@oh-my-pi/pi-ai 18.4.3 → 18.4.4

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [18.4.4] - 2026-09-29
+
+### Added
+
+- Added the `ultrafast` service tier. It is sent to the OpenAI API as-is, and to Codex only for models that list it in their discovered service tiers; other providers never receive it. On Codex websockets, switching into or out of `ultrafast` starts a new response chain instead of reusing `previous_response_id`, matching the Codex CLI. Ultrafast turns are costed at standard rates because no Ultrafast price is published yet ([#13782](https://github.com/can1357/oh-my-pi/pull/13782) by [@H4vC](https://github.com/H4vC)).
+
+### Changed
+
+- Changed to fall back to adaptive thinking when between_tools is used with xhigh effort
+- xAI requests (`xai`, `xai-oauth` chat and image generation) honor `XAI_BASE_URL` again when the model uses the bundled `https://api.x.ai/v1` endpoint; a custom `baseUrl` from models.yml still wins, and `xai-oauth` OAuth access tokens always stay on the bundled endpoint.
+
+### Fixed
+
+- Fixed Claude on Amazon Bedrock's Anthropic Messages routes (`/anthropic` on bedrock-runtime and bedrock-mantle): runtime requests no longer fail with a request-metadata 400, and both routes use Anthropic's on-demand compaction ([#13311](https://github.com/can1357/oh-my-pi/pull/13311) by [@mustafaabidali](https://github.com/mustafaabidali)).
+- `/usage` no longer shows an always-empty `gpt-4 requests` row for Cursor accounts on usage-based plans; the Cursor Models and Other Models meters remain ([#13726](https://github.com/can1357/oh-my-pi/pull/13726) by [@will-bogusz](https://github.com/will-bogusz)).
+- Cursor turns routed through an HTTP proxy now finish instead of hanging after the response completes ([#13724](https://github.com/can1357/oh-my-pi/pull/13724) by [@will-bogusz](https://github.com/will-bogusz)).
+- Fixed Codex requests sending `priority` (and `scale`) to models whose discovered service tiers list other tiers but not that one, matching the Codex CLI; an empty or missing list is treated as not reported, so `priority` is still sent and `/fast` keeps working on accounts whose `/models` lists no tiers (`flex` is always allowed) ([#13782](https://github.com/can1357/oh-my-pi/pull/13782) by [@H4vC](https://github.com/H4vC)).
+- Fixed Codex priority cost: a turn the backend reports as served at `default` is no longer billed at the priority multiplier ([#13782](https://github.com/can1357/oh-my-pi/pull/13782) by [@H4vC](https://github.com/H4vC)).
+
 ## [18.4.3] - 2026-09-28
 
 ### Added
@@ -2300,20 +2319,4 @@
 - Fixed the platform OpenAI Responses and Codex websocket stale-chain classifiers missing the "Unsupported parameter: previous_response_id" rejection phrasing (FastAPI-style `detail` body with no `error.code`), so a chained turn now falls back to a full-transcript replay instead of surfacing the 400
 - Fixed the HTTP-400 raw-request dump for Codex SSE to record the body actually sent on the wire instead of the pre-transport request body, which made chained-request failures look like the rejected parameter was never sent
 
-## [15.11.7] - 2026-06-12
-
-### Added
-
-- Added `requestModelId` and `thinking.suppress` options to `google-gemini-cli` so collapsed effort-tier variants serialize their per-effort upstream wire id, and thinking-off requests on models with `thinking.suppressWhenOff` send an explicit `thinkingConfig` (`includeThoughts: false` with `thinkingLevel: "MINIMAL"` or `thinkingBudget: 0`) — Cloud Code Assist re-applies the per-id baked server default when the config is omitted, silently thinking and billing the tokens
-- Added mandatory-reasoning clamping: models baked with `thinking.requiresEffort` floor omitted or disabled reasoning to the lowest supported effort in every api mapping, and `disableReasoning` no longer emits OpenRouter `reasoning: { enabled: false }` for them — fixes `omp bench` and utility requests 400ing with "Reasoning is mandatory for this endpoint and cannot be disabled" on OpenRouter Gemini 3.x
-
-### Changed
-
-- Changed `google-gemini-cli` request mapping to route per-request wire ids via `resolveWireModelId`: the session effort picks the backing variant id (collapsed `gemini-3.5-flash` at high → `gemini-3.5-flash-low`; claude pairs route off → bare id, efforts → `-thinking`) while `AssistantMessage.model` and usage attribution stay on the logical id. A thinking budget clamped to zero now falls through to the thinking-off path (off routing plus suppression) instead of only disabling thinking
-- Changed `openai-completions` and `anthropic-messages` to serialize per-request wire ids via `resolveWireModelId`, so collapsed `X`/`X-thinking` pairs on aggregators and custom providers switch to the thinking SKU when reasoning is enabled (previously only `google-gemini-cli` routed effort-tier variants)
-
-### Fixed
-
-- Fixed `google-gemini-cli` ignoring `Model.requestModelId` when serializing the request model id
-
-Older entries are archived in [packages/ai/CHANGELOG.md@689a3418cb45](https://github.com/can1357/oh-my-pi/blob/689a3418cb45d54a459cde2e1abf3f66f50e47a4/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages\ai\CHANGELOG.md@07e9197a3012](https://github.com/can1357/oh-my-pi/blob/07e9197a3012f58c459f1faabeb324decc21f41d/packages\ai\CHANGELOG.md).

package/dist/types/auth-broker/protocol.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Auth-broker wire-protocol helpers shared by the server and the client store.
+ */
+import type { CredentialBlockSnapshot } from "./types.js";
+/** Parse a snapshot `ETag` / `If-None-Match` value (`"N"`, `W/"N"`, or bare `N`) into a generation. */
+export declare function parseGenerationTag(header: string | null): number | undefined;
+/**
+ * Canonical order for a credential's block snapshots. The server and the client
+ * store both sort with it, because block lists are compared positionally; the
+ * `updatedAtMs` tiebreak keeps otherwise-identical blocks in one stable order.
+ */
+export declare function compareCredentialBlockSnapshots(a: CredentialBlockSnapshot, b: CredentialBlockSnapshot): number;

package/dist/types/dialect/rendering.d.ts

@@ -1,4 +1,5 @@
 import type { AssistantMessage, Message, ToolCall } from "../types.js";
+import { type ToolArgShape } from "./coercion.js";
 import type { DialectRenderOptions, DialectToolResult } from "./types.js";
 export declare function renderToolResponseResults(results: readonly DialectToolResult[]): string;
 export declare function kimiCallId(name: string, id: string, index: number): string;
@@ -15,6 +16,9 @@ export declare function pyCall(name: string, args: Record<string, unknown>): str
 export declare function pyValue(value: unknown): string;
 export declare function escapeXmlAttr(value: string): string;
 export declare function escapeXmlText(value: string): string;
+/** Render one Anthropic-style `<invoke>`; declared string args stay raw, everything else is JSON. */
+export declare function renderInvoke(call: ToolCall, shape: ToolArgShape | undefined): string;
+export declare function renderInvokes(calls: readonly ToolCall[], tools: NonNullable<DialectRenderOptions["tools"]>): string;
 export type AssistantTranscriptParts = {
     readonly text: string;
     readonly thinking: string;

package/dist/types/images/shared.d.ts

@@ -10,9 +10,11 @@ export declare function usageFromWire(value: unknown): Usage;
 export declare function imageBaseUrl(model: Model): string;
 export declare function modelHeaders(model: Model, signal?: AbortSignal): Promise<Record<string, string>>;
 export declare function errorMessage(rawText: string): string;
+/** Request URL, or a builder for routes that depend on the bearer (xAI's `XAI_BASE_URL` rule). */
+type ImageRequestUrl = string | ((bearer: string) => string);
 export declare function postJson(options: {
     model: Model;
-    url: string;
+    url: ImageRequestUrl;
     body: unknown;
     apiKey: ApiKey;
     fetch: FetchImpl;
@@ -20,7 +22,7 @@ export declare function postJson(options: {
 }): Promise<unknown>;
 export declare function postMultipart(options: {
     model: Model;
-    url: string;
+    url: ImageRequestUrl;
     body: FormData;
     apiKey: ApiKey;
     fetch: FetchImpl;
@@ -32,3 +34,4 @@ export declare function decodeImageResponse(value: unknown, fetch: FetchImpl, si
 }>;
 export declare function toDataUrl(image: GeneratedImage): string;
 export declare function resolveOpenAIImageSize(aspectRatio?: string, imageSize?: string): string | undefined;
+export {};

package/dist/types/providers/anthropic-wire.d.ts

@@ -225,7 +225,15 @@ export type ThinkingConfigAdaptive = {
     /** Preserved-thinking prefix mismatch policy. */
     block_binding?: ThinkingBlockBinding;
 };
-export type ThinkingConfigParam = ThinkingConfigEnabled | ThinkingConfigDisabled | ThinkingConfigAdaptive;
+/**
+ * Sonnet 5.5's replacement for `disabled`: no up-front thinking, progress
+ * updates between tool calls only. Takes no other field, and effort above
+ * `high` is rejected alongside it.
+ */
+export type ThinkingConfigBetweenTools = {
+    type: "between_tools";
+};
+export type ThinkingConfigParam = ThinkingConfigEnabled | ThinkingConfigDisabled | ThinkingConfigAdaptive | ThinkingConfigBetweenTools;
 export type OutputConfig = {
     /** Adaptive-thinking effort level (effort beta). */
     effort?: "low" | "medium" | "high" | "xhigh" | "max" | null;

package/dist/types/providers/anthropic.d.ts

@@ -217,6 +217,23 @@ type SystemBlockOptions = {
 export declare function buildAnthropicSystemBlocks(systemPrompt: readonly string[] | undefined, options?: SystemBlockOptions): AnthropicSystemBlock[] | undefined;
 export declare function normalizeExtraBetas(betas?: string[] | string): string[];
 export declare function buildAnthropicClientOptions(args: AnthropicClientOptionsArgs): AnthropicClientOptionsResult;
+/**
+ * True when enabled thinking on `model` is budget thinking
+ * (`thinking.type: "enabled"` with `budget_tokens`) rather than adaptive.
+ */
+export declare function usesBudgetThinking(model: Model<"anthropic-messages">): boolean;
+/** The most output tokens a request to `model` may ask for (`max_tokens` ceiling). */
+export declare function anthropicOutputLimit(model: Model<"anthropic-messages">): number;
+/**
+ * The `max_tokens` and thinking budget of budget thinking: `max_tokens`
+ * rises to leave {@link OUTPUT_FALLBACK_BUFFER} visible output tokens after
+ * the budget, within `maxAllowedTokens`, and the budget shrinks when that
+ * ceiling leaves less (a non-positive budget means the ceiling is too low).
+ */
+export declare function budgetThinkingOutput(maxTokens: number | undefined, budgetTokens: number, maxAllowedTokens: number): {
+    maxTokens: number;
+    budgetTokens: number;
+};
 /**
  * A single Anthropic conversation turn, including the mid-conversation
  * `system` role (Opus 4.8+ and Fable/Mythos 5).

package/dist/types/providers/aws-sigv4.d.ts

@@ -33,6 +33,11 @@ export interface SignParams {
     /** Override clock for deterministic tests. */
     date?: Date;
 }
+/** Coerce a possibly-ArrayBufferLike-backed `Uint8Array` into one over a fresh
+ * `ArrayBuffer`, which is what `crypto.subtle.{digest,sign,importKey}` requires
+ * under the strict TS DOM typings. No-op when already strict.
+ */
+export declare function asStrict(bytes: Uint8Array): Uint8Array<ArrayBuffer>;
 export declare function toHex(bytes: Uint8Array): string;
 export declare function sha256(data: Uint8Array | string): Promise<Uint8Array>;
 export declare function sha256Hex(data: Uint8Array | string): Promise<string>;

package/dist/types/providers/bedrock-anthropic.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Fit an Anthropic request body to Bedrock's Anthropic Messages API
+ * (`compat.bedrockMessagesApi`): both `/anthropic` routes reject the tool
+ * `strict` field, and bedrock-runtime rejects a `metadata.user_id` outside
+ * Bedrock's request-metadata pattern. A user id that fits is kept, otherwise
+ * its embedded session id, otherwise the metadata is dropped. Mutates and
+ * returns `payload`.
+ */
+export declare function fitBedrockAnthropicPayload<T>(payload: T): T;

package/dist/types/providers/bedrock-request-metadata.d.ts

@@ -0,0 +1,2 @@
+/** Check Bedrock's request-metadata character and length limits. Keys must also be nonempty. */
+export declare function isBedrockRequestMetadataValue(value: string): boolean;

package/dist/types/providers/cursor/interaction-query.d.ts

@@ -1,5 +1,14 @@
 import type http2 from "node:http2";
 import { type InteractionQuery } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
+type ProtoUnknownField = {
+    no: number;
+    wireType: number;
+    data: Uint8Array;
+};
+/** Wrap one Connect-protocol message: 1 flag byte + 4-byte big-endian length + payload. */
+export declare function frameConnectMessage(data: Uint8Array, flags?: number): Buffer;
+/** Well-formed protobuf-es `$unknown` entries on `message`; anything else on the bag is ignored. */
+export declare function protoUnknownFields(message: object): ProtoUnknownField[];
 /**
  * Answer a Cursor `interaction_query` so the Run RPC can continue.
  *
@@ -13,3 +22,4 @@ import { type InteractionQuery } from "@oh-my-pi/pi-catalog/discovery/cursor-pro
  * VM setup is left unanswered rather than reporting a fake success.
  */
 export declare function handleInteractionQuery(query: InteractionQuery, h2Request: http2.ClientHttp2Stream): void;
+export {};

package/dist/types/providers/openai-chat-wire.d.ts

@@ -397,7 +397,7 @@ export interface ChatCompletionChunk {
     /** Moderation results, present on the moderation chunk when requested. */
     moderation?: ChatCompletionChunkModeration | null;
     /** Processing type actually used for serving the request. */
-    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | null;
     /** Deprecated by OpenAI: backend configuration fingerprint, pairs with `seed`. */
     system_fingerprint?: string;
     /** Only with `stream_options: {"include_usage": true}`; null except on the last chunk. */
@@ -632,7 +632,7 @@ export interface ChatCompletionCreateParamsBase {
     /** Deprecated by OpenAI (Beta): best-effort deterministic sampling seed. */
     seed?: number | null;
     /** Processing type used for serving the request. */
-    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | null;
     /** Up to 4 sequences where the API will stop generating further tokens. */
     stop?: string | null | Array<string>;
     /** Whether to store the output for model distillation or evals. */

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -64,7 +64,7 @@ export interface RequestBody {
     client_metadata?: Record<string, string>;
     max_output_tokens?: number;
     max_completion_tokens?: number;
-    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | null;
     /** Explicit cyber access program for this request; see `openai-codex/access-programs.ts`. */
     access_programs?: {
         cyber: string;

package/dist/types/providers/openai-responses-wire.d.ts

@@ -772,7 +772,7 @@ export interface Response {
      * When this parameter is set, the response body will include the `service_tier`
      * utilized.
      */
-    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | null;
     /**
      * The status of the response generation. One of `completed`, `failed`,
      * `in_progress`, `cancelled`, `queued`, or `incomplete`.
@@ -5772,7 +5772,7 @@ export interface ResponseCreateParamsBase {
      * When this parameter is set, the response body will include the `service_tier`
      * utilized.
      */
-    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | null;
+    service_tier?: "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast" | null;
     /**
      * Whether to store the generated model response for later retrieval via API.
      */

package/dist/types/providers/xai-base-url.d.ts

@@ -0,0 +1,17 @@
+/** Bundled xAI API endpoint for the `xai` and `xai-oauth` providers. */
+export declare const XAI_DEFAULT_BASE_URL = "https://api.x.ai/v1";
+/**
+ * Resolve the base URL for an xAI request (`xai` / `xai-oauth` chat, image
+ * generation, web search, and HTTP tools).
+ *
+ * `XAI_BASE_URL` redirects traffic that targets the bundled default endpoint
+ * (or has no base URL); trailing slashes on the override are stripped. A
+ * custom `baseUrl` (models.yml, provider config) always wins.
+ *
+ * The override never receives official xAI OAuth credentials: an `xai-oauth`
+ * request whose bearer is an xAI OAuth access token (a JWT, whether stored,
+ * from `XAI_OAUTH_TOKEN`, or unknown because no bearer was supplied) stays on
+ * the bundled endpoint. API keys, including command-backed ones, follow the
+ * override.
+ */
+export declare function resolveXaiBaseUrl(provider: string, baseUrl: string | undefined, bearer: string | undefined): string | undefined;

package/dist/types/types.d.ts

@@ -83,7 +83,9 @@ export type CacheRetention = "none" | "short" | "long";
  * values providers consume on the wire:
  *
  * - OpenAI / OpenAI-Codex: sent verbatim as the `service_tier` field
- *   (`flex`/`scale`/`priority`).
+ *   (`flex`/`scale`/`priority`/`ultrafast`). `ultrafast` is a separate
+ *   low-latency serving path: sent to the OpenAI API as-is (preview access is
+ *   per project), and to Codex only for models whose discovery advertises it.
  * - Google (Gemini API + Vertex AI): sent as the top-level `serviceTier`
  *   field (`flex`/`priority`).
  * - OpenRouter: passed through as `service_tier`; OpenRouter realizes it for
@@ -95,7 +97,7 @@ export type CacheRetention = "none" | "short" | "long";
  * Per-family scoping is expressed by {@link ServiceTierByFamily}, not by
  * scoped sentinel values — see {@link serviceTierFamily}.
  */
-export type ServiceTier = "auto" | "default" | "flex" | "scale" | "priority";
+export type ServiceTier = "auto" | "default" | "flex" | "scale" | "priority" | "ultrafast";
 /** Provider families that expose an independent service-tier knob. */
 export type ServiceTierFamily = "openai" | "anthropic" | "google";
 /**
@@ -105,7 +107,7 @@ export type ServiceTierFamily = "openai" | "anthropic" | "google";
  * models mid-session.
  */
 export type ServiceTierByFamily = Partial<Record<ServiceTierFamily, ServiceTier>>;
-type ServiceTierModel = Pick<Model, "provider" | "api" | "identity">;
+type ServiceTierModel = Pick<Model, "provider" | "api" | "identity"> & Partial<Pick<Model, "serviceTiers">>;
 /**
  * Classify a model into the service-tier family whose knob governs it, or
  * `undefined` when the model exposes no serving-priority control.
@@ -132,6 +134,15 @@ export declare function resolveModelServiceTier(tiers: ServiceTierByFamily | nul
  * Vertex) and OpenRouter accept `flex`/`priority`; Fireworks Serverless
  * realizes only its Priority serving path. Anthropic is absent because it
  * realizes `priority` via `speed: "fast"`.
+ *
+ * Codex-backend models (`openai-codex-responses`): `ultrafast` is sent only
+ * when the model's discovered `service_tiers` lists it. `priority`/`scale`
+ * are dropped only when that list is non-empty and omits them (codex-rs
+ * `service_tier_for_request`); an empty or missing list counts as "not
+ * reported" — accounts whose `/models` lists no tiers keep `/fast` — so the
+ * provider-level answer stands. `flex` and `default` are never gated.
+ * First-party OpenAI takes `ultrafast` as-is. A bare provider string cannot
+ * carry the list, so it answers for the provider alone.
  */
 export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, target: Provider | ServiceTierModel | undefined): boolean;
 /**

package/dist/types/usage/shared.d.ts

@@ -1,4 +1,4 @@
-import type { UsageStatus } from "../usage.js";
+import type { UsageAmount, UsageStatus } from "../usage.js";
 /** Milliseconds in one hour. */
 export declare const HOUR_MS: number;
 /** Milliseconds in one day. */
@@ -11,3 +11,15 @@ export declare function parsePositiveTimestamp(value: unknown): number | undefin
 export declare function parseIsoTimestamp(value: unknown): number | undefined;
 /** Maps a used fraction to the standard quota status thresholds. */
 export declare function usageStatus(usedFraction: number | undefined): UsageStatus;
+/**
+ * Builds an amount from absolute counters. Without an authoritative
+ * `usedFraction`, it derives one from `used / limit` (capped at 1).
+ * Undefined fields are omitted rather than emitted as `undefined` keys.
+ */
+export declare function buildUsageAmount(args: {
+    used: number | undefined;
+    limit: number | undefined;
+    remaining: number | undefined;
+    usedFraction?: number;
+    unit: UsageAmount["unit"];
+}): UsageAmount;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.4.3",
+	"version": "18.4.4",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.4.3",
-		"@oh-my-pi/pi-catalog": "18.4.3",
-		"@oh-my-pi/pi-natives": "18.4.3",
-		"@oh-my-pi/pi-utils": "18.4.3",
-		"@oh-my-pi/pi-wire": "18.4.3"
+		"@oh-my-pi/omptype": "18.4.4",
+		"@oh-my-pi/pi-catalog": "18.4.4",
+		"@oh-my-pi/pi-natives": "18.4.4",
+		"@oh-my-pi/pi-utils": "18.4.4",
+		"@oh-my-pi/pi-wire": "18.4.4"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth-broker/client.ts

@@ -31,6 +31,7 @@ import type {
 	UsageStaleResponse,
 } from "./types";
 import { AUTH_BROKER_CAPABILITIES_HEADER, AUTH_BROKER_CAPABILITY_CODEX_METER_BLOCK_SCOPES } from "./types";
+import { parseGenerationTag } from "./protocol";
 import {
 	clientUsageReportResponseSchema,
 	clientUsageSummaryResponseSchema,
@@ -112,18 +113,6 @@ export type FetchSnapshotResult =
 	| { status: 200; snapshot: SnapshotResponse; generation: number }
 	| { status: 304; generation: number };
 
-function parseGenerationTag(header: string | null): number | undefined {
-	if (!header) return undefined;
-	let value = header.trim();
-	if (value.startsWith("W/")) value = value.slice(2).trim();
-	if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-		value = value.slice(1, -1);
-	}
-	const generation = Number(value);
-	if (!Number.isInteger(generation) || generation < 0) return undefined;
-	return generation;
-}
-
 const DEFAULT_TIMEOUT_MS = 10_000;
 const DEFAULT_MAX_RETRIES = 1;
 

package/src/auth-broker/protocol.ts

@@ -0,0 +1,32 @@
+/**
+ * Auth-broker wire-protocol helpers shared by the server and the client store.
+ */
+import type { CredentialBlockSnapshot } from "./types";
+
+/** Parse a snapshot `ETag` / `If-None-Match` value (`"N"`, `W/"N"`, or bare `N`) into a generation. */
+export function parseGenerationTag(header: string | null): number | undefined {
+	if (!header) return undefined;
+	let value = header.trim();
+	if (value.startsWith("W/")) value = value.slice(2).trim();
+	if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+		value = value.slice(1, -1);
+	}
+	const generation = Number(value);
+	if (!Number.isInteger(generation) || generation < 0) return undefined;
+	return generation;
+}
+
+/**
+ * Canonical order for a credential's block snapshots. The server and the client
+ * store both sort with it, because block lists are compared positionally; the
+ * `updatedAtMs` tiebreak keeps otherwise-identical blocks in one stable order.
+ */
+export function compareCredentialBlockSnapshots(a: CredentialBlockSnapshot, b: CredentialBlockSnapshot): number {
+	const provider = a.providerKey.localeCompare(b.providerKey);
+	if (provider !== 0) return provider;
+	const scope = a.blockScope.localeCompare(b.blockScope);
+	if (scope !== 0) return scope;
+	const blockedUntil = a.blockedUntilMs - b.blockedUntilMs;
+	if (blockedUntil !== 0) return blockedUntil;
+	return (a.updatedAtMs ?? 0) - (b.updatedAtMs ?? 0);
+}

package/src/auth-broker/remote-store.ts

@@ -24,7 +24,9 @@ import * as AIError from "../error";
 import type { OAuthCredentials } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import type { ClientUsageIdentity, ObservedUsageEntry, UsageReport } from "../usage";
+import { raceSignal } from "../auth/abort";
 import { type AuthBrokerClient, AuthBrokerError, AuthBrokerStreamUnsupportedError } from "./client";
+import { compareCredentialBlockSnapshots } from "./protocol";
 import type {
 	CredentialBlockSnapshot,
 	RefresherSchedule,
@@ -67,16 +69,6 @@ const BACKGROUND_BACKOFF_MAX_MS = 30_000;
 /** Idle window after the last foreground store use before background sync parks. */
 const BACKGROUND_IDLE_MS = 20_000;
 
-function compareCredentialBlockSnapshots(a: CredentialBlockSnapshot, b: CredentialBlockSnapshot): number {
-	const provider = a.providerKey.localeCompare(b.providerKey);
-	if (provider !== 0) return provider;
-	const scope = a.blockScope.localeCompare(b.blockScope);
-	if (scope !== 0) return scope;
-	const blockedUntil = a.blockedUntilMs - b.blockedUntilMs;
-	if (blockedUntil !== 0) return blockedUntil;
-	return (a.updatedAtMs ?? 0) - (b.updatedAtMs ?? 0);
-}
-
 function toCredentialBlockSnapshot(block: StoredCredentialBlock): CredentialBlockSnapshot {
 	return {
 		providerKey: block.providerKey,
@@ -1209,7 +1201,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	 */
 	async fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null> {
 		this.#noteActivity();
-		const reports = await this.#raceWithSignal(this.#loadUsageReports(), signal);
+		const reports = await raceSignal(this.#loadUsageReports(), signal, "auth-broker request aborted");
 		if (!reports) return null;
 		return this.#filterUsageReports(this.#applyUsageOverlays(reports));
 	}
@@ -1229,7 +1221,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		signal?: AbortSignal,
 	): Promise<UsageReport | null> {
 		this.#noteActivity();
-		const reports = await this.#raceWithSignal(this.#loadUsageReports(), signal);
+		const reports = await raceSignal(this.#loadUsageReports(), signal, "auth-broker request aborted");
 		const visibleReports = reports ? this.#filterUsageReports(reports) : null;
 		const matched = visibleReports ? matchUsageReport(visibleReports, provider, credential) : null;
 		const overlay = this.#getActiveUsageOverlay(provider, credential);
@@ -1310,34 +1302,6 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		return merged;
 	}
 
-	/**
-	 * Reject the awaited promise when the caller's signal aborts, without
-	 * affecting the shared upstream fetch. Used to give each caller their
-	 * own cancel without one caller's abort cascading into a peer's in-flight
-	 * request through the single-flight `#usageInflight`.
-	 */
-	#raceWithSignal<T>(promise: Promise<T>, signal?: AbortSignal): Promise<T> {
-		if (!signal) return promise;
-		if (signal.aborted) return Promise.reject(new AIError.AbortError("auth-broker request aborted"));
-		return new Promise<T>((resolve, reject) => {
-			const onAbort = (): void => {
-				signal.removeEventListener("abort", onAbort);
-				reject(new AIError.AbortError("auth-broker request aborted"));
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-			promise.then(
-				value => {
-					signal.removeEventListener("abort", onAbort);
-					resolve(value);
-				},
-				err => {
-					signal.removeEventListener("abort", onAbort);
-					reject(err);
-				},
-			);
-		});
-	}
-
 	#replaceBrokerUsageAccounts(entries: readonly SnapshotEntry[]): void {
 		this.#brokerUsageProviderByCredentialId.clear();
 		this.#brokerUsageAccountCounts.clear();

package/src/auth-broker/server.ts

@@ -41,6 +41,7 @@ import {
 	DEFAULT_SERVER_IDLE_TIMEOUT_S,
 	DEFAULT_STREAM_KEEPALIVE_MS,
 } from "./types";
+import { compareCredentialBlockSnapshots, parseGenerationTag } from "./protocol";
 import {
 	clientUsageReportRequestSchema,
 	credentialBlockDeleteRequestSchema,
@@ -165,18 +166,6 @@ function snapshotHeaders(generation: number): Record<string, string> {
 	};
 }
 
-function parseGenerationTag(header: string | null): number | undefined {
-	if (!header) return undefined;
-	let value = header.trim();
-	if (value.startsWith("W/")) value = value.slice(2).trim();
-	if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-		value = value.slice(1, -1);
-	}
-	const generation = Number(value);
-	if (!Number.isInteger(generation) || generation < 0) return undefined;
-	return generation;
-}
-
 function parseWaitMs(url: URL): number {
 	const raw = url.searchParams.get("wait");
 	if (raw === null) return 0;
@@ -316,14 +305,6 @@ function computeRotatesInMs(
 	return Math.max(0, rotatesAt - serverNowMs);
 }
 
-function compareCredentialBlockSnapshots(a: CredentialBlockSnapshot, b: CredentialBlockSnapshot): number {
-	const provider = a.providerKey.localeCompare(b.providerKey);
-	if (provider !== 0) return provider;
-	const scope = a.blockScope.localeCompare(b.blockScope);
-	if (scope !== 0) return scope;
-	return a.blockedUntilMs - b.blockedUntilMs;
-}
-
 const CODEX_BLOCK_PROVIDER_KEY = "openai-codex:oauth";
 const CODEX_LEGACY_PROJECTED_BLOCK_SCOPES = new Set(["chat", "spark", "shared"]);
 

package/src/auth-broker/snapshot-cache.ts

@@ -9,6 +9,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isEnoent, logger } from "@oh-my-pi/pi-utils";
+import { asStrict } from "../providers/aws-sigv4";
 import type { SnapshotResponse } from "./types";
 
 const MAGIC = new Uint8Array([0x4f, 0x4d, 0x50, 0x53]); // "OMPS"
@@ -210,15 +211,6 @@ async function deriveAesKey(token: string, usages: Array<"encrypt" | "decrypt">)
 	return globalThis.crypto.subtle.importKey("raw", digest, AES_ALGORITHM, false, usages);
 }
 
-function asStrict(bytes: Uint8Array): Uint8Array<ArrayBuffer> {
-	if (bytes.buffer instanceof ArrayBuffer && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength) {
-		return bytes as Uint8Array<ArrayBuffer>;
-	}
-	const copy = new Uint8Array(bytes.byteLength);
-	copy.set(bytes);
-	return copy;
-}
-
 function randomHex(byteLength: number): string {
 	const bytes = new Uint8Array(byteLength);
 	globalThis.crypto.getRandomValues(bytes);

package/src/dialect/anthropic.ts

@@ -1,14 +1,8 @@
-import { parseJsonWithRepair } from "@oh-my-pi/pi-utils";
+import { escapeXmlText, parseJsonWithRepair } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
 import dialectPrompt from "./anthropic.md" with { type: "text" };
-import { buildArgShapes, buildStringArgsResolver, mintToolCallId, type ToolArgShape } from "./coercion";
-import {
-	escapeXmlAttr,
-	escapeXmlText,
-	renderDelimitedThinking,
-	renderLegacyTextTranscript,
-	stringifyJson,
-} from "./rendering";
+import { buildArgShapes, buildStringArgsResolver, mintToolCallId } from "./coercion";
+import { renderDelimitedThinking, renderInvoke, renderInvokes, renderLegacyTextTranscript } from "./rendering";
 import type {
 	DialectDefinition,
 	DialectRenderOptions,
@@ -578,22 +572,6 @@ function renderTranscript(messages: readonly Message[], options: DialectRenderOp
 	});
 }
 
-function renderInvoke(call: ToolCall, shape: ToolArgShape | undefined): string {
-	let body = `<invoke name="${escapeXmlAttr(call.name)}">`;
-	for (const key in call.arguments) {
-		const value = call.arguments[key];
-		const isString = shape?.stringArgs.has(key) === true;
-		const rendered = isString && typeof value === "string" ? value : stringifyJson(value);
-		body += `<parameter name="${escapeXmlAttr(key)}">${rendered}</parameter>`;
-	}
-	return `${body}</invoke>`;
-}
-
-function renderInvokes(calls: readonly ToolCall[], tools: NonNullable<DialectRenderOptions["tools"]>): string {
-	const shapes = buildArgShapes(tools);
-	return calls.map(call => renderInvoke(call, shapes.get(call.name))).join("\n");
-}
-
 const definition: DialectDefinition = {
 	dialect: "anthropic",
 	prompt: dialectPrompt,