@oh-my-pi/pi-ai 18.11.1 → 18.11.2

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [18.11.2] - 2026-10-16
+
+### Breaking Changes
+
+- `resolveGatewayApiKey` and `buildGatewayApiKeyResolver` (`@oh-my-pi/pi-ai/auth-gateway`) take the request's route options (`{ storage, client? }`) instead of an `AuthStorage`, their resolver callback receives the resolved credential, and `resolveGatewayAccount` takes that credential ([#15900](https://github.com/can1357/oh-my-pi/pull/15900) by [@alphastorm](https://github.com/alphastorm))
+
+### Added
+
+- Added scoped clients to `startAuthGateway` (`clients`, `setClients`): each client bearer is limited to its own models and OAuth accounts, with no fallback to other accounts or API keys, and request log lines name the client and the credential a request started on ([#5098](https://github.com/can1357/oh-my-pi/issues/5098), [#15900](https://github.com/can1357/oh-my-pi/pull/15900) by [@alphastorm](https://github.com/alphastorm))
+- Added experimental native image judgments for TypeSafe Jev's `jev-latest`, `jev-preview`, `jev-1.13.0`, and `jev-1.14.0`, plus OpenRouter's `typesafe/jev-1.13`, `typesafe/jev-1.14`, and `~typesafe/jev-latest` models; images outside Jev's documented size bounds fall through to a vision chat judge instead of failing ([#15887](https://github.com/can1357/oh-my-pi/pull/15887) by [@anatoli-tsinovoy](https://github.com/anatoli-tsinovoy))
+
+### Fixed
+
+- Fixed error results from non-first-party providers regaining partial output the provider had discarded; an error with empty content now stays empty ([#14516](https://github.com/can1357/oh-my-pi/issues/14516), [#14572](https://github.com/can1357/oh-my-pi/pull/14572) by [@oleg494](https://github.com/oleg494))
+- Fixed the auth gateway's `POST /v1/audio/speech` answering 502 for requests the speech adapter rejects (unsupported format, over-long input); they now get 400 `invalid_request_error` ([#14508](https://github.com/can1357/oh-my-pi/pull/14508) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed a single-string tool call with two or more mislabelled string fields silently dispatching whichever field came first in the JSON; such ambiguous calls now fail validation and the model sees its own arguments back ([#14414](https://github.com/can1357/oh-my-pi/pull/14414) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed GLM-5.2 on Ollama Cloud losing its reasoning between turns; Ollama Cloud now keeps assistant thinking in history for models verified to accept it ([#14440](https://github.com/can1357/oh-my-pi/pull/14440) by [@Dante-dan](https://github.com/Dante-dan))
+- Fixed GPT Image generation and edits failing on gateways that validate request parameters, such as LiteLLM; `response_format` is no longer sent to GPT Image models ([#14619](https://github.com/can1357/oh-my-pi/pull/14619) by [@jimhester](https://github.com/jimhester))
+- Fixed OpenRouter errors such as "Access denied by security policy" dropping the routed upstream's own explanation from `error.metadata.raw` ([#10906](https://github.com/can1357/oh-my-pi/issues/10906), [#14435](https://github.com/can1357/oh-my-pi/pull/14435) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed GitHub Copilot usage reporting an AI-credit allowance as "Premium Requests" in request units; the unit each billing item reports is now honoured ([#13849](https://github.com/can1357/oh-my-pi/issues/13849), [#14501](https://github.com/can1357/oh-my-pi/pull/14501) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed an OpenAI-compatible server's `finish_reason: "repetition"` or `stop_reason: "repetition_detected"` not being treated as a thinking loop, so the degenerate partial reasoning was kept and replayed into the next turn ([#12525](https://github.com/can1357/oh-my-pi/issues/12525), [#14535](https://github.com/can1357/oh-my-pi/pull/14535) by [@F0Rextasy](https://github.com/F0Rextasy))
+
 ## [18.11.1] - 2026-10-15
 
 ### Added
@@ -2357,49 +2379,4 @@
 
 - Added utility functions to strip schema descriptions for optimized LLM context usage
 
-## [16.0.10] - 2026-06-18
-
-### Added
-
-- Replaced the old legacy XML-ish `pi` owned tool-calling dialect with the new sigil-delimited format (`§` call header with inline `key=value` scalars, `«…»` verbatim body fence for the dominant string argument, `¤` reasoning, `‡‡` tool result) using single-token markers that never occur in source code. Verbatim fences escalate Markdown-style (`««…»»`) so re-rendered history never collides with payload content, and the scanner gates a bare `§` on an exact known-tool name to avoid swallowing prose. Round-trips and streams through the existing scanner contract at ~46% fewer tokens than the legacy format on typical calls; selectable via `tools.format` or `PI_DIALECT=pi`.
-
-### Changed
-
-- Updated `pi` dialect formatting to use a token-frugal, sigil-delimited format (`§`, `¤`, `‡‡`)
-- Updated `pi` dialect body fences to automatically escalate when content contains fence markers
-- Changed `pi` dialect tool results response format to `‡‡` blocks
-
-### Fixed
-
-- Fixed Bedrock application inference profile ARNs to route requests to the ARN's region instead of the default Bedrock runtime region. ([#3004](https://github.com/can1357/oh-my-pi/issues/3004))
-
-## [16.0.9] - 2026-06-18
-
-### Fixed
-
-- Fixed OAuth login replacing all other active accounts for the same provider, allowing multiple OAuth accounts to coexist concurrently.
-- Fixed legacy `api_key` credentials not being replaced/disabled atomically upon upgrading to OAuth login.
-- Fixed a logic issue where AuthStorage lost session-to-credential stickiness upon CLI restarts, causing cold-starts for server-side prompt cache (KV cache) and wasting tokens.
-- Fixed GitHub Copilot Responses requests rejecting image inputs that carry the `detail: "original"` hint with an HTTP 400 by degrading the hint to `"auto"` for hosts that do not support it; other hosts still preserve native-resolution frames (snapcompact). ([#2822](https://github.com/can1357/oh-my-pi/issues/2822))
-
-## [16.0.8] - 2026-06-18
-
-### Fixed
-
-- Improved reliability of auth-broker snapshot loading by implementing a robust manual schema check
-- Fixed MCP tool argument validation to drop optional empty-string parameters before schema validation, matching the existing optional null handling and avoiding pattern/type failures for omitted model-filled fields. ([#2981](https://github.com/can1357/oh-my-pi/issues/2981))
-- Fixed API-key credential replacement to hard-delete superseded disabled `api_key` rows so `auth_credentials` does not grow indefinitely after key rotation. ([#2941](https://github.com/can1357/oh-my-pi/issues/2941))
-- Fixed Cursor provider streaming to close text blocks before tool calls so post-tool text opens a new content block and TUI transcript cards render inline instead of grouped near the bottom. ([#2924](https://github.com/can1357/oh-my-pi/issues/2924))
-
-## [16.0.7] - 2026-06-18
-
-### Changed
-
-- Switched Google OAuth callback hostname from `localhost` to `127.0.0.1` to prevent IPv6 loopback fallback delays and proxy routing interception.
-
-### Fixed
-
-- Fixed OpenCode Go usage reporting to synthesize `/usage` limits from OMP-observed request costs for the 5h, weekly, and monthly provider caps. ([#2942](https://github.com/can1357/oh-my-pi/issues/2942))
-- Fixed MiniMax Anthropic-compatible requests to serialize adaptive thinking without an invalid Anthropic `output_config.effort` tier ([#2928](https://github.com/can1357/oh-my-pi/issues/2928)).
-
-Older entries are archived in [packages/ai/CHANGELOG.md@592e894eb29e](https://github.com/can1357/oh-my-pi/blob/592e894eb29ed3db2ee2dae71ec7d72ac13c64c8/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@aa43b0057f82](https://github.com/can1357/oh-my-pi/blob/aa43b0057f82cb167459f8e6b41c5ec9f4e0f91d/packages/ai/CHANGELOG.md).

package/README.md

@@ -565,6 +565,8 @@ if (message.stopReason === "error" || message.stopReason === "aborted") {
 }
 ```
 
+If the provider discards partial output by returning an error message with empty `content`, the final result remains empty. Leaked-thinking healing does not reconstruct discarded blocks from earlier streaming deltas.
+
 ### Aborting Requests
 
 The abort signal allows you to cancel in-progress requests. Aborted requests have `stopReason === 'aborted'`:

package/dist/types/auth-gateway/clients.d.ts

@@ -0,0 +1,67 @@
+import type { SessionsApi } from "../auth/types.js";
+import type { Api, Model } from "../types.js";
+/** One scoped client. */
+export interface AuthGatewayClient {
+    /** Operator-chosen name, logged with the client's requests. */
+    name: string;
+    /** Hex SHA-256 digest of the client's bearer token. */
+    tokenSha256: string;
+    /** `provider/id` or `provider/*` grants; absent allows every served model, `[]` none. */
+    models?: readonly string[];
+    /** Provider id → OAuth identity keys the client's requests to that provider may use. */
+    accounts?: Readonly<Record<string, readonly string[]>>;
+}
+/** An admitted scoped client, as the gateway's routes see it. */
+export interface AuthGatewayClientScope {
+    readonly name: string;
+    /** False when the client may call every served model. */
+    readonly limitsModels: boolean;
+    /** Whether the client may call `model`. */
+    allows(model: Model<Api>): boolean;
+    /**
+     * Session id the client's credential lookups for `provider` resolve under:
+     * its own restricted session when `accounts` lists the provider, otherwise
+     * the request's `sessionId`. Throws for a provider `accounts` omits, and for
+     * a bound provider once the restriction is lifted, so a lookup can never
+     * resolve unrestricted on the client's behalf.
+     */
+    credentialSessionId(provider: string, sessionId: string): string;
+    /**
+     * Hold the client's account restriction while a request uses it; call the
+     * returned release once the request can no longer resolve a credential. A
+     * reload that retires the client lifts the restriction only after every
+     * hold is released. Take the first hold in the same tick as
+     * `authenticate`, before a reload can retire the client.
+     */
+    retain(): () => void;
+}
+/**
+ * Parse a clients file: a JSON object mapping each client name to
+ * `{ tokenSha256, models?, accounts? }`. Any malformed entry or unknown field
+ * rejects the whole file, since a misspelled `models` would otherwise allow
+ * every model. Errors name the offending field, never its value.
+ */
+export declare function parseAuthGatewayClients(text: string): AuthGatewayClient[];
+/** Hex SHA-256 digest of a bearer token, as `tokenSha256` records it. */
+export declare function hashAuthGatewayToken(token: string): string;
+type RestrictionSessions = Pick<SessionsApi, "restrict" | "unrestrict">;
+/**
+ * The scoped clients one gateway admits, looked up by the digest of the
+ * presented bearer.
+ */
+export declare class AuthGatewayClientTable {
+    #private;
+    constructor(sessions: RestrictionSessions, gatewayTokens: Iterable<string>);
+    /**
+     * Replace the admitted clients. An invalid table throws and changes
+     * nothing. An unchanged client keeps its scope; a new or changed one is
+     * restricted before its token is admitted; the scopes left out are retired.
+     * Ignored once the table is closed.
+     */
+    set(clients: readonly AuthGatewayClient[]): void;
+    /** The client `token` authenticates, if any. */
+    authenticate(token: string): AuthGatewayClientScope | undefined;
+    /** Admit no more clients and retire every scope. */
+    close(): void;
+}
+export {};

package/dist/types/auth-gateway/dispatch.d.ts

@@ -3,6 +3,7 @@ import type { AuthStorage } from "../auth-storage.js";
 import { type GatewayErrorClassification } from "../error/gateway.js";
 import type { Api, FetchImpl, Model, Usage } from "../types.js";
 import type { ClientUsageIdentity } from "../usage.js";
+import type { AuthGatewayClientScope } from "./clients.js";
 import type { AuthGatewayServerOptions } from "./types.js";
 export type ModelResolver = (modelId: string) => Model<Api> | undefined;
 /** What the gateway's routes need, whatever transport carries the requests. */
@@ -21,7 +22,15 @@ export interface AuthGatewayRouteOptions {
     excludeProviders?: ReadonlySet<string>;
     /** Upstream transport for every provider call; defaults to global `fetch`. Test seam. */
     fetch?: FetchImpl;
+    /**
+     * The scoped client that sent this request, set per request by the HTTP
+     * server: it narrows `resolveModel` / `listModels`, and every credential
+     * lookup below resolves under its {@link AuthGatewayClientScope.credentialSessionId}.
+     */
+    client?: AuthGatewayClientScope;
 }
+/** The route options a request's credential lookups read. */
+export type AuthGatewayCredentialOptions = Pick<AuthGatewayRouteOptions, "storage" | "client">;
 /** The HTTP server's options: the routes' plus its listener and inbound auth. */
 export interface AuthGatewayBootOptions extends AuthGatewayServerOptions, AuthGatewayRouteOptions {
 }
@@ -37,13 +46,20 @@ export declare function normalizeClientSessionKey(clientKey: string | undefined)
  *
  * `markUsageLimitReached` and the auth-retry resolver switch a session to a
  * sibling credential, so the provider state retained for that session can
- * outlive the account that taught it. OAuth rows expose an account id / email
- * that survives token refresh — fingerprinting the bearer instead would look
+ * outlive the account that taught it. A stored credential keeps its durable
+ * row id across token refreshes — fingerprinting the bearer instead would look
  * like a rotation every time a token refreshes and discard the retained
- * lessons for nothing. Key-based rows fall back to a hash of the key, never
- * the key itself: this value is held for the lifetime of the entry.
+ * lessons for nothing. The id comes from the selection itself, not the
+ * session's current pin, which a concurrent request on the same session may
+ * have moved. Unstored keys fall back to a hash of the key, never the key
+ * itself: this value is held for the lifetime of the entry.
  */
-export declare function resolveGatewayAccount(storage: AuthStorage, provider: string, sessionId: string, apiKey: string): string;
+export declare function resolveGatewayAccount(resolved: ResolvedApiKey): string;
+/** Who sent a request and which stored credential it started on, for the `auth-gateway request` log line. */
+export declare function gatewayRequestLogFields(opts: AuthGatewayCredentialOptions, resolved: ResolvedApiKey): {
+    client?: string;
+    credentialId?: number;
+};
 /**
  * Resolve the credential for one request from broker-backed storage.
  *
@@ -53,7 +69,7 @@ export declare function resolveGatewayAccount(storage: AuthStorage, provider: st
  * stored token before dispatch. Storage failures map through
  * {@link classifyGatewayError}; a provider without any credential is a 401.
  */
-export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<Api>, sessionId: string, signal: AbortSignal, peer: string): Promise<ResolvedApiKey | GatewayErrorClassification>;
+export declare function resolveGatewayApiKey(opts: AuthGatewayCredentialOptions, model: Model<Api>, sessionId: string, signal: AbortSignal, peer: string): Promise<ResolvedApiKey | GatewayErrorClassification>;
 /**
  * Build the {@link ApiKeyResolver} handed to a pi-ai client for a gateway
  * request. Drives the central a/b/c auth-retry policy server-side:
@@ -67,11 +83,13 @@ export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<
  * `lastKey` tracks the most recent bearer so the switch step invalidates the
  * credential that actually failed; a retry context's `previousKey` wins, since
  * concurrent operations sharing one resolver (split judgment chunks) each know
- * the bearer they sent. `onResolvedKey` observes every rotation; routes that
- * retain provider session state use it to re-key the account lease, one-shot
- * routes pass `undefined`.
+ * the bearer they sent. Every step resolves under the scoped client's
+ * credential session when `opts.client` binds the provider, so refresh,
+ * blocking and sibling rotation stay inside its accounts. `onResolvedKey`
+ * observes every rotation; routes that retain provider session state use it
+ * to re-key the account lease, one-shot routes pass `undefined`.
  */
-export declare function buildGatewayApiKeyResolver(storage: AuthStorage, model: Model<Api>, sessionId: string, initialKey: ResolvedApiKey, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (apiKey: string) => void): ApiKeyResolver;
+export declare function buildGatewayApiKeyResolver(opts: AuthGatewayCredentialOptions, model: Model<Api>, sessionId: string, initialKey: ResolvedApiKey, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (resolved: ResolvedApiKey) => void): ApiKeyResolver;
 /**
  * Attribute one settled upstream request to the originating client via the
  * broker's observed-usage channel (`AuthStorage.usage.observe`, batched

package/dist/types/auth-gateway/http.d.ts

@@ -24,6 +24,8 @@ export declare function hasMisplacedBearer(req: Request, url: URL, tokens: Reado
  * of the longer input so length itself doesn't leak via timing.
  */
 export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/** The token of an `Authorization: Bearer <token>` header, trimmed; `undefined` without one. */
+export declare function readBearerToken(req: Request): string | undefined;
 export declare function isAuthorized(req: Request, tokens: ReadonlySet<string>): boolean;
 /**
  * Extract allow-listed passthrough headers from an inbound request. Keys are

package/dist/types/auth-gateway/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./clients.js";
 export * from "./dispatch.js";
 export * from "./http.js";
 export * from "./session-state.js";

package/dist/types/auth-gateway/server.d.ts

@@ -27,12 +27,17 @@
  * answers the `/v1/*` routes for any transport: {@link startAuthGateway}
  * serves them over HTTP behind bearer auth, `stdio.ts` over JSON lines.
  */
+import { type AuthGatewayClientScope } from "./clients.js";
 import { type AuthGatewayBootOptions, type AuthGatewayRouteOptions } from "./dispatch.js";
 import type { AuthGatewayServerHandle } from "./types.js";
 /** The gateway's `/v1/*` routes, for a transport that has already admitted the caller. */
 export interface AuthGatewayRouter {
-    /** Answers one request; `peer` names the caller in logs. Never rejects: a crashed route answers 500. */
-    route(req: Request, peer: string): Promise<Response>;
+    /**
+     * Answers one request; `peer` names the caller in logs, `client` is the
+     * scoped client the transport admitted, if any. Never rejects: a crashed
+     * route answers 500.
+     */
+    route(req: Request, peer: string, client?: AuthGatewayClientScope): Promise<Response>;
     /**
      * Closes the retained provider session state (Codex WebSockets, GitLab Duo
      * workflows), whose sockets and timers would otherwise keep the process alive.
@@ -40,8 +45,8 @@ export interface AuthGatewayRouter {
     close(): void;
 }
 /**
- * The gateway's routes over `opts`, owning their per-session provider state:
+ * The gateway's routes over `hostOpts`, owning their per-session provider state:
  * two routers in one process never share (or tear down) each other's.
  */
-export declare function createAuthGatewayRouter(opts: AuthGatewayRouteOptions): AuthGatewayRouter;
+export declare function createAuthGatewayRouter(hostOpts: AuthGatewayRouteOptions): AuthGatewayRouter;
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/session-state.d.ts

@@ -77,6 +77,12 @@ export interface AuthGatewaySessionStateRequest {
      * resolves a sibling credential.
      */
     account: string;
+    /**
+     * Name of the scoped gateway client that sent the request, if any. A
+     * client's conversations never share retained state with another client's,
+     * or with unscoped traffic, even when their keys or histories match.
+     */
+    client?: string;
 }
 /**
  * Bounded per-session provider state, owned by one gateway server instance.

package/dist/types/auth-gateway/types.d.ts

@@ -1,4 +1,5 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
+import type { AuthGatewayClient } from "./clients.js";
 import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, OpenAIResponseInclude, ServiceTier, TokenTaskBudget } from "../types.js";
 /**
  * Wire types for the omp auth-gateway.
@@ -123,8 +124,14 @@ export interface AuthGatewayFormatModule {
 export interface AuthGatewayServerOptions {
     /** Listen address. Default `127.0.0.1:4000`. */
     bind?: string;
-    /** Accept any of these bearer tokens. Empty allows unauthenticated calls. */
+    /** Accept any of these bearer tokens. Empty allows unauthenticated calls unless `clients` is set. */
     bearerTokens: string[];
+    /**
+     * Scoped clients, each admitted by its own bearer and limited to its models
+     * and accounts (see `clients.ts`). Any table, even an empty one, requires a
+     * bearer on every request. Throws at startup when invalid.
+     */
+    clients?: readonly AuthGatewayClient[];
     /** Honor forwarded peer headers only when the connecting proxy is trusted. Default false. */
     trustProxyHeaders?: boolean;
     /** Version surfaced on `/healthz`. */
@@ -135,4 +142,11 @@ export interface AuthGatewayServerHandle {
     port: number;
     hostname: string;
     close(): Promise<void>;
+    /**
+     * Replace the scoped clients. A removed or changed token is refused from
+     * the next request on; a request already in flight keeps the models and
+     * accounts it was admitted with, retries included, until it finishes.
+     * Throws, changing nothing, when the table is invalid. Turns bearer auth on.
+     */
+    setClients(clients: readonly AuthGatewayClient[]): void;
 }

package/dist/types/judgment/native.d.ts

@@ -3,7 +3,8 @@ import { type ApiKey } from "../auth-retry.js";
 import * as AIError from "../error/index.js";
 import type { ImageContent, Model, Usage } from "../types.js";
 import { type Judge, type JudgeOptions, type JudgmentRequest, type JudgmentResult, type Questions } from "./types.js";
-import type { JudgmentWire } from "./wire.js";
+import type { JudgmentImageAssets, JudgmentWire } from "./wire.js";
+export type { JudgmentImageAssets } from "./wire.js";
 export declare const TYPESAFE_PROVIDER = "typesafe";
 export declare const TYPESAFE_DEFAULT_MODEL = "jev-latest";
 declare const JUDGMENT_WIRES: {
@@ -19,11 +20,16 @@ export declare function isJudgmentApi(api: Api): api is JudgmentApi;
 /** Whether both the native protocol and catalog model support image input. */
 export declare function nativeJudgmentSupportsImages(model: Model): boolean;
 /**
- * Reject `images` that `model`'s native judgment API cannot take — no image support, or a
- * documented per-dialect cap exceeded — before any credential or upstream work.
+ * Whether `model`'s native judgment API takes these exact images: image support plus every documented
+ * per-dialect bound. A judge chain skips a candidate that would refuse them instead of failing on it.
+ */
+export declare function nativeJudgmentAcceptsImages(model: Model, images: readonly ImageContent[]): boolean;
+/**
+ * Reject images that `model`'s native judgment API cannot take — no image support, an unsupported or
+ * unreferenced asset, or a documented per-dialect cap exceeded — before any credential or upstream work.
  * @throws {AIError.ValidationError} naming the reason.
  */
-export declare function checkNativeJudgmentImages(model: Model, images: readonly ImageContent[]): void;
+export declare function checkNativeJudgmentImages(model: Model, request: JudgmentRequest, imageAssets?: JudgmentImageAssets): void;
 /** `TYPESAFE_BASE_URL` when set, else the public API root; trailing slashes stripped. */
 export declare function typesafeBaseUrl(): string;
 /** `TYPESAFE_DEFAULT_MODEL` when set, else {@link TYPESAFE_DEFAULT_MODEL}. */
@@ -52,13 +58,15 @@ export interface NativeJudgeOptions extends NativeJudgeConnection {
      */
     maxQuestions?: number;
     /**
-     * Whether the catalogued model accepts images. `false` disables image input;
-     * a `true` value cannot enable a wire dialect that does not support images.
+     * Whether images are enabled for this judge. `false` disables image input; `true` enables
+     * dialects that require explicit opt-in but cannot enable a wire without image support.
      */
     supportsImages?: boolean;
 }
 /** Per-call options for {@link NativeJudge.judge}. */
 export interface NativeJudgeCallOptions extends JudgeOptions {
+    /** Assets keyed by their existing references; wires without asset transport reject them. */
+    imageAssets?: JudgmentImageAssets;
     /**
      * Called before a split judgment rejects, with the summed usage of the chunks that had already
      * succeeded: billed upstream, but their answers are discarded with the failure. Not called when
@@ -73,7 +81,7 @@ export declare class JudgmentApiError extends AIError.ProviderHttpError {
 export declare class NativeJudge implements Judge {
     #private;
     readonly label: string;
-    /** True when the selected native wire and model both accept image inputs. */
+    /** True when the selected native wire and model or direct-call option permit image input. */
     readonly supportsImages?: boolean;
     readonly api: JudgmentApi;
     readonly provider: string;
@@ -92,4 +100,3 @@ export declare class NativeJudge implements Judge {
  * @throws ConfigurationError when the model's API is not a judgment API.
  */
 export declare function createNativeJudge(model: Model, connection: NativeJudgeConnection): NativeJudge;
-export {};

package/dist/types/judgment/systemone.d.ts

@@ -1,7 +1,14 @@
-import { type JudgmentWire } from "./wire.js";
+import { type JudgmentRequest } from "./types.js";
+import { type JudgmentImageAssets, type JudgmentWire } from "./wire.js";
+/**
+ * The subset of `assets` that `request` references. TypeSafe substitutes a reference wherever it
+ * occurs as text in a string of `state`, a question's `instructions`, or its `criteria` (never in
+ * object keys) and rejects a request carrying an unreferenced asset.
+ */
+export declare function referencedImageAssets(request: JudgmentRequest, assets: JudgmentImageAssets): JudgmentImageAssets;
 /** TypeSafe's own route, shared by every System One server. */
 export declare const typesafeWire: JudgmentWire;
-/** OpenRouter Decisions: the System One body under `/api/alpha`. */
+/** OpenRouter Decisions: System One body under `/api/alpha`, with image parts preserved in state. */
 export declare const openrouterDecisionsWire: JudgmentWire;
 /** Cloudflare Workers AI decision models (Clef) through the account-scoped `ai/run` route. */
 export declare const workersAiWire: JudgmentWire;

package/dist/types/judgment/wire.d.ts

@@ -3,7 +3,7 @@
  * encodes, and decodes one request for each API it serves. Internal to the
  * judgment module; `native.ts` maps every judgment API to its dialect.
  */
-import type { Usage } from "../types.js";
+import type { ImageContent, Usage } from "../types.js";
 import type { JudgmentRequest } from "./types.js";
 /** Where one attempt posts and which bearer token it sends. */
 export interface JudgmentTarget {
@@ -35,7 +35,23 @@ export interface JudgmentImageInput {
     maxTotalBytes?: number;
     /** Pixels per image, when the image header reports dimensions. */
     maxPixels?: number;
+    /** Minimum pixels per image, when the image header reports dimensions. */
+    minPixels?: number;
+    /** Inclusive bounds on each side, when the image header reports dimensions. */
+    minSide?: number;
+    maxSide?: number;
 }
+/** Shared TypeSafe Jev/OpenRouter image limits (https://docs.typesafe.ai/images#limits); out-of-range images are rejected upstream, never resized. */
+export declare const JEV_IMAGE_INPUT: {
+    readonly mimeTypes: readonly ["image/png", "image/jpeg"];
+    readonly maxBytes: number;
+    readonly minPixels: 78400;
+    readonly maxPixels: 2458624;
+    readonly minSide: 280;
+    readonly maxSide: 1568;
+};
+/** Image assets kept separately from judgment state for asset-aware native wires. */
+export type JudgmentImageAssets = Readonly<Record<string, ImageContent>>;
 /** How one judgment API addresses, encodes, and decodes a request. */
 export interface JudgmentWire {
     /**
@@ -43,10 +59,16 @@ export interface JudgmentWire {
      * Throws when the credential cannot address the endpoint (e.g. no account id).
      */
     target(baseUrl: string, model: string, key: string): JudgmentTarget;
-    /** Request body for `model`. */
-    encode(request: JudgmentRequest, model: string): unknown;
+    /** Request body for `model`, with optional asset context for dialects that preserve references. */
+    encode(request: JudgmentRequest, model: string, imageAssets?: JudgmentImageAssets): unknown;
+    /** Headers this dialect adds to requests that carry images. */
+    imageHeaders?: Readonly<Record<string, string>>;
     /** Image input this dialect accepts; absent means text-only. */
     images?: JudgmentImageInput;
+    /** Whether raw asset maps can be transported without loss by this dialect. */
+    supportsImageAssets?: boolean;
+    /** Whether image support must be enabled explicitly for direct NativeJudge construction. */
+    imagesRequireOptIn?: boolean;
     /** The response's answers and usage; `undefined` when the payload is not this API's response shape. */
     decode(payload: unknown): DecodedJudgment | undefined;
 }

package/dist/types/providers/openai-shared.d.ts

@@ -399,6 +399,22 @@ interface StrictToolsRetryContext {
     strictToolsApplied: boolean;
     tools: Tool[] | undefined;
 }
+/**
+ * Read OpenRouter's `error.metadata.raw` from a captured non-2xx body.
+ *
+ * OpenRouter routes to a different upstream per request, so its top-level
+ * `error.message` is a generic policy sentence ("Access denied by security
+ * policy") and the only place the routed provider's own words appear is
+ * `error.metadata.raw`. Providers that proxy through OpenRouter also hang the
+ * upstream provider name there.
+ *
+ * The detail lives in the decoded body captured on the thrown
+ * {@link AIError.OpenAIHttpError}, not on the error object itself: no error
+ * class in this package carries an `error` property, so reading
+ * `error.error.metadata.raw` unconditionally yielded `undefined` and the
+ * upstream detail was dropped from every surfaced message.
+ */
+export declare function readOpenRouterRawMetadata(capturedErrorResponse: CapturedHttpErrorResponse | undefined): string | undefined;
 /** Decide whether an OpenAI-family request should retry once with non-strict tools. */
 export declare function shouldRetryWithoutStrictTools(error: unknown, capturedErrorResponse: CapturedHttpErrorResponse | undefined, context: StrictToolsRetryContext): boolean;
 export declare const OPENAI_RESPONSES_PROGRESS_EVENT_TYPES: ReadonlySet<string>;

package/dist/types/providers/systemone-server.d.ts

@@ -1,7 +1,9 @@
 import type { JudgmentRequest, JudgmentResult } from "../judgment/types.js";
+import type { JudgmentImageAssets } from "../judgment/wire.js";
 export interface SystemOneParsedRequest {
     modelId: string;
     request: JudgmentRequest;
+    imageAssets?: JudgmentImageAssets;
 }
 /** `POST /v1/systemone` response body; `cost` (USD) appears only when the route billed one. */
 export interface SystemOneResponseBody {
@@ -15,10 +17,11 @@ export interface SystemOneResponseBody {
 }
 /**
  * Validate the routing-relevant parts of a System One request body, including
- * optional embedded base64 images.
+ * top-level embedded images and inline TypeSafe image assets.
  *
  * @throws {AIError.ValidationError} when required routing fields are missing
- * or malformed, or a supplied image is malformed.
+ * or malformed, supplied image data is invalid, or an asset uses multipart
+ * `part`, which this JSON ingress cannot read.
  */
 export declare function parseRequest(body: unknown): SystemOneParsedRequest;
 /** Re-encode a judgment result in TypeSafe's response shape. */

package/dist/types/providers/transform-messages.d.ts

@@ -9,6 +9,10 @@ import type { Api, AssistantMessage, Message, Model } from "../types.js";
  * MUST not push a normalized id past this bound.
  */
 export declare const MAX_TOOL_CALL_ID_LENGTH = 64;
+/** Replace unsupported tool-call ID characters and cap the result for strict replay providers. */
+export declare function normalizeToolCallId(id: string, maxLength?: number): string;
+/** Whether `id` already satisfies the strict 1–64 `[a-zA-Z0-9_-]` tool-call ID contract. */
+export declare function isValidToolCallId(id: string): boolean;
 /**
  * OpenAI Responses-family APIs mint composite tool ids (`call_id|item_id`);
  * opaque Chat Completions ids do not (openai-completions preserves same-model

package/dist/types/utils.d.ts

@@ -1,4 +1,5 @@
 import type { ResponseInput } from "./providers/openai-responses-wire.js";
+export { normalizeToolCallId } from "./providers/transform-messages.js";
 import type { CacheRetention, OpenAIResponsesHistoryPayload, ProviderPayload } from "./types.js";
 export { isRecord } from "@oh-my-pi/pi-utils";
 /**
@@ -9,7 +10,6 @@ export { isRecord } from "@oh-my-pi/pi-utils";
  */
 export declare function getHeaderCaseInsensitive(headers: Record<string, string> | undefined, headerName: string): string | undefined;
 export declare function normalizeSystemPrompts(systemPrompt: readonly string[] | string | undefined | null): string[];
-export declare function normalizeToolCallId(id: string): string;
 type ResponsesToolItemIdPrefix = "fc" | "ctc";
 /** Preserve opaque call IDs for Responses replay while normalizing or generating the separate item ID. */
 export declare function normalizeResponsesToolCallId(id: string, itemPrefix?: ResponsesToolItemIdPrefix): {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.11.1",
+	"version": "18.11.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.11.1",
-		"@oh-my-pi/pi-catalog": "18.11.1",
-		"@oh-my-pi/pi-natives": "18.11.1",
-		"@oh-my-pi/pi-utils": "18.11.1",
-		"@oh-my-pi/pi-wire": "18.11.1"
+		"@oh-my-pi/omptype": "18.11.2",
+		"@oh-my-pi/pi-catalog": "18.11.2",
+		"@oh-my-pi/pi-natives": "18.11.2",
+		"@oh-my-pi/pi-utils": "18.11.2",
+		"@oh-my-pi/pi-wire": "18.11.2"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"