@omnicross/core 0.1.6 → 0.1.7

package/dist/{chunk-UDCC7EMR.js → chunk-E3COOKUP.js}

@@ -1,30 +1,30 @@
-import {
-  collectMatchText,
-  deriveGatewaySessionKey,
-  deriveSubscriptionSessionKey
-} from "./chunk-WB6PH56J.js";
 import {
   streamSSEResponse
 } from "./chunk-VVEHS2LI.js";
 import {
-  TransformerChainExecutor
-} from "./chunk-WNKWAEUR.js";
-import {
-  injectExtendedContextBeta
-} from "./chunk-MZNPGW5Q.js";
+  AnthropicTransformer,
+  resolveAnthropicMaxTokens
+} from "./chunk-PEGTIPB3.js";
 import {
   GeminiTransformer
 } from "./chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "./chunk-OEWZUX4G.js";
+} from "./chunk-32O35CIF.js";
 import {
-  AnthropicTransformer,
-  resolveAnthropicMaxTokens
-} from "./chunk-6CL5HTPQ.js";
+  TransformerChainExecutor
+} from "./chunk-WNKWAEUR.js";
 import {
-  getGeminiCodeAssistResolver
-} from "./chunk-DRWHTIIZ.js";
+  injectExtendedContextBeta
+} from "./chunk-MZNPGW5Q.js";
+import {
+  DEFAULT_CODEX_CLI_HEADERS,
+  NEVER_FORWARD_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders,
+  fillMissingHeaders,
+  flattenHeaderValue
+} from "./chunk-XXFYLL7R.js";
 import {
   getSharedIdentityStore
 } from "./chunk-XTEI64OU.js";
@@ -32,22 +32,36 @@ import {
   applyFingerprint,
   captureCallerIdentity
 } from "./chunk-XX6NQJMA.js";
+import {
+  collectMatchText,
+  deriveGatewaySessionKey,
+  deriveSubscriptionSessionKey
+} from "./chunk-GFIZ6LQI.js";
+import {
+  emitWebhookEvent
+} from "./chunk-OE6TDIWW.js";
+import {
+  getGeminiCodeAssistResolver
+} from "./chunk-DRWHTIIZ.js";
+import {
+  resolveProviderChain
+} from "./chunk-JWC6APFQ.js";
 import {
   resolveSubscriptionChain
 } from "./chunk-5ERIZW3D.js";
+import {
+  getSharedOverloadCounter
+} from "./chunk-PO3XB56Z.js";
 import {
   getSharedAccountHealth,
   resolveResetSeconds
-} from "./chunk-YJVHCHQX.js";
+} from "./chunk-N7OOJI5V.js";
 import {
   SubscriptionAuthSource
 } from "./chunk-23S5OPIO.js";
 import {
   serializeError
 } from "./chunk-AVYJ4YBN.js";
-import {
-  emitWebhookEvent
-} from "./chunk-OE6TDIWW.js";
 import {
   isAccountAllowanceExhaustedError
 } from "./chunk-OPRS4IQZ.js";
@@ -62,9 +76,6 @@ import {
   LlmConfigProviderAuth,
   getProviderHeaders
 } from "./chunk-ZY6KU6P3.js";
-import {
-  resolveProviderChain
-} from "./chunk-JWC6APFQ.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -90,14 +101,20 @@ import {
 } from "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-IFXJ2BG7.js";
+} from "./chunk-7C7DET6S.js";
 import {
   convertAnthropicToOpenAI,
   convertOpenAIToAnthropic
-} from "./chunk-AT7B7SOZ.js";
+} from "./chunk-5NJLQ6T6.js";
 import {
   fetchUpstream
-} from "./chunk-SIZQQD6T.js";
+} from "./chunk-RJ5ZGNI3.js";
+import {
+  getSharedAccountAllowanceStore
+} from "./chunk-MKF46GNZ.js";
+import {
+  getSharedAccountRouteActivity
+} from "./chunk-GL6XM527.js";
 import {
   applyAugmentation
 } from "./chunk-Y7FO65VT.js";
@@ -479,6 +496,66 @@ var ProviderProxyRouteMap = class {
   }
 };
 
+// src/provider-proxy/identity/claudeCodeHeaders.ts
+var DEFAULT_ANTHROPIC_VERSION = "2023-06-01";
+var OAUTH_BETA = "oauth-2025-04-20";
+var CLAUDE_CODE_BETA = "claude-code-20250219";
+var INTERLEAVED_THINKING_BETA = "interleaved-thinking-2025-05-14";
+var TOOL_STREAMING_BETA = "fine-grained-tool-streaming-2025-05-14";
+var DEFAULT_CLAUDE_CODE_HEADERS = Object.freeze({
+  "user-agent": "claude-cli/1.0.119 (external, cli)",
+  "x-app": "cli",
+  accept: "application/json",
+  "accept-language": "*",
+  "sec-fetch-mode": "cors",
+  "anthropic-dangerous-direct-browser-access": "true",
+  "x-stainless-lang": "js",
+  "x-stainless-package-version": "0.55.1",
+  "x-stainless-os": "Windows",
+  "x-stainless-arch": "x64",
+  "x-stainless-runtime": "node",
+  "x-stainless-runtime-version": "v20.19.2",
+  "x-stainless-retry-count": "0",
+  "x-stainless-timeout": "60"
+});
+var FORCED_ACCEPT_ENCODING = "identity";
+var CLAUDE_FORWARD_ALLOWLIST = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-language",
+  "sec-fetch-mode",
+  "user-agent",
+  "x-app",
+  "anthropic-dangerous-direct-browser-access",
+  "anthropic-version"
+]);
+var STAINLESS_PREFIX = "x-stainless-";
+function extractClaudeClientHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    const key = rawKey.toLowerCase();
+    if (NEVER_FORWARD_HEADERS.has(key)) continue;
+    if (!CLAUDE_FORWARD_ALLOWLIST.has(key) && !key.startsWith(STAINLESS_PREFIX)) continue;
+    const value = flattenHeaderValue(rawVal);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function buildAnthropicBeta(model, callerBeta) {
+  const isHaiku = typeof model === "string" && model.toLowerCase().includes("haiku");
+  const baseline = isHaiku ? [OAUTH_BETA, INTERLEAVED_THINKING_BETA] : [CLAUDE_CODE_BETA, OAUTH_BETA, INTERLEAVED_THINKING_BETA, TOOL_STREAMING_BETA];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  const add = (flag) => {
+    const trimmed = flag.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    out.push(trimmed);
+  };
+  baseline.forEach(add);
+  if (callerBeta) callerBeta.split(",").forEach(add);
+  return out.join(",");
+}
+
 // src/provider-proxy/usage/recordAnthropicUsage.ts
 function readAnthropicUsage(usage) {
   if (!usage) return null;
@@ -653,7 +730,7 @@ async function relaySseBody(res, body, options) {
     res.end();
   }
 }
-async function relayResponse(res, providerResponse, isStream, rewriteModel, usageTap) {
+async function relayResponse(res, providerResponse, isStream, rewriteModel, usageTap, onSseEvent) {
   const contentType = providerResponse.headers.get("Content-Type") ?? "";
   const status = providerResponse.status && providerResponse.status >= 100 ? providerResponse.status : 200;
   const upstreamIsSse = contentType.includes("text/event-stream");
@@ -667,13 +744,16 @@ async function relayResponse(res, providerResponse, isStream, rewriteModel, usag
       res.end();
       return null;
     }
-    if (rewriteModel || usageTap) {
+    if (rewriteModel || usageTap || onSseEvent) {
       let capturedUsage = null;
       await relaySseBody(res, providerResponse.body, {
         rewriteModel,
-        onSseEvent: usageTap ? (event) => {
-          const raw = usageTap.extractUsage(event);
-          if (raw) capturedUsage = raw;
+        onSseEvent: onSseEvent || usageTap ? (event) => {
+          onSseEvent?.(event);
+          if (usageTap) {
+            const raw = usageTap.extractUsage(event);
+            if (raw) capturedUsage = raw;
+          }
         } : void 0
       });
       if (capturedUsage) usageTap.onUsage(capturedUsage);
@@ -985,7 +1065,16 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: proxyProviderId(plan), accountId: proxyAccountId }
+        {
+          providerId: proxyProviderId(plan),
+          accountId: proxyAccountId,
+          routeActivity: plan.isSubscription ? {
+            endpoint: "messages",
+            sessionKey: plan.sessionKey,
+            sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
+            model: resolvedModel
+          } : void 0
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -1012,7 +1101,8 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
       reportSelection?.(accountId, isActive, remapped);
     }
   });
-  if (plan.isSubscription && plan.transformerProvider.name === "claude") {
+  const isClaudeSubscription = plan.isSubscription && plan.transformerProvider.name === "claude";
+  if (isClaudeSubscription) {
     applyFingerprint(
       getSharedIdentityStore(),
       headers,
@@ -1021,16 +1111,36 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
       options.callerIdentity
     );
   }
+  if (isClaudeSubscription) {
+    fillMissingHeaders(headers, options.callerClientHeaders ?? {});
+    fillMissingHeaders(headers, DEFAULT_CLAUDE_CODE_HEADERS);
+  }
+  fillMissingHeaders(headers, { "anthropic-version": DEFAULT_ANTHROPIC_VERSION });
+  headers["accept-encoding"] = FORCED_ACCEPT_ENCODING;
   const applyRemap = remappedModel !== void 0 && outboundRemapApplies(plan);
   const outboundBody = applyRemap ? rewriteBodyModel(rawBody, remappedModel) : rawBody;
   const outboundModel = applyRemap ? remappedModel : plan.resolvedModel;
+  if (isClaudeSubscription) {
+    headers["anthropic-beta"] = buildAnthropicBeta(outboundModel, options.callerAnthropicBeta);
+  } else if (options.callerAnthropicBeta) {
+    fillMissingHeaders(headers, { "anthropic-beta": options.callerAnthropicBeta });
+  }
   console.info(
     `[ProviderProxy:anthropic] (subscription same-format) -> ${plan.upstreamUrl} model=${outboundModel} stream=${plan.isStream}`
   );
   const response = await fetchUpstream(
     plan.upstreamUrl,
     { method: "POST", headers, body: outboundBody },
-    { providerId: proxyProviderId(plan), accountId: proxyAccountId }
+    {
+      providerId: proxyProviderId(plan),
+      accountId: proxyAccountId,
+      routeActivity: plan.isSubscription ? {
+        endpoint: "messages",
+        sessionKey: plan.sessionKey,
+        sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
+        model: outboundModel
+      } : void 0
+    }
   );
   return { response, rawStatus: response.status };
 }
@@ -1370,7 +1480,12 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     const callerBetaRaw = req.headers["anthropic-beta"];
     const callerAnthropicBeta = Array.isArray(callerBetaRaw) ? callerBetaRaw.join(",") : callerBetaRaw;
     const callerIdentity = captureCallerIdentity(getSharedIdentityStore(), req.headers);
-    await handleAnthropicMessagesByo(res, rawBody, route, deps, { callerAnthropicBeta, callerIdentity });
+    const callerClientHeaders = extractClaudeClientHeaders(req.headers);
+    await handleAnthropicMessagesByo(res, rawBody, route, deps, {
+      callerAnthropicBeta,
+      callerIdentity,
+      callerClientHeaders
+    });
     return;
   }
   const hints = route.anthropicSdkHints;
@@ -1957,6 +2072,8 @@ function emitResponsesUsageRecord(recorder, rawUsage, attribution) {
     providerId: attribution.providerId,
     model: attribution.model,
     apiKeyId: attribution.apiKeyId,
+    cacheKeySource: attribution.cacheKeySource,
+    cacheKeyInjected: attribution.cacheKeyInjected,
     auditResponse: attribution.auditResponse,
     engineOrigin: "codex-ingress",
     usage: tapped,
@@ -1981,12 +2098,72 @@ function recordResponsesStreamUsage(recorder, rawUsage, attribution) {
   }
 }
 
+// src/provider-proxy/ingress/codexUsageLimitDetection.ts
+var PROVIDER_ID = "codex";
+var DEFAULT_QUOTA_COOLDOWN_MS = 5 * 6e4;
+var QUOTA_EXHAUSTED_PERCENT = 90;
+function parseTryAgainDeadline(bodyText) {
+  const match = bodyText.match(/try again (?:at|on)\s+(.+?)(?:[.\n]|$)/i);
+  if (!match) return void 0;
+  const cleaned = match[1].replace(/(\d+)(st|nd|rd|th)/giu, "$1").trim();
+  const ms = Date.parse(cleaned);
+  return Number.isFinite(ms) ? ms : void 0;
+}
+function deadlineFromAllowanceSnapshot(accountId, now) {
+  const snapshot = getSharedAccountAllowanceStore().get(PROVIDER_ID, accountId, now);
+  if (!snapshot) return void 0;
+  const candidates = snapshot.windows.filter(
+    (w) => typeof w.usedPercent === "number" && w.usedPercent >= QUOTA_EXHAUSTED_PERCENT && typeof w.resetsAt === "string"
+  ).map((w) => ({ ms: Date.parse(w.resetsAt), usedPercent: w.usedPercent })).filter((x) => Number.isFinite(x.ms) && x.ms > now).sort((a, b) => b.usedPercent - a.usedPercent);
+  return candidates[0]?.ms;
+}
+function resolveCodexQuotaDeadline(accountId, bodyText, now = Date.now()) {
+  const parsed = parseTryAgainDeadline(bodyText);
+  const parsedDeadline = parsed !== void 0 && parsed > now ? parsed : void 0;
+  return deadlineFromAllowanceSnapshot(accountId, now) ?? parsedDeadline ?? now + DEFAULT_QUOTA_COOLDOWN_MS;
+}
+function markCodexUsageLimitExhaustion(accountId, bodyText, now = Date.now()) {
+  if (!accountId) return;
+  const deadline = resolveCodexQuotaDeadline(accountId, bodyText, now);
+  getSharedAccountHealth().markQuotaExhausted(PROVIDER_ID, accountId, deadline, now);
+}
+
 // src/provider-proxy/ingress/openaiResponsesIngress.ts
+var SERVER_OVERLOADED_CODES = /* @__PURE__ */ new Set(["server_is_overloaded", "slow_down"]);
+function isCodexServerOverloadEvent(event) {
+  if (event["type"] !== "response.failed") return false;
+  const error = event["response"]?.["error"];
+  const code = error?.["code"];
+  return typeof code === "string" && SERVER_OVERLOADED_CODES.has(code);
+}
 function isOpenAIResponsesRequest(method, url) {
   if (method !== "POST" || !url) return false;
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
   return path.endsWith("/responses");
 }
+var SAFE_INJECTED_CACHE_KEY_SOURCES = /* @__PURE__ */ new Set([
+  "session-header",
+  "thread-header",
+  "body-session-id",
+  "body-thread-id",
+  "content-fingerprint"
+]);
+function isSafeInjectedCacheKeySource(source) {
+  return SAFE_INJECTED_CACHE_KEY_SOURCES.has(source);
+}
+function ensureCodexPromptCacheKey(body, proxyProviderId2, derivedSession) {
+  if (typeof body.prompt_cache_key === "string" && body.prompt_cache_key.trim()) {
+    return { cacheKeySource: "client", cacheKeyInjected: false };
+  }
+  if (proxyProviderId2 !== "codex" || !isSafeInjectedCacheKeySource(derivedSession.source)) {
+    return { cacheKeySource: "none", cacheKeyInjected: false };
+  }
+  body.prompt_cache_key = `omnicross:${derivedSession.source}:${derivedSession.key}`;
+  return {
+    cacheKeySource: derivedSession.source,
+    cacheKeyInjected: true
+  };
+}
 async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHeaders = {}) {
   let responsesBody;
   try {
@@ -2007,14 +2184,31 @@ async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHe
   const resolvedModel = route.model;
   responsesBody.model = resolvedModel;
   try {
-    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(
+      res,
+      route,
+      deps,
+      resolvedModel,
+      isStream,
+      sessionKey,
+      derivedSession.source,
+      requestHeaders
+    ) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
-    const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
+    const cacheKeyAttribution = ensureCodexPromptCacheKey(
+      responsesBody,
+      plan.proxyProviderId,
+      derivedSession
+    );
+    let providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
+    providerResponse = await retryAroundCodexUsageLimit(responsesBody, plan, providerResponse);
     const usageAttribution = {
       sessionId: route.sessionId,
       providerId: route.providerId ?? "codex",
       model: resolvedModel,
       apiKeyId: route.apiKeyId ?? null,
+      cacheKeySource: cacheKeyAttribution.cacheKeySource,
+      cacheKeyInjected: cacheKeyAttribution.cacheKeyInjected,
       // request-audit-log: correlate this request's tokens/cost to its audit record.
       auditResponse: res
     };
@@ -2030,12 +2224,33 @@ async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHe
         recordResponsesStreamUsage(usageRecorder, rawUsage, usageAttribution);
       }
     } : void 0;
+    const overloadActivityId = providerResponse.activityRecordId;
+    const overloadAccountId = providerResponse.accountId;
+    const overloadProviderId = plan.proxyProviderId;
+    let overloadRecorded = false;
+    const overloadDetector = (event) => {
+      if (overloadRecorded || !isCodexServerOverloadEvent(event)) return;
+      overloadRecorded = true;
+      if (overloadActivityId) {
+        getSharedAccountRouteActivity().amend(overloadActivityId, {
+          streamError: "server_overloaded"
+        });
+      }
+      if (overloadAccountId) {
+        getSharedOverloadCounter().recordOverload({
+          providerId: overloadProviderId,
+          accountId: overloadAccountId,
+          endpoint: "responses"
+        });
+      }
+    };
     const bodyText = await relayResponse(
       res,
       providerResponse.response,
       isStream,
       route.requestedModel,
-      usageTap
+      usageTap,
+      overloadDetector
     );
     if (bodyText && deps.usageRecorder) {
       recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
@@ -2099,7 +2314,7 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     proxyProviderId: "byo"
   };
 }
-async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) {
+async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey, sessionSource, requestHeaders) {
   const profile = route.subscriptionProfile;
   if (!profile) {
     writeError(res, 502, "Subscription mode requires a codex subscription profile");
@@ -2142,6 +2357,7 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream,
   return {
     auth,
     sessionKey,
+    sessionSource,
     preferredAccountId: route.preferredAccountId,
     preferredAccountGroup: route.preferredAccountGroup,
     boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
@@ -2154,7 +2370,10 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream,
     // profile's `resolveUpstreamUrl` for non-Code-Assist subscriptions.
     resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : typeof config.url === "string" ? config.url : upstreamUrl,
     upstreamUrl,
-    proxyProviderId: profile.authStrategy.providerId
+    proxyProviderId: profile.authStrategy.providerId,
+    // Only the codex backend understands these; other subscription providers
+    // (gemini Code Assist) share this relay and must not receive them.
+    callerClientHeaders: profile.authStrategy.providerId === "codex" ? extractCodexClientHeaders(requestHeaders) : void 0
   };
 }
 async function resolveGeminiCodeAssistProject(profile, hints) {
@@ -2172,6 +2391,7 @@ async function runPipeline4(responsesBody, plan) {
   const endpointTransformer = getResponsesEndpointTransformer();
   const { auth, sessionKey, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
   let proxyAccountId;
+  let activityRecordId;
   const authHeaders = {};
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
@@ -2199,6 +2419,11 @@ async function runPipeline4(responsesBody, plan) {
           if (value !== void 0 && !(key in headers)) headers[key] = value;
         }
       }
+      if (plan.proxyProviderId === "codex") {
+        fillMissingHeaders(headers, plan.callerClientHeaders ?? {});
+        fillMissingHeaders(headers, DEFAULT_CODEX_CLI_HEADERS);
+        fillMissingHeaders(headers, { accept: codexAcceptHeader(isStream) });
+      }
       return headers;
     },
     fetchFn: (url, headers, body) => {
@@ -2206,7 +2431,19 @@ async function runPipeline4(responsesBody, plan) {
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: plan.proxyProviderId, accountId: proxyAccountId }
+        {
+          providerId: plan.proxyProviderId,
+          accountId: proxyAccountId,
+          routeActivity: plan.proxyProviderId === "byo" ? void 0 : {
+            endpoint: "responses",
+            sessionKey,
+            sessionSource: plan.sessionSource ?? "none",
+            model: resolvedModel,
+            onRecorded: (record) => {
+              activityRecordId = record.id;
+            }
+          }
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -2214,7 +2451,7 @@ async function runPipeline4(responsesBody, plan) {
     },
     runResponseChain: true
   });
-  return { response, rawStatus };
+  return { response, rawStatus, accountId: proxyAccountId, activityRecordId };
 }
 async function runPipelineWithPoolReporting4(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
@@ -2240,6 +2477,22 @@ async function runPipelineWithSubscriptionRetry3(responsesBody, plan) {
   console.log("[ProviderProxy:responses] 401 \u2192 token refreshed; retrying once");
   return runPipeline4(responsesBody, plan);
 }
+var MAX_QUOTA_RETRIES = 3;
+function isCodexAccountQuota429(plan, result) {
+  return plan.proxyProviderId === "codex" && !!result.accountId && result.rawStatus === 429;
+}
+async function retryAroundCodexUsageLimit(responsesBody, plan, first, runAttempt = runPipelineWithSubscriptionRetry3) {
+  if (!isCodexAccountQuota429(plan, first)) return first;
+  let current = first;
+  for (let attempt = 0; attempt < MAX_QUOTA_RETRIES; attempt++) {
+    const errorBody = await current.response.text().catch(() => "");
+    markCodexUsageLimitExhaustion(current.accountId, errorBody);
+    const next = await runAttempt(responsesBody, plan);
+    if (!isCodexAccountQuota429(plan, next)) return next;
+    current = next;
+  }
+  return current;
+}
 
 // src/provider-proxy/providerProxyRouter.ts
 function extractRouteToken(authHeader) {
@@ -2531,15 +2784,20 @@ function normalizeAudit(raw) {
   return {
     enabled: a?.enabled === true,
     captureBodies: a?.captureBodies === true,
-    maxBodyBytes: Math.trunc(
-      clampNumber(a?.maxBodyBytes, 256, 1048576, DEFAULT_AUDIT_CONFIG.maxBodyBytes)
-    ),
+    maxBodyBytes: normalizeMaxBodyBytes(a?.maxBodyBytes),
     retentionDays: Math.trunc(
       clampNumber(a?.retentionDays, 1, 365, DEFAULT_AUDIT_CONFIG.retentionDays)
     ),
     trustForwardedFor: a?.trustForwardedFor === true
   };
 }
+function normalizeMaxBodyBytes(value) {
+  if (value === -1) return -1;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return DEFAULT_AUDIT_CONFIG.maxBodyBytes;
+  }
+  return Math.trunc(Math.min(1048576, value));
+}
 function normalizeBilling(raw) {
   const b = raw?.billing;
   const config = {
@@ -3240,7 +3498,8 @@ async function createNamedKey(db, name) {
     id,
     name,
     keyHash: hashKey(secret),
-    keyPrefix: prefix
+    keyPrefix: prefix,
+    plaintext: secret
   });
   return {
     id: row.id,
@@ -3261,7 +3520,8 @@ async function createIntegrationKey(db, name, allowedEndpoints = ["responses", "
     keyPrefix: prefix,
     kind: "integration",
     allowedEndpoints: [...new Set(allowedEndpoints)],
-    loopbackOnly: true
+    loopbackOnly: true,
+    plaintext: secret
   });
   return {
     id: row.id,

package/dist/chunk-FU7EAR73.js

@@ -0,0 +1,62 @@
+// src/transformer/transformers/utils/usage-mapping.ts
+function num(obj, key) {
+  const v = obj?.[key];
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+function detailCachedTokens(obj, detailKey) {
+  const detail = obj?.[detailKey];
+  return num(detail, "cached_tokens");
+}
+function anthropicUsageToChatUsage(usage) {
+  if (!usage) return void 0;
+  const input = num(usage, "input_tokens");
+  const output = num(usage, "output_tokens");
+  const cacheRead = num(usage, "cache_read_input_tokens");
+  const cacheCreation = num(usage, "cache_creation_input_tokens");
+  const promptTokens = input + cacheRead + cacheCreation;
+  const out = {
+    prompt_tokens: promptTokens,
+    completion_tokens: output,
+    total_tokens: promptTokens + output
+  };
+  if (cacheRead > 0) {
+    out.prompt_tokens_details = { cached_tokens: cacheRead };
+  }
+  return out;
+}
+function chatUsageToResponsesUsage(usage) {
+  if (!usage) return void 0;
+  const prompt = num(usage, "prompt_tokens");
+  const completion = num(usage, "completion_tokens");
+  const out = {
+    input_tokens: prompt,
+    output_tokens: completion,
+    total_tokens: num(usage, "total_tokens") || prompt + completion
+  };
+  const cacheRead = detailCachedTokens(usage, "prompt_tokens_details");
+  if (cacheRead > 0) {
+    out.input_tokens_details = { cached_tokens: cacheRead };
+  }
+  return out;
+}
+function responsesUsageToChatUsage(usage) {
+  if (!usage) return void 0;
+  const input = num(usage, "input_tokens");
+  const output = num(usage, "output_tokens");
+  const out = {
+    prompt_tokens: input,
+    completion_tokens: output,
+    total_tokens: num(usage, "total_tokens") || input + output
+  };
+  const cacheRead = detailCachedTokens(usage, "input_tokens_details");
+  if (cacheRead > 0) {
+    out.prompt_tokens_details = { cached_tokens: cacheRead };
+  }
+  return out;
+}
+
+export {
+  anthropicUsageToChatUsage,
+  chatUsageToResponsesUsage,
+  responsesUsageToChatUsage
+};