@mupt-ai/dari-gateway 0.2.1 → 0.3.0

package/src/models/catalog.ts

@@ -0,0 +1,310 @@
+import { getSupportedThinkingLevels, type Api, type Model } from "@mupt-ai/pi-ai";
+import {
+  getBuiltinModelDataGeneratedAt,
+  getBuiltinModels,
+  getBuiltinProviders,
+} from "@mupt-ai/pi-ai/providers/all";
+import {
+  REASONING_EFFORTS,
+  isReasoningEffort,
+  isRecord,
+  type ReasoningEffort,
+} from "@mupt-ai/dari-router/policy-engine";
+import { HttpError } from "../http/errors.js";
+
+// The models each provider can serve to a coding agent, with the limits,
+// thinking levels, and list prices a caller needs to pick and price one.
+// Gateways (OpenRouter, Vercel AI Gateway) are listed live from their public
+// models endpoints; model providers come from the bundled Pi catalog.
+
+export type CatalogModel = {
+  // Canonical `provider/native-id`; request it as `dari/model/<id>`.
+  id: string;
+  provider: string;
+  native_model_id: string;
+  name: string;
+  context_window: number | null;
+  max_output_tokens: number | null;
+  input_modalities: string[];
+  // Accepted thinking levels; ["off"] for models that do not reason.
+  thinking_levels: ReasoningEffort[];
+  // List price in USD per million tokens; null when the source publishes
+  // none, e.g. meta-routers whose price depends on the model they pick.
+  price: CatalogModelPrice | null;
+  // When the price was read: the fetch time for gateways, the catalog's
+  // generation time for model providers.
+  price_as_of: string;
+};
+
+export type CatalogModelPrice = {
+  input: number;
+  output: number;
+  cached_input: number | null;
+  cache_write: number | null;
+  // Long-context rates, each applying to prompts above its token threshold.
+  tiers: CatalogPriceTier[];
+};
+
+export type CatalogPriceTier = {
+  input_tokens_above: number;
+  input: number;
+  output: number;
+  cached_input: number | null;
+  cache_write: number | null;
+};
+
+export type ModelCatalogOptions = {
+  // Providers to list; defaults to DEFAULT_CATALOG_PROVIDERS. Any Pi built-in
+  // provider id is accepted.
+  providers?: readonly string[] | undefined;
+  fetch?: ((url: string, init?: RequestInit) => Promise<Response>) | undefined;
+  signal?: AbortSignal | undefined;
+};
+
+export const DEFAULT_CATALOG_PROVIDERS: readonly string[] = [
+  "openai",
+  "anthropic",
+  "meta",
+  "xai",
+  "fireworks",
+  "openrouter",
+  "vercel-ai-gateway",
+];
+
+type LiveListing = {
+  url: string;
+  models: (data: unknown[], asOf: string) => CatalogModel[];
+};
+
+const LIVE_LISTINGS: Record<string, LiveListing> = {
+  openrouter: { url: "https://openrouter.ai/api/v1/models", models: openRouterModels },
+  "vercel-ai-gateway": { url: "https://ai-gateway.vercel.sh/v1/models", models: vercelModels },
+};
+
+/** List the agent-capable models of each requested provider. */
+export async function listModelCatalog(options: ModelCatalogOptions = {}): Promise<CatalogModel[]> {
+  const providers = [...new Set(options.providers ?? DEFAULT_CATALOG_PROVIDERS)];
+  const builtin = new Set<string>(getBuiltinProviders());
+  for (const provider of providers) {
+    if (LIVE_LISTINGS[provider] === undefined && !builtin.has(provider)) {
+      throw new HttpError(400, `Unknown catalog provider '${provider}'.`, "unknown_provider", "provider");
+    }
+  }
+  const lists = await Promise.all(providers.map(async (provider) => {
+    const listing = LIVE_LISTINGS[provider];
+    return listing === undefined
+      ? piModels(provider)
+      : listing.models(await fetchListing(listing.url, options), new Date().toISOString());
+  }));
+  return lists.flat();
+}
+
+async function fetchListing(url: string, options: ModelCatalogOptions): Promise<unknown[]> {
+  let status: number | undefined;
+  let body: unknown = null;
+  // Network errors, aborts, and unparseable bodies are upstream failures
+  // too: all of them surface as catalog_unavailable rather than a raw 500.
+  try {
+    const response = await (options.fetch ?? fetch)(url, {
+      headers: { accept: "application/json" },
+      ...(options.signal ? { signal: options.signal } : {}),
+    });
+    status = response.status;
+    body = response.ok ? await response.json() : null;
+  } catch {
+    // Leaves body null.
+  }
+  if (!isRecord(body) || !Array.isArray(body.data)) {
+    const detail = status === undefined ? "could not be reached" : `returned no model list (HTTP ${status})`;
+    throw new HttpError(502, `${url} ${detail}.`, "catalog_unavailable");
+  }
+  return body.data;
+}
+
+function piModels(provider: string): CatalogModel[] {
+  const generatedAt = getBuiltinModelDataGeneratedAt();
+  const asOf = generatedAt === undefined ? "" : new Date(generatedAt).toISOString();
+  const models = getBuiltinModels(provider as never) as unknown as Model<Api>[];
+  return models.map((model) => ({
+    id: `${provider}/${model.id}`,
+    provider,
+    native_model_id: model.id,
+    name: model.name,
+    context_window: model.contextWindow,
+    max_output_tokens: model.maxTokens,
+    input_modalities: [...model.input],
+    thinking_levels: orderedEfforts(getSupportedThinkingLevels(model)),
+    price: piPrice(model.cost),
+    price_as_of: asOf,
+  }));
+}
+
+function piPrice(cost: Model<Api>["cost"]): CatalogModelPrice {
+  return {
+    input: cost.input,
+    output: cost.output,
+    cached_input: cost.cacheRead,
+    cache_write: cost.cacheWrite,
+    tiers: (cost.tiers ?? []).map((tier) => ({
+      input_tokens_above: tier.inputTokensAbove,
+      input: tier.input,
+      output: tier.output,
+      cached_input: tier.cacheRead,
+      cache_write: tier.cacheWrite,
+    })),
+  };
+}
+
+// https://openrouter.ai/docs/api/api-reference/models/get-models
+function openRouterModels(data: unknown[], asOf: string): CatalogModel[] {
+  return data.filter(isRecord).flatMap((model) => {
+    const architecture = isRecord(model.architecture) ? model.architecture : {};
+    const parameters = stringList(model.supported_parameters);
+    if (typeof model.id !== "string" || !parameters.includes("tools")) return [];
+    if (!stringList(architecture.output_modalities).includes("text")) return [];
+    const reasoning = isRecord(model.reasoning) ? model.reasoning : {};
+    const topProvider = isRecord(model.top_provider) ? model.top_provider : {};
+    return [{
+      id: `openrouter/${model.id}`,
+      provider: "openrouter",
+      native_model_id: model.id,
+      name: typeof model.name === "string" ? model.name : model.id,
+      context_window: positiveInteger(model.context_length),
+      max_output_tokens: positiveInteger(topProvider.max_completion_tokens),
+      input_modalities: stringList(architecture.input_modalities),
+      thinking_levels: gatewayThinkingLevels({
+        reasons: parameters.includes("reasoning"),
+        efforts: Array.isArray(reasoning.supported_efforts) ? stringList(reasoning.supported_efforts) : null,
+        canDisable: reasoning.mandatory !== true,
+      }),
+      price: isRecord(model.pricing) ? openRouterPrice(model.pricing) : null,
+      price_as_of: asOf,
+    }];
+  });
+}
+
+function openRouterPrice(pricing: Record<string, unknown>): CatalogModelPrice | null {
+  const base = rates(pricing, "prompt", "completion");
+  if (base === null) return null;
+  // Overrides restate only the rates they change; time-of-day overrides are
+  // not context tiers.
+  const tiers = (Array.isArray(pricing.overrides) ? pricing.overrides : [])
+    .filter(isRecord)
+    .flatMap((override) => {
+      const threshold = positiveInteger(override.min_prompt_tokens);
+      if (threshold === null || "utc_days" in override || "utc_start" in override || "utc_end" in override) {
+        return [];
+      }
+      const tier = rates({ ...pricing, ...override }, "prompt", "completion", override);
+      return tier === null ? [] : [{ input_tokens_above: threshold, ...tier }];
+    });
+  return { ...base, tiers };
+}
+
+// https://vercel.com/docs/ai-gateway/models-and-providers
+function vercelModels(data: unknown[], asOf: string): CatalogModel[] {
+  return data.filter(isRecord).flatMap((model) => {
+    const modalities = isRecord(model.modalities) ? model.modalities : {};
+    const parameters = stringList(model.supported_parameters);
+    if (typeof model.id !== "string" || model.type !== "language" || !parameters.includes("tools")) return [];
+    if (!stringList(modalities.output).includes("text")) return [];
+    const options = Array.isArray(model.reasoning_options) ? model.reasoning_options.filter(isRecord) : [];
+    const effort = options.find((option) => option.type === "effort");
+    return [{
+      id: `vercel-ai-gateway/${model.id}`,
+      provider: "vercel-ai-gateway",
+      native_model_id: model.id,
+      name: typeof model.name === "string" ? model.name : model.id,
+      context_window: positiveInteger(model.context_window),
+      max_output_tokens: positiveInteger(model.max_tokens),
+      input_modalities: stringList(modalities.input),
+      thinking_levels: gatewayThinkingLevels({
+        reasons: parameters.includes("reasoning") || options.length > 0,
+        efforts: effort === undefined ? null : stringList(effort.values),
+        canDisable: options.length === 0 || options.some((option) => option.type === "toggle"),
+      }),
+      price: isRecord(model.pricing) ? vercelPrice(model.pricing) : null,
+      price_as_of: asOf,
+    }];
+  });
+}
+
+function vercelPrice(pricing: Record<string, unknown>): CatalogModelPrice | null {
+  const base = rates(pricing, "input", "output");
+  if (base === null) return null;
+  // Each rate lists its own {cost, min, max} ranges; a range covers prompts of
+  // at least `min` tokens, so it is the tier above `min - 1`.
+  const ranged = new Map<number, Record<string, unknown>>();
+  for (const key of ["input", "output", "input_cache_read", "input_cache_write"]) {
+    const ranges = Array.isArray(pricing[`${key}_tiers`]) ? pricing[`${key}_tiers`] as unknown[] : [];
+    for (const range of ranges.filter(isRecord)) {
+      const start = positiveInteger(range.min);
+      if (start === null || range.cost == null) continue;
+      ranged.set(start - 1, { ...ranged.get(start - 1), [key]: range.cost });
+    }
+  }
+  const tiers = [...ranged.entries()]
+    .sort(([left], [right]) => left - right)
+    .flatMap(([threshold, stated]) => {
+      const tier = rates({ ...pricing, ...stated }, "input", "output", stated);
+      return tier === null ? [] : [{ input_tokens_above: threshold, ...tier }];
+    });
+  return { ...base, tiers };
+}
+
+// Base rates from per-token strings. A tier inherits input and output from
+// the base price but states its own cache rates, or has none.
+function rates(
+  pricing: Record<string, unknown>,
+  inputKey: string,
+  outputKey: string,
+  cacheRates: Record<string, unknown> = pricing,
+): Omit<CatalogPriceTier, "input_tokens_above"> | null {
+  const input = perMillion(pricing[inputKey]);
+  const output = perMillion(pricing[outputKey]);
+  // Meta-routers with variable prices list negative rates.
+  if (input === null || output === null) return null;
+  return {
+    input,
+    output,
+    cached_input: perMillion(cacheRates.input_cache_read),
+    cache_write: perMillion(cacheRates.input_cache_write),
+  };
+}
+
+// USD per token as a decimal string -> USD per million tokens. Shifting the
+// exponent in the string keeps "0.000001" exactly 1.
+function perMillion(value: unknown): number | null {
+  const rate = typeof value === "string" ? Number(`${value.trim()}e6`)
+    : typeof value === "number" ? value * 1_000_000
+    : Number.NaN;
+  return Number.isFinite(rate) && rate >= 0 ? rate : null;
+}
+
+// Gateways forward `reasoning.effort`; models that reason without a stated
+// effort list take the standard low/medium/high levels.
+function gatewayThinkingLevels(args: {
+  reasons: boolean;
+  efforts: string[] | null;
+  canDisable: boolean;
+}): ReasoningEffort[] {
+  if (!args.reasons) return ["off"];
+  const efforts = args.efforts ?? ["low", "medium", "high"];
+  return orderedEfforts([
+    ...efforts.map((effort) => effort === "none" ? "off" : effort),
+    ...(args.canDisable ? ["off"] : []),
+  ]);
+}
+
+function orderedEfforts(levels: readonly string[]): ReasoningEffort[] {
+  const accepted = new Set(levels.filter(isReasoningEffort));
+  return REASONING_EFFORTS.filter((effort) => accepted.has(effort));
+}
+
+function stringList(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((item): item is string => typeof item === "string") : [];
+}
+
+function positiveInteger(value: unknown): number | null {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}

package/src/models/execution_provider.ts

@@ -11,12 +11,15 @@ export function executionProviderForModel(
 }
 
 /**
- * The key that serves a model on a resolved router. Missing declarations are
+ * The key that serves a model on a resolved router: a platform-supplied
+ * credential first, then the resolved provider key. Missing declarations are
  * user-owned so unknown platform data cannot trigger managed-key billing.
  */
 export function keySourceForModel(
   credentials: ResolvedRouter,
   model: string,
 ): ProviderKeySource {
+  const supplied = credentials.provider_credentials?.[model];
+  if (supplied) return supplied.subscription ? "subscription" : "user";
   return credentials.provider_key_sources?.[executionProviderForModel(credentials, model)] ?? "user";
 }

package/src/models/provider_defaults.ts

@@ -33,6 +33,9 @@ const PROVIDER_BASE_URLS: Record<string, string> = {
   anthropic: "https://api.anthropic.com",
   fireworks: "https://api.fireworks.ai/inference/v1",
   xai: "https://api.x.ai/v1",
+  // Meta's Model API serves OpenAI Responses and Chat Completions here, and
+  // Anthropic Messages at https://api.meta.ai.
+  meta: "https://api.meta.ai/v1",
   // Pi-ai derives the effective AWS region from the endpoint unless the
   // model config overrides base_url or the native id is an inference profile
   // ARN, so this default only pins us-east-1 when nothing else is configured.

package/src/models/runtime_overrides.ts

@@ -169,6 +169,28 @@ const MODEL_OFF_WIRE_NONE: ReadonlySet<string> = new Set([
   "deepseek-ai/DeepSeek-V4.1-Flash-1017",
 ]);
 
+// Wire values a provider's API accepts for thinking levels the Pi registry
+// leaves unmapped. Meta's Model API takes reasoning effort "none" on every
+// Muse model (dev.meta.ai/docs/coding-agents).
+const PROVIDER_THINKING_LEVEL_OVERRIDES: Record<string, Record<string, string>> = {
+  meta: { off: "none" },
+};
+
+export function providerThinkingLevelOverrides(provider: string): Record<string, string> | undefined {
+  return PROVIDER_THINKING_LEVEL_OVERRIDES[provider];
+}
+
+/** Registered Pi metadata with the serving provider's thinking level overrides. */
+export function withThinkingLevelOverrides(
+  provider: string,
+  registered: Record<string, unknown> | undefined,
+): Record<string, unknown> | undefined {
+  const override = providerThinkingLevelOverrides(provider);
+  if (registered === undefined || override === undefined) return registered;
+  const map = isRecord(registered.thinkingLevelMap) ? registered.thinkingLevelMap : {};
+  return { ...registered, thinkingLevelMap: { ...map, ...override } };
+}
+
 export function offRequiresWireNone(modelId: string): boolean {
   return MODEL_OFF_WIRE_NONE.has(canonicalModelId(modelId));
 }

package/src/models/subscriptions.ts

@@ -0,0 +1,54 @@
+import {
+  nativeModelId,
+  providerForModel,
+  type RouterModelPrice,
+} from "@mupt-ai/dari-router/policy-engine";
+
+import type { ClientHarness, ResolvedRouterModelConfig, SubscriptionKind } from "../types.js";
+
+const CODEX_BACKEND_URL = "https://chatgpt.com/backend-api";
+
+// The model provider whose models each kind of plan serves.
+const SUBSCRIPTION_MODEL_PROVIDERS: Record<SubscriptionKind, string> = {
+  openai_codex: "openai",
+  anthropic_claude_code: "anthropic",
+  meta_muse: "meta",
+};
+
+// The client each plan is limited to, as its provider limits it: a Claude Code
+// plan serves only Claude Code, and a Muse Code plan only Muse Code.
+const SUBSCRIPTION_CLIENTS: Partial<Record<SubscriptionKind, ClientHarness>> = {
+  anthropic_claude_code: "claude_code",
+  meta_muse: "muse_code",
+};
+
+/**
+ * Whether a plan may serve a model for this client: each plan serves only its
+ * own provider's models, and only to the client its provider allows.
+ */
+export function subscriptionServes(
+  kind: SubscriptionKind,
+  model: string,
+  clientHarness: ClientHarness | undefined,
+): boolean {
+  if (SUBSCRIPTION_MODEL_PROVIDERS[kind] !== providerForModel(model)) return false;
+  const client = SUBSCRIPTION_CLIENTS[kind];
+  return client === undefined || clientHarness === client;
+}
+
+// A ChatGPT plan serves OpenAI models as the `openai-codex` provider through
+// the Codex backend.
+export function codexModelConfig(
+  modelId: string,
+  price: RouterModelPrice | null,
+): ResolvedRouterModelConfig {
+  return {
+    provider: "openai-codex",
+    native_model_id: nativeModelId(modelId),
+    api: "openai-codex-responses",
+    base_url: CODEX_BACKEND_URL,
+    // A plan bills no tokens; the catalog price only feeds cost estimates.
+    cost: price ?? { input: 0, output: 0 },
+    fast_mode: false,
+  };
+}

package/src/platform/platform.ts

@@ -33,7 +33,10 @@ export type GatewayPlatform = {
    * Optional. Supply the credential for one enabled model of this request,
    * consulted after `resolveRouter` and before its provider keys (for the
    * self-hosted gateway, its environment keys), so an embedder can serve
-   * per-tenant keys from its own store. Undefined keeps the resolved key.
+   * per-tenant keys from its own store. Undefined keeps the resolved key. A
+   * credential with `subscription` serves the model on that plan, even on a
+   * strict router; a plan that cannot serve the model for this client (see
+   * SubscriptionKind) is ignored.
    */
   resolveProviderCredential?(
     request: ProviderCredentialRequest,
@@ -74,6 +77,7 @@ export type ProviderCredentialRequest = {
   organizationId: string;
   // The gateway key the request authenticated with.
   apiKey: string;
+  clientHarness?: ClientHarness;
 };
 
 export type PrefixStateWrite = {

package/src/protocol/input/chat_completions.ts

@@ -80,7 +80,9 @@ export function internalChatCompletionsToInteraction(request: ChatCompletionRequ
   const tools = chatTools(request.tools);
   toolsByWireName(tools);
   const responseFormat = toInteractionResponseFormat(request.response_format);
-  const reasoningEffort = request.reasoning_effort;
+  // OpenAI spells the non-reasoning effort "none"; Dari spells it "off".
+  const requestedEffort: string | undefined = request.reasoning_effort;
+  const reasoningEffort = requestedEffort === "none" ? "off" : request.reasoning_effort;
   return {
     sourceProtocol: request.source_protocol ?? "openai_chat",
     model: request.model,

package/src/protocol/input/chat_completions_validation.ts

@@ -214,7 +214,8 @@ function validateReasoning(request: ChatCompletionRequest): void {
       "reasoning"
     );
   }
-  if (request.reasoning_effort !== undefined && !isReasoningEffort(request.reasoning_effort)) {
+  const effort: unknown = request.reasoning_effort;
+  if (effort !== undefined && effort !== "none" && !isReasoningEffort(effort)) {
     throw new HttpError(
       400,
       "reasoning_effort is not supported.",

package/src/providers/pi.ts

@@ -29,7 +29,13 @@ import {
 import { HttpError } from "../http/errors.js";
 import { effectiveContextWindow } from "../models/context_limits.js";
 import { defaultBaseUrl } from "../models/provider_defaults.js";
-import { contextWindowOverride, inputModalitiesOverride, runtimeCompat } from "../models/runtime_overrides.js";
+import {
+  contextWindowOverride,
+  inputModalitiesOverride,
+  providerThinkingLevelOverrides,
+  runtimeCompat,
+  withThinkingLevelOverrides,
+} from "../models/runtime_overrides.js";
 import { BEDROCK_API } from "./model_capabilities.js";
 import { buildContext } from "./pi_context.js";
 import { providerIdentityFromModel } from "../interaction/provider_continuation_state.js";
@@ -335,16 +341,21 @@ export function buildModel(
   // A null catalog value delegates to Pi's registry when it knows the model.
   // Custom OpenAI-compatible models are not necessarily registered, so keep
   // the public effort set permissive and let the provider validate the wire
-  // value instead of silently treating an unknown model as off-only.
+  // value instead of silently treating an unknown model as off-only. A
+  // built-in provider with its own thinking levels (Meta) serves ids newer
+  // than the registry the same way, with only its key configured.
+  const providerThinking = providerThinkingLevelOverrides(provider);
   const fallbackThinkingLevels =
-    config !== undefined && configuredThinkingLevels == null && registered === undefined
+    (config !== undefined || providerThinking !== undefined) &&
+    configuredThinkingLevels == null &&
+    registered === undefined
       ? REASONING_EFFORTS
       : undefined;
   const effectiveThinkingLevels = Array.isArray(configuredThinkingLevels)
     ? configuredThinkingLevels
     : fallbackThinkingLevels;
   const configuredThinking = effectiveThinkingLevels
-    ? thinkingMetadata(effectiveThinkingLevels, registered)
+    ? thinkingMetadata(effectiveThinkingLevels, registered ?? { thinkingLevelMap: providerThinking })
     : null;
   const defaultThinkingLevel = config?.default_thinking_level ?? undefined;
   const api = config?.api ?? registered?.api ?? defaultApi(provider);
@@ -415,7 +426,10 @@ function resolveModelMetadata(
   nativeId: string
 ): Record<string, unknown> | undefined {
   const registry = registryProvider(provider, modelId);
-  return pi.getModel?.(registry, nativeId) ?? pi.getModel?.(registry, modelId);
+  return withThinkingLevelOverrides(
+    provider,
+    pi.getModel?.(registry, nativeId) ?? pi.getModel?.(registry, modelId),
+  );
 }
 
 // Dari's "azure" provider has no Pi registry of its own. One Foundry resource
@@ -491,7 +505,8 @@ function executionPricing(
 }
 
 function defaultApi(provider: string): string {
-  if (provider === "openai" || provider === "xai") return "openai-responses";
+  // Meta recommends Responses: its Chat Completions drops reasoning between turns.
+  if (provider === "openai" || provider === "xai" || provider === "meta") return "openai-responses";
   if (provider === "anthropic") return "anthropic-messages";
   if (provider === "amazon-bedrock") return BEDROCK_API;
   if (provider === "azure") return "azure-openai-responses";

package/src/providers/pi_options.ts

@@ -51,8 +51,10 @@ export function buildOptions(
   const providerAuth: ResolvedProviderAuth = typeof auth === "string" ? { type: "bearer", apiKey: auth } : auth;
   const { generation, toolChoice, parallelToolCalls, responseFormat } = request;
   const headers: Record<string, string> = {};
+  const bearerHeader = sendsBearerToMessages(providerAuth, model);
+  if (bearerHeader) headers.authorization = `Bearer ${providerAuth.apiKey}`;
   const options: Record<string, unknown> = {
-    ...authenticationOptions(providerAuth, api),
+    ...(bearerHeader ? {} : authenticationOptions(providerAuth, api)),
     maxRetries: 0,
     timeoutMs,
     signal,
@@ -67,6 +69,9 @@ export function buildOptions(
   if (isClaudeCodeOAuth(providerAuth, api)) {
     headers["user-agent"] = request.claudeCodeUserAgent ?? CLAUDE_CODE_USER_AGENT;
   }
+  if (model.provider === "meta" && request.museCodeClientId !== undefined) {
+    headers["x-client-id"] = request.museCodeClientId;
+  }
   // Pi's Anthropic transport honors compat.supportsTemperature; the OpenAI
   // transports forward temperature regardless, so drop it here for models
   // that reject it instead of failing the whole request.
@@ -207,6 +212,17 @@ function authenticationOptions(auth: ResolvedProviderAuth, api: unknown): Bedroc
   };
 }
 
+// Anthropic Messages endpoints outside Anthropic that take the key as a bearer
+// token (Claude Code's ANTHROPIC_AUTH_TOKEN) and reject x-api-key.
+const BEARER_MESSAGES_PROVIDERS: ReadonlySet<unknown> = new Set(["meta"]);
+
+function sendsBearerToMessages(
+  auth: ResolvedProviderAuth,
+  model: Model,
+): auth is Extract<ResolvedProviderAuth, { type: "bearer" }> {
+  return auth.type === "bearer" && isAnthropic(model.api) && BEARER_MESSAGES_PROVIDERS.has(model.provider);
+}
+
 function isClaudeCodeOAuth(auth: ResolvedProviderAuth, api: unknown): boolean {
   return auth.type === "bearer" && isAnthropic(api) && auth.apiKey.includes("sk-ant-oat");
 }

package/src/providers/provider_call.ts

@@ -115,8 +115,10 @@ export function prepareProviderExecution(args: {
   }
   const provider = executionProviderForModel(args.credentials, model);
   const supplied = args.credentials.provider_credentials?.[model];
-  const providerKeySource = supplied ? "user" : keySourceForModel(args.credentials, model);
-  if (args.credentials.strict === true && providerKeySource === "subscription") {
+  const providerKeySource = keySourceForModel(args.credentials, model);
+  // A strict router serves a plan only when the platform supplied it for this
+  // request, never a pooled or personal one it resolved.
+  if (args.credentials.strict === true && providerKeySource === "subscription" && !supplied) {
     throw new HttpError(
       400,
       `Strict routers do not serve '${model}' from a personal subscription.`,
@@ -148,7 +150,9 @@ export function prepareProviderExecution(args: {
       : {}),
     provider,
     providerKeySource,
-    ...(providerKeySource === "subscription" && args.credentials.attributed_user_id
+    // Only resolved personal subscriptions are held at their usage limit;
+    // the platform manages the plans it supplies.
+    ...(providerKeySource === "subscription" && !supplied && args.credentials.attributed_user_id
       ? {
           subscriptionUserId: args.credentials.attributed_user_id,
           subscriptionCredentialId: args.credentials.subscription_credential_ids?.[provider],

package/src/providers/subscription_limits.ts

@@ -4,7 +4,7 @@ import { providerFailureMessage } from "../runtime/provider_stream_outcome.js";
 import type { ProviderKeySource } from "../types.js";
 import type { CapturedProviderResponse } from "./response_capture.js";
 
-export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 
 export type SubscriptionUsageLimit = {
   oauthProvider: SubscriptionOAuthProvider;
@@ -25,6 +25,7 @@ const FAILURE_MARKER = "subscription_usage_limit";
 const SUBSCRIPTION_LABEL: Record<SubscriptionOAuthProvider, string> = {
   anthropic_claude_code: "Claude Code",
   openai_codex: "ChatGPT",
+  meta_muse: "Muse Code",
 };
 
 export function subscriptionOAuthProviderFor(
@@ -34,13 +35,16 @@ export function subscriptionOAuthProviderFor(
   if (keySource !== "subscription") return null;
   if (provider === "anthropic") return "anthropic_claude_code";
   if (provider === "openai" || provider === "openai-codex") return "openai_codex";
+  if (provider === "meta") return "meta_muse";
   return null;
 }
 
 /**
  * Recognize a personal subscription that has run out of quota. Claude Code
  * answers 429 with the unified rate-limit headers; the ChatGPT backend answers
- * 429 with a structured `error.code` and `resets_at`. The Codex WebSocket
+ * 429 with a structured `error.code` and `resets_at`. Meta documents no
+ * usage-limit signature for Muse Code plans, so any 429 on one holds it until
+ * the reset Meta gives, if any. The Codex WebSocket
  * transport bypasses fetch, so its usage-limit error only survives as message
  * text and is matched there without a reset time.
  */
@@ -57,6 +61,7 @@ export function detectSubscriptionUsageLimit(args: {
   if (oauthProvider === "anthropic_claude_code") {
     return anthropicUsageLimit(args.captured, now);
   }
+  if (oauthProvider === "meta_muse") return museUsageLimit(args.captured, now);
   return codexUsageLimit(args.captured, providerFailureMessage(args.failure), now);
 }
 
@@ -109,6 +114,18 @@ function codexUsageLimit(
   };
 }
 
+function museUsageLimit(
+  captured: CapturedProviderResponse | undefined,
+  now: Date,
+): SubscriptionUsageLimit | null {
+  if (captured === undefined || captured.status !== 429) return null;
+  return {
+    oauthProvider: "meta_muse",
+    resetsAt: laterReset(codexErrorBody(captured.bodyText)?.resets_at, captured.headers, now),
+    reason: "Muse Code usage limit reached.",
+  };
+}
+
 function codexErrorBody(bodyText: string): Record<string, unknown> | null {
   try {
     const parsed: unknown = JSON.parse(bodyText);
@@ -178,13 +195,13 @@ export function subscriptionUsageLimitFromFailure(
   const oauthProvider = marker.oauth_provider;
   const resetsAt = typeof marker.resets_at === "string" ? new Date(marker.resets_at) : null;
   if (
-    (oauthProvider !== "anthropic_claude_code" && oauthProvider !== "openai_codex")
+    typeof oauthProvider !== "string" || !(oauthProvider in SUBSCRIPTION_LABEL)
     || resetsAt === null || Number.isNaN(resetsAt.getTime())
   ) {
     return null;
   }
   return {
-    oauthProvider,
+    oauthProvider: oauthProvider as SubscriptionOAuthProvider,
     resetsAt,
     reason: typeof marker.reason === "string" ? marker.reason : "Subscription usage limit reached.",
     ...(marker.switched === true ? { switched: true } : {}),