@omnicross/core 0.4.3 → 0.4.5

package/dist/pipeline/AccountRouteActivity.d.cts

@@ -1,18 +1,40 @@
 /**
- * Bounded, metadata-only history of subscription account routing decisions.
+ * Bounded, metadata-only history of upstream routing decisions.
  *
  * Records are created at the shared upstream fetch seam, after authentication has
- * reported the account that will actually serve the request. The store is
- * intentionally process-local: it is useful for live operator diagnostics without
- * turning session/account affinity into a durable tracking database.
+ * reported the credential that will actually serve the request. TWO credential
+ * kinds share one timeline: subscription POOL ACCOUNTS (`credentialKind:
+ * 'subscription-account'`, identified by `accountId`) and BYO provider API KEYS
+ * (`credentialKind: 'provider-key'`, identified by `keyId` when the ApiKeyPool
+ * bound one). The store is intentionally process-local: it is useful for live
+ * operator diagnostics without turning session/account affinity into a durable
+ * tracking database.
  */
 declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
-type AccountRouteEndpoint = 'responses' | 'messages';
-type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteEndpoint = 'responses' | 'messages' | 'chat' | 'generateContent';
+/**
+ * Which kind of upstream credential a row attributes. Absent on records minted
+ * by older callers — those are subscription-account rows (the historical only
+ * kind), so the DEFAULT is `'subscription-account'`.
+ */
+type RouteCredentialKind = 'subscription-account' | 'provider-key';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'route-session-id' | 'none';
 type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
 interface AccountRouteActivityInput {
+    /**
+     * Display provider id: a subscription provider id (`claude`/`codex`/…) for
+     * account rows, the PROVIDER ROW id for provider-key rows. This is NOT the
+     * egress proxy key (`'byo'`) — it must be the id an operator recognizes.
+     */
     providerId: string;
-    accountId: string;
+    /** Which kind of credential served the request. Defaults to
+     *  `'subscription-account'` for back-compat with older callers. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription pool account id (required for `subscription-account` rows). */
+    accountId?: string;
+    /** ApiKeyPool key id when known (provider-key rows). Metadata only — the key
+     *  STRING never enters this store. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;
@@ -33,11 +55,14 @@ interface AccountRouteActivityRecord extends AccountRouteActivityInput {
     ts: number;
     affinity: AccountRouteAffinity;
     previousAccountId?: string;
+    /** For `provider-key` rows whose session switched keys (pool rotation). */
+    previousKeyId?: string;
 }
 interface AccountRouteActivityQuery {
     providerId?: string;
     accountId?: string;
     sessionKey?: string;
+    credentialKind?: RouteCredentialKind;
     limit?: number;
 }
 declare class AccountRouteActivityStore {
@@ -58,4 +83,4 @@ declare class AccountRouteActivityStore {
 }
 declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
 
-export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, type RouteCredentialKind, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.d.ts

@@ -1,18 +1,40 @@
 /**
- * Bounded, metadata-only history of subscription account routing decisions.
+ * Bounded, metadata-only history of upstream routing decisions.
  *
  * Records are created at the shared upstream fetch seam, after authentication has
- * reported the account that will actually serve the request. The store is
- * intentionally process-local: it is useful for live operator diagnostics without
- * turning session/account affinity into a durable tracking database.
+ * reported the credential that will actually serve the request. TWO credential
+ * kinds share one timeline: subscription POOL ACCOUNTS (`credentialKind:
+ * 'subscription-account'`, identified by `accountId`) and BYO provider API KEYS
+ * (`credentialKind: 'provider-key'`, identified by `keyId` when the ApiKeyPool
+ * bound one). The store is intentionally process-local: it is useful for live
+ * operator diagnostics without turning session/account affinity into a durable
+ * tracking database.
  */
 declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
-type AccountRouteEndpoint = 'responses' | 'messages';
-type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteEndpoint = 'responses' | 'messages' | 'chat' | 'generateContent';
+/**
+ * Which kind of upstream credential a row attributes. Absent on records minted
+ * by older callers — those are subscription-account rows (the historical only
+ * kind), so the DEFAULT is `'subscription-account'`.
+ */
+type RouteCredentialKind = 'subscription-account' | 'provider-key';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'route-session-id' | 'none';
 type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
 interface AccountRouteActivityInput {
+    /**
+     * Display provider id: a subscription provider id (`claude`/`codex`/…) for
+     * account rows, the PROVIDER ROW id for provider-key rows. This is NOT the
+     * egress proxy key (`'byo'`) — it must be the id an operator recognizes.
+     */
     providerId: string;
-    accountId: string;
+    /** Which kind of credential served the request. Defaults to
+     *  `'subscription-account'` for back-compat with older callers. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription pool account id (required for `subscription-account` rows). */
+    accountId?: string;
+    /** ApiKeyPool key id when known (provider-key rows). Metadata only — the key
+     *  STRING never enters this store. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;
@@ -33,11 +55,14 @@ interface AccountRouteActivityRecord extends AccountRouteActivityInput {
     ts: number;
     affinity: AccountRouteAffinity;
     previousAccountId?: string;
+    /** For `provider-key` rows whose session switched keys (pool rotation). */
+    previousKeyId?: string;
 }
 interface AccountRouteActivityQuery {
     providerId?: string;
     accountId?: string;
     sessionKey?: string;
+    credentialKind?: RouteCredentialKind;
     limit?: number;
 }
 declare class AccountRouteActivityStore {
@@ -58,4 +83,4 @@ declare class AccountRouteActivityStore {
 }
 declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
 
-export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, type RouteCredentialKind, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.js

@@ -2,7 +2,7 @@ import {
   ACCOUNT_ROUTE_ACTIVITY_LIMIT,
   AccountRouteActivityStore,
   getSharedAccountRouteActivity
-} from "../chunk-GL6XM527.js";
+} from "../chunk-TX7ZM4OI.js";
 export {
   ACCOUNT_ROUTE_ACTIVITY_LIMIT,
   AccountRouteActivityStore,

package/dist/pipeline/upstreamFetch.cjs

@@ -4,14 +4,14 @@
 
 
 
-var _chunkVFFCV4J6cjs = require('../chunk-VFFCV4J6.cjs');
+var _chunkCXRJMNJJcjs = require('../chunk-CXRJMNJJ.cjs');
 require('../chunk-235MXAGX.cjs');
 require('../chunk-VYOBVPNB.cjs');
-require('../chunk-NKVZ6Z3Y.cjs');
+require('../chunk-4HMAS74X.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkVFFCV4J6cjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkVFFCV4J6cjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkVFFCV4J6cjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkVFFCV4J6cjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkVFFCV4J6cjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkCXRJMNJJcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkCXRJMNJJcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkCXRJMNJJcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkCXRJMNJJcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkCXRJMNJJcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -1,6 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
-import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
+import { RouteCredentialKind, AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -39,6 +39,20 @@ import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRe
  */
 
 interface AccountRouteActivityContext {
+    /**
+     * DISPLAY provider id for the row: the subscription provider id
+     * (`claude`/`codex`/…) for account rows, or the PROVIDER ROW id for BYO
+     * provider-key rows. Deliberately NOT the egress ctx's `providerId` for BYO —
+     * that is the proxy-layer key, the literal `'byo'`, useless as a row identity.
+     * Falls back to `ctx.providerId` when absent (legacy account-row callers).
+     */
+    providerId?: string;
+    /** Which credential kind served the call. Defaults `subscription-account`. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription account id — required to record an account row. */
+    accountId?: string;
+    /** ApiKeyPool key id for provider-key rows, when the pool bound one. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;

package/dist/pipeline/upstreamFetch.d.ts

@@ -1,6 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
-import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
+import { RouteCredentialKind, AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -39,6 +39,20 @@ import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRe
  */
 
 interface AccountRouteActivityContext {
+    /**
+     * DISPLAY provider id for the row: the subscription provider id
+     * (`claude`/`codex`/…) for account rows, or the PROVIDER ROW id for BYO
+     * provider-key rows. Deliberately NOT the egress ctx's `providerId` for BYO —
+     * that is the proxy-layer key, the literal `'byo'`, useless as a row identity.
+     * Falls back to `ctx.providerId` when absent (legacy account-row callers).
+     */
+    providerId?: string;
+    /** Which credential kind served the call. Defaults `subscription-account`. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription account id — required to record an account row. */
+    accountId?: string;
+    /** ApiKeyPool key id for provider-key rows, when the pool bound one. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;

package/dist/pipeline/upstreamFetch.js

@@ -4,10 +4,10 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-NTF7TLT7.js";
+} from "../chunk-LBIXTHP7.js";
 import "../chunk-3WD4HTR2.js";
 import "../chunk-FYPKKMB3.js";
-import "../chunk-GL6XM527.js";
+import "../chunk-TX7ZM4OI.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,

package/dist/ports.d.cts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.cjs';
 export { UsageEventStore } from './ports/usage-event-store.cjs';
 export { WebSearchBackend } from './ports/web-search-backend.cjs';
 export { U as UsageSink } from './types-BSIJdsyl.cjs';
-export { O as OutboundCredentialStore } from './types-C6m-Db26.cjs';
+export { O as OutboundCredentialStore } from './types-Dt1bgHPg.cjs';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';

package/dist/ports.d.ts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.js';
 export { UsageEventStore } from './ports/usage-event-store.js';
 export { WebSearchBackend } from './ports/web-search-backend.js';
 export { U as UsageSink } from './types-By9Tg6-I.js';
-export { O as OutboundCredentialStore } from './types-Da735j2d.js';
+export { O as OutboundCredentialStore } from './types-IRPv4i1Y.js';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,17 +1,17 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkJ5XMB5KYcjs = require('../chunk-J5XMB5KY.cjs');
+var _chunkNCCEWVWYcjs = require('../chunk-NCCEWVWY.cjs');
 require('../chunk-QVOB2DNX.cjs');
-require('../chunk-UOOLU64V.cjs');
+require('../chunk-LVQOCIES.cjs');
 require('../chunk-NOITAVHA.cjs');
 require('../chunk-QWNUOR7F.cjs');
 require('../chunk-47E3I5PF.cjs');
 require('../chunk-5RSZYQJH.cjs');
 require('../chunk-VGBJPHHD.cjs');
-require('../chunk-CGEZQC2G.cjs');
-require('../chunk-X6GHTNDL.cjs');
-require('../chunk-E5RCCGE7.cjs');
+require('../chunk-F3TT5XPV.cjs');
+require('../chunk-ZG57GAVU.cjs');
+require('../chunk-DF5JXK36.cjs');
 require('../chunk-BTSADEX4.cjs');
 require('../chunk-32SRZFFP.cjs');
 require('../chunk-2E42SAW3.cjs');
@@ -22,10 +22,10 @@ require('../chunk-3OPYJG76.cjs');
 require('../chunk-J3QQ6JS5.cjs');
 require('../chunk-E4QHVXV5.cjs');
 require('../chunk-HQP3K7PU.cjs');
-require('../chunk-AFH5CEMF.cjs');
+require('../chunk-SQU2FGXI.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
-require('../chunk-WYECWQ3J.cjs');
+require('../chunk-2DMOOZ4F.cjs');
 require('../chunk-UKQHBK4Q.cjs');
 require('../chunk-UIBD2YY5.cjs');
 require('../chunk-R3HK6R4B.cjs');
@@ -55,19 +55,19 @@ require('../chunk-GMMT7RVN.cjs');
 require('../chunk-UNEFIWXI.cjs');
 require('../chunk-A2YMUCBT.cjs');
 require('../chunk-GDIXXKF2.cjs');
-require('../chunk-NDIBVTBZ.cjs');
+require('../chunk-XYFCNDJK.cjs');
 require('../chunk-N3MGNLCU.cjs');
 require('../chunk-4NAMH4UE.cjs');
 require('../chunk-77USGNRW.cjs');
 require('../chunk-IUL4VWNU.cjs');
-require('../chunk-VFFCV4J6.cjs');
+require('../chunk-CXRJMNJJ.cjs');
 require('../chunk-235MXAGX.cjs');
 require('../chunk-VYOBVPNB.cjs');
-require('../chunk-NKVZ6Z3Y.cjs');
+require('../chunk-4HMAS74X.cjs');
 require('../chunk-INY54AYX.cjs');
 require('../chunk-G4CZIUIB.cjs');
 require('../chunk-2RCCLQYV.cjs');
 
 
 
-exports.ProviderProxy = _chunkJ5XMB5KYcjs.ProviderProxy; exports.isLoopbackAddress = _chunkJ5XMB5KYcjs.isLoopbackAddress;
+exports.ProviderProxy = _chunkNCCEWVWYcjs.ProviderProxy; exports.isLoopbackAddress = _chunkNCCEWVWYcjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.js

@@ -1,17 +1,17 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-SWY2LTMR.js";
+} from "../chunk-L4L77G3X.js";
 import "../chunk-WTQMX2Q6.js";
-import "../chunk-MPFOC7AT.js";
+import "../chunk-24W3DVGI.js";
 import "../chunk-V53ZEFXC.js";
 import "../chunk-7PIUVCKK.js";
 import "../chunk-TKZ3DZS5.js";
 import "../chunk-FU7EAR73.js";
 import "../chunk-IDPMD4B7.js";
-import "../chunk-K6J2RIEX.js";
-import "../chunk-ZJJBITUN.js";
-import "../chunk-F6P4DIBL.js";
+import "../chunk-NDJSLJIA.js";
+import "../chunk-IAWLTZUP.js";
+import "../chunk-TLYFFUW4.js";
 import "../chunk-OXBGNEYR.js";
 import "../chunk-QIIAMBTM.js";
 import "../chunk-FXR6N3SR.js";
@@ -22,10 +22,10 @@ import "../chunk-DK4A7DLE.js";
 import "../chunk-GFIZ6LQI.js";
 import "../chunk-MZEGQSKQ.js";
 import "../chunk-VVEHS2LI.js";
-import "../chunk-M6PKXP6T.js";
+import "../chunk-4LSZ7NFM.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
-import "../chunk-HRBXQ5AC.js";
+import "../chunk-WYUXJKMK.js";
 import "../chunk-ONTTXSRL.js";
 import "../chunk-OE6TDIWW.js";
 import "../chunk-DRWHTIIZ.js";
@@ -55,15 +55,15 @@ import "../chunk-FMOBD2OQ.js";
 import "../chunk-HUZZZ3JL.js";
 import "../chunk-H5JUT3KV.js";
 import "../chunk-5NJLQ6T6.js";
-import "../chunk-EE7VP4O3.js";
+import "../chunk-HQ7C3VB6.js";
 import "../chunk-QSOHEDKO.js";
 import "../chunk-YEHQ5FXZ.js";
 import "../chunk-WYVGULTQ.js";
 import "../chunk-ZLNHPUFA.js";
-import "../chunk-NTF7TLT7.js";
+import "../chunk-LBIXTHP7.js";
 import "../chunk-3WD4HTR2.js";
 import "../chunk-FYPKKMB3.js";
-import "../chunk-GL6XM527.js";
+import "../chunk-TX7ZM4OI.js";
 import "../chunk-4RM22ETG.js";
 import "../chunk-4JOU54M5.js";
 import "../chunk-4PFWFODB.js";

package/dist/provider-proxy/identity/codexCliHeaders.cjs

@@ -2,7 +2,9 @@
 
 
 
-var _chunkAFH5CEMFcjs = require('../../chunk-AFH5CEMF.cjs');
+
+
+var _chunkSQU2FGXIcjs = require('../../chunk-SQU2FGXI.cjs');
 
 
 var _chunkUKQHBK4Qcjs = require('../../chunk-UKQHBK4Q.cjs');
@@ -11,4 +13,6 @@ var _chunkUKQHBK4Qcjs = require('../../chunk-UKQHBK4Q.cjs');
 
 
 
-exports.DEFAULT_CODEX_CLI_HEADERS = _chunkAFH5CEMFcjs.DEFAULT_CODEX_CLI_HEADERS; exports.codexAcceptHeader = _chunkAFH5CEMFcjs.codexAcceptHeader; exports.extractCodexClientHeaders = _chunkAFH5CEMFcjs.extractCodexClientHeaders; exports.fillMissingHeaders = _chunkUKQHBK4Qcjs.fillMissingHeaders;
+
+
+exports.CODEX_ORIGINATOR_MARKER = _chunkSQU2FGXIcjs.CODEX_ORIGINATOR_MARKER; exports.DEFAULT_CODEX_CLI_HEADERS = _chunkSQU2FGXIcjs.DEFAULT_CODEX_CLI_HEADERS; exports.codexAcceptHeader = _chunkSQU2FGXIcjs.codexAcceptHeader; exports.extractCodexClientHeaders = _chunkSQU2FGXIcjs.extractCodexClientHeaders; exports.fillMissingCodexCliIdentity = _chunkSQU2FGXIcjs.fillMissingCodexCliIdentity; exports.fillMissingHeaders = _chunkUKQHBK4Qcjs.fillMissingHeaders;

package/dist/provider-proxy/identity/codexCliHeaders.d.cts

@@ -36,24 +36,55 @@ declare function fillMissingHeaders(headers: Record<string, string>, source: Rea
  *
  * NOT DONE HERE (deliberate, see the relay call site):
  *  - `chatgpt-account-id`: compatible implementations send the ChatGPT account
- *    id parsed out of the OAuth `id_token`. Guessing it wrong risks a 403 on a
- *    path that currently works, so it is left to a follow-up that can verify it.
- *  - forcing `store: false` on the body: a body mutation with its own regression
- *    surface, tracked separately.
+ *    id parsed out of the OAuth `id_token`. Verified 2026-09-12 against the
+ *    live backend: the header is NOT required (a request without it authorizes
+ *    fine), so it stays omitted — sending a guessed id risks a 403.
+ *  - forcing `store: false` on the body: DONE since 2026-09-12 in the driver's
+ *    `applyPlanAuth` — the backend now 400s any /codex/responses call without
+ *    it (`{"detail":"Store must be set to false"}`).
  *
  * @module provider-proxy/identity/codexCliHeaders
  */
 
 /**
- * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
- * the caller left empty — a forwarded real value always wins, so a genuine Codex
- * CLI keeps its own identity and only a caller that sent nothing gets these.
+ * Client markers a real `codex` CLI invocation carries. This is the COMPLETE
+ * synthetic persona spread onto a caller that brought NO identity of its own
+ * (no `user-agent`) — originator + a coherent (user-agent, version) pair.
  *
- * `originator` is the load-bearing one: it is how the backend tells the Codex
- * CLI apart from a generic Responses client, so compatible relays send it
- * unconditionally.
+ * NEVER applied under a caller's own `user-agent`: see
+ * `fillMissingCodexCliIdentity` for why a fabricated `version` there is not
+ * merely cosmetic but a hard failure.
+ *
+ * The pinned version is a floor for anonymous traffic only and WILL drift from
+ * the real CLI — acceptable because the backend's per-model minimum-version
+ * gate is the one place it matters, and an absent `version` passes that gate.
  */
 declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * The always-safe marker: how the backend tells the Codex CLI apart from a
+ * generic Responses client. Filled for EVERY codex-subscription caller, real
+ * client or not — compatible relays send it unconditionally.
+ */
+declare const CODEX_ORIGINATOR_MARKER: Readonly<Record<string, string>>;
+/**
+ * Fill the codex client-identity markers a caller left empty — WITHOUT ever
+ * fabricating a `version` under a caller that brought its own `user-agent`.
+ *
+ * WHY THE SPLIT (2026-09 incident): the ChatGPT backend gates newer models on
+ * the request's client `version` header — `gpt-6-astra` answered a relayed
+ * `version: 0.144.5` with
+ *   `The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade…`
+ * even though the caller WAS the latest CLI (0.153.4): the Codex CLI only
+ * attaches its `version` header to the BUILT-IN openai provider, so a custom
+ * provider (this relay) arrives without one, and the old unconditional fill
+ * pinned a stale number under the caller's real UA. A caller that omits
+ * `version` goes WITHOUT one — the exact shape compatible relays send and the
+ * anthropic-path egress has always used, which the backend accepts.
+ *
+ * So: real client (own `user-agent`) ⇒ originator only; anonymous caller ⇒
+ * the full coherent persona above.
+ */
+declare function fillMissingCodexCliIdentity(headers: Record<string, string>): void;
 /**
  * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
  * passing along what the client actually sent is not fingerprint synthesis.
@@ -62,4 +93,4 @@ declare function extractCodexClientHeaders(reqHeaders: Record<string, string | s
 /** The `accept` a Codex CLI sends, which differs by streaming mode. */
 declare function codexAcceptHeader(isStream: boolean): string;
 
-export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders, fillMissingHeaders };
+export { CODEX_ORIGINATOR_MARKER, DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders, fillMissingCodexCliIdentity, fillMissingHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.d.ts

@@ -36,24 +36,55 @@ declare function fillMissingHeaders(headers: Record<string, string>, source: Rea
  *
  * NOT DONE HERE (deliberate, see the relay call site):
  *  - `chatgpt-account-id`: compatible implementations send the ChatGPT account
- *    id parsed out of the OAuth `id_token`. Guessing it wrong risks a 403 on a
- *    path that currently works, so it is left to a follow-up that can verify it.
- *  - forcing `store: false` on the body: a body mutation with its own regression
- *    surface, tracked separately.
+ *    id parsed out of the OAuth `id_token`. Verified 2026-09-12 against the
+ *    live backend: the header is NOT required (a request without it authorizes
+ *    fine), so it stays omitted — sending a guessed id risks a 403.
+ *  - forcing `store: false` on the body: DONE since 2026-09-12 in the driver's
+ *    `applyPlanAuth` — the backend now 400s any /codex/responses call without
+ *    it (`{"detail":"Store must be set to false"}`).
  *
  * @module provider-proxy/identity/codexCliHeaders
  */
 
 /**
- * Client markers a real `codex` CLI invocation carries. Used ONLY to fill a slot
- * the caller left empty — a forwarded real value always wins, so a genuine Codex
- * CLI keeps its own identity and only a caller that sent nothing gets these.
+ * Client markers a real `codex` CLI invocation carries. This is the COMPLETE
+ * synthetic persona spread onto a caller that brought NO identity of its own
+ * (no `user-agent`) — originator + a coherent (user-agent, version) pair.
  *
- * `originator` is the load-bearing one: it is how the backend tells the Codex
- * CLI apart from a generic Responses client, so compatible relays send it
- * unconditionally.
+ * NEVER applied under a caller's own `user-agent`: see
+ * `fillMissingCodexCliIdentity` for why a fabricated `version` there is not
+ * merely cosmetic but a hard failure.
+ *
+ * The pinned version is a floor for anonymous traffic only and WILL drift from
+ * the real CLI — acceptable because the backend's per-model minimum-version
+ * gate is the one place it matters, and an absent `version` passes that gate.
  */
 declare const DEFAULT_CODEX_CLI_HEADERS: Readonly<Record<string, string>>;
+/**
+ * The always-safe marker: how the backend tells the Codex CLI apart from a
+ * generic Responses client. Filled for EVERY codex-subscription caller, real
+ * client or not — compatible relays send it unconditionally.
+ */
+declare const CODEX_ORIGINATOR_MARKER: Readonly<Record<string, string>>;
+/**
+ * Fill the codex client-identity markers a caller left empty — WITHOUT ever
+ * fabricating a `version` under a caller that brought its own `user-agent`.
+ *
+ * WHY THE SPLIT (2026-09 incident): the ChatGPT backend gates newer models on
+ * the request's client `version` header — `gpt-6-astra` answered a relayed
+ * `version: 0.144.5` with
+ *   `The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade…`
+ * even though the caller WAS the latest CLI (0.153.4): the Codex CLI only
+ * attaches its `version` header to the BUILT-IN openai provider, so a custom
+ * provider (this relay) arrives without one, and the old unconditional fill
+ * pinned a stale number under the caller's real UA. A caller that omits
+ * `version` goes WITHOUT one — the exact shape compatible relays send and the
+ * anthropic-path egress has always used, which the backend accepts.
+ *
+ * So: real client (own `user-agent`) ⇒ originator only; anonymous caller ⇒
+ * the full coherent persona above.
+ */
+declare function fillMissingCodexCliIdentity(headers: Record<string, string>): void;
 /**
  * Extract the caller's forwardable Codex CLI headers (lowercased keys). Ungated:
  * passing along what the client actually sent is not fingerprint synthesis.
@@ -62,4 +93,4 @@ declare function extractCodexClientHeaders(reqHeaders: Record<string, string | s
 /** The `accept` a Codex CLI sends, which differs by streaming mode. */
 declare function codexAcceptHeader(isStream: boolean): string;
 
-export { DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders, fillMissingHeaders };
+export { CODEX_ORIGINATOR_MARKER, DEFAULT_CODEX_CLI_HEADERS, codexAcceptHeader, extractCodexClientHeaders, fillMissingCodexCliIdentity, fillMissingHeaders };

package/dist/provider-proxy/identity/codexCliHeaders.js

@@ -1,14 +1,18 @@
 import {
+  CODEX_ORIGINATOR_MARKER,
   DEFAULT_CODEX_CLI_HEADERS,
   codexAcceptHeader,
-  extractCodexClientHeaders
-} from "../../chunk-M6PKXP6T.js";
+  extractCodexClientHeaders,
+  fillMissingCodexCliIdentity
+} from "../../chunk-4LSZ7NFM.js";
 import {
   fillMissingHeaders
 } from "../../chunk-ONTTXSRL.js";
 export {
+  CODEX_ORIGINATOR_MARKER,
   DEFAULT_CODEX_CLI_HEADERS,
   codexAcceptHeader,
   extractCodexClientHeaders,
+  fillMissingCodexCliIdentity,
   fillMissingHeaders
 };

package/dist/provider-proxy/identity/openCodeGoHeaders.cjs

@@ -5,7 +5,7 @@
 
 
 
-var _chunkWYECWQ3Jcjs = require('../../chunk-WYECWQ3J.cjs');
+var _chunk2DMOOZ4Fcjs = require('../../chunk-2DMOOZ4F.cjs');
 require('../../chunk-UKQHBK4Q.cjs');
 
 
@@ -14,4 +14,4 @@ require('../../chunk-UKQHBK4Q.cjs');
 
 
 
-exports.OPENCODE_SESSION_HEADER = _chunkWYECWQ3Jcjs.OPENCODE_SESSION_HEADER; exports.__resetOpenCodeGoHeadersForTests = _chunkWYECWQ3Jcjs.__resetOpenCodeGoHeadersForTests; exports.extractOpenCodeSessionHeader = _chunkWYECWQ3Jcjs.extractOpenCodeSessionHeader; exports.getOpenCodeGoUserAgent = _chunkWYECWQ3Jcjs.getOpenCodeGoUserAgent; exports.resolveOpenCodeSessionHeader = _chunkWYECWQ3Jcjs.resolveOpenCodeSessionHeader; exports.setOpenCodeGoUserAgent = _chunkWYECWQ3Jcjs.setOpenCodeGoUserAgent;
+exports.OPENCODE_SESSION_HEADER = _chunk2DMOOZ4Fcjs.OPENCODE_SESSION_HEADER; exports.__resetOpenCodeGoHeadersForTests = _chunk2DMOOZ4Fcjs.__resetOpenCodeGoHeadersForTests; exports.extractOpenCodeSessionHeader = _chunk2DMOOZ4Fcjs.extractOpenCodeSessionHeader; exports.getOpenCodeGoUserAgent = _chunk2DMOOZ4Fcjs.getOpenCodeGoUserAgent; exports.resolveOpenCodeSessionHeader = _chunk2DMOOZ4Fcjs.resolveOpenCodeSessionHeader; exports.setOpenCodeGoUserAgent = _chunk2DMOOZ4Fcjs.setOpenCodeGoUserAgent;

package/dist/provider-proxy/identity/openCodeGoHeaders.js

@@ -5,7 +5,7 @@ import {
   getOpenCodeGoUserAgent,
   resolveOpenCodeSessionHeader,
   setOpenCodeGoUserAgent
-} from "../../chunk-HRBXQ5AC.js";
+} from "../../chunk-WYUXJKMK.js";
 import "../../chunk-ONTTXSRL.js";
 export {
   OPENCODE_SESSION_HEADER,