@kenkaiiii/gg-ai 5.76.0 → 5.77.0

package/dist/index.js

@@ -38,7 +38,7 @@ var ProviderError = class extends GGAIError {
   resetsAt;
   constructor(provider, message, options) {
     super(message, {
-      source: "provider",
+      source: options?.source ?? "provider",
       requestId: options?.requestId,
       hint: options?.hint,
       cause: options?.cause
@@ -435,6 +435,46 @@ var StreamResult = class _StreamResult {
   }
 };
 
+// src/utils/provider-options.ts
+var RESERVED_BODY_FIELDS = /* @__PURE__ */ new Set([
+  "contents",
+  "dimensions",
+  "documents",
+  "encoding_format",
+  "input",
+  "messages",
+  "model",
+  "query",
+  "requests",
+  "stream",
+  "system",
+  "tools",
+  "top_n",
+  // Never copy prototype-shaped keys onto a request body.
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function mergeProviderOptions(body, providerOptions) {
+  if (!providerOptions) return body;
+  const base = body;
+  const extra = {};
+  for (const key of Object.keys(providerOptions).sort()) {
+    if (RESERVED_BODY_FIELDS.has(key)) continue;
+    if (Object.hasOwn(base, key) && base[key] !== void 0) continue;
+    const value = providerOptions[key];
+    if (value === void 0) continue;
+    Object.defineProperty(extra, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  if (Object.keys(extra).length === 0) return body;
+  return { ...base, ...extra };
+}
+
 // src/utils/zod-to-json-schema.ts
 import { z } from "zod";
 var schemaCache = /* @__PURE__ */ new WeakMap();
@@ -1677,7 +1717,7 @@ async function* runStream(options) {
     }
     maxTokens = 1;
   }
-  const params = {
+  const baseParams = {
     model: options.model,
     max_tokens: maxTokens,
     messages,
@@ -1720,6 +1760,7 @@ async function* runStream(options) {
     ...useServerFallback ? { fallbacks: "default" } : {},
     stream: useStreaming
   };
+  const params = mergeProviderOptions(baseParams, options.providerOptions);
   const hasAdaptiveThinking = isAdaptiveThinkingModel(options.model);
   const betaHeaders = [
     ...isOAuth ? ["claude-code-20250219", "oauth-2025-04-20"] : [],
@@ -2425,20 +2466,21 @@ async function* runStream2(options) {
       params.thinking = { type: "disabled" };
     }
   }
+  const requestParams = mergeProviderOptions(params, options.providerOptions);
   if (getEnvironment()?.GGAI_DUMP_REQUEST) {
     const fs = await import("fs");
     const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const dumpPath = `/tmp/ggai-request-${ts}.json`;
-    fs.writeFileSync(dumpPath, JSON.stringify(params, null, 2));
+    fs.writeFileSync(dumpPath, JSON.stringify(requestParams, null, 2));
     fs.appendFileSync(
       "/tmp/ggai-requests.log",
-      `[${ts}] ${dumpPath} messages=${params.messages.length}
+      `[${ts}] ${dumpPath} messages=${requestParams.messages.length}
 `
     );
   }
   if (!useStreaming) {
     try {
-      const completion = await client.chat.completions.create(params, {
+      const completion = await client.chat.completions.create(requestParams, {
         signal: options.signal ?? void 0
       });
       yield* synthesizeEventsFromCompletion(completion, !!options.thinking, endpointKey);
@@ -2449,7 +2491,7 @@ async function* runStream2(options) {
   }
   let stream2;
   try {
-    stream2 = await client.chat.completions.create(params, {
+    stream2 = await client.chat.completions.create(requestParams, {
       signal: options.signal ?? void 0
     });
   } catch (err) {
@@ -2937,7 +2979,9 @@ async function* runStream3(options, retriedWithoutReasoning = false) {
     headers["session_id"] = transportSessionId;
     headers["x-client-request-id"] = transportSessionId;
   }
-  const encodedRequest = await encodeCodexRequest(body);
+  const encodedRequest = await encodeCodexRequest(
+    mergeProviderOptions(body, options.providerOptions)
+  );
   if (encodedRequest.compressed) headers["Content-Encoding"] = "zstd";
   providerDiag("codex_request_body", {
     rawBytes: encodedRequest.rawBytes,
@@ -3652,11 +3696,11 @@ function stripUnsupportedSchemaFields(value) {
     ["exclusiveMinimum", "minimum", 1],
     ["exclusiveMaximum", "maximum", -1]
   ]) {
-    const bound = value[key];
-    if (bound === void 0) continue;
+    const bound2 = value[key];
+    if (bound2 === void 0) continue;
     delete value[key];
-    if (typeof bound === "number" && value[target] === void 0) {
-      value[target] = value.type === "integer" ? bound + step : bound;
+    if (typeof bound2 === "number" && value[target] === void 0) {
+      value[target] = value.type === "integer" ? bound2 + step : bound2;
     }
   }
   for (const item of Object.values(value)) {
@@ -3750,7 +3794,7 @@ function buildRequestPlan(options, method) {
     throw new ProviderError("gemini", formatUnsupportedModelMessage(options.model));
   }
   const projectId = getGoogleProject(options);
-  const request = buildGenerateRequest(options);
+  const request = mergeProviderOptions(buildGenerateRequest(options), options.providerOptions);
   return {
     url: getCodeAssistEndpoint(method),
     headers: {
@@ -3988,6 +4032,449 @@ function toError3(err) {
   return new ProviderError("gemini", String(err));
 }
 
+// src/redaction.ts
+var REDACTED = "[REDACTED]";
+var TRUNCATED = "[TRUNCATED]";
+var CIRCULAR = "[CIRCULAR]";
+var SENSITIVE_NAME = /(?:^|[_-])(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|key|auth(?:orization)?|bearer|cookie|credential|private[_-]?key|password|passwd|secret)(?:$|[_-])/i;
+var ENV_SECRET_ASSIGNMENT = /\b((?:[A-Z0-9]+_)*(?:API_?KEY|ACCESS_TOKEN|REFRESH_TOKEN|TOKEN|KEY|AUTH|AUTHORIZATION|BEARER|CREDENTIALS?|PASSWORD|PASSWD|SECRET))\b(\s*[=:]\s*)(["']?)(?!\$|process\.env|os\.environ|import\.meta|env\.)(?=[^\s,"';}]*\d)([^\s,"';}=$][^\s,"';}]{7,})\3/g;
+var COMPACT_SECRET_ASSIGNMENT = /\b((?:[a-z0-9]+[_-])*(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|auth|authorization|credentials?|password|passwd|secret)|(?:[a-z0-9]+[_-])+key)=(["']?)(?!\$)([^\s,"'&;}=][^\s,"'&;}]{7,})\2/gi;
+var URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/?#@:"'`<>]*:[^\s/?#"'`<>]+@/gi;
+var URL_USERINFO_TO_FIRST_AT = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]*:[^\s/@]+@/gi;
+function escaped(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizedSecrets(secrets) {
+  if (!secrets) return [];
+  return [...new Set([...secrets].filter((value) => value.length >= 8 && value !== REDACTED))].sort(
+    (a, b) => b.length - a.length
+  );
+}
+function environmentSecrets(env) {
+  const values = /* @__PURE__ */ new Set();
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || value.length < 8 || value === REDACTED || !SENSITIVE_NAME.test(name)) continue;
+    values.add(value);
+  }
+  return [...values].sort((a, b) => b.length - a.length);
+}
+function redactText(text, options = {}) {
+  let result = text;
+  result = result.replace(
+    /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g,
+    REDACTED
+  );
+  result = result.replace(URL_USERINFO, `$1${REDACTED}@`);
+  result = result.replace(URL_USERINFO_TO_FIRST_AT, `$1${REDACTED}@`);
+  result = result.replace(
+    /\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[^\s,;]+/gi,
+    `$1${REDACTED}`
+  );
+  result = result.replace(
+    /\b(bearer|basic)\s+(?![A-Za-z][a-z]{0,14}\b)[A-Za-z0-9+/_.=-]{8,}/gi,
+    `$1 ${REDACTED}`
+  );
+  result = result.replace(/\b(cookie|set-cookie)(\s*:\s*)[^\s=;:]+=[^\r\n]*/gi, `$1$2${REDACTED}`);
+  result = result.replace(
+    /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,
+    REDACTED
+  );
+  result = result.replace(
+    /\b(?:sk-(?:ant-|proj-)?|xox[baprs]-|gh[pousr]_|github_pat_|AIza)[A-Za-z0-9_-]{12,}\b/g,
+    REDACTED
+  );
+  result = result.replace(
+    ENV_SECRET_ASSIGNMENT,
+    (_match, name, separator, quote) => `${name}${separator}${quote}${REDACTED}${quote}`
+  );
+  result = result.replace(
+    COMPACT_SECRET_ASSIGNMENT,
+    (_match, name, quote) => `${name}=${quote}${REDACTED}${quote}`
+  );
+  for (const secret of normalizedSecrets(options.secrets)) {
+    result = result.replace(new RegExp(escaped(secret), "g"), REDACTED);
+  }
+  const maxStringLength = options.maxStringLength ?? 1e6;
+  if (result.length > maxStringLength) {
+    result = `${result.slice(0, maxStringLength)}${TRUNCATED}`;
+  }
+  return result;
+}
+function isBinary(value) {
+  return value instanceof ArrayBuffer || ArrayBuffer.isView(value) || typeof Blob !== "undefined" && value instanceof Blob;
+}
+function isMediaObject(value) {
+  return (value.type === "image" || value.type === "video") && (typeof value.data === "string" || typeof value.url === "string");
+}
+function redactValue(value, options = {}) {
+  const maxDepth = options.maxDepth ?? 20;
+  const maxEntries = options.maxEntries ?? 1e4;
+  const ancestors = /* @__PURE__ */ new WeakSet();
+  let entries = 0;
+  const visit = (current, depth, sensitive = false) => {
+    if (typeof current === "string") {
+      if (sensitive && current.length > 0 && current !== REDACTED) return REDACTED;
+      return redactText(current, options);
+    }
+    if (current === null || current === void 0 || typeof current === "number" || typeof current === "boolean" || typeof current === "bigint") {
+      return current;
+    }
+    if (typeof current !== "object") return current;
+    if (isBinary(current)) return current;
+    if (current instanceof Date) return new Date(current.getTime());
+    if (depth >= maxDepth) return TRUNCATED;
+    if (ancestors.has(current)) return CIRCULAR;
+    ancestors.add(current);
+    try {
+      return cloneObject(current, depth);
+    } finally {
+      ancestors.delete(current);
+    }
+  };
+  const cloneObject = (current, depth) => {
+    if (current instanceof Error) {
+      const error = {
+        name: current.name,
+        message: visit(current.message, depth + 1),
+        stack: visit(current.stack, depth + 1)
+      };
+      for (const [key, child] of Object.entries(current)) {
+        error[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
+      }
+      return error;
+    }
+    if (Array.isArray(current)) {
+      const clone2 = [];
+      for (const child of current) {
+        if (++entries > maxEntries) {
+          clone2.push(TRUNCATED);
+          break;
+        }
+        clone2.push(visit(child, depth + 1));
+      }
+      return clone2;
+    }
+    const record = current;
+    if (isMediaObject(record)) return { ...record };
+    const clone = {};
+    for (const [key, child] of Object.entries(record)) {
+      if (++entries > maxEntries) {
+        clone[TRUNCATED] = true;
+        break;
+      }
+      clone[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
+    }
+    return clone;
+  };
+  return visit(value, 0);
+}
+
+// src/utils/json-post.ts
+var MAX_ERROR_MESSAGE_CHARS = 240;
+function abortError() {
+  return new DOMException("Aborted", "AbortError");
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError();
+}
+async function postJson(request) {
+  const { provider, signal } = request;
+  const secrets = request.secrets?.filter((s) => typeof s === "string" && s !== "");
+  const clean = (text2) => bound(redactText(text2, { secrets }));
+  const fetchImpl = request.fetch ?? globalThis.fetch;
+  throwIfAborted(signal);
+  let response;
+  try {
+    response = await fetchImpl(request.url, {
+      method: "POST",
+      headers: request.headers,
+      body: JSON.stringify(request.body),
+      signal
+    });
+  } catch (err) {
+    if (signal?.aborted || isAbortError2(err)) throw abortError();
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new GGAIError(`Couldn't reach ${provider}: ${clean(detail)}`, {
+      source: "network",
+      cause: err
+    });
+  }
+  const headerRequestId = readHeader(
+    response.headers,
+    "x-request-id",
+    "request-id",
+    "openai-request-id"
+  );
+  let text;
+  try {
+    text = await response.text();
+  } catch (err) {
+    if (signal?.aborted || isAbortError2(err)) throw abortError();
+    throw new GGAIError(`Lost the connection to ${provider} while reading its response.`, {
+      source: "network",
+      cause: err
+    });
+  }
+  if (!response.ok) {
+    throw httpError(provider, response, text, headerRequestId, clean);
+  }
+  try {
+    return {
+      json: JSON.parse(text),
+      ...headerRequestId ? { requestId: headerRequestId } : {}
+    };
+  } catch {
+    throw new ProviderError(provider, `${provider} returned a response that isn't valid JSON.`, {
+      statusCode: response.status,
+      ...headerRequestId ? { requestId: headerRequestId } : {}
+    });
+  }
+}
+function httpError(provider, response, text, headerRequestId, clean) {
+  const status = response.status;
+  const parsed = parseErrorBody(text);
+  const rawMessage = parsed.message ?? (parsed.isJson ? "" : text.trim());
+  const message = !rawMessage ? emptyProviderErrorMessage(status) : isRawHtmlErrorEcho(rawMessage) ? providerHtmlErrorMessage(status) : clean(rawMessage);
+  const requestId = headerRequestId ?? parsed.requestId;
+  const base = {
+    statusCode: status,
+    ...requestId ? { requestId } : {}
+  };
+  if (status === 401 || status === 403) {
+    return new ProviderError(provider, message, { ...base, source: "auth" });
+  }
+  const codeType = `${parsed.code ?? ""} ${parsed.type ?? ""}`.toLowerCase();
+  if (status === 402 || codeType.includes("insufficient_quota") || isHardBillingMessage(message)) {
+    const stamped = /usage limit reached/i.test(message) ? message : `usage limit reached: ${message}`;
+    return new ProviderError(provider, stamped, base);
+  }
+  if (status === 429) {
+    const retryAfter = Number(readHeader(response.headers, "retry-after"));
+    const resetsAt = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.floor(Date.now() / 1e3) + Math.ceil(retryAfter) : void 0;
+    return new ProviderError(provider, message, {
+      ...base,
+      ...resetsAt !== void 0 ? { resetsAt } : {}
+    });
+  }
+  return new ProviderError(provider, message, base);
+}
+function parseErrorBody(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { isJson: false };
+  }
+  if (!isRecord(parsed)) return { isJson: true };
+  const error = parsed.error;
+  const errorObj = isRecord(error) ? error : void 0;
+  const message = stringField(errorObj, "message") ?? (typeof error === "string" && error.trim() ? error.trim() : void 0) ?? stringField(parsed, "message") ?? stringField(parsed, "detail");
+  const requestId = stringField(parsed, "request_id") ?? stringField(errorObj, "request_id");
+  const code = stringField(errorObj, "code") ?? stringField(errorObj, "status");
+  const type = stringField(errorObj, "type");
+  return {
+    isJson: true,
+    ...message ? { message } : {},
+    ...requestId ? { requestId } : {},
+    ...code ? { code } : {},
+    ...type ? { type } : {}
+  };
+}
+function stringField(record, key) {
+  const value = record?.[key];
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAbortError2(err) {
+  return (err instanceof Error || err instanceof DOMException) && err.name === "AbortError";
+}
+function bound(text) {
+  const trimmed = text.trim();
+  return trimmed.length > MAX_ERROR_MESSAGE_CHARS ? `${trimmed.slice(0, MAX_ERROR_MESSAGE_CHARS)}\u2026` : trimmed;
+}
+function joinUrl(baseUrl, path) {
+  return `${baseUrl.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+
+// src/providers/gemini-embeddings.ts
+var GEMINI_API_BASE_URL = "https://generativelanguage.googleapis.com/v1beta";
+var GEMINI_EMBED_BATCH_SIZE = 100;
+var TASK_TYPES = {
+  query: "RETRIEVAL_QUERY",
+  document: "RETRIEVAL_DOCUMENT"
+};
+function supportsTaskType(model) {
+  return !/^gemini-embedding-2(?:$|[-.@])/.test(model);
+}
+async function embedGemini(request) {
+  if (!request.apiKey) {
+    throw new GGAIError("Gemini embeddings need a Gemini API key (apiKey).", {
+      source: "auth",
+      hint: "Create a key in Google AI Studio. Gemini Code Assist sign-in can't be used for embeddings."
+    });
+  }
+  const model = request.model.replace(/^models\//, "");
+  const resource = `models/${model}`;
+  const taskType = request.inputType && supportsTaskType(model) ? TASK_TYPES[request.inputType] : void 0;
+  const embedContentConfig = {
+    ...taskType ? { taskType } : {},
+    ...request.dimensions !== void 0 ? { outputDimensionality: request.dimensions } : {}
+  };
+  const body = mergeProviderOptions(
+    {
+      requests: request.input.map((text) => ({
+        model: resource,
+        content: { parts: [{ text }] },
+        ...Object.keys(embedContentConfig).length > 0 ? { embedContentConfig } : {}
+      }))
+    },
+    request.providerOptions
+  );
+  const { json, requestId } = await postJson({
+    provider: "gemini",
+    url: joinUrl(request.baseUrl ?? GEMINI_API_BASE_URL, `${resource}:batchEmbedContents`),
+    headers: { "Content-Type": "application/json", "x-goog-api-key": request.apiKey },
+    body,
+    fetch: request.fetch,
+    signal: request.signal,
+    secrets: [request.apiKey]
+  });
+  const invalid = (detail) => new ProviderError("gemini", `Invalid embeddings response: ${detail}.`, {
+    ...requestId ? { requestId } : {}
+  });
+  if (!isRecord(json) || !Array.isArray(json.embeddings)) {
+    throw invalid("missing `embeddings` array");
+  }
+  const embeddings = json.embeddings.map((entry) => {
+    if (!isRecord(entry) || !Array.isArray(entry.values)) {
+      throw invalid("an entry has no `values` array");
+    }
+    return entry.values;
+  });
+  const usage = json.usageMetadata;
+  const promptTokens = isRecord(usage) ? usage.promptTokenCount : void 0;
+  return {
+    embeddings,
+    model,
+    ...typeof promptTokens === "number" && Number.isFinite(promptTokens) ? { usage: { inputTokens: promptTokens } } : {}
+  };
+}
+
+// src/providers/openai-compat-retrieval.ts
+function jsonHeaders(apiKey) {
+  return {
+    "Content-Type": "application/json",
+    ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+  };
+}
+async function embedOpenAICompatible(request, config) {
+  const body = mergeProviderOptions(
+    {
+      model: config.wireModel ?? request.model,
+      input: request.input,
+      // gg-ai parses float arrays only; never let a server default to base64.
+      encoding_format: "float",
+      ...request.dimensions !== void 0 ? { dimensions: request.dimensions } : {},
+      ...request.inputType && config.inputTypeFields ? config.inputTypeFields(request.inputType) : {}
+    },
+    request.providerOptions
+  );
+  const { json, requestId } = await postJson({
+    provider: config.provider,
+    url: joinUrl(config.baseUrl, "embeddings"),
+    headers: jsonHeaders(request.apiKey),
+    body,
+    fetch: request.fetch,
+    signal: request.signal,
+    secrets: [request.apiKey]
+  });
+  const invalid = (detail) => new ProviderError(config.provider, `Invalid embeddings response: ${detail}.`, {
+    ...requestId ? { requestId } : {}
+  });
+  if (!isRecord(json) || !Array.isArray(json.data)) throw invalid("missing `data` array");
+  const items = json.data.map((item) => {
+    if (!isRecord(item)) throw invalid("an entry in `data` is not an object");
+    const index = item.index;
+    if (index !== void 0 && !(typeof index === "number" && Number.isInteger(index))) {
+      throw invalid("an entry has a non-integer `index`");
+    }
+    if (!Array.isArray(item.embedding)) {
+      throw invalid("an entry's `embedding` is not an array of numbers");
+    }
+    return { index, embedding: item.embedding };
+  });
+  const withIndex = items.filter((item) => item.index !== void 0).length;
+  let embeddings;
+  if (withIndex === 0) {
+    embeddings = items.map((item) => item.embedding);
+  } else if (withIndex !== items.length) {
+    throw invalid("some entries have an `index` and some don't");
+  } else {
+    const slots = new Array(items.length);
+    for (const item of items) {
+      const index = item.index;
+      if (index < 0 || index >= items.length || slots[index] !== void 0) {
+        throw invalid(`unexpected or duplicate index ${index}`);
+      }
+      slots[index] = item.embedding;
+    }
+    embeddings = slots;
+  }
+  const usage = json.usage;
+  const promptTokens = isRecord(usage) ? usage.prompt_tokens : void 0;
+  return {
+    embeddings,
+    ...typeof json.model === "string" && json.model ? { model: json.model } : {},
+    ...typeof promptTokens === "number" && Number.isFinite(promptTokens) ? { usage: { inputTokens: promptTokens } } : {}
+  };
+}
+async function rerankCohereCompatible(request, config) {
+  const body = mergeProviderOptions(
+    {
+      model: config.wireModel ?? request.model,
+      query: request.query,
+      documents: request.documents,
+      ...request.topN !== void 0 ? { top_n: request.topN } : {}
+    },
+    request.providerOptions
+  );
+  const { json, requestId } = await postJson({
+    provider: config.provider,
+    url: joinUrl(config.baseUrl, "rerank"),
+    headers: jsonHeaders(request.apiKey),
+    body,
+    fetch: request.fetch,
+    signal: request.signal,
+    secrets: [request.apiKey]
+  });
+  const invalid = (detail) => new ProviderError(config.provider, `Invalid rerank response: ${detail}.`, {
+    ...requestId ? { requestId } : {}
+  });
+  if (!isRecord(json) || !Array.isArray(json.results)) throw invalid("missing `results` array");
+  const results = json.results.map((item) => {
+    if (!isRecord(item)) throw invalid("an entry in `results` is not an object");
+    const { index, relevance_score: score } = item;
+    if (typeof index !== "number" || typeof score !== "number") {
+      throw invalid("an entry is missing a numeric `index` or `relevance_score`");
+    }
+    return { index, score };
+  });
+  const usage = json.usage;
+  const tokens = isRecord(usage) ? usage.prompt_tokens ?? usage.total_tokens : void 0;
+  const searchUnits = isRecord(usage) ? usage.search_units : void 0;
+  const rerankUsage = {
+    ...typeof tokens === "number" && Number.isFinite(tokens) ? { inputTokens: tokens } : {},
+    ...typeof searchUnits === "number" && Number.isFinite(searchUnits) ? { searchUnits } : {}
+  };
+  return {
+    results,
+    ...typeof json.model === "string" && json.model ? { model: json.model } : {},
+    ...Object.keys(rerankUsage).length > 0 ? { usage: rerankUsage } : {}
+  };
+}
+
 // src/provider-registry.ts
 var ProviderRegistryImpl = class {
   providers = /* @__PURE__ */ new Map();
@@ -4017,6 +4504,11 @@ var ProviderRegistryImpl = class {
   has(name) {
     return this.providers.has(name);
   }
+  /** Whether a registered provider offers a capability (`false` for unknown providers). */
+  supports(name, capability) {
+    const entry = this.providers.get(name);
+    return typeof entry?.[capability] === "function";
+  }
   /** List all registered provider names. */
   list() {
     return [...this.providers.keys()];
@@ -4194,6 +4686,10 @@ function observePreparedContext(before, after, tools) {
 }
 
 // src/stream.ts
+var OPENAI_EMBED_BATCH_SIZE = 2048;
+var OPENROUTER_EMBED_BATCH_SIZE = 64;
+var LOCAL_EMBED_BATCH_SIZE = 64;
+var OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
 var GLM_CODING_BASE_URL = "https://api.z.ai/api/coding/paas/v4";
 var KIMI_CODE_USER_AGENT = `kimi-code-cli/${process.env.KIMI_CODE_VERSION ?? "1.0.11"}`;
 var GROK_CLI_PROXY_HOST = "cli-chat-proxy.grok.com";
@@ -4214,10 +4710,20 @@ providerRegistry.register("openai", {
       return streamOpenAICodex(options);
     }
     return streamOpenAI(options);
-  }
+  },
+  // OpenAI API-key auth only; ChatGPT-subscription (Codex) tokens have no embeddings API.
+  // OpenAI has no task/input-type parameter, so `inputType` is ignored.
+  embed: (request) => embedOpenAICompatible(request, {
+    provider: "openai",
+    baseUrl: request.baseUrl ?? "https://api.openai.com/v1"
+  }),
+  embedBatchSize: OPENAI_EMBED_BATCH_SIZE
 });
 providerRegistry.register("gemini", {
-  stream: (options) => streamGemini(options)
+  stream: (options) => streamGemini(options),
+  // Native Gemini API with an AI Studio key — not the Code Assist OAuth endpoint above.
+  embed: (request) => embedGemini(request),
+  embedBatchSize: GEMINI_EMBED_BATCH_SIZE
 });
 providerRegistry.register("glm", {
   stream: (options) => streamOpenAI({
@@ -4241,7 +4747,19 @@ providerRegistry.register("deepseek", {
 providerRegistry.register("openrouter", {
   stream: (options) => streamOpenAI({
     ...options,
-    baseUrl: options.baseUrl ?? "https://openrouter.ai/api/v1"
+    baseUrl: options.baseUrl ?? OPENROUTER_BASE_URL
+  }),
+  embed: (request) => embedOpenAICompatible(request, {
+    provider: "openrouter",
+    baseUrl: request.baseUrl ?? OPENROUTER_BASE_URL,
+    inputTypeFields: (inputType) => ({
+      input_type: inputType === "query" ? "search_query" : "search_document"
+    })
+  }),
+  embedBatchSize: OPENROUTER_EMBED_BATCH_SIZE,
+  rerank: (request) => rerankCohereCompatible(request, {
+    provider: "openrouter",
+    baseUrl: request.baseUrl ?? OPENROUTER_BASE_URL
   })
 });
 providerRegistry.register("huggingface", {
@@ -4311,19 +4829,36 @@ providerRegistry.register("local", {
   // vLLM). There is no default endpoint: the baseUrl comes from the endpoint
   // credential the discovery layer wrote, so a missing one is a wiring bug, not
   // something to paper over with a guess at someone else's port.
-  stream: (options) => {
-    if (!options.baseUrl) {
-      throw new GGAIError(
-        "Local provider requires a baseUrl (e.g. http://127.0.0.1:11434/v1). No local endpoint was resolved for this model \u2014 re-scan for local models."
-      );
-    }
-    return streamOpenAI({
-      ...options,
-      model: localWireModelId(options.model),
-      webSearch: false
-    });
-  }
+  stream: (options) => streamOpenAI({
+    ...options,
+    baseUrl: requireLocalBaseUrl(options.baseUrl),
+    model: localWireModelId(options.model),
+    webSearch: false
+  }),
+  // Every supported local server exposes OpenAI-compatible `/v1/embeddings`
+  // (the model must be an embedding model). None has an input-type parameter.
+  embed: (request) => embedOpenAICompatible(request, {
+    provider: "local",
+    baseUrl: requireLocalBaseUrl(request.baseUrl),
+    wireModel: localWireModelId(request.model)
+  }),
+  embedBatchSize: LOCAL_EMBED_BATCH_SIZE,
+  // llama.cpp (`llama-server --rerank`) and vLLM serve `/v1/rerank`; Ollama and
+  // LM Studio don't, and answer with a 404 ProviderError.
+  rerank: (request) => rerankCohereCompatible(request, {
+    provider: "local",
+    baseUrl: requireLocalBaseUrl(request.baseUrl),
+    wireModel: localWireModelId(request.model)
+  })
 });
+function requireLocalBaseUrl(baseUrl) {
+  if (!baseUrl) {
+    throw new GGAIError(
+      "Local provider requires a baseUrl (e.g. http://127.0.0.1:11434/v1). No local endpoint was resolved for this model \u2014 re-scan for local models."
+    );
+  }
+  return baseUrl;
+}
 function stream(options) {
   const entry = providerRegistry.get(options.provider);
   if (!entry) {
@@ -4382,6 +4917,121 @@ function messagesContainVideo(messages) {
   return false;
 }
 
+// src/embed.ts
+var CAPABILITY_LABEL = {
+  embed: "embeddings",
+  rerank: "reranking"
+};
+function resolveCapability(provider, capability) {
+  const entry = providerRegistry.get(provider);
+  if (!entry) {
+    throw new GGAIError(
+      `Unknown provider: "${provider}". Registered: ${providerRegistry.list().join(", ")}`
+    );
+  }
+  const fn = entry[capability];
+  if (typeof fn !== "function") {
+    const label = CAPABILITY_LABEL[capability];
+    const offering = providerRegistry.list().filter((name) => providerRegistry.supports(name, capability)).sort();
+    throw new GGAIError(`Provider "${provider}" doesn't support ${label}.`, {
+      source: "capability",
+      hint: offering.length > 0 ? `Use a provider that offers ${label}: ${offering.join(", ")}.` : `No registered provider offers ${label}.`
+    });
+  }
+  return fn;
+}
+function assertPositiveInteger(name, value) {
+  if (value !== void 0 && !(Number.isInteger(value) && value > 0)) {
+    throw new GGAIError(`${name} must be a positive integer (got ${String(value)}).`);
+  }
+}
+async function embed(options) {
+  const embedFn = resolveCapability(options.provider, "embed");
+  if (!Array.isArray(options.input)) {
+    throw new GGAIError("embed() input must be an array of strings.");
+  }
+  assertPositiveInteger("dimensions", options.dimensions);
+  assertPositiveInteger("batchSize", options.batchSize);
+  if (options.input.length === 0) return { embeddings: [], model: options.model };
+  const entry = providerRegistry.get(options.provider);
+  const batchSize = options.batchSize ?? entry?.embedBatchSize ?? options.input.length;
+  const { normalize, batchSize: _batchSize, ...request } = options;
+  const embeddings = [];
+  let model = options.model;
+  let inputTokens;
+  let expectedLength = options.dimensions;
+  for (let start = 0; start < options.input.length; start += batchSize) {
+    throwIfAborted(options.signal);
+    const batch = options.input.slice(start, start + batchSize);
+    const response = await embedFn({ ...request, input: batch });
+    const invalid = (detail) => new ProviderError(options.provider, `Invalid embeddings response: ${detail}.`);
+    if (!Array.isArray(response.embeddings) || response.embeddings.length !== batch.length) {
+      const count = Array.isArray(response.embeddings) ? response.embeddings.length : 0;
+      throw invalid(`expected ${batch.length} embeddings, got ${count}`);
+    }
+    for (const vector of response.embeddings) {
+      if (!Array.isArray(vector) || vector.length === 0) throw invalid("received an empty vector");
+      if (!vector.every((value) => typeof value === "number" && Number.isFinite(value))) {
+        throw invalid("received a vector with non-numeric values");
+      }
+      if (expectedLength === void 0) {
+        expectedLength = vector.length;
+      } else if (vector.length !== expectedLength) {
+        throw invalid(
+          options.dimensions !== void 0 ? `requested ${options.dimensions} dimensions, got a vector with ${vector.length}` : `vectors have different lengths (${expectedLength} and ${vector.length})`
+        );
+      }
+      embeddings.push(normalize ? l2Normalize(vector) : vector);
+    }
+    if (response.model) model = response.model;
+    if (response.usage) inputTokens = (inputTokens ?? 0) + response.usage.inputTokens;
+  }
+  return {
+    embeddings,
+    model,
+    ...inputTokens !== void 0 ? { usage: { inputTokens } } : {}
+  };
+}
+async function rerank(options) {
+  const rerankFn = resolveCapability(options.provider, "rerank");
+  if (!Array.isArray(options.documents)) {
+    throw new GGAIError("rerank() documents must be an array of strings.");
+  }
+  assertPositiveInteger("topN", options.topN);
+  if (options.documents.length === 0) return { results: [], model: options.model };
+  throwIfAborted(options.signal);
+  const response = await rerankFn(options);
+  const invalid = (detail) => new ProviderError(options.provider, `Invalid rerank response: ${detail}.`);
+  if (!Array.isArray(response.results)) throw invalid("missing results");
+  const seen = /* @__PURE__ */ new Set();
+  const results = response.results.map(({ index, score }) => {
+    if (!Number.isInteger(index) || index < 0 || index >= options.documents.length) {
+      throw invalid(
+        `index ${String(index)} is out of range for ${options.documents.length} documents`
+      );
+    }
+    if (seen.has(index)) throw invalid(`index ${index} appears more than once`);
+    if (typeof score !== "number" || !Number.isFinite(score)) {
+      throw invalid(`document ${index} has a non-numeric score`);
+    }
+    seen.add(index);
+    return { index, score };
+  });
+  results.sort((a, b) => b.score - a.score || a.index - b.index);
+  return {
+    results: options.topN !== void 0 ? results.slice(0, options.topN) : results,
+    model: response.model ?? options.model,
+    ...response.usage ? { usage: response.usage } : {}
+  };
+}
+function l2Normalize(vector) {
+  let sumOfSquares = 0;
+  for (const value of vector) sumOfSquares += value * value;
+  if (sumOfSquares === 0) return [...vector];
+  const norm = Math.sqrt(sumOfSquares);
+  return vector.map((value) => value / norm);
+}
+
 // src/chat-error.ts
 function causeCode(error) {
   if (!(error instanceof Error) || !error.cause || typeof error.cause !== "object") return "";
@@ -4623,143 +5273,6 @@ Original: ${message}`;
   return message;
 }
 
-// src/redaction.ts
-var REDACTED = "[REDACTED]";
-var TRUNCATED = "[TRUNCATED]";
-var CIRCULAR = "[CIRCULAR]";
-var SENSITIVE_NAME = /(?:^|[_-])(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|key|auth(?:orization)?|bearer|cookie|credential|private[_-]?key|password|passwd|secret)(?:$|[_-])/i;
-var ENV_SECRET_ASSIGNMENT = /\b((?:[A-Z0-9]+_)*(?:API_?KEY|ACCESS_TOKEN|REFRESH_TOKEN|TOKEN|KEY|AUTH|AUTHORIZATION|BEARER|CREDENTIALS?|PASSWORD|PASSWD|SECRET))\b(\s*[=:]\s*)(["']?)(?!\$|process\.env|os\.environ|import\.meta|env\.)(?=[^\s,"';}]*\d)([^\s,"';}=$][^\s,"';}]{7,})\3/g;
-var COMPACT_SECRET_ASSIGNMENT = /\b((?:[a-z0-9]+[_-])*(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|auth|authorization|credentials?|password|passwd|secret)|(?:[a-z0-9]+[_-])+key)=(["']?)(?!\$)([^\s,"'&;}=][^\s,"'&;}]{7,})\2/gi;
-var URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/?#@:"'`<>]*:[^\s/?#"'`<>]+@/gi;
-var URL_USERINFO_TO_FIRST_AT = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]*:[^\s/@]+@/gi;
-function escaped(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function normalizedSecrets(secrets) {
-  if (!secrets) return [];
-  return [...new Set([...secrets].filter((value) => value.length >= 8 && value !== REDACTED))].sort(
-    (a, b) => b.length - a.length
-  );
-}
-function environmentSecrets(env) {
-  const values = /* @__PURE__ */ new Set();
-  for (const [name, value] of Object.entries(env)) {
-    if (!value || value.length < 8 || value === REDACTED || !SENSITIVE_NAME.test(name)) continue;
-    values.add(value);
-  }
-  return [...values].sort((a, b) => b.length - a.length);
-}
-function redactText(text, options = {}) {
-  let result = text;
-  result = result.replace(
-    /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g,
-    REDACTED
-  );
-  result = result.replace(URL_USERINFO, `$1${REDACTED}@`);
-  result = result.replace(URL_USERINFO_TO_FIRST_AT, `$1${REDACTED}@`);
-  result = result.replace(
-    /\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[^\s,;]+/gi,
-    `$1${REDACTED}`
-  );
-  result = result.replace(
-    /\b(bearer|basic)\s+(?![A-Za-z][a-z]{0,14}\b)[A-Za-z0-9+/_.=-]{8,}/gi,
-    `$1 ${REDACTED}`
-  );
-  result = result.replace(/\b(cookie|set-cookie)(\s*:\s*)[^\s=;:]+=[^\r\n]*/gi, `$1$2${REDACTED}`);
-  result = result.replace(
-    /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,
-    REDACTED
-  );
-  result = result.replace(
-    /\b(?:sk-(?:ant-|proj-)?|xox[baprs]-|gh[pousr]_|github_pat_|AIza)[A-Za-z0-9_-]{12,}\b/g,
-    REDACTED
-  );
-  result = result.replace(
-    ENV_SECRET_ASSIGNMENT,
-    (_match, name, separator, quote) => `${name}${separator}${quote}${REDACTED}${quote}`
-  );
-  result = result.replace(
-    COMPACT_SECRET_ASSIGNMENT,
-    (_match, name, quote) => `${name}=${quote}${REDACTED}${quote}`
-  );
-  for (const secret of normalizedSecrets(options.secrets)) {
-    result = result.replace(new RegExp(escaped(secret), "g"), REDACTED);
-  }
-  const maxStringLength = options.maxStringLength ?? 1e6;
-  if (result.length > maxStringLength) {
-    result = `${result.slice(0, maxStringLength)}${TRUNCATED}`;
-  }
-  return result;
-}
-function isBinary(value) {
-  return value instanceof ArrayBuffer || ArrayBuffer.isView(value) || typeof Blob !== "undefined" && value instanceof Blob;
-}
-function isMediaObject(value) {
-  return (value.type === "image" || value.type === "video") && (typeof value.data === "string" || typeof value.url === "string");
-}
-function redactValue(value, options = {}) {
-  const maxDepth = options.maxDepth ?? 20;
-  const maxEntries = options.maxEntries ?? 1e4;
-  const ancestors = /* @__PURE__ */ new WeakSet();
-  let entries = 0;
-  const visit = (current, depth, sensitive = false) => {
-    if (typeof current === "string") {
-      if (sensitive && current.length > 0 && current !== REDACTED) return REDACTED;
-      return redactText(current, options);
-    }
-    if (current === null || current === void 0 || typeof current === "number" || typeof current === "boolean" || typeof current === "bigint") {
-      return current;
-    }
-    if (typeof current !== "object") return current;
-    if (isBinary(current)) return current;
-    if (current instanceof Date) return new Date(current.getTime());
-    if (depth >= maxDepth) return TRUNCATED;
-    if (ancestors.has(current)) return CIRCULAR;
-    ancestors.add(current);
-    try {
-      return cloneObject(current, depth);
-    } finally {
-      ancestors.delete(current);
-    }
-  };
-  const cloneObject = (current, depth) => {
-    if (current instanceof Error) {
-      const error = {
-        name: current.name,
-        message: visit(current.message, depth + 1),
-        stack: visit(current.stack, depth + 1)
-      };
-      for (const [key, child] of Object.entries(current)) {
-        error[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
-      }
-      return error;
-    }
-    if (Array.isArray(current)) {
-      const clone2 = [];
-      for (const child of current) {
-        if (++entries > maxEntries) {
-          clone2.push(TRUNCATED);
-          break;
-        }
-        clone2.push(visit(child, depth + 1));
-      }
-      return clone2;
-    }
-    const record = current;
-    if (isMediaObject(record)) return { ...record };
-    const clone = {};
-    for (const [key, child] of Object.entries(record)) {
-      if (++entries > maxEntries) {
-        clone[TRUNCATED] = true;
-        break;
-      }
-      clone[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
-    }
-    return clone;
-  };
-  return visit(value, 0);
-}
-
 // src/providers/palsu.ts
 function palsuText(text) {
   return { role: "assistant", content: text ? [{ type: "text", text }] : [] };
@@ -4840,7 +5353,8 @@ function computeCacheUsage(current, previous) {
 function registerPalsuProvider(config) {
   const name = config?.name ?? "palsu";
   const responses = [];
-  const state = { callCount: 0 };
+  const state = { callCount: 0, embedCallCount: 0, rerankCallCount: 0 };
+  const embedDimensions = config?.embedDimensions ?? PALSU_DEFAULT_EMBED_DIMENSIONS;
   const defaultResponse = config?.defaultResponse ?? palsuText("");
   const enableCache = config?.promptCache ?? false;
   let lastMessagesSerialized = null;
@@ -4908,10 +5422,72 @@ function registerPalsuProvider(config) {
         return yield* simulateStream(message, stopReason, options.signal, cacheUsage);
       })();
       return new StreamResult(gen, options.signal);
+    },
+    async embed(request) {
+      throwIfAborted(request.signal);
+      state.embedCallCount++;
+      const dimensions = request.dimensions ?? embedDimensions;
+      return {
+        embeddings: request.input.map((text) => palsuEmbedding(text, dimensions)),
+        model: request.model,
+        usage: { inputTokens: request.input.reduce((n, text) => n + tokenize(text).length, 0) }
+      };
+    },
+    ...config?.embedBatchSize !== void 0 ? { embedBatchSize: config.embedBatchSize } : {},
+    async rerank(request) {
+      throwIfAborted(request.signal);
+      state.rerankCallCount++;
+      return {
+        results: request.documents.map((document, index) => ({
+          index,
+          score: palsuRerankScore(request.query, document)
+        })),
+        model: request.model
+      };
     }
   });
   return handle;
 }
+var PALSU_DEFAULT_EMBED_DIMENSIONS = 64;
+function tokenize(text) {
+  return text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+}
+function fnv1a(text) {
+  let hash = 2166136261;
+  for (let i = 0; i < text.length; i++) {
+    hash ^= text.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
+function palsuEmbedding(text, dimensions = PALSU_DEFAULT_EMBED_DIMENSIONS) {
+  const vector = new Array(dimensions).fill(0);
+  const tokens = tokenize(text);
+  if (tokens.length === 0) {
+    vector[0] = 1;
+    return vector;
+  }
+  for (const token of tokens) {
+    const hash = fnv1a(token);
+    const slot = hash % dimensions;
+    vector[slot] = (vector[slot] ?? 0) + (hash >>> 31 === 0 ? 1 : -1);
+  }
+  const norm = Math.sqrt(vector.reduce((sum, value) => sum + value * value, 0));
+  if (norm === 0) {
+    vector.fill(0);
+    vector[0] = 1;
+    return vector;
+  }
+  return vector.map((value) => value / norm);
+}
+function palsuRerankScore(query, document) {
+  const queryTokens = new Set(tokenize(query));
+  if (queryTokens.size === 0) return 0;
+  const documentTokens = new Set(tokenize(document));
+  let hits = 0;
+  for (const token of queryTokens) if (documentTokens.has(token)) hits++;
+  return hits / queryTokens.size;
+}
 export {
   EventStream,
   GGAIError,
@@ -4922,6 +5498,7 @@ export {
   clampProviderContextImages,
   classifyProviderError,
   dropInvalidToolCalls,
+  embed,
   environmentSecrets,
   formatChatError,
   formatError,
@@ -4932,6 +5509,8 @@ export {
   isValidToolCallName,
   localWireModelId,
   palsuAssistantMessage,
+  palsuEmbedding,
+  palsuRerankScore,
   palsuText,
   palsuThinking,
   palsuToolCall,
@@ -4940,6 +5519,7 @@ export {
   redactText,
   redactValue,
   registerPalsuProvider,
+  rerank,
   resolveToolSchema,
   sanitizeMessagesForWire,
   setProviderDiagnostic,