@omnicross/core 0.1.6 → 0.1.8

package/dist/provider-proxy/identity/codexCliHeaders.d.cts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.d.ts

@@ -0,0 +1,45 @@
+/**
+ * codexCliHeaders — the Codex CLI client headers the CODEX SUBSCRIPTION relay
+ * puts on every `chatgpt.com/backend-api/codex/responses` request.
+ *
+ * WHY THIS EXISTS: like the claude relay, this path sent exactly `content-type`
+ * + `Authorization` (verified against a live `upstream-trace.jsonl`). Unlike the
+ * claude one it still got a 200 — ChatGPT's Codex backend does not currently
+ * reject a bare request — but the relayed call carried NONE of the markers a
+ * real `codex` CLI sends (`originator`, its UA, `version`, `openai-beta`,
+ * `session_id`), which is exactly the shape risk-control looks at.
+ *
+ * SCOPE: applied ONLY to the codex SUBSCRIPTION plan (`proxyProviderId ===
+ * 'codex'`, i.e. an OAuth ChatGPT account). A BYO OpenAI-compatible endpoint
+ * shares this relay and must stay byte-identical — sending it `originator:
+ * codex_cli_rs` would be wrong and could trip its own checks.
+ *
+ * Modeled on claude-relay-service (`routes/openaiRoutes.js`, the codex branch).
+ *
+ * NOT DONE HERE (deliberate, see the relay call site):
+ *  - `chatgpt-account-id`: CRS sends the ChatGPT account id parsed out of the
+ *    OAuth `id_token`. Guessing it wrong risks a 403 on a path that currently
+ *    works, so it is left to a follow-up that can verify the value.
+ *  - forcing `store: false` on the body: a body mutation with its own regression
+ *    surface, tracked separately.
+ *
+ * @module provider-proxy/identity/codexCliHeaders
+ */
+/**
+ * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
+ * the caller left empty — a forwarded real value always wins, so a genuine Codex
+ * CLI keeps its own identity and only a caller that sent nothing gets these.
+ *
+ * `originator` is the load-bearing one: it is how the backend tells the Codex
+ * CLI apart from a generic Responses client, and CRS sends it unconditionally.
+ */
+declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
+ * passing along what the client actually sent is not fingerprint synthesis.
+ */
+declare function extractCodexClientHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/** The `accept` a Codex CLI sends, which differs by streaming mode. */
+declare function codexAcceptHeader(isStream: boolean): string;
+
+export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.js

@@ -0,0 +1,10 @@
+import {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+} from "../../chunk-XXFYLL7R.js";
+export {
+  DEFAULT_CODEX_CLI_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders
+};

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -9,34 +9,37 @@
 
 
 
-var _chunkSQYVORNPcjs = require('../../chunk-SQYVORNP.cjs');
-require('../../chunk-EJLH6NFT.cjs');
+var _chunk26K6T2YScjs = require('../../chunk-26K6T2YS.cjs');
 require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-FZ46M34D.cjs');
-require('../../chunk-IIRPUVPH.cjs');
-require('../../chunk-GBHYAGX3.cjs');
-require('../../chunk-3OPYJG76.cjs');
-require('../../chunk-7AK7B36B.cjs');
+require('../../chunk-2Z4XM3H5.cjs');
+require('../../chunk-OXHNSZ53.cjs');
 require('../../chunk-V4TXMEJS.cjs');
-require('../../chunk-6VUQPOV3.cjs');
+require('../../chunk-OVQBNVSV.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 require('../../chunk-OF3BECU2.cjs');
-require('../../chunk-4VLRHHFE.cjs');
 require('../../chunk-EYZYXJTJ.cjs');
-require('../../chunk-DLXZEZWO.cjs');
-require('../../chunk-SNYBEXLB.cjs');
-require('../../chunk-R3HK6R4B.cjs');
+require('../../chunk-2E42SAW3.cjs');
+require('../../chunk-EPN67EGP.cjs');
+require('../../chunk-IIRPUVPH.cjs');
+require('../../chunk-GBHYAGX3.cjs');
+require('../../chunk-3OPYJG76.cjs');
+require('../../chunk-3SCOLIPT.cjs');
 require('../../chunk-RPII3E6Z.cjs');
 require('../../chunk-6RPZADX3.cjs');
+require('../../chunk-J3QQ6JS5.cjs');
+require('../../chunk-UIBD2YY5.cjs');
+require('../../chunk-R3HK6R4B.cjs');
+require('../../chunk-QXD4MV2X.cjs');
 require('../../chunk-NYUNU75A.cjs');
-require('../../chunk-YK57NMIF.cjs');
+require('../../chunk-OTZC4TNH.cjs');
+require('../../chunk-YWL7YZWS.cjs');
 require('../../chunk-YNJNTCSQ.cjs');
 require('../../chunk-SVNDB62D.cjs');
-require('../../chunk-UIBD2YY5.cjs');
 require('../../chunk-6QQG7YG3.cjs');
 require('../../chunk-25GXJCEZ.cjs');
 require('../../chunk-MUHWHQVM.cjs');
 require('../../chunk-Q27JY5RG.cjs');
-require('../../chunk-QXD4MV2X.cjs');
 require('../../chunk-APYG5QD7.cjs');
 require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-4YINUUKQ.cjs');
@@ -44,16 +47,17 @@ require('../../chunk-4VZX5F4T.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
 require('../../chunk-4IH4EL7M.cjs');
 require('../../chunk-A2YMUCBT.cjs');
-require('../../chunk-UNWKG6EI.cjs');
+require('../../chunk-XPIOJQS2.cjs');
 require('../../chunk-FCR77GYM.cjs');
 require('../../chunk-AEOZIDEB.cjs');
 require('../../chunk-XSVNC2UD.cjs');
-require('../../chunk-WYTEQ4Q5.cjs');
+require('../../chunk-GDIXXKF2.cjs');
 require('../../chunk-OKMJLEXX.cjs');
 require('../../chunk-KBM2W6UY.cjs');
-require('../../chunk-KCVJWJST.cjs');
-require('../../chunk-3Z5BQZFM.cjs');
+require('../../chunk-RJUONLUQ.cjs');
+require('../../chunk-235MXAGX.cjs');
 require('../../chunk-HVBBDBS3.cjs');
+require('../../chunk-NKVZ6Z3Y.cjs');
 require('../../chunk-NZYN7C3P.cjs');
 require('../../chunk-JMJBSACD.cjs');
 require('../../chunk-GMMT7RVN.cjs');
@@ -69,4 +73,4 @@ require('../../chunk-UNEFIWXI.cjs');
 
 
 
-exports.aggregateAnthropicSseToJsonBody = _chunkSQYVORNPcjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunkSQYVORNPcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkSQYVORNPcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkSQYVORNPcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkSQYVORNPcjs.getSharedExecutor; exports.readBody = _chunkSQYVORNPcjs.readBody; exports.relayResponse = _chunkSQYVORNPcjs.relayResponse; exports.resolvePoolBoundKey = _chunkSQYVORNPcjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunkSQYVORNPcjs.writeBoundAccountError; exports.writeError = _chunkSQYVORNPcjs.writeError;
+exports.aggregateAnthropicSseToJsonBody = _chunk26K6T2YScjs.aggregateAnthropicSseToJsonBody; exports.getAnthropicEndpointTransformer = _chunk26K6T2YScjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunk26K6T2YScjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunk26K6T2YScjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunk26K6T2YScjs.getSharedExecutor; exports.readBody = _chunk26K6T2YScjs.readBody; exports.relayResponse = _chunk26K6T2YScjs.relayResponse; exports.resolvePoolBoundKey = _chunk26K6T2YScjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunk26K6T2YScjs.writeBoundAccountError; exports.writeError = _chunk26K6T2YScjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -5,6 +5,7 @@ import { TransformerChainExecutor } from '../../transformer/TransformerChainExec
 import { Transformer } from '../../transformer/types.cjs';
 import { ProviderProxyDeps } from '../types.cjs';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.cjs';
@@ -77,7 +78,16 @@ interface StreamUsageTap {
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -5,6 +5,7 @@ import { TransformerChainExecutor } from '../../transformer/TransformerChainExec
 import { Transformer } from '../../transformer/types.js';
 import { ProviderProxyDeps } from '../types.js';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../../completion/ApiKeyPoolService.js';
@@ -77,7 +78,16 @@ interface StreamUsageTap {
  *
  * @returns the (upstream) JSON body text for non-stream responses, else `null`.
  */
-declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap): Promise<string | null>;
+declare function relayResponse(res: http.ServerResponse, providerResponse: Response, isStream: boolean, rewriteModel?: string, usageTap?: StreamUsageTap, 
+/**
+ * Read-only observer invoked with every parsed SSE `data:` event during a
+ * streaming relay. Never affects the relayed bytes (it runs on the ORIGINAL
+ * line, independent of the model-rewrite / usage-tap paths). Used to detect
+ * in-band errors that arrive AFTER a `200` — e.g. a Codex `response.failed`
+ * server-overload event. When present, forces the line-based relay path so
+ * events are parsed even without a `rewriteModel`/`usageTap`.
+ */
+onSseEvent?: (event: Record<string, unknown>) => void): Promise<string | null>;
 /**
  * Aggregate a streaming Anthropic `text/event-stream` body into ONE buffered
  * Anthropic `message` JSON object — the inverse of the SDK's SSE wire format.

package/dist/provider-proxy/ingress/providerProxyShared.js

@@ -9,34 +9,37 @@ import {
   resolvePoolBoundKey,
   writeBoundAccountError,
   writeError
-} from "../../chunk-UDCC7EMR.js";
-import "../../chunk-WB6PH56J.js";
+} from "../../chunk-QYC54PMG.js";
 import "../../chunk-VVEHS2LI.js";
 import "../../chunk-46RLHI7D.js";
-import "../../chunk-WNKWAEUR.js";
-import "../../chunk-MZNPGW5Q.js";
-import "../../chunk-DK4A7DLE.js";
-import "../../chunk-VRFBB5DB.js";
+import "../../chunk-MYYR3HZL.js";
+import "../../chunk-PEGTIPB3.js";
 import "../../chunk-LVUCAWMK.js";
-import "../../chunk-OEWZUX4G.js";
+import "../../chunk-32O35CIF.js";
+import "../../chunk-FU7EAR73.js";
 import "../../chunk-LB6EBS6Y.js";
-import "../../chunk-6CL5HTPQ.js";
 import "../../chunk-7VU7V2E4.js";
-import "../../chunk-UX7VWA46.js";
-import "../../chunk-BPKCU575.js";
-import "../../chunk-DRWHTIIZ.js";
+import "../../chunk-FXR6N3SR.js";
+import "../../chunk-UAPBLNN2.js";
+import "../../chunk-WNKWAEUR.js";
+import "../../chunk-MZNPGW5Q.js";
+import "../../chunk-DK4A7DLE.js";
+import "../../chunk-XXFYLL7R.js";
 import "../../chunk-XTEI64OU.js";
 import "../../chunk-XX6NQJMA.js";
+import "../../chunk-GFIZ6LQI.js";
+import "../../chunk-OE6TDIWW.js";
+import "../../chunk-DRWHTIIZ.js";
+import "../../chunk-JWC6APFQ.js";
 import "../../chunk-5ERIZW3D.js";
-import "../../chunk-YJVHCHQX.js";
+import "../../chunk-PO3XB56Z.js";
+import "../../chunk-N7OOJI5V.js";
 import "../../chunk-23S5OPIO.js";
 import "../../chunk-AVYJ4YBN.js";
-import "../../chunk-OE6TDIWW.js";
 import "../../chunk-OPRS4IQZ.js";
 import "../../chunk-2JYRIADS.js";
 import "../../chunk-DE2SRBFZ.js";
 import "../../chunk-ZY6KU6P3.js";
-import "../../chunk-JWC6APFQ.js";
 import "../../chunk-WLYIIEAF.js";
 import "../../chunk-TKJMZBAH.js";
 import "../../chunk-3QFXFCHG.js";
@@ -44,16 +47,17 @@ import "../../chunk-EBLFCNPY.js";
 import "../../chunk-AQ5TNQB7.js";
 import "../../chunk-XEKD23J5.js";
 import "../../chunk-H5JUT3KV.js";
-import "../../chunk-IFXJ2BG7.js";
+import "../../chunk-7C7DET6S.js";
 import "../../chunk-K5NM7VAH.js";
 import "../../chunk-WNY4WMRF.js";
 import "../../chunk-OZFM4X3S.js";
-import "../../chunk-AT7B7SOZ.js";
+import "../../chunk-5NJLQ6T6.js";
 import "../../chunk-N5T4M4GU.js";
 import "../../chunk-TOVPMMHM.js";
-import "../../chunk-SIZQQD6T.js";
-import "../../chunk-SYQF7OIR.js";
+import "../../chunk-RJ5ZGNI3.js";
+import "../../chunk-3WD4HTR2.js";
 import "../../chunk-MKF46GNZ.js";
+import "../../chunk-GL6XM527.js";
 import "../../chunk-CDHS2QDC.js";
 import "../../chunk-Y7FO65VT.js";
 import "../../chunk-FMOBD2OQ.js";

package/dist/provider-proxy/matchText.cjs

@@ -5,7 +5,7 @@
 
 
 
-var _chunkEJLH6NFTcjs = require('../chunk-EJLH6NFT.cjs');
+var _chunkJ3QQ6JS5cjs = require('../chunk-J3QQ6JS5.cjs');
 
 
 
@@ -13,4 +13,4 @@ var _chunkEJLH6NFTcjs = require('../chunk-EJLH6NFT.cjs');
 
 
 
-exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkEJLH6NFTcjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkEJLH6NFTcjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkEJLH6NFTcjs.collectMatchText; exports.deriveGatewaySessionKey = _chunkEJLH6NFTcjs.deriveGatewaySessionKey; exports.deriveSubscriptionSessionKey = _chunkEJLH6NFTcjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkEJLH6NFTcjs.flattenMatchText;
+exports.MATCH_TEXT_PER_MESSAGE_CAP = _chunkJ3QQ6JS5cjs.MATCH_TEXT_PER_MESSAGE_CAP; exports.MATCH_TEXT_RECENT_MESSAGES = _chunkJ3QQ6JS5cjs.MATCH_TEXT_RECENT_MESSAGES; exports.collectMatchText = _chunkJ3QQ6JS5cjs.collectMatchText; exports.deriveGatewaySessionKey = _chunkJ3QQ6JS5cjs.deriveGatewaySessionKey; exports.deriveSubscriptionSessionKey = _chunkJ3QQ6JS5cjs.deriveSubscriptionSessionKey; exports.flattenMatchText = _chunkJ3QQ6JS5cjs.flattenMatchText;

package/dist/provider-proxy/matchText.d.cts

@@ -55,8 +55,6 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
-/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
- *  session-affinity bucket key (NOT a security primitive). */
 /**
  * Source used to derive a gateway session-affinity key. The value is kept
  * deliberately small and non-sensitive: callers only receive the hashed key,
@@ -88,7 +86,7 @@ type SessionRequestHeaders = Record<string, string | string[] | undefined>;
  * final fallback is route-scoped (api key/session + endpoint) so a request
  * with no usable metadata remains conservative and does not rotate accounts
  * on every turn. Raw ids and prompts are never returned or logged; only their
- * FNV-1a digest is exposed as `key`.
+ * truncated SHA-256 digest is exposed as `key`.
  */
 declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;
 

package/dist/provider-proxy/matchText.d.ts

@@ -55,8 +55,6 @@ declare function collectMatchText(anthropicBody: Record<string, unknown>): strin
  * SAME key for the same body.
  */
 declare function deriveSubscriptionSessionKey(anthropicBody: Record<string, unknown>): string | undefined;
-/** 32-bit FNV-1a hex digest — a small, dependency-free stable string hash for the
- *  session-affinity bucket key (NOT a security primitive). */
 /**
  * Source used to derive a gateway session-affinity key. The value is kept
  * deliberately small and non-sensitive: callers only receive the hashed key,
@@ -88,7 +86,7 @@ type SessionRequestHeaders = Record<string, string | string[] | undefined>;
  * final fallback is route-scoped (api key/session + endpoint) so a request
  * with no usable metadata remains conservative and does not rotate accounts
  * on every turn. Raw ids and prompts are never returned or logged; only their
- * FNV-1a digest is exposed as `key`.
+ * truncated SHA-256 digest is exposed as `key`.
  */
 declare function deriveGatewaySessionKey(body: Record<string, unknown>, headers?: SessionRequestHeaders, options?: GatewaySessionKeyOptions): DerivedSessionKey;
 

package/dist/provider-proxy/matchText.js

@@ -5,7 +5,7 @@ import {
   deriveGatewaySessionKey,
   deriveSubscriptionSessionKey,
   flattenMatchText
-} from "../chunk-WB6PH56J.js";
+} from "../chunk-GFIZ6LQI.js";
 export {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,

package/dist/provider-proxy/types.d.cts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { ThinkLevel } from '@omnicross/contracts/completion-types';
+import { UsageCacheKeySource } from '@omnicross/contracts/usage-stats-types';
 import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
@@ -49,6 +50,14 @@ type StreamEventCallback = (event: Record<string, unknown>) => void;
 interface ProxyAttribution {
     sessionId?: string | null;
     apiKeyId?: string | null;
+    /** Token-free Route Lease attribution; never contains the bearer token. */
+    routeLease?: RouteLeaseUsageAttribution | null;
+}
+interface RouteLeaseUsageAttribution {
+    readonly leaseId: string;
+    readonly consumer: string;
+    readonly runId?: string;
+    readonly stageId?: string;
 }
 /**
  * 1M-context opt-in for outbound Anthropic requests. Populated by
@@ -321,6 +330,8 @@ interface RouteContext {
      * `route.apiKeyId ?? null`), exactly as before.
      */
     readonly apiKeyId?: string;
+    /** Safe process-local lease attribution. The route token is intentionally absent. */
+    readonly routeLease?: RouteLeaseUsageAttribution;
     /** Wire format this route's ingress decodes. */
     readonly ingressFormat: IngressFormat;
     /** Re-auth mode (BYO key vs subscription OAuth). */
@@ -457,7 +468,15 @@ interface UsageRecordImportInput {
     usage: UsageTokens;
     rawUsage?: unknown;
     runId?: string | null;
+    /** Token-free managed-route attribution. */
+    routeLeaseId?: string | null;
+    routeLeaseConsumer?: string | null;
+    routeLeaseStageId?: string | null;
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
      * relay taps set this to the request's `http.ServerResponse` so the recorder can
@@ -466,4 +485,4 @@ interface UsageRecordImportInput {
     auditResponse?: object;
 }
 
-export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };
+export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, RouteLeaseUsageAttribution, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };

package/dist/provider-proxy/types.d.ts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { ThinkLevel } from '@omnicross/contracts/completion-types';
+import { UsageCacheKeySource } from '@omnicross/contracts/usage-stats-types';
 import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
@@ -49,6 +50,14 @@ type StreamEventCallback = (event: Record<string, unknown>) => void;
 interface ProxyAttribution {
     sessionId?: string | null;
     apiKeyId?: string | null;
+    /** Token-free Route Lease attribution; never contains the bearer token. */
+    routeLease?: RouteLeaseUsageAttribution | null;
+}
+interface RouteLeaseUsageAttribution {
+    readonly leaseId: string;
+    readonly consumer: string;
+    readonly runId?: string;
+    readonly stageId?: string;
 }
 /**
  * 1M-context opt-in for outbound Anthropic requests. Populated by
@@ -321,6 +330,8 @@ interface RouteContext {
      * `route.apiKeyId ?? null`), exactly as before.
      */
     readonly apiKeyId?: string;
+    /** Safe process-local lease attribution. The route token is intentionally absent. */
+    readonly routeLease?: RouteLeaseUsageAttribution;
     /** Wire format this route's ingress decodes. */
     readonly ingressFormat: IngressFormat;
     /** Re-auth mode (BYO key vs subscription OAuth). */
@@ -457,7 +468,15 @@ interface UsageRecordImportInput {
     usage: UsageTokens;
     rawUsage?: unknown;
     runId?: string | null;
+    /** Token-free managed-route attribution. */
+    routeLeaseId?: string | null;
+    routeLeaseConsumer?: string | null;
+    routeLeaseStageId?: string | null;
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
      * relay taps set this to the request's `http.ServerResponse` so the recorder can
@@ -466,4 +485,4 @@ interface UsageRecordImportInput {
     auditResponse?: object;
 }
 
-export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };
+export type { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProviderProxyDeps, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, RouteLeaseUsageAttribution, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat, UsageRecordImportInput, UsageRecorderImport };

package/dist/provider-proxy.cjs

@@ -5,34 +5,65 @@
 
 
 
-var _chunkSQYVORNPcjs = require('./chunk-SQYVORNP.cjs');
-require('./chunk-EJLH6NFT.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunk26K6T2YScjs = require('./chunk-26K6T2YS.cjs');
 require('./chunk-HQP3K7PU.cjs');
 require('./chunk-FZ46M34D.cjs');
-require('./chunk-IIRPUVPH.cjs');
-require('./chunk-GBHYAGX3.cjs');
-require('./chunk-3OPYJG76.cjs');
-require('./chunk-7AK7B36B.cjs');
+require('./chunk-2Z4XM3H5.cjs');
+require('./chunk-OXHNSZ53.cjs');
 require('./chunk-V4TXMEJS.cjs');
-require('./chunk-6VUQPOV3.cjs');
+require('./chunk-OVQBNVSV.cjs');
+require('./chunk-5RSZYQJH.cjs');
 require('./chunk-OF3BECU2.cjs');
-require('./chunk-4VLRHHFE.cjs');
 require('./chunk-EYZYXJTJ.cjs');
-require('./chunk-DLXZEZWO.cjs');
-require('./chunk-SNYBEXLB.cjs');
-require('./chunk-R3HK6R4B.cjs');
+require('./chunk-2E42SAW3.cjs');
+require('./chunk-EPN67EGP.cjs');
+require('./chunk-IIRPUVPH.cjs');
+require('./chunk-GBHYAGX3.cjs');
+require('./chunk-3OPYJG76.cjs');
+require('./chunk-3SCOLIPT.cjs');
 require('./chunk-RPII3E6Z.cjs');
 require('./chunk-6RPZADX3.cjs');
+require('./chunk-J3QQ6JS5.cjs');
+require('./chunk-UIBD2YY5.cjs');
+require('./chunk-R3HK6R4B.cjs');
+require('./chunk-QXD4MV2X.cjs');
 require('./chunk-NYUNU75A.cjs');
-require('./chunk-YK57NMIF.cjs');
+require('./chunk-OTZC4TNH.cjs');
+require('./chunk-YWL7YZWS.cjs');
 require('./chunk-YNJNTCSQ.cjs');
 require('./chunk-SVNDB62D.cjs');
-require('./chunk-UIBD2YY5.cjs');
 require('./chunk-6QQG7YG3.cjs');
 require('./chunk-25GXJCEZ.cjs');
 require('./chunk-MUHWHQVM.cjs');
 require('./chunk-Q27JY5RG.cjs');
-require('./chunk-QXD4MV2X.cjs');
 require('./chunk-APYG5QD7.cjs');
 require('./chunk-L74VDN4A.cjs');
 require('./chunk-4YINUUKQ.cjs');
@@ -40,16 +71,17 @@ require('./chunk-4VZX5F4T.cjs');
 require('./chunk-QBZJ7P2T.cjs');
 require('./chunk-4IH4EL7M.cjs');
 require('./chunk-A2YMUCBT.cjs');
-require('./chunk-UNWKG6EI.cjs');
+require('./chunk-XPIOJQS2.cjs');
 require('./chunk-FCR77GYM.cjs');
 require('./chunk-AEOZIDEB.cjs');
 require('./chunk-XSVNC2UD.cjs');
-require('./chunk-WYTEQ4Q5.cjs');
+require('./chunk-GDIXXKF2.cjs');
 require('./chunk-OKMJLEXX.cjs');
 require('./chunk-KBM2W6UY.cjs');
-require('./chunk-KCVJWJST.cjs');
-require('./chunk-3Z5BQZFM.cjs');
+require('./chunk-RJUONLUQ.cjs');
+require('./chunk-235MXAGX.cjs');
 require('./chunk-HVBBDBS3.cjs');
+require('./chunk-NKVZ6Z3Y.cjs');
 require('./chunk-NZYN7C3P.cjs');
 require('./chunk-JMJBSACD.cjs');
 require('./chunk-GMMT7RVN.cjs');
@@ -61,4 +93,32 @@ require('./chunk-UNEFIWXI.cjs');
 
 
 
-exports.DEFAULT_ROUTE_IDLE_MS = _chunkSQYVORNPcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunkSQYVORNPcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunkSQYVORNPcjs.ProviderProxyRouteMap; exports.__resetProviderProxyForTests = _chunkSQYVORNPcjs.__resetProviderProxyForTests; exports.extractRouteToken = _chunkSQYVORNPcjs.extractRouteToken; exports.getProviderProxy = _chunkSQYVORNPcjs.getProviderProxy;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_ROUTE_IDLE_MS = _chunk26K6T2YScjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunk26K6T2YScjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunk26K6T2YScjs.ProviderProxyRouteMap; exports.ROUTE_LEASE_API_VERSION = _chunk26K6T2YScjs.ROUTE_LEASE_API_VERSION; exports.ROUTE_LEASE_CAPABILITIES = _chunk26K6T2YScjs.ROUTE_LEASE_CAPABILITIES; exports.ROUTE_LEASE_CAPABILITIES_SCHEMA = _chunk26K6T2YScjs.ROUTE_LEASE_CAPABILITIES_SCHEMA; exports.ROUTE_LEASE_CODEX_TOKEN_ENV = _chunk26K6T2YScjs.ROUTE_LEASE_CODEX_TOKEN_ENV; exports.ROUTE_LEASE_DEFAULT_TTL_SECONDS = _chunk26K6T2YScjs.ROUTE_LEASE_DEFAULT_TTL_SECONDS; exports.ROUTE_LEASE_MAX_CONSUMER_BYTES = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_CONSUMER_BYTES; exports.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_EXECUTION_ID_BYTES; exports.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES; exports.ROUTE_LEASE_MAX_MODEL_BYTES = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_MODEL_BYTES; exports.ROUTE_LEASE_MAX_SESSION_ID_BYTES = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_SESSION_ID_BYTES; exports.ROUTE_LEASE_MAX_TTL_SECONDS = _chunk26K6T2YScjs.ROUTE_LEASE_MAX_TTL_SECONDS; exports.ROUTE_LEASE_REQUEST_SCHEMA = _chunk26K6T2YScjs.ROUTE_LEASE_REQUEST_SCHEMA; exports.ROUTE_LEASE_RESULT_SCHEMA = _chunk26K6T2YScjs.ROUTE_LEASE_RESULT_SCHEMA; exports.ROUTE_LEASE_RUNTIMES = _chunk26K6T2YScjs.ROUTE_LEASE_RUNTIMES; exports.ROUTE_LEASE_RUNTIME_TABLE = _chunk26K6T2YScjs.ROUTE_LEASE_RUNTIME_TABLE; exports.ROUTE_LEASE_SESSION_HASH_DOMAIN = _chunk26K6T2YScjs.ROUTE_LEASE_SESSION_HASH_DOMAIN; exports.RouteLeaseError = _chunk26K6T2YScjs.RouteLeaseError; exports.RouteLeaseManager = _chunk26K6T2YScjs.RouteLeaseManager; exports.RouteLeaseTargetResolver = _chunk26K6T2YScjs.RouteLeaseTargetResolver; exports.SYSTEM_ROUTE_LEASE_CLOCK = _chunk26K6T2YScjs.SYSTEM_ROUTE_LEASE_CLOCK; exports.__resetProviderProxyForTests = _chunk26K6T2YScjs.__resetProviderProxyForTests; exports.canonicalizeRouteLeasePayload = _chunk26K6T2YScjs.canonicalizeRouteLeasePayload; exports.extractRouteToken = _chunk26K6T2YScjs.extractRouteToken; exports.getProviderProxy = _chunk26K6T2YScjs.getProviderProxy; exports.hashRouteLeasePayload = _chunk26K6T2YScjs.hashRouteLeasePayload; exports.hashRouteLeaseSessionId = _chunk26K6T2YScjs.hashRouteLeaseSessionId; exports.isLoopbackAddress = _chunk26K6T2YScjs.isLoopbackAddress; exports.normalizeRouteLeaseIdempotencyKey = _chunk26K6T2YScjs.normalizeRouteLeaseIdempotencyKey; exports.normalizeRouteLeaseTtl = _chunk26K6T2YScjs.normalizeRouteLeaseTtl; exports.parseRouteLeaseCreate = _chunk26K6T2YScjs.parseRouteLeaseCreate; exports.routeLeaseRuntime = _chunk26K6T2YScjs.routeLeaseRuntime;