@oscharko-dev/keiko 0.2.0-beta.4 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/embedding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedding.d.ts","sourceRoot":"","sources":["../src/embedding.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,KAAK,EAEV,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,aAAa,GACb,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,kBAAkB,GAClB,mCAAmC,CAAC;AAExC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACtF;AA4DD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAiCnC;AA4BD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,wBAAwB,CAW1B"}
+{"version":3,"file":"embedding.d.ts","sourceRoot":"","sources":["../src/embedding.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAE3B,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,aAAa,GACb,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,GAChB,kBAAkB,GAClB,mCAAmC,CAAC;AAExC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAIrF,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,2BAA2B,KAC/B,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3C;AAkED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAiCnC;AA4BD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,wBAAwB,CAW1B"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/embedding.js

@@ -15,29 +15,33 @@ const SAFE_MESSAGES = Object.freeze({
     timeout: "embedding probe timed out",
     cancelled: "embedding probe was cancelled by the caller",
     "unsupported-model": "embedding model is not available on the configured gateway",
+    "proxy-unreachable": "configured proxy is unreachable",
+    "proxy-auth-required": "configured proxy requires authentication",
+    "proxy-egress-failed": "configured proxy failed outbound egress",
+    "proxy-blocked-by-policy": "configured proxy blocked outbound egress",
+    "tls-ca-failure": "TLS certificate verification failed for outbound egress",
     "invalid-response": "embedding response was malformed",
     "incompatible-with-stored-identity": "embedding model identity changed — existing capsules are no longer compatible",
 });
+const ADAPTER_FAILURE_REASONS = Object.freeze({
+    "wrong-header": "wrong-header",
+    "rate-limited": "rate-limited",
+    "unsupported-model": "unsupported-model",
+    timeout: "timeout",
+    cancelled: "cancelled",
+    "invalid-response": "invalid-response",
+    "proxy-unreachable": "proxy-unreachable",
+    "proxy-auth-required": "proxy-auth-required",
+    "proxy-egress-failed": "proxy-egress-failed",
+    "proxy-blocked-by-policy": "proxy-blocked-by-policy",
+    "tls-ca-failure": "tls-ca-failure",
+    transport: "unavailable",
+});
 function fail(reason) {
     return { ok: false, reason, safeMessage: SAFE_MESSAGES[reason] };
 }
 function reasonFromAdapter(kind) {
-    switch (kind) {
-        case "wrong-header":
-            return "wrong-header";
-        case "rate-limited":
-            return "rate-limited";
-        case "unsupported-model":
-            return "unsupported-model";
-        case "timeout":
-            return "timeout";
-        case "cancelled":
-            return "cancelled";
-        case "invalid-response":
-            return "invalid-response";
-        case "transport":
-            return "unavailable";
-    }
+    return ADAPTER_FAILURE_REASONS[kind];
 }
 function hasCredentials(adapter) {
     return adapter.apiKey.trim().length > 0;

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAGlB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAOD,qBAAa,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAG3C,MAAM,EAAE,aAAa,EACtC,IAAI,GAAE,WAAgB;IAOlB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+BzD,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC,kBAAkB,CAAC;YAoB/D,UAAU;IAczB,OAAO,CAAC,MAAM;IAiBd,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;YAYtC,MAAM;IAiBpB,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAUnB"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAGlB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAOD,qBAAa,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAG3C,MAAM,EAAE,aAAa,EACtC,IAAI,GAAE,WAAgB;IAOlB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+BzD,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC,kBAAkB,CAAC;YAuB/D,UAAU;IAczB,OAAO,CAAC,MAAM;IAiBd,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;YAYtC,MAAM;IAoBpB,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAUnB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.js

@@ -3,7 +3,7 @@
 // (request id, latency, cost class) is owned by the gateway, not the provider, so
 // the audit ledger (issue #10) has a reliable typed target on every response.
 import { randomUUID } from "node:crypto";
-import { UnknownModelError } from "@oscharko-dev/keiko-security/errors/gateway";
+import { CancelledError, UnknownModelError } from "@oscharko-dev/keiko-security/errors/gateway";
 import { findConfiguredCapability } from "./model-selection.js";
 import { OpenAiAdapter } from "./openai-adapter.js";
 import { CircuitBreaker, executeWithRetry, systemClock } from "./resilience.js";
@@ -59,7 +59,10 @@ export class Gateway {
             breaker.recordSuccess();
         }
         catch (error) {
-            breaker.recordFailure();
+            // A client-initiated cancel is not a provider fault — skip the breaker.
+            if (!(error instanceof CancelledError)) {
+                breaker.recordFailure();
+            }
             throw error;
         }
     }
@@ -100,7 +103,10 @@ export class Gateway {
             return response;
         }
         catch (error) {
-            breaker.recordFailure();
+            // A client-initiated cancel is not a provider fault — skip the breaker.
+            if (!(error instanceof CancelledError)) {
+                breaker.recordFailure();
+            }
             throw error;
         }
     }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,eAAO,MAAM,kBAAkB,WAAa,CAAC;AAE7C,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAIvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AA2BD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOlE;AAoDD,wBAAgB,4BAA4B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUrF;AAGD,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EACxC,QAAQ,EAAE,MAAM,IAAI,EACpB,QAAQ,GAAE,MAA2B,GACpC,QAAQ,CAqCV;AAmeD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAoCD,wBAAuB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,cAAc,CA2BhB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,eAAO,MAAM,kBAAkB,WAAa,CAAC;AAE7C,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAIvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AAsCD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOlE;AAoDD,wBAAgB,4BAA4B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUrF;AAGD,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EACxC,QAAQ,EAAE,MAAM,IAAI,EACpB,QAAQ,GAAE,MAA2B,GACpC,QAAQ,CAqCV;AAufD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAoCD,wBAAuB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,cAAc,CA2BhB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.js

@@ -13,6 +13,12 @@ export class OutboundHttpEgressError extends Error {
         this.code = code;
     }
 }
+const FORWARDED_CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "x-litellm-key",
+    "x-api-key",
+    "api-key",
+]);
 function headersFromNode(headers) {
     const out = new Headers();
     for (const [name, value] of Object.entries(headers)) {
@@ -34,6 +40,9 @@ function headersToRecord(headers) {
     });
     return out;
 }
+function hasForwardedCredentialHeader(headers) {
+    return Object.keys(headers).some((name) => FORWARDED_CREDENTIAL_HEADERS.has(name.toLowerCase()));
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -234,7 +243,7 @@ function noProxyRuleMatches(rule, host, hostPort) {
     const domain = rule.startsWith(".") ? rule.slice(1) : rule;
     if (host === domain)
         return true;
-    return rule.startsWith(".") && host.endsWith(`.${domain}`);
+    return host.endsWith(`.${domain}`);
 }
 function noProxyMatches(url, rules) {
     if (rules === undefined || rules.length === 0)
@@ -291,7 +300,7 @@ function mapProxyError(error) {
     if (error instanceof OutboundHttpEgressError)
         return error;
     if (isRecoverableTlsTrustError(error)) {
-        return new OutboundHttpEgressError("TLS_CA_FAILURE", "TLS certificate verification failed for outbound egress.");
+        return tlsCaFailureError();
     }
     if (error instanceof Error) {
         const code = isRecord(error) ? error.code : undefined;
@@ -303,6 +312,9 @@ function mapProxyError(error) {
     }
     return new OutboundHttpEgressError("PROXY_EGRESS_FAILED", "Outbound egress failed.");
 }
+function tlsCaFailureError() {
+    return new OutboundHttpEgressError("TLS_CA_FAILURE", "TLS certificate verification failed for outbound egress.");
+}
 const PROXY_UNREACHABLE_ERROR = new OutboundHttpEgressError("PROXY_UNREACHABLE", "Configured proxy is unreachable.");
 function attachAbortGuard(signal, onAbort) {
     if (signal.aborted) {
@@ -470,6 +482,9 @@ function responseFromClientRequest(start) {
 function fetchHttpViaProxy(target, init, proxy, ca, maxResponseBytes) {
     const body = bodyToString(init.body);
     const headers = headersToRecord(init.headers);
+    if (hasForwardedCredentialHeader(headers)) {
+        throw new OutboundHttpEgressError("PROXY_BLOCKED_BY_POLICY", "Refusing to forward credential headers to a plaintext HTTP target through the configured proxy.");
+    }
     // Ensure Host header omits the default port (fixes SigV4 pre-signed S3 URLs).
     if (!Object.prototype.hasOwnProperty.call(headers, "host")) {
         headers.host = hostHeader(target);
@@ -544,7 +559,18 @@ async function fetchDirectWithCaFallback(url, init, doFetch, useCaFallback, egre
     }
     catch (error) {
         if (useCaFallback && usesHttps(url) && isRecoverableTlsTrustError(error)) {
-            return fetchWithCaBundle(url, init, egress, maxResponseBytes);
+            try {
+                return await fetchWithCaBundle(url, init, egress, maxResponseBytes);
+            }
+            catch (fallbackError) {
+                if (isRecoverableTlsTrustError(fallbackError)) {
+                    throw tlsCaFailureError();
+                }
+                throw fallbackError;
+            }
+        }
+        if (usesHttps(url) && isRecoverableTlsTrustError(error)) {
+            throw tlsCaFailureError();
         }
         throw error;
     }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts

@@ -1,14 +1,14 @@
 export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
-export type { CircuitBreakerConfig, CircuitBreakerStatus, CircuitState, ChatMessage, Clock, CostClass, FinishReason, GatewayConfig, GatewayRequest, GatewayStreamChunk, LatencyClass, ModelCapability, ModelKind, ModelProviderConfig, NormalizedResponse, NormalizedToolCall, ProviderAdapter, ResponseFormat, StreamDelta, StreamEvent, ToolDefinition, UsageMetadata, } from "./types.js";
+export type { CircuitBreakerConfig, CircuitBreakerStatus, CircuitState, ChatMessage, Clock, CostClass, FinishReason, GatewayConfig, GatewayRequest, GatewayStreamChunk, LatencyClass, ModelCapability, ModelKind, ModelProviderConfig, NormalizedResponse, NormalizedToolCall, OutboundHttpEgressConfig, ProviderAdapter, ResponseFormat, StreamDelta, StreamEvent, ToolDefinition, UsageMetadata, } from "./types.js";
 export { CAPABILITY_REGISTRY, createDefaultChatCapability, explainConversationIneligibility, findCapability, isConversationEligibleModel, listCapabilities, resolveCostClass, selectCheapest, type CapabilityQuery, type ConversationIneligibilityReason, } from "./capabilities.js";
 export { CAPABILITY_DATA } from "./capabilities.data.js";
-export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, type EnvSource, type SafeGatewayConfig, type SafeProviderConfig, } from "./config.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, loadEgressConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, resolveOutboundHttpEgressConfig, toSafeObject, validateBaseUrl, type EnvSource, type SafeGatewayConfig, type SafeProviderConfig, } from "./config.js";
 export { Gateway, type GatewayDeps } from "./gateway.js";
 export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, type ModelSelectionQuery, } from "./model-selection.js";
 export { assertCompatibleEmbeddingIdentity, verifyEmbeddingCapability, type EmbeddingCapabilityCheck, type EmbeddingFailureReason, type EmbeddingIdentityWarning, type EmbeddingProbeOptions, type OpenAIEmbeddingAdapter, } from "./embedding.js";
-export { requestOpenAIEmbedding, type OpenAIEmbeddingErrorKind, type OpenAIEmbeddingOutcome, type OpenAIEmbeddingRequest, type OpenAIEmbeddingSuccess, } from "./openai-embedding-adapter.js";
+export { requestOpenAIEmbedding, requestOpenAIEmbeddingBatch, type OpenAIEmbeddingBatchOutcome, type OpenAIEmbeddingBatchRequest, type OpenAIEmbeddingErrorKind, type OpenAIEmbeddingOutcome, type OpenAIEmbeddingRequest, type OpenAIEmbeddingSuccess, } from "./openai-embedding-adapter.js";
 export { redact } from "@oscharko-dev/keiko-security";
-export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, type ErrorCode, } from "@oscharko-dev/keiko-security/errors/gateway";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayEgressError, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, type ErrorCode, type GatewayEgressErrorCode, } from "@oscharko-dev/keiko-security/errors/gateway";
 export * as QualityIntelligence from "./qualityIntelligence/index.js";
 export { QualityIntelligenceSafeErrorException, createInMemoryReplayCache, deriveReplayCacheKey, dispatchQualityIntelligenceRequest, isCacheable, type QualityIntelligenceBudgetState, type QualityIntelligenceCancellationHandle, type QualityIntelligenceReplayCachePort, type QualityIntelligenceSafeError, type QualityIntelligenceSafeErrorCode, } from "./qualityIntelligence/index.js";
 export type { QualityIntelligenceDispatcherArgs, QualityIntelligenceDispatcherResult, } from "./qualityIntelligence/dispatcher.js";

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,KAAK,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,+BAA+B,GACrC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,SAAS,GACf,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,qCAAqC,EACrC,yBAAyB,EACzB,oBAAoB,EACpB,kCAAkC,EAClC,WAAW,EACX,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,GACtC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,KAAK,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,+BAA+B,GACrC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,+BAA+B,EAC/B,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,sBAAsB,GAC5B,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,qCAAqC,EACrC,yBAAyB,EACzB,oBAAoB,EACpB,kCAAkC,EAClC,WAAW,EACX,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,GACtC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,qCAAqC,CAAC"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.js

@@ -13,13 +13,13 @@
 export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
 export { CAPABILITY_REGISTRY, createDefaultChatCapability, explainConversationIneligibility, findCapability, isConversationEligibleModel, listCapabilities, resolveCostClass, selectCheapest, } from "./capabilities.js";
 export { CAPABILITY_DATA } from "./capabilities.data.js";
-export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "./config.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, loadEgressConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, resolveOutboundHttpEgressConfig, toSafeObject, validateBaseUrl, } from "./config.js";
 export { Gateway } from "./gateway.js";
 export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, } from "./model-selection.js";
 export { assertCompatibleEmbeddingIdentity, verifyEmbeddingCapability, } from "./embedding.js";
-export { requestOpenAIEmbedding, } from "./openai-embedding-adapter.js";
+export { requestOpenAIEmbedding, requestOpenAIEmbeddingBatch, } from "./openai-embedding-adapter.js";
 export { redact } from "@oscharko-dev/keiko-security";
-export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayEgressError, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";
 // Quality Intelligence sub-module (Epic #270, Issue #279). Exposed under a namespace so
 // callers reach typed task profiles, the prompt-segmentation seam, the capability gate,
 // the safe-error taxonomy, and (post-M3) the dispatcher via a single import surface.

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.d.ts

@@ -4,5 +4,6 @@ export interface UsageSeed {
     readonly latencyMs: number;
     readonly costClass: CostClass;
 }
+export declare function textFromContent(value: unknown): string;
 export declare function normalizeChatResponse(rawPayload: unknown, modelId: string, seed: UsageSeed, expectStructured?: boolean): NormalizedResponse;
 //# sourceMappingURL=normalize.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,SAAS,EAET,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAwFD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,gBAAgB,UAAQ,GACvB,kBAAkB,CAYpB"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,SAAS,EAET,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAqGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQtD;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,gBAAgB,UAAQ,GACvB,kBAAkB,CAYpB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/normalize.js

@@ -79,6 +79,27 @@ function firstChoice(payload) {
     }
     return isRecord(choices[0]) ? choices[0] : undefined;
 }
+function textPart(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (!isRecord(value)) {
+        return "";
+    }
+    if (typeof value.text === "string") {
+        return value.text;
+    }
+    return typeof value.content === "string" ? value.content : "";
+}
+export function textFromContent(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (!Array.isArray(value)) {
+        return "";
+    }
+    return value.map(textPart).join("");
+}
 export function normalizeChatResponse(rawPayload, modelId, seed, expectStructured = false) {
     const payload = isRecord(rawPayload) ? rawPayload : {};
     const usage = buildUsage(payload, seed);
@@ -87,7 +108,7 @@ export function normalizeChatResponse(rawPayload, modelId, seed, expectStructure
     const finishReason = mapFinishReason(choice?.finish_reason);
     assertNotRefusal(message, finishReason);
     const toolCalls = parseToolCalls(message);
-    const content = typeof message.content === "string" ? message.content : "";
+    const content = textFromContent(message.content);
     const structuredOutput = expectStructured && content.length > 0 ? parseStructuredOutput(content) : null;
     return { modelId, content, finishReason, toolCalls, structuredOutput, usage };
 }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAyOD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA4B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAoBnC;YAIa,YAAY;IA0B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAWR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAmBV,QAAQ;YAYR,aAAa;CAO5B"}
+{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAEV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAmBpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AA2RD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA2B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAqBnC;YAUa,YAAY;IA+B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAeR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAuBV,QAAQ;YAYR,aAAa;CAO5B"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.js

@@ -2,11 +2,33 @@
 // AbortSignal. fetch, clock, request-id, and cost class are injected so tests run
 // with no network I/O and no real time. The raw provider body is never echoed into
 // an error; only a redacted, status-level summary is surfaced.
-import { AuthenticationError, CancelledError, ContextOverflowError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, } from "@oscharko-dev/keiko-security/errors/gateway";
+import { AuthenticationError, CancelledError, ContextOverflowError, ERROR_CODES, GatewayEgressError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, } from "@oscharko-dev/keiko-security/errors/gateway";
 import { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME } from "./config.js";
-import { gatewayFetch, readJsonCapped, readSseStream } from "./http.js";
-import { normalizeChatResponse } from "./normalize.js";
+import { gatewayFetch, OutboundHttpEgressError, readJsonCapped, readSseStream, } from "./http.js";
+import { normalizeChatResponse, textFromContent } from "./normalize.js";
 import { redact } from "@oscharko-dev/keiko-security";
+const PROVIDER_EMPTY_ASSISTANT_STATUS = 200;
+const GATEWAY_EGRESS_CODES = {
+    PROXY_UNREACHABLE: ERROR_CODES.PROXY_UNREACHABLE,
+    PROXY_AUTH_REQUIRED: ERROR_CODES.PROXY_AUTH_REQUIRED,
+    PROXY_EGRESS_FAILED: ERROR_CODES.PROXY_EGRESS_FAILED,
+    PROXY_BLOCKED_BY_POLICY: ERROR_CODES.PROXY_BLOCKED_BY_POLICY,
+    TLS_CA_FAILURE: ERROR_CODES.TLS_CA_FAILURE,
+};
+const GATEWAY_EGRESS_MESSAGES = {
+    PROXY_UNREACHABLE: "configured proxy is unreachable",
+    PROXY_AUTH_REQUIRED: "configured proxy requires authentication",
+    PROXY_EGRESS_FAILED: "configured proxy failed outbound egress",
+    PROXY_BLOCKED_BY_POLICY: "configured proxy blocked outbound egress",
+    TLS_CA_FAILURE: "TLS certificate verification failed for outbound egress",
+};
+function buildMessageContent(content, parts) {
+    if (parts === undefined)
+        return content;
+    return parts.map((part) => part.type === "text"
+        ? { type: "text", text: part.text }
+        : { type: "image_url", image_url: { url: part.image_url.url } });
+}
 function buildMessage(message) {
     const toolCalls = message.toolCalls?.map((call) => ({
         id: call.id,
@@ -17,7 +39,7 @@ function buildMessage(message) {
         role: message.role,
         content: message.role === "assistant" && toolCalls !== undefined && toolCalls.length > 0
             ? null
-            : message.content,
+            : buildMessageContent(message.content, message.contentParts),
         ...(message.role === "tool" && message.toolCallId !== undefined
             ? { tool_call_id: message.toolCallId }
             : {}),
@@ -72,7 +94,11 @@ function firstStreamChoice(chunk) {
 function deltaFromChunk(chunk) {
     const choice = firstStreamChoice(chunk);
     const delta = choice !== undefined && isRecord(choice.delta) ? choice.delta : undefined;
-    return delta !== undefined && typeof delta.content === "string" ? delta.content : undefined;
+    if (delta === undefined || !("content" in delta)) {
+        return undefined;
+    }
+    const content = textFromContent(delta.content);
+    return content.length > 0 ? content : undefined;
 }
 function finishReasonFromChunk(chunk) {
     const choice = firstStreamChoice(chunk);
@@ -135,6 +161,12 @@ function redactResponse(response, secrets) {
         structuredOutput: redactRecord(response.structuredOutput, secrets),
     };
 }
+function assertUsableAssistantResponse(response, modelId, secrets) {
+    if (response.content.trim().length > 0 || response.toolCalls.length > 0) {
+        return;
+    }
+    throw new ProviderError(`provider returned an empty assistant response for '${modelId}'`, PROVIDER_EMPTY_ASSISTANT_STATUS, secrets);
+}
 function errorSignal(payload) {
     const error = isRecord(payload) && isRecord(payload.error) ? payload.error : payload;
     if (!isRecord(error)) {
@@ -173,6 +205,11 @@ function apiKeyHeaders(config) {
     const headerName = config.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME;
     return { [headerName]: apiKeyHeaderValue(headerName, config.apiKey) };
 }
+function mapOutboundEgressError(error, secrets) {
+    if (!(error instanceof OutboundHttpEgressError))
+        return undefined;
+    return new GatewayEgressError(GATEWAY_EGRESS_CODES[error.code], GATEWAY_EGRESS_MESSAGES[error.code], secrets);
+}
 export class OpenAiAdapter {
     deps;
     now;
@@ -192,11 +229,13 @@ export class OpenAiAdapter {
             mapHttpError(response, config.modelId, secrets, errorPayload);
         }
         const payload = await this.readBody(response, config, secrets);
-        return redactResponse(normalizeChatResponse(payload, config.modelId, {
+        const normalized = normalizeChatResponse(payload, config.modelId, {
             requestId: this.deps.requestId,
             latencyMs: this.now() - start,
             costClass: this.deps.costClass,
-        }, request.responseFormat?.type === "json_schema"), secrets);
+        }, request.responseFormat?.type === "json_schema");
+        assertUsableAssistantResponse(normalized, config.modelId, secrets);
+        return redactResponse(normalized, secrets);
     };
     // Streaming chat path (Layer 1): yields redacted content-delta tokens as they
     // arrive, then a terminal `done` with the assembled, redacted NormalizedResponse.
@@ -217,17 +256,29 @@ export class OpenAiAdapter {
             yield { type: "delta", token };
         }
         const assembled = this.assembleResponse(config, start, acc);
+        assertUsableAssistantResponse(assembled, config.modelId, secrets);
         yield { type: "done", response: redactResponse(assembled, secrets) };
     };
-    // Iterates the SSE stream, yielding each redacted content token while mutating
-    // `acc` with the raw accumulated content, finish reason, and final usage counts.
+    // Iterates the SSE stream, yielding redacted content tokens while mutating `acc`.
+    // Redaction is applied to the full accumulated buffer on every delta so that a
+    // configured secret straddling two SSE chunk boundaries is still caught.  We track
+    // how many characters of the REDACTED output we have already emitted and yield only
+    // the new suffix each time.  When a cross-delta match shrinks the redacted string
+    // relative to what was emitted, the cursor overshoots and the tail (containing the
+    // secret or its replacement) is deferred to the terminal `done` chunk, which always
+    // redacts the full `acc.content` independently via redactResponse().
     async *streamDeltas(response, config, secrets, acc) {
+        let emittedRedactedLength = 0;
         try {
             for await (const chunk of readSseStream(response)) {
                 const content = deltaFromChunk(chunk);
                 if (content !== undefined) {
                     acc.content += content;
-                    yield redact(content, secrets);
+                    const redacted = redact(acc.content, secrets);
+                    if (redacted.length > emittedRedactedLength) {
+                        yield redacted.slice(emittedRedactedLength);
+                        emittedRedactedLength = redacted.length;
+                    }
                 }
                 const finish = finishReasonFromChunk(chunk);
                 if (finish !== undefined)
@@ -266,6 +317,10 @@ export class OpenAiAdapter {
         if (error instanceof CancelledError || error instanceof TimeoutError) {
             return error;
         }
+        const egressError = mapOutboundEgressError(error, secrets);
+        if (egressError !== undefined) {
+            return egressError;
+        }
         return new TransportError(`stream read failed for '${config.modelId}'`, secrets);
     }
     async dispatch(request, config, secrets, stream = false) {
@@ -296,6 +351,10 @@ export class OpenAiAdapter {
         if (cancel?.aborted === true) {
             return new CancelledError(`request for '${config.modelId}' cancelled`, secrets);
         }
+        const egressError = mapOutboundEgressError(error, secrets);
+        if (egressError !== undefined) {
+            return egressError;
+        }
         if (timeout.aborted) {
             return new TimeoutError(`request for '${config.modelId}' timed out`, secrets);
         }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-embedding-adapter.d.ts

@@ -15,6 +15,24 @@ export interface OpenAIEmbeddingSuccess {
     readonly modelId: string;
     readonly modelRevision?: string;
 }
+export interface OpenAIEmbeddingBatchRequest {
+    readonly endpoint: string;
+    readonly apiKey: string;
+    readonly apiKeyHeaderName?: string;
+    readonly modelId: string;
+    readonly inputs: readonly string[];
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    readonly fetchImpl?: typeof fetch;
+    readonly egress?: OutboundHttpEgressConfig | undefined;
+}
+export type OpenAIEmbeddingBatchOutcome = {
+    readonly ok: true;
+    readonly value: readonly OpenAIEmbeddingSuccess[];
+} | {
+    readonly ok: false;
+    readonly kind: OpenAIEmbeddingErrorKind;
+};
 export type OpenAIEmbeddingOutcome = {
     readonly ok: true;
     readonly value: OpenAIEmbeddingSuccess;
@@ -22,6 +40,7 @@ export type OpenAIEmbeddingOutcome = {
     readonly ok: false;
     readonly kind: OpenAIEmbeddingErrorKind;
 };
-export type OpenAIEmbeddingErrorKind = "wrong-header" | "rate-limited" | "unsupported-model" | "timeout" | "cancelled" | "transport" | "invalid-response";
+export type OpenAIEmbeddingErrorKind = "wrong-header" | "rate-limited" | "unsupported-model" | "timeout" | "cancelled" | "transport" | "proxy-unreachable" | "proxy-auth-required" | "proxy-egress-failed" | "proxy-blocked-by-policy" | "tls-ca-failure" | "invalid-response";
 export declare function requestOpenAIEmbedding(request: OpenAIEmbeddingRequest): Promise<OpenAIEmbeddingOutcome>;
+export declare function requestOpenAIEmbeddingBatch(request: OpenAIEmbeddingBatchRequest): Promise<OpenAIEmbeddingBatchOutcome>;
 //# sourceMappingURL=openai-embedding-adapter.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-embedding-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-embedding-adapter.d.ts","sourceRoot":"","sources":["../src/openai-embedding-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,WAAW,GACX,kBAAkB,CAAC;AA0KvB,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAYjC"}
+{"version":3,"file":"openai-embedding-adapter.d.ts","sourceRoot":"","sources":["../src/openai-embedding-adapter.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,MAAM,2BAA2B,GAEnC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,GAChB,kBAAkB,CAAC;AAoLvB,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAuHD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAetC"}