@mupt-ai/dari-gateway 0.2.0 → 0.3.0

package/src/providers/pi_options.ts

@@ -1,15 +1,15 @@
 import type { BedrockOptions } from "@mupt-ai/pi-ai/api/bedrock-converse-stream";
 import { isReasoningEffort, isRecord, type ReasoningEffort } from "@mupt-ai/dari-router/policy-engine";
-import type { InteractionRequest, InteractionResponseFormat, InteractionToolChoice } from "../interaction/types";
-import { requiredCapabilitiesFor } from "../interaction/capabilities";
-import { toolWireName, toolsByWireName } from "../interaction/tool_identity";
-import { gatewayFor, payloadWithGatewayFields } from "../models/gateways";
-import { offRequiresWireNone } from "../models/runtime_overrides";
-import { effectiveReasoningForModel, validateReasoningEffortForModel } from "./reasoning";
-import { isBedrockApi, isOpenAIResponsesApi } from "./model_capabilities";
-import type { ResolvedProviderAuth } from "../types";
-import type { ProviderFetch } from "./response_capture";
-import { forwardsAnthropicSafeguards, payloadWithSafeguards } from "./anthropic_safeguards";
+import type { InteractionRequest, InteractionResponseFormat, InteractionToolChoice } from "../interaction/types.js";
+import { requiredCapabilitiesFor } from "../interaction/capabilities.js";
+import { toolWireName, toolsByWireName } from "../interaction/tool_identity.js";
+import { gatewayFor, payloadWithGatewayFields } from "../models/gateways.js";
+import { offRequiresWireNone } from "../models/runtime_overrides.js";
+import { effectiveReasoningForModel, validateReasoningEffortForModel } from "./reasoning.js";
+import { isBedrockApi, isOpenAIResponsesApi } from "./model_capabilities.js";
+import type { ResolvedProviderAuth } from "../types.js";
+import type { ProviderFetch } from "./response_capture.js";
+import { forwardsAnthropicSafeguards, payloadWithSafeguards } from "./anthropic_safeguards.js";
 
 type PiOptionsSupport = {
   getSupportedThinkingLevels?: (model: Record<string, unknown>) => string[];
@@ -51,8 +51,10 @@ export function buildOptions(
   const providerAuth: ResolvedProviderAuth = typeof auth === "string" ? { type: "bearer", apiKey: auth } : auth;
   const { generation, toolChoice, parallelToolCalls, responseFormat } = request;
   const headers: Record<string, string> = {};
+  const bearerHeader = sendsBearerToMessages(providerAuth, model);
+  if (bearerHeader) headers.authorization = `Bearer ${providerAuth.apiKey}`;
   const options: Record<string, unknown> = {
-    ...authenticationOptions(providerAuth, api),
+    ...(bearerHeader ? {} : authenticationOptions(providerAuth, api)),
     maxRetries: 0,
     timeoutMs,
     signal,
@@ -67,6 +69,9 @@ export function buildOptions(
   if (isClaudeCodeOAuth(providerAuth, api)) {
     headers["user-agent"] = request.claudeCodeUserAgent ?? CLAUDE_CODE_USER_AGENT;
   }
+  if (model.provider === "meta" && request.museCodeClientId !== undefined) {
+    headers["x-client-id"] = request.museCodeClientId;
+  }
   // Pi's Anthropic transport honors compat.supportsTemperature; the OpenAI
   // transports forward temperature regardless, so drop it here for models
   // that reject it instead of failing the whole request.
@@ -207,6 +212,17 @@ function authenticationOptions(auth: ResolvedProviderAuth, api: unknown): Bedroc
   };
 }
 
+// Anthropic Messages endpoints outside Anthropic that take the key as a bearer
+// token (Claude Code's ANTHROPIC_AUTH_TOKEN) and reject x-api-key.
+const BEARER_MESSAGES_PROVIDERS: ReadonlySet<unknown> = new Set(["meta"]);
+
+function sendsBearerToMessages(
+  auth: ResolvedProviderAuth,
+  model: Model,
+): auth is Extract<ResolvedProviderAuth, { type: "bearer" }> {
+  return auth.type === "bearer" && isAnthropic(model.api) && BEARER_MESSAGES_PROVIDERS.has(model.provider);
+}
+
 function isClaudeCodeOAuth(auth: ResolvedProviderAuth, api: unknown): boolean {
   return auth.type === "bearer" && isAnthropic(api) && auth.apiKey.includes("sk-ant-oat");
 }

package/src/providers/pi_output.ts

@@ -1,9 +1,9 @@
 import { isRecord } from "@mupt-ai/dari-router/policy-engine";
 
-import { HttpError } from "../http/errors";
-import { providerToolCallIdentity, toolsByWireName } from "../interaction/tool_identity";
-import { isAnthropicEffort } from "../interaction/provider_continuation_state";
-import { isBedrockApi, isOpenAIResponsesApi } from "./model_capabilities";
+import { HttpError } from "../http/errors.js";
+import { providerToolCallIdentity, toolsByWireName } from "../interaction/tool_identity.js";
+import { isAnthropicEffort } from "../interaction/provider_continuation_state.js";
+import { isBedrockApi, isOpenAIResponsesApi } from "./model_capabilities.js";
 import type {
   InteractionItem,
   InteractionOutput,
@@ -13,7 +13,7 @@ import type {
   ProviderContinuationState,
   ProviderIdentity,
   ToolKind,
-} from "../interaction/types";
+} from "../interaction/types.js";
 
 export function piMessageToInteractionOutput(
   message: Record<string, unknown>,

package/src/providers/provider_attempt_runner.ts

@@ -1,4 +1,4 @@
-import { subscriptionUsageLimitFromFailure } from "./subscription_limits";
+import { subscriptionUsageLimitFromFailure } from "./subscription_limits.js";
 
 export type ProviderAttemptFailure =
   | {

package/src/providers/provider_call.ts

@@ -8,46 +8,46 @@ import {
   type RoutingDecision,
 } from "@mupt-ai/dari-router/policy-engine";
 
-import { executionProviderForModel, keySourceForModel } from "../models/execution_provider";
-import { HttpError } from "../http/errors";
-import type { RequestTags } from "../platform/platform";
-import type { InteractionRequest, ProviderIdentity } from "../interaction/types";
+import { executionProviderForModel, keySourceForModel } from "../models/execution_provider.js";
+import { HttpError } from "../http/errors.js";
+import type { RequestTags } from "../platform/platform.js";
+import type { InteractionRequest, ProviderIdentity } from "../interaction/types.js";
 import {
   CustomerDisconnectedError,
   createProviderAttemptAbort,
   type ProviderAttemptAbort,
-} from "../runtime/customer_disconnect";
+} from "../runtime/customer_disconnect.js";
 import {
   isProviderFailureMessage,
   providerFailureFromCaught,
   providerFailureFromEvent,
-} from "../runtime/provider_stream_outcome";
-import { providerAuthForSelectedModel } from "../strategies/routing";
-import { scrubSecretValues } from "../telemetry/scrub";
+} from "../runtime/provider_stream_outcome.js";
+import { providerAuthForSelectedModel } from "../strategies/routing.js";
+import { scrubSecretValues } from "../telemetry/scrub.js";
 import {
   usageContextFor,
   type RoutingUsageContext,
-} from "../telemetry/usage";
+} from "../telemetry/usage.js";
 import type {
   ProviderAuth,
   ProviderKeySource,
   ResolvedRouter,
   ResolvedRouterModelConfig,
-} from "../types";
-import { awsRoleCredentials } from "./aws_assume_role";
+} from "../types.js";
+import { awsRoleCredentials } from "./aws_assume_role.js";
 import {
   attachProviderResponseCapture,
   createProviderResponseCapture,
   type ProviderFetch,
   type ProviderResponseCapture,
-} from "./response_capture";
+} from "./response_capture.js";
 import {
   completeInteractionModel,
   streamInteractionModel,
   type ProviderEndpoint,
   type ProviderEventStream,
-} from "./pi";
-import { promptTokenEstimateFor, type PromptTokenEstimate } from "./cancel_estimate";
+} from "./pi.js";
+import { promptTokenEstimateFor, type PromptTokenEstimate } from "./cancel_estimate.js";
 
 type ProviderCallConfig = {
   model: string;
@@ -115,8 +115,10 @@ export function prepareProviderExecution(args: {
   }
   const provider = executionProviderForModel(args.credentials, model);
   const supplied = args.credentials.provider_credentials?.[model];
-  const providerKeySource = supplied ? "user" : keySourceForModel(args.credentials, model);
-  if (args.credentials.strict === true && providerKeySource === "subscription") {
+  const providerKeySource = keySourceForModel(args.credentials, model);
+  // A strict router serves a plan only when the platform supplied it for this
+  // request, never a pooled or personal one it resolved.
+  if (args.credentials.strict === true && providerKeySource === "subscription" && !supplied) {
     throw new HttpError(
       400,
       `Strict routers do not serve '${model}' from a personal subscription.`,
@@ -148,7 +150,9 @@ export function prepareProviderExecution(args: {
       : {}),
     provider,
     providerKeySource,
-    ...(providerKeySource === "subscription" && args.credentials.attributed_user_id
+    // Only resolved personal subscriptions are held at their usage limit;
+    // the platform manages the plans it supplies.
+    ...(providerKeySource === "subscription" && !supplied && args.credentials.attributed_user_id
       ? {
           subscriptionUserId: args.credentials.attributed_user_id,
           subscriptionCredentialId: args.credentials.subscription_credential_ids?.[provider],

package/src/providers/provider_reported_cost.ts

@@ -1,8 +1,8 @@
 import { isRecord } from "@mupt-ai/dari-router/policy-engine";
 
-import { gatewayFor } from "../models/gateways";
-import { providerFailureFromCaught } from "../runtime/provider_stream_outcome";
-import type { ProviderFetch } from "./response_capture";
+import { gatewayFor } from "../models/gateways.js";
+import { providerFailureFromCaught } from "../runtime/provider_stream_outcome.js";
+import type { ProviderFetch } from "./response_capture.js";
 
 // Gateways bill per call and say what they billed: OpenRouter as `usage.cost`
 // on the final chunk, Vercel AI Gateway as `providerMetadata.gateway.cost`.

package/src/providers/reasoning.ts

@@ -1,6 +1,6 @@
 import type { ReasoningEffort } from "@mupt-ai/dari-router/policy-engine";
-import { HttpError } from "../http/errors";
-import type { InteractionRequest } from "../interaction/types";
+import { HttpError } from "../http/errors.js";
+import type { InteractionRequest } from "../interaction/types.js";
 
 type ReasoningRequest = Pick<InteractionRequest, "reasoning">;
 

package/src/providers/stream_finalization.ts

@@ -3,32 +3,32 @@ import type {
   RoutingDecision,
 } from "@mupt-ai/dari-router/policy-engine";
 
-import type { InteractionRequest, ProviderIdentity } from "../interaction/types";
+import type { InteractionRequest, ProviderIdentity } from "../interaction/types.js";
 import {
   captureOperationalError,
   type OperationalErrorCode,
-} from "../observability/errors";
-import type { ProviderStreamOutcome } from "../runtime/provider_stream_outcome";
-import type { RoutedProtocol } from "../runtime/routed_protocol";
+} from "../observability/errors.js";
+import type { ProviderStreamOutcome } from "../runtime/provider_stream_outcome.js";
+import type { RoutedProtocol } from "../runtime/routed_protocol.js";
 import {
   reportedExecution,
   type FrozenProviderTerminal,
   type ProviderAttemptRecord,
   type ReportableProviderOutcome,
   type RoutedRuntimeReporter,
-} from "../runtime/runtime_reporter";
-import type { ProviderKeySource } from "../types";
+} from "../runtime/runtime_reporter.js";
+import type { ProviderKeySource } from "../types.js";
 import {
   reportRoutingUsage,
   type RoutingUsageContext,
-} from "../telemetry/usage";
-import { customerCanceledProviderMessage } from "../runtime/customer_disconnect";
+} from "../telemetry/usage.js";
+import { customerCanceledProviderMessage } from "../runtime/customer_disconnect.js";
 import {
   estimatedCancelUsage,
   partialInteractionOutput,
   type DeliveredOutput,
   type PromptTokenEstimate,
-} from "./cancel_estimate";
+} from "./cancel_estimate.js";
 
 // Structurally a subset of ProviderExecution. The narrowing is deliberate: it
 // keeps apiKey and auth out of the finalizer.

package/src/providers/subscription_limits.ts

@@ -1,10 +1,10 @@
 import { isRecord } from "@mupt-ai/dari-router/policy-engine";
 
-import { providerFailureMessage } from "../runtime/provider_stream_outcome";
-import type { ProviderKeySource } from "../types";
-import type { CapturedProviderResponse } from "./response_capture";
+import { providerFailureMessage } from "../runtime/provider_stream_outcome.js";
+import type { ProviderKeySource } from "../types.js";
+import type { CapturedProviderResponse } from "./response_capture.js";
 
-export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 
 export type SubscriptionUsageLimit = {
   oauthProvider: SubscriptionOAuthProvider;
@@ -25,6 +25,7 @@ const FAILURE_MARKER = "subscription_usage_limit";
 const SUBSCRIPTION_LABEL: Record<SubscriptionOAuthProvider, string> = {
   anthropic_claude_code: "Claude Code",
   openai_codex: "ChatGPT",
+  meta_muse: "Muse Code",
 };
 
 export function subscriptionOAuthProviderFor(
@@ -34,13 +35,16 @@ export function subscriptionOAuthProviderFor(
   if (keySource !== "subscription") return null;
   if (provider === "anthropic") return "anthropic_claude_code";
   if (provider === "openai" || provider === "openai-codex") return "openai_codex";
+  if (provider === "meta") return "meta_muse";
   return null;
 }
 
 /**
  * Recognize a personal subscription that has run out of quota. Claude Code
  * answers 429 with the unified rate-limit headers; the ChatGPT backend answers
- * 429 with a structured `error.code` and `resets_at`. The Codex WebSocket
+ * 429 with a structured `error.code` and `resets_at`. Meta documents no
+ * usage-limit signature for Muse Code plans, so any 429 on one holds it until
+ * the reset Meta gives, if any. The Codex WebSocket
  * transport bypasses fetch, so its usage-limit error only survives as message
  * text and is matched there without a reset time.
  */
@@ -57,6 +61,7 @@ export function detectSubscriptionUsageLimit(args: {
   if (oauthProvider === "anthropic_claude_code") {
     return anthropicUsageLimit(args.captured, now);
   }
+  if (oauthProvider === "meta_muse") return museUsageLimit(args.captured, now);
   return codexUsageLimit(args.captured, providerFailureMessage(args.failure), now);
 }
 
@@ -109,6 +114,18 @@ function codexUsageLimit(
   };
 }
 
+function museUsageLimit(
+  captured: CapturedProviderResponse | undefined,
+  now: Date,
+): SubscriptionUsageLimit | null {
+  if (captured === undefined || captured.status !== 429) return null;
+  return {
+    oauthProvider: "meta_muse",
+    resetsAt: laterReset(codexErrorBody(captured.bodyText)?.resets_at, captured.headers, now),
+    reason: "Muse Code usage limit reached.",
+  };
+}
+
 function codexErrorBody(bodyText: string): Record<string, unknown> | null {
   try {
     const parsed: unknown = JSON.parse(bodyText);
@@ -178,13 +195,13 @@ export function subscriptionUsageLimitFromFailure(
   const oauthProvider = marker.oauth_provider;
   const resetsAt = typeof marker.resets_at === "string" ? new Date(marker.resets_at) : null;
   if (
-    (oauthProvider !== "anthropic_claude_code" && oauthProvider !== "openai_codex")
+    typeof oauthProvider !== "string" || !(oauthProvider in SUBSCRIPTION_LABEL)
     || resetsAt === null || Number.isNaN(resetsAt.getTime())
   ) {
     return null;
   }
   return {
-    oauthProvider,
+    oauthProvider: oauthProvider as SubscriptionOAuthProvider,
     resetsAt,
     reason: typeof marker.reason === "string" ? marker.reason : "Subscription usage limit reached.",
     ...(marker.switched === true ? { switched: true } : {}),

package/src/runtime/claude_code/auxiliary_routing.ts

@@ -4,11 +4,11 @@ import {
   type RoutingDecision,
 } from "@mupt-ai/dari-router/policy-engine";
 
-import type { RoutedDecision } from "../../strategies/route_decision";
-import { isBackgroundRequest } from "../../interaction/types";
-import { HttpError } from "../../http/errors";
-import { assertCreditAvailableBeforeRouting } from "../../telemetry/usage";
-import type { PreparedRoutedCompletion } from "../prepare_routed_completion";
+import type { RoutedDecision } from "../../strategies/route_decision.js";
+import { isBackgroundRequest } from "../../interaction/types.js";
+import { HttpError } from "../../http/errors.js";
+import { assertCreditAvailableBeforeRouting } from "../../telemetry/usage.js";
+import type { PreparedRoutedCompletion } from "../prepare_routed_completion.js";
 import { leaseFallbackDecision } from "../routing_lease.js";
 
 // Explicit background classes bypass the selector and every lease path.

package/src/runtime/customer_disconnect.ts

@@ -1,4 +1,4 @@
-import { HttpError } from "../http/errors";
+import { HttpError } from "../http/errors.js";
 
 const CUSTOMER_DISCONNECTED_MESSAGE = "Client disconnected.";
 

package/src/runtime/explicit_model.ts

@@ -1,9 +1,9 @@
 import type { RoutingCandidate, RoutingDecision } from "@mupt-ai/dari-router/policy-engine";
 
-import { HttpError } from "../http/errors";
-import { explicitModelId } from "../protocol/input/router_model";
-import type { RoutedDecision } from "../strategies/route_decision";
-import type { PreparedRoutedCompletion } from "./prepare_routed_completion";
+import { HttpError } from "../http/errors.js";
+import { explicitModelId } from "../protocol/input/router_model.js";
+import type { RoutedDecision } from "../strategies/route_decision.js";
+import type { PreparedRoutedCompletion } from "./prepare_routed_completion.js";
 
 /* A request for `dari/model/<id>` is served by exactly that enabled model,
    with no selector, lease, or fallback: the user chose it, like picking a
@@ -14,14 +14,7 @@ export function explicitModelDecision(
 ): RoutedDecision | null {
   const modelId = explicitModelId(prepared.interaction.model);
   if (modelId === null) return null;
-  if (!prepared.credentials.enabled_models.includes(modelId)) {
-    throw new HttpError(
-      400,
-      `Model '${modelId}' is not enabled on this router.`,
-      "model_not_enabled",
-      "model",
-    );
-  }
+  if (!prepared.credentials.enabled_models.includes(modelId)) throw modelNotEnabled(modelId);
   const candidates = prepared.routing.candidateResolution.candidates.filter(
     (candidate) => candidate.model === modelId,
   );
@@ -63,14 +56,7 @@ function pickCandidate(
    refuses everything else instead of substituting. */
 export function strictModelDecision(prepared: PreparedRoutedCompletion): RoutedDecision {
   const modelId = explicitModelId(prepared.interaction.model);
-  if (modelId === null) {
-    throw new HttpError(
-      400,
-      "This router is strict: request a pinned model as 'dari/model/<id>'.",
-      "strict_model_required",
-      "model",
-    );
-  }
+  if (modelId === null) throw strictModelRequired();
   const { decision } = explicitModelDecision(prepared)!;
   const requested = prepared.interaction.reasoning?.effort
     ?? prepared.credentials.model_configs?.[modelId]?.default_thinking_level;
@@ -84,3 +70,16 @@ export function strictModelDecision(prepared: PreparedRoutedCompletion): RoutedD
   }
   return { decision };
 }
+
+export function modelNotEnabled(modelId: string): HttpError {
+  return new HttpError(400, `Model '${modelId}' is not enabled on this router.`, "model_not_enabled", "model");
+}
+
+export function strictModelRequired(): HttpError {
+  return new HttpError(
+    400,
+    "This router is strict: request a pinned model as 'dari/model/<id>'.",
+    "strict_model_required",
+    "model",
+  );
+}

package/src/runtime/harness_identity/conversation.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 
-import type { SourceProtocol } from "../../interaction/types";
+import type { SourceProtocol } from "../../interaction/types.js";
 
 export type HarnessConversationIdentity =
   | {

package/src/runtime/harness_identity/extract.ts

@@ -1,12 +1,12 @@
 import { isRecord } from "@mupt-ai/dari-router/policy-engine";
 
-import { HttpError } from "../../http/errors";
+import { HttpError } from "../../http/errors.js";
 import type {
   AgentRequestClass,
   AgentRequestContext,
   InteractionRequestPurpose,
-} from "../../interaction/types";
-import type { HarnessConversationIdentity } from "./conversation";
+} from "../../interaction/types.js";
+import type { HarnessConversationIdentity } from "./conversation.js";
 
 const MAX_ID_CHARS = 200;
 

package/src/runtime/harness_identity/index.ts

@@ -3,7 +3,7 @@ export {
   scopedHarnessSessionId,
   type HarnessConversationIdentity,
   type HarnessConversationScope,
-} from "./conversation";
+} from "./conversation.js";
 export {
   chatCompletionsConversationIdentity,
   claudeCodeConversationIdentity,
@@ -11,4 +11,4 @@ export {
   codexRequestPurpose,
   codexRequestContext,
   openCodeRequestContext,
-} from "./extract";
+} from "./extract.js";

package/src/runtime/prepare_routed_completion.ts

@@ -1,27 +1,29 @@
 import type { CandidatePruningAudit } from "@mupt-ai/dari-router/policy-engine";
 
-import { interactionConversationPrefix } from "../context/interaction_fingerprint";
+import { interactionConversationPrefix } from "../context/interaction_fingerprint.js";
 import {
   buildRoutingContext,
   derivePrefixLookupHashes,
   type ImageCapabilityPrunedModel,
   type RoutingContext,
-} from "../context/routing_context";
-import { isBackgroundRequest, type InteractionRequest } from "../interaction/types";
-import { executionProviderForModel } from "../models/execution_provider";
-import { gatewayPlatform, type RequestTags } from "../platform/platform";
-import { resolveRouter } from "../strategies/routing";
-import { RequestReporter, type ReportedCandidatePruning } from "../telemetry/report";
-import { RoutingBillingFinalization } from "../telemetry/billing_finalization";
-import type { ClientHarness, ProviderCredential, ResolvedRouter } from "../types";
-import { requestTags } from "./request_tags";
-import type { RoutedRuntimeReporter } from "./runtime_reporter";
-import type { RoutedProtocol } from "./routed_protocol";
+} from "../context/routing_context.js";
+import { isBackgroundRequest, type InteractionRequest } from "../interaction/types.js";
+import { executionProviderForModel } from "../models/execution_provider.js";
+import { codexModelConfig, subscriptionServes } from "../models/subscriptions.js";
+import { gatewayPlatform, type RequestTags } from "../platform/platform.js";
+import { resolveRouter } from "../strategies/routing.js";
+import { RequestReporter, type ReportedCandidatePruning } from "../telemetry/report.js";
+import { RoutingBillingFinalization } from "../telemetry/billing_finalization.js";
+import type { ClientHarness, ProviderCredential, ResolvedRouter } from "../types.js";
+import { requestTags } from "./request_tags.js";
+import { strictProviderAccess } from "./strict_provider_access.js";
+import type { RoutedRuntimeReporter } from "./runtime_reporter.js";
+import type { RoutedProtocol } from "./routed_protocol.js";
 import {
   scopedHarnessConversationId,
   scopedHarnessSessionId,
   type HarnessConversationIdentity,
-} from "./harness_identity";
+} from "./harness_identity/index.js";
 
 export type PreparedRoutedCompletion = {
   requestId: string;
@@ -125,7 +127,10 @@ export async function prepareRoutedCompletion(args: {
     }
     credentials = conversationCredentials;
   }
-  credentials = await withProviderCredentials(credentials, args.apiKey);
+  const access = strictProviderAccess(credentials, args.interaction);
+  credentials = access.credentials;
+  args = { ...args, interaction: access.interaction };
+  credentials = await withProviderCredentials(credentials, args.apiKey, args.clientHarness);
   const billable = true;
   const routing = await buildRoutingContext({
     routerId: prefixFingerprintRouterId,
@@ -188,6 +193,7 @@ export async function prepareRoutedCompletion(args: {
 async function withProviderCredentials(
   credentials: ResolvedRouter,
   apiKey: string,
+  clientHarness: ClientHarness | undefined,
 ): Promise<ResolvedRouter> {
   const platform = gatewayPlatform();
   if (platform.resolveProviderCredential === undefined) return credentials;
@@ -200,14 +206,27 @@ async function withProviderCredentials(
         routerId: credentials.router_id,
         organizationId: credentials.organization_id,
         apiKey,
+        ...(clientHarness ? { clientHarness } : {}),
       }),
     ] as const),
   );
   const provider_credentials: Record<string, ProviderCredential> = {};
+  const model_configs = { ...credentials.model_configs };
   for (const [model, credential] of resolved) {
-    if (credential?.apiKey.trim()) provider_credentials[model] = credential;
+    if (!credential?.apiKey.trim()) continue;
+    const plan = credential.subscription;
+    if (plan !== undefined && !subscriptionServes(plan, model, clientHarness)) continue;
+    provider_credentials[model] = credential;
+    if (plan === "openai_codex") {
+      // Keep the catalog's limits and thinking levels; only the serving
+      // endpoint changes.
+      model_configs[model] = {
+        ...model_configs[model],
+        ...codexModelConfig(model, credentials.model_prices?.[model] ?? null),
+      };
+    }
   }
-  return { ...credentials, provider_credentials };
+  return { ...credentials, provider_credentials, model_configs };
 }
 
 // Core's cache-aware pruning audit, extended with the context layer's image

package/src/runtime/provider_stream_lifecycle.ts

@@ -1,4 +1,4 @@
-import type { ProviderStreamOutcome } from "./provider_stream_outcome";
+import type { ProviderStreamOutcome } from "./provider_stream_outcome.js";
 
 type LifecycleArgs = {
   partialResponse: () => Record<string, unknown>;

package/src/runtime/provider_stream_outcome.ts

@@ -1,6 +1,6 @@
 import { isRecord } from "@mupt-ai/dari-router/policy-engine";
-import type { InteractionOutput } from "../interaction/types";
-import { scrubSecrets } from "../telemetry/scrub";
+import type { InteractionOutput } from "../interaction/types.js";
+import { scrubSecrets } from "../telemetry/scrub.js";
 
 export type ProviderStreamOutcome =
   | {

package/src/runtime/request_tags.ts

@@ -1,5 +1,5 @@
-import { HttpError } from "../http/errors";
-import type { RequestTags } from "../platform/platform";
+import { HttpError } from "../http/errors.js";
+import type { RequestTags } from "../platform/platform.js";
 
 const TAGS_MAX_CHARS = 2048;
 const TAGS_MAX_COUNT = 32;

package/src/runtime/routed_completion.ts

@@ -1,16 +1,16 @@
 import { randomUUID } from "node:crypto";
 
-import { isBackgroundRequest, type InteractionRequest } from "../interaction/types";
-import { explicitModelId } from "../protocol/input/router_model";
-import { captureRequestError } from "../observability/errors";
-import type { SelectorBackend } from "../strategies/routing";
-import type { ClientHarness } from "../types";
-import { assertAutoroutingAllowed, assertCreditAvailableBeforeRouting, routerSelectsModels } from "../telemetry/usage";
-import type { HarnessConversationIdentity } from "./harness_identity";
-import { CustomerDisconnectedError } from "./customer_disconnect";
-import { prepareRoutedCompletion } from "./prepare_routed_completion";
-import type { RoutedProtocol } from "./routed_protocol";
-import { runPreparedRoutedCompletion } from "./routed_runtime";
+import { isBackgroundRequest, type InteractionRequest } from "../interaction/types.js";
+import { explicitModelId } from "../protocol/input/router_model.js";
+import { captureRequestError } from "../observability/errors.js";
+import type { SelectorBackend } from "../strategies/routing.js";
+import type { ClientHarness } from "../types.js";
+import { assertAutoroutingAllowed, assertCreditAvailableBeforeRouting, routerSelectsModels } from "../telemetry/usage.js";
+import type { HarnessConversationIdentity } from "./harness_identity/index.js";
+import { CustomerDisconnectedError } from "./customer_disconnect.js";
+import { prepareRoutedCompletion } from "./prepare_routed_completion.js";
+import type { RoutedProtocol } from "./routed_protocol.js";
+import { runPreparedRoutedCompletion } from "./routed_runtime.js";
 
 export async function handleRoutedCompletion(args: {
   request: Request;

package/src/runtime/routed_protocol.ts

@@ -1,6 +1,6 @@
 import type { RoutingDecision } from "@mupt-ai/dari-router/policy-engine";
-import type { InteractionOutput, InteractionRequest, ProviderIdentity } from "../interaction/types";
-import type { ProviderStreamOutcome } from "./provider_stream_outcome";
+import type { InteractionOutput, InteractionRequest, ProviderIdentity } from "../interaction/types.js";
+import type { ProviderStreamOutcome } from "./provider_stream_outcome.js";
 
 export type RoutedCompletionResponseArgs = {
   id: string;