@omnicross/core 0.1.2 → 0.1.3

package/dist/provider-proxy/identity/fingerprintHeaders.d.ts

@@ -0,0 +1,89 @@
+import { SubscriptionIdentityStore } from './SubscriptionIdentityStore.js';
+
+/**
+ * fingerprintHeaders — the PURE half of subscription client-fingerprint replay
+ * (subscription-client-fingerprint #7, design D2/D3/D4/D7).
+ *
+ * Holds ONLY pure functions (no state, no store): the capture WHITELIST
+ * (`extractFingerprintHeaders`), the store-normalizer (`sanitizeFrozenHeaders`),
+ * the TTL refresh split (`refreshNonStainless`), the outbound merge
+ * (`mergeFrozenIdentity`), and the one composition entrypoint the relay calls
+ * (`applyFingerprint`, which takes the store INSTANCE as a parameter so this file
+ * never imports the store at runtime — no cycle).
+ *
+ * SAFETY CORE (non-negotiable):
+ *  - The capture whitelist is POSITIVE (`x-stainless-*` + a small set of
+ *    Claude-Code / Anthropic-SDK header names) AND has an explicit EXCLUSION of
+ *    `authorization` / `x-api-key` / `cookie` (the token/secret) — belt AND
+ *    suspenders, so widening the whitelist can never leak auth.
+ *  - The outbound merge NEVER overwrites `authorization` / `content-type`
+ *    (the auth strategy owns auth; content-type is fixed) and never overwrites a
+ *    header the outbound build already set (case-insensitive).
+ *  - Values are only ever REAL captured client headers — nothing here fabricates
+ *    a `x-stainless-*` value. The only synthesizable piece is the operator-set UA
+ *    baseline, applied in `applyFingerprint` ONLY when NOTHING was captured.
+ *
+ * @module provider-proxy/identity/fingerprintHeaders
+ */
+
+/** Header-name prefix that marks a stainless (SDK-runtime) fingerprint header. */
+declare const STAINLESS_PREFIX = "x-stainless-";
+/** Whether a header name (any case) is a stainless fingerprint header. */
+declare function isStainless(name: string): boolean;
+/**
+ * Capture: extract the WHITELISTED fingerprint headers from an incoming client
+ * request's header bag (`http.IncomingHttpHeaders`-shaped). Array values (rare —
+ * duplicate headers) are joined with `, `. Keys are lowercased. The auth/secret
+ * exclusion is applied FIRST so it wins over any whitelist entry. Never throws.
+ */
+declare function extractFingerprintHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/**
+ * Ingress capture gate (subscription-client-fingerprint #7): extract the caller's
+ * fingerprint headers ONLY when replay is enabled — returns `undefined` when
+ * disabled so the ingress does NO extraction work on the default/BYO path (and
+ * threads nothing to the relay). Behavior when enabled is identical to calling
+ * `extractFingerprintHeaders` directly.
+ */
+declare function captureCallerIdentity(store: SubscriptionIdentityStore, reqHeaders: Record<string, string | string[] | undefined>): Record<string, string> | undefined;
+/**
+ * Store-normalize a header bag before freezing/seeding: lowercase keys, drop
+ * empty/non-string values, and HARD-EXCLUDE the auth/secret + protected-outbound
+ * sets. This is the second line of defense (after the capture whitelist) so a
+ * persisted/seeded identity can never carry a token even if a bad bag was handed
+ * in. Idempotent.
+ */
+declare function sanitizeFrozenHeaders(headers: Record<string, string>): Record<string, string>;
+/**
+ * TTL refresh split (P2, piece 2): produce the refreshed frozen set when a newer
+ * real capture is observed after the CC-header TTL. The STAINLESS set stays
+ * frozen-stable (only the original values survive — a real client keeps a stable
+ * stainless identity); the NON-stainless headers (user-agent / anthropic-beta /
+ * x-app / …) are refreshed from the newer observation, falling back to the frozen
+ * value when the new bag omits one. New stainless headers in the incoming bag are
+ * IGNORED (stainless never grows/changes after the first freeze).
+ */
+declare function refreshNonStainless(frozen: Record<string, string>, incoming: Record<string, string>): Record<string, string>;
+/**
+ * Merge a frozen identity into the outbound `headers` in place. NEVER overwrites
+ * `authorization` / `content-type`, and never overwrites a header already present
+ * (case-insensitive) — so a header the auth strategy or the relay already set
+ * always wins. The identity keys are already lowercased (`sanitizeFrozenHeaders`).
+ */
+declare function mergeFrozenIdentity(headers: Record<string, string>, identity: Record<string, string>): void;
+/**
+ * The ONE composition entrypoint the claude same-format relay calls, AFTER
+ * `applyHeaders` reported the selected account and BEFORE `fetchUpstream`.
+ *
+ * Disabled (default) OR no account id ⇒ a strict no-op — the `headers` object is
+ * left BYTE-IDENTICAL (the zero-regression guarantee). When enabled:
+ *  1. capture the caller's real fingerprint headers for this account (first-seen
+ *     freeze; P2 TTL refresh) — per-account, keyed by the reported account id;
+ *  2. replay the frozen identity for the account into `headers` (never
+ *     overwriting auth/content-type). On the FIRST request this is the client's
+ *     own just-captured headers (honest); later requests replay the frozen set;
+ *  3. if NOTHING is captured for the account, apply ONLY the operator-configured
+ *     UA baseline (never a fabricated stainless value).
+ */
+declare function applyFingerprint(store: SubscriptionIdentityStore, headers: Record<string, string>, providerId: string, accountId: string | undefined, callerIdentity: Record<string, string> | undefined, now?: number): void;
+
+export { STAINLESS_PREFIX, applyFingerprint, captureCallerIdentity, extractFingerprintHeaders, isStainless, mergeFrozenIdentity, refreshNonStainless, sanitizeFrozenHeaders };

package/dist/provider-proxy/identity/fingerprintHeaders.js

@@ -0,0 +1,20 @@
+import {
+  STAINLESS_PREFIX,
+  applyFingerprint,
+  captureCallerIdentity,
+  extractFingerprintHeaders,
+  isStainless,
+  mergeFrozenIdentity,
+  refreshNonStainless,
+  sanitizeFrozenHeaders
+} from "../../chunk-XX6NQJMA.js";
+export {
+  STAINLESS_PREFIX,
+  applyFingerprint,
+  captureCallerIdentity,
+  extractFingerprintHeaders,
+  isStainless,
+  mergeFrozenIdentity,
+  refreshNonStainless,
+  sanitizeFrozenHeaders
+};

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -7,39 +7,46 @@
 
 
 
-var _chunkSN3YWBX7cjs = require('../../chunk-SN3YWBX7.cjs');
-require('../../chunk-SPVWWUHX.cjs');
+var _chunk2FMI2B6Vcjs = require('../../chunk-2FMI2B6V.cjs');
 require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-FZ46M34D.cjs');
 require('../../chunk-46ZIFWYG.cjs');
-require('../../chunk-GBHYAGX3.cjs');
 require('../../chunk-3OPYJG76.cjs');
-require('../../chunk-UYPEN5XE.cjs');
-require('../../chunk-7YN22L2H.cjs');
-require('../../chunk-2DCNB7DF.cjs');
+require('../../chunk-FFALUUZZ.cjs');
 require('../../chunk-C72S6TTV.cjs');
 require('../../chunk-DWKQZ2SK.cjs');
 require('../../chunk-4VAVYUZS.cjs');
+require('../../chunk-7YN22L2H.cjs');
+require('../../chunk-2DCNB7DF.cjs');
 require('../../chunk-EYZYXJTJ.cjs');
 require('../../chunk-YMFAJFQT.cjs');
-require('../../chunk-XBSYYZIY.cjs');
+require('../../chunk-3QOSDDNI.cjs');
+require('../../chunk-GBHYAGX3.cjs');
+require('../../chunk-RPII3E6Z.cjs');
+require('../../chunk-6RPZADX3.cjs');
+require('../../chunk-QWBWGODS.cjs');
+require('../../chunk-NYUNU75A.cjs');
+require('../../chunk-VQY5W4YW.cjs');
+require('../../chunk-Y6OM7EV7.cjs');
+require('../../chunk-SVNDB62D.cjs');
 require('../../chunk-R3HK6R4B.cjs');
+require('../../chunk-AEOZIDEB.cjs');
+require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-KUU2RNG6.cjs');
-require('../../chunk-LKZJEL6E.cjs');
+require('../../chunk-Q27JY5RG.cjs');
 require('../../chunk-QXD4MV2X.cjs');
-require('../../chunk-NYUNU75A.cjs');
-require('../../chunk-N3V2J5ZO.cjs');
-require('../../chunk-SVNDB62D.cjs');
 require('../../chunk-A2YMUCBT.cjs');
-require('../../chunk-G2FUJNA2.cjs');
+require('../../chunk-SVXC36MU.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
+require('../../chunk-4IH4EL7M.cjs');
 require('../../chunk-SUEGJ75D.cjs');
+require('../../chunk-S6JGLF3G.cjs');
 require('../../chunk-RSJ3TWJQ.cjs');
 require('../../chunk-YGXJGRFI.cjs');
 require('../../chunk-NZYN7C3P.cjs');
-require('../../chunk-V5KPWNYX.cjs');
-require('../../chunk-6VIXXLMX.cjs');
+require('../../chunk-JMJBSACD.cjs');
 require('../../chunk-GMMT7RVN.cjs');
+require('../../chunk-UNEFIWXI.cjs');
 
 
 
@@ -49,4 +56,4 @@ require('../../chunk-GMMT7RVN.cjs');
 
 
 
-exports.getAnthropicEndpointTransformer = _chunkSN3YWBX7cjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkSN3YWBX7cjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkSN3YWBX7cjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkSN3YWBX7cjs.getSharedExecutor; exports.readBody = _chunkSN3YWBX7cjs.readBody; exports.relayResponse = _chunkSN3YWBX7cjs.relayResponse; exports.resolvePoolBoundKey = _chunkSN3YWBX7cjs.resolvePoolBoundKey; exports.writeError = _chunkSN3YWBX7cjs.writeError;
+exports.getAnthropicEndpointTransformer = _chunk2FMI2B6Vcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunk2FMI2B6Vcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunk2FMI2B6Vcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunk2FMI2B6Vcjs.getSharedExecutor; exports.readBody = _chunk2FMI2B6Vcjs.readBody; exports.relayResponse = _chunk2FMI2B6Vcjs.relayResponse; exports.resolvePoolBoundKey = _chunk2FMI2B6Vcjs.resolvePoolBoundKey; exports.writeError = _chunk2FMI2B6Vcjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -43,9 +43,18 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  * - else: read the JSON text and write it once, returning it so the caller can
  *   tap usage. Mirrors the host's codex relay.
  *
- * @returns the JSON body text for non-stream responses, else `null`.
+ * `rewriteModel` (optional, design D4): when set, the response `model` is
+ * rewritten to this id — top-level + nested `response.model` for non-stream JSON,
+ * and EVERY model-bearing SSE event for streams — so a kind-mapped outbound
+ * caller (Claude Code / Codex) sees its ORIGINAL requested id, not the upstream
+ * provider name. When UNSET the relay is byte-identical to before (the resident
+ * proxy + `chat`/`gemini` ingresses never pass it → zero regression). The RETURN
+ * value stays the UPSTREAM body text (the usage tap must account on the real
+ * upstream model), even though the client receives the rewritten body.
+ *
+ * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
 /**

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -43,9 +43,18 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  * - else: read the JSON text and write it once, returning it so the caller can
  *   tap usage. Mirrors the host's codex relay.
  *
- * @returns the JSON body text for non-stream responses, else `null`.
+ * `rewriteModel` (optional, design D4): when set, the response `model` is
+ * rewritten to this id — top-level + nested `response.model` for non-stream JSON,
+ * and EVERY model-bearing SSE event for streams — so a kind-mapped outbound
+ * caller (Claude Code / Codex) sees its ORIGINAL requested id, not the upstream
+ * provider name. When UNSET the relay is byte-identical to before (the resident
+ * proxy + `chat`/`gemini` ingresses never pass it → zero regression). The RETURN
+ * value stays the UPSTREAM body text (the usage tap must account on the real
+ * upstream model), even though the client receives the rewritten body.
+ *
+ * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
 /**

package/dist/provider-proxy/ingress/providerProxyShared.js

@@ -7,39 +7,46 @@ import {
   relayResponse,
   resolvePoolBoundKey,
   writeError
-} from "../../chunk-2FEVTJWG.js";
-import "../../chunk-QOCNX236.js";
+} from "../../chunk-4DECIFU7.js";
 import "../../chunk-VVEHS2LI.js";
 import "../../chunk-46RLHI7D.js";
 import "../../chunk-G2UTNSGU.js";
-import "../../chunk-MZNPGW5Q.js";
 import "../../chunk-DK4A7DLE.js";
-import "../../chunk-O466Y272.js";
-import "../../chunk-C7PSERMH.js";
-import "../../chunk-5HTVET6E.js";
+import "../../chunk-MQNDWYPN.js";
 import "../../chunk-Z7LUNECE.js";
 import "../../chunk-ZJZAOKI7.js";
 import "../../chunk-FTQ7IQUC.js";
+import "../../chunk-C7PSERMH.js";
+import "../../chunk-5HTVET6E.js";
 import "../../chunk-7VU7V2E4.js";
 import "../../chunk-ZLX3KGXX.js";
-import "../../chunk-MNYKI4CI.js";
+import "../../chunk-CWM2ZDU5.js";
+import "../../chunk-MZNPGW5Q.js";
+import "../../chunk-XTEI64OU.js";
+import "../../chunk-XX6NQJMA.js";
+import "../../chunk-IAXWICZU.js";
+import "../../chunk-5ERIZW3D.js";
+import "../../chunk-5ENKBSWO.js";
+import "../../chunk-N5QFKSDO.js";
+import "../../chunk-AVYJ4YBN.js";
 import "../../chunk-DRWHTIIZ.js";
+import "../../chunk-WNY4WMRF.js";
+import "../../chunk-TKJMZBAH.js";
 import "../../chunk-JO5NLTLY.js";
-import "../../chunk-PXUJF5HS.js";
+import "../../chunk-ZY6KU6P3.js";
 import "../../chunk-JWC6APFQ.js";
-import "../../chunk-5ERIZW3D.js";
-import "../../chunk-74TMJA7Z.js";
-import "../../chunk-AVYJ4YBN.js";
 import "../../chunk-H5JUT3KV.js";
-import "../../chunk-3MEACFK3.js";
+import "../../chunk-CZHZGRU7.js";
 import "../../chunk-AQ5TNQB7.js";
+import "../../chunk-XEKD23J5.js";
 import "../../chunk-5ZQBEOMD.js";
+import "../../chunk-BO4RFWBR.js";
 import "../../chunk-Z7Y2NPHY.js";
 import "../../chunk-S4WBV25P.js";
 import "../../chunk-CDHS2QDC.js";
-import "../../chunk-745DV5FL.js";
-import "../../chunk-E3WHL7CO.js";
+import "../../chunk-Y7FO65VT.js";
 import "../../chunk-FMOBD2OQ.js";
+import "../../chunk-HUZZZ3JL.js";
 export {
   getAnthropicEndpointTransformer,
   getGeminiEndpointTransformer,

package/dist/provider-proxy/matchText.cjs

@@ -3,10 +3,12 @@
 
 
 
-var _chunkSPVWWUHXcjs = require('../chunk-SPVWWUHX.cjs');
 
+var _chunkQWBWGODScjs = require('../chunk-QWBWGODS.cjs');
 
 
 
 
-exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkSPVWWUHXcjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkSPVWWUHXcjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkSPVWWUHXcjs.collectMatchText; exports.flattenMatchText = _chunkSPVWWUHXcjs.flattenMatchText;
+
+
+exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkQWBWGODScjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkQWBWGODScjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkQWBWGODScjs.collectMatchText; exports.deriveSubscriptionSessionKey = _chunkQWBWGODScjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkQWBWGODScjs.flattenMatchText;

package/dist/provider-proxy/matchText.d.cts

@@ -43,5 +43,18 @@ declare function flattenMatchText(value: unknown): string;
  * @param anthropicBody the parsed Anthropic Messages request body.
  */
 declare function collectMatchText(anthropicBody: Record<string, unknown>): string[];
+/**
+ * Derive a STABLE per-conversation session key for the account-pool's session
+ * affinity (subscription-account-scheduling, D5). Anchored on `system` + the
+ * FIRST `user` message — both survive a multi-turn conversation UNCHANGED (unlike
+ * the full transcript, which grows every turn), so one conversation keeps one
+ * session key and thus one sticky account. Returns `undefined` when there is no
+ * anchor text (⇒ the selector falls back to pure priority/LRU, still correct).
+ *
+ * Lives here (the shared match-text SSOT) so BOTH relay paths — the core
+ * `/v1/messages` ingress and the daemon `SubscriptionDispatcher` — derive the
+ * SAME key for the same body.
+ */
+declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
 
-export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, flattenMatchText };
+export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, deriveSubscriptionSessionKey, flattenMatchText };

package/dist/provider-proxy/matchText.d.ts

@@ -43,5 +43,18 @@ declare function flattenMatchText(value: unknown): string;
  * @param anthropicBody the parsed Anthropic Messages request body.
  */
 declare function collectMatchText(anthropicBody: Record<string, unknown>): string[];
+/**
+ * Derive a STABLE per-conversation session key for the account-pool's session
+ * affinity (subscription-account-scheduling, D5). Anchored on `system` + the
+ * FIRST `user` message — both survive a multi-turn conversation UNCHANGED (unlike
+ * the full transcript, which grows every turn), so one conversation keeps one
+ * session key and thus one sticky account. Returns `undefined` when there is no
+ * anchor text (⇒ the selector falls back to pure priority/LRU, still correct).
+ *
+ * Lives here (the shared match-text SSOT) so BOTH relay paths — the core
+ * `/v1/messages` ingress and the daemon `SubscriptionDispatcher` — derive the
+ * SAME key for the same body.
+ */
+declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
 
-export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, flattenMatchText };
+export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, deriveSubscriptionSessionKey, flattenMatchText };

package/dist/provider-proxy/matchText.js

@@ -2,11 +2,13 @@ import {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,
   collectMatchText,
+  deriveSubscriptionSessionKey,
   flattenMatchText
-} from "../chunk-QOCNX236.js";
+} from "../chunk-IAXWICZU.js";
 export {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,
   collectMatchText,
+  deriveSubscriptionSessionKey,
   flattenMatchText
 };

package/dist/provider-proxy/types.d.cts

@@ -285,6 +285,23 @@ interface RouteContext {
     readonly targetProviderFormat: TargetProviderFormat;
     /** Resolved provider model the upstream request targets. */
     readonly model: string;
+    /**
+     * The client's ORIGINAL requested model id, for RESPONSE `model` passthrough
+     * on the kind-mapped outbound endpoints (`messages`/`responses`). Stamped ONLY
+     * by the outbound `resolveRoute` for those endpoints; the resident-proxy route
+     * minting path leaves it `undefined`, so internal completions are never
+     * rewritten (the two kind-mapped ingresses pass it as `relayResponse`'s
+     * `rewriteModel` — undefined ⇒ byte-identical passthrough).
+     */
+    readonly requestedModel?: string;
+    /**
+     * The outbound named-key id (`verified.id`) this request authenticated with,
+     * for usage attribution (the ByApiKey view). Stamped ONLY by the outbound
+     * `resolveRoute`; the resident-proxy route-minting path leaves it `undefined`,
+     * so internal completions record `apiKeyId: null` (the taps read
+     * `route.apiKeyId ?? null`), exactly as before.
+     */
+    readonly apiKeyId?: string;
     /** Wire format this route's ingress decodes. */
     readonly ingressFormat: IngressFormat;
     /** Re-auth mode (BYO key vs subscription OAuth). */
@@ -406,6 +423,12 @@ interface UsageRecordImportInput {
     rawUsage?: unknown;
     runId?: string | null;
     eventId?: string | null;
+    /**
+     * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
+     * relay taps set this to the request's `http.ServerResponse` so the recorder can
+     * stash this request's tokens/cost for the audit capture. Opaque; unset ⇒ no-op.
+     */
+    auditResponse?: object;
 }
 
 export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };

package/dist/provider-proxy/types.d.ts

@@ -285,6 +285,23 @@ interface RouteContext {
     readonly targetProviderFormat: TargetProviderFormat;
     /** Resolved provider model the upstream request targets. */
     readonly model: string;
+    /**
+     * The client's ORIGINAL requested model id, for RESPONSE `model` passthrough
+     * on the kind-mapped outbound endpoints (`messages`/`responses`). Stamped ONLY
+     * by the outbound `resolveRoute` for those endpoints; the resident-proxy route
+     * minting path leaves it `undefined`, so internal completions are never
+     * rewritten (the two kind-mapped ingresses pass it as `relayResponse`'s
+     * `rewriteModel` — undefined ⇒ byte-identical passthrough).
+     */
+    readonly requestedModel?: string;
+    /**
+     * The outbound named-key id (`verified.id`) this request authenticated with,
+     * for usage attribution (the ByApiKey view). Stamped ONLY by the outbound
+     * `resolveRoute`; the resident-proxy route-minting path leaves it `undefined`,
+     * so internal completions record `apiKeyId: null` (the taps read
+     * `route.apiKeyId ?? null`), exactly as before.
+     */
+    readonly apiKeyId?: string;
     /** Wire format this route's ingress decodes. */
     readonly ingressFormat: IngressFormat;
     /** Re-auth mode (BYO key vs subscription OAuth). */
@@ -406,6 +423,12 @@ interface UsageRecordImportInput {
     rawUsage?: unknown;
     runId?: string | null;
     eventId?: string | null;
+    /**
+     * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
+     * relay taps set this to the request's `http.ServerResponse` so the recorder can
+     * stash this request's tokens/cost for the audit capture. Opaque; unset ⇒ no-op.
+     */
+    auditResponse?: object;
 }
 
 export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };

package/dist/provider-proxy.cjs

@@ -5,39 +5,46 @@
 
 
 
-var _chunkSN3YWBX7cjs = require('./chunk-SN3YWBX7.cjs');
-require('./chunk-SPVWWUHX.cjs');
+var _chunk2FMI2B6Vcjs = require('./chunk-2FMI2B6V.cjs');
 require('./chunk-HQP3K7PU.cjs');
 require('./chunk-FZ46M34D.cjs');
 require('./chunk-46ZIFWYG.cjs');
-require('./chunk-GBHYAGX3.cjs');
 require('./chunk-3OPYJG76.cjs');
-require('./chunk-UYPEN5XE.cjs');
-require('./chunk-7YN22L2H.cjs');
-require('./chunk-2DCNB7DF.cjs');
+require('./chunk-FFALUUZZ.cjs');
 require('./chunk-C72S6TTV.cjs');
 require('./chunk-DWKQZ2SK.cjs');
 require('./chunk-4VAVYUZS.cjs');
+require('./chunk-7YN22L2H.cjs');
+require('./chunk-2DCNB7DF.cjs');
 require('./chunk-EYZYXJTJ.cjs');
 require('./chunk-YMFAJFQT.cjs');
-require('./chunk-XBSYYZIY.cjs');
+require('./chunk-3QOSDDNI.cjs');
+require('./chunk-GBHYAGX3.cjs');
+require('./chunk-RPII3E6Z.cjs');
+require('./chunk-6RPZADX3.cjs');
+require('./chunk-QWBWGODS.cjs');
+require('./chunk-NYUNU75A.cjs');
+require('./chunk-VQY5W4YW.cjs');
+require('./chunk-Y6OM7EV7.cjs');
+require('./chunk-SVNDB62D.cjs');
 require('./chunk-R3HK6R4B.cjs');
+require('./chunk-AEOZIDEB.cjs');
+require('./chunk-L74VDN4A.cjs');
 require('./chunk-KUU2RNG6.cjs');
-require('./chunk-LKZJEL6E.cjs');
+require('./chunk-Q27JY5RG.cjs');
 require('./chunk-QXD4MV2X.cjs');
-require('./chunk-NYUNU75A.cjs');
-require('./chunk-N3V2J5ZO.cjs');
-require('./chunk-SVNDB62D.cjs');
 require('./chunk-A2YMUCBT.cjs');
-require('./chunk-G2FUJNA2.cjs');
+require('./chunk-SVXC36MU.cjs');
 require('./chunk-QBZJ7P2T.cjs');
+require('./chunk-4IH4EL7M.cjs');
 require('./chunk-SUEGJ75D.cjs');
+require('./chunk-S6JGLF3G.cjs');
 require('./chunk-RSJ3TWJQ.cjs');
 require('./chunk-YGXJGRFI.cjs');
 require('./chunk-NZYN7C3P.cjs');
-require('./chunk-V5KPWNYX.cjs');
-require('./chunk-6VIXXLMX.cjs');
+require('./chunk-JMJBSACD.cjs');
 require('./chunk-GMMT7RVN.cjs');
+require('./chunk-UNEFIWXI.cjs');
 
 
 
@@ -45,4 +52,4 @@ require('./chunk-GMMT7RVN.cjs');
 
 
 
-exports.DEFAULT_ROUTE_IDLE_MS = _chunkSN3YWBX7cjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunkSN3YWBX7cjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunkSN3YWBX7cjs.ProviderProxyRouteMap; exports.__resetProviderProxyForTests = _chunkSN3YWBX7cjs.__resetProviderProxyForTests; exports.extractRouteToken = _chunkSN3YWBX7cjs.extractRouteToken; exports.getProviderProxy = _chunkSN3YWBX7cjs.getProviderProxy;
+exports.DEFAULT_ROUTE_IDLE_MS = _chunk2FMI2B6Vcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunk2FMI2B6Vcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunk2FMI2B6Vcjs.ProviderProxyRouteMap; exports.__resetProviderProxyForTests = _chunk2FMI2B6Vcjs.__resetProviderProxyForTests; exports.extractRouteToken = _chunk2FMI2B6Vcjs.extractRouteToken; exports.getProviderProxy = _chunk2FMI2B6Vcjs.getProviderProxy;

package/dist/provider-proxy.js

@@ -5,39 +5,46 @@ import {
   __resetProviderProxyForTests,
   extractRouteToken,
   getProviderProxy
-} from "./chunk-2FEVTJWG.js";
-import "./chunk-QOCNX236.js";
+} from "./chunk-4DECIFU7.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
 import "./chunk-G2UTNSGU.js";
-import "./chunk-MZNPGW5Q.js";
 import "./chunk-DK4A7DLE.js";
-import "./chunk-O466Y272.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-5HTVET6E.js";
+import "./chunk-MQNDWYPN.js";
 import "./chunk-Z7LUNECE.js";
 import "./chunk-ZJZAOKI7.js";
 import "./chunk-FTQ7IQUC.js";
+import "./chunk-C7PSERMH.js";
+import "./chunk-5HTVET6E.js";
 import "./chunk-7VU7V2E4.js";
 import "./chunk-ZLX3KGXX.js";
-import "./chunk-MNYKI4CI.js";
+import "./chunk-CWM2ZDU5.js";
+import "./chunk-MZNPGW5Q.js";
+import "./chunk-XTEI64OU.js";
+import "./chunk-XX6NQJMA.js";
+import "./chunk-IAXWICZU.js";
+import "./chunk-5ERIZW3D.js";
+import "./chunk-5ENKBSWO.js";
+import "./chunk-N5QFKSDO.js";
+import "./chunk-AVYJ4YBN.js";
 import "./chunk-DRWHTIIZ.js";
+import "./chunk-WNY4WMRF.js";
+import "./chunk-TKJMZBAH.js";
 import "./chunk-JO5NLTLY.js";
-import "./chunk-PXUJF5HS.js";
+import "./chunk-ZY6KU6P3.js";
 import "./chunk-JWC6APFQ.js";
-import "./chunk-5ERIZW3D.js";
-import "./chunk-74TMJA7Z.js";
-import "./chunk-AVYJ4YBN.js";
 import "./chunk-H5JUT3KV.js";
-import "./chunk-3MEACFK3.js";
+import "./chunk-CZHZGRU7.js";
 import "./chunk-AQ5TNQB7.js";
+import "./chunk-XEKD23J5.js";
 import "./chunk-5ZQBEOMD.js";
+import "./chunk-BO4RFWBR.js";
 import "./chunk-Z7Y2NPHY.js";
 import "./chunk-S4WBV25P.js";
 import "./chunk-CDHS2QDC.js";
-import "./chunk-745DV5FL.js";
-import "./chunk-E3WHL7CO.js";
+import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";
+import "./chunk-HUZZZ3JL.js";
 export {
   DEFAULT_ROUTE_IDLE_MS,
   ProviderProxy,

package/dist/{routeResolver-HE-ZO0fO.d.ts → routeResolver-B1NglTfe.d.ts}

@@ -1,6 +1,6 @@
 import { ProviderConfigSource } from './ports/provider-config-source.js';
 import { IngressFormat, RouteContext } from './provider-proxy/types.js';
-import { OutboundEndpoint, EndpointRoutingConfig, RequestRole } from './outbound-api/types.js';
+import { q as OutboundEndpoint, P as ModelRef, b as EndpointRoutingConfig, R as RequestRole } from './types-6OUY_xfA.js';
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 
 /**
@@ -39,21 +39,26 @@ declare function endpointSupportsSubscription(endpoint: OutboundEndpoint): boole
 
 /**
  * routeResolver — turn an endpoint's `EndpointRoutingConfig` + the detected
- * request role into a `RouteContext` for the shared `provider-proxy` dispatch
- * (`outbound-api-server`, design D2).
+ * request KIND (messages/responses) or ROLE (chat/gemini) into a `RouteContext`
+ * for the shared `provider-proxy` dispatch (`outbound-api-server`, design D1/D2).
  *
  * Steps:
- *  1. Pick the model for the role (vision → default fallback when `visionModel`
- *     is unset; vision is optional).
+ *  1. Pick the model ref: by model KIND for the kind-mapped endpoints
+ *     (`messages`/`responses`) via `modelMap[detectModelKind(...)]` with a
+ *     serving-owned fallback (messages: first configured of `sonnet → opus →
+ *     haiku → fable`; responses: `codex`); by ROLE (default/background) for the
+ *     role-based endpoints (`chat`/`gemini`). Vision was removed.
  *  2. Parse the chosen `"providerId,modelId"` ref.
  *  3. Gate by `useSubscription`: OFF → only BYO-key providers are eligible
  *     (subscription-backed providers excluded); ON → subscription-backed
  *     providers are eligible.
  *  4. Resolve the provider (BYO via the `ProviderConfigSource`; subscription via the
  *     subscription registry) and build the `RouteContext` exactly as the
- *     internal callers do.
- *  5. Return a clear `503`-style error when the role's required model is unset,
- *     the provider is unavailable, or the subscription gate excludes it.
+ *     internal callers do. For kind-mapped endpoints STAMP `route.requestedModel`
+ *     with the client's ORIGINAL requested id so the response `model` can be
+ *     passed through unchanged (the resident proxy leaves this unset).
+ *  5. Return a clear `503`-style error when the required model is unset, the
+ *     provider is unavailable, or the subscription gate excludes it.
  *
  * @module outbound-api/routeResolver
  */
@@ -76,13 +81,34 @@ declare function parseModelRef(ref: string | undefined): {
     providerId: string;
     modelId: string;
 } | null;
+/**
+ * Pick the model ref for the LIST-mapped `chat` endpoint: the client requests
+ * one of the configured refs' modelIds directly (the same names `GET /v1/models`
+ * advertises). Exact modelId match first, then case-insensitive. No requested
+ * model, or a model not in the list → `undefined` (per-request 404).
+ */
+declare function pickModelRefFromList(models: ModelRef[] | undefined, requestedModel: string | undefined): ModelRef | undefined;
 /** Resolve a route for one authenticated outbound request. */
 declare function resolveRoute(args: {
     config: EndpointRoutingConfig;
-    role: RequestRole;
+    /** Role for the role-based endpoints (`chat`/`gemini`); ignored (optional) for kind-mapped ones. */
+    role?: RequestRole;
     ingressFormat: IngressFormat;
     llmConfig: ProviderConfigSource;
     sessionId?: string | null;
+    /**
+     * The client's ORIGINAL requested model id. For kind-mapped endpoints it
+     * selects the model KIND AND is stamped onto `route.requestedModel` so the
+     * response `model` passes through unchanged. Ignored for role-based endpoints.
+     */
+    requestedModel?: string;
+    /**
+     * The verified named-key id (`verified.id`). Stamped onto EVERY outbound
+     * endpoint's route (not gated on kind — attribution is orthogonal to the
+     * passthrough-rewrite gate), BYO + subscription. Absent for the resident
+     * proxy's internal route minting, so internal usage records `apiKeyId: null`.
+     */
+    apiKeyId?: string;
 }): Promise<RouteResolveResult>;
 
-export { type RouteResolveError as R, SUBSCRIPTION_PROVIDER_IDS as S, type RouteResolveResult as a, endpointSupportsSubscription as e, isSubscriptionProviderId as i, parseModelRef as p, resolveRoute as r };
+export { type RouteResolveError as R, SUBSCRIPTION_PROVIDER_IDS as S, pickModelRefFromList as a, type RouteResolveResult as b, endpointSupportsSubscription as e, isSubscriptionProviderId as i, parseModelRef as p, resolveRoute as r };