- Export OAUTH_ALIASES as canonical id→alias source - model.js derives 16 OAuth alias→id pairs instead of hardcoding (mmf kept out to preserve behavior) - Add verify-alias.mjs byte-for-byte guard (133 tokens), all equal Co-authored-by: Cursor <cursoragent@cursor.com>