@omnicross/core 0.1.6 → 0.1.8

package/dist/pipeline/SubscriptionAccountHealth.d.ts

@@ -31,6 +31,12 @@ declare const OVERLOAD_ENABLED_DEFAULT = true;
 declare const AUTH_ERROR_TTL_MS: number;
 /** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
+/**
+ * Hard cap on a quota-exhaustion cooldown (the weekly usage window is ~1 week).
+ * A parsed/supplied deadline farther than this into the future is clamped, so a
+ * bogus parse can never strand an account indefinitely.
+ */
+declare const MAX_QUOTA_COOLDOWN_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
     /** From a 429 authoritative reset header — rate-limited until this instant. */
@@ -39,11 +45,20 @@ interface HealthRecord {
     overloadUntil?: number;
     /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
     tempUnavailableUntil?: number;
+    /**
+     * From a detected quota/usage-limit error (e.g. Codex weekly window exhausted).
+     * Intentionally NOT cleared by a 2xx: while the account's credits/window are
+     * exhausted, in-flight sessions on the SAME account keep returning 2xx (Codex
+     * does not kill them mid-session), which would otherwise immediately heal a
+     * transient/rate-limit mark and re-strand every NEW session onto this account.
+     * Self-heals only when the deadline elapses.
+     */
+    quotaExhaustedUntil?: number;
     /** From a 403-ban — permanent, self-heal never clears it. */
     blocked?: boolean;
 }
 /** The coarse health state surfaced to the admin accounts view (secret-free). */
-type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
 /** Admin-facing status projection for one account. */
 interface AccountHealthStatus {
     state: AccountHealthState;
@@ -68,7 +83,7 @@ interface AccountRecoveryEvent {
 /** A recovery listener (fire-and-forget; the emitter never awaits it). */
 type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
 /** The coarse anomaly state an account transitioned into (secret-free). */
-type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded' | 'quota_exhausted';
 /**
  * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
  * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
@@ -192,6 +207,20 @@ declare class SubscriptionAccountHealth {
      *  - 2xx → clear rate-limit + transient state (keep `blocked`).
      */
     recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /**
+     * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+     * usage-limit wall). Unlike the status-driven timers set by
+     * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+     * sessions on the same account keep succeeding after the window is exhausted,
+     * so a traffic-driven clear would re-strand every NEW session onto this
+     * account. It excludes the account from NEW-session selection until the
+     * deadline elapses (existing sessions are unaffected — they already hold their
+     * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+     * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+     * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+     * unhealthy edge.
+     */
+    markQuotaExhausted(providerId: string, accountId: string, untilEpochMs: number, now?: number): void;
     /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
     private isUnhealthyAt;
     /**
@@ -260,4 +289,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, MAX_QUOTA_COOLDOWN_MS, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.js

@@ -1,6 +1,7 @@
 import {
   ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
+  MAX_QUOTA_COOLDOWN_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,
   SERVER_ERROR_TTL_MS,
@@ -9,10 +10,11 @@ import {
   getSharedAccountHealth,
   resolveResetSeconds,
   setSharedAccountHealth
-} from "../chunk-YJVHCHQX.js";
+} from "../chunk-N7OOJI5V.js";
 export {
   ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
+  MAX_QUOTA_COOLDOWN_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,
   SERVER_ERROR_TTL_MS,

package/dist/pipeline/upstreamFetch.cjs

@@ -4,13 +4,14 @@
 
 
 
-var _chunkKCVJWJSTcjs = require('../chunk-KCVJWJST.cjs');
-require('../chunk-3Z5BQZFM.cjs');
+var _chunkRJUONLUQcjs = require('../chunk-RJUONLUQ.cjs');
+require('../chunk-235MXAGX.cjs');
 require('../chunk-HVBBDBS3.cjs');
+require('../chunk-NKVZ6Z3Y.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkKCVJWJSTcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkKCVJWJSTcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkKCVJWJSTcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkKCVJWJSTcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkKCVJWJSTcjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkRJUONLUQcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkRJUONLUQcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkRJUONLUQcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkRJUONLUQcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkRJUONLUQcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -1,5 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
+import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -28,27 +29,55 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
- * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
- * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
- * response and append the FULL exchange (request + verbatim response incl. SSE)
- * to the trace file. Absent a path (the default) it is a pure no-op — zero
- * regression. See `upstreamTrace.ts`.
+ * DEBUG TRACE: when a diagnostic caller explicitly installs an upstream-trace
+ * path, relay calls (`ctx.providerId` set) clone the response and append the
+ * FULL exchange (request + verbatim response incl. SSE) to the trace file. The
+ * daemon audit runtime never installs this path, preventing duplicate body
+ * storage. Absent a path (the default) it is a pure no-op — zero regression.
  *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 
+interface AccountRouteActivityContext {
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    /**
+     * Invoked once with the freshly-recorded activity record. Lets a caller
+     * capture the record `id` so it can {@link AccountRouteActivityStore.amend}
+     * the SAME row later, once a post-hoc fact (e.g. an overload event buried in
+     * the 200 SSE body) becomes known during relay. Best-effort: never throws.
+     */
+    onRecorded?: (record: AccountRouteActivityRecord) => void;
+}
 /** The opaque call context the resolver maps to a proxy (precedence input). */
 interface UpstreamProxyContext {
     /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
     providerId?: string;
     /** The selected pooled account id (per-account override input). */
     accountId?: string;
+    /** Metadata-only live route activity. Never contains prompts, headers, or tokens. */
+    routeActivity?: AccountRouteActivityContext;
     /**
      * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
      * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
      * do NOT set this — it is filled from the fetch `url`.
      */
     url?: string;
+    /**
+     * CREDENTIAL EXCHANGE — this call's request/response BODIES carry secrets (an
+     * authorization code + PKCE verifier out, an access/refresh token back), so the
+     * debug trace must record the exchange's METADATA only and replace both bodies
+     * with a placeholder.
+     *
+     * Set it on every OAuth token-endpoint call (interactive login + refresh).
+     * Those calls still need a `providerId` so the per-provider proxy layer applies
+     * and so a failure is traceable at all — but the trace captures bodies verbatim
+     * (that is its purpose for relay traffic), and a plaintext token must never
+     * reach the trace file. Purely a trace concern: the proxy resolver ignores it.
+     */
+    redactBodies?: boolean;
 }
 /**
  * The layered proxy lookup the daemon injects. Applies precedence
@@ -86,4 +115,4 @@ declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamPro
 /** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
 declare function __resetUpstreamProxyForTests(): void;
 
-export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };
+export { type AccountRouteActivityContext, type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.d.ts

@@ -1,5 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
+import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -28,27 +29,55 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
- * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
- * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
- * response and append the FULL exchange (request + verbatim response incl. SSE)
- * to the trace file. Absent a path (the default) it is a pure no-op — zero
- * regression. See `upstreamTrace.ts`.
+ * DEBUG TRACE: when a diagnostic caller explicitly installs an upstream-trace
+ * path, relay calls (`ctx.providerId` set) clone the response and append the
+ * FULL exchange (request + verbatim response incl. SSE) to the trace file. The
+ * daemon audit runtime never installs this path, preventing duplicate body
+ * storage. Absent a path (the default) it is a pure no-op — zero regression.
  *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 
+interface AccountRouteActivityContext {
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    /**
+     * Invoked once with the freshly-recorded activity record. Lets a caller
+     * capture the record `id` so it can {@link AccountRouteActivityStore.amend}
+     * the SAME row later, once a post-hoc fact (e.g. an overload event buried in
+     * the 200 SSE body) becomes known during relay. Best-effort: never throws.
+     */
+    onRecorded?: (record: AccountRouteActivityRecord) => void;
+}
 /** The opaque call context the resolver maps to a proxy (precedence input). */
 interface UpstreamProxyContext {
     /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
     providerId?: string;
     /** The selected pooled account id (per-account override input). */
     accountId?: string;
+    /** Metadata-only live route activity. Never contains prompts, headers, or tokens. */
+    routeActivity?: AccountRouteActivityContext;
     /**
      * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
      * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
      * do NOT set this — it is filled from the fetch `url`.
      */
     url?: string;
+    /**
+     * CREDENTIAL EXCHANGE — this call's request/response BODIES carry secrets (an
+     * authorization code + PKCE verifier out, an access/refresh token back), so the
+     * debug trace must record the exchange's METADATA only and replace both bodies
+     * with a placeholder.
+     *
+     * Set it on every OAuth token-endpoint call (interactive login + refresh).
+     * Those calls still need a `providerId` so the per-provider proxy layer applies
+     * and so a failure is traceable at all — but the trace captures bodies verbatim
+     * (that is its purpose for relay traffic), and a plaintext token must never
+     * reach the trace file. Purely a trace concern: the proxy resolver ignores it.
+     */
+    redactBodies?: boolean;
 }
 /**
  * The layered proxy lookup the daemon injects. Applies precedence
@@ -86,4 +115,4 @@ declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamPro
 /** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
 declare function __resetUpstreamProxyForTests(): void;
 
-export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };
+export { type AccountRouteActivityContext, type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.js

@@ -4,9 +4,10 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-SIZQQD6T.js";
-import "../chunk-SYQF7OIR.js";
+} from "../chunk-RJ5ZGNI3.js";
+import "../chunk-3WD4HTR2.js";
 import "../chunk-MKF46GNZ.js";
+import "../chunk-GL6XM527.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,

package/dist/pipeline/upstreamTrace.cjs

@@ -4,11 +4,13 @@
 
 
 
-var _chunk3Z5BQZFMcjs = require('../chunk-3Z5BQZFM.cjs');
 
+var _chunk235MXAGXcjs = require('../chunk-235MXAGX.cjs');
 
 
 
 
 
-exports.__resetUpstreamTraceForTests = _chunk3Z5BQZFMcjs.__resetUpstreamTraceForTests; exports.getUpstreamTracePath = _chunk3Z5BQZFMcjs.getUpstreamTracePath; exports.redactHeaders = _chunk3Z5BQZFMcjs.redactHeaders; exports.setUpstreamTracePath = _chunk3Z5BQZFMcjs.setUpstreamTracePath; exports.writeUpstreamTrace = _chunk3Z5BQZFMcjs.writeUpstreamTrace;
+
+
+exports.REDACTED_BODY = _chunk235MXAGXcjs.REDACTED_BODY; exports.__resetUpstreamTraceForTests = _chunk235MXAGXcjs.__resetUpstreamTraceForTests; exports.getUpstreamTracePath = _chunk235MXAGXcjs.getUpstreamTracePath; exports.redactHeaders = _chunk235MXAGXcjs.redactHeaders; exports.setUpstreamTracePath = _chunk235MXAGXcjs.setUpstreamTracePath; exports.writeUpstreamTrace = _chunk235MXAGXcjs.writeUpstreamTrace;

package/dist/pipeline/upstreamTrace.d.cts

@@ -14,22 +14,36 @@
  * (a `text/event-stream` included — `clone().text()` tees the stream so the
  * relay keeps streaming the original while the clone is buffered for the
  * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
- * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
- * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
- * is swallowed so the egress path is never affected.
+ * carry an opaque `providerId`; webhook / billing sends do not, so they are
+ * skipped (less noise). OAuth token-endpoint calls (interactive login + refresh)
+ * DO carry one — a failed login must be diagnosable — but they set the ctx's
+ * `redactBodies`, so their bodies are replaced with {@link REDACTED_BODY}.
+ * Tracing is fire-and-forget: a read/write failure is swallowed so the egress
+ * path is never affected.
  *
- * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
- * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
- * path the trace is a pure no-op — byte-identical zero regression.
+ * A diagnostic caller may explicitly install a path via
+ * {@link setUpstreamTracePath}. The daemon's audit runtime intentionally does
+ * not install one: audit bodies have a single persistence path. Absent an
+ * explicit path the trace is a pure no-op — byte-identical zero regression.
  *
  * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
  * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
  * test, and a plaintext trace file must not hold them. Header KEYS stay visible
  * so presence is verifiable. The request/response BODIES are captured VERBATIM
- * (a prompt / a codex SSE stream) — that is the whole point.
+ * (a prompt / a codex SSE stream) — that is the whole point — EXCEPT on a
+ * credential exchange, where the body IS the secret (see {@link REDACTED_BODY}).
  *
  * @module @omnicross/core/pipeline/upstreamTrace
  */
+/**
+ * Placeholder written in place of a request/response body whose content is a
+ * CREDENTIAL rather than the thing under test — an OAuth token exchange or
+ * refresh (`fetchUpstream` ctx `redactBodies`). Those calls are still traced so a
+ * failed login/refresh is diagnosable (url, status, duration, byte count), but a
+ * plaintext authorization code / access token / refresh token must never land in
+ * this file.
+ */
+declare const REDACTED_BODY = "***REDACTED (credential exchange)***";
 /**
  * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
  * write wins. The path is resolved by the daemon relative to the audit store.
@@ -82,4 +96,4 @@ declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
 /** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
 declare function __resetUpstreamTraceForTests(): void;
 
-export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };
+export { REDACTED_BODY, type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };

package/dist/pipeline/upstreamTrace.d.ts

@@ -14,22 +14,36 @@
  * (a `text/event-stream` included — `clone().text()` tees the stream so the
  * relay keeps streaming the original while the clone is buffered for the
  * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
- * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
- * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
- * is swallowed so the egress path is never affected.
+ * carry an opaque `providerId`; webhook / billing sends do not, so they are
+ * skipped (less noise). OAuth token-endpoint calls (interactive login + refresh)
+ * DO carry one — a failed login must be diagnosable — but they set the ctx's
+ * `redactBodies`, so their bodies are replaced with {@link REDACTED_BODY}.
+ * Tracing is fire-and-forget: a read/write failure is swallowed so the egress
+ * path is never affected.
  *
- * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
- * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
- * path the trace is a pure no-op — byte-identical zero regression.
+ * A diagnostic caller may explicitly install a path via
+ * {@link setUpstreamTracePath}. The daemon's audit runtime intentionally does
+ * not install one: audit bodies have a single persistence path. Absent an
+ * explicit path the trace is a pure no-op — byte-identical zero regression.
  *
  * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
  * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
  * test, and a plaintext trace file must not hold them. Header KEYS stay visible
  * so presence is verifiable. The request/response BODIES are captured VERBATIM
- * (a prompt / a codex SSE stream) — that is the whole point.
+ * (a prompt / a codex SSE stream) — that is the whole point — EXCEPT on a
+ * credential exchange, where the body IS the secret (see {@link REDACTED_BODY}).
  *
  * @module @omnicross/core/pipeline/upstreamTrace
  */
+/**
+ * Placeholder written in place of a request/response body whose content is a
+ * CREDENTIAL rather than the thing under test — an OAuth token exchange or
+ * refresh (`fetchUpstream` ctx `redactBodies`). Those calls are still traced so a
+ * failed login/refresh is diagnosable (url, status, duration, byte count), but a
+ * plaintext authorization code / access token / refresh token must never land in
+ * this file.
+ */
+declare const REDACTED_BODY = "***REDACTED (credential exchange)***";
 /**
  * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
  * write wins. The path is resolved by the daemon relative to the audit store.
@@ -82,4 +96,4 @@ declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
 /** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
 declare function __resetUpstreamTraceForTests(): void;
 
-export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };
+export { REDACTED_BODY, type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };

package/dist/pipeline/upstreamTrace.js

@@ -1,11 +1,13 @@
 import {
+  REDACTED_BODY,
   __resetUpstreamTraceForTests,
   getUpstreamTracePath,
   redactHeaders,
   setUpstreamTracePath,
   writeUpstreamTrace
-} from "../chunk-SYQF7OIR.js";
+} from "../chunk-3WD4HTR2.js";
 export {
+  REDACTED_BODY,
   __resetUpstreamTraceForTests,
   getUpstreamTracePath,
   redactHeaders,

package/dist/ports.d.cts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.cjs';
 export { UsageEventStore } from './ports/usage-event-store.cjs';
 export { WebSearchBackend } from './ports/web-search-backend.cjs';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.cjs';
-export { O as OutboundCredentialStore } from './types-H3wGZSOo.cjs';
+export { O as OutboundCredentialStore } from './types-C2MwkLah.cjs';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';
@@ -27,5 +27,5 @@ import '@omnicross/contracts/billing-types';
 import '@omnicross/contracts/health-logging-types';
 import '@omnicross/contracts/voucher-types';
 import '@omnicross/contracts/webhook-types';
-import './ProviderProxy-CnMQYN59.cjs';
+import './ProviderProxy-QdwNV6l1.cjs';
 import './keyPolicy-zdWTu3CQ.cjs';

package/dist/ports.d.ts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.js';
 export { UsageEventStore } from './ports/usage-event-store.js';
 export { WebSearchBackend } from './ports/web-search-backend.js';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.js';
-export { O as OutboundCredentialStore } from './types-hsoKrVQS.js';
+export { O as OutboundCredentialStore } from './types-BB8pxk_3.js';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
@@ -27,5 +27,5 @@ import '@omnicross/contracts/billing-types';
 import '@omnicross/contracts/health-logging-types';
 import '@omnicross/contracts/voucher-types';
 import '@omnicross/contracts/webhook-types';
-import './ProviderProxy-C-xqrkKi.js';
+import './ProviderProxy--ROec6VI.js';
 import './keyPolicy-zdWTu3CQ.js';

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,34 +1,37 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkSQYVORNPcjs = require('../chunk-SQYVORNP.cjs');
-require('../chunk-EJLH6NFT.cjs');
+var _chunk26K6T2YScjs = require('../chunk-26K6T2YS.cjs');
 require('../chunk-HQP3K7PU.cjs');
 require('../chunk-FZ46M34D.cjs');
-require('../chunk-IIRPUVPH.cjs');
-require('../chunk-GBHYAGX3.cjs');
-require('../chunk-3OPYJG76.cjs');
-require('../chunk-7AK7B36B.cjs');
+require('../chunk-2Z4XM3H5.cjs');
+require('../chunk-OXHNSZ53.cjs');
 require('../chunk-V4TXMEJS.cjs');
-require('../chunk-6VUQPOV3.cjs');
+require('../chunk-OVQBNVSV.cjs');
+require('../chunk-5RSZYQJH.cjs');
 require('../chunk-OF3BECU2.cjs');
-require('../chunk-4VLRHHFE.cjs');
 require('../chunk-EYZYXJTJ.cjs');
-require('../chunk-DLXZEZWO.cjs');
-require('../chunk-SNYBEXLB.cjs');
-require('../chunk-R3HK6R4B.cjs');
+require('../chunk-2E42SAW3.cjs');
+require('../chunk-EPN67EGP.cjs');
+require('../chunk-IIRPUVPH.cjs');
+require('../chunk-GBHYAGX3.cjs');
+require('../chunk-3OPYJG76.cjs');
+require('../chunk-3SCOLIPT.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
+require('../chunk-J3QQ6JS5.cjs');
+require('../chunk-UIBD2YY5.cjs');
+require('../chunk-R3HK6R4B.cjs');
+require('../chunk-QXD4MV2X.cjs');
 require('../chunk-NYUNU75A.cjs');
-require('../chunk-YK57NMIF.cjs');
+require('../chunk-OTZC4TNH.cjs');
+require('../chunk-YWL7YZWS.cjs');
 require('../chunk-YNJNTCSQ.cjs');
 require('../chunk-SVNDB62D.cjs');
-require('../chunk-UIBD2YY5.cjs');
 require('../chunk-6QQG7YG3.cjs');
 require('../chunk-25GXJCEZ.cjs');
 require('../chunk-MUHWHQVM.cjs');
 require('../chunk-Q27JY5RG.cjs');
-require('../chunk-QXD4MV2X.cjs');
 require('../chunk-APYG5QD7.cjs');
 require('../chunk-L74VDN4A.cjs');
 require('../chunk-4YINUUKQ.cjs');
@@ -36,16 +39,17 @@ require('../chunk-4VZX5F4T.cjs');
 require('../chunk-QBZJ7P2T.cjs');
 require('../chunk-4IH4EL7M.cjs');
 require('../chunk-A2YMUCBT.cjs');
-require('../chunk-UNWKG6EI.cjs');
+require('../chunk-XPIOJQS2.cjs');
 require('../chunk-FCR77GYM.cjs');
 require('../chunk-AEOZIDEB.cjs');
 require('../chunk-XSVNC2UD.cjs');
-require('../chunk-WYTEQ4Q5.cjs');
+require('../chunk-GDIXXKF2.cjs');
 require('../chunk-OKMJLEXX.cjs');
 require('../chunk-KBM2W6UY.cjs');
-require('../chunk-KCVJWJST.cjs');
-require('../chunk-3Z5BQZFM.cjs');
+require('../chunk-RJUONLUQ.cjs');
+require('../chunk-235MXAGX.cjs');
 require('../chunk-HVBBDBS3.cjs');
+require('../chunk-NKVZ6Z3Y.cjs');
 require('../chunk-NZYN7C3P.cjs');
 require('../chunk-JMJBSACD.cjs');
 require('../chunk-GMMT7RVN.cjs');
@@ -53,4 +57,4 @@ require('../chunk-UNEFIWXI.cjs');
 
 
 
-exports.ProviderProxy = _chunkSQYVORNPcjs.ProviderProxy; exports.isLoopbackAddress = _chunkSQYVORNPcjs.isLoopbackAddress;
+exports.ProviderProxy = _chunk26K6T2YScjs.ProviderProxy; exports.isLoopbackAddress = _chunk26K6T2YScjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.d.cts

@@ -1,7 +1,8 @@
-export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-CnMQYN59.cjs';
+export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-QdwNV6l1.cjs';
 import './types.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';

package/dist/provider-proxy/ProviderProxy.d.ts

@@ -1,7 +1,8 @@
-export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-C-xqrkKi.js';
+export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy--ROec6VI.js';
 import './types.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.js';

package/dist/provider-proxy/ProviderProxy.js

@@ -1,34 +1,37 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-UDCC7EMR.js";
-import "../chunk-WB6PH56J.js";
+} from "../chunk-QYC54PMG.js";
 import "../chunk-VVEHS2LI.js";
 import "../chunk-46RLHI7D.js";
-import "../chunk-WNKWAEUR.js";
-import "../chunk-MZNPGW5Q.js";
-import "../chunk-DK4A7DLE.js";
-import "../chunk-VRFBB5DB.js";
+import "../chunk-MYYR3HZL.js";
+import "../chunk-PEGTIPB3.js";
 import "../chunk-LVUCAWMK.js";
-import "../chunk-OEWZUX4G.js";
+import "../chunk-32O35CIF.js";
+import "../chunk-FU7EAR73.js";
 import "../chunk-LB6EBS6Y.js";
-import "../chunk-6CL5HTPQ.js";
 import "../chunk-7VU7V2E4.js";
-import "../chunk-UX7VWA46.js";
-import "../chunk-BPKCU575.js";
-import "../chunk-DRWHTIIZ.js";
+import "../chunk-FXR6N3SR.js";
+import "../chunk-UAPBLNN2.js";
+import "../chunk-WNKWAEUR.js";
+import "../chunk-MZNPGW5Q.js";
+import "../chunk-DK4A7DLE.js";
+import "../chunk-XXFYLL7R.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
+import "../chunk-GFIZ6LQI.js";
+import "../chunk-OE6TDIWW.js";
+import "../chunk-DRWHTIIZ.js";
+import "../chunk-JWC6APFQ.js";
 import "../chunk-5ERIZW3D.js";
-import "../chunk-YJVHCHQX.js";
+import "../chunk-PO3XB56Z.js";
+import "../chunk-N7OOJI5V.js";
 import "../chunk-23S5OPIO.js";
 import "../chunk-AVYJ4YBN.js";
-import "../chunk-OE6TDIWW.js";
 import "../chunk-OPRS4IQZ.js";
 import "../chunk-2JYRIADS.js";
 import "../chunk-DE2SRBFZ.js";
 import "../chunk-ZY6KU6P3.js";
-import "../chunk-JWC6APFQ.js";
 import "../chunk-WLYIIEAF.js";
 import "../chunk-TKJMZBAH.js";
 import "../chunk-3QFXFCHG.js";
@@ -36,16 +39,17 @@ import "../chunk-EBLFCNPY.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-XEKD23J5.js";
 import "../chunk-H5JUT3KV.js";
-import "../chunk-IFXJ2BG7.js";
+import "../chunk-7C7DET6S.js";
 import "../chunk-K5NM7VAH.js";
 import "../chunk-WNY4WMRF.js";
 import "../chunk-OZFM4X3S.js";
-import "../chunk-AT7B7SOZ.js";
+import "../chunk-5NJLQ6T6.js";
 import "../chunk-N5T4M4GU.js";
 import "../chunk-TOVPMMHM.js";
-import "../chunk-SIZQQD6T.js";
-import "../chunk-SYQF7OIR.js";
+import "../chunk-RJ5ZGNI3.js";
+import "../chunk-3WD4HTR2.js";
 import "../chunk-MKF46GNZ.js";
+import "../chunk-GL6XM527.js";
 import "../chunk-CDHS2QDC.js";
 import "../chunk-Y7FO65VT.js";
 import "../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/identity/codexCliHeaders.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk3SCOLIPTcjs = require('../../chunk-3SCOLIPT.cjs');
+
+
+
+
+exports.DEFAULT_CODEX_CLI_HEADERS = _chunk3SCOLIPTcjs.DEFAULT_CODEX_CLI_HEADERS; exports.codexAcceptHeader = _chunk3SCOLIPTcjs.codexAcceptHeader; exports.extractCodexClientHeaders = _chunk3SCOLIPTcjs.extractCodexClientHeaders;