@omnicross/core 0.1.10 → 0.2.1

package/dist/provider-proxy/types.d.ts

@@ -1,488 +1,22 @@
-import http from 'node:http';
-import { ThinkLevel } from '@omnicross/contracts/completion-types';
-import { UsageCacheKeySource } from '@omnicross/contracts/usage-stats-types';
-import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
-import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
-import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
-import { AuthSource } from '../pipeline/AuthSource.js';
-import { BoundAccountFallbackPolicy } from '../pipeline/BoundAccountSelectionError.js';
-import { SubscriptionAuthProfile } from '../pipeline/SubscriptionAuthSource.js';
-import { AuthStrategy } from '../pipeline/SubscriptionAuthStrategy.js';
-import { ProviderConfigSource } from '../ports/provider-config-source.js';
-import { WebSearchBackend } from '../ports/web-search-backend.js';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
+import '@omnicross/contracts/subscription-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.js';
+import '../pipeline/AuthSource.js';
+import '../pipeline/BoundAccountSelectionError.js';
+import '../pipeline/SubscriptionAuthSource.js';
+import '../pipeline/SubscriptionAuthStrategy.js';
+import '../ports/provider-config-source.js';
+import '../ports/web-search-backend.js';
+export { A as AnthropicIngressHandler, a as AnthropicIngressHandlerFactory, b as AnthropicRouteHandlerParams, c as AnthropicSdkHints, E as ExtendedContextHint, D as IngressFormat, W as ProviderProxyDeps, X as ProxyAttribution, aB as RetryCallback, aC as RouteAuthMode, aD as RouteContext, aE as RouteLeaseUsageAttribution, aF as StreamEventCallback, aG as SubscriptionDispatchProfile, aH as SubscriptionRequestSummary, aI as TargetProviderFormat, aS as UsageRecordImportInput, U as UsageRecorderImport } from '../types-By9Tg6-I.js';
+import '../frontends-Doz0RaWu.js';
+import '../runtime-t8AZacFF.js';
 import '@omnicross/contracts/llm-config';
 import '../logger-4GvQNzhE.js';
 import '../transformer/types.js';
 import '../transformer/TransformerService.js';
 import '@omnicross/contracts/websearch-types';
-
-/**
- * Shared contract types for the resident `ProviderProxy`.
- *
- * The `ProviderProxy` (OpenSpec `engine-provider-decouple`, design D0/D3/D7/D9)
- * is the single resident `127.0.0.1` listener that subsumes both of the
- * host's per-session proxies (Anthropic Messages ingress and OpenAI Responses
- * ingress). Per-run state lives in a `Map<token, RouteContext>`
- * minted at run start and reaped at run end / on idle TTL.
- *
- * These types are kept in their own module so the server, route map, router,
- * and the two ingress parsers can share shapes without importing one another
- * for type-only purposes.
- *
- * @module provider-proxy/types
- */
-
-/** Callback for retry events (client toast). */
-type RetryCallback = (info: {
-    attempt: number;
-    maxAttempts: number;
-    delayMs: number;
-    statusCode: number;
-    error?: string;
-}) => void;
-/** Callback for real-time SSE streaming events (content_block_delta, content_block_start, etc.) */
-type StreamEventCallback = (event: Record<string, unknown>) => void;
-/**
- * Routing attribution carried alongside usage records — `messageId` is per-request
- * and unknown at this layer, so only the persistent `sessionId` + `apiKeyId` flow
- * through.
- */
-interface ProxyAttribution {
-    sessionId?: string | null;
-    apiKeyId?: string | null;
-    /** Token-free Route Lease attribution; never contains the bearer token. */
-    routeLease?: RouteLeaseUsageAttribution | null;
-}
-interface RouteLeaseUsageAttribution {
-    readonly leaseId: string;
-    readonly consumer: string;
-    readonly runId?: string;
-    readonly stageId?: string;
-}
-/**
- * 1M-context opt-in for outbound Anthropic requests. Populated by
- * the host's Claude-SDK engine from the active session's `cliBackend` /
- * `useExtendedContext` schema fields. When `enabled` is true and `model`
- * is in the 1M-capable allowlist, `injectExtendedContextBeta` adds
- * `'context-1m-2025-08-07'` to the request's `anthropic-beta` header
- * before transport.
- */
-interface ExtendedContextHint {
-    enabled: boolean;
-    model: string;
-}
-/** Lightweight summary derived from the inbound Anthropic request body —
- *  consumed by `modelMapper` (scenario routing) without full body access. */
-interface SubscriptionRequestSummary {
-    messageCount: number;
-    /** cl100k_base-estimated token count of system + messages (no tools). */
-    estimatedInputTokens: number;
-    /**
-     * OPTIONAL bounded per-message text slice (system prompt + the most recent
-     * user/system messages, each per-message-capped) consumed ONLY by the
-     * OpenCodeGo keyword matcher in `@omnicross/subscriptions`
-     * (`resolveOpenCodeGoScenario`). Core only WRITES this `string[]`; it never
-     * reads it and never names the matcher — keeping the cross-layer litmus at 0
-     * (no `@omnicross/core` → `@omnicross/subscriptions` edge). Optional so callers
-     * that omit it (legacy/tests) compile and degrade to the token-threshold +
-     * `default` routing.
-     */
-    matchText?: string[];
-}
-interface SubscriptionDispatchProfile {
-    readonly providerId: SubscriptionProviderId;
-    readonly displayName: string;
-    readonly authStrategy: AuthStrategy;
-    /** Pass-through providers (Claude) skip the transformer chain entirely.
-     *  Transformer providers use the chain below + the proxy's existing
-     *  `AnthropicTransformer` endpoint reverse-decoder. */
-    readonly mode: 'pass-through' | 'transformer';
-    /** Resolve the upstream URL for a given resolved model id. Required for
-     *  `mode === 'transformer'`; unused for pass-through (proxy hard-codes
-     *  `api.anthropic.com`). The OPTIONAL 2nd `config` arg lets the opencodego
-     *  profile honor a per-account `baseUrl` override (D1) — additive, so existing
-     *  one-arg callers compile unchanged. */
-    readonly resolveUpstreamUrl?: (resolvedModel: string, config?: OpenCodeGoTokenConfig) => string;
-    /** Names of transformers (registered in `TransformerService`) to run on the
-     *  provider chain. The proxy adds `AnthropicTransformer` as the endpoint
-     *  reverse-decoder. */
-    readonly providerTransformerNames?: readonly string[];
-    readonly modelTransformerNames?: readonly string[];
-    /**
-     * OPTIONAL shape-aware provider transformer-name resolver (opencodego zen).
-     * Parallel to `resolveUpstreamUrl(model, config)`: lets a profile vary its
-     * provider chain by the RESOLVED model's wire shape (e.g. zen `responses` ⇒
-     * `['openai-response']`, `gemini` ⇒ `['gemini']`). `config` is `unknown` on the
-     * core side (opaque-config discipline — core never names
-     * `OpenCodeGoTokenConfig` from `@omnicross/subscriptions`); the subscriptions
-     * implementation narrows it. When ABSENT, both ingress paths fall back to the
-     * static `providerTransformerNames` — BYTE-IDENTICAL for claude / codex / gemini
-     * (which leave this unset). Purely additive (optional).
-     */
-    readonly resolveProviderTransformerNames?: (model: string, config?: unknown) => readonly string[];
-    /** Optional model placeholder rewriter — only set for OpenCodeGo. */
-    readonly modelMapper?: (sdkModel: string, summary: SubscriptionRequestSummary, config: OpenCodeGoTokenConfig | undefined) => {
-        resolvedModel: string;
-        scenario: OpenCodeGoScenario;
-    };
-    /** Optional fallback resolver — for OpenCodeGo, picks the next model after
-     *  an unrecoverable error. Returns `null` when exhausted. Cap = 3. The
-     *  opencodego implementation ALSO consults the circuit breaker (D5): it skips
-     *  models whose circuit is open. */
-    readonly nextFallback?: (scenario: OpenCodeGoScenario, attempted: readonly string[], config: OpenCodeGoTokenConfig | undefined) => OpenCodeGoModelEntry | null;
-    /** Optional circuit-breaker admission gate for the PRIMARY (mapped) model
-     *  (D5 primary-gating). Only set for OpenCodeGo. Returns whether `modelId`'s
-     *  circuit currently admits a request (side-effecting: flips an `open` model
-     *  to `half-open` once its window elapses, exactly like `nextFallback`'s
-     *  internal consult). `nextFallback` covers the FALLBACKS; this covers the
-     *  primary the loop already holds. Absent/undefined ⇒ the loop treats the
-     *  primary as always admitted (claude / codex / gemini have no breaker). */
-    readonly allowModel?: (modelId: string) => boolean;
-    /** Optional record-outcome callback (D5 record seam). Only set for OpenCodeGo.
-     *  Both fallback loops invoke it after each attempt: `ok: true` on a `2xx`,
-     *  `ok: false` on a thrown/network error / `5xx` / `429`; a non-429 `4xx` is
-     *  NEUTRAL and the loops MUST NOT call it. Drives the per-model breaker.
-     *  Absent/undefined for claude / codex / gemini ⇒ a no-op (no breaker). */
-    readonly recordModelOutcome?: (modelId: string, ok: boolean) => void;
-}
-/** The single-entry handler the Anthropic ingress drives per request. */
-interface AnthropicIngressHandler {
-    handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
-}
-/**
- * Per-run inputs the resident proxy threads into the ingress handler factory.
- * Structural mirror of the host's `RouteHandlerParams` — kept here so the
- * ingress + `ProviderProxyDeps` do not import upward. The host's
- * `RouteHandlerParams` re-exports / aligns to this shape (so its
- * request-handler factory is assignable to the factory type below).
- */
-interface AnthropicRouteHandlerParams {
-    readonly llmConfig: ProviderConfigSource;
-    readonly providerId: string;
-    readonly model: string;
-    readonly apiKey: string;
-    readonly backgroundTaskModel?: string;
-    readonly isOfficialProvider: boolean;
-    readonly thinkingLevel?: ThinkLevel;
-    readonly extendedContext?: ExtendedContextHint | null;
-    readonly passThrough: boolean;
-    /** Upstream Bearer for the pass-through path (resident-proxy route token swap). */
-    readonly passThroughAuthToken?: string | null;
-    /** Lazy per-request resolver for the pass-through Bearer (takes precedence over the static one). */
-    readonly resolvePassThroughAuthToken?: (() => Promise<string | null>) | null;
-    readonly subscriptionProfile?: SubscriptionDispatchProfile | null;
-    /** Bound subscription account forwarded to the host's Anthropic handler. */
-    readonly preferredAccountId?: string;
-    readonly preferredAccountGroup?: string;
-    /** Strict by default; pool fallback is an explicit endpoint opt-in. */
-    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
-    /** Preferred provider-pool key selected by a resource-level binding. */
-    readonly preferredKeyId?: string;
-    /** Strict by default; pool fallback is an explicit binding opt-in. */
-    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
-    readonly maxConcurrency?: number;
-    /** Instance-level web-search backend; falls back to the proxy-global one. */
-    readonly webSearchService?: WebSearchBackend | null;
-    readonly onRetry?: RetryCallback;
-    readonly onStreamEvent?: StreamEventCallback;
-    readonly usageRecorder?: UsageRecorderImport | null;
-    readonly attribution?: ProxyAttribution | null;
-}
-/** Factory that builds a per-request Anthropic ingress handler. */
-type AnthropicIngressHandlerFactory = (params: AnthropicRouteHandlerParams) => AnthropicIngressHandler;
-/**
- * Wire format the proxy ingests for a given route. Phase 1 landed the two
- * already-sound parsers (`anthropic-messages`, `openai-responses`);
- * `provider-proxy-transformer-matrix` adds `openai-chat` (qwen / copilot /
- * opencode) and `gemini-generatecontent` (gemini-CLI api-key/relay) — completing
- * the resident proxy's 4-ingress-parser matrix.
- */
-type IngressFormat = 'anthropic-messages' | 'openai-responses' | 'openai-chat' | 'gemini-generatecontent';
-/**
- * The target Provider's wire format. The proxy's internal pass-through-vs-
- * transform decision is keyed on `(ingressFormat, targetProviderFormat)`:
- * when they MATCH the request is passed through + re-authed; otherwise it is
- * transformed through the Unified chain (design D3).
- *
- * NOTE: `'anthropic'` here is the FORMAT family, not a provider id. An official
- * or third-party Anthropic Messages provider is `'anthropic'`; an
- * OpenAI-compatible / Responses provider is `'openai-responses'`.
- */
-type TargetProviderFormat = 'anthropic' | 'openai-responses' | 'transform';
-/**
- * How the proxy re-authenticates a route upstream. `'byo'` resolves the key
- * from an LLM-config provider row (with optional `ApiKeyPool` failover);
- * `'subscription'` re-auths via a subscription `AuthStrategy` (OAuth bearer +
- * 401 refresh). The forwarded route-token sentinel is ALWAYS discarded — the
- * proxy never trusts the CLI/SDK-carried key.
- */
-type RouteAuthMode = 'byo' | 'subscription';
-/**
- * The Anthropic SDK-hint bundle carried on a `RouteContext` for routes whose
- * ingress is `'anthropic-messages'`. The Anthropic path is NOT re-implemented
- * inside the resident proxy — it is DELEGATED wholesale to the host's existing
- * per-request proxy handler (engine-provider-decouple task 2.10, "delegate for
- * parity"). That handler keeps owning its own upstream fetch + all the SDK
- * quirks (probe-mock, local web-search interception, thinkingLevel / 1M-context
- * beta injection, subscription dispatch, and the 5h/7d window header taps) — so
- * everything the host proxy used to receive per session is threaded here per
- * run and fed straight into the per-request handler factory.
- *
- * D7 conversion-SSOT is ALREADY MET: the delegated host handler runs
- * its Anthropic⇄Unified⇄provider conversion through the SAME shared pipeline
- * SSOT (`executeProviderCall` + `AnthropicTransformer`) that the Responses /
- * OpenAI-Chat / Gemini ingresses use — there is no second conversion stack. The
- * SDK quirks listed above (probe / web-search / thinking / window-tap) are
- * INGRESS concerns and deliberately stay at the ingress under the design's
- * ingress-vs-core split; they are NOT folded into the shared core.
- */
-interface AnthropicSdkHints {
-    /** Real provider key (resolved at run start) for `getProviderHeaders`. */
-    readonly apiKey: string;
-    /** Official-Anthropic provider → skip probe caching + transformer pipeline. */
-    readonly isOfficialProvider: boolean;
-    /** claude-code OAuth pass-through (forward to api.anthropic.com verbatim). */
-    readonly passThrough: boolean;
-    /**
-     * Host-managed OAuth Bearer token for the pass-through path. With the
-     * resident proxy the SDK forwards the route TOKEN as its `Authorization`
-     * header (used only for route lookup, then discarded), so the real upstream
-     * Bearer can no longer ride the SDK header — it is carried here and
-     * re-applied by the pass-through forwarder. `null`/absent → fall back to the
-     * SDK's own forwarded credential (system `~/.claude/.credentials.json`).
-     */
-    readonly passThroughAuthToken?: string | null;
-    /**
-     * OPTIONAL lazy resolver for the pass-through upstream Bearer, evaluated at
-     * REQUEST time rather than route-build time. When present it takes precedence
-     * over the static `passThroughAuthToken`, so a long-lived route always forwards
-     * a freshly auto-refreshed token (the host re-reads its OAuth store / system
-     * credentials per request) instead of the one captured when the route was
-     * built — that capture is what makes a session outlive its token and 401
-     * mid-run. Returns `null` (or throws) to fall back to the static token.
-     */
-    readonly resolvePassThroughAuthToken?: (() => Promise<string | null>) | null;
-    /** User thinking-budget preference (Anthropic-direct + reasoning chain). */
-    readonly thinkingLevel?: ThinkLevel;
-    /** 1M-context opt-in (injects `context-1m-2025-08-07` into anthropic_beta). */
-    readonly extendedContext?: ExtendedContextHint | null;
-    /** Subscription dispatch profile (Codex/Gemini/OpenCodeGo over the SDK wire). */
-    readonly subscriptionProfile?: SubscriptionDispatchProfile | null;
-    /** Bound subscription account for the delegated Anthropic path. */
-    readonly preferredAccountId?: string;
-    readonly preferredAccountGroup?: string;
-    /** Strict by default; pool fallback is an explicit endpoint opt-in. */
-    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
-    /** Preferred provider-pool key for a delegated BYO Anthropic route. */
-    readonly preferredKeyId?: string;
-    /** Strict by default; pool fallback is an explicit binding opt-in. */
-    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
-    /** Per-request max-concurrency cap for the error-handler semaphore. */
-    readonly maxConcurrency?: number;
-    /** Instance-level web-search backend (falls back to the proxy-global one). */
-    readonly webSearchService?: WebSearchBackend | null;
-    /** Retry-event callback (client toast). */
-    readonly onRetry?: RetryCallback;
-    /** Real-time SSE event callback (client live-display). */
-    readonly onStreamEvent?: StreamEventCallback;
-    /** Usage attribution (sessionId + apiKeyId) for recorded usage rows. */
-    readonly attribution?: ProxyAttribution | null;
-    /**
-     * The usage recorder (`UsageRecorderImport` port) for the delegated
-     * stream-manager taps (stream + non-stream + 5h/7d window). Per-run
-     * because `buildProviderEnvWithProxy` resolves it from the explicit arg ??
-     * the module-level recorder, exactly as the host proxy received it. The
-     * host injects its concrete usage-recorder service, which satisfies the port.
-     */
-    readonly usageRecorder?: UsageRecorderImport | null;
-}
-/**
- * Per-run routing context, looked up by the crypto route token carried in the
- * forwarded `Authorization` sentinel. Shaped to exactly what the pipeline call
- * (`executeProviderCall` + the `endpointTransformer` seam) needs to re-auth and
- * route a single run's traffic. There is NO fallback: a token miss or an
- * expired entry is rejected (design D9).
- */
-interface RouteContext {
-    /** Owning chat session id — usage attribution + ApiKeyPool affinity. */
-    readonly sessionId: string | null;
-    /**
-     * Target Provider's wire format. Drives the internal pass-through-vs-transform
-     * decision against the route's `ingressFormat`.
-     */
-    readonly targetProviderFormat: TargetProviderFormat;
-    /** Resolved provider model the upstream request targets. */
-    readonly model: string;
-    /**
-     * The client's ORIGINAL requested model id, for RESPONSE `model` passthrough
-     * on the kind-mapped outbound endpoints (`messages`/`responses`). Stamped ONLY
-     * by the outbound `resolveRoute` for those endpoints; the resident-proxy route
-     * minting path leaves it `undefined`, so internal completions are never
-     * rewritten (the two kind-mapped ingresses pass it as `relayResponse`'s
-     * `rewriteModel` — undefined ⇒ byte-identical passthrough).
-     */
-    readonly requestedModel?: string;
-    /**
-     * The outbound named-key id (`verified.id`) this request authenticated with,
-     * for usage attribution (the ByApiKey view). Stamped ONLY by the outbound
-     * `resolveRoute`; the resident-proxy route-minting path leaves it `undefined`,
-     * so internal completions record `apiKeyId: null` (the taps read
-     * `route.apiKeyId ?? null`), exactly as before.
-     */
-    readonly apiKeyId?: string;
-    /** Safe process-local lease attribution. The route token is intentionally absent. */
-    readonly routeLease?: RouteLeaseUsageAttribution;
-    /** Wire format this route's ingress decodes. */
-    readonly ingressFormat: IngressFormat;
-    /** Re-auth mode (BYO key vs subscription OAuth). */
-    readonly authMode: RouteAuthMode;
-    /**
-     * LLM-config provider row id whose key/headers authenticate a BYO call.
-     * Required for `authMode === 'byo'`; ignored for subscription routes.
-     */
-    readonly providerId?: string;
-    /**
-     * Background-task model (the SDK's haiku probes map to this). Optional —
-     * falls back to `model` when omitted. Anthropic ingress quirk only.
-     */
-    readonly backgroundTaskModel?: string;
-    /**
-     * Pre-built `AuthSource` for this route, when the caller resolved it at run
-     * start (subscription routes supply this). When omitted for BYO routes the
-     * proxy builds an `LlmConfigProviderAuth` from `providerId` at request time.
-     */
-    readonly auth?: AuthSource;
-    /**
-     * Subscription profile (structural `SubscriptionAuthProfile` subset — the
-     * registry's full `SubscriptionDispatchProfile` satisfies it). REQUIRED when
-     * `authMode === 'subscription'`. The route resolver populates it for BOTH the
-     * OpenAI-Responses ingress and the built-in (factory-absent) Anthropic
-     * `/v1/messages` ingress (RT2.1). The Responses ingress consumes only
-     * `authStrategy` / `resolveUpstreamUrl` / `providerTransformerNames`; the
-     * built-in messages subscription path additionally reads the OPTIONAL `mode`
-     * + `modelMapper` fields (present on the registry profile passed here). The
-     * factory-present Anthropic delegation carries its OWN profile inside
-     * `anthropicSdkHints.subscriptionProfile` and ignores this field.
-     */
-    readonly subscriptionProfile?: SubscriptionAuthProfile | null;
-    /**
-     * Per-request preferred subscription account id (provider/subscription
-     * duality). Stamped by the outbound `resolveRoute` from
-     * `EndpointRoutingConfig.boundAccountId`; strict bindings fail when this
-     * account cannot serve. The pool is used only when the route carries the
-     * explicit `'pool'` fallback policy. Undefined ⇒ pool auto-schedule.
-     */
-    readonly preferredAccountId?: string;
-    /** Account-group binding projected by the outbound gateway. */
-    readonly preferredAccountGroup?: string;
-    /** Bound-account behavior; `'pool'` is the explicit fallback opt-in. */
-    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
-    /** Optional provider key selected by a resource-level gateway binding. */
-    readonly preferredKeyId?: string;
-    /** Strict by default; `'pool'` permits normal provider key selection. */
-    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
-    /**
-     * OPAQUE per-account subscription config (opencodego-only). Populated by the
-     * route resolver from the subscription registry's `getOpenCodeGoConfig()`
-     * getter; passed BACK INTO the profile closures (`modelMapper` /
-     * `nextFallback` / `resolveUpstreamUrl`) by the built-in (factory-absent)
-     * `/v1/messages` plan builder so user `baseUrl` / `modelMap` / `fallbacks`
-     * overrides apply on that path.
-     *
-     * Typed `unknown` ON PURPOSE: core MUST NOT name the concrete
-     * `OpenCodeGoTokenConfig` type from `@omnicross/subscriptions` (cross-layer
-     * litmus = 0). The plan builder narrows it to the contract type
-     * (`@omnicross/contracts`) at the single profile-call boundary.
-     *
-     * INERT when an Anthropic ingress factory is injected (the built-in plan
-     * builder is then unreachable) and for non-opencodego routes (claude /
-     * codex / gemini leave it `undefined`).
-     */
-    readonly subscriptionConfig?: unknown;
-    /**
-     * The Anthropic SDK-hint bundle. REQUIRED when
-     * `ingressFormat === 'anthropic-messages'` (the resident proxy delegates that
-     * ingress to the host's existing per-request handler, which needs the full bundle).
-     * Ignored for the OpenAI Responses ingress.
-     */
-    readonly anthropicSdkHints?: AnthropicSdkHints | null;
-}
-/**
- * App-session-scoped dependencies the resident proxy needs to service ALL
- * routes. Unlike the per-run proxies these are wired ONCE at startup; per-run
- * state lives in the route map.
- */
-interface ProviderProxyDeps {
-    readonly llmConfig: ProviderConfigSource;
-    /**
-     * Session-affine key selection + 429/529/401/403 failover. Centralized here
-     * (task 2.8) so the next-batch cutover removes the per-proxy taps. Optional —
-     * BYO single-key routes work without it.
-     */
-    readonly apiKeyPool?: ApiKeyPoolService | null;
-    /**
-     * The single usage tap (task 2.8). When set, both ingress relays
-     * record their non-stream usage through it. Optional.
-     */
-    readonly usageRecorder?: UsageRecorderImport | null;
-    /**
-     * Factory for the per-request Anthropic `/v1/messages` ingress handler
-     * (E1 de-inversion). The ingress builds its delegated request handler
-     * through THIS injected factory instead of importing the host's factory
-     * directly. Bootstrap supplies the host implementation.
-     *
-     * Optional so unit-test constructors that never drive the Anthropic ingress
-     * (env-wiring smoke, pool failover, etc.) compile unchanged; when a route
-     * with `ingressFormat: 'anthropic-messages'` IS served without it wired, the
-     * ingress responds 502 (the factory is a hard dependency of THAT path only).
-     */
-    readonly anthropicIngressHandlerFactory?: AnthropicIngressHandlerFactory | null;
-}
-/**
- * Structural port for the usage recorder — only the `record` method.
- *
- * Kept structural so the serving core does not depend on the host's concrete
- * usage-recorder class. The host injects that concrete service at
- * bootstrap; it satisfies this port. Both the proxy taps (narrow literal-null
- * payloads) and the CompletionService / TransformerHandler completion path
- * (rich payloads with `messageId` / `apiKeyId` / `'completion'` origin) call
- * through this single `record()`, so the accepted input is the full structural
- * mirror of the host's `UsageRecordInput`.
- */
-interface UsageRecorderImport {
-    record(input: UsageRecordImportInput): void;
-}
-/**
- * The usage payload accepted by the recorder port — structural mirror of the
- * host's `UsageRecordInput` (type-only; no host import). Covers both the proxy
- * taps and the completion path.
- */
-interface UsageRecordImportInput {
-    messageId?: string | null;
-    parentMessageId?: string | null;
-    sessionId?: string | null;
-    providerId: string;
-    model: string;
-    apiKeyId?: string | null;
-    engineOrigin: UsageEngineOrigin;
-    usage: UsageTokens;
-    rawUsage?: unknown;
-    runId?: string | null;
-    /** Token-free managed-route attribution. */
-    routeLeaseId?: string | null;
-    routeLeaseConsumer?: string | null;
-    routeLeaseStageId?: string | null;
-    eventId?: string | null;
-    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
-    cacheKeySource?: UsageCacheKeySource;
-    /** Whether the gateway, rather than the client, attached the cache key. */
-    cacheKeyInjected?: boolean;
-    /**
-     * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
-     * relay taps set this to the request's `http.ServerResponse` so the recorder can
-     * stash this request's tokens/cost for the audit capture. Opaque; unset ⇒ no-op.
-     */
-    auditResponse?: object;
-}
-
-export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, RouteLeaseUsageAttribution, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };
+import '@omnicross/contracts/image-generation-types';
+import '@omnicross/contracts/search-types';

package/dist/provider-proxy.cjs

@@ -33,61 +33,79 @@
 
 
 
-var _chunkTIT74RILcjs = require('./chunk-TIT74RIL.cjs');
+
+
+
+
+
+
+
+var _chunkVSYQ6XYNcjs = require('./chunk-VSYQ6XYN.cjs');
+require('./chunk-E4QHVXV5.cjs');
 require('./chunk-HQP3K7PU.cjs');
 require('./chunk-QVOB2DNX.cjs');
-require('./chunk-P7EM6BND.cjs');
-require('./chunk-ZQQUD66M.cjs');
-require('./chunk-5LNYGCIW.cjs');
-require('./chunk-CMVXX7ON.cjs');
+require('./chunk-7ZHBN75N.cjs');
+require('./chunk-GBHYAGX3.cjs');
+require('./chunk-3OPYJG76.cjs');
+require('./chunk-ZAPN7XA6.cjs');
+require('./chunk-KIQ2HA2A.cjs');
+require('./chunk-NOITAVHA.cjs');
+require('./chunk-QWNUOR7F.cjs');
+require('./chunk-POUTD5AM.cjs');
+require('./chunk-6DDYNS2B.cjs');
 require('./chunk-5RSZYQJH.cjs');
-require('./chunk-56QD3YW6.cjs');
-require('./chunk-QUSEZNYS.cjs');
+require('./chunk-32SRZFFP.cjs');
 require('./chunk-2E42SAW3.cjs');
 require('./chunk-5UK3KLE2.cjs');
-require('./chunk-IIRPUVPH.cjs');
-require('./chunk-GBHYAGX3.cjs');
-require('./chunk-3OPYJG76.cjs');
-require('./chunk-3SCOLIPT.cjs');
+require('./chunk-MXI2PWIC.cjs');
 require('./chunk-RPII3E6Z.cjs');
 require('./chunk-6RPZADX3.cjs');
 require('./chunk-J3QQ6JS5.cjs');
 require('./chunk-UIBD2YY5.cjs');
 require('./chunk-R3HK6R4B.cjs');
+require('./chunk-KQBLZMP6.cjs');
+require('./chunk-OIKREZVQ.cjs');
 require('./chunk-QXD4MV2X.cjs');
 require('./chunk-NYUNU75A.cjs');
 require('./chunk-OTZC4TNH.cjs');
-require('./chunk-YWL7YZWS.cjs');
+require('./chunk-7LRTPNFL.cjs');
 require('./chunk-YNJNTCSQ.cjs');
 require('./chunk-SVNDB62D.cjs');
 require('./chunk-6QQG7YG3.cjs');
 require('./chunk-25GXJCEZ.cjs');
-require('./chunk-MUHWHQVM.cjs');
-require('./chunk-Q27JY5RG.cjs');
+require('./chunk-FX325I5Q.cjs');
+require('./chunk-AEOZIDEB.cjs');
+require('./chunk-HCOQQAZE.cjs');
 require('./chunk-APYG5QD7.cjs');
 require('./chunk-L74VDN4A.cjs');
+require('./chunk-XSVNC2UD.cjs');
 require('./chunk-4YINUUKQ.cjs');
-require('./chunk-4VZX5F4T.cjs');
+require('./chunk-T6NWPIYZ.cjs');
 require('./chunk-QBZJ7P2T.cjs');
 require('./chunk-4IH4EL7M.cjs');
+require('./chunk-JMJBSACD.cjs');
+require('./chunk-GMMT7RVN.cjs');
+require('./chunk-UNEFIWXI.cjs');
 require('./chunk-A2YMUCBT.cjs');
-require('./chunk-UWDW6PN3.cjs');
-require('./chunk-FCR77GYM.cjs');
-require('./chunk-AEOZIDEB.cjs');
-require('./chunk-XSVNC2UD.cjs');
 require('./chunk-GDIXXKF2.cjs');
-require('./chunk-OC6DOOFX.cjs');
-require('./chunk-RICPANBY.cjs');
+require('./chunk-VXRTQZF2.cjs');
+require('./chunk-WX2E2G7H.cjs');
 require('./chunk-77USGNRW.cjs');
-require('./chunk-AOFWNWLT.cjs');
-require('./chunk-RJUONLUQ.cjs');
+require('./chunk-IUL4VWNU.cjs');
+require('./chunk-4Z3ZLLC2.cjs');
 require('./chunk-235MXAGX.cjs');
 require('./chunk-HVBBDBS3.cjs');
 require('./chunk-NKVZ6Z3Y.cjs');
-require('./chunk-NZYN7C3P.cjs');
-require('./chunk-JMJBSACD.cjs');
-require('./chunk-GMMT7RVN.cjs');
-require('./chunk-UNEFIWXI.cjs');
+require('./chunk-UPQIWJIE.cjs');
+require('./chunk-G4CZIUIB.cjs');
+require('./chunk-MPXOKQJP.cjs');
+
+
+
+
+
+
+
 
 
 
@@ -123,4 +141,4 @@ require('./chunk-UNEFIWXI.cjs');
 
 
 
-exports.DEFAULT_ROUTE_IDLE_MS = _chunkTIT74RILcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunkTIT74RILcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunkTIT74RILcjs.ProviderProxyRouteMap; exports.ROUTE_LEASE_API_VERSION = _chunkTIT74RILcjs.ROUTE_LEASE_API_VERSION; exports.ROUTE_LEASE_CAPABILITIES = _chunkTIT74RILcjs.ROUTE_LEASE_CAPABILITIES; exports.ROUTE_LEASE_CAPABILITIES_SCHEMA = _chunkTIT74RILcjs.ROUTE_LEASE_CAPABILITIES_SCHEMA; exports.ROUTE_LEASE_CODEX_TOKEN_ENV = _chunkTIT74RILcjs.ROUTE_LEASE_CODEX_TOKEN_ENV; exports.ROUTE_LEASE_DEFAULT_TTL_SECONDS = _chunkTIT74RILcjs.ROUTE_LEASE_DEFAULT_TTL_SECONDS; exports.ROUTE_LEASE_MAX_CONSUMER_BYTES = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_CONSUMER_BYTES; exports.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES; exports.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES; exports.ROUTE_LEASE_MAX_MODEL_BYTES = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_MODEL_BYTES; exports.ROUTE_LEASE_MAX_SESSION_ID_BYTES = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_SESSION_ID_BYTES; exports.ROUTE_LEASE_MAX_TTL_SECONDS = _chunkTIT74RILcjs.ROUTE_LEASE_MAX_TTL_SECONDS; exports.ROUTE_LEASE_REQUEST_SCHEMA = _chunkTIT74RILcjs.ROUTE_LEASE_REQUEST_SCHEMA; exports.ROUTE_LEASE_RESULT_SCHEMA = _chunkTIT74RILcjs.ROUTE_LEASE_RESULT_SCHEMA; exports.ROUTE_LEASE_RUNTIMES = _chunkTIT74RILcjs.ROUTE_LEASE_RUNTIMES; exports.ROUTE_LEASE_RUNTIME_TABLE = _chunkTIT74RILcjs.ROUTE_LEASE_RUNTIME_TABLE; exports.ROUTE_LEASE_SESSION_HASH_DOMAIN = _chunkTIT74RILcjs.ROUTE_LEASE_SESSION_HASH_DOMAIN; exports.RouteLeaseError = _chunkTIT74RILcjs.RouteLeaseError; exports.RouteLeaseManager = _chunkTIT74RILcjs.RouteLeaseManager; exports.RouteLeaseTargetResolver = _chunkTIT74RILcjs.RouteLeaseTargetResolver; exports.SYSTEM_ROUTE_LEASE_CLOCK = _chunkTIT74RILcjs.SYSTEM_ROUTE_LEASE_CLOCK; exports.__resetProviderProxyForTests = _chunkTIT74RILcjs.__resetProviderProxyForTests; exports.canonicalizeRouteLeasePayload = _chunkTIT74RILcjs.canonicalizeRouteLeasePayload; exports.extractRouteToken = _chunkTIT74RILcjs.extractRouteToken; exports.getProviderProxy = _chunkTIT74RILcjs.getProviderProxy; exports.hashRouteLeasePayload = _chunkTIT74RILcjs.hashRouteLeasePayload; exports.hashRouteLeaseSessionId = _chunkTIT74RILcjs.hashRouteLeaseSessionId; exports.isLoopbackAddress = _chunkTIT74RILcjs.isLoopbackAddress; exports.normalizeRouteLeaseIdempotencyKey = _chunkTIT74RILcjs.normalizeRouteLeaseIdempotencyKey; exports.normalizeRouteLeaseTtl = _chunkTIT74RILcjs.normalizeRouteLeaseTtl; exports.parseRouteLeaseCreate = _chunkTIT74RILcjs.parseRouteLeaseCreate; exports.routeLeaseRuntime = _chunkTIT74RILcjs.routeLeaseRuntime;
+exports.DEFAULT_ROUTE_IDLE_MS = _chunkVSYQ6XYNcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunkVSYQ6XYNcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunkVSYQ6XYNcjs.ProviderProxyRouteMap; exports.ROUTE_LEASE_API_VERSION = _chunkVSYQ6XYNcjs.ROUTE_LEASE_API_VERSION; exports.ROUTE_LEASE_CAPABILITIES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_CAPABILITIES; exports.ROUTE_LEASE_CAPABILITIES_SCHEMA = _chunkVSYQ6XYNcjs.ROUTE_LEASE_CAPABILITIES_SCHEMA; exports.ROUTE_LEASE_CODEX_TOKEN_ENV = _chunkVSYQ6XYNcjs.ROUTE_LEASE_CODEX_TOKEN_ENV; exports.ROUTE_LEASE_DEFAULT_TTL_SECONDS = _chunkVSYQ6XYNcjs.ROUTE_LEASE_DEFAULT_TTL_SECONDS; exports.ROUTE_LEASE_MAX_CONSUMER_BYTES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_CONSUMER_BYTES; exports.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES; exports.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES; exports.ROUTE_LEASE_MAX_MODEL_BYTES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_MODEL_BYTES; exports.ROUTE_LEASE_MAX_SESSION_ID_BYTES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_SESSION_ID_BYTES; exports.ROUTE_LEASE_MAX_TTL_SECONDS = _chunkVSYQ6XYNcjs.ROUTE_LEASE_MAX_TTL_SECONDS; exports.ROUTE_LEASE_REQUEST_SCHEMA = _chunkVSYQ6XYNcjs.ROUTE_LEASE_REQUEST_SCHEMA; exports.ROUTE_LEASE_RESULT_SCHEMA = _chunkVSYQ6XYNcjs.ROUTE_LEASE_RESULT_SCHEMA; exports.ROUTE_LEASE_RUNTIMES = _chunkVSYQ6XYNcjs.ROUTE_LEASE_RUNTIMES; exports.ROUTE_LEASE_RUNTIME_TABLE = _chunkVSYQ6XYNcjs.ROUTE_LEASE_RUNTIME_TABLE; exports.ROUTE_LEASE_SESSION_HASH_DOMAIN = _chunkVSYQ6XYNcjs.ROUTE_LEASE_SESSION_HASH_DOMAIN; exports.ResponsesAffinityStore = _chunkVSYQ6XYNcjs.ResponsesAffinityStore; exports.RouteLeaseError = _chunkVSYQ6XYNcjs.RouteLeaseError; exports.RouteLeaseManager = _chunkVSYQ6XYNcjs.RouteLeaseManager; exports.RouteLeaseTargetResolver = _chunkVSYQ6XYNcjs.RouteLeaseTargetResolver; exports.SYSTEM_ROUTE_LEASE_CLOCK = _chunkVSYQ6XYNcjs.SYSTEM_ROUTE_LEASE_CLOCK; exports.__resetProviderProxyForTests = _chunkVSYQ6XYNcjs.__resetProviderProxyForTests; exports.canonicalizeRouteLeasePayload = _chunkVSYQ6XYNcjs.canonicalizeRouteLeasePayload; exports.classifyResponsesProfile = _chunkVSYQ6XYNcjs.classifyResponsesProfile; exports.createNativeResponsesHostedImageIngress = _chunkVSYQ6XYNcjs.createNativeResponsesHostedImageIngress; exports.createResponsesCompactHandler = _chunkVSYQ6XYNcjs.createResponsesCompactHandler; exports.extractRouteToken = _chunkVSYQ6XYNcjs.extractRouteToken; exports.getProviderProxy = _chunkVSYQ6XYNcjs.getProviderProxy; exports.getResponsesAffinityStore = _chunkVSYQ6XYNcjs.getResponsesAffinityStore; exports.hashRouteLeasePayload = _chunkVSYQ6XYNcjs.hashRouteLeasePayload; exports.hashRouteLeaseSessionId = _chunkVSYQ6XYNcjs.hashRouteLeaseSessionId; exports.isLoopbackAddress = _chunkVSYQ6XYNcjs.isLoopbackAddress; exports.normalizeRouteLeaseIdempotencyKey = _chunkVSYQ6XYNcjs.normalizeRouteLeaseIdempotencyKey; exports.normalizeRouteLeaseTtl = _chunkVSYQ6XYNcjs.normalizeRouteLeaseTtl; exports.parseRouteLeaseCreate = _chunkVSYQ6XYNcjs.parseRouteLeaseCreate; exports.previousResponseNotFound = _chunkVSYQ6XYNcjs.previousResponseNotFound; exports.registerResponsesCompactOperation = _chunkVSYQ6XYNcjs.registerResponsesCompactOperation; exports.routeLeaseRuntime = _chunkVSYQ6XYNcjs.routeLeaseRuntime;