvApiKeyCredentialSource(provider: string, options?: {
+    fetch?: FetchImpl;
+}): Promise<EnvApiKeyCredentialSource | undefined>;
+/** Enumerate usable credential candidates in provider dispatch precedence without exposing credentials. */
+export declare function getEnvApiKeyCredentialSources(provider: string, options?: {
+    fetch?: FetchImpl;
+}): Promise<EnvApiKeyCredentialSource[]>;
+/** Resolve Vertex ADC provenance, including metadata-server credentials, without acquiring a token. */
+export declare function getGoogleVertexCredentialSource(options?: {
+    fetch?: FetchImpl;
+}): Promise<EnvApiKeyCredentialSource | undefined>;
+/** Name of the environment variable whose value is selected by `getEnvApiKey`, when identifiable. */
+export declare function getEnvApiKeyEnvName(provider: string): Promise<string | undefined>;
 /**
  * Enumerate every provider that has an env-var fallback for `getEnvApiKey`.
  * Used by `gjc auth-broker migrate --include-env` to discover env-sourced keys

package/dist/types/types.d.ts

@@ -89,6 +89,8 @@ export interface ToolChoiceCompat {
     supportsToolChoice?: boolean;
     /** Legacy flag for forced tool_choice support. */
     supportsForcedToolChoice?: boolean;
+    /** Whether the provider supports OpenAI ultrafast service tier. Default: false. */
+    supportsUltrafastTier?: boolean;
 }
 export type CacheRetention = "none" | "short" | "long";
 /**
@@ -107,9 +109,11 @@ export type CacheRetention = "none" | "short" | "long";
  * - `"openai-only"` → `"priority"` on `openai` and `OpenAI code provider`; ignored elsewhere.
  * - `"Anthropic model-only"` → `"priority"` on direct `anthropic` (not Bedrock/Vertex Anthropic model).
  */
-export type ServiceTier = "auto" | "default" | "flex" | "scale" | "priority" | "openai-only" | "claude-only";
+export type ServiceTier = "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | "openai-only" | "claude-only";
 /** Resolved tier — one of the values that providers actually consume on the wire. */
 export type ResolvedServiceTier = Exclude<ServiceTier, "openai-only" | "claude-only">;
+/** Parse a provider-reported service tier, leaving unknown response values for request fallback. */
+export declare function parseResolvedServiceTier(value: unknown): ResolvedServiceTier | undefined;
 /**
  * Resolves a possibly scoped `ServiceTier` to the effective tier for the
  * given provider. Scoped values match their target family and otherwise
@@ -119,13 +123,19 @@ export declare function resolveServiceTier(serviceTier: ServiceTier | null | und
 /**
  * True when the (possibly scoped) tier should be sent as an OpenAI-compatible
  * `service_tier` request field. Custom providers must explicitly opt in through
- * `compat.supportsServiceTier`; unknown providers remain fail-closed.
+ * `compat.supportsServiceTier` for the existing tiers or a model-specific
+ * `supportsUltrafastTier` capability for ultrafast; unknown providers remain fail-closed.
+ *
+ * Note: ultrafast has an additional gating requirement via `modelSupportsUltrafastTier`
+ * to ensure it is only sent to models that explicitly support it.
  */
-export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined, supportsServiceTier?: boolean): boolean;
+export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined, supportsServiceTier?: boolean, supportsUltrafastTier?: boolean): boolean;
 /**
  * True when a priority tier is realized as a fast-mode request on the provider's
  * wire protocol. Custom OpenAI-compatible proxies opt in explicitly rather than
  * inheriting support merely because their API shape resembles OpenAI.
+ *
+ * Note: ultrafast is distinct from priority and is not considered fast-mode.
  */
 export declare function isFastModeEffectiveForProvider(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined, supportsServiceTier?: boolean): boolean;
 /**
@@ -611,6 +621,8 @@ export interface AssistantMessage {
     provider: Provider;
     model: string;
     responseId?: string;
+    /** Effective service tier reported by the provider, or the sent tier when the provider omits it. */
+    serviceTier?: ResolvedServiceTier;
     usage: Usage;
     stopReason: StopReason;
     errorMessage?: string;
@@ -905,6 +917,7 @@ export type AssistantMessageEvent = {
     contentIndex?: undefined;
     reason: Extract<StopReason, "aborted" | "error">;
     error: AssistantMessage;
+    partial?: AssistantMessage;
 } | {
     type: "toolChoiceIncapability";
     contentIndex?: undefined;
@@ -949,6 +962,12 @@ export interface OpenAICompat extends ToolChoiceCompat {
      * preserves or intentionally realizes OpenAI priority processing.
      */
     supportsServiceTier?: boolean;
+    /**
+     * Whether the model explicitly supports the ultrafast service tier.
+     * Only models that set this flag will send ultrafast tier to the API.
+     * Models: gpt-6-astra and gpt-6.1-sol.
+     */
+    supportsUltrafastTier?: boolean;
     /**
      * Tool names the provider reserves for its own built-ins and refuses to
      * accept as custom function declarations. A colliding tool is **dropped**
@@ -1170,6 +1189,8 @@ export interface Model<TApi extends Api = any> {
     requestTransform?: ModelRequestTransform;
     /** Default prompt-cache retention preference for this model when the request omits one. */
     cacheRetention?: CacheRetention;
+    /** Configured inter-event idle timeout for this model, in milliseconds. */
+    streamIdleTimeoutMs?: number;
     /** Provider-assigned priority value (lower = higher priority). */
     priority?: number;
     /** Canonical thinking capability metadata for this model. */
@@ -1194,3 +1215,5 @@ export interface Model<TApi extends Api = any> {
 }
 /** True when a model explicitly opts into OpenAI-compatible `service_tier` forwarding. */
 export declare function modelSupportsServiceTier(model: Pick<Model, "compat"> | undefined): boolean;
+/** True when a model explicitly opts into OpenAI ultrafast service tier support. */
+export declare function modelSupportsUltrafastTier(model: Pick<Model, "compat"> | undefined): boolean;

package/dist/types/usage.d.ts

@@ -230,6 +230,9 @@ export interface UsageCredential {
     email?: string;
     enterpriseUrl?: string;
     profileArn?: string;
+    /** Organization the OAuth token is scoped to; usage limits are per organization. */
+    organizationId?: string;
+    organizationName?: string;
     mcpBinding?: UsageMCPOAuthBinding;
     metadata?: Record<string, unknown>;
 }

package/dist/types/utils/discovery/antigravity.d.ts

@@ -1,4 +1,10 @@
+import { logger } from "@gajae-code/utils";
 import type { Model } from "../../types";
+/**
+ * Returns the default Antigravity discovery User-Agent.
+ * Can be overridden via PI_AI_ANTIGRAVITY_USER_AGENT environment variable.
+ */
+export declare function getDefaultAntigravityUserAgent(): string;
 /**
  * Raw model metadata returned by Antigravity's `fetchAvailableModels` endpoint.
  */
@@ -15,6 +21,12 @@ export interface AntigravityDiscoveryApiModel {
     modelProvider?: string;
     isInternal?: boolean;
     supportsVideo?: boolean;
+    /** Account-specific entitlement status */
+    entitlement?: string;
+    /** Whether the model is disabled for this account */
+    disabled?: boolean;
+    /** Per-account quota/tier information */
+    quota?: string;
 }
 /**
  * Grouping metadata used by Antigravity to surface recommended model ids.
@@ -43,7 +55,7 @@ export interface FetchAntigravityDiscoveryModelsOptions {
     token: string;
     /** Optional endpoint override. Defaults to Antigravity fallback endpoints. */
     endpoint?: string;
-    /** Deprecated and ignored for antigravity discovery parity. */
+    /** Optional Google Cloud project ID for tier-gated model discovery. */
     project?: string;
     /** Optional user agent override. */
     userAgent?: string;
@@ -57,6 +69,8 @@ export interface FetchAntigravityDiscoveryModelsOptions {
      * Default: `google-antigravity`.
      */
     targetProvider?: "google-antigravity" | "google-gemini-cli";
+    /** Optional logger for debug diagnostics. */
+    logger?: Pick<typeof logger, "debug">;
 }
 /**
  * Fetches discoverable Antigravity models and normalizes them into canonical model entries.
@@ -65,3 +79,4 @@ export interface FetchAntigravityDiscoveryModelsOptions {
  * Returns `[]` only when the endpoint responds successfully with no usable models.
  */
 export declare function fetchAntigravityDiscoveryModels(options: FetchAntigravityDiscoveryModelsOptions): Promise<Model<"google-gemini-cli">[] | null>;
+export declare function getAntigravityDiscoveryUserAgent(): string;

package/dist/types/utils/idle-iterator.d.ts

@@ -23,11 +23,12 @@ export declare function getStreamIdleTimeoutRemediationMs(): number;
  * Returns the idle timeout used for OpenAI-family streaming transports.
  *
  * Honors `GJC_OPENAI_STREAM_IDLE_TIMEOUT_MS` first (`PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is the legacy alias). Set `=0` to disable.
+ * A configured model timeout takes precedence over the built-in provider/model floors; environment overrides win over it.
  * When `provider` is given, long-reasoning hosts (xAI Grok and Grok Build) use that floor instead of the 120s default.
  * Grok models reached through other OpenAI-compatible hosts (`openrouter/x-ai/grok-*`, kilo, litellm, …) get the
  * same floor keyed on the model id, because long-reasoning silence is a property of the model (#4797).
  */
-export declare function getOpenAIStreamIdleTimeoutMs(provider?: string, modelId?: string): number | undefined;
+export declare function getOpenAIStreamIdleTimeoutMs(provider?: string, modelId?: string, configuredTimeoutMs?: number): number | undefined;
 /**
  * Returns the timeout used while waiting for the first stream event.
  * The first token can legitimately take longer than later inter-event gaps,
@@ -57,7 +58,7 @@ export declare function getStreamFirstEventTimeoutMs(idleTimeoutMs?: number, fal
  *   window so a short post-connect first-event budget cannot kill legitimate
  *   slow setup.
  */
-export declare function resolveOpenAISdkRequestTimeoutMs(provider: string, streamFirstEventTimeoutOverride?: number, modelId?: string): number | undefined;
+export declare function resolveOpenAISdkRequestTimeoutMs(provider: string, streamFirstEventTimeoutOverride?: number, modelId?: string, configuredIdleTimeoutMs?: number, effectiveIdleTimeoutOverride?: number): number | undefined;
 /**
  * Resolves the Anthropic SDK client `timeout` so stalled-before-headers requests
  * are bounded. The Anthropic first-event watchdog deliberately arms only once

package/dist/types/utils/oauth/glm-zcode.d.ts

@@ -1,33 +1,3 @@
-/**
- * GLM ZCode OAuth flow (UNOFFICIAL, opt-in).
- *
- * Replicates how the ZCode desktop app turns a Z.AI login into usable GLM model
- * access. This is NOT an official Z.AI OAuth client: it reuses ZCode's authorize
- * page, broker, and a custom-protocol redirect. It may break at any time and may
- * violate ZCode/Z.AI Terms of Service. Endpoints/client id are overridable via
- * `ZCODE_OAUTH_*` environment variables.
- *
- * Verified end-to-end against the ZCode host bundle (`resolveZaiApiKey` /
- * `resolveBizApiKey`) and live traffic:
- *   1. Authorize: GET {authorize}?redirect_uri=zcode://oauth/callback&response_type=code&client_id=...&state=...
- *      (custom-protocol redirect → a CLI cannot catch it, so the user pastes the code/redirect URL)
- *   2. Broker:    POST {broker} { provider:"zai", code, redirect_uri, state }
- *                  → { data: { token: <ZCode JWT>, zai: { access_token: <upstream Z.AI token> } } }
- *   3. Business:  POST {z/login} { token: <upstream Z.AI token> } → { data: { access_token: <business token> } }
- *   4. Provision: with the business token, GET getCustomerInfo → default org/project,
- *      GET/POST .../api_keys (find/create a key named "zcode-api-key"),
- *      GET .../api_keys/copy/{id} → secretKey ⇒ a real Z.AI API key "{id}.{secret}".
- *
- * Credential mapping:
- *   - `access`  = the provisioned **Z.AI API key** ("{id}.{secret}"). Model requests go to
- *                 `https://api.z.ai/api/anthropic/v1/messages` with `Authorization: Bearer <key>`
- *                 (exactly like a dashboard key) — NO zcode.z.ai gateway, NO captcha.
- *   - `refresh` = the upstream Z.AI OAuth access token (used to re-provision the key).
- * The API key is long-lived, so `expires` is set far in the future.
- *
- * This provider must NEVER force `isOAuth=true`: the key is a plain Z.AI API key, and
- * api.z.ai is not api.anthropic.com, so the Anthropic path already emits a plain bearer.
- */
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
 export declare const GLM_ZCODE_REFRESH_SKEW_MS: number;

package/dist/types/utils/oauth/types.d.ts

@@ -7,6 +7,15 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
     profileArn?: string;
+    /**
+     * Organization the token is scoped to. One Anthropic account can belong to
+     * several organizations (e.g. a Team workspace and a personal Max plan); each
+     * login is bound to exactly one of them, so the organization is part of the
+     * credential's identity.
+     */
+    organizationId?: string;
+    /** Display name of {@link organizationId}. */
+    organizationName?: string;
 };
 export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "commandcode-goat" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.18.11",
+	"version": "0.19.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -30,7 +30,7 @@
 	},
 	"scripts": {
 		"check": "biome check . && bun run check:types",
-		"check:types": "tsc -p tsconfig.json --noEmit",
+		"check:types": "bun ../coding-agent/scripts/generate-docs-index.ts && tsc -p tsconfig.json --noEmit",
 		"lint": "biome lint .",
 		"test": "bun test",
 		"fix": "biome check --write --unsafe .",
@@ -41,8 +41,8 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.18.11",
-		"@gajae-code/utils": "0.18.11",
+		"@gajae-code/natives": "0.19.0",
+		"@gajae-code/utils": "0.19.0",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/remote-store.ts

@@ -23,6 +23,7 @@ import {
 	type CachedUsagePresentation,
 	type CredentialDispatchTicket,
 	type CredentialInventoryRecord,
+	formatOAuthIdentityLabel,
 	type MCPOAuthRefreshClient,
 	type OAuthCredential,
 	REMOTE_REFRESH_SENTINEL,
@@ -1106,6 +1107,8 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			email: current.email,
 			projectId: current.projectId,
 			enterpriseUrl: current.enterpriseUrl,
+			organizationId: current.organizationId,
+			organizationName: current.organizationName,
 		});
 		const observed = this.#snapshot.credentials.find(candidate => candidate.id === credentialId);
 		if (
@@ -1315,7 +1318,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			return null;
 		}
 		if (!reports) return null;
-		return matchUsageReport(reports, provider, credential);
+		return matchUsageReport(reports, provider, credential, this.#usageMatchContext(provider));
 	}
 
 	/**
@@ -1346,6 +1349,18 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		});
 	}
 
+	#usageMatchContext(provider: string): UsageMatchContext {
+		let credentialCount = 0;
+		const claimedOrganizationIds = new Set<string>();
+		for (const entry of this.#snapshot.credentials) {
+			if (entry.provider !== provider || entry.credential.type !== "oauth") continue;
+			credentialCount += 1;
+			const organizationId = normalizeOrganizationId(entry.credential.organizationId);
+			if (organizationId) claimedOrganizationIds.add(organizationId);
+		}
+		return { credentialCount, claimedOrganizationIds };
+	}
+
 	#identityDigestForEntry(entry: SnapshotEntry): string {
 		const credential = entry.credential;
 		const identity =
@@ -1356,6 +1371,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 						projectId: credential.projectId ?? null,
 						enterpriseUrl: credential.enterpriseUrl ?? null,
 						mcpBinding: credential.mcpBinding ?? null,
+						...(credential.organizationId ? { organizationId: credential.organizationId } : {}),
 					}
 				: { type: credential.type };
 		return createHash("sha256")
@@ -1382,7 +1398,12 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		if (this.#usageCacheEpoch !== epoch) return;
 		for (const entry of this.#snapshot.credentials) {
 			if (entry.credential.type !== "oauth") continue;
-			const report = matchUsageReport(reports, entry.provider, entry.credential);
+			const report = matchUsageReport(
+				reports,
+				entry.provider,
+				entry.credential,
+				this.#usageMatchContext(entry.provider),
+			);
 			if (!report) continue;
 			const fetchedAt = Number.isFinite(report.fetchedAt) ? report.fetchedAt : Date.now();
 			this.recordUsagePresentation({
@@ -1485,7 +1506,7 @@ function isErrorStatus(error: unknown, status: number): boolean {
 
 function snapshotIdentityLabel(entry: SnapshotEntry): string | null {
 	if (entry.credential.type !== "oauth") return null;
-	return entry.credential.email ?? entry.credential.accountId ?? entry.credential.projectId ?? null;
+	return formatOAuthIdentityLabel(entry.credential);
 }
 
 function safePresentationUsageReport(report: UsageReport): SafeUsageReport {
@@ -1531,20 +1552,45 @@ function cloneUsagePresentation(observation: CachedUsagePresentation): CachedUsa
 	};
 }
 
+/** Facts about the provider's stored credentials that a usage report match must respect. */
+interface UsageMatchContext {
+	/** Stored OAuth credentials for the provider; a report without identity can only belong to a sole credential. */
+	credentialCount: number;
+	/** Organizations the provider's stored credentials are scoped to. */
+	claimedOrganizationIds: ReadonlySet<string>;
+}
+
 /**
  * Match a broker-supplied usage report to a specific OAuth credential. The
  * broker returns aggregate reports across all credentials it manages, so we
- * pick the one whose identity (accountId / email / projectId) lines up with
- * the credential the caller is asking about.
+ * pick the one whose identity (accountId / email / projectId) and organization
+ * line up with the credential the caller is asking about. Missing or ambiguous
+ * usage data is safer than assigning another credential's limits.
  *
- * Falls back to the lone candidate when only one matches the provider; falls
- * through to `null` when nothing matches, which `AuthStorage` treats as "no
- * usage data" (ranking proceeds without a usage signal for this credential).
+ * Ownership must be shown by the report itself. A lone returned report is not
+ * evidence: when one credential's usage fetch fails, the broker returns only
+ * the others' reports. So a report is taken without an identity match only
+ * when the provider has a single stored credential. A credential stored
+ * without an organization never takes a report whose organization another
+ * stored credential claims.
  */
-function matchUsageReport(reports: UsageReport[], provider: Provider, credential: OAuthCredential): UsageReport | null {
-	const candidates = reports.filter(report => report.provider === provider);
+function matchUsageReport(
+	reports: UsageReport[],
+	provider: Provider,
+	credential: OAuthCredential,
+	context: UsageMatchContext,
+): UsageReport | null {
+	const organizationId = normalizeOrganizationId(credential.organizationId);
+	const candidates = reports.filter(report => {
+		if (report.provider !== provider) return false;
+		const reportOrganizationId = normalizeOrganizationId(
+			readMetadataString((report.metadata ?? {}) as Record<string, unknown>, "orgId"),
+		);
+		if (organizationId) return reportOrganizationId === organizationId;
+		return reportOrganizationId === undefined || !context.claimedOrganizationIds.has(reportOrganizationId);
+	});
 	if (candidates.length === 0) return null;
-	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 1 && context.credentialCount === 1) return candidates[0];
 	const accountId = credential.accountId?.trim().toLowerCase();
 	const email = credential.email?.trim().toLowerCase();
 	const projectId = credential.projectId?.trim().toLowerCase();
@@ -1554,6 +1600,11 @@ function matchUsageReport(reports: UsageReport[], provider: Provider, credential
 	return null;
 }
 
+function normalizeOrganizationId(organizationId: string | undefined): string | undefined {
+	const normalized = organizationId?.trim().toLowerCase();
+	return normalized ? normalized : undefined;
+}
+
 function reportMatchesIdentity(
 	report: UsageReport,
 	accountId: string | undefined,

package/src/auth-broker/wire-schemas.ts

@@ -45,6 +45,8 @@ export const oauthCredentialSchema = z
 		projectId: z.string().optional(),
 		email: z.string().optional(),
 		accountId: z.string().optional(),
+		organizationId: z.string().optional(),
+		organizationName: z.string().optional(),
 		mcpBinding: mcpOAuthBindingSchema.optional(),
 	})
 	.strict();

package/src/auth-gateway/server.ts

@@ -589,8 +589,9 @@ export function redactGatewayStream(events: AssistantMessageEventStream): Assist
 	async function* redactedEvents(): AsyncGenerator<AssistantMessageEvent> {
 		try {
 			for await (const event of events) {
-				if (event.type === "error") yield { ...event, error: redactGatewayMessage(event.error) };
-				else yield event;
+				if (event.type === "error") {
+					yield { type: "error", reason: event.reason, error: redactGatewayMessage(event.error) };
+				} else yield event;
 			}
 		} catch (error) {
 			throw redactGatewayError(error);