@omnicross/core 0.1.4 → 0.1.5

package/dist/index.js

@@ -71,23 +71,26 @@ import {
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-QYTT6GE3.js";
+} from "./chunk-FH2P4OCD.js";
 import {
   createSSEParser,
   streamSSEResponse
 } from "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
+import {
+  TransformerChainExecutor
+} from "./chunk-G2UTNSGU.js";
 import {
   TransformerService
 } from "./chunk-DK4A7DLE.js";
 import {
   registerBuiltinTransformers
-} from "./chunk-VPBAUQ2M.js";
+} from "./chunk-OQWKZCXP.js";
+import "./chunk-IB3FDI4O.js";
 import "./chunk-ZJZAOKI7.js";
-import "./chunk-FTQ7IQUC.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-TIER4SUC.js";
-import "./chunk-Z7LUNECE.js";
+import "./chunk-C6OV7GCC.js";
+import "./chunk-IWQAX3CS.js";
+import "./chunk-BODMAL6G.js";
 import "./chunk-7VU7V2E4.js";
 import {
   PricingEngine
@@ -95,9 +98,6 @@ import {
 import {
   UsageRecorder
 } from "./chunk-BPKCU575.js";
-import {
-  TransformerChainExecutor
-} from "./chunk-G2UTNSGU.js";
 import "./chunk-MZNPGW5Q.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
@@ -154,7 +154,7 @@ import {
 } from "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-7Y47UCF2.js";
+} from "./chunk-IFXJ2BG7.js";
 import {
   AUDIT_REDACTED,
   redactAuditText
@@ -173,9 +173,10 @@ import {
   hasImageContent,
   hasThinkingEnabled
 } from "./chunk-5ZQBEOMD.js";
-import "./chunk-Z7Y2NPHY.js";
-import "./chunk-S4WBV25P.js";
-import "./chunk-XK5CIRMQ.js";
+import "./chunk-MFZ5437A.js";
+import "./chunk-6QZGDLL4.js";
+import "./chunk-D3TDKWRP.js";
+import "./chunk-SYQF7OIR.js";
 import {
   BuiltinToolExecutor,
   getBuiltinSearchTools

package/dist/outbound-api/auditCapture.cjs

@@ -1,9 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkE3UCVHLPcjs = require('../chunk-E3UCVHLP.cjs');
+var _chunkUNWKG6EIcjs = require('../chunk-UNWKG6EI.cjs');
 require('../chunk-FCR77GYM.cjs');
 require('../chunk-AEOZIDEB.cjs');
 require('../chunk-XSVNC2UD.cjs');
 
 
-exports.beginAuditCapture = _chunkE3UCVHLPcjs.beginAuditCapture;
+exports.beginAuditCapture = _chunkUNWKG6EIcjs.beginAuditCapture;

package/dist/outbound-api/auditCapture.d.cts

@@ -14,9 +14,11 @@ import http from 'node:http';
  *    method; path with the query string DROPPED), the response `statusCode`, the
  *    elapsed ms, and the fields the handler fills in (keyId / model / provider /
  *    error / bodies) — then hands it to the fire-and-forget `recordAudit`;
- *  - when `captureBodies` is ALSO on, wraps `res.write`/`res.end` to accumulate a
- *    BOUNDED response body (metadata-only for a streaming `text/event-stream`
- *    response — a full stream is unbounded), and truncates+redacts both bodies.
+ *  - when `captureBodies` is ALSO on, wraps `res.write`/`res.end` to accumulate
+ *    the response body. Bodies are captured IN FULL (no truncation) and a
+ *    streaming `text/event-stream` response is captured too — the earlier
+ *    metadata-only/bounded behavior made a codex (streaming) reply invisible,
+ *    which defeated debugging. See `upstreamTrace.ts` for the upstream leg.
  *
  * Request HEADERS are NEVER read into a record (Authorization / x-api-key live
  * there). Every stored body passes through {@link redactAuditText}. The assembly

package/dist/outbound-api/auditCapture.d.ts

@@ -14,9 +14,11 @@ import http from 'node:http';
  *    method; path with the query string DROPPED), the response `statusCode`, the
  *    elapsed ms, and the fields the handler fills in (keyId / model / provider /
  *    error / bodies) — then hands it to the fire-and-forget `recordAudit`;
- *  - when `captureBodies` is ALSO on, wraps `res.write`/`res.end` to accumulate a
- *    BOUNDED response body (metadata-only for a streaming `text/event-stream`
- *    response — a full stream is unbounded), and truncates+redacts both bodies.
+ *  - when `captureBodies` is ALSO on, wraps `res.write`/`res.end` to accumulate
+ *    the response body. Bodies are captured IN FULL (no truncation) and a
+ *    streaming `text/event-stream` response is captured too — the earlier
+ *    metadata-only/bounded behavior made a codex (streaming) reply invisible,
+ *    which defeated debugging. See `upstreamTrace.ts` for the upstream leg.
  *
  * Request HEADERS are NEVER read into a record (Authorization / x-api-key live
  * there). Every stored body passes through {@link redactAuditText}. The assembly

package/dist/outbound-api/auditCapture.js

@@ -1,6 +1,6 @@
 import {
   beginAuditCapture
-} from "../chunk-7Y47UCF2.js";
+} from "../chunk-IFXJ2BG7.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";

package/dist/outbound-api.cjs

@@ -55,20 +55,20 @@
 
 
 
-var _chunkDKPXN34Vcjs = require('./chunk-DKPXN34V.cjs');
+var _chunkCGKLE6IWcjs = require('./chunk-CGKLE6IW.cjs');
 require('./chunk-HQP3K7PU.cjs');
 require('./chunk-FZ46M34D.cjs');
+require('./chunk-46ZIFWYG.cjs');
 require('./chunk-3OPYJG76.cjs');
-require('./chunk-RGTR7CIO.cjs');
+require('./chunk-ZCIQ3L3R.cjs');
+require('./chunk-7FEBOPJO.cjs');
 require('./chunk-DWKQZ2SK.cjs');
-require('./chunk-4VAVYUZS.cjs');
-require('./chunk-7YN22L2H.cjs');
-require('./chunk-SU2GCLAC.cjs');
-require('./chunk-C72S6TTV.cjs');
+require('./chunk-4XMYPW46.cjs');
+require('./chunk-K52THW2C.cjs');
+require('./chunk-3Q6Z6JTO.cjs');
 require('./chunk-EYZYXJTJ.cjs');
 require('./chunk-YMFAJFQT.cjs');
 require('./chunk-SNYBEXLB.cjs');
-require('./chunk-46ZIFWYG.cjs');
 require('./chunk-GBHYAGX3.cjs');
 require('./chunk-RPII3E6Z.cjs');
 require('./chunk-6RPZADX3.cjs');
@@ -111,7 +111,7 @@ var _chunk4IH4EL7Mcjs = require('./chunk-4IH4EL7M.cjs');
 require('./chunk-A2YMUCBT.cjs');
 
 
-var _chunkE3UCVHLPcjs = require('./chunk-E3UCVHLP.cjs');
+var _chunkUNWKG6EIcjs = require('./chunk-UNWKG6EI.cjs');
 
 
 
@@ -119,9 +119,10 @@ var _chunkFCR77GYMcjs = require('./chunk-FCR77GYM.cjs');
 require('./chunk-AEOZIDEB.cjs');
 require('./chunk-XSVNC2UD.cjs');
 require('./chunk-SUEGJ75D.cjs');
-require('./chunk-RSJ3TWJQ.cjs');
-require('./chunk-YGXJGRFI.cjs');
-require('./chunk-OCEUVQHW.cjs');
+require('./chunk-DDMRUL76.cjs');
+require('./chunk-JWVTXXPX.cjs');
+require('./chunk-PG7PS2NN.cjs');
+require('./chunk-3Z5BQZFM.cjs');
 require('./chunk-NZYN7C3P.cjs');
 require('./chunk-JMJBSACD.cjs');
 require('./chunk-GMMT7RVN.cjs');
@@ -203,4 +204,4 @@ require('./chunk-UNEFIWXI.cjs');
 
 
 
-exports.AUDIT_REDACTED = _chunkFCR77GYMcjs.AUDIT_REDACTED; exports.ConcurrencyQueueFullError = _chunkDKPXN34Vcjs.ConcurrencyQueueFullError; exports.ConcurrencyWaitCancelledError = _chunkDKPXN34Vcjs.ConcurrencyWaitCancelledError; exports.ConcurrencyWaitTimeoutError = _chunkDKPXN34Vcjs.ConcurrencyWaitTimeoutError; exports.DEFAULT_ACCOUNT_PROBE = _chunkDKPXN34Vcjs.DEFAULT_ACCOUNT_PROBE; exports.DEFAULT_CONCURRENCY_QUEUE = _chunkDKPXN34Vcjs.DEFAULT_CONCURRENCY_QUEUE; exports.DEFAULT_FINGERPRINT = _chunkDKPXN34Vcjs.DEFAULT_FINGERPRINT; exports.DEFAULT_OUTBOUND_PORT = _chunkDKPXN34Vcjs.DEFAULT_OUTBOUND_PORT; exports.DEFAULT_USER_MESSAGE_QUEUE = _chunkDKPXN34Vcjs.DEFAULT_USER_MESSAGE_QUEUE; exports.ENDPOINT_MODEL_KINDS = _chunk4IH4EL7Mcjs.ENDPOINT_MODEL_KINDS; exports.KeySpendTracker = _chunkDKPXN34Vcjs.KeySpendTracker; exports.KeyedMutex = _chunkDKPXN34Vcjs.KeyedMutex; exports.OUTBOUND_API_SERVER_CONFIG_KEY = _chunkDKPXN34Vcjs.OUTBOUND_API_SERVER_CONFIG_KEY; exports.OutboundApiConfigError = _chunkDKPXN34Vcjs.OutboundApiConfigError; exports.OutboundApiServer = _chunkDKPXN34Vcjs.OutboundApiServer; exports.OutboundConcurrencyGate = _chunkDKPXN34Vcjs.OutboundConcurrencyGate; exports.OutboundRateLimiter = _chunkDKPXN34Vcjs.OutboundRateLimiter; exports.SUBSCRIPTION_PROVIDER_IDS = _chunkVACWOIREcjs.SUBSCRIPTION_PROVIDER_IDS; exports.SerialQueueTimeoutError = _chunkDKPXN34Vcjs.SerialQueueTimeoutError; exports.UserMessageSerialQueue = _chunkDKPXN34Vcjs.UserMessageSerialQueue; exports.__resetOutboundApiServerForTests = _chunkDKPXN34Vcjs.__resetOutboundApiServerForTests; exports.beginAuditCapture = _chunkE3UCVHLPcjs.beginAuditCapture; exports.beginBillingCapture = _chunkAPYG5QD7cjs.beginBillingCapture; exports.checkKeyQuota = _chunkDKPXN34Vcjs.checkKeyQuota; exports.classifyModelPrefix = _chunkVACWOIREcjs.classifyModelPrefix; exports.computeKeyExpiry = _chunkDKPXN34Vcjs.computeKeyExpiry; exports.computeVoucherGrant = _chunkDKPXN34Vcjs.computeVoucherGrant; exports.createNamedKey = _chunkDKPXN34Vcjs.createNamedKey; exports.defaultServerConfig = _chunkDKPXN34Vcjs.defaultServerConfig; exports.detectModelKind = _chunkVACWOIREcjs.detectModelKind; exports.detectRequestRole = _chunkVACWOIREcjs.detectRequestRole; exports.endpointSupportsSubscription = _chunkVACWOIREcjs.endpointSupportsSubscription; exports.endpointToIngressFormat = _chunkVACWOIREcjs.endpointToIngressFormat; exports.formatUrls = _chunkDKPXN34Vcjs.formatUrls; exports.generateVoucherCode = _chunkDKPXN34Vcjs.generateVoucherCode; exports.getOutboundApiServer = _chunkDKPXN34Vcjs.getOutboundApiServer; exports.handleVoucherRedeem = _chunkDKPXN34Vcjs.handleVoucherRedeem; exports.hashKey = _chunkDKPXN34Vcjs.hashKey; exports.hashVoucherCode = _chunkDKPXN34Vcjs.hashVoucherCode; exports.isConcurrencyRejection = _chunkDKPXN34Vcjs.isConcurrencyRejection; exports.isKindMappedEndpoint = _chunkVACWOIREcjs.isKindMappedEndpoint; exports.isRedeemRequest = _chunkDKPXN34Vcjs.isRedeemRequest; exports.isSerialQueueTimeout = _chunkDKPXN34Vcjs.isSerialQueueTimeout; exports.isSubscriptionProviderId = _chunkVACWOIREcjs.isSubscriptionProviderId; exports.isUserMessageRequest = _chunkDKPXN34Vcjs.isUserMessageRequest; exports.loadServerConfig = _chunkDKPXN34Vcjs.loadServerConfig; exports.mergeServerConfig = _chunkDKPXN34Vcjs.mergeServerConfig; exports.modelKindsForEndpoint = _chunkVACWOIREcjs.modelKindsForEndpoint; exports.newVoucherId = _chunkDKPXN34Vcjs.newVoucherId; exports.normalizeAccountProbe = _chunkDKPXN34Vcjs.normalizeAccountProbe; exports.normalizeAudit = _chunkDKPXN34Vcjs.normalizeAudit; exports.normalizeBilling = _chunkDKPXN34Vcjs.normalizeBilling; exports.normalizeFingerprint = _chunkDKPXN34Vcjs.normalizeFingerprint; exports.normalizePrefixTargets = _chunkDKPXN34Vcjs.normalizePrefixTargets; exports.normalizeProxyConfig = _chunkDKPXN34Vcjs.normalizeProxyConfig; exports.normalizeProxySegment = _chunkDKPXN34Vcjs.normalizeProxySegment; exports.normalizeQueueSegments = _chunkDKPXN34Vcjs.normalizeQueueSegments; exports.normalizeServerConfig = _chunkDKPXN34Vcjs.normalizeServerConfig; exports.normalizeVoucher = _chunkDKPXN34Vcjs.normalizeVoucher; exports.normalizeWebhookDestination = _chunkDKPXN34Vcjs.normalizeWebhookDestination; exports.normalizeWebhookSegment = _chunkDKPXN34Vcjs.normalizeWebhookSegment; exports.parseModelRef = _chunkVACWOIREcjs.parseModelRef; exports.pickModelRefFromList = _chunkVACWOIREcjs.pickModelRefFromList; exports.randomBase62 = _chunkDKPXN34Vcjs.randomBase62; exports.redactAuditText = _chunkFCR77GYMcjs.redactAuditText; exports.resolvePrefixTarget = _chunkVACWOIREcjs.resolvePrefixTarget; exports.resolveRoute = _chunkVACWOIREcjs.resolveRoute; exports.saveServerConfig = _chunkDKPXN34Vcjs.saveServerConfig; exports.startOfLocalDay = _chunkDKPXN34Vcjs.startOfLocalDay; exports.startOfLocalWeek = _chunkDKPXN34Vcjs.startOfLocalWeek; exports.toVoucherInfo = _chunkDKPXN34Vcjs.toVoucherInfo; exports.validateEndpointModelConfig = _chunkVACWOIREcjs.validateEndpointModelConfig; exports.validateServerModelConfig = _chunkVACWOIREcjs.validateServerModelConfig; exports.verifyKey = _chunkDKPXN34Vcjs.verifyKey; exports.verifyPresentedKey = _chunkDKPXN34Vcjs.verifyPresentedKey; exports.voucherCodePrefix = _chunkDKPXN34Vcjs.voucherCodePrefix;
+exports.AUDIT_REDACTED = _chunkFCR77GYMcjs.AUDIT_REDACTED; exports.ConcurrencyQueueFullError = _chunkCGKLE6IWcjs.ConcurrencyQueueFullError; exports.ConcurrencyWaitCancelledError = _chunkCGKLE6IWcjs.ConcurrencyWaitCancelledError; exports.ConcurrencyWaitTimeoutError = _chunkCGKLE6IWcjs.ConcurrencyWaitTimeoutError; exports.DEFAULT_ACCOUNT_PROBE = _chunkCGKLE6IWcjs.DEFAULT_ACCOUNT_PROBE; exports.DEFAULT_CONCURRENCY_QUEUE = _chunkCGKLE6IWcjs.DEFAULT_CONCURRENCY_QUEUE; exports.DEFAULT_FINGERPRINT = _chunkCGKLE6IWcjs.DEFAULT_FINGERPRINT; exports.DEFAULT_OUTBOUND_PORT = _chunkCGKLE6IWcjs.DEFAULT_OUTBOUND_PORT; exports.DEFAULT_USER_MESSAGE_QUEUE = _chunkCGKLE6IWcjs.DEFAULT_USER_MESSAGE_QUEUE; exports.ENDPOINT_MODEL_KINDS = _chunk4IH4EL7Mcjs.ENDPOINT_MODEL_KINDS; exports.KeySpendTracker = _chunkCGKLE6IWcjs.KeySpendTracker; exports.KeyedMutex = _chunkCGKLE6IWcjs.KeyedMutex; exports.OUTBOUND_API_SERVER_CONFIG_KEY = _chunkCGKLE6IWcjs.OUTBOUND_API_SERVER_CONFIG_KEY; exports.OutboundApiConfigError = _chunkCGKLE6IWcjs.OutboundApiConfigError; exports.OutboundApiServer = _chunkCGKLE6IWcjs.OutboundApiServer; exports.OutboundConcurrencyGate = _chunkCGKLE6IWcjs.OutboundConcurrencyGate; exports.OutboundRateLimiter = _chunkCGKLE6IWcjs.OutboundRateLimiter; exports.SUBSCRIPTION_PROVIDER_IDS = _chunkVACWOIREcjs.SUBSCRIPTION_PROVIDER_IDS; exports.SerialQueueTimeoutError = _chunkCGKLE6IWcjs.SerialQueueTimeoutError; exports.UserMessageSerialQueue = _chunkCGKLE6IWcjs.UserMessageSerialQueue; exports.__resetOutboundApiServerForTests = _chunkCGKLE6IWcjs.__resetOutboundApiServerForTests; exports.beginAuditCapture = _chunkUNWKG6EIcjs.beginAuditCapture; exports.beginBillingCapture = _chunkAPYG5QD7cjs.beginBillingCapture; exports.checkKeyQuota = _chunkCGKLE6IWcjs.checkKeyQuota; exports.classifyModelPrefix = _chunkVACWOIREcjs.classifyModelPrefix; exports.computeKeyExpiry = _chunkCGKLE6IWcjs.computeKeyExpiry; exports.computeVoucherGrant = _chunkCGKLE6IWcjs.computeVoucherGrant; exports.createNamedKey = _chunkCGKLE6IWcjs.createNamedKey; exports.defaultServerConfig = _chunkCGKLE6IWcjs.defaultServerConfig; exports.detectModelKind = _chunkVACWOIREcjs.detectModelKind; exports.detectRequestRole = _chunkVACWOIREcjs.detectRequestRole; exports.endpointSupportsSubscription = _chunkVACWOIREcjs.endpointSupportsSubscription; exports.endpointToIngressFormat = _chunkVACWOIREcjs.endpointToIngressFormat; exports.formatUrls = _chunkCGKLE6IWcjs.formatUrls; exports.generateVoucherCode = _chunkCGKLE6IWcjs.generateVoucherCode; exports.getOutboundApiServer = _chunkCGKLE6IWcjs.getOutboundApiServer; exports.handleVoucherRedeem = _chunkCGKLE6IWcjs.handleVoucherRedeem; exports.hashKey = _chunkCGKLE6IWcjs.hashKey; exports.hashVoucherCode = _chunkCGKLE6IWcjs.hashVoucherCode; exports.isConcurrencyRejection = _chunkCGKLE6IWcjs.isConcurrencyRejection; exports.isKindMappedEndpoint = _chunkVACWOIREcjs.isKindMappedEndpoint; exports.isRedeemRequest = _chunkCGKLE6IWcjs.isRedeemRequest; exports.isSerialQueueTimeout = _chunkCGKLE6IWcjs.isSerialQueueTimeout; exports.isSubscriptionProviderId = _chunkVACWOIREcjs.isSubscriptionProviderId; exports.isUserMessageRequest = _chunkCGKLE6IWcjs.isUserMessageRequest; exports.loadServerConfig = _chunkCGKLE6IWcjs.loadServerConfig; exports.mergeServerConfig = _chunkCGKLE6IWcjs.mergeServerConfig; exports.modelKindsForEndpoint = _chunkVACWOIREcjs.modelKindsForEndpoint; exports.newVoucherId = _chunkCGKLE6IWcjs.newVoucherId; exports.normalizeAccountProbe = _chunkCGKLE6IWcjs.normalizeAccountProbe; exports.normalizeAudit = _chunkCGKLE6IWcjs.normalizeAudit; exports.normalizeBilling = _chunkCGKLE6IWcjs.normalizeBilling; exports.normalizeFingerprint = _chunkCGKLE6IWcjs.normalizeFingerprint; exports.normalizePrefixTargets = _chunkCGKLE6IWcjs.normalizePrefixTargets; exports.normalizeProxyConfig = _chunkCGKLE6IWcjs.normalizeProxyConfig; exports.normalizeProxySegment = _chunkCGKLE6IWcjs.normalizeProxySegment; exports.normalizeQueueSegments = _chunkCGKLE6IWcjs.normalizeQueueSegments; exports.normalizeServerConfig = _chunkCGKLE6IWcjs.normalizeServerConfig; exports.normalizeVoucher = _chunkCGKLE6IWcjs.normalizeVoucher; exports.normalizeWebhookDestination = _chunkCGKLE6IWcjs.normalizeWebhookDestination; exports.normalizeWebhookSegment = _chunkCGKLE6IWcjs.normalizeWebhookSegment; exports.parseModelRef = _chunkVACWOIREcjs.parseModelRef; exports.pickModelRefFromList = _chunkVACWOIREcjs.pickModelRefFromList; exports.randomBase62 = _chunkCGKLE6IWcjs.randomBase62; exports.redactAuditText = _chunkFCR77GYMcjs.redactAuditText; exports.resolvePrefixTarget = _chunkVACWOIREcjs.resolvePrefixTarget; exports.resolveRoute = _chunkVACWOIREcjs.resolveRoute; exports.saveServerConfig = _chunkCGKLE6IWcjs.saveServerConfig; exports.startOfLocalDay = _chunkCGKLE6IWcjs.startOfLocalDay; exports.startOfLocalWeek = _chunkCGKLE6IWcjs.startOfLocalWeek; exports.toVoucherInfo = _chunkCGKLE6IWcjs.toVoucherInfo; exports.validateEndpointModelConfig = _chunkVACWOIREcjs.validateEndpointModelConfig; exports.validateServerModelConfig = _chunkVACWOIREcjs.validateServerModelConfig; exports.verifyKey = _chunkCGKLE6IWcjs.verifyKey; exports.verifyPresentedKey = _chunkCGKLE6IWcjs.verifyPresentedKey; exports.voucherCodePrefix = _chunkCGKLE6IWcjs.voucherCodePrefix;

package/dist/outbound-api.js

@@ -55,20 +55,20 @@ import {
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-QYTT6GE3.js";
+} from "./chunk-FH2P4OCD.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
+import "./chunk-G2UTNSGU.js";
 import "./chunk-DK4A7DLE.js";
-import "./chunk-VPBAUQ2M.js";
+import "./chunk-OQWKZCXP.js";
+import "./chunk-IB3FDI4O.js";
 import "./chunk-ZJZAOKI7.js";
-import "./chunk-FTQ7IQUC.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-TIER4SUC.js";
-import "./chunk-Z7LUNECE.js";
+import "./chunk-C6OV7GCC.js";
+import "./chunk-IWQAX3CS.js";
+import "./chunk-BODMAL6G.js";
 import "./chunk-7VU7V2E4.js";
 import "./chunk-ZLX3KGXX.js";
 import "./chunk-BPKCU575.js";
-import "./chunk-G2UTNSGU.js";
 import "./chunk-MZNPGW5Q.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
@@ -111,7 +111,7 @@ import {
 import "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-7Y47UCF2.js";
+} from "./chunk-IFXJ2BG7.js";
 import {
   AUDIT_REDACTED,
   redactAuditText
@@ -119,9 +119,10 @@ import {
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
 import "./chunk-5ZQBEOMD.js";
-import "./chunk-Z7Y2NPHY.js";
-import "./chunk-S4WBV25P.js";
-import "./chunk-XK5CIRMQ.js";
+import "./chunk-MFZ5437A.js";
+import "./chunk-6QZGDLL4.js";
+import "./chunk-D3TDKWRP.js";
+import "./chunk-SYQF7OIR.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";

package/dist/pipeline/upstreamFetch.cjs

@@ -4,11 +4,12 @@
 
 
 
-var _chunkOCEUVQHWcjs = require('../chunk-OCEUVQHW.cjs');
+var _chunkPG7PS2NNcjs = require('../chunk-PG7PS2NN.cjs');
+require('../chunk-3Z5BQZFM.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkOCEUVQHWcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkOCEUVQHWcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkOCEUVQHWcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkOCEUVQHWcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkOCEUVQHWcjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkPG7PS2NNcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkPG7PS2NNcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkPG7PS2NNcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkPG7PS2NNcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkPG7PS2NNcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -28,6 +28,12 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
+ * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
+ * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
+ * response and append the FULL exchange (request + verbatim response incl. SSE)
+ * to the trace file. Absent a path (the default) it is a pure no-op — zero
+ * regression. See `upstreamTrace.ts`.
+ *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 

package/dist/pipeline/upstreamFetch.d.ts

@@ -28,6 +28,12 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
+ * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
+ * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
+ * response and append the FULL exchange (request + verbatim response incl. SSE)
+ * to the trace file. Absent a path (the default) it is a pure no-op — zero
+ * regression. See `upstreamTrace.ts`.
+ *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 

package/dist/pipeline/upstreamFetch.js

@@ -4,7 +4,8 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-XK5CIRMQ.js";
+} from "../chunk-D3TDKWRP.js";
+import "../chunk-SYQF7OIR.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,

package/dist/pipeline/upstreamTrace.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunk3Z5BQZFMcjs = require('../chunk-3Z5BQZFM.cjs');
+
+
+
+
+
+
+exports.__resetUpstreamTraceForTests = _chunk3Z5BQZFMcjs.__resetUpstreamTraceForTests; exports.getUpstreamTracePath = _chunk3Z5BQZFMcjs.getUpstreamTracePath; exports.redactHeaders = _chunk3Z5BQZFMcjs.redactHeaders; exports.setUpstreamTracePath = _chunk3Z5BQZFMcjs.setUpstreamTracePath; exports.writeUpstreamTrace = _chunk3Z5BQZFMcjs.writeUpstreamTrace;

package/dist/pipeline/upstreamTrace.d.cts

@@ -0,0 +1,85 @@
+/**
+ * upstreamTrace — opt-in COMPLETE upstream-exchange capture for debugging
+ * (the omnicross → provider leg, e.g. the codex Responses call).
+ *
+ * The request-audit-log (`auditCapture`) only sees the CLIENT-facing leg
+ * (what the client sent to omnicross + what omnicross returned). It can NOT
+ * show the actual upstream provider request/response — and for a streaming
+ * codex reply it records metadata only. Every protocol-level codex bug
+ * (missing `Content-Type`, `store:false`, `input_text`, …) lives in the
+ * UPSTREAM exchange, so this module captures it verbatim.
+ *
+ * {@link fetchUpstream} is the single egress seam for every upstream call.
+ * When a trace path is installed it clones the response, reads the FULL body
+ * (a `text/event-stream` included — `clone().text()` tees the stream so the
+ * relay keeps streaming the original while the clone is buffered for the
+ * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
+ * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
+ * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
+ * is swallowed so the egress path is never affected.
+ *
+ * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
+ * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
+ * path the trace is a pure no-op — byte-identical zero regression.
+ *
+ * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
+ * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
+ * test, and a plaintext trace file must not hold them. Header KEYS stay visible
+ * so presence is verifiable. The request/response BODIES are captured VERBATIM
+ * (a prompt / a codex SSE stream) — that is the whole point.
+ *
+ * @module @omnicross/core/pipeline/upstreamTrace
+ */
+/**
+ * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
+ * write wins. The path is resolved by the daemon relative to the audit store.
+ */
+declare function setUpstreamTracePath(path: string | null): void;
+/** The active trace file path, or `null` when tracing is disabled. */
+declare function getUpstreamTracePath(): string | null;
+/**
+ * Mask secret header values while keeping the keys. Accepts a web `Headers`
+ * (from a fetch response) or a plain `Record<string,string>` (from a relay
+ * `buildHeaders`). Never throws.
+ */
+declare function redactHeaders(headers: Headers | Record<string, string> | Array<[string, string]> | undefined | null): Record<string, string>;
+/** One complete upstream-exchange trace record (appended as one JSON line). */
+interface UpstreamTraceRecord {
+    /** Epoch ms the call started (request send time). */
+    ts: number;
+    /** Round-trip duration in ms (response fully read). */
+    durationMs: number;
+    /** The opaque relay provider id (`codex`/`claude`/`gemini`/`opencodego`/`byo`). */
+    providerId?: string;
+    /** The selected pooled account id, when the relay reported one. */
+    accountId?: string;
+    /** The upstream URL the request was sent to. */
+    url: string;
+    /** HTTP method. */
+    method: string;
+    /** Outbound request headers (secret values masked). */
+    requestHeaders: Record<string, string>;
+    /** Outbound request body verbatim (the codex Responses payload), when a string. */
+    requestBody: string | null;
+    /** Upstream HTTP status (`0` when the fetch itself failed). */
+    status: number;
+    /** Upstream HTTP status text. */
+    statusText: string;
+    /** Upstream response headers. */
+    responseHeaders: Record<string, string>;
+    /** Upstream response body verbatim — the FULL `text/event-stream` for a stream. */
+    responseBody: string;
+    /** Response body size in UTF-8 bytes. */
+    responseBytes: number;
+}
+/**
+ * Append one trace record to the installed file. A no-op (zero work) when no
+ * path is installed. Fire-and-forget safe: any fs error is swallowed — a trace
+ * failure must NEVER surface into the egress path. ASYNC so a slow disk / large
+ * SSE body never blocks the event loop (the call site does not await it).
+ */
+declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
+/** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
+declare function __resetUpstreamTraceForTests(): void;
+
+export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };

package/dist/pipeline/upstreamTrace.d.ts

@@ -0,0 +1,85 @@
+/**
+ * upstreamTrace — opt-in COMPLETE upstream-exchange capture for debugging
+ * (the omnicross → provider leg, e.g. the codex Responses call).
+ *
+ * The request-audit-log (`auditCapture`) only sees the CLIENT-facing leg
+ * (what the client sent to omnicross + what omnicross returned). It can NOT
+ * show the actual upstream provider request/response — and for a streaming
+ * codex reply it records metadata only. Every protocol-level codex bug
+ * (missing `Content-Type`, `store:false`, `input_text`, …) lives in the
+ * UPSTREAM exchange, so this module captures it verbatim.
+ *
+ * {@link fetchUpstream} is the single egress seam for every upstream call.
+ * When a trace path is installed it clones the response, reads the FULL body
+ * (a `text/event-stream` included — `clone().text()` tees the stream so the
+ * relay keeps streaming the original while the clone is buffered for the
+ * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
+ * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
+ * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
+ * is swallowed so the egress path is never affected.
+ *
+ * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
+ * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
+ * path the trace is a pure no-op — byte-identical zero regression.
+ *
+ * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
+ * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
+ * test, and a plaintext trace file must not hold them. Header KEYS stay visible
+ * so presence is verifiable. The request/response BODIES are captured VERBATIM
+ * (a prompt / a codex SSE stream) — that is the whole point.
+ *
+ * @module @omnicross/core/pipeline/upstreamTrace
+ */
+/**
+ * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
+ * write wins. The path is resolved by the daemon relative to the audit store.
+ */
+declare function setUpstreamTracePath(path: string | null): void;
+/** The active trace file path, or `null` when tracing is disabled. */
+declare function getUpstreamTracePath(): string | null;
+/**
+ * Mask secret header values while keeping the keys. Accepts a web `Headers`
+ * (from a fetch response) or a plain `Record<string,string>` (from a relay
+ * `buildHeaders`). Never throws.
+ */
+declare function redactHeaders(headers: Headers | Record<string, string> | Array<[string, string]> | undefined | null): Record<string, string>;
+/** One complete upstream-exchange trace record (appended as one JSON line). */
+interface UpstreamTraceRecord {
+    /** Epoch ms the call started (request send time). */
+    ts: number;
+    /** Round-trip duration in ms (response fully read). */
+    durationMs: number;
+    /** The opaque relay provider id (`codex`/`claude`/`gemini`/`opencodego`/`byo`). */
+    providerId?: string;
+    /** The selected pooled account id, when the relay reported one. */
+    accountId?: string;
+    /** The upstream URL the request was sent to. */
+    url: string;
+    /** HTTP method. */
+    method: string;
+    /** Outbound request headers (secret values masked). */
+    requestHeaders: Record<string, string>;
+    /** Outbound request body verbatim (the codex Responses payload), when a string. */
+    requestBody: string | null;
+    /** Upstream HTTP status (`0` when the fetch itself failed). */
+    status: number;
+    /** Upstream HTTP status text. */
+    statusText: string;
+    /** Upstream response headers. */
+    responseHeaders: Record<string, string>;
+    /** Upstream response body verbatim — the FULL `text/event-stream` for a stream. */
+    responseBody: string;
+    /** Response body size in UTF-8 bytes. */
+    responseBytes: number;
+}
+/**
+ * Append one trace record to the installed file. A no-op (zero work) when no
+ * path is installed. Fire-and-forget safe: any fs error is swallowed — a trace
+ * failure must NEVER surface into the egress path. ASYNC so a slow disk / large
+ * SSE body never blocks the event loop (the call site does not await it).
+ */
+declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
+/** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
+declare function __resetUpstreamTraceForTests(): void;
+
+export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };

package/dist/pipeline/upstreamTrace.js

@@ -0,0 +1,14 @@
+import {
+  __resetUpstreamTraceForTests,
+  getUpstreamTracePath,
+  redactHeaders,
+  setUpstreamTracePath,
+  writeUpstreamTrace
+} from "../chunk-SYQF7OIR.js";
+export {
+  __resetUpstreamTraceForTests,
+  getUpstreamTracePath,
+  redactHeaders,
+  setUpstreamTracePath,
+  writeUpstreamTrace
+};

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,20 +1,20 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkDKPXN34Vcjs = require('../chunk-DKPXN34V.cjs');
+var _chunkCGKLE6IWcjs = require('../chunk-CGKLE6IW.cjs');
 require('../chunk-HQP3K7PU.cjs');
 require('../chunk-FZ46M34D.cjs');
+require('../chunk-46ZIFWYG.cjs');
 require('../chunk-3OPYJG76.cjs');
-require('../chunk-RGTR7CIO.cjs');
+require('../chunk-ZCIQ3L3R.cjs');
+require('../chunk-7FEBOPJO.cjs');
 require('../chunk-DWKQZ2SK.cjs');
-require('../chunk-4VAVYUZS.cjs');
-require('../chunk-7YN22L2H.cjs');
-require('../chunk-SU2GCLAC.cjs');
-require('../chunk-C72S6TTV.cjs');
+require('../chunk-4XMYPW46.cjs');
+require('../chunk-K52THW2C.cjs');
+require('../chunk-3Q6Z6JTO.cjs');
 require('../chunk-EYZYXJTJ.cjs');
 require('../chunk-YMFAJFQT.cjs');
 require('../chunk-SNYBEXLB.cjs');
-require('../chunk-46ZIFWYG.cjs');
 require('../chunk-GBHYAGX3.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
@@ -35,14 +35,15 @@ require('../chunk-VACWOIRE.cjs');
 require('../chunk-QBZJ7P2T.cjs');
 require('../chunk-4IH4EL7M.cjs');
 require('../chunk-A2YMUCBT.cjs');
-require('../chunk-E3UCVHLP.cjs');
+require('../chunk-UNWKG6EI.cjs');
 require('../chunk-FCR77GYM.cjs');
 require('../chunk-AEOZIDEB.cjs');
 require('../chunk-XSVNC2UD.cjs');
 require('../chunk-SUEGJ75D.cjs');
-require('../chunk-RSJ3TWJQ.cjs');
-require('../chunk-YGXJGRFI.cjs');
-require('../chunk-OCEUVQHW.cjs');
+require('../chunk-DDMRUL76.cjs');
+require('../chunk-JWVTXXPX.cjs');
+require('../chunk-PG7PS2NN.cjs');
+require('../chunk-3Z5BQZFM.cjs');
 require('../chunk-NZYN7C3P.cjs');
 require('../chunk-JMJBSACD.cjs');
 require('../chunk-GMMT7RVN.cjs');
@@ -50,4 +51,4 @@ require('../chunk-UNEFIWXI.cjs');
 
 
 
-exports.ProviderProxy = _chunkDKPXN34Vcjs.ProviderProxy; exports.isLoopbackAddress = _chunkDKPXN34Vcjs.isLoopbackAddress;
+exports.ProviderProxy = _chunkCGKLE6IWcjs.ProviderProxy; exports.isLoopbackAddress = _chunkCGKLE6IWcjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.js

@@ -1,20 +1,20 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-QYTT6GE3.js";
+} from "../chunk-FH2P4OCD.js";
 import "../chunk-VVEHS2LI.js";
 import "../chunk-46RLHI7D.js";
+import "../chunk-G2UTNSGU.js";
 import "../chunk-DK4A7DLE.js";
-import "../chunk-VPBAUQ2M.js";
+import "../chunk-OQWKZCXP.js";
+import "../chunk-IB3FDI4O.js";
 import "../chunk-ZJZAOKI7.js";
-import "../chunk-FTQ7IQUC.js";
-import "../chunk-C7PSERMH.js";
-import "../chunk-TIER4SUC.js";
-import "../chunk-Z7LUNECE.js";
+import "../chunk-C6OV7GCC.js";
+import "../chunk-IWQAX3CS.js";
+import "../chunk-BODMAL6G.js";
 import "../chunk-7VU7V2E4.js";
 import "../chunk-ZLX3KGXX.js";
 import "../chunk-BPKCU575.js";
-import "../chunk-G2UTNSGU.js";
 import "../chunk-MZNPGW5Q.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
@@ -35,14 +35,15 @@ import "../chunk-UHGVBFU3.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-XEKD23J5.js";
 import "../chunk-H5JUT3KV.js";
-import "../chunk-7Y47UCF2.js";
+import "../chunk-IFXJ2BG7.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";
 import "../chunk-5ZQBEOMD.js";
-import "../chunk-Z7Y2NPHY.js";
-import "../chunk-S4WBV25P.js";
-import "../chunk-XK5CIRMQ.js";
+import "../chunk-MFZ5437A.js";
+import "../chunk-6QZGDLL4.js";
+import "../chunk-D3TDKWRP.js";
+import "../chunk-SYQF7OIR.js";
 import "../chunk-CDHS2QDC.js";
 import "../chunk-Y7FO65VT.js";
 import "../chunk-FMOBD2OQ.js";