@oh-my-pi/pi-ai 17.1.5 → 17.1.7

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [17.1.7] - 2026-07-27
+
+### Changed
+
+- Upstream `403 Forbidden` responses (e.g. Anthropic `permission_error` plan/model denials, Copilot model-policy rejections) now rotate through sibling credentials like usage limits do, instead of failing the session on the first denied account. The denied credential is soft-blocked for 60s and re-validated — never removed — and the original 403 surfaces only once every sibling has been tried.
+- Usage report filtering in the auth-broker remote store is memoized per (reports, snapshot) with a precomputed per-provider OAuth credential map, replacing an O(reports × credentials) scan on every credential-selection and status refresh
+- Cursor and Devin Connect-frame readers no longer copy every stream chunk through `Buffer.concat` when the pending buffer is empty
+
+## [17.1.6] - 2026-07-27
+
+### Added
+
+- Added `getProxyForUrl()` for transports that need provider-specific and standard proxy environment resolution with `NO_PROXY` support ([#6770](https://github.com/can1357/oh-my-pi/issues/6770)).
+- Added SiliconFlow and SiliconFlow (China) to the built-in API-key login provider catalog so `omp login siliconflow` / `omp login siliconflow-cn` stores a reusable credential validated against each region's `/v1/models` endpoint.
+
 ## [17.1.5] - 2026-07-27
 
 ### Fixed

package/dist/types/auth-retry.d.ts

@@ -14,7 +14,7 @@ import { isAuthRetryableError } from "./error/auth-classify.js";
  *   (invalidate/usage-limit the current credential and rotate to a sibling).
  *
  * Current drivers preserve that bounded a/b/c sequence for ordinary 401/auth
- * failures. Usage/account-limit failures skip refresh and may repeat step (c)
+ * failures. 403/usage-limit failures skip refresh and may repeat step (c)
  * until the resolver returns `undefined`, cycles, or hits
  * {@link AUTH_RETRY_MAX_ATTEMPTS}.
  */
@@ -84,8 +84,8 @@ export declare function resolveNextAuthRetryKey(state: AuthRetryKeyState, resolv
  * - A resolver → initial `attempt`, then resolver-driven retries until the
  *   applicable policy is exhausted, the resolver declines or cycles, or the
  *   operation reaches {@link AUTH_RETRY_MAX_ATTEMPTS}. Ordinary 401/auth
- *   failures retain one refresh-same plus one sibling switch; usage/account
- *   limits rotate directly through distinct siblings.
+ *   failures retain one refresh-same plus one sibling switch; 403/usage-limit
+ *   failures rotate directly through distinct siblings.
  *
  * Used by non-streaming consumers (image generation, web search, completion
  * helpers). The streaming driver in `stream.ts` implements the same policy with
@@ -136,7 +136,7 @@ export interface WithOAuthAccessOptions {
  * - initial → `getOAuthAccess` (or `opts.seed`).
  * - 401/auth failure → one `getOAuthAccess` with `forceRefresh: true` for the
  *   current account, then sibling rotation.
- * - usage-limit failure → `rotateSessionCredential` directly, without a
+ * - 403/usage-limit failure → `rotateSessionCredential` directly, without a
  *   force-refresh detour.
  *
  * A refresh-same step may retry a new bearer for the same credential identity;

package/dist/types/error/auth-classify.d.ts

@@ -9,9 +9,11 @@ export declare function isDefinitiveOAuthFailure(errorMsg: string): boolean;
 export declare function isInvalidatedOAuthTokenError(error: unknown): boolean;
 /**
  * Whether an upstream failure should rotate to a sibling credential: a hard
- * `401`, a body-classified usage limit (Codex `usage_limit_reached`, Anthropic
- * account rate-limit, Google `resource_exhausted`, OpenAI `insufficient_quota`,
- * …), or a bare `429` whose payload did not preserve a richer quota code.
+ * `401`, a `403` (token valid but access denied — plan, model policy, or org
+ * restriction a sibling account may not share), a body-classified usage limit
+ * (Codex `usage_limit_reached`, Anthropic account rate-limit, Google
+ * `resource_exhausted`, OpenAI `insufficient_quota`, …), or a bare `429`
+ * whose payload did not preserve a richer quota code.
  * Transient 429s (`Too many requests`, per-minute caps) stay in the
  * upstream-backoff lane.
  */

package/dist/types/registry/registry.d.ts

@@ -239,6 +239,14 @@ declare const ALL: ({
     readonly id: "sakana";
     readonly name: "Sakana AI";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "siliconflow";
+    readonly name: "SiliconFlow";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "siliconflow-cn";
+    readonly name: "SiliconFlow (China)";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "synthetic";
     readonly name: "Synthetic";

package/dist/types/registry/siliconflow-cn.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginSiliconFlowCn: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const siliconflowCnProvider: {
+    readonly id: "siliconflow-cn";
+    readonly name: "SiliconFlow (China)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/siliconflow.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginSiliconFlow: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const siliconflowProvider: {
+    readonly id: "siliconflow";
+    readonly name: "SiliconFlow";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/utils/proxy.d.ts

@@ -18,6 +18,8 @@ export declare function __resetProxyCache(): void;
  * for the lifetime of the process and this function is called for every outgoing request.
  */
 export declare function getProxyForProvider(provider: string): string | undefined;
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+export declare function getProxyForUrl(provider: string, url: URL): string | undefined;
 /**
  * Wraps a fetch implementation to inject proxy options for non-local hosts.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.1.5",
+	"version": "17.1.7",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.1.5",
-		"@oh-my-pi/pi-utils": "17.1.5",
-		"@oh-my-pi/pi-wire": "17.1.5",
+		"@oh-my-pi/pi-catalog": "17.1.7",
+		"@oh-my-pi/pi-utils": "17.1.7",
+		"@oh-my-pi/pi-wire": "17.1.7",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/remote-store.ts

@@ -253,6 +253,10 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#usageInflight?: Promise<UsageReport[] | null>;
 	#credentialBlockReconcileAfter: Map<string, number> = new Map();
 	#usageCacheEpoch = 0;
+	/** Per-snapshot lookup of oauth credentials by provider; rebuilt when `#snapshot` is replaced. */
+	#usageFilterLookup?: { snapshot: SnapshotResponse; byProvider: Map<Provider, OAuthCredential[]> };
+	/** Memoized `#filterUsageReports` output, keyed on (input identity, lookup identity). */
+	#usageFilterResult?: { input: UsageReport[]; byProvider: Map<Provider, OAuthCredential[]>; output: UsageReport[] };
 	#closed = false;
 	/**
 	 * `true` once the SSE consumer received its first frame and hasn't dropped
@@ -962,18 +966,39 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		return overlay ?? matched;
 	}
 
+	/**
+	 * Hot path — called per `getUsageReport()`/`fetchUsageReports()` (status-line
+	 * refresh cadence). The oauth-credential lookup is memoized on `#snapshot`
+	 * identity (every update site replaces the reference), and the filtered
+	 * output on (reports identity, lookup identity) — `#loadUsageReports`
+	 * serves the same array for 15s, so steady-state calls are O(1).
+	 */
 	#filterUsageReports(reports: UsageReport[]): UsageReport[] {
 		const accountPool = this.#accountPool;
 		if (!accountPool) return reports;
-		return reports.filter(report => {
+		let lookup = this.#usageFilterLookup;
+		if (!lookup || lookup.snapshot !== this.#snapshot) {
+			const byProvider = new Map<Provider, OAuthCredential[]>();
+			for (const entry of this.#snapshot.credentials) {
+				if (entry.credential.type !== "oauth") continue;
+				const list = byProvider.get(entry.provider);
+				if (list) list.push(entry.credential);
+				else byProvider.set(entry.provider, [entry.credential]);
+			}
+			lookup = { snapshot: this.#snapshot, byProvider };
+			this.#usageFilterLookup = lookup;
+		}
+		const memo = this.#usageFilterResult;
+		if (memo && memo.input === reports && memo.byProvider === lookup.byProvider) return memo.output;
+		const byProvider = lookup.byProvider;
+		const output = reports.filter(report => {
 			if (!accountPool.has(report.provider)) return true;
-			return this.#snapshot.credentials.some(
-				entry =>
-					entry.provider === report.provider &&
-					entry.credential.type === "oauth" &&
-					usageReportMatchesCredential(report, entry.credential),
-			);
+			const credentials = byProvider.get(report.provider);
+			if (!credentials) return false;
+			return credentials.some(credential => usageReportMatchesCredential(report, credential));
 		});
+		this.#usageFilterResult = { input: reports, byProvider, output };
+		return output;
 	}
 
 	ingestUsageReport(provider: Provider, credential: OAuthCredential, report: UsageReport): boolean {

package/src/auth-retry.ts

@@ -1,3 +1,4 @@
+import { extractHttpStatusFromError } from "@oh-my-pi/pi-utils";
 import type { OAuthAccess } from "./auth-storage";
 import * as AIError from "./error";
 import { isAuthRetryableError, isInvalidatedOAuthTokenError } from "./error/auth-classify";
@@ -18,7 +19,7 @@ import { isUsageLimitOutcome } from "./error/rate-limit";
  *   (invalidate/usage-limit the current credential and rotate to a sibling).
  *
  * Current drivers preserve that bounded a/b/c sequence for ordinary 401/auth
- * failures. Usage/account-limit failures skip refresh and may repeat step (c)
+ * failures. 403/usage-limit failures skip refresh and may repeat step (c)
  * until the resolver returns `undefined`, cycles, or hits
  * {@link AUTH_RETRY_MAX_ATTEMPTS}.
  */
@@ -92,7 +93,11 @@ export const AUTH_RETRY_MAX_ATTEMPTS = 64;
 function isDirectCredentialRotationError(error: unknown): boolean {
 	if (isUsageLimit(error) || isInvalidatedOAuthTokenError(error)) return true;
 	const status = AIError.status(error);
+	// 403: the token is valid but access was denied, so refreshing the same
+	// credential can't help — rotate straight through the sibling pool.
+	if (status === 403) return true;
 	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
+	if (status === undefined && message !== undefined && extractHttpStatusFromError({ message }) === 403) return true;
 	return isUsageLimitOutcome(status, message);
 }
 
@@ -199,8 +204,8 @@ async function runOAuthAttempt<T>(
  * - A resolver → initial `attempt`, then resolver-driven retries until the
  *   applicable policy is exhausted, the resolver declines or cycles, or the
  *   operation reaches {@link AUTH_RETRY_MAX_ATTEMPTS}. Ordinary 401/auth
- *   failures retain one refresh-same plus one sibling switch; usage/account
- *   limits rotate directly through distinct siblings.
+ *   failures retain one refresh-same plus one sibling switch; 403/usage-limit
+ *   failures rotate directly through distinct siblings.
  *
  * Used by non-streaming consumers (image generation, web search, completion
  * helpers). The streaming driver in `stream.ts` implements the same policy with
@@ -289,7 +294,7 @@ export interface WithOAuthAccessOptions {
  * - initial → `getOAuthAccess` (or `opts.seed`).
  * - 401/auth failure → one `getOAuthAccess` with `forceRefresh: true` for the
  *   current account, then sibling rotation.
- * - usage-limit failure → `rotateSessionCredential` directly, without a
+ * - 403/usage-limit failure → `rotateSessionCredential` directly, without a
  *   force-refresh detour.
  *
  * A refresh-same step may retry a new bearer for the same credential identity;

package/src/error/auth-classify.ts

@@ -26,9 +26,11 @@ export function isInvalidatedOAuthTokenError(error: unknown): boolean {
 
 /**
  * Whether an upstream failure should rotate to a sibling credential: a hard
- * `401`, a body-classified usage limit (Codex `usage_limit_reached`, Anthropic
- * account rate-limit, Google `resource_exhausted`, OpenAI `insufficient_quota`,
- * …), or a bare `429` whose payload did not preserve a richer quota code.
+ * `401`, a `403` (token valid but access denied — plan, model policy, or org
+ * restriction a sibling account may not share), a body-classified usage limit
+ * (Codex `usage_limit_reached`, Anthropic account rate-limit, Google
+ * `resource_exhausted`, OpenAI `insufficient_quota`, …), or a bare `429`
+ * whose payload did not preserve a richer quota code.
  * Transient 429s (`Too many requests`, per-minute caps) stay in the
  * upstream-backoff lane.
  */
@@ -36,9 +38,9 @@ export function isAuthRetryableError(error: unknown): boolean {
 	if (isUsageLimit(error)) return true;
 	if (isInvalidatedOAuthTokenError(error)) return true;
 	const httpStatus = extractHttpStatusFromError(error);
-	if (httpStatus === 401) return true;
+	if (httpStatus === 401 || httpStatus === 403) return true;
 	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
 	const embeddedStatus = message ? extractHttpStatusFromError({ message }) : undefined;
-	if (embeddedStatus === 401) return true;
+	if (embeddedStatus === 401 || embeddedStatus === 403) return true;
 	return isUsageLimitOutcome(httpStatus ?? embeddedStatus, message);
 }

package/src/providers/cursor.ts

@@ -503,7 +503,7 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 
 			stream.push({ type: "start", partial: output });
 
-			let pendingBuffer = Buffer.alloc(0);
+			let pendingBuffer: Buffer = Buffer.alloc(0);
 			let currentTextBlock: (TextContent & { [kStreamingBlockIndex]: number }) | null = null;
 			let currentThinkingBlock: (ThinkingContent & { [kStreamingBlockIndex]: number }) | null = null;
 			let currentToolCall: ToolCallState | null = null;
@@ -557,7 +557,9 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 						log?.write(chunk);
 					});
 				}
-				pendingBuffer = Buffer.concat([pendingBuffer, chunk]);
+				// Steady state drains fully per chunk; alias the fresh h2 chunk instead
+				// of copying it through Buffer.concat (see aws-eventstream.ts).
+				pendingBuffer = pendingBuffer.length === 0 ? chunk : Buffer.concat([pendingBuffer, chunk]);
 
 				while (pendingBuffer.length >= 5) {
 					const flags = pendingBuffer[0];

package/src/providers/devin.ts

@@ -217,7 +217,12 @@ export const streamDevin: StreamFunction<"devin-agent"> = (
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (value && value.length > 0) {
-					pending = Buffer.concat([pending, value]);
+					// Steady state drains fully per chunk; view the fresh reader chunk
+					// instead of copying it through Buffer.concat (see aws-eventstream.ts).
+					pending =
+						pending.length === 0
+							? Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+							: Buffer.concat([pending, value]);
 				}
 
 				while (pending.length >= 5) {

package/src/providers/openai-codex-responses.ts

@@ -61,7 +61,7 @@ import {
 	getOpenAIStreamIdleTimeoutMs,
 	iterateWithIdleTimeout,
 } from "../utils/idle-iterator";
-import { getProxyForProvider, shouldBypassProxy } from "../utils/proxy";
+import { getProxyForUrl } from "../utils/proxy";
 import { createRequestDebugSession, isRequestDebugEnabled, type RequestDebugResponseLog } from "../utils/request-debug";
 import { adaptSchemaForStrict, NO_STRICT, sanitizeSchemaForOpenAIResponses, toolWireSchema } from "../utils/schema";
 import { notifyRawSseEvent } from "../utils/sse-debug";
@@ -3855,15 +3855,7 @@ async function getOrCreateCodexWebSocketConnection(
 	provider: string,
 	signal?: AbortSignal,
 ): Promise<CodexWebSocketConnection> {
-	const targetUrl = new URL(url);
-	const proxy = shouldBypassProxy(targetUrl)
-		? undefined
-		: (getProxyForProvider(provider) ??
-			(targetUrl.protocol === "wss:"
-				? Bun.env.HTTPS_PROXY || Bun.env.https_proxy
-				: Bun.env.HTTP_PROXY || Bun.env.http_proxy) ??
-			Bun.env.ALL_PROXY ??
-			Bun.env.all_proxy);
+	const proxy = getProxyForUrl(provider, new URL(url));
 	const headerRecord = headersToRecord(headers);
 	// Join an in-flight handshake instead of tearing it down: closing a
 	// CONNECTING socket rejects the concurrent caller (prewarm racing the first

package/src/registry/registry.ts

@@ -51,6 +51,8 @@ import { perplexityProvider } from "./perplexity";
 import { qianfanProvider } from "./qianfan";
 import { qwenPortalProvider } from "./qwen-portal";
 import { sakanaProvider } from "./sakana";
+import { siliconflowProvider } from "./siliconflow";
+import { siliconflowCnProvider } from "./siliconflow-cn";
 import { syntheticProvider } from "./synthetic";
 import { tavilyProvider } from "./tavily";
 import { togetherProvider } from "./together";
@@ -121,6 +123,8 @@ const ALL = [
 	perplexityProvider,
 	qianfanProvider,
 	veniceProvider,
+	siliconflowProvider,
+	siliconflowCnProvider,
 	syntheticProvider,
 	nanogptProvider,
 	waferServerlessProvider,

package/src/registry/siliconflow-cn.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginSiliconFlowCn = createApiKeyLogin({
+	providerLabel: "SiliconFlow (China)",
+	authUrl: "https://cloud.siliconflow.cn/account/ak",
+	instructions: "Create or copy your API key from the SiliconFlow console",
+	promptMessage: "Paste your SiliconFlow API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "siliconflow-cn",
+		modelsUrl: "https://api.siliconflow.cn/v1/models",
+	},
+});
+
+export const siliconflowCnProvider = {
+	id: "siliconflow-cn",
+	name: "SiliconFlow (China)",
+	login: (cb: OAuthLoginCallbacks) => loginSiliconFlowCn(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/siliconflow.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginSiliconFlow = createApiKeyLogin({
+	providerLabel: "SiliconFlow",
+	authUrl: "https://cloud.siliconflow.com/account/ak",
+	instructions: "Create or copy your API key from the SiliconFlow console",
+	promptMessage: "Paste your SiliconFlow API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "siliconflow",
+		modelsUrl: "https://api.siliconflow.com/v1/models",
+	},
+});
+
+export const siliconflowProvider = {
+	id: "siliconflow",
+	name: "SiliconFlow",
+	login: (cb: OAuthLoginCallbacks) => loginSiliconFlow(cb),
+} as const satisfies ProviderDefinition;

package/src/stream.ts

@@ -970,7 +970,9 @@ function extractStatusFromAssistantError(message: AssistantMessage): number | un
 }
 
 function isRetryableUpstreamError(error: unknown, status: number | undefined, message: string | undefined): boolean {
-	// 401 means the credential is bad. Usage-limit phrasing (Codex's
+	// 401 means the credential is bad; 403 is its valid-token twin (access
+	// denied by plan, model policy, or org restriction — a sibling account may
+	// not share it). Usage-limit phrasing (Codex's
 	// "You have hit your ChatGPT usage limit", Anthropic's "usage_limit_reached",
 	// Google's "resource_exhausted", OpenAI's "insufficient_quota") and 429s
 	// without transient rate-limit wording mean this account is parked but a
@@ -983,7 +985,7 @@ function isRetryableUpstreamError(error: unknown, status: number | undefined, me
 	// instead of burning siblings.
 	if (AIError.isUsageLimit(error)) return true;
 	if (isInvalidatedOAuthTokenError(error)) return true;
-	if (status === 401) return true;
+	if (status === 401 || status === 403) return true;
 	return isUsageLimitOutcome(status, message);
 }
 

package/src/utils/proxy.ts

@@ -129,6 +129,16 @@ export function getProxyForProvider(provider: string): string | undefined {
 	return value;
 }
 
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+export function getProxyForUrl(provider: string, url: URL): string | undefined {
+	if (shouldBypassProxy(url)) return undefined;
+	const protocolProxy =
+		url.protocol === "https:" || url.protocol === "wss:"
+			? Bun.env.HTTPS_PROXY || Bun.env.https_proxy
+			: Bun.env.HTTP_PROXY || Bun.env.http_proxy;
+	return getProxyForProvider(provider) || protocolProxy || Bun.env.ALL_PROXY || Bun.env.all_proxy || undefined;
+}
+
 /**
  * Wraps a fetch implementation to inject proxy options for non-local hosts.
  */

package/dist/types/providers/__tests__/google-auth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/keyless-auth-header.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/kimi-code-thinking.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/openai-codex-error.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/registry/oauth/__tests__/xai-oauth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/src/providers/__tests__/google-auth.test.ts

@@ -1,144 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { Buffer } from "node:buffer";
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import type { FetchImpl } from "../../types";
-import { __resetVertexTokenCache, getVertexAccessToken } from "../google-auth";
-
-const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-
-/** Generate a real RS256 private key so signJwtRs256 / pemToPkcs8 run for real. */
-async function generateServiceAccountPem(): Promise<string> {
-	const keyPair = (await globalThis.crypto.subtle.generateKey(
-		{ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
-		true,
-		["sign", "verify"],
-	)) as CryptoKeyPair;
-	const pkcs8 = new Uint8Array(await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey));
-	const body = (
-		Buffer.from(pkcs8)
-			.toString("base64")
-			.match(/.{1,64}/g) ?? []
-	).join("\n");
-	return `-----BEGIN PRIVATE KEY-----\n${body}\n-----END PRIVATE KEY-----\n`;
-}
-
-function urlOf(input: string | URL | Request): string {
-	if (typeof input === "string") return input;
-	if (input instanceof URL) return input.toString();
-	return input.url;
-}
-
-describe("getVertexAccessToken impersonated_service_account ADC", () => {
-	let tmpDir: string;
-	let originalGac: string | undefined;
-
-	beforeEach(async () => {
-		__resetVertexTokenCache();
-		originalGac = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
-		tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "omp-vertex-adc-"));
-	});
-
-	afterEach(async () => {
-		__resetVertexTokenCache();
-		if (originalGac === undefined) delete Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
-		else Bun.env.GOOGLE_APPLICATION_CREDENTIALS = originalGac;
-		await fs.rm(tmpDir, { recursive: true, force: true });
-	});
-
-	it("rejects a malformed service_account_impersonation_url before any network call", async () => {
-		const adcPath = path.join(tmpDir, "impersonated-bad-url.json");
-		await Bun.write(
-			adcPath,
-			JSON.stringify({
-				type: "impersonated_service_account",
-				// Missing the trailing ":generateAccessToken" the principal parser requires.
-				service_account_impersonation_url:
-					"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/target@project.iam.gserviceaccount.com",
-				source_credentials: {
-					type: "authorized_user",
-					client_id: "client-id",
-					client_secret: "client-secret",
-					refresh_token: "refresh-token",
-				},
-			}),
-		);
-		Bun.env.GOOGLE_APPLICATION_CREDENTIALS = adcPath;
-
-		const calls: string[] = [];
-		const fetchImpl: FetchImpl = async input => {
-			calls.push(urlOf(input));
-			return new Response("{}");
-		};
-
-		// The principal is parsed before the source exchange, so a bad URL must fail
-		// up front rather than after burning a source-token round trip.
-		await expect(getVertexAccessToken({ fetch: fetchImpl })).rejects.toBeInstanceOf(RangeError);
-		expect(calls).toEqual([]);
-	});
-
-	it("signs an RS256 JWT for a service_account source and reconstructs the IAM URL", async () => {
-		const pem = await generateServiceAccountPem();
-		const adcPath = path.join(tmpDir, "impersonated-sa.json");
-		await Bun.write(
-			adcPath,
-			JSON.stringify({
-				type: "impersonated_service_account",
-				// Non-canonical project segment proves the request URL is rebuilt, not echoed.
-				service_account_impersonation_url:
-					"https://iamcredentials.googleapis.com/v1/projects/explicit-proj/serviceAccounts/target@project.iam.gserviceaccount.com:generateAccessToken",
-				source_credentials: {
-					type: "service_account",
-					client_email: "source@project.iam.gserviceaccount.com",
-					private_key: pem,
-					private_key_id: "key-1",
-				},
-				// delegates intentionally omitted — the IAM body must default to [].
-			}),
-		);
-		Bun.env.GOOGLE_APPLICATION_CREDENTIALS = adcPath;
-
-		const calls: { url: string; init?: RequestInit }[] = [];
-		const fetchImpl: FetchImpl = async (input, init) => {
-			const url = urlOf(input);
-			calls.push({ url, init });
-			if (url === "https://oauth2.googleapis.com/token") {
-				return new Response(JSON.stringify({ access_token: "sa-source-token", expires_in: 3600 }));
-			}
-			if (url.startsWith("https://iamcredentials.googleapis.com/")) {
-				return new Response(
-					JSON.stringify({
-						accessToken: "impersonated-token",
-						expireTime: new Date(Date.now() + 3_600_000).toISOString(),
-					}),
-				);
-			}
-			return new Response("unexpected", { status: 404 });
-		};
-
-		const token = await getVertexAccessToken({ fetch: fetchImpl });
-		expect(token).toBe("impersonated-token");
-
-		// Source JWT exchange happens first, then the impersonation exchange.
-		expect(calls.map(c => c.url)).toEqual([
-			"https://oauth2.googleapis.com/token",
-			"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/target@project.iam.gserviceaccount.com:generateAccessToken",
-		]);
-
-		// Source credential is exchanged via a signed JWT bearer assertion, not a refresh grant.
-		const sourceBody = new URLSearchParams(String(calls[0].init?.body));
-		expect(sourceBody.get("grant_type")).toBe(JWT_BEARER_GRANT);
-		expect((sourceBody.get("assertion") ?? "").split(".")).toHaveLength(3);
-
-		// The IAM call carries the source-derived bearer token and defaults delegates to [].
-		const iamHeaders = calls[1].init?.headers as Record<string, string>;
-		expect(iamHeaders.Authorization).toBe("Bearer sa-source-token");
-		expect(JSON.parse(String(calls[1].init?.body))).toEqual({
-			delegates: [],
-			scope: [CLOUD_PLATFORM_SCOPE],
-			lifetime: "3600s",
-		});
-	});
-});

package/src/providers/__tests__/keyless-auth-header.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { NO_AUTH_SENTINEL, resolveOpenAIRequestSetup } from "../openai-shared";
-
-describe("resolveOpenAIRequestSetup keyless auth", () => {
-	test("omits Authorization for the keyless (auth: none) sentinel, keeping custom headers", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{
-				provider: "qwen",
-				id: "Qwen3.6-35B-A3B",
-				baseUrl: "http://localhost:8788",
-				headers: { "x-api-key": "real-key" },
-			},
-			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
-		);
-		expect(setup.headers.Authorization).toBeUndefined();
-		expect(setup.headers["x-api-key"]).toBe("real-key");
-	});
-
-	test("still injects Bearer for a real key", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{ provider: "custom", id: "m", baseUrl: "http://localhost:8788" },
-			{ apiKey: "sk-real", messages: [] },
-		);
-		expect(setup.headers.Authorization).toBe("Bearer sk-real");
-	});
-
-	test("caller-supplied Authorization in model.headers is preserved even when keyless", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{
-				provider: "qwen",
-				id: "m",
-				baseUrl: "http://localhost:8788",
-				headers: { Authorization: "Bearer custom-token" },
-			},
-			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
-		);
-		expect(setup.headers.Authorization).toBe("Bearer custom-token");
-	});
-});