@juspay/neurolink 12.7.2 → 12.7.4

package/dist/proxy/codexFallback.js

@@ -0,0 +1,371 @@
+/**
+ * Anthropic Messages API fallback over the pooled Codex Responses transport.
+ *
+ * This module deliberately contains only wire-format conversion and buffered
+ * SSE parsing. Account selection, OAuth, cooldowns, and quota persistence stay
+ * in the native Codex proxy handler so fallback traffic follows the same pool
+ * rules as a native Codex request.
+ */
+import { extractCodexUsage } from "./codexUsage.js";
+export class CodexFallbackResponseError extends Error {
+    status;
+    responseBody;
+    constructor(status, responseBody) {
+        super(`Codex fallback request returned HTTP ${status}`);
+        this.name = "CodexFallbackResponseError";
+        this.status = status;
+        this.responseBody = responseBody;
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function buildSystemInstructions(body) {
+    if (typeof body.system === "string") {
+        return body.system || undefined;
+    }
+    if (Array.isArray(body.system)) {
+        const text = body.system
+            .map((block) => (typeof block.text === "string" ? block.text : ""))
+            .filter(Boolean)
+            .join("\n\n");
+        return text || undefined;
+    }
+    return undefined;
+}
+function imageUrlForBlock(block) {
+    if (block.source.type === "url" && block.source.url) {
+        return block.source.url;
+    }
+    if (block.source.type === "base64" && block.source.data) {
+        return `data:${block.source.media_type ?? "image/png"};base64,${block.source.data}`;
+    }
+    return undefined;
+}
+function flattenClaudeContent(content) {
+    if (typeof content === "string") {
+        return content;
+    }
+    return content
+        .map((block) => {
+        switch (block.type) {
+            case "text":
+                return block.text;
+            case "thinking":
+                return block.thinking;
+            case "image":
+                return "[image attachment]";
+            case "tool_use":
+                return `[tool call ${block.name}] ${JSON.stringify(block.input ?? {})}`;
+            case "tool_result":
+                return flattenClaudeContent(block.content);
+        }
+    })
+        .join("\n");
+}
+function toCodexContentPart(block, role) {
+    const textType = role === "assistant" ? "output_text" : "input_text";
+    switch (block.type) {
+        case "text":
+            return { type: textType, text: block.text };
+        case "thinking":
+            return { type: textType, text: block.thinking };
+        case "image": {
+            const imageUrl = imageUrlForBlock(block);
+            if (role === "user" && imageUrl) {
+                return { type: "input_image", image_url: imageUrl };
+            }
+            return { type: textType, text: "[image attachment]" };
+        }
+    }
+}
+function convertClaudeMessage(role, content) {
+    if (typeof content === "string") {
+        return [
+            {
+                role,
+                content: [
+                    {
+                        type: role === "assistant" ? "output_text" : "input_text",
+                        text: content,
+                    },
+                ],
+            },
+        ];
+    }
+    const input = [];
+    let messageContent = [];
+    const flushMessage = () => {
+        if (messageContent.length === 0) {
+            return;
+        }
+        input.push({ role, content: messageContent });
+        messageContent = [];
+    };
+    for (const block of content) {
+        if (block.type === "tool_use") {
+            flushMessage();
+            input.push({
+                type: "function_call",
+                call_id: block.id,
+                name: block.name,
+                arguments: JSON.stringify(block.input ?? {}),
+            });
+            continue;
+        }
+        if (block.type === "tool_result") {
+            flushMessage();
+            input.push({
+                type: "function_call_output",
+                call_id: block.tool_use_id,
+                output: flattenClaudeContent(block.content),
+            });
+            continue;
+        }
+        messageContent.push(toCodexContentPart(block, role));
+    }
+    flushMessage();
+    return input;
+}
+/** Convert a Claude Messages request into the ChatGPT Codex Responses shape. */
+export function convertClaudeRequestToCodex(body, model) {
+    const input = body.messages.flatMap((message) => convertClaudeMessage(message.role, message.content));
+    const request = {
+        model,
+        input,
+        stream: true,
+        // ChatGPT's backend rejects requests unless this is explicitly false.
+        store: false,
+    };
+    const instructions = buildSystemInstructions(body);
+    if (instructions) {
+        request.instructions = instructions;
+    }
+    if (body.tools && body.tools.length > 0) {
+        request.tools = body.tools.map((tool) => ({
+            type: "function",
+            name: tool.name,
+            ...(tool.description ? { description: tool.description } : {}),
+            parameters: tool.input_schema,
+        }));
+    }
+    if (body.tool_choice) {
+        switch (body.tool_choice.type) {
+            case "any":
+                request.tool_choice = "required";
+                break;
+            case "tool":
+                request.tool_choice = { type: "function", name: body.tool_choice.name };
+                break;
+            default:
+                request.tool_choice = body.tool_choice.type;
+                break;
+        }
+    }
+    // The ChatGPT Codex backend is not the public Responses API. In particular,
+    // it rejects `max_output_tokens`, and its model-owned sampling controls do
+    // not map safely from Anthropic's `temperature` or `top_p`. Omit all three
+    // so the backend uses its supported defaults instead of rejecting fallback
+    // traffic before it can be served.
+    return request;
+}
+function parseFunctionArguments(value) {
+    if (isRecord(value)) {
+        return value;
+    }
+    if (typeof value !== "string") {
+        throw new Error("Codex fallback function call is missing JSON arguments");
+    }
+    try {
+        const parsed = JSON.parse(value || "{}");
+        if (!isRecord(parsed)) {
+            throw new Error("not an object");
+        }
+        return parsed;
+    }
+    catch {
+        throw new Error("Codex fallback function call returned invalid JSON arguments");
+    }
+}
+function outputTextFromItem(value) {
+    if (!isRecord(value) ||
+        value.type !== "message" ||
+        !Array.isArray(value.content)) {
+        return "";
+    }
+    return value.content
+        .filter(isRecord)
+        .filter((part) => part.type === "output_text")
+        .map((part) => (typeof part.text === "string" ? part.text : ""))
+        .join("");
+}
+function addFunctionCall(item, toolCalls) {
+    if (item.type !== "function_call") {
+        return;
+    }
+    const callId = asNonEmptyString(item.call_id);
+    const name = asNonEmptyString(item.name);
+    if (!callId || !name) {
+        throw new Error("Codex fallback function call is missing an id or name");
+    }
+    toolCalls.set(callId, {
+        toolCallId: callId,
+        toolName: name,
+        args: parseFunctionArguments(item.arguments),
+    });
+}
+function parseSSEPayloads(sse) {
+    const frames = sse.replace(/\r\n?/g, "\n").split("\n\n");
+    const parsed = [];
+    for (const frame of frames) {
+        if (!frame.trim()) {
+            continue;
+        }
+        let event;
+        const data = [];
+        for (const line of frame.split("\n")) {
+            if (!line || line.startsWith(":")) {
+                continue;
+            }
+            if (line.startsWith("event:")) {
+                event = line.slice("event:".length).trim();
+                continue;
+            }
+            if (line.startsWith("data:")) {
+                data.push(line.slice("data:".length).trimStart());
+                continue;
+            }
+            if (line.startsWith("id:") || line.startsWith("retry:")) {
+                continue;
+            }
+            // SSE permits extension fields that this parser does not consume.
+            continue;
+        }
+        if (data.length === 0) {
+            continue;
+        }
+        const raw = data.join("\n").trim();
+        if (raw === "[DONE]") {
+            continue;
+        }
+        try {
+            const payload = JSON.parse(raw);
+            if (!isRecord(payload)) {
+                throw new Error("not an object");
+            }
+            parsed.push({ event, payload });
+        }
+        catch {
+            throw new Error("Codex fallback stream contains malformed JSON");
+        }
+    }
+    return parsed;
+}
+function responseStatus(payload) {
+    const response = payload.response;
+    return isRecord(response) ? asNonEmptyString(response.status) : undefined;
+}
+function outputTextFromResponse(payload) {
+    const response = payload.response;
+    if (!isRecord(response) || !Array.isArray(response.output)) {
+        return "";
+    }
+    return response.output.map(outputTextFromItem).join("");
+}
+/**
+ * Parse a complete Codex Responses SSE stream before emitting Claude output.
+ *
+ * A missing terminal event, malformed JSON, terminal error, or empty response
+ * is rejected. That makes it safe for the caller to try the next configured
+ * fallback without ever replaying output already sent to a client.
+ */
+export function parseCodexFallbackSSE(sse) {
+    const payloads = parseSSEPayloads(sse);
+    const toolCalls = new Map();
+    let textFromDeltas = "";
+    let textFromCompletedItems = "";
+    let textFromResponse = "";
+    let usage;
+    let sawCompleted = false;
+    for (const { event, payload } of payloads) {
+        const type = asNonEmptyString(payload.type) ?? event;
+        if (!type) {
+            throw new Error("Codex fallback stream event is missing a type");
+        }
+        if (type === "error" ||
+            type === "response.failed" ||
+            type === "response.incomplete") {
+            throw new Error(`Codex fallback stream terminated with ${type}`);
+        }
+        if (type === "response.output_text.delta") {
+            if (typeof payload.delta !== "string") {
+                throw new Error("Codex fallback text delta is malformed");
+            }
+            textFromDeltas += payload.delta;
+            continue;
+        }
+        if (type === "response.output_item.done") {
+            if (!isRecord(payload.item)) {
+                throw new Error("Codex fallback output item is malformed");
+            }
+            addFunctionCall(payload.item, toolCalls);
+            textFromCompletedItems += outputTextFromItem(payload.item);
+            continue;
+        }
+        if (type !== "response.completed") {
+            continue;
+        }
+        if (sawCompleted) {
+            throw new Error("Codex fallback stream emitted more than one completion event");
+        }
+        sawCompleted = true;
+        const status = responseStatus(payload);
+        if (status !== "completed") {
+            throw new Error(`Codex fallback stream completed with unexpected status ${status ?? "unknown"}`);
+        }
+        const parsedUsage = extractCodexUsage(payload);
+        if (parsedUsage) {
+            usage = {
+                input: parsedUsage.inputTokens,
+                output: parsedUsage.outputTokens,
+                total: parsedUsage.inputTokens + parsedUsage.outputTokens,
+                cacheReadTokens: parsedUsage.cacheReadTokens,
+                cacheCreationTokens: parsedUsage.cacheCreationTokens,
+            };
+        }
+        textFromResponse = outputTextFromResponse(payload);
+    }
+    if (!sawCompleted) {
+        throw new Error("Codex fallback stream ended before response.completed");
+    }
+    const text = textFromDeltas || textFromCompletedItems || textFromResponse;
+    const resolvedToolCalls = [...toolCalls.values()];
+    if (!text && resolvedToolCalls.length === 0) {
+        throw new Error("Codex fallback returned no content or tool calls");
+    }
+    return {
+        text,
+        toolCalls: resolvedToolCalls,
+        ...(usage ? { usage } : {}),
+        finishReason: resolvedToolCalls.length > 0 ? "tool_use" : "end_turn",
+    };
+}
+/** Consume and validate a native Codex response before producing Claude output. */
+export async function consumeCodexFallbackResponse(response) {
+    if (!response.ok) {
+        throw new CodexFallbackResponseError(response.status, await response.text().catch(() => ""));
+    }
+    if (!response.body) {
+        throw new Error("Codex fallback returned an empty stream");
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("text/event-stream")) {
+        // Consume it before failing so the underlying connection can be reused.
+        await response.text().catch(() => "");
+        throw new Error("Codex fallback returned a non-SSE response");
+    }
+    return parseCodexFallbackSSE(await response.text());
+}

package/dist/proxy/proxyActivity.js

@@ -63,6 +63,13 @@ export function trackProxyResponse(response, finishRequest, observer) {
     let observedBodyBytes = 0;
     let responseChunks = 0;
     let settled = false;
+    let sourceClosed = false;
+    // A framework can cancel its adapter after the upstream stream has already
+    // closed. Snapshot reader.closed before cancel() so that normal cleanup is
+    // not recorded as a client-aborted request.
+    void reader.closed.then(() => {
+        sourceClosed = true;
+    }, () => undefined);
     const settle = (outcome) => {
         if (settled) {
             return;
@@ -100,7 +107,11 @@ export function trackProxyResponse(response, finishRequest, observer) {
             }
         },
         async cancel(reason) {
-            settle("client_cancelled");
+            // Read the state before cancelling: reader.cancel() itself rejects the
+            // closed promise for a genuinely active source, which is too late to
+            // distinguish it from a source that had already ended normally.
+            await Promise.resolve();
+            settle(sourceClosed ? "completed" : "client_cancelled");
             await withTimeout(reader.cancel(reason), PROXY_RESPONSE_CANCEL_TIMEOUT_MS, "Timed out cancelling the upstream proxy response");
         },
     });

package/dist/proxy/usageStats.d.ts

@@ -40,7 +40,7 @@ export declare class ProxyUsageStatsStore {
     recordAttemptError(accountLabel: string, accountType: string, status: number, rateLimitKind?: "transient" | "quota"): void;
     recordFinalError(status: number, accountLabel?: string, accountType?: string, details?: ProxyTerminalErrorDetails): void;
     getStats(): ProxyStats;
-    getAccountStats(label: string): AccountStats | undefined;
+    getAccountStats(label: string, type?: string): AccountStats | undefined;
     getTerminalErrors(): ProxyTerminalErrorJournal;
     getUsageSnapshot(): ProxyUsageStatsSnapshot;
     getPersistenceStatus(): ProxyStatsPersistenceStatus;
@@ -81,7 +81,7 @@ export declare function getStats(): ProxyStats;
 export declare function getUsageSnapshot(): ProxyUsageStatsSnapshot;
 export declare function getReconciledStats(): Promise<ProxyStats>;
 export declare function getReconciledUsageSnapshot(): Promise<ProxyUsageStatsSnapshot>;
-export declare function getAccountStats(label: string): AccountStats | undefined;
+export declare function getAccountStats(label: string, type?: string): AccountStats | undefined;
 export declare function getTerminalErrors(): ProxyTerminalErrorJournal;
 export declare function getUsageStatsPersistenceStatus(): ProxyStatsPersistenceStatus;
 export declare function flushUsageStats(): Promise<void>;

package/dist/proxy/usageStats.js

@@ -8,6 +8,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, readdir, rename, rm, stat, } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { normalizeAnthropicAccountKey } from "./accountSelection.js";
 import { AsyncMutex } from "../utils/asyncMutex.js";
 import { redactUrlsInText, sanitizeForLog } from "../utils/logSanitize.js";
 import { writeJsonSnapshotAtomically } from "./snapshotPersistence.js";
@@ -63,6 +64,34 @@ function emptyTerminalErrorJournal(startedAt) {
         recent: [],
     };
 }
+/**
+ * Statistics must never use an email/label as their primary map key. One
+ * person can authenticate both provider pools with the same email, and a
+ * bare key silently merged their attempts, limits, and failures into one row.
+ *
+ * Keep non-account pseudo rows (passthrough, peer, internal) untouched. The
+ * display label remains separate so the CLI stays readable while persisted
+ * counters retain a collision-proof identity.
+ */
+function resolveStatsAccountIdentity(label, type) {
+    if (type === "codex-oauth") {
+        const key = label.startsWith("codex:") ? label : `codex:${label}`;
+        return {
+            key,
+            label: label.startsWith("codex:") ? label.slice("codex:".length) : label,
+        };
+    }
+    if (type === "oauth" || type === "api_key") {
+        const key = normalizeAnthropicAccountKey(label);
+        return {
+            key,
+            label: label.startsWith("anthropic:")
+                ? label.slice("anthropic:".length)
+                : label,
+        };
+    }
+    return { key: label, label };
+}
 function cloneTerminalErrorSummary(summary) {
     return { ...summary };
 }
@@ -152,6 +181,9 @@ function terminalErrorCategory(status, errorType) {
 }
 function createTerminalErrorSummary(args) {
     const { now, status, accountLabel, accountType, details } = args;
+    const accountIdentity = accountLabel && accountType
+        ? resolveStatsAccountIdentity(accountLabel, accountType)
+        : undefined;
     const errorType = clipTerminalErrorField(details?.errorType);
     const message = details?.message
         ? stripTerminalErrorControlCharacters(sanitizeForLog(redactUrlsInText(details.message), MAX_TERMINAL_ERROR_MESSAGE_LENGTH + MAX_TERMINAL_ERROR_FIELD_LENGTH))
@@ -170,6 +202,11 @@ function createTerminalErrorSummary(args) {
         ...(clipTerminalErrorField(accountLabel)
             ? { account: clipTerminalErrorField(accountLabel) }
             : {}),
+        ...(clipTerminalErrorField(details?.accountKey ?? accountIdentity?.key)
+            ? {
+                accountKey: clipTerminalErrorField(details?.accountKey ?? accountIdentity?.key),
+            }
+            : {}),
         ...(clipTerminalErrorField(accountType)
             ? { accountType: clipTerminalErrorField(accountType) }
             : {}),
@@ -201,7 +238,9 @@ function mergeAccountStats(left, right) {
     if (!left) {
         return cloneAccount(right);
     }
+    const key = right.key ?? left.key;
     return {
+        ...(key ? { key } : {}),
         label: right.label || left.label,
         type: right.type || left.type,
         attemptCount: left.attemptCount + right.attemptCount,
@@ -248,7 +287,9 @@ function validAccountStats(value) {
         return false;
     }
     const candidate = value;
-    return (typeof candidate.label === "string" &&
+    return ((candidate.key === undefined ||
+        (typeof candidate.key === "string" && candidate.key.length > 0)) &&
+        typeof candidate.label === "string" &&
         typeof candidate.type === "string" &&
         finiteNonNegativeInteger(candidate.attemptCount) &&
         finiteNonNegativeInteger(candidate.attemptErrorCount) &&
@@ -282,7 +323,7 @@ function validStats(value) {
         typeof candidate.accounts !== "object") {
         return false;
     }
-    return Object.entries(candidate.accounts).every(([label, account]) => validAccountStats(account) && label === account.label);
+    return Object.entries(candidate.accounts).every(([key, account]) => validAccountStats(account) && key === (account.key ?? account.label));
 }
 function validOptionalString(value, maxLength) {
     return (value === undefined ||
@@ -302,6 +343,7 @@ function validTerminalErrorSummary(value) {
         TERMINAL_ERROR_CATEGORIES.includes(candidate.category) &&
         validOptionalString(candidate.requestId, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.account, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
+        validOptionalString(candidate.accountKey, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.accountType, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.errorType, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
         validOptionalString(candidate.errorCode, MAX_TERMINAL_ERROR_FIELD_LENGTH) &&
@@ -615,8 +657,20 @@ export class ProxyUsageStatsStore {
     getStats() {
         return cloneStats(this.stats);
     }
-    getAccountStats(label) {
-        const account = this.stats.accounts[label];
+    getAccountStats(label, type) {
+        const direct = this.stats.accounts[label];
+        if (direct) {
+            return cloneAccount(direct);
+        }
+        const identity = type
+            ? resolveStatsAccountIdentity(label, type)
+            : undefined;
+        const account = identity
+            ? this.stats.accounts[identity.key]
+            : (() => {
+                const matches = Object.values(this.stats.accounts).filter((candidate) => candidate.label === label);
+                return matches.length === 1 ? matches[0] : undefined;
+            })();
         return account ? cloneAccount(account) : undefined;
     }
     getTerminalErrors() {
@@ -920,9 +974,11 @@ export class ProxyUsageStatsStore {
         }
     }
     ensureAccount(target, label, type) {
-        if (!target.accounts[label]) {
-            target.accounts[label] = {
-                label,
+        const identity = resolveStatsAccountIdentity(label, type);
+        if (!target.accounts[identity.key]) {
+            target.accounts[identity.key] = {
+                key: identity.key,
+                label: identity.label,
                 type,
                 attemptCount: 0,
                 attemptErrorCount: 0,
@@ -934,7 +990,7 @@ export class ProxyUsageStatsStore {
                 lastAttemptAt: 0,
             };
         }
-        return target.accounts[label];
+        return target.accounts[identity.key];
     }
     scheduleFlush() {
         if (!this.filePath || this.flushTimer) {
@@ -1131,8 +1187,8 @@ export async function getReconciledStats() {
 export async function getReconciledUsageSnapshot() {
     return defaultStore.reconcileUsageSnapshot();
 }
-export function getAccountStats(label) {
-    return defaultStore.getAccountStats(label);
+export function getAccountStats(label, type) {
+    return defaultStore.getAccountStats(label, type);
 }
 export function getTerminalErrors() {
     return defaultStore.getTerminalErrors();

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -12,7 +12,7 @@
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";
-import type { AccountAllowlist, AccountAdmissionLease, JsonObject, AccountCooldownPlan, AccountQuota, AccountQuotaWindow, AccountUsageFetchResult, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicEntitlementFailure, AnthropicLoopState, AnthropicScopedExhaustion, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyLimitsRefreshResponse, ProxyQuotaCooldownUpdate, ProxyOveragePolicy, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
+import type { AccountAllowlist, AccountAdmissionLease, JsonObject, AccountCooldownPlan, AccountQuota, AccountQuotaWindow, AccountUsageFetchResult, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicEntitlementFailure, AnthropicInvalidRequestFailure, AnthropicLoopState, AnthropicScopedExhaustion, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyLimitsRefreshResponse, ProxyQuotaCooldownUpdate, ProxyOveragePolicy, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
 declare function tryAcquireAccountAdmission(accountKey: string, capacity: number | undefined): AccountAdmissionLease | undefined;
 declare function enqueueAccountAdmission(accountKey: string, capacity: number): QueuedAccountAdmission;
 declare function acquireAccountAdmission(accountKey: string, capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<AccountAdmissionLease | undefined>;
@@ -65,7 +65,8 @@ declare function planCooldownFor429(quota: AccountQuota | null, retryAfterMs: nu
 declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: AccountQuota, now: number, policy?: ProxyOveragePolicy): ProxyQuotaCooldownUpdate;
 /**
  * Seed each account's runtime quota from the persisted snapshots in
- * ~/.neurolink/account-quotas.json (keyed by label). Runtime state is
+ * ~/.neurolink/account-quotas.json (keyed by provider-qualified account key).
+ * Runtime state is
  * in-memory only, so without this the quota-aware ordering is blind after a
  * proxy restart: all accounts tie, selection falls back to token-store
  * enumeration order, and the first account served becomes self-reinforcing
@@ -173,6 +174,18 @@ declare function trackUpstreamReadableStream(source: ReadableStream<Uint8Array>)
     stream: ReadableStream<Uint8Array>;
     outcome: Promise<StreamTerminalOutcome>;
 };
+/**
+ * Remove what a borrower has no business seeing.
+ *
+ * `x-neurolink-account` carries the lender's account label, which for an OAuth
+ * account is their email address; the pool counters describe the shape of a
+ * pool that is not the borrower's. The borrower's own routing needs the quota
+ * and grant headers, and nothing else here.
+ *
+ * A no-op for the node's own traffic, where these headers are exactly the
+ * diagnostics the operator wants.
+ */
+declare function redactHeadersForBorrower(headers: Record<string, string>): Record<string, string>;
 declare function executeClaudeFallbackTranslation(args: {
     ctx: ServerContext;
     body: ClaudeRequest;
@@ -203,6 +216,7 @@ declare function executeClaudeFallbackTranslation(args: {
     idleTimeoutMs?: number;
 }): Promise<unknown>;
 declare function executeClaudeFallbackWithRetry(args: Parameters<typeof executeClaudeFallbackTranslation>[0]): Promise<unknown>;
+declare function getCodexFallbackInvalidRequestFailure(error: unknown): AnthropicInvalidRequestFailure | null;
 declare function buildClaudeAnthropicFailureResponse(args: {
     tracer?: ProxyTracer;
     requestStartTime: number;
@@ -329,6 +343,7 @@ declare function handleAnthropicNonOkResponse(args: {
         contentType?: string;
     } | null;
     entitlementFailure: AnthropicEntitlementFailure | null;
+    allowConfiguredModelFallback?: boolean;
 }): Promise<AnthropicNonOkResult>;
 /**
  * Detect Anthropic's anti-abuse / request-construction 429.
@@ -388,6 +403,11 @@ export declare function parseClaudeErrorBody(errBody: string): ParsedClaudeError
  * Detect malformed request errors that should not trigger account/provider failover.
  */
 export declare function isInvalidRequestError(status: number, errBody: string): boolean;
+/**
+ * A 404 for a retired model can be served by an explicitly configured fallback;
+ * other 404s remain terminal so a bad endpoint or resource is never disguised.
+ */
+declare function isAnthropicModelNotFound(status: number, errBody: string): boolean;
 /**
  * A subscription-specific beta rejection. Anthropic returns
  * `400 invalid_request_error` with a message like
@@ -492,7 +512,10 @@ export declare const __testHooks: {
     redactProviderErrorMessage: typeof redactProviderErrorMessage;
     isUpstreamOverload: typeof isUpstreamOverload;
     getOverloadRotationDelayMs: typeof getOverloadRotationDelayMs;
+    redactHeadersForBorrower: typeof redactHeadersForBorrower;
     shouldAttemptClaudeFallback: typeof shouldAttemptClaudeFallback;
+    isAnthropicModelNotFound: typeof isAnthropicModelNotFound;
+    getCodexFallbackInvalidRequestFailure: typeof getCodexFallbackInvalidRequestFailure;
     executeClaudeFallbackWithRetry: typeof executeClaudeFallbackWithRetry;
     buildClaudeAnthropicFailureResponse: typeof buildClaudeAnthropicFailureResponse;
     isAccountEntitlementError: typeof isAccountEntitlementError;