@omnicross/core 0.1.5 → 0.1.6

package/dist/provider-proxy/ProviderProxy.js

@@ -1,37 +1,38 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-FH2P4OCD.js";
+} from "../chunk-UDCC7EMR.js";
+import "../chunk-WB6PH56J.js";
 import "../chunk-VVEHS2LI.js";
 import "../chunk-46RLHI7D.js";
-import "../chunk-G2UTNSGU.js";
+import "../chunk-WNKWAEUR.js";
+import "../chunk-MZNPGW5Q.js";
 import "../chunk-DK4A7DLE.js";
-import "../chunk-OQWKZCXP.js";
-import "../chunk-IB3FDI4O.js";
-import "../chunk-ZJZAOKI7.js";
-import "../chunk-C6OV7GCC.js";
-import "../chunk-IWQAX3CS.js";
-import "../chunk-BODMAL6G.js";
+import "../chunk-VRFBB5DB.js";
+import "../chunk-LVUCAWMK.js";
+import "../chunk-OEWZUX4G.js";
+import "../chunk-LB6EBS6Y.js";
+import "../chunk-6CL5HTPQ.js";
 import "../chunk-7VU7V2E4.js";
-import "../chunk-ZLX3KGXX.js";
+import "../chunk-UX7VWA46.js";
 import "../chunk-BPKCU575.js";
-import "../chunk-MZNPGW5Q.js";
+import "../chunk-DRWHTIIZ.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
-import "../chunk-IAXWICZU.js";
+import "../chunk-5ERIZW3D.js";
+import "../chunk-YJVHCHQX.js";
+import "../chunk-23S5OPIO.js";
+import "../chunk-AVYJ4YBN.js";
 import "../chunk-OE6TDIWW.js";
-import "../chunk-DRWHTIIZ.js";
-import "../chunk-IK3KE3AU.js";
+import "../chunk-OPRS4IQZ.js";
+import "../chunk-2JYRIADS.js";
+import "../chunk-DE2SRBFZ.js";
 import "../chunk-ZY6KU6P3.js";
 import "../chunk-JWC6APFQ.js";
-import "../chunk-5ERIZW3D.js";
-import "../chunk-5ENKBSWO.js";
-import "../chunk-HRRYG2AX.js";
-import "../chunk-AVYJ4YBN.js";
 import "../chunk-WLYIIEAF.js";
 import "../chunk-TKJMZBAH.js";
 import "../chunk-3QFXFCHG.js";
-import "../chunk-UHGVBFU3.js";
+import "../chunk-EBLFCNPY.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-XEKD23J5.js";
 import "../chunk-H5JUT3KV.js";
@@ -39,11 +40,12 @@ import "../chunk-IFXJ2BG7.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";
-import "../chunk-5ZQBEOMD.js";
-import "../chunk-MFZ5437A.js";
-import "../chunk-6QZGDLL4.js";
-import "../chunk-D3TDKWRP.js";
+import "../chunk-AT7B7SOZ.js";
+import "../chunk-N5T4M4GU.js";
+import "../chunk-TOVPMMHM.js";
+import "../chunk-SIZQQD6T.js";
 import "../chunk-SYQF7OIR.js";
+import "../chunk-MKF46GNZ.js";
 import "../chunk-CDHS2QDC.js";
 import "../chunk-Y7FO65VT.js";
 import "../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -8,37 +8,39 @@
 
 
 
-var _chunkCGKLE6IWcjs = require('../../chunk-CGKLE6IW.cjs');
+
+var _chunkSQYVORNPcjs = require('../../chunk-SQYVORNP.cjs');
+require('../../chunk-EJLH6NFT.cjs');
 require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-FZ46M34D.cjs');
-require('../../chunk-46ZIFWYG.cjs');
+require('../../chunk-IIRPUVPH.cjs');
+require('../../chunk-GBHYAGX3.cjs');
 require('../../chunk-3OPYJG76.cjs');
-require('../../chunk-ZCIQ3L3R.cjs');
-require('../../chunk-7FEBOPJO.cjs');
-require('../../chunk-DWKQZ2SK.cjs');
-require('../../chunk-4XMYPW46.cjs');
-require('../../chunk-K52THW2C.cjs');
-require('../../chunk-3Q6Z6JTO.cjs');
+require('../../chunk-7AK7B36B.cjs');
+require('../../chunk-V4TXMEJS.cjs');
+require('../../chunk-6VUQPOV3.cjs');
+require('../../chunk-OF3BECU2.cjs');
+require('../../chunk-4VLRHHFE.cjs');
 require('../../chunk-EYZYXJTJ.cjs');
-require('../../chunk-YMFAJFQT.cjs');
+require('../../chunk-DLXZEZWO.cjs');
 require('../../chunk-SNYBEXLB.cjs');
-require('../../chunk-GBHYAGX3.cjs');
+require('../../chunk-R3HK6R4B.cjs');
 require('../../chunk-RPII3E6Z.cjs');
 require('../../chunk-6RPZADX3.cjs');
-require('../../chunk-QWBWGODS.cjs');
+require('../../chunk-NYUNU75A.cjs');
+require('../../chunk-YK57NMIF.cjs');
+require('../../chunk-YNJNTCSQ.cjs');
+require('../../chunk-SVNDB62D.cjs');
 require('../../chunk-UIBD2YY5.cjs');
-require('../../chunk-R3HK6R4B.cjs');
-require('../../chunk-HYN75H6G.cjs');
+require('../../chunk-6QQG7YG3.cjs');
+require('../../chunk-25GXJCEZ.cjs');
+require('../../chunk-MUHWHQVM.cjs');
 require('../../chunk-Q27JY5RG.cjs');
 require('../../chunk-QXD4MV2X.cjs');
-require('../../chunk-NYUNU75A.cjs');
-require('../../chunk-VQY5W4YW.cjs');
-require('../../chunk-KFI44N2R.cjs');
-require('../../chunk-SVNDB62D.cjs');
 require('../../chunk-APYG5QD7.cjs');
 require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-4YINUUKQ.cjs');
-require('../../chunk-VACWOIRE.cjs');
+require('../../chunk-4VZX5F4T.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
 require('../../chunk-4IH4EL7M.cjs');
 require('../../chunk-A2YMUCBT.cjs');
@@ -46,11 +48,12 @@ require('../../chunk-UNWKG6EI.cjs');
 require('../../chunk-FCR77GYM.cjs');
 require('../../chunk-AEOZIDEB.cjs');
 require('../../chunk-XSVNC2UD.cjs');
-require('../../chunk-SUEGJ75D.cjs');
-require('../../chunk-DDMRUL76.cjs');
-require('../../chunk-JWVTXXPX.cjs');
-require('../../chunk-PG7PS2NN.cjs');
+require('../../chunk-WYTEQ4Q5.cjs');
+require('../../chunk-OKMJLEXX.cjs');
+require('../../chunk-KBM2W6UY.cjs');
+require('../../chunk-KCVJWJST.cjs');
 require('../../chunk-3Z5BQZFM.cjs');
+require('../../chunk-HVBBDBS3.cjs');
 require('../../chunk-NZYN7C3P.cjs');
 require('../../chunk-JMJBSACD.cjs');
 require('../../chunk-GMMT7RVN.cjs');
@@ -65,4 +68,5 @@ require('../../chunk-UNEFIWXI.cjs');
 
 
 
-exports.aggregateAnthropicSseToJsonBody = _chunkCGKLE6IWcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunkCGKLE6IWcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkCGKLE6IWcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkCGKLE6IWcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkCGKLE6IWcjs.getSharedExecutor; exports.readBody = _chunkCGKLE6IWcjs.readBody; exports.relayResponse = _chunkCGKLE6IWcjs.relayResponse; exports.resolvePoolBoundKey = _chunkCGKLE6IWcjs.resolvePoolBoundKey; exports.writeError = _chunkCGKLE6IWcjs.writeError;
+
+exports.aggregateAnthropicSseToJsonBody = _chunkSQYVORNPcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunkSQYVORNPcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkSQYVORNPcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkSQYVORNPcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkSQYVORNPcjs.getSharedExecutor; exports.readBody = _chunkSQYVORNPcjs.readBody; exports.relayResponse = _chunkSQYVORNPcjs.relayResponse; exports.resolvePoolBoundKey = _chunkSQYVORNPcjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunkSQYVORNPcjs.writeBoundAccountError; exports.writeError = _chunkSQYVORNPcjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.cjs';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.cjs';
 import { Transformer } from '../../transformer/types.cjs';
 import { ProviderProxyDeps } from '../types.cjs';
@@ -37,6 +38,28 @@ declare function getAnthropicEndpointTransformer(): Transformer;
 declare function getGeminiEndpointTransformer(): Transformer;
 /** Read the full request body from an IncomingMessage. */
 declare function readBody(req: http.IncomingMessage): Promise<string>;
+/**
+ * A usage tap for {@link relayResponse}'s stream branch. Streaming responses were
+ * previously not metered (only the non-stream branch recorded usage), so Codex
+ * — which always streams — produced zero usage/dashboard rows. The tap lets each
+ * ingress extract the RAW provider usage object from the SSE events it already
+ * knows, and {@link onUsage} fires once at stream end so the recorder charges
+ * exactly one event per request. Returning the raw object (not normalized)
+ * keeps this tap endpoint-agnostic; each recorder normalizes its own shape.
+ */
+interface StreamUsageTap {
+    /**
+     * Inspect one parsed SSE `data:` JSON event. Return the raw provider usage
+     * object it carries (else null/undefined). The LAST non-null return across
+     * the whole stream is what {@link onUsage} receives — so for endpoints whose
+     * usage arrives piecewise (e.g. Anthropic `message_start`+`message_delta`),
+     * merge inside this closure and return the combined value from the terminal
+     * event.
+     */
+    extractUsage(event: Record<string, unknown>): Record<string, unknown> | null | undefined;
+    /** Called once at stream end with the last captured usage (only if any). */
+    onUsage(rawUsage: Record<string, unknown>): void;
+}
 /**
  * Relay an already-wire-shaped `Response` to the http `res`.
  * - `text/event-stream` (or `isStream`): pipe the ReadableStream chunk-by-chunk.
@@ -54,7 +77,7 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.
@@ -73,13 +96,19 @@ declare function relayResponse(res: http.ServerResponse, providerResponse: Respo
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string): Promise<string>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
+/**
+ * Map a strict bound-account failure to a stable structured response. The body
+ * carries only the fixed code/reason/message; account ids, tokens, and upstream
+ * error text never cross the wire.
+ */
+declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAccountSelectionError): void;
 /**
  * Resolve the FIRST-CHOICE BYO request key for a `buildByoPlan`, threading the
  * ApiKeyPool through TWO gates so 429/529/401/403 failover actually fires on the
  * outbound serving path (omnicross-daemon-parity-poolseam, design D2(b)).
  *
- * MIRRORS the host engine adapter's `resolveApiKeyForProvider` (the reference impl whose
- * pool failover already works internally):
+ * Matches the host engine adapter's `resolveApiKeyForProvider` contract so pool
+ * failover remains inside the provider layer:
  *   - pool present AND a (synthesized outbound) sessionId present →
  *     `getKeyForSession(providerId, sessionId)`. This SEEDS `sessionBindings`
  *     with the chosen key AND returns that same key, so it becomes the first
@@ -101,6 +130,6 @@ declare function writeError(res: http.ServerResponse, status: number, message: s
  * already-`resolveKey`-resolved string (its loader passes the host resolver),
  * so the pool branch needs no further `$ENV` expansion.
  */
-declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null): Promise<string>;
+declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
 
-export { aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeError };
+export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.js';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.js';
 import { Transformer } from '../../transformer/types.js';
 import { ProviderProxyDeps } from '../types.js';
@@ -37,6 +38,28 @@ declare function getAnthropicEndpointTransformer(): Transformer;
 declare function getGeminiEndpointTransformer(): Transformer;
 /** Read the full request body from an IncomingMessage. */
 declare function readBody(req: http.IncomingMessage): Promise<string>;
+/**
+ * A usage tap for {@link relayResponse}'s stream branch. Streaming responses were
+ * previously not metered (only the non-stream branch recorded usage), so Codex
+ * — which always streams — produced zero usage/dashboard rows. The tap lets each
+ * ingress extract the RAW provider usage object from the SSE events it already
+ * knows, and {@link onUsage} fires once at stream end so the recorder charges
+ * exactly one event per request. Returning the raw object (not normalized)
+ * keeps this tap endpoint-agnostic; each recorder normalizes its own shape.
+ */
+interface StreamUsageTap {
+    /**
+     * Inspect one parsed SSE `data:` JSON event. Return the raw provider usage
+     * object it carries (else null/undefined). The LAST non-null return across
+     * the whole stream is what {@link onUsage} receives — so for endpoints whose
+     * usage arrives piecewise (e.g. Anthropic `message_start`+`message_delta`),
+     * merge inside this closure and return the combined value from the terminal
+     * event.
+     */
+    extractUsage(event: Record<string, unknown>): Record<string, unknown> | null | undefined;
+    /** Called once at stream end with the last captured usage (only if any). */
+    onUsage(rawUsage: Record<string, unknown>): void;
+}
 /**
  * Relay an already-wire-shaped `Response` to the http `res`.
  * - `text/event-stream` (or `isStream`): pipe the ReadableStream chunk-by-chunk.
@@ -54,7 +77,7 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.
@@ -73,13 +96,19 @@ declare function relayResponse(res: http.ServerResponse, providerResponse: Respo
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string): Promise<string>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
+/**
+ * Map a strict bound-account failure to a stable structured response. The body
+ * carries only the fixed code/reason/message; account ids, tokens, and upstream
+ * error text never cross the wire.
+ */
+declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAccountSelectionError): void;
 /**
  * Resolve the FIRST-CHOICE BYO request key for a `buildByoPlan`, threading the
  * ApiKeyPool through TWO gates so 429/529/401/403 failover actually fires on the
  * outbound serving path (omnicross-daemon-parity-poolseam, design D2(b)).
  *
- * MIRRORS the host engine adapter's `resolveApiKeyForProvider` (the reference impl whose
- * pool failover already works internally):
+ * Matches the host engine adapter's `resolveApiKeyForProvider` contract so pool
+ * failover remains inside the provider layer:
  *   - pool present AND a (synthesized outbound) sessionId present →
  *     `getKeyForSession(providerId, sessionId)`. This SEEDS `sessionBindings`
  *     with the chosen key AND returns that same key, so it becomes the first
@@ -101,6 +130,6 @@ declare function writeError(res: http.ServerResponse, status: number, message: s
  * already-`resolveKey`-resolved string (its loader passes the host resolver),
  * so the pool branch needs no further `$ENV` expansion.
  */
-declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null): Promise<string>;
+declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
 
-export { aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeError };
+export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };

package/dist/provider-proxy/ingress/providerProxyShared.js

@@ -7,38 +7,40 @@ import {
   readBody,
   relayResponse,
   resolvePoolBoundKey,
+  writeBoundAccountError,
   writeError
-} from "../../chunk-FH2P4OCD.js";
+} from "../../chunk-UDCC7EMR.js";
+import "../../chunk-WB6PH56J.js";
 import "../../chunk-VVEHS2LI.js";
 import "../../chunk-46RLHI7D.js";
-import "../../chunk-G2UTNSGU.js";
+import "../../chunk-WNKWAEUR.js";
+import "../../chunk-MZNPGW5Q.js";
 import "../../chunk-DK4A7DLE.js";
-import "../../chunk-OQWKZCXP.js";
-import "../../chunk-IB3FDI4O.js";
-import "../../chunk-ZJZAOKI7.js";
-import "../../chunk-C6OV7GCC.js";
-import "../../chunk-IWQAX3CS.js";
-import "../../chunk-BODMAL6G.js";
+import "../../chunk-VRFBB5DB.js";
+import "../../chunk-LVUCAWMK.js";
+import "../../chunk-OEWZUX4G.js";
+import "../../chunk-LB6EBS6Y.js";
+import "../../chunk-6CL5HTPQ.js";
 import "../../chunk-7VU7V2E4.js";
-import "../../chunk-ZLX3KGXX.js";
+import "../../chunk-UX7VWA46.js";
 import "../../chunk-BPKCU575.js";
-import "../../chunk-MZNPGW5Q.js";
+import "../../chunk-DRWHTIIZ.js";
 import "../../chunk-XTEI64OU.js";
 import "../../chunk-XX6NQJMA.js";
-import "../../chunk-IAXWICZU.js";
+import "../../chunk-5ERIZW3D.js";
+import "../../chunk-YJVHCHQX.js";
+import "../../chunk-23S5OPIO.js";
+import "../../chunk-AVYJ4YBN.js";
 import "../../chunk-OE6TDIWW.js";
-import "../../chunk-DRWHTIIZ.js";
-import "../../chunk-IK3KE3AU.js";
+import "../../chunk-OPRS4IQZ.js";
+import "../../chunk-2JYRIADS.js";
+import "../../chunk-DE2SRBFZ.js";
 import "../../chunk-ZY6KU6P3.js";
 import "../../chunk-JWC6APFQ.js";
-import "../../chunk-5ERIZW3D.js";
-import "../../chunk-5ENKBSWO.js";
-import "../../chunk-HRRYG2AX.js";
-import "../../chunk-AVYJ4YBN.js";
 import "../../chunk-WLYIIEAF.js";
 import "../../chunk-TKJMZBAH.js";
 import "../../chunk-3QFXFCHG.js";
-import "../../chunk-UHGVBFU3.js";
+import "../../chunk-EBLFCNPY.js";
 import "../../chunk-AQ5TNQB7.js";
 import "../../chunk-XEKD23J5.js";
 import "../../chunk-H5JUT3KV.js";
@@ -46,11 +48,12 @@ import "../../chunk-IFXJ2BG7.js";
 import "../../chunk-K5NM7VAH.js";
 import "../../chunk-WNY4WMRF.js";
 import "../../chunk-OZFM4X3S.js";
-import "../../chunk-5ZQBEOMD.js";
-import "../../chunk-MFZ5437A.js";
-import "../../chunk-6QZGDLL4.js";
-import "../../chunk-D3TDKWRP.js";
+import "../../chunk-AT7B7SOZ.js";
+import "../../chunk-N5T4M4GU.js";
+import "../../chunk-TOVPMMHM.js";
+import "../../chunk-SIZQQD6T.js";
 import "../../chunk-SYQF7OIR.js";
+import "../../chunk-MKF46GNZ.js";
 import "../../chunk-CDHS2QDC.js";
 import "../../chunk-Y7FO65VT.js";
 import "../../chunk-FMOBD2OQ.js";
@@ -64,5 +67,6 @@ export {
   readBody,
   relayResponse,
   resolvePoolBoundKey,
+  writeBoundAccountError,
   writeError
 };

package/dist/provider-proxy/matchText.cjs

@@ -4,11 +4,13 @@
 
 
 
-var _chunkQWBWGODScjs = require('../chunk-QWBWGODS.cjs');
 
+var _chunkEJLH6NFTcjs = require('../chunk-EJLH6NFT.cjs');
 
 
 
 
 
-exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkQWBWGODScjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkQWBWGODScjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkQWBWGODScjs.collectMatchText; exports.deriveSubscriptionSessionKey = _chunkQWBWGODScjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkQWBWGODScjs.flattenMatchText;
+
+
+exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkEJLH6NFTcjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkEJLH6NFTcjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkEJLH6NFTcjs.collectMatchText; exports.deriveGatewaySessionKey = _chunkEJLH6NFTcjs.deriveGatewaySessionKey; exports.deriveSubscriptionSessionKey = _chunkEJLH6NFTcjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkEJLH6NFTcjs.flattenMatchText;

package/dist/provider-proxy/matchText.d.cts

@@ -34,11 +34,10 @@ declare const MATCH_TEXT_RECENT_MESSAGES = 6;
 declare function flattenMatchText(value: unknown): string;
 /**
  * Build the BOUNDED match-text slice: the `system` prompt plus the most recent
- * `user`/`system` messages, each truncated to a per-message char cap (design.md
- * §2 — mirrors the reference `DetectScenario` role filter, bounded so matching
- * cost is independent of conversation length). Assistant turns are excluded (the
- * §3 common-denominator decision; same safe direction as the reference for the
- * background tool-blocker pre-scan). System prompt is emitted first.
+ * `user`/`system` messages, each truncated to a per-message char cap so matching
+ * cost is independent of conversation length. Assistant turns are excluded to
+ * keep routing based on instructions rather than generated text. System prompt
+ * is emitted first.
  *
  * @param anthropicBody the parsed Anthropic Messages request body.
  */
@@ -56,5 +55,41 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
+/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
+ *  session-affinity bucket key (NOT a security primitive). */
+/**
+ * Source used to derive a gateway session-affinity key. The value is kept
+ * deliberately small and non-sensitive: callers only receive the hashed key,
+ * while the source is useful to tests/diagnostics without exposing the raw
+ * session id.
+ */
+type SessionKeySource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback';
+/** A hashed session key and the extraction path that produced it. */
+interface DerivedSessionKey {
+    readonly key: string;
+    readonly source: SessionKeySource;
+}
+/** Options for {@link deriveGatewaySessionKey}. */
+interface GatewaySessionKeyOptions {
+    /** A stable route/key seed used when the request has no conversation id. */
+    readonly fallbackKey?: string;
+    /** Namespaces the conservative fallback (normally `responses`). */
+    readonly endpoint?: string;
+}
+/** Header bag accepted by Node's IncomingHttpHeaders and browser-style tests. */
+type SessionRequestHeaders = Record<string, string | string[] | undefined>;
+/**
+ * Derive one stable account-pool affinity key for a gateway request.
+ *
+ * Codex/Responses sends the same conversation id in a few wire-compatible
+ * locations depending on the client version. Prefer those explicit ids in a
+ * deterministic order, then fall back to a bounded content fingerprint made
+ * from stable developer/system instructions and the first user input. The
+ * final fallback is route-scoped (api key/session + endpoint) so a request
+ * with no usable metadata remains conservative and does not rotate accounts
+ * on every turn. Raw ids and prompts are never returned or logged; only their
+ * FNV-1a digest is exposed as `key`.
+ */
+declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;
 
-export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, deriveSubscriptionSessionKey, flattenMatchText };
+export { type DerivedSessionKey, type GatewaySessionKeyOptions, MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, type SessionKeySource, type SessionRequestHeaders, collectMatchText, deriveGatewaySessionKey, deriveSubscriptionSessionKey, flattenMatchText };

package/dist/provider-proxy/matchText.d.ts

@@ -34,11 +34,10 @@ declare const MATCH_TEXT_RECENT_MESSAGES = 6;
 declare function flattenMatchText(value: unknown): string;
 /**
  * Build the BOUNDED match-text slice: the `system` prompt plus the most recent
- * `user`/`system` messages, each truncated to a per-message char cap (design.md
- * §2 — mirrors the reference `DetectScenario` role filter, bounded so matching
- * cost is independent of conversation length). Assistant turns are excluded (the
- * §3 common-denominator decision; same safe direction as the reference for the
- * background tool-blocker pre-scan). System prompt is emitted first.
+ * `user`/`system` messages, each truncated to a per-message char cap so matching
+ * cost is independent of conversation length. Assistant turns are excluded to
+ * keep routing based on instructions rather than generated text. System prompt
+ * is emitted first.
  *
  * @param anthropicBody the parsed Anthropic Messages request body.
  */
@@ -56,5 +55,41 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
+/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
+ *  session-affinity bucket key (NOT a security primitive). */
+/**
+ * Source used to derive a gateway session-affinity key. The value is kept
+ * deliberately small and non-sensitive: callers only receive the hashed key,
+ * while the source is useful to tests/diagnostics without exposing the raw
+ * session id.
+ */
+type SessionKeySource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback';
+/** A hashed session key and the extraction path that produced it. */
+interface DerivedSessionKey {
+    readonly key: string;
+    readonly source: SessionKeySource;
+}
+/** Options for {@link deriveGatewaySessionKey}. */
+interface GatewaySessionKeyOptions {
+    /** A stable route/key seed used when the request has no conversation id. */
+    readonly fallbackKey?: string;
+    /** Namespaces the conservative fallback (normally `responses`). */
+    readonly endpoint?: string;
+}
+/** Header bag accepted by Node's IncomingHttpHeaders and browser-style tests. */
+type SessionRequestHeaders = Record<string, string | string[] | undefined>;
+/**
+ * Derive one stable account-pool affinity key for a gateway request.
+ *
+ * Codex/Responses sends the same conversation id in a few wire-compatible
+ * locations depending on the client version. Prefer those explicit ids in a
+ * deterministic order, then fall back to a bounded content fingerprint made
+ * from stable developer/system instructions and the first user input. The
+ * final fallback is route-scoped (api key/session + endpoint) so a request
+ * with no usable metadata remains conservative and does not rotate accounts
+ * on every turn. Raw ids and prompts are never returned or logged; only their
+ * FNV-1a digest is exposed as `key`.
+ */
+declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;
 
-export { MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, collectMatchText, deriveSubscriptionSessionKey, flattenMatchText };
+export { type DerivedSessionKey, type GatewaySessionKeyOptions, MATCH_TEXT_PER_MESSAGE_CAP, MATCH_TEXT_RECENT_MESSAGES, type SessionKeySource, type SessionRequestHeaders, collectMatchText, deriveGatewaySessionKey, deriveSubscriptionSessionKey, flattenMatchText };

package/dist/provider-proxy/matchText.js

@@ -2,13 +2,15 @@ import {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,
   collectMatchText,
+  deriveGatewaySessionKey,
   deriveSubscriptionSessionKey,
   flattenMatchText
-} from "../chunk-IAXWICZU.js";
+} from "../chunk-WB6PH56J.js";
 export {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,
   collectMatchText,
+  deriveGatewaySessionKey,
   deriveSubscriptionSessionKey,
   flattenMatchText
 };

package/dist/provider-proxy/types.d.cts

@@ -4,6 +4,7 @@ import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, Open
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
 import { AuthSource } from '../pipeline/AuthSource.cjs';
+import { BoundAccountFallbackPolicy } from '../pipeline/BoundAccountSelectionError.cjs';
 import { SubscriptionAuthProfile } from '../pipeline/SubscriptionAuthSource.cjs';
 import { AuthStrategy } from '../pipeline/SubscriptionAuthStrategy.cjs';
 import { ProviderConfigSource } from '../ports/provider-config-source.cjs';
@@ -161,6 +162,15 @@ interface AnthropicRouteHandlerParams {
     /** Lazy per-request resolver for the pass-through Bearer (takes precedence over the static one). */
     readonly resolvePassThroughAuthToken?: (() => Promise<string | null>) | null;
     readonly subscriptionProfile?: SubscriptionDispatchProfile | null;
+    /** Bound subscription account forwarded to the host's Anthropic handler. */
+    readonly preferredAccountId?: string;
+    readonly preferredAccountGroup?: string;
+    /** Strict by default; pool fallback is an explicit endpoint opt-in. */
+    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /** Preferred provider-pool key selected by a resource-level binding. */
+    readonly preferredKeyId?: string;
+    /** Strict by default; pool fallback is an explicit binding opt-in. */
+    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     readonly maxConcurrency?: number;
     /** Instance-level web-search backend; falls back to the proxy-global one. */
     readonly webSearchService?: WebSearchBackend | null;
@@ -249,6 +259,15 @@ interface AnthropicSdkHints {
     readonly extendedContext?: ExtendedContextHint | null;
     /** Subscription dispatch profile (Codex/Gemini/OpenCodeGo over the SDK wire). */
     readonly subscriptionProfile?: SubscriptionDispatchProfile | null;
+    /** Bound subscription account for the delegated Anthropic path. */
+    readonly preferredAccountId?: string;
+    readonly preferredAccountGroup?: string;
+    /** Strict by default; pool fallback is an explicit endpoint opt-in. */
+    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /** Preferred provider-pool key for a delegated BYO Anthropic route. */
+    readonly preferredKeyId?: string;
+    /** Strict by default; pool fallback is an explicit binding opt-in. */
+    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /** Per-request max-concurrency cap for the error-handler semaphore. */
     readonly maxConcurrency?: number;
     /** Instance-level web-search backend (falls back to the proxy-global one). */
@@ -338,10 +357,19 @@ interface RouteContext {
     /**
      * Per-request preferred subscription account id (provider/subscription
      * duality). Stamped by the outbound `resolveRoute` from
-     * `EndpointRoutingConfig.boundAccountId`; the account picker prefers it when
-     * schedulable (else falls back to the pool). Undefined ⇒ pool auto-schedule.
+     * `EndpointRoutingConfig.boundAccountId`; strict bindings fail when this
+     * account cannot serve. The pool is used only when the route carries the
+     * explicit `'pool'` fallback policy. Undefined ⇒ pool auto-schedule.
      */
     readonly preferredAccountId?: string;
+    /** Account-group binding projected by the outbound gateway. */
+    readonly preferredAccountGroup?: string;
+    /** Bound-account behavior; `'pool'` is the explicit fallback opt-in. */
+    readonly boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /** Optional provider key selected by a resource-level gateway binding. */
+    readonly preferredKeyId?: string;
+    /** Strict by default; `'pool'` permits normal provider key selection. */
+    readonly boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /**
      * OPAQUE per-account subscription config (opencodego-only). Populated by the
      * route resolver from the subscription registry's `getOpenCodeGoConfig()`