@oscharko-dev/keiko 0.2.0-beta.5 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/embedding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedding.d.ts","sourceRoot":"","sources":["../src/embedding.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,KAAK,EAEV,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,aAAa,GACb,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,kBAAkB,GAClB,mCAAmC,CAAC;AAExC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACtF;AA4DD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAiCnC;AA4BD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,wBAAwB,CAW1B"}
+{"version":3,"file":"embedding.d.ts","sourceRoot":"","sources":["../src/embedding.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAE3B,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,MAAM,MAAM,sBAAsB,GAC9B,qBAAqB,GACrB,aAAa,GACb,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,GAChB,kBAAkB,GAClB,mCAAmC,CAAC;AAExC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAIrF,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,KAAK,EAAE,2BAA2B,KAC/B,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3C;AAkED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAiCnC;AA4BD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,wBAAwB,CAW1B"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/embedding.js

@@ -15,29 +15,33 @@ const SAFE_MESSAGES = Object.freeze({
     timeout: "embedding probe timed out",
     cancelled: "embedding probe was cancelled by the caller",
     "unsupported-model": "embedding model is not available on the configured gateway",
+    "proxy-unreachable": "configured proxy is unreachable",
+    "proxy-auth-required": "configured proxy requires authentication",
+    "proxy-egress-failed": "configured proxy failed outbound egress",
+    "proxy-blocked-by-policy": "configured proxy blocked outbound egress",
+    "tls-ca-failure": "TLS certificate verification failed for outbound egress",
     "invalid-response": "embedding response was malformed",
     "incompatible-with-stored-identity": "embedding model identity changed — existing capsules are no longer compatible",
 });
+const ADAPTER_FAILURE_REASONS = Object.freeze({
+    "wrong-header": "wrong-header",
+    "rate-limited": "rate-limited",
+    "unsupported-model": "unsupported-model",
+    timeout: "timeout",
+    cancelled: "cancelled",
+    "invalid-response": "invalid-response",
+    "proxy-unreachable": "proxy-unreachable",
+    "proxy-auth-required": "proxy-auth-required",
+    "proxy-egress-failed": "proxy-egress-failed",
+    "proxy-blocked-by-policy": "proxy-blocked-by-policy",
+    "tls-ca-failure": "tls-ca-failure",
+    transport: "unavailable",
+});
 function fail(reason) {
     return { ok: false, reason, safeMessage: SAFE_MESSAGES[reason] };
 }
 function reasonFromAdapter(kind) {
-    switch (kind) {
-        case "wrong-header":
-            return "wrong-header";
-        case "rate-limited":
-            return "rate-limited";
-        case "unsupported-model":
-            return "unsupported-model";
-        case "timeout":
-            return "timeout";
-        case "cancelled":
-            return "cancelled";
-        case "invalid-response":
-            return "invalid-response";
-        case "transport":
-            return "unavailable";
-    }
+    return ADAPTER_FAILURE_REASONS[kind];
 }
 function hasCredentials(adapter) {
     return adapter.apiKey.trim().length > 0;

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAGlB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAOD,qBAAa,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAG3C,MAAM,EAAE,aAAa,EACtC,IAAI,GAAE,WAAgB;IAOlB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+BzD,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC,kBAAkB,CAAC;YAoB/D,UAAU;IAczB,OAAO,CAAC,MAAM;IAiBd,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;YAYtC,MAAM;IAiBpB,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAUnB"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,kBAAkB,EAGlB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;CACpC;AAOD,qBAAa,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAG3C,MAAM,EAAE,aAAa,EACtC,IAAI,GAAE,WAAgB;IAOlB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+BzD,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC,kBAAkB,CAAC;YAuB/D,UAAU;IAczB,OAAO,CAAC,MAAM;IAiBd,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB;YAYtC,MAAM;IAoBpB,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,UAAU;CAUnB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/gateway.js

@@ -3,7 +3,7 @@
 // (request id, latency, cost class) is owned by the gateway, not the provider, so
 // the audit ledger (issue #10) has a reliable typed target on every response.
 import { randomUUID } from "node:crypto";
-import { UnknownModelError } from "@oscharko-dev/keiko-security/errors/gateway";
+import { CancelledError, UnknownModelError } from "@oscharko-dev/keiko-security/errors/gateway";
 import { findConfiguredCapability } from "./model-selection.js";
 import { OpenAiAdapter } from "./openai-adapter.js";
 import { CircuitBreaker, executeWithRetry, systemClock } from "./resilience.js";
@@ -59,7 +59,10 @@ export class Gateway {
             breaker.recordSuccess();
         }
         catch (error) {
-            breaker.recordFailure();
+            // A client-initiated cancel is not a provider fault — skip the breaker.
+            if (!(error instanceof CancelledError)) {
+                breaker.recordFailure();
+            }
             throw error;
         }
     }
@@ -100,7 +103,10 @@ export class Gateway {
             return response;
         }
         catch (error) {
-            breaker.recordFailure();
+            // A client-initiated cancel is not a provider fault — skip the breaker.
+            if (!(error instanceof CancelledError)) {
+                breaker.recordFailure();
+            }
             throw error;
         }
     }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,eAAO,MAAM,kBAAkB,WAAa,CAAC;AAE7C,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAIvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AA2BD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOlE;AAoDD,wBAAgB,4BAA4B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUrF;AAGD,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EACxC,QAAQ,EAAE,MAAM,IAAI,EACpB,QAAQ,GAAE,MAA2B,GACpC,QAAQ,CAqCV;AAmeD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAoCD,wBAAuB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,cAAc,CA2BhB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D,eAAO,MAAM,kBAAkB,WAAa,CAAC;AAE7C,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAIvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,CAAC;AAErB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AAsCD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOlE;AAoDD,wBAAgB,4BAA4B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAUrF;AAGD,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EACxC,QAAQ,EAAE,MAAM,IAAI,EACpB,QAAQ,GAAE,MAA2B,GACpC,QAAQ,CAqCV;AAufD,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAoCD,wBAAuB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,MAA2B,GACpC,cAAc,CA2BhB"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/http.js

@@ -13,6 +13,12 @@ export class OutboundHttpEgressError extends Error {
         this.code = code;
     }
 }
+const FORWARDED_CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "x-litellm-key",
+    "x-api-key",
+    "api-key",
+]);
 function headersFromNode(headers) {
     const out = new Headers();
     for (const [name, value] of Object.entries(headers)) {
@@ -34,6 +40,9 @@ function headersToRecord(headers) {
     });
     return out;
 }
+function hasForwardedCredentialHeader(headers) {
+    return Object.keys(headers).some((name) => FORWARDED_CREDENTIAL_HEADERS.has(name.toLowerCase()));
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -234,7 +243,7 @@ function noProxyRuleMatches(rule, host, hostPort) {
     const domain = rule.startsWith(".") ? rule.slice(1) : rule;
     if (host === domain)
         return true;
-    return rule.startsWith(".") && host.endsWith(`.${domain}`);
+    return host.endsWith(`.${domain}`);
 }
 function noProxyMatches(url, rules) {
     if (rules === undefined || rules.length === 0)
@@ -291,7 +300,7 @@ function mapProxyError(error) {
     if (error instanceof OutboundHttpEgressError)
         return error;
     if (isRecoverableTlsTrustError(error)) {
-        return new OutboundHttpEgressError("TLS_CA_FAILURE", "TLS certificate verification failed for outbound egress.");
+        return tlsCaFailureError();
     }
     if (error instanceof Error) {
         const code = isRecord(error) ? error.code : undefined;
@@ -303,6 +312,9 @@ function mapProxyError(error) {
     }
     return new OutboundHttpEgressError("PROXY_EGRESS_FAILED", "Outbound egress failed.");
 }
+function tlsCaFailureError() {
+    return new OutboundHttpEgressError("TLS_CA_FAILURE", "TLS certificate verification failed for outbound egress.");
+}
 const PROXY_UNREACHABLE_ERROR = new OutboundHttpEgressError("PROXY_UNREACHABLE", "Configured proxy is unreachable.");
 function attachAbortGuard(signal, onAbort) {
     if (signal.aborted) {
@@ -470,6 +482,9 @@ function responseFromClientRequest(start) {
 function fetchHttpViaProxy(target, init, proxy, ca, maxResponseBytes) {
     const body = bodyToString(init.body);
     const headers = headersToRecord(init.headers);
+    if (hasForwardedCredentialHeader(headers)) {
+        throw new OutboundHttpEgressError("PROXY_BLOCKED_BY_POLICY", "Refusing to forward credential headers to a plaintext HTTP target through the configured proxy.");
+    }
     // Ensure Host header omits the default port (fixes SigV4 pre-signed S3 URLs).
     if (!Object.prototype.hasOwnProperty.call(headers, "host")) {
         headers.host = hostHeader(target);
@@ -544,7 +559,18 @@ async function fetchDirectWithCaFallback(url, init, doFetch, useCaFallback, egre
     }
     catch (error) {
         if (useCaFallback && usesHttps(url) && isRecoverableTlsTrustError(error)) {
-            return fetchWithCaBundle(url, init, egress, maxResponseBytes);
+            try {
+                return await fetchWithCaBundle(url, init, egress, maxResponseBytes);
+            }
+            catch (fallbackError) {
+                if (isRecoverableTlsTrustError(fallbackError)) {
+                    throw tlsCaFailureError();
+                }
+                throw fallbackError;
+            }
+        }
+        if (usesHttps(url) && isRecoverableTlsTrustError(error)) {
+            throw tlsCaFailureError();
         }
         throw error;
     }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts

@@ -1,14 +1,14 @@
 export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
-export type { CircuitBreakerConfig, CircuitBreakerStatus, CircuitState, ChatMessage, Clock, CostClass, FinishReason, GatewayConfig, GatewayRequest, GatewayStreamChunk, LatencyClass, ModelCapability, ModelKind, ModelProviderConfig, NormalizedResponse, NormalizedToolCall, ProviderAdapter, ResponseFormat, StreamDelta, StreamEvent, ToolDefinition, UsageMetadata, } from "./types.js";
+export type { CircuitBreakerConfig, CircuitBreakerStatus, CircuitState, ChatMessage, Clock, CostClass, FinishReason, GatewayConfig, GatewayRequest, GatewayStreamChunk, LatencyClass, ModelCapability, ModelKind, ModelProviderConfig, NormalizedResponse, NormalizedToolCall, OutboundHttpEgressConfig, ProviderAdapter, ResponseFormat, StreamDelta, StreamEvent, ToolDefinition, UsageMetadata, } from "./types.js";
 export { CAPABILITY_REGISTRY, createDefaultChatCapability, explainConversationIneligibility, findCapability, isConversationEligibleModel, listCapabilities, resolveCostClass, selectCheapest, type CapabilityQuery, type ConversationIneligibilityReason, } from "./capabilities.js";
 export { CAPABILITY_DATA } from "./capabilities.data.js";
-export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, type EnvSource, type SafeGatewayConfig, type SafeProviderConfig, } from "./config.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, loadEgressConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, resolveOutboundHttpEgressConfig, toSafeObject, validateBaseUrl, type EnvSource, type SafeGatewayConfig, type SafeProviderConfig, } from "./config.js";
 export { Gateway, type GatewayDeps } from "./gateway.js";
 export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, type ModelSelectionQuery, } from "./model-selection.js";
 export { assertCompatibleEmbeddingIdentity, verifyEmbeddingCapability, type EmbeddingCapabilityCheck, type EmbeddingFailureReason, type EmbeddingIdentityWarning, type EmbeddingProbeOptions, type OpenAIEmbeddingAdapter, } from "./embedding.js";
-export { requestOpenAIEmbedding, type OpenAIEmbeddingErrorKind, type OpenAIEmbeddingOutcome, type OpenAIEmbeddingRequest, type OpenAIEmbeddingSuccess, } from "./openai-embedding-adapter.js";
+export { requestOpenAIEmbedding, requestOpenAIEmbeddingBatch, type OpenAIEmbeddingBatchOutcome, type OpenAIEmbeddingBatchRequest, type OpenAIEmbeddingErrorKind, type OpenAIEmbeddingOutcome, type OpenAIEmbeddingRequest, type OpenAIEmbeddingSuccess, } from "./openai-embedding-adapter.js";
 export { redact } from "@oscharko-dev/keiko-security";
-export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, type ErrorCode, } from "@oscharko-dev/keiko-security/errors/gateway";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayEgressError, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, type ErrorCode, type GatewayEgressErrorCode, } from "@oscharko-dev/keiko-security/errors/gateway";
 export * as QualityIntelligence from "./qualityIntelligence/index.js";
 export { QualityIntelligenceSafeErrorException, createInMemoryReplayCache, deriveReplayCacheKey, dispatchQualityIntelligenceRequest, isCacheable, type QualityIntelligenceBudgetState, type QualityIntelligenceCancellationHandle, type QualityIntelligenceReplayCachePort, type QualityIntelligenceSafeError, type QualityIntelligenceSafeErrorCode, } from "./qualityIntelligence/index.js";
 export type { QualityIntelligenceDispatcherArgs, QualityIntelligenceDispatcherResult, } from "./qualityIntelligence/dispatcher.js";

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,KAAK,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,+BAA+B,GACrC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,SAAS,GACf,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,qCAAqC,EACrC,yBAAyB,EACzB,oBAAoB,EACpB,kCAAkC,EAClC,WAAW,EACX,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,GACtC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,KAAK,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,gCAAgC,EAChC,cAAc,EACd,2BAA2B,EAC3B,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,+BAA+B,GACrC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,+BAA+B,EAC/B,YAAY,EACZ,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,sBAAsB,GAC5B,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,qCAAqC,EACrC,yBAAyB,EACzB,oBAAoB,EACpB,kCAAkC,EAClC,WAAW,EACX,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,GACtC,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,qCAAqC,CAAC"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/index.js

@@ -13,13 +13,13 @@
 export { KEIKO_MODEL_GATEWAY_VERSION } from "./version.js";
 export { CAPABILITY_REGISTRY, createDefaultChatCapability, explainConversationIneligibility, findCapability, isConversationEligibleModel, listCapabilities, resolveCostClass, selectCheapest, } from "./capabilities.js";
 export { CAPABILITY_DATA } from "./capabilities.data.js";
-export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "./config.js";
+export { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME, loadConfigFromFile, loadEgressConfigFromFile, normalizeApiKeyHeaderName, parseGatewayConfig, resolveOutboundHttpEgressConfig, toSafeObject, validateBaseUrl, } from "./config.js";
 export { Gateway } from "./gateway.js";
 export { assertConfiguredModel, findConfiguredCapability, listConfiguredCapabilities, selectConfiguredModel, } from "./model-selection.js";
 export { assertCompatibleEmbeddingIdentity, verifyEmbeddingCapability, } from "./embedding.js";
-export { requestOpenAIEmbedding, } from "./openai-embedding-adapter.js";
+export { requestOpenAIEmbedding, requestOpenAIEmbeddingBatch, } from "./openai-embedding-adapter.js";
 export { redact } from "@oscharko-dev/keiko-security";
-export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";
+export { AuthenticationError, CancelledError, CircuitOpenError, ConfigInvalidError, ContextOverflowError, ERROR_CODES, GatewayEgressError, GatewayError, MalformedToolCallError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, UnknownModelError, } from "@oscharko-dev/keiko-security/errors/gateway";
 // Quality Intelligence sub-module (Epic #270, Issue #279). Exposed under a namespace so
 // callers reach typed task profiles, the prompt-segmentation seam, the capability gate,
 // the safe-error taxonomy, and (post-M3) the dispatcher via a single import surface.

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AA4PD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA2B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAqBnC;YAIa,YAAY;IA0B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAWR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAmBV,QAAQ;YAYR,aAAa;CAO5B"}
+{"version":3,"file":"openai-adapter.d.ts","sourceRoot":"","sources":["../src/openai-adapter.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAEV,SAAS,EAET,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAElB,eAAe,EAEhB,MAAM,YAAY,CAAC;AAmBpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AA2RD,qBAAa,aAAc,YAAW,eAAe;IAGvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,IAAI,GACF,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,OAAO,CAAC,kBAAkB,CAAC,CA2B5B;IAKF,UAAU,GACR,MAAM,aAAa,EACnB,SAAS,cAAc,EACvB,QAAQ,mBAAmB,KAC1B,cAAc,CAAC,kBAAkB,CAAC,CAqBnC;YAUa,YAAY;IA+B3B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,cAAc;YAeR,QAAQ;IA6BtB,OAAO,CAAC,gBAAgB;YAuBV,QAAQ;YAYR,aAAa;CAO5B"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-adapter.js

@@ -2,12 +2,33 @@
 // AbortSignal. fetch, clock, request-id, and cost class are injected so tests run
 // with no network I/O and no real time. The raw provider body is never echoed into
 // an error; only a redacted, status-level summary is surfaced.
-import { AuthenticationError, CancelledError, ContextOverflowError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, } from "@oscharko-dev/keiko-security/errors/gateway";
+import { AuthenticationError, CancelledError, ContextOverflowError, ERROR_CODES, GatewayEgressError, ModelRefusalError, ProviderError, RateLimitError, TimeoutError, TransportError, } from "@oscharko-dev/keiko-security/errors/gateway";
 import { apiKeyHeaderValue, DEFAULT_API_KEY_HEADER_NAME } from "./config.js";
-import { gatewayFetch, readJsonCapped, readSseStream } from "./http.js";
+import { gatewayFetch, OutboundHttpEgressError, readJsonCapped, readSseStream, } from "./http.js";
 import { normalizeChatResponse, textFromContent } from "./normalize.js";
 import { redact } from "@oscharko-dev/keiko-security";
 const PROVIDER_EMPTY_ASSISTANT_STATUS = 200;
+const GATEWAY_EGRESS_CODES = {
+    PROXY_UNREACHABLE: ERROR_CODES.PROXY_UNREACHABLE,
+    PROXY_AUTH_REQUIRED: ERROR_CODES.PROXY_AUTH_REQUIRED,
+    PROXY_EGRESS_FAILED: ERROR_CODES.PROXY_EGRESS_FAILED,
+    PROXY_BLOCKED_BY_POLICY: ERROR_CODES.PROXY_BLOCKED_BY_POLICY,
+    TLS_CA_FAILURE: ERROR_CODES.TLS_CA_FAILURE,
+};
+const GATEWAY_EGRESS_MESSAGES = {
+    PROXY_UNREACHABLE: "configured proxy is unreachable",
+    PROXY_AUTH_REQUIRED: "configured proxy requires authentication",
+    PROXY_EGRESS_FAILED: "configured proxy failed outbound egress",
+    PROXY_BLOCKED_BY_POLICY: "configured proxy blocked outbound egress",
+    TLS_CA_FAILURE: "TLS certificate verification failed for outbound egress",
+};
+function buildMessageContent(content, parts) {
+    if (parts === undefined)
+        return content;
+    return parts.map((part) => part.type === "text"
+        ? { type: "text", text: part.text }
+        : { type: "image_url", image_url: { url: part.image_url.url } });
+}
 function buildMessage(message) {
     const toolCalls = message.toolCalls?.map((call) => ({
         id: call.id,
@@ -18,7 +39,7 @@ function buildMessage(message) {
         role: message.role,
         content: message.role === "assistant" && toolCalls !== undefined && toolCalls.length > 0
             ? null
-            : message.content,
+            : buildMessageContent(message.content, message.contentParts),
         ...(message.role === "tool" && message.toolCallId !== undefined
             ? { tool_call_id: message.toolCallId }
             : {}),
@@ -184,6 +205,11 @@ function apiKeyHeaders(config) {
     const headerName = config.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME;
     return { [headerName]: apiKeyHeaderValue(headerName, config.apiKey) };
 }
+function mapOutboundEgressError(error, secrets) {
+    if (!(error instanceof OutboundHttpEgressError))
+        return undefined;
+    return new GatewayEgressError(GATEWAY_EGRESS_CODES[error.code], GATEWAY_EGRESS_MESSAGES[error.code], secrets);
+}
 export class OpenAiAdapter {
     deps;
     now;
@@ -233,15 +259,26 @@ export class OpenAiAdapter {
         assertUsableAssistantResponse(assembled, config.modelId, secrets);
         yield { type: "done", response: redactResponse(assembled, secrets) };
     };
-    // Iterates the SSE stream, yielding each redacted content token while mutating
-    // `acc` with the raw accumulated content, finish reason, and final usage counts.
+    // Iterates the SSE stream, yielding redacted content tokens while mutating `acc`.
+    // Redaction is applied to the full accumulated buffer on every delta so that a
+    // configured secret straddling two SSE chunk boundaries is still caught.  We track
+    // how many characters of the REDACTED output we have already emitted and yield only
+    // the new suffix each time.  When a cross-delta match shrinks the redacted string
+    // relative to what was emitted, the cursor overshoots and the tail (containing the
+    // secret or its replacement) is deferred to the terminal `done` chunk, which always
+    // redacts the full `acc.content` independently via redactResponse().
     async *streamDeltas(response, config, secrets, acc) {
+        let emittedRedactedLength = 0;
         try {
             for await (const chunk of readSseStream(response)) {
                 const content = deltaFromChunk(chunk);
                 if (content !== undefined) {
                     acc.content += content;
-                    yield redact(content, secrets);
+                    const redacted = redact(acc.content, secrets);
+                    if (redacted.length > emittedRedactedLength) {
+                        yield redacted.slice(emittedRedactedLength);
+                        emittedRedactedLength = redacted.length;
+                    }
                 }
                 const finish = finishReasonFromChunk(chunk);
                 if (finish !== undefined)
@@ -280,6 +317,10 @@ export class OpenAiAdapter {
         if (error instanceof CancelledError || error instanceof TimeoutError) {
             return error;
         }
+        const egressError = mapOutboundEgressError(error, secrets);
+        if (egressError !== undefined) {
+            return egressError;
+        }
         return new TransportError(`stream read failed for '${config.modelId}'`, secrets);
     }
     async dispatch(request, config, secrets, stream = false) {
@@ -310,6 +351,10 @@ export class OpenAiAdapter {
         if (cancel?.aborted === true) {
             return new CancelledError(`request for '${config.modelId}' cancelled`, secrets);
         }
+        const egressError = mapOutboundEgressError(error, secrets);
+        if (egressError !== undefined) {
+            return egressError;
+        }
         if (timeout.aborted) {
             return new TimeoutError(`request for '${config.modelId}' timed out`, secrets);
         }

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-embedding-adapter.d.ts

@@ -15,6 +15,24 @@ export interface OpenAIEmbeddingSuccess {
     readonly modelId: string;
     readonly modelRevision?: string;
 }
+export interface OpenAIEmbeddingBatchRequest {
+    readonly endpoint: string;
+    readonly apiKey: string;
+    readonly apiKeyHeaderName?: string;
+    readonly modelId: string;
+    readonly inputs: readonly string[];
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    readonly fetchImpl?: typeof fetch;
+    readonly egress?: OutboundHttpEgressConfig | undefined;
+}
+export type OpenAIEmbeddingBatchOutcome = {
+    readonly ok: true;
+    readonly value: readonly OpenAIEmbeddingSuccess[];
+} | {
+    readonly ok: false;
+    readonly kind: OpenAIEmbeddingErrorKind;
+};
 export type OpenAIEmbeddingOutcome = {
     readonly ok: true;
     readonly value: OpenAIEmbeddingSuccess;
@@ -22,6 +40,7 @@ export type OpenAIEmbeddingOutcome = {
     readonly ok: false;
     readonly kind: OpenAIEmbeddingErrorKind;
 };
-export type OpenAIEmbeddingErrorKind = "wrong-header" | "rate-limited" | "unsupported-model" | "timeout" | "cancelled" | "transport" | "invalid-response";
+export type OpenAIEmbeddingErrorKind = "wrong-header" | "rate-limited" | "unsupported-model" | "timeout" | "cancelled" | "transport" | "proxy-unreachable" | "proxy-auth-required" | "proxy-egress-failed" | "proxy-blocked-by-policy" | "tls-ca-failure" | "invalid-response";
 export declare function requestOpenAIEmbedding(request: OpenAIEmbeddingRequest): Promise<OpenAIEmbeddingOutcome>;
+export declare function requestOpenAIEmbeddingBatch(request: OpenAIEmbeddingBatchRequest): Promise<OpenAIEmbeddingBatchOutcome>;
 //# sourceMappingURL=openai-embedding-adapter.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-embedding-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-embedding-adapter.d.ts","sourceRoot":"","sources":["../src/openai-embedding-adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,WAAW,GACX,kBAAkB,CAAC;AA0KvB,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAYjC"}
+{"version":3,"file":"openai-embedding-adapter.d.ts","sourceRoot":"","sources":["../src/openai-embedding-adapter.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,MAAM,2BAA2B,GAEnC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,sBAAsB,EAAE,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,yBAAyB,GACzB,gBAAgB,GAChB,kBAAkB,CAAC;AAoLvB,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAuHD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAetC"}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/openai-embedding-adapter.js

@@ -2,7 +2,14 @@
 // dependency), mirroring openai-adapter.ts. Surfaces only structural status
 // information; the raw provider body never escapes this module.
 import { apiKeyHeaderValue } from "./config.js";
-import { gatewayFetch, readJsonCapped } from "./http.js";
+import { gatewayFetch, OutboundHttpEgressError, readJsonCapped, } from "./http.js";
+const OUTBOUND_EMBEDDING_KINDS = {
+    PROXY_UNREACHABLE: "proxy-unreachable",
+    PROXY_AUTH_REQUIRED: "proxy-auth-required",
+    PROXY_EGRESS_FAILED: "proxy-egress-failed",
+    PROXY_BLOCKED_BY_POLICY: "proxy-blocked-by-policy",
+    TLS_CA_FAILURE: "tls-ca-failure",
+};
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -67,10 +74,12 @@ function classifyStatus(status) {
 // transport error. Without this distinction, callers cannot tell whether their user
 // pressed Cancel or the server hung. #192 Copilot finding.
 function classifyDispatchError(error, timeoutSignal, callerSignal) {
-    if (timeoutSignal.aborted)
-        return "timeout";
     if (callerSignal?.aborted === true)
         return "cancelled";
+    if (error instanceof OutboundHttpEgressError)
+        return OUTBOUND_EMBEDDING_KINDS[error.code];
+    if (timeoutSignal.aborted)
+        return "timeout";
     if (error instanceof DOMException && error.name === "TimeoutError")
         return "timeout";
     // A bare AbortError without either of our signals being aborted is a transport error
@@ -107,15 +116,15 @@ async function discardBody(response) {
         // ignore — body discarded intentionally
     }
 }
-async function dispatch(request, built) {
+async function dispatch(built, fetchImpl, egress) {
     try {
         return await gatewayFetch(built.url, {
             method: "POST",
             headers: built.headers,
             body: built.body,
             signal: built.signal,
-            ...(request.fetchImpl !== undefined ? { fetchImpl: request.fetchImpl } : {}),
-            ...(request.egress !== undefined ? { egress: request.egress } : {}),
+            ...(fetchImpl !== undefined ? { fetchImpl } : {}),
+            ...(egress !== undefined ? { egress } : {}),
         });
     }
     catch (error) {
@@ -143,7 +152,7 @@ async function decodeSuccess(response, request) {
 }
 export async function requestOpenAIEmbedding(request) {
     const built = buildRequest(request);
-    const dispatched = await dispatch(request, built);
+    const dispatched = await dispatch(built, request.fetchImpl, request.egress);
     if (typeof dispatched === "string") {
         return { ok: false, kind: dispatched };
     }
@@ -154,3 +163,109 @@ export async function requestOpenAIEmbedding(request) {
     }
     return decodeSuccess(dispatched, request);
 }
+// ─── Array-batch transport (#189 GRD-004) ────────────────────────────────────
+function buildBatchRequest(request) {
+    const name = headerName(request.apiKeyHeaderName);
+    const headers = {
+        "content-type": "application/json",
+        [name]: apiKeyHeaderValue(name, request.apiKey),
+    };
+    // OpenAI-compatible body: `input` is the array. Identical envelope to the scalar path
+    // except the array value, so the same gateway/TLS/egress handling applies.
+    const body = JSON.stringify({ model: request.modelId, input: request.inputs });
+    const timeoutSignal = AbortSignal.timeout(request.timeoutMs ?? 30_000);
+    const signal = request.signal !== undefined ? AbortSignal.any([timeoutSignal, request.signal]) : timeoutSignal;
+    return {
+        url: joinUrl(request.endpoint),
+        headers,
+        body,
+        signal,
+        timeoutSignal,
+        callerSignal: request.signal,
+    };
+}
+// Resolve the slot index for one `data[]` entry, or -1 if its index is missing, non-integer,
+// out of range, or already filled (duplicate).
+function batchSlotIndex(item, count, slots) {
+    const index = typeof item.index === "number" ? item.index : -1;
+    if (!Number.isInteger(index) || index < 0 || index >= count)
+        return -1;
+    return slots[index] === undefined ? index : -1;
+}
+function buildBatchSuccess(item, embedding, ctx) {
+    const modelId = (typeof item.model === "string" ? item.model : undefined) ?? ctx.topModel ?? ctx.requestModelId;
+    return {
+        vector: Float32Array.from(embedding),
+        modelId,
+        ...(ctx.topRevision !== undefined ? { modelRevision: ctx.topRevision } : {}),
+    };
+}
+// Validate one `data[]` entry and place it at its declared `index`. Returns false on any
+// malformed/duplicate/out-of-range item so the caller can fail the whole batch.
+function placeBatchItem(item, ctx, slots) {
+    if (!isRecord(item))
+        return false;
+    const index = batchSlotIndex(item, ctx.count, slots);
+    if (index < 0)
+        return false;
+    const embedding = item.embedding;
+    if (!isNumberArray(embedding) || embedding.length === 0)
+        return false;
+    slots[index] = buildBatchSuccess(item, embedding, ctx);
+    return true;
+}
+function buildBatchContext(payload, request) {
+    return {
+        count: request.inputs.length,
+        topModel: typeof payload.model === "string" ? payload.model : undefined,
+        topRevision: typeof payload.model_revision === "string" ? payload.model_revision : undefined,
+        requestModelId: request.modelId,
+    };
+}
+async function decodeBatchSuccess(response, request) {
+    let payload;
+    try {
+        payload = await readJsonCapped(response);
+    }
+    catch {
+        return { ok: false, kind: "invalid-response" };
+    }
+    if (!isRecord(payload) || !Array.isArray(payload.data)) {
+        return { ok: false, kind: "invalid-response" };
+    }
+    const ctx = buildBatchContext(payload, request);
+    if (payload.data.length !== ctx.count) {
+        return { ok: false, kind: "invalid-response" };
+    }
+    // Place each item at its declared `index` so the result is strictly aligned to `inputs`
+    // regardless of provider ordering. Any missing/duplicate/out-of-range index → invalid.
+    const slots = new Array(ctx.count);
+    for (const item of payload.data) {
+        if (!placeBatchItem(item, ctx, slots)) {
+            return { ok: false, kind: "invalid-response" };
+        }
+    }
+    const value = [];
+    for (const slot of slots) {
+        if (slot === undefined)
+            return { ok: false, kind: "invalid-response" };
+        value.push(slot);
+    }
+    return { ok: true, value };
+}
+export async function requestOpenAIEmbeddingBatch(request) {
+    if (request.inputs.length === 0) {
+        return { ok: true, value: [] };
+    }
+    const built = buildBatchRequest(request);
+    const dispatched = await dispatch(built, request.fetchImpl, request.egress);
+    if (typeof dispatched === "string") {
+        return { ok: false, kind: dispatched };
+    }
+    if (!dispatched.ok) {
+        const kind = classifyStatus(dispatched.status) ?? "transport";
+        await discardBody(dispatched);
+        return { ok: false, kind };
+    }
+    return decodeBatchSuccess(dispatched, request);
+}

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/qualityIntelligence/capabilityGate.d.ts

@@ -1,4 +1,13 @@
 import type { ModelCapability } from "@oscharko-dev/keiko-contracts";
-import type { QualityIntelligenceTaskProfile } from "./taskProfiles.js";
+import type { ModelSelectionQuery } from "../model-selection.js";
+import type { QualityIntelligenceCapability, QualityIntelligenceTaskProfile } from "./taskProfiles.js";
+/**
+ * Project a profile's required QI capabilities onto the gateway `ModelSelectionQuery` constraints
+ * the selector understands. This is the WRITE side of the SAME capability mapping that `modelSupports`
+ * READS, kept in one file so auto-selection and the gate can never drift (Issue #762: a single shared
+ * capability mapping, never a per-stage duplicate). text → chat kind (every QI task profile is a chat
+ * task); structured-output → structuredOutput; function-calling → toolCalling; vision → supportsImageInput.
+ */
+export declare function buildSelectionQueryForCapabilities(required: readonly QualityIntelligenceCapability[]): ModelSelectionQuery;
 export declare function assertProfileCompatibleWithModel(profile: QualityIntelligenceTaskProfile, modelCapability: ModelCapability): void;
 //# sourceMappingURL=capabilityGate.d.ts.map

package/node_modules/@oscharko-dev/keiko-model-gateway/dist/qualityIntelligence/capabilityGate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilityGate.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/capabilityGate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,mBAAmB,CAAC;AAe3B,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,8BAA8B,EACvC,eAAe,EAAE,eAAe,GAC/B,IAAI,CAWN"}
+{"version":3,"file":"capabilityGate.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/capabilityGate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EACV,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,SAAS,6BAA6B,EAAE,GACjD,mBAAmB,CAyBrB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,8BAA8B,EACvC,eAAe,EAAE,eAAe,GAC/B,IAAI,CAWN"}