@omnicross/core 0.1.5 → 0.1.7

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,49 +1,55 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkCGKLE6IWcjs = require('../chunk-CGKLE6IW.cjs');
+var _chunk4BB343BIcjs = require('../chunk-4BB343BI.cjs');
 require('../chunk-HQP3K7PU.cjs');
 require('../chunk-FZ46M34D.cjs');
-require('../chunk-46ZIFWYG.cjs');
-require('../chunk-3OPYJG76.cjs');
-require('../chunk-ZCIQ3L3R.cjs');
-require('../chunk-7FEBOPJO.cjs');
-require('../chunk-DWKQZ2SK.cjs');
-require('../chunk-4XMYPW46.cjs');
-require('../chunk-K52THW2C.cjs');
-require('../chunk-3Q6Z6JTO.cjs');
+require('../chunk-2Z4XM3H5.cjs');
+require('../chunk-OXHNSZ53.cjs');
+require('../chunk-V4TXMEJS.cjs');
+require('../chunk-OVQBNVSV.cjs');
+require('../chunk-5RSZYQJH.cjs');
+require('../chunk-OF3BECU2.cjs');
 require('../chunk-EYZYXJTJ.cjs');
-require('../chunk-YMFAJFQT.cjs');
-require('../chunk-SNYBEXLB.cjs');
+require('../chunk-2E42SAW3.cjs');
+require('../chunk-OJGQKHN5.cjs');
+require('../chunk-IIRPUVPH.cjs');
 require('../chunk-GBHYAGX3.cjs');
+require('../chunk-3OPYJG76.cjs');
+require('../chunk-3SCOLIPT.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
-require('../chunk-QWBWGODS.cjs');
+require('../chunk-J3QQ6JS5.cjs');
 require('../chunk-UIBD2YY5.cjs');
 require('../chunk-R3HK6R4B.cjs');
-require('../chunk-HYN75H6G.cjs');
-require('../chunk-Q27JY5RG.cjs');
 require('../chunk-QXD4MV2X.cjs');
 require('../chunk-NYUNU75A.cjs');
-require('../chunk-VQY5W4YW.cjs');
-require('../chunk-KFI44N2R.cjs');
+require('../chunk-OTZC4TNH.cjs');
+require('../chunk-YWL7YZWS.cjs');
+require('../chunk-YNJNTCSQ.cjs');
 require('../chunk-SVNDB62D.cjs');
+require('../chunk-6QQG7YG3.cjs');
+require('../chunk-25GXJCEZ.cjs');
+require('../chunk-MUHWHQVM.cjs');
+require('../chunk-Q27JY5RG.cjs');
 require('../chunk-APYG5QD7.cjs');
 require('../chunk-L74VDN4A.cjs');
 require('../chunk-4YINUUKQ.cjs');
-require('../chunk-VACWOIRE.cjs');
+require('../chunk-4VZX5F4T.cjs');
 require('../chunk-QBZJ7P2T.cjs');
 require('../chunk-4IH4EL7M.cjs');
 require('../chunk-A2YMUCBT.cjs');
-require('../chunk-UNWKG6EI.cjs');
+require('../chunk-XPIOJQS2.cjs');
 require('../chunk-FCR77GYM.cjs');
 require('../chunk-AEOZIDEB.cjs');
 require('../chunk-XSVNC2UD.cjs');
-require('../chunk-SUEGJ75D.cjs');
-require('../chunk-DDMRUL76.cjs');
-require('../chunk-JWVTXXPX.cjs');
-require('../chunk-PG7PS2NN.cjs');
-require('../chunk-3Z5BQZFM.cjs');
+require('../chunk-GDIXXKF2.cjs');
+require('../chunk-OKMJLEXX.cjs');
+require('../chunk-KBM2W6UY.cjs');
+require('../chunk-RJUONLUQ.cjs');
+require('../chunk-235MXAGX.cjs');
+require('../chunk-HVBBDBS3.cjs');
+require('../chunk-NKVZ6Z3Y.cjs');
 require('../chunk-NZYN7C3P.cjs');
 require('../chunk-JMJBSACD.cjs');
 require('../chunk-GMMT7RVN.cjs');
@@ -51,4 +57,4 @@ require('../chunk-UNEFIWXI.cjs');
 
 
 
-exports.ProviderProxy = _chunkCGKLE6IWcjs.ProviderProxy; exports.isLoopbackAddress = _chunkCGKLE6IWcjs.isLoopbackAddress;
+exports.ProviderProxy = _chunk4BB343BIcjs.ProviderProxy; exports.isLoopbackAddress = _chunk4BB343BIcjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.d.cts

@@ -2,12 +2,14 @@ export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-CnM
 import './types.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';
 import '@omnicross/contracts/llm-config';
 import '../logger-4GvQNzhE.cjs';
 import '../pipeline/AuthSource.cjs';
+import '../pipeline/BoundAccountSelectionError.cjs';
 import '../pipeline/SubscriptionAuthSource.cjs';
 import '../pipeline/SubscriptionAuthStrategy.cjs';
 import '../ports/provider-config-source.cjs';

package/dist/provider-proxy/ProviderProxy.d.ts

@@ -2,12 +2,14 @@ export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-C-x
 import './types.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.js';
 import '@omnicross/contracts/llm-config';
 import '../logger-4GvQNzhE.js';
 import '../pipeline/AuthSource.js';
+import '../pipeline/BoundAccountSelectionError.js';
 import '../pipeline/SubscriptionAuthSource.js';
 import '../pipeline/SubscriptionAuthStrategy.js';
 import '../ports/provider-config-source.js';

package/dist/provider-proxy/ProviderProxy.js

@@ -1,49 +1,55 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-FH2P4OCD.js";
+} from "../chunk-E3COOKUP.js";
 import "../chunk-VVEHS2LI.js";
 import "../chunk-46RLHI7D.js";
-import "../chunk-G2UTNSGU.js";
-import "../chunk-DK4A7DLE.js";
-import "../chunk-OQWKZCXP.js";
-import "../chunk-IB3FDI4O.js";
-import "../chunk-ZJZAOKI7.js";
-import "../chunk-C6OV7GCC.js";
-import "../chunk-IWQAX3CS.js";
-import "../chunk-BODMAL6G.js";
+import "../chunk-MYYR3HZL.js";
+import "../chunk-PEGTIPB3.js";
+import "../chunk-LVUCAWMK.js";
+import "../chunk-32O35CIF.js";
+import "../chunk-FU7EAR73.js";
+import "../chunk-LB6EBS6Y.js";
 import "../chunk-7VU7V2E4.js";
-import "../chunk-ZLX3KGXX.js";
-import "../chunk-BPKCU575.js";
+import "../chunk-FXR6N3SR.js";
+import "../chunk-SOO562NM.js";
+import "../chunk-WNKWAEUR.js";
 import "../chunk-MZNPGW5Q.js";
+import "../chunk-DK4A7DLE.js";
+import "../chunk-XXFYLL7R.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
-import "../chunk-IAXWICZU.js";
+import "../chunk-GFIZ6LQI.js";
 import "../chunk-OE6TDIWW.js";
 import "../chunk-DRWHTIIZ.js";
-import "../chunk-IK3KE3AU.js";
-import "../chunk-ZY6KU6P3.js";
 import "../chunk-JWC6APFQ.js";
 import "../chunk-5ERIZW3D.js";
-import "../chunk-5ENKBSWO.js";
-import "../chunk-HRRYG2AX.js";
+import "../chunk-PO3XB56Z.js";
+import "../chunk-N7OOJI5V.js";
+import "../chunk-23S5OPIO.js";
 import "../chunk-AVYJ4YBN.js";
+import "../chunk-OPRS4IQZ.js";
+import "../chunk-2JYRIADS.js";
+import "../chunk-DE2SRBFZ.js";
+import "../chunk-ZY6KU6P3.js";
 import "../chunk-WLYIIEAF.js";
 import "../chunk-TKJMZBAH.js";
 import "../chunk-3QFXFCHG.js";
-import "../chunk-UHGVBFU3.js";
+import "../chunk-EBLFCNPY.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-XEKD23J5.js";
 import "../chunk-H5JUT3KV.js";
-import "../chunk-IFXJ2BG7.js";
+import "../chunk-7C7DET6S.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";
-import "../chunk-5ZQBEOMD.js";
-import "../chunk-MFZ5437A.js";
-import "../chunk-6QZGDLL4.js";
-import "../chunk-D3TDKWRP.js";
-import "../chunk-SYQF7OIR.js";
+import "../chunk-5NJLQ6T6.js";
+import "../chunk-N5T4M4GU.js";
+import "../chunk-TOVPMMHM.js";
+import "../chunk-RJ5ZGNI3.js";
+import "../chunk-3WD4HTR2.js";
+import "../chunk-MKF46GNZ.js";
+import "../chunk-GL6XM527.js";
 import "../chunk-CDHS2QDC.js";
 import "../chunk-Y7FO65VT.js";
 import "../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/identity/codexCliHeaders.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk3SCOLIPTcjs = require('../../chunk-3SCOLIPT.cjs');
+
+
+
+
+exports.DEFAULT_CODEX_CLI_HEADERS = _chunk3SCOLIPTcjs.DEFAULT_CODEX_CLI_HEADERS; exports.codexAcceptHeader = _chunk3SCOLIPTcjs.codexAcceptHeader; exports.extractCodexClientHeaders = _chunk3SCOLIPTcjs.extractCodexClientHeaders;

package/dist/provider-proxy/identity/codexCliHeaders.d.cts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.d.ts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.js

@@ -0,0 +1,10 @@
+import {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+} from "../../chunk-XXFYLL7R.js";
+export {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+};

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -8,49 +8,56 @@
 
 
 
-var _chunkCGKLE6IWcjs = require('../../chunk-CGKLE6IW.cjs');
+
+var _chunk4BB343BIcjs = require('../../chunk-4BB343BI.cjs');
 require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-FZ46M34D.cjs');
-require('../../chunk-46ZIFWYG.cjs');
-require('../../chunk-3OPYJG76.cjs');
-require('../../chunk-ZCIQ3L3R.cjs');
-require('../../chunk-7FEBOPJO.cjs');
-require('../../chunk-DWKQZ2SK.cjs');
-require('../../chunk-4XMYPW46.cjs');
-require('../../chunk-K52THW2C.cjs');
-require('../../chunk-3Q6Z6JTO.cjs');
+require('../../chunk-2Z4XM3H5.cjs');
+require('../../chunk-OXHNSZ53.cjs');
+require('../../chunk-V4TXMEJS.cjs');
+require('../../chunk-OVQBNVSV.cjs');
+require('../../chunk-5RSZYQJH.cjs');
+require('../../chunk-OF3BECU2.cjs');
 require('../../chunk-EYZYXJTJ.cjs');
-require('../../chunk-YMFAJFQT.cjs');
-require('../../chunk-SNYBEXLB.cjs');
+require('../../chunk-2E42SAW3.cjs');
+require('../../chunk-OJGQKHN5.cjs');
+require('../../chunk-IIRPUVPH.cjs');
 require('../../chunk-GBHYAGX3.cjs');
+require('../../chunk-3OPYJG76.cjs');
+require('../../chunk-3SCOLIPT.cjs');
 require('../../chunk-RPII3E6Z.cjs');
 require('../../chunk-6RPZADX3.cjs');
-require('../../chunk-QWBWGODS.cjs');
+require('../../chunk-J3QQ6JS5.cjs');
 require('../../chunk-UIBD2YY5.cjs');
 require('../../chunk-R3HK6R4B.cjs');
-require('../../chunk-HYN75H6G.cjs');
-require('../../chunk-Q27JY5RG.cjs');
 require('../../chunk-QXD4MV2X.cjs');
 require('../../chunk-NYUNU75A.cjs');
-require('../../chunk-VQY5W4YW.cjs');
-require('../../chunk-KFI44N2R.cjs');
+require('../../chunk-OTZC4TNH.cjs');
+require('../../chunk-YWL7YZWS.cjs');
+require('../../chunk-YNJNTCSQ.cjs');
 require('../../chunk-SVNDB62D.cjs');
+require('../../chunk-6QQG7YG3.cjs');
+require('../../chunk-25GXJCEZ.cjs');
+require('../../chunk-MUHWHQVM.cjs');
+require('../../chunk-Q27JY5RG.cjs');
 require('../../chunk-APYG5QD7.cjs');
 require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-4YINUUKQ.cjs');
-require('../../chunk-VACWOIRE.cjs');
+require('../../chunk-4VZX5F4T.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
 require('../../chunk-4IH4EL7M.cjs');
 require('../../chunk-A2YMUCBT.cjs');
-require('../../chunk-UNWKG6EI.cjs');
+require('../../chunk-XPIOJQS2.cjs');
 require('../../chunk-FCR77GYM.cjs');
 require('../../chunk-AEOZIDEB.cjs');
 require('../../chunk-XSVNC2UD.cjs');
-require('../../chunk-SUEGJ75D.cjs');
-require('../../chunk-DDMRUL76.cjs');
-require('../../chunk-JWVTXXPX.cjs');
-require('../../chunk-PG7PS2NN.cjs');
-require('../../chunk-3Z5BQZFM.cjs');
+require('../../chunk-GDIXXKF2.cjs');
+require('../../chunk-OKMJLEXX.cjs');
+require('../../chunk-KBM2W6UY.cjs');
+require('../../chunk-RJUONLUQ.cjs');
+require('../../chunk-235MXAGX.cjs');
+require('../../chunk-HVBBDBS3.cjs');
+require('../../chunk-NKVZ6Z3Y.cjs');
 require('../../chunk-NZYN7C3P.cjs');
 require('../../chunk-JMJBSACD.cjs');
 require('../../chunk-GMMT7RVN.cjs');
@@ -65,4 +72,5 @@ require('../../chunk-UNEFIWXI.cjs');
 
 
 
-exports.aggregateAnthropicSseToJsonBody = _chunkCGKLE6IWcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunkCGKLE6IWcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkCGKLE6IWcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkCGKLE6IWcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkCGKLE6IWcjs.getSharedExecutor; exports.readBody = _chunkCGKLE6IWcjs.readBody; exports.relayResponse = _chunkCGKLE6IWcjs.relayResponse; exports.resolvePoolBoundKey = _chunkCGKLE6IWcjs.resolvePoolBoundKey; exports.writeError = _chunkCGKLE6IWcjs.writeError;
+
+exports.aggregateAnthropicSseToJsonBody = _chunk4BB343BIcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunk4BB343BIcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunk4BB343BIcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunk4BB343BIcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunk4BB343BIcjs.getSharedExecutor; exports.readBody = _chunk4BB343BIcjs.readBody; exports.relayResponse = _chunk4BB343BIcjs.relayResponse; exports.resolvePoolBoundKey = _chunk4BB343BIcjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunk4BB343BIcjs.writeBoundAccountError; exports.writeError = _chunk4BB343BIcjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -1,9 +1,11 @@
 import http from 'node:http';
 import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.cjs';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.cjs';
 import { Transformer } from '../../transformer/types.cjs';
 import { ProviderProxyDeps } from '../types.cjs';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.cjs';
@@ -37,6 +39,28 @@ declare function getAnthropicEndpointTransformer(): Transformer;
 declare function getGeminiEndpointTransformer(): Transformer;
 /** Read the full request body from an IncomingMessage. */
 declare function readBody(req: http.IncomingMessage): Promise<string>;
+/**
+ * A usage tap for {@link relayResponse}'s stream branch. Streaming responses were
+ * previously not metered (only the non-stream branch recorded usage), so Codex
+ * — which always streams — produced zero usage/dashboard rows. The tap lets each
+ * ingress extract the RAW provider usage object from the SSE events it already
+ * knows, and {@link onUsage} fires once at stream end so the recorder charges
+ * exactly one event per request. Returning the raw object (not normalized)
+ * keeps this tap endpoint-agnostic; each recorder normalizes its own shape.
+ */
+interface StreamUsageTap {
+    /**
+     * Inspect one parsed SSE `data:` JSON event. Return the raw provider usage
+     * object it carries (else null/undefined). The LAST non-null return across
+     * the whole stream is what {@link onUsage} receives — so for endpoints whose
+     * usage arrives piecewise (e.g. Anthropic `message_start`+`message_delta`),
+     * merge inside this closure and return the combined value from the terminal
+     * event.
+     */
+    extractUsage(event: Record<string, unknown>): Record<string, unknown> | null | undefined;
+    /** Called once at stream end with the last captured usage (only if any). */
+    onUsage(rawUsage: Record<string, unknown>): void;
+}
 /**
  * Relay an already-wire-shaped `Response` to the http `res`.
  * - `text/event-stream` (or `isStream`): pipe the ReadableStream chunk-by-chunk.
@@ -54,7 +78,16 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.
@@ -73,13 +106,19 @@ declare function relayResponse(res: http.ServerResponse, providerResponse: Respo
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string): Promise<string>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
+/**
+ * Map a strict bound-account failure to a stable structured response. The body
+ * carries only the fixed code/reason/message; account ids, tokens, and upstream
+ * error text never cross the wire.
+ */
+declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAccountSelectionError): void;
 /**
  * Resolve the FIRST-CHOICE BYO request key for a `buildByoPlan`, threading the
  * ApiKeyPool through TWO gates so 429/529/401/403 failover actually fires on the
  * outbound serving path (omnicross-daemon-parity-poolseam, design D2(b)).
  *
- * MIRRORS the host engine adapter's `resolveApiKeyForProvider` (the reference impl whose
- * pool failover already works internally):
+ * Matches the host engine adapter's `resolveApiKeyForProvider` contract so pool
+ * failover remains inside the provider layer:
  *   - pool present AND a (synthesized outbound) sessionId present →
  *     `getKeyForSession(providerId, sessionId)`. This SEEDS `sessionBindings`
  *     with the chosen key AND returns that same key, so it becomes the first
@@ -101,6 +140,6 @@ declare function writeError(res: http.ServerResponse, status: number, message: s
  * already-`resolveKey`-resolved string (its loader passes the host resolver),
  * so the pool branch needs no further `$ENV` expansion.
  */
-declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null): Promise<string>;
+declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
 
-export { aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeError };
+export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -1,9 +1,11 @@
 import http from 'node:http';
 import { LLMProvider } from '@omnicross/contracts/llm-config';
+import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.js';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.js';
 import { Transformer } from '../../transformer/types.js';
 import { ProviderProxyDeps } from '../types.js';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.js';
@@ -37,6 +39,28 @@ declare function getAnthropicEndpointTransformer(): Transformer;
 declare function getGeminiEndpointTransformer(): Transformer;
 /** Read the full request body from an IncomingMessage. */
 declare function readBody(req: http.IncomingMessage): Promise<string>;
+/**
+ * A usage tap for {@link relayResponse}'s stream branch. Streaming responses were
+ * previously not metered (only the non-stream branch recorded usage), so Codex
+ * — which always streams — produced zero usage/dashboard rows. The tap lets each
+ * ingress extract the RAW provider usage object from the SSE events it already
+ * knows, and {@link onUsage} fires once at stream end so the recorder charges
+ * exactly one event per request. Returning the raw object (not normalized)
+ * keeps this tap endpoint-agnostic; each recorder normalizes its own shape.
+ */
+interface StreamUsageTap {
+    /**
+     * Inspect one parsed SSE `data:` JSON event. Return the raw provider usage
+     * object it carries (else null/undefined). The LAST non-null return across
+     * the whole stream is what {@link onUsage} receives — so for endpoints whose
+     * usage arrives piecewise (e.g. Anthropic `message_start`+`message_delta`),
+     * merge inside this closure and return the combined value from the terminal
+     * event.
+     */
+    extractUsage(event: Record<string, unknown>): Record<string, unknown> | null | undefined;
+    /** Called once at stream end with the last captured usage (only if any). */
+    onUsage(rawUsage: Record<string, unknown>): void;
+}
 /**
  * Relay an already-wire-shaped `Response` to the http `res`.
  * - `text/event-stream` (or `isStream`): pipe the ReadableStream chunk-by-chunk.
@@ -54,7 +78,16 @@ declare function readBody(req: http.IncomingMessage): Promise<string>;
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.
@@ -73,13 +106,19 @@ declare function relayResponse(res: http.ServerResponse, providerResponse: Respo
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string): Promise<string>;
 /** Write a JSON error response if the headers have not been sent. */
 declare function writeError(res: http.ServerResponse, status: number, message: string): void;
+/**
+ * Map a strict bound-account failure to a stable structured response. The body
+ * carries only the fixed code/reason/message; account ids, tokens, and upstream
+ * error text never cross the wire.
+ */
+declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAccountSelectionError): void;
 /**
  * Resolve the FIRST-CHOICE BYO request key for a `buildByoPlan`, threading the
  * ApiKeyPool through TWO gates so 429/529/401/403 failover actually fires on the
  * outbound serving path (omnicross-daemon-parity-poolseam, design D2(b)).
  *
- * MIRRORS the host engine adapter's `resolveApiKeyForProvider` (the reference impl whose
- * pool failover already works internally):
+ * Matches the host engine adapter's `resolveApiKeyForProvider` contract so pool
+ * failover remains inside the provider layer:
  *   - pool present AND a (synthesized outbound) sessionId present →
  *     `getKeyForSession(providerId, sessionId)`. This SEEDS `sessionBindings`
  *     with the chosen key AND returns that same key, so it becomes the first
@@ -101,6 +140,6 @@ declare function writeError(res: http.ServerResponse, status: number, message: s
  * already-`resolveKey`-resolved string (its loader passes the host resolver),
  * so the pool branch needs no further `$ENV` expansion.
  */
-declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null): Promise<string>;
+declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
 
-export { aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeError };
+export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };