@oh-my-pi/pi-ai 18.2.7 → 18.2.9

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 ## [Unreleased]
 
+## [18.2.9] - 2026-09-22
+
+### Added
+
+- Added Claude saved-reset discovery and redemption, including session-only resets, grant eligibility, expiry, and safe retry handling.
+
+### Fixed
+
+- Fixed custom OpenAI-compatible extension streamers failing when no compatibility configuration was provided.
+- Fixed local provider sign-in for LM Studio, llama.cpp, and vLLM so an empty API key is not treated as successful authentication.
+- Fixed Vercel AI Gateway models backed by non-Anthropic providers failing tool calls because of strict schema validation; requests now retry with compatible non-strict tool handling.
+- Improved AWS Bedrock authentication by refreshing expired AWS SSO sessions automatically, reducing the need to run `aws sso login` again.
+- Fixed Bedrock tool-enabled requests when tool descriptions are included in the system prompt.
+- Improved Alibaba Token Plan (Beijing) quota reporting across workspaces and made gateway rejection codes visible in error logs.
+- Fixed the tool-call loop guard so repeated identical calls continue to be redirected after the detection threshold is reached.
+- Fixed valid required null values inside tool argument unions being removed before dispatch ([#12523](https://github.com/can1357/oh-my-pi/pull/12523) by [@cswenor](https://github.com/cswenor)).
+- Signing in to a local provider (lm-studio, llama.cpp, vllm) with an empty key paste no longer reports the provider as logged in while its requests go out unauthenticated. ([#12436](https://github.com/can1357/oh-my-pi/pull/12436) by [@xiechimon](https://github.com/xiechimon))
+- Fixed every turn failing with `400 Invalid schema for function '<tool>' … Missing '<param>'` on Vercel AI Gateway models served from a non-Anthropic upstream (e.g. `openai/gpt-5.6-sol`): the translated strict-tool rejection now triggers the existing non-strict retry instead of failing the turn ([#12760](https://github.com/can1357/oh-my-pi/pull/12760) by [@primitive-type](https://github.com/primitive-type)).
+- Expired AWS SSO access tokens are now refreshed via the SSO OIDC `refresh_token` grant instead of failing with `sso-token-expired`, so Bedrock profiles keep working between `aws sso login` runs the same way the AWS CLI does ([#12736](https://github.com/can1357/oh-my-pi/pull/12736) by [@nwbb](https://github.com/nwbb)).
+- Fixed Bedrock rejecting tool-enabled requests when tool descriptions are inlined into the system prompt ([#12732](https://github.com/can1357/oh-my-pi/pull/12732) by [@mustafaabidali](https://github.com/mustafaabidali)).
+- Alibaba Token Plan (Beijing) quota reporting no longer pins requests to a single workspace, and HTTP-200 gateway rejections now log their error code ([#12395](https://github.com/can1357/oh-my-pi/pull/12395) by [@Dante-dan](https://github.com/Dante-dan)).
+- The tool-call loop guard keeps redirecting when a model continues the same identical call past the detection threshold instead of firing only once ([#12709](https://github.com/can1357/oh-my-pi/pull/12709) by [@F0Rextasy](https://github.com/F0Rextasy)).
+- Fixed OpenAI-compatible Gemini gateways losing message-level thought signatures when replaying tool-call history.
+- Added support for explicitly disabling reasoning with `reasoning_effort: "none"` through Chat Completions authentication gateways.
+- Improved Bedrock resilience by retrying transient in-stream internal server, service unavailable, and throttling errors.
+- Fixed Anthropic prompt-cache keep-alive refreshes for turns that used forced tool selection.
+- Fixed auth-broker usage reports incorrectly sharing usage limits between Team members with shared workspace and organization identifiers.
+- Fixed OpenAI Codex requests hanging when an error response body is delayed.
+- Fixed Kimi usage reporting so monthly totals and code quotas are shown alongside the five-hour usage window.
+- Bedrock no longer sends provider-invalid payloads when an errored tool result contains an image; the image is hoisted into a sibling block ([#12865](https://github.com/can1357/oh-my-pi/pull/12865) by [@roboomp](https://github.com/roboomp)).
+- Gemini, Vertex, and Cloud Code Assist requests no longer include the unsupported `minP`/`repetitionPenalty` sampling fields, which caused 400s when set globally ([#12850](https://github.com/can1357/oh-my-pi/pull/12850) by [@roboomp](https://github.com/roboomp)).
+
+## [18.2.8] - 2026-09-21
+
+### Added
+
+- Added support for text embeddings, document reranking, video generation, image generation across multiple providers, audio speech synthesis, and audio transcription services.
+- Added support for the System One judgment API, including configurable request headers for proxy routing and custom authentication.
+
+### Changed
+
+- Updated API response cost reporting to use aggregate usage totals.
+- Model list responses now optionally include a model kind.
+
+### Fixed
+
+- Fixed detection of Claude usage-limit errors.
+
 ## [18.2.7] - 2026-09-21
 
 ### Breaking Changes
@@ -2239,21 +2287,4 @@
 - Made the openai-completions non-strict retry reachable for `"mixed"` strict mode (previously gated to `all_strict`, i.e. Cerebras only) and taught it to recognize upstream tool-schema validation 400s (`Invalid tool parameters schema …`, `Invalid schema for function …`). A matching rejection now retries the request with base (non-strict) schemas and persists `strictToolsDisabled` on the provider session, so later requests skip the doomed strict attempt instead of paying a 400 + retry round-trip each turn. ([#2270](https://github.com/can1357/oh-my-pi/issues/2270))
 - Cross-model `anthropic-messages → anthropic-messages` continuations now preserve prior assistant turns' reasoning chains end-to-end: every prior `thinking`/`redactedThinking` block survives (not just the latest surviving assistant), and third-party ↔ third-party replays keep their signatures intact so the reasoning chain stays signed for the next turn. Signatures are stripped (and any `redacted_thinking` sibling without a native landing spot is dropped) only when an official Anthropic endpoint is on either end of the replay — official Anthropic cryptographically binds reasoning signatures to its key+session+model, while compatible reasoning endpoints (Z.AI, DeepSeek, custom anthropic-messages providers configured via `models.yaml`) treat them as opaque continuation hints. Source-side official detection uses the canonical catalog provider id `"anthropic"` (assistant messages carry no `baseUrl`); target-side detection reuses the baked `compat.officialEndpoint` flag. Latest-turn byte-for-byte behavior (Anthropic's "thinking blocks in the latest assistant message cannot be modified" rule) and existing aborted/errored last-block sanitization are unchanged. ([#2257](https://github.com/can1357/oh-my-pi/issues/2257), [#2265](https://github.com/can1357/oh-my-pi/issues/2265))
 
-## [15.10.12] - 2026-06-10
-
-### Added
-
-- Added `antigravityRankingStrategy` and registered it for `google-antigravity` in `DEFAULT_RANKING_STRATEGIES`, so new sessions are routed to OAuth credentials with quota headroom for the requested model backend (lowest relevant `remainingFraction` counter as the sole ranked window, 24h `windowDefaults` matching `daily-cloudcode-pa.googleapis.com` resets). Without it, the existing `antigravityUsageProvider` data never reached credential selection. ([#2198](https://github.com/can1357/oh-my-pi/issues/2198))
-
-### Changed
-
-- Updated MiniMax and MiniMax Token Plan defaults to `MiniMax-M3` and refreshed Token Plan login copy/links ([#1725](https://github.com/can1357/oh-my-pi/issues/1725)).
-
-### Fixed
-
-- Fixed OpenAI Responses and Azure OpenAI Responses streams silently surfacing incomplete output as successful when a custom/proxy provider drops the connection without sending a terminal `response.completed`/`response.incomplete` event. Both providers now detect premature stream closure and throw with `stopReason: "error"` ([#2184](https://github.com/can1357/oh-my-pi/pull/2184))
-- Fixed `isUsageLimitError` missing Antigravity / Cloud Code Assist's `Individual quota reached` 429 phrasing. The `USAGE_LIMIT_PATTERN` only knew `quota.?exceeded` / `limit_reached`, so `auth-retry` and `AuthStorage.markUsageLimitReached` treated the response as a terminal provider error and pinned sessions to the exhausted OAuth account instead of rotating to a sibling credential. The pattern now also matches `quota.?reached`. ([#2198](https://github.com/can1357/oh-my-pi/issues/2198))
-- Scoped Antigravity usage blocking and ranking by model family (`gemini-*`/`gemma-*` → Google, `claude-*` → Anthropic, `gpt-*`/`openai/*` → OpenAI), so an exhausted Gemini counter no longer makes a healthy Claude/OpenAI Antigravity credential unavailable until reset. ([#2198](https://github.com/can1357/oh-my-pi/issues/2198))
-- Fixed no-model Antigravity credential lookups (e.g. image-provider discovery) inheriting provider-wide exhaustion: `scopeLimits` now returns no limits without a concrete backend counter, and `blockScope` always returns a counter scope so missing model context can never fall through to AuthStorage's provider-wide block bucket. ([#2198](https://github.com/can1357/oh-my-pi/issues/2198))
-
-Older entries are archived in [packages/ai/CHANGELOG.md@8a9097246135](https://github.com/can1357/oh-my-pi/blob/8a9097246135bd572ff96fb552121fe1194d2906/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@1f7329fc2c7c](https://github.com/can1357/oh-my-pi/blob/1f7329fc2c7c366b38731738e0db9c170f9bb348/packages/ai/CHANGELOG.md).

package/dist/types/auth-gateway/dispatch.d.ts

@@ -0,0 +1,80 @@
+import type { ApiKeyResolver } from "../auth-retry.js";
+import type { AuthStorage } from "../auth-storage.js";
+import { type GatewayErrorClassification } from "../error/gateway.js";
+import type { Api, FetchImpl, Model, Usage } from "../types.js";
+import type { ClientUsageIdentity } from "../usage.js";
+import type { AuthGatewayServerOptions } from "./types.js";
+export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
+    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+    storage: AuthStorage;
+    /**
+     * Resolve a client-requested model id to a pi-ai Model. Caller supplies
+     * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
+     * dependency in `pi-ai`).
+     */
+    resolveModel: ModelResolver;
+    /** Optional supplier for `/v1/models` listing. Returns the full model array. */
+    listModels?: () => Iterable<Model<Api>>;
+    /** Upstream transport for every provider call; defaults to global `fetch`. Test seam. */
+    fetch?: FetchImpl;
+}
+/**
+ * The client's own session key, or `undefined` when it sent none. A blank key
+ * counts as none: honouring it would collapse every caller that sends an empty
+ * key into one shared credential-sticky, prefix-cache and provider-session
+ * bucket.
+ */
+export declare function normalizeClientSessionKey(clientKey: string | undefined): string | undefined;
+/**
+ * Stable identity of the account a request's credential belongs to.
+ *
+ * `markUsageLimitReached` and the auth-retry resolver switch a session to a
+ * sibling credential, so the provider state retained for that session can
+ * outlive the account that taught it. OAuth rows expose an account id / email
+ * that survives token refresh — fingerprinting the bearer instead would look
+ * like a rotation every time a token refreshes and discard the retained
+ * lessons for nothing. Key-based rows fall back to a hash of the key, never
+ * the key itself: this value is held for the lifetime of the entry.
+ */
+export declare function resolveGatewayAccount(storage: AuthStorage, provider: string, sessionId: string, apiKey: string): string;
+/**
+ * Resolve the credential for one request from broker-backed storage.
+ *
+ * pi-ai clients never consult `AuthStorage`; the gateway resolves the bearer
+ * (an OAuth access token refreshed through the broker when needed) and hands
+ * it to the client. Returns the key, or the error classification the route
+ * should encode in its own envelope: storage failures map through
+ * {@link classifyGatewayError}, a provider without any credential is a 401.
+ */
+export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<Api>, sessionId: string, signal: AbortSignal, peer: string): Promise<string | GatewayErrorClassification>;
+/**
+ * Build the {@link ApiKeyResolver} handed to a pi-ai client for a gateway
+ * request. Drives the central a/b/c auth-retry policy server-side:
+ *
+ * - initial resolve → the credential already resolved for this request.
+ * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential
+ *   (a peer/broker may have rotated its token out from under our cached copy).
+ * - step (c) `lastChance` → {@link refreshGatewayApiKeyAfterAuthError} switches
+ *   to a sibling (usage-limit block vs credential invalidation by error class).
+ *
+ * `lastKey` tracks the most recent bearer so the switch step invalidates the
+ * credential that actually failed. `onResolvedKey` observes every rotation;
+ * routes that retain provider session state use it to re-key the account
+ * lease, one-shot routes pass `undefined`.
+ */
+export declare function buildGatewayApiKeyResolver(storage: AuthStorage, model: Model<Api>, sessionId: string, initialKey: string, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (apiKey: string) => void): ApiKeyResolver;
+/**
+ * Attribute one settled upstream request to the originating client via the
+ * broker's observed-usage channel (`AuthStorage.recordObservedUsage`, batched
+ * by the remote store). Error/aborted turns still record — the provider
+ * billed whatever tokens the partial turn consumed; zero-usage results
+ * (pre-flight failures) are skipped. `at` defaults to now.
+ */
+export declare function recordGatewayUsage(storage: AuthStorage, model: Model<Api>, client: ClientUsageIdentity, usage: Usage, at?: number): void;
+/**
+ * An `AbortController` that follows the inbound request's abort signal. Routes
+ * abort it themselves when the response body is cancelled mid-stream, which
+ * `req.signal` alone does not observe.
+ */
+export declare function mirrorRequestAbort(req: Request): AbortController;

package/dist/types/auth-gateway/http.d.ts

@@ -1,4 +1,4 @@
-import type { Api, AssistantMessage, Model } from "../types.js";
+import type { Api, Model } from "../types.js";
 import type { ClientUsageIdentity } from "../usage.js";
 export declare function json(status: number, body: unknown, headers?: Record<string, string>): Response;
 /**
@@ -7,14 +7,13 @@ export declare function json(status: number, body: unknown, headers?: Record<str
  * `request-id` (surfaced as `_request_id` by the OpenAI and Anthropic SDKs,
  * matches the gateway log line), LiteLLM's model-resolution and cost headers,
  * and OpenAI's `openai-processing-ms`. Model/request-id headers are always
- * present; `message` — the final assistant message, available only on
- * non-streaming responses — adds the computed cost, and `startedAt` the wall
- * time. Streaming responses send headers before usage exists, so they carry
- * only the identity headers.
+ * present; `costUsd` — known only once a non-streaming response has settled —
+ * adds the computed cost, and `startedAt` the wall time. Streaming responses
+ * send headers before usage exists, so they carry only the identity headers.
  */
 export declare function gatewayResponseHeaders(model: Model<Api>, info: {
     requestId: string;
-    message?: AssistantMessage;
+    costUsd?: number;
     startedAt?: number;
 }): Record<string, string>;
 export declare function resolvePeer(req: Request): string;

package/dist/types/auth-gateway/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./dispatch.js";
 export * from "./http.js";
 export * from "./session-state.js";
 export * from "./server.js";

package/dist/types/auth-gateway/routes/embeddings.d.ts

@@ -0,0 +1,3 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+/** OpenAI-compatible `POST /v1/embeddings` gateway handler. */
+export declare function handleEmbeddings(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/images.d.ts

@@ -0,0 +1,3 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+export declare function handleImageGenerations(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleImageEdits(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/rerank.d.ts

@@ -0,0 +1,3 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+/** OpenRouter-compatible `POST /v1/rerank` gateway handler. */
+export declare function handleRerank(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/speech.d.ts

@@ -0,0 +1,2 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+export declare function handleSpeech(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/systemone.d.ts

@@ -0,0 +1,2 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+export declare function handleSystemOne(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/transcriptions.d.ts

@@ -0,0 +1,3 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+/** OpenAI-compatible `POST /v1/audio/transcriptions` gateway handler. */
+export declare function handleTranscriptions(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/video.d.ts

@@ -0,0 +1,7 @@
+import { type AuthGatewayBootOptions } from "../dispatch.js";
+/** OpenRouter-compatible `POST /v1/videos` asynchronous video submit handler. */
+export declare function handleVideoSubmit(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+/** OpenRouter-compatible `GET /v1/videos/:id` asynchronous video poll handler. */
+export declare function handleVideoPoll(bootOpts: AuthGatewayBootOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;
+/** OpenRouter-compatible `GET /v1/videos/:id/content` streaming video content handler. */
+export declare function handleVideoContent(bootOpts: AuthGatewayBootOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;

package/dist/types/auth-gateway/server.d.ts

@@ -16,21 +16,15 @@
  *   POST /v1/chat/completions              → OpenAI chat-completions in/out
  *   POST /v1/messages                      → Anthropic messages in/out
  *   POST /v1/responses                     → OpenAI Responses in/out
+ *   POST /v1/pi/stream                     → native pi-ai stream in/out
+ *   POST /v1/systemone | /alpha/decisions  → TypeSafe System One judgments (routes/systemone)
+ *   POST /v1/images[/generations|/edits]   → image generation, OpenAI/OpenRouter wire (routes/images)
+ *   POST /v1/audio/speech                  → text-to-speech, raw audio out (routes/speech)
+ *   POST /v1/audio/transcriptions          → speech-to-text, multipart or JSON base64 in (routes/transcriptions)
+ *
+ * Chat routes live in this file; every other modality is a `routes/*` module
+ * built on the shared plumbing in `dispatch.ts`.
  */
-import type { AuthStorage } from "../auth-storage.js";
-import type { Api, Model } from "../types.js";
-import type { AuthGatewayServerHandle, AuthGatewayServerOptions } from "./types.js";
-export type ModelResolver = (modelId: string) => Model<Api> | undefined;
-export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
-    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
-    storage: AuthStorage;
-    /**
-     * Resolve a client-requested model id to a pi-ai Model. Caller supplies
-     * this from a ModelRegistry (lives in `coding-agent` to avoid an inverse
-     * dependency in `pi-ai`).
-     */
-    resolveModel: ModelResolver;
-    /** Optional supplier for `/v1/models` listing. Returns the full model array. */
-    listModels?: () => Iterable<Model<Api>>;
-}
+import { type AuthGatewayBootOptions } from "./dispatch.js";
+import type { AuthGatewayServerHandle } from "./types.js";
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/types.d.ts

@@ -47,6 +47,11 @@ export interface AuthGatewayParsedRequestOptions {
     reasoning?: Effort;
     /** Force-disable reasoning (Anthropic `thinking: { type: "disabled" }`). */
     disableReasoning?: boolean;
+    /**
+     * Preserve an explicit wire-level reasoning-off request through providers
+     * that distinguish it from the generic disable hint.
+     */
+    forceReasoningOff?: boolean;
     /**
      * Explicit Anthropic `thinking.budget_tokens`. Mirrors Rust's
      * `resolve_thinking_budget`: pins onto whichever effort the client

package/dist/types/auth-storage.d.ts

@@ -1,8 +1,7 @@
 import type { ApiKeyResolver } from "./auth-retry.js";
 import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthPrompt, OAuthProviderId } from "./registry/oauth/types.js";
 import type { Provider } from "./types.js";
-import type { ClientUsageIdentity, ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage.js";
-import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset.js";
+import type { ClientUsageIdentity, ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport, UsageResetCredit, UsageResetCredits } from "./usage.js";
 export { isSqliteBusyError, isSqliteCorruptionError, SqliteAuthCredentialStore } from "./auth/sqlite-credential-store.js";
 export type ApiKeyCredential = {
     type: "api_key";
@@ -685,14 +684,15 @@ export interface StoredOAuthRefreshResult<T extends OAuthCredential = OAuthCrede
     refreshed: boolean;
     removed: boolean;
 }
-/**
- * Identifies which stored account to redeem a saved rate-limit reset for.
- * Any one field is enough; `credentialId` is the most precise.
- */
+/** A saved-reset option bound to one provider and durable stored credential. */
 export interface ResetCreditTarget {
-    credentialId?: number;
+    provider: string;
+    credentialId: number;
+    /** Grant selected by the caller; a changed offer must be confirmed again. */
+    creditId?: string;
     accountId?: string;
     email?: string;
+    orgId?: string;
 }
 /** Outcome of {@link AuthStorage.redeemResetCredit}. */
 export interface ResetCreditRedeemOutcome {
@@ -706,20 +706,27 @@ export interface ResetCreditRedeemOutcome {
      * retryable, unlike a genuine `no_credit`), `http_<status>` (unexpected
      * HTTP).
      */
-    code: CodexResetConsumeCode;
+    code: string;
+    provider?: string;
     accountId?: string;
     email?: string;
+    orgId?: string;
+    /** Provider explanation for an unavailable or refused reset. */
+    reason?: string;
+    /** Normalized usage limit IDs the provider confirmed it cleared. */
+    cleared?: string[];
     /** The credit that was spent (when one was). */
     creditId?: string;
 }
 /** One stored account's live saved-reset status, from {@link AuthStorage.listResetCredits}. */
-export interface ResetCreditAccountStatus {
-    credentialId?: number;
+export interface ResetCreditAccountStatus extends UsageResetCredits {
+    provider: string;
+    credentialId: number;
     accountId?: string;
     email?: string;
-    /** Resets redeemable for this account right now (live, not cached). */
-    availableCount: number;
-    credits: CodexResetCredit[];
+    orgId?: string;
+    orgName?: string;
+    credits: UsageResetCredit[];
     /** Whether this is the given session's active account. */
     active: boolean;
     /** Set when the account's token refresh or list call failed. */
@@ -858,11 +865,23 @@ export declare class AuthStorage {
      * Check if credentials exist for a provider in storage.
      */
     has(provider: string): boolean;
+    /**
+     * True when the provider has stored credentials but none of them carries
+     * auth — i.e. its only credential is the KDL `empty-fallback` keyless-mode
+     * marker (an empty paste at an optional-key login prompt). Such a provider
+     * is configured-but-keyless: model availability treats it like an
+     * `auth: none` endpoint instead of locking it out (issue #12281).
+     */
+    hasKeylessPlaceholder(provider: string): boolean;
     /**
      * Dedicated auth for default-model availability (picker / `getAvailable`).
      * Unlike {@link getApiKey}, this does not refresh OAuth tokens, and unlike
      * {@link hasResolvableAuth} it ignores cross-provider env aliases so
      * `XAI_API_KEY` does not auto-select SuperGrok (`xai-oauth`).
+     *
+     * A stored keyless-fallback marker (empty paste at an optional-key login)
+     * does not count: it never reaches the wire as a bearer, so treating it as
+     * auth would present the provider as signed-in while requests go out bare.
      */
     hasAuth(provider: string): boolean;
     /**
@@ -1170,16 +1189,7 @@ export declare class AuthStorage {
      * explicit runtime/config API-key override suppresses OAuth.
      */
     getOAuthAccessByCredentialId(provider: string, credentialId: number, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution | undefined>;
-    /**
-     * List saved rate-limit resets for every stored OAuth account of `provider`
-     * (Codex), fetched LIVE from the dedicated `rate-limit-reset-credits` route.
-     *
-     * This deliberately bypasses the usage-report cache: `/wham/usage` is
-     * IP-rate-limited and may serve stale (or pre-feature) snapshots when many
-     * accounts are polled, which would hide redeemable credits. One entry per
-     * account, with the session's active account flagged and unreachable
-     * accounts carrying an `error`.
-     */
+    /** List live saved-reset balances and eligibility for one provider's stored OAuth accounts. */
     listResetCredits(options?: {
         provider?: string;
         sessionId?: string;
@@ -1187,18 +1197,11 @@ export declare class AuthStorage {
         signal?: AbortSignal;
     }): Promise<ResetCreditAccountStatus[]>;
     /**
-     * Redeem one saved rate-limit reset (OpenAI Codex "saved resets") for a
-     * specific stored account.
-     *
-     * Resolves a fresh access token for the target account, picks an available
-     * credit (the given `creditId`, else the first redeemable one), spends it,
-     * and invalidates the cached usage report so the next `/usage` reflects the
-     * reset. Never throws for business outcomes — inspect the returned `code`.
+     * Redeem a stored account's saved reset after checking its live offer.
+     * Business refusals return a code; transport errors may throw without losing Claude's request ID.
      */
     redeemResetCredit(options: {
         target: ResetCreditTarget;
-        provider?: string;
-        creditId?: string;
         baseUrlResolver?: (provider: string) => string | undefined;
         signal?: AbortSignal;
     }): Promise<ResetCreditRedeemOutcome>;

package/dist/types/embeddings/index.d.ts

@@ -0,0 +1,7 @@
+import type { Api, Model } from "@oh-my-pi/pi-catalog/types";
+import { type EmbeddingOptions } from "./openai-embeddings.js";
+import type { EmbeddingRequest, EmbeddingResult } from "./types.js";
+export * from "./openai-embeddings.js";
+export * from "./types.js";
+/** Dispatch an embedding request through the transport selected by the catalog model. */
+export declare function embed(model: Model<Api>, request: EmbeddingRequest, options: EmbeddingOptions): Promise<EmbeddingResult>;

package/dist/types/embeddings/openai-embeddings.d.ts

@@ -0,0 +1,15 @@
+import type { Api, FetchImpl, Model } from "@oh-my-pi/pi-catalog/types";
+import { type ApiKey } from "../auth-retry.js";
+import * as AIError from "../error/index.js";
+import type { EmbeddingRequest, EmbeddingResult } from "./types.js";
+export interface EmbeddingOptions {
+    apiKey: ApiKey;
+    fetch?: FetchImpl;
+    signal?: AbortSignal;
+}
+/** Non-2xx response from an OpenAI-compatible embeddings endpoint. */
+export declare class EmbeddingApiError extends AIError.ProviderHttpError {
+    readonly name = "EmbeddingApiError";
+}
+/** Call an OpenAI/OpenRouter-compatible embeddings endpoint. */
+export declare function embedOpenAI(model: Model<Api>, request: EmbeddingRequest, options: EmbeddingOptions): Promise<EmbeddingResult>;

package/dist/types/embeddings/types.d.ts

@@ -0,0 +1,15 @@
+import type { Usage } from "@oh-my-pi/pi-catalog/types";
+export interface EmbeddingRequest {
+    input: string | string[] | number[] | number[][];
+    dimensions?: number;
+    encodingFormat: "float" | "base64";
+    user?: string;
+}
+export interface EmbeddingResult {
+    embeddings: Array<{
+        index: number;
+        embedding: number[] | string;
+    }>;
+    model: string;
+    usage: Usage;
+}

package/dist/types/images/google-antigravity.d.ts

@@ -0,0 +1,9 @@
+import type { Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+interface AntigravityCredentials {
+    accessToken: string;
+    projectId: string;
+}
+export declare function parseAntigravityCredentials(raw: string): AntigravityCredentials | undefined;
+export declare function generateAntigravityImage(model: Model, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;
+export {};

package/dist/types/images/google-generative-ai.d.ts

@@ -0,0 +1,3 @@
+import type { Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+export declare function generateGoogleImage(model: Model, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;

package/dist/types/images/index.d.ts

@@ -0,0 +1,14 @@
+import type { Api, Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+export * from "./google-antigravity.js";
+export * from "./google-generative-ai.js";
+export * from "./openai-hosted.js";
+export * from "./openai-images.js";
+export * from "./openrouter-images.js";
+export * from "./types.js";
+/** Catalog APIs {@link generateImage} serves; the hosted Responses pair needs an explicit carrier model. */
+export type ImageGenerationApi = "openai-images" | "openrouter-images" | "google-generative-ai" | "google-gemini-cli" | "openai-responses" | "openai-codex-responses";
+/** Whether a catalog API generates images through one of the pi-ai image clients. */
+export declare function isImageGenerationApi(api: Api): api is ImageGenerationApi;
+/** Generate (or edit, when `request.inputImages` is set) images through the transport selected by the model's `api`. */
+export declare function generateImage(model: Model<Api>, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;

package/dist/types/images/openai-hosted.d.ts

@@ -0,0 +1,3 @@
+import type { Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+export declare function generateHostedImage(model: Model, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;

package/dist/types/images/openai-images.d.ts

@@ -0,0 +1,5 @@
+import type { Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+export declare const XAI_MAX_EDIT_IMAGES = 3;
+export declare function resolveXAIResolution(imageSize?: string): "1k" | "2k";
+export declare function generateOpenAIImage(model: Model, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;

package/dist/types/images/openrouter-images.d.ts

@@ -0,0 +1,3 @@
+import type { Model } from "@oh-my-pi/pi-catalog/types";
+import type { ImageGenerationOptions, ImageGenerationRequest, ImageGenerationResult } from "./types.js";
+export declare function generateOpenRouterImage(model: Model, request: ImageGenerationRequest, options: ImageGenerationOptions): Promise<ImageGenerationResult>;

package/dist/types/images/shared.d.ts

@@ -0,0 +1,34 @@
+import type { FetchImpl, Model, Usage } from "@oh-my-pi/pi-catalog/types";
+import type { ApiKey } from "../auth-retry.js";
+import * as AIError from "../error/index.js";
+import type { GeneratedImage } from "./types.js";
+export declare class ImageApiError extends AIError.ProviderHttpError {
+    readonly name = "ImageApiError";
+}
+export declare function emptyUsage(input?: number, output?: number, cost?: number): Usage;
+export declare function usageFromWire(value: unknown): Usage;
+export declare function imageBaseUrl(model: Model): string;
+export declare function modelHeaders(model: Model, signal?: AbortSignal): Promise<Record<string, string>>;
+export declare function errorMessage(rawText: string): string;
+export declare function postJson(options: {
+    model: Model;
+    url: string;
+    body: unknown;
+    apiKey: ApiKey;
+    fetch: FetchImpl;
+    signal?: AbortSignal;
+}): Promise<unknown>;
+export declare function postMultipart(options: {
+    model: Model;
+    url: string;
+    body: FormData;
+    apiKey: ApiKey;
+    fetch: FetchImpl;
+    signal?: AbortSignal;
+}): Promise<unknown>;
+export declare function decodeImageResponse(value: unknown, fetch: FetchImpl, signal?: AbortSignal): Promise<{
+    images: GeneratedImage[];
+    usage: Usage;
+}>;
+export declare function toDataUrl(image: GeneratedImage): string;
+export declare function resolveOpenAIImageSize(aspectRatio?: string, imageSize?: string): string | undefined;

package/dist/types/images/types.d.ts

@@ -0,0 +1,31 @@
+import type { Api, FetchImpl, Model, Usage } from "@oh-my-pi/pi-catalog/types";
+import type { ApiKey } from "../auth-retry.js";
+export interface ImageInput {
+    data: string;
+    mimeType: string;
+}
+export interface ImageGenerationRequest {
+    prompt: string;
+    inputImages?: ImageInput[];
+    aspectRatio?: string;
+    imageSize?: string;
+    count?: number;
+}
+export interface GeneratedImage {
+    data: string;
+    mimeType: string;
+}
+export interface ImageGenerationResult {
+    images: GeneratedImage[];
+    text?: string;
+    usage: Usage;
+}
+export interface ImageGenerationOptions {
+    apiKey: ApiKey;
+    fetch?: FetchImpl;
+    signal?: AbortSignal;
+    /** Chat model that carries a Responses `image_generation` tool call. */
+    carrier?: Model<Api>;
+    /** Stable provider session id, used by the Codex Responses carrier. */
+    sessionId?: string;
+}

package/dist/types/index.d.ts

@@ -1,12 +1,18 @@
 export { type Type, type } from "@oh-my-pi/omptype";
 export * from "./api-registry.js";
 export type * from "./auth-broker/index.js";
-export type { AuthGatewayBootOptions, ModelResolver } from "./auth-gateway/server.js";
+export type { AuthGatewayBootOptions, ModelResolver } from "./auth-gateway/dispatch.js";
 export * from "./auth-gateway/types.js";
 export * from "./auth-retry.js";
 export * from "./auth-storage.js";
 export * from "./error/rate-limit.js";
+export * from "./embeddings/index.js";
+export * from "./images/index.js";
 export * from "./judgment/index.js";
+export * from "./rerank/index.js";
+export * from "./speech/index.js";
+export * from "./transcription/index.js";
+export * from "./video/index.js";
 export * from "./oneshot-retry.js";
 export * from "./provider-details.js";
 export * from "./provider-session-state.js";
@@ -33,6 +39,7 @@ export * from "./stream.js";
 export * from "./types.js";
 export * from "./usage.js";
 export * from "./usage/claude.js";
+export * from "./usage/claude-reset.js";
 export * from "./usage/cursor.js";
 export * from "./usage/gemini.js";
 export * from "./usage/github-copilot.js";

package/dist/types/judgment/typesafe.d.ts

@@ -27,6 +27,8 @@ export interface TypeSafeJudgeOptions {
     baseUrl?: string;
     /** Defaults to {@link typesafeModel}. */
     model?: string;
+    /** Static headers attached to judgment requests (e.g. proxy routing, gateway auth). */
+    headers?: Record<string, string>;
     fetch?: FetchImpl;
     /** Per-attempt timeout; defaults to {@link DEFAULT_TIMEOUT_MS}. */
     timeoutMs?: number;

package/dist/types/providers/amazon-bedrock.d.ts

@@ -11,6 +11,13 @@
  */
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import type { StreamFunction, StreamOptions, ThinkingBudgets } from "../types.js";
+/**
+ * Resolve the service-model status for an in-stream exception/error code.
+ * Frame headers carry the bare shape name in either camelCase
+ * (`internalServerException`) or PascalCase (`InternalServerException`); both
+ * normalize to the same map key. Unknown shapes default to 400.
+ */
+export declare function bedrockStreamExceptionStatus(code: string): number;
 export type BedrockThinkingDisplay = "summarized" | "omitted";
 /** Bedrock guardrail trace verbosity, mirrors the Converse `guardrailConfig.trace` values. */
 export type BedrockGuardrailTrace = "enabled" | "disabled" | "enabled_full";