@omnicross/core 0.1.6 → 0.1.7

package/dist/pipeline/upstreamTrace.d.ts

@@ -14,22 +14,36 @@
  * (a `text/event-stream` included — `clone().text()` tees the stream so the
  * relay keeps streaming the original while the clone is buffered for the
  * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
- * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
- * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
- * is swallowed so the egress path is never affected.
+ * carry an opaque `providerId`; webhook / billing sends do not, so they are
+ * skipped (less noise). OAuth token-endpoint calls (interactive login + refresh)
+ * DO carry one — a failed login must be diagnosable — but they set the ctx's
+ * `redactBodies`, so their bodies are replaced with {@link REDACTED_BODY}.
+ * Tracing is fire-and-forget: a read/write failure is swallowed so the egress
+ * path is never affected.
  *
- * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
- * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
- * path the trace is a pure no-op — byte-identical zero regression.
+ * A diagnostic caller may explicitly install a path via
+ * {@link setUpstreamTracePath}. The daemon's audit runtime intentionally does
+ * not install one: audit bodies have a single persistence path. Absent an
+ * explicit path the trace is a pure no-op — byte-identical zero regression.
  *
  * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
  * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
  * test, and a plaintext trace file must not hold them. Header KEYS stay visible
  * so presence is verifiable. The request/response BODIES are captured VERBATIM
- * (a prompt / a codex SSE stream) — that is the whole point.
+ * (a prompt / a codex SSE stream) — that is the whole point — EXCEPT on a
+ * credential exchange, where the body IS the secret (see {@link REDACTED_BODY}).
  *
  * @module @omnicross/core/pipeline/upstreamTrace
  */
+/**
+ * Placeholder written in place of a request/response body whose content is a
+ * CREDENTIAL rather than the thing under test — an OAuth token exchange or
+ * refresh (`fetchUpstream` ctx `redactBodies`). Those calls are still traced so a
+ * failed login/refresh is diagnosable (url, status, duration, byte count), but a
+ * plaintext authorization code / access token / refresh token must never land in
+ * this file.
+ */
+declare const REDACTED_BODY = "***REDACTED (credential exchange)***";
 /**
  * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
  * write wins. The path is resolved by the daemon relative to the audit store.
@@ -82,4 +96,4 @@ declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
 /** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
 declare function __resetUpstreamTraceForTests(): void;
 
-export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };
+export { REDACTED_BODY, type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };

package/dist/pipeline/upstreamTrace.js

@@ -1,11 +1,13 @@
 import {
+  REDACTED_BODY,
   __resetUpstreamTraceForTests,
   getUpstreamTracePath,
   redactHeaders,
   setUpstreamTracePath,
   writeUpstreamTrace
-} from "../chunk-SYQF7OIR.js";
+} from "../chunk-3WD4HTR2.js";
 export {
+  REDACTED_BODY,
   __resetUpstreamTraceForTests,
   getUpstreamTracePath,
   redactHeaders,

package/dist/ports.d.cts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.cjs';
 export { UsageEventStore } from './ports/usage-event-store.cjs';
 export { WebSearchBackend } from './ports/web-search-backend.cjs';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.cjs';
-export { O as OutboundCredentialStore } from './types-H3wGZSOo.cjs';
+export { O as OutboundCredentialStore } from './types-gjJ5lJ5n.cjs';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';

package/dist/ports.d.ts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.js';
 export { UsageEventStore } from './ports/usage-event-store.js';
 export { WebSearchBackend } from './ports/web-search-backend.js';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.js';
-export { O as OutboundCredentialStore } from './types-hsoKrVQS.js';
+export { O as OutboundCredentialStore } from './types-CqZD77rS.js';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,34 +1,37 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkSQYVORNPcjs = require('../chunk-SQYVORNP.cjs');
-require('../chunk-EJLH6NFT.cjs');
+var _chunk4BB343BIcjs = require('../chunk-4BB343BI.cjs');
 require('../chunk-HQP3K7PU.cjs');
 require('../chunk-FZ46M34D.cjs');
-require('../chunk-IIRPUVPH.cjs');
-require('../chunk-GBHYAGX3.cjs');
-require('../chunk-3OPYJG76.cjs');
-require('../chunk-7AK7B36B.cjs');
+require('../chunk-2Z4XM3H5.cjs');
+require('../chunk-OXHNSZ53.cjs');
 require('../chunk-V4TXMEJS.cjs');
-require('../chunk-6VUQPOV3.cjs');
+require('../chunk-OVQBNVSV.cjs');
+require('../chunk-5RSZYQJH.cjs');
 require('../chunk-OF3BECU2.cjs');
-require('../chunk-4VLRHHFE.cjs');
 require('../chunk-EYZYXJTJ.cjs');
-require('../chunk-DLXZEZWO.cjs');
-require('../chunk-SNYBEXLB.cjs');
-require('../chunk-R3HK6R4B.cjs');
+require('../chunk-2E42SAW3.cjs');
+require('../chunk-OJGQKHN5.cjs');
+require('../chunk-IIRPUVPH.cjs');
+require('../chunk-GBHYAGX3.cjs');
+require('../chunk-3OPYJG76.cjs');
+require('../chunk-3SCOLIPT.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
+require('../chunk-J3QQ6JS5.cjs');
+require('../chunk-UIBD2YY5.cjs');
+require('../chunk-R3HK6R4B.cjs');
+require('../chunk-QXD4MV2X.cjs');
 require('../chunk-NYUNU75A.cjs');
-require('../chunk-YK57NMIF.cjs');
+require('../chunk-OTZC4TNH.cjs');
+require('../chunk-YWL7YZWS.cjs');
 require('../chunk-YNJNTCSQ.cjs');
 require('../chunk-SVNDB62D.cjs');
-require('../chunk-UIBD2YY5.cjs');
 require('../chunk-6QQG7YG3.cjs');
 require('../chunk-25GXJCEZ.cjs');
 require('../chunk-MUHWHQVM.cjs');
 require('../chunk-Q27JY5RG.cjs');
-require('../chunk-QXD4MV2X.cjs');
 require('../chunk-APYG5QD7.cjs');
 require('../chunk-L74VDN4A.cjs');
 require('../chunk-4YINUUKQ.cjs');
@@ -36,16 +39,17 @@ require('../chunk-4VZX5F4T.cjs');
 require('../chunk-QBZJ7P2T.cjs');
 require('../chunk-4IH4EL7M.cjs');
 require('../chunk-A2YMUCBT.cjs');
-require('../chunk-UNWKG6EI.cjs');
+require('../chunk-XPIOJQS2.cjs');
 require('../chunk-FCR77GYM.cjs');
 require('../chunk-AEOZIDEB.cjs');
 require('../chunk-XSVNC2UD.cjs');
-require('../chunk-WYTEQ4Q5.cjs');
+require('../chunk-GDIXXKF2.cjs');
 require('../chunk-OKMJLEXX.cjs');
 require('../chunk-KBM2W6UY.cjs');
-require('../chunk-KCVJWJST.cjs');
-require('../chunk-3Z5BQZFM.cjs');
+require('../chunk-RJUONLUQ.cjs');
+require('../chunk-235MXAGX.cjs');
 require('../chunk-HVBBDBS3.cjs');
+require('../chunk-NKVZ6Z3Y.cjs');
 require('../chunk-NZYN7C3P.cjs');
 require('../chunk-JMJBSACD.cjs');
 require('../chunk-GMMT7RVN.cjs');
@@ -53,4 +57,4 @@ require('../chunk-UNEFIWXI.cjs');
 
 
 
-exports.ProviderProxy = _chunkSQYVORNPcjs.ProviderProxy; exports.isLoopbackAddress = _chunkSQYVORNPcjs.isLoopbackAddress;
+exports.ProviderProxy = _chunk4BB343BIcjs.ProviderProxy; exports.isLoopbackAddress = _chunk4BB343BIcjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.d.cts

@@ -2,6 +2,7 @@ export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-CnM
 import './types.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';

package/dist/provider-proxy/ProviderProxy.d.ts

@@ -2,6 +2,7 @@ export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-C-x
 import './types.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.js';

package/dist/provider-proxy/ProviderProxy.js

@@ -1,34 +1,37 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-UDCC7EMR.js";
-import "../chunk-WB6PH56J.js";
+} from "../chunk-E3COOKUP.js";
 import "../chunk-VVEHS2LI.js";
 import "../chunk-46RLHI7D.js";
-import "../chunk-WNKWAEUR.js";
-import "../chunk-MZNPGW5Q.js";
-import "../chunk-DK4A7DLE.js";
-import "../chunk-VRFBB5DB.js";
+import "../chunk-MYYR3HZL.js";
+import "../chunk-PEGTIPB3.js";
 import "../chunk-LVUCAWMK.js";
-import "../chunk-OEWZUX4G.js";
+import "../chunk-32O35CIF.js";
+import "../chunk-FU7EAR73.js";
 import "../chunk-LB6EBS6Y.js";
-import "../chunk-6CL5HTPQ.js";
 import "../chunk-7VU7V2E4.js";
-import "../chunk-UX7VWA46.js";
-import "../chunk-BPKCU575.js";
-import "../chunk-DRWHTIIZ.js";
+import "../chunk-FXR6N3SR.js";
+import "../chunk-SOO562NM.js";
+import "../chunk-WNKWAEUR.js";
+import "../chunk-MZNPGW5Q.js";
+import "../chunk-DK4A7DLE.js";
+import "../chunk-XXFYLL7R.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
+import "../chunk-GFIZ6LQI.js";
+import "../chunk-OE6TDIWW.js";
+import "../chunk-DRWHTIIZ.js";
+import "../chunk-JWC6APFQ.js";
 import "../chunk-5ERIZW3D.js";
-import "../chunk-YJVHCHQX.js";
+import "../chunk-PO3XB56Z.js";
+import "../chunk-N7OOJI5V.js";
 import "../chunk-23S5OPIO.js";
 import "../chunk-AVYJ4YBN.js";
-import "../chunk-OE6TDIWW.js";
 import "../chunk-OPRS4IQZ.js";
 import "../chunk-2JYRIADS.js";
 import "../chunk-DE2SRBFZ.js";
 import "../chunk-ZY6KU6P3.js";
-import "../chunk-JWC6APFQ.js";
 import "../chunk-WLYIIEAF.js";
 import "../chunk-TKJMZBAH.js";
 import "../chunk-3QFXFCHG.js";
@@ -36,16 +39,17 @@ import "../chunk-EBLFCNPY.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-XEKD23J5.js";
 import "../chunk-H5JUT3KV.js";
-import "../chunk-IFXJ2BG7.js";
+import "../chunk-7C7DET6S.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";
-import "../chunk-AT7B7SOZ.js";
+import "../chunk-5NJLQ6T6.js";
 import "../chunk-N5T4M4GU.js";
 import "../chunk-TOVPMMHM.js";
-import "../chunk-SIZQQD6T.js";
-import "../chunk-SYQF7OIR.js";
+import "../chunk-RJ5ZGNI3.js";
+import "../chunk-3WD4HTR2.js";
 import "../chunk-MKF46GNZ.js";
+import "../chunk-GL6XM527.js";
 import "../chunk-CDHS2QDC.js";
 import "../chunk-Y7FO65VT.js";
 import "../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/identity/codexCliHeaders.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk3SCOLIPTcjs = require('../../chunk-3SCOLIPT.cjs');
+
+
+
+
+exports.DEFAULT_CODEX_CLI_HEADERS = _chunk3SCOLIPTcjs.DEFAULT_CODEX_CLI_HEADERS; exports.codexAcceptHeader = _chunk3SCOLIPTcjs.codexAcceptHeader; exports.extractCodexClientHeaders = _chunk3SCOLIPTcjs.extractCodexClientHeaders;

package/dist/provider-proxy/identity/codexCliHeaders.d.cts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.d.ts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.js

@@ -0,0 +1,10 @@
+import {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+} from "../../chunk-XXFYLL7R.js";
+export {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+};

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -9,34 +9,37 @@
 
 
 
-var _chunkSQYVORNPcjs = require('../../chunk-SQYVORNP.cjs');
-require('../../chunk-EJLH6NFT.cjs');
+var _chunk4BB343BIcjs = require('../../chunk-4BB343BI.cjs');
 require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-FZ46M34D.cjs');
-require('../../chunk-IIRPUVPH.cjs');
-require('../../chunk-GBHYAGX3.cjs');
-require('../../chunk-3OPYJG76.cjs');
-require('../../chunk-7AK7B36B.cjs');
+require('../../chunk-2Z4XM3H5.cjs');
+require('../../chunk-OXHNSZ53.cjs');
 require('../../chunk-V4TXMEJS.cjs');
-require('../../chunk-6VUQPOV3.cjs');
+require('../../chunk-OVQBNVSV.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 require('../../chunk-OF3BECU2.cjs');
-require('../../chunk-4VLRHHFE.cjs');
 require('../../chunk-EYZYXJTJ.cjs');
-require('../../chunk-DLXZEZWO.cjs');
-require('../../chunk-SNYBEXLB.cjs');
-require('../../chunk-R3HK6R4B.cjs');
+require('../../chunk-2E42SAW3.cjs');
+require('../../chunk-OJGQKHN5.cjs');
+require('../../chunk-IIRPUVPH.cjs');
+require('../../chunk-GBHYAGX3.cjs');
+require('../../chunk-3OPYJG76.cjs');
+require('../../chunk-3SCOLIPT.cjs');
 require('../../chunk-RPII3E6Z.cjs');
 require('../../chunk-6RPZADX3.cjs');
+require('../../chunk-J3QQ6JS5.cjs');
+require('../../chunk-UIBD2YY5.cjs');
+require('../../chunk-R3HK6R4B.cjs');
+require('../../chunk-QXD4MV2X.cjs');
 require('../../chunk-NYUNU75A.cjs');
-require('../../chunk-YK57NMIF.cjs');
+require('../../chunk-OTZC4TNH.cjs');
+require('../../chunk-YWL7YZWS.cjs');
 require('../../chunk-YNJNTCSQ.cjs');
 require('../../chunk-SVNDB62D.cjs');
-require('../../chunk-UIBD2YY5.cjs');
 require('../../chunk-6QQG7YG3.cjs');
 require('../../chunk-25GXJCEZ.cjs');
 require('../../chunk-MUHWHQVM.cjs');
 require('../../chunk-Q27JY5RG.cjs');
-require('../../chunk-QXD4MV2X.cjs');
 require('../../chunk-APYG5QD7.cjs');
 require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-4YINUUKQ.cjs');
@@ -44,16 +47,17 @@ require('../../chunk-4VZX5F4T.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
 require('../../chunk-4IH4EL7M.cjs');
 require('../../chunk-A2YMUCBT.cjs');
-require('../../chunk-UNWKG6EI.cjs');
+require('../../chunk-XPIOJQS2.cjs');
 require('../../chunk-FCR77GYM.cjs');
 require('../../chunk-AEOZIDEB.cjs');
 require('../../chunk-XSVNC2UD.cjs');
-require('../../chunk-WYTEQ4Q5.cjs');
+require('../../chunk-GDIXXKF2.cjs');
 require('../../chunk-OKMJLEXX.cjs');
 require('../../chunk-KBM2W6UY.cjs');
-require('../../chunk-KCVJWJST.cjs');
-require('../../chunk-3Z5BQZFM.cjs');
+require('../../chunk-RJUONLUQ.cjs');
+require('../../chunk-235MXAGX.cjs');
 require('../../chunk-HVBBDBS3.cjs');
+require('../../chunk-NKVZ6Z3Y.cjs');
 require('../../chunk-NZYN7C3P.cjs');
 require('../../chunk-JMJBSACD.cjs');
 require('../../chunk-GMMT7RVN.cjs');
@@ -69,4 +73,4 @@ require('../../chunk-UNEFIWXI.cjs');
 
 
 
-exports.aggregateAnthropicSseToJsonBody = _chunkSQYVORNPcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunkSQYVORNPcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkSQYVORNPcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkSQYVORNPcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkSQYVORNPcjs.getSharedExecutor; exports.readBody = _chunkSQYVORNPcjs.readBody; exports.relayResponse = _chunkSQYVORNPcjs.relayResponse; exports.resolvePoolBoundKey = _chunkSQYVORNPcjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunkSQYVORNPcjs.writeBoundAccountError; exports.writeError = _chunkSQYVORNPcjs.writeError;
+exports.aggregateAnthropicSseToJsonBody = _chunk4BB343BIcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunk4BB343BIcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunk4BB343BIcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunk4BB343BIcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunk4BB343BIcjs.getSharedExecutor; exports.readBody = _chunk4BB343BIcjs.readBody; exports.relayResponse = _chunk4BB343BIcjs.relayResponse; exports.resolvePoolBoundKey = _chunk4BB343BIcjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunk4BB343BIcjs.writeBoundAccountError; exports.writeError = _chunk4BB343BIcjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -5,6 +5,7 @@ import { TransformerChainExecutor } from '../../transformer/TransformerChainExec
 import { Transformer } from '../../transformer/types.cjs';
 import { ProviderProxyDeps } from '../types.cjs';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.cjs';
@@ -77,7 +78,16 @@ interface StreamUsageTap {
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -5,6 +5,7 @@ import { TransformerChainExecutor } from '../../transformer/TransformerChainExec
 import { Transformer } from '../../transformer/types.js';
 import { ProviderProxyDeps } from '../types.js';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.js';
@@ -77,7 +78,16 @@ interface StreamUsageTap {
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.

package/dist/provider-proxy/ingress/providerProxyShared.js

@@ -9,34 +9,37 @@ import {
   resolvePoolBoundKey,
   writeBoundAccountError,
   writeError
-} from "../../chunk-UDCC7EMR.js";
-import "../../chunk-WB6PH56J.js";
+} from "../../chunk-E3COOKUP.js";
 import "../../chunk-VVEHS2LI.js";
 import "../../chunk-46RLHI7D.js";
-import "../../chunk-WNKWAEUR.js";
-import "../../chunk-MZNPGW5Q.js";
-import "../../chunk-DK4A7DLE.js";
-import "../../chunk-VRFBB5DB.js";
+import "../../chunk-MYYR3HZL.js";
+import "../../chunk-PEGTIPB3.js";
 import "../../chunk-LVUCAWMK.js";
-import "../../chunk-OEWZUX4G.js";
+import "../../chunk-32O35CIF.js";
+import "../../chunk-FU7EAR73.js";
 import "../../chunk-LB6EBS6Y.js";
-import "../../chunk-6CL5HTPQ.js";
 import "../../chunk-7VU7V2E4.js";
-import "../../chunk-UX7VWA46.js";
-import "../../chunk-BPKCU575.js";
-import "../../chunk-DRWHTIIZ.js";
+import "../../chunk-FXR6N3SR.js";
+import "../../chunk-SOO562NM.js";
+import "../../chunk-WNKWAEUR.js";
+import "../../chunk-MZNPGW5Q.js";
+import "../../chunk-DK4A7DLE.js";
+import "../../chunk-XXFYLL7R.js";
 import "../../chunk-XTEI64OU.js";
 import "../../chunk-XX6NQJMA.js";
+import "../../chunk-GFIZ6LQI.js";
+import "../../chunk-OE6TDIWW.js";
+import "../../chunk-DRWHTIIZ.js";
+import "../../chunk-JWC6APFQ.js";
 import "../../chunk-5ERIZW3D.js";
-import "../../chunk-YJVHCHQX.js";
+import "../../chunk-PO3XB56Z.js";
+import "../../chunk-N7OOJI5V.js";
 import "../../chunk-23S5OPIO.js";
 import "../../chunk-AVYJ4YBN.js";
-import "../../chunk-OE6TDIWW.js";
 import "../../chunk-OPRS4IQZ.js";
 import "../../chunk-2JYRIADS.js";
 import "../../chunk-DE2SRBFZ.js";
 import "../../chunk-ZY6KU6P3.js";
-import "../../chunk-JWC6APFQ.js";
 import "../../chunk-WLYIIEAF.js";
 import "../../chunk-TKJMZBAH.js";
 import "../../chunk-3QFXFCHG.js";
@@ -44,16 +47,17 @@ import "../../chunk-EBLFCNPY.js";
 import "../../chunk-AQ5TNQB7.js";
 import "../../chunk-XEKD23J5.js";
 import "../../chunk-H5JUT3KV.js";
-import "../../chunk-IFXJ2BG7.js";
+import "../../chunk-7C7DET6S.js";
 import "../../chunk-K5NM7VAH.js";
 import "../../chunk-WNY4WMRF.js";
 import "../../chunk-OZFM4X3S.js";
-import "../../chunk-AT7B7SOZ.js";
+import "../../chunk-5NJLQ6T6.js";
 import "../../chunk-N5T4M4GU.js";
 import "../../chunk-TOVPMMHM.js";
-import "../../chunk-SIZQQD6T.js";
-import "../../chunk-SYQF7OIR.js";
+import "../../chunk-RJ5ZGNI3.js";
+import "../../chunk-3WD4HTR2.js";
 import "../../chunk-MKF46GNZ.js";
+import "../../chunk-GL6XM527.js";
 import "../../chunk-CDHS2QDC.js";
 import "../../chunk-Y7FO65VT.js";
 import "../../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/matchText.cjs

@@ -5,7 +5,7 @@
 
 
 
-var _chunkEJLH6NFTcjs = require('../chunk-EJLH6NFT.cjs');
+var _chunkJ3QQ6JS5cjs = require('../chunk-J3QQ6JS5.cjs');
 
 
 
@@ -13,4 +13,4 @@ var _chunkEJLH6NFTcjs = require('../chunk-EJLH6NFT.cjs');
 
 
 
-exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkEJLH6NFTcjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkEJLH6NFTcjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkEJLH6NFTcjs.collectMatchText; exports.deriveGatewaySessionKey = _chunkEJLH6NFTcjs.deriveGatewaySessionKey; exports.deriveSubscriptionSessionKey = _chunkEJLH6NFTcjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkEJLH6NFTcjs.flattenMatchText;
+exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkJ3QQ6JS5cjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkJ3QQ6JS5cjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkJ3QQ6JS5cjs.collectMatchText; exports.deriveGatewaySessionKey = _chunkJ3QQ6JS5cjs.deriveGatewaySessionKey; exports.deriveSubscriptionSessionKey = _chunkJ3QQ6JS5cjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkJ3QQ6JS5cjs.flattenMatchText;

package/dist/provider-proxy/matchText.d.cts

@@ -55,8 +55,6 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
-/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
- *  session-affinity bucket key (NOT a security primitive). */
 /**
  * Source used to derive a gateway session-affinity key. The value is kept
  * deliberately small and non-sensitive: callers only receive the hashed key,
@@ -88,7 +86,7 @@ type SessionRequestHeaders = Record<string, string | string[] | undefined>;
  * final fallback is route-scoped (api key/session + endpoint) so a request
  * with no usable metadata remains conservative and does not rotate accounts
  * on every turn. Raw ids and prompts are never returned or logged; only their
- * FNV-1a digest is exposed as `key`.
+ * truncated SHA-256 digest is exposed as `key`.
  */
 declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;
 

package/dist/provider-proxy/matchText.d.ts

@@ -55,8 +55,6 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
-/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
- *  session-affinity bucket key (NOT a security primitive). */
 /**
  * Source used to derive a gateway session-affinity key. The value is kept
  * deliberately small and non-sensitive: callers only receive the hashed key,
@@ -88,7 +86,7 @@ type SessionRequestHeaders = Record<string, string | string[] | undefined>;
  * final fallback is route-scoped (api key/session + endpoint) so a request
  * with no usable metadata remains conservative and does not rotate accounts
  * on every turn. Raw ids and prompts are never returned or logged; only their
- * FNV-1a digest is exposed as `key`.
+ * truncated SHA-256 digest is exposed as `key`.
  */
 declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;