@omnicross/core 0.4.4 → 0.4.6

package/dist/pipeline/SubscriptionAuthSource.d.ts

@@ -89,6 +89,17 @@ interface SubscriptionAuthProfile {
      * byte-identity).
      */
     readonly resolveProviderTransformerNames?: (model: string, config?: unknown) => readonly string[];
+    /**
+     * OPTIONAL chat-bridge-only chain-name resolver (openai-chat-bridge OQ1
+     * closure). The OpenAI-chat ingress consults it INSTEAD of
+     * `resolveProviderTransformerNames`/`providerTransformerNames` because a chat
+     * caller's wire is Unified: an anthropic-shape upstream needs the
+     * `['anthropic']` ENCODER, whereas the messages path's same-shape `[]` means
+     * "the caller already speaks Anthropic" — different answers for the same
+     * shape. Only opencodego sets it; absent ⇒ the chat ingress keeps the static
+     * `providerTransformerNames` (claude/kimi/grok route-to chains).
+     */
+    readonly chatBridgeTransformerNames?: (model: string, config?: unknown) => readonly string[];
     /**
      * Pass-through (claude) vs transformer (codex / opencodego / gemini). The
      * built-in `/v1/messages` subscription path (RT2.1) reads this for its

package/dist/pipeline/upstreamFetch.cjs

@@ -4,14 +4,14 @@
 
 
 
-var _chunkVFFCV4J6cjs = require('../chunk-VFFCV4J6.cjs');
+var _chunkCXRJMNJJcjs = require('../chunk-CXRJMNJJ.cjs');
 require('../chunk-235MXAGX.cjs');
 require('../chunk-VYOBVPNB.cjs');
-require('../chunk-NKVZ6Z3Y.cjs');
+require('../chunk-4HMAS74X.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkVFFCV4J6cjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkVFFCV4J6cjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkVFFCV4J6cjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkVFFCV4J6cjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkVFFCV4J6cjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkCXRJMNJJcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkCXRJMNJJcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkCXRJMNJJcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkCXRJMNJJcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkCXRJMNJJcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -1,6 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
-import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
+import { RouteCredentialKind, AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -39,6 +39,20 @@ import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRe
  */
 
 interface AccountRouteActivityContext {
+    /**
+     * DISPLAY provider id for the row: the subscription provider id
+     * (`claude`/`codex`/…) for account rows, or the PROVIDER ROW id for BYO
+     * provider-key rows. Deliberately NOT the egress ctx's `providerId` for BYO —
+     * that is the proxy-layer key, the literal `'byo'`, useless as a row identity.
+     * Falls back to `ctx.providerId` when absent (legacy account-row callers).
+     */
+    providerId?: string;
+    /** Which credential kind served the call. Defaults `subscription-account`. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription account id — required to record an account row. */
+    accountId?: string;
+    /** ApiKeyPool key id for provider-key rows, when the pool bound one. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;

package/dist/pipeline/upstreamFetch.d.ts

@@ -1,6 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
-import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
+import { RouteCredentialKind, AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -39,6 +39,20 @@ import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRe
  */
 
 interface AccountRouteActivityContext {
+    /**
+     * DISPLAY provider id for the row: the subscription provider id
+     * (`claude`/`codex`/…) for account rows, or the PROVIDER ROW id for BYO
+     * provider-key rows. Deliberately NOT the egress ctx's `providerId` for BYO —
+     * that is the proxy-layer key, the literal `'byo'`, useless as a row identity.
+     * Falls back to `ctx.providerId` when absent (legacy account-row callers).
+     */
+    providerId?: string;
+    /** Which credential kind served the call. Defaults `subscription-account`. */
+    credentialKind?: RouteCredentialKind;
+    /** Subscription account id — required to record an account row. */
+    accountId?: string;
+    /** ApiKeyPool key id for provider-key rows, when the pool bound one. */
+    keyId?: string;
     endpoint: AccountRouteEndpoint;
     sessionKey?: string;
     sessionSource: AccountRouteSessionSource;

package/dist/pipeline/upstreamFetch.js

@@ -4,10 +4,10 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-NTF7TLT7.js";
+} from "../chunk-LBIXTHP7.js";
 import "../chunk-3WD4HTR2.js";
 import "../chunk-FYPKKMB3.js";
-import "../chunk-GL6XM527.js";
+import "../chunk-TX7ZM4OI.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,

package/dist/ports.d.cts

@@ -4,8 +4,8 @@ export { AutomaticPricingSource, PricingStore } from './ports/pricing-store.cjs'
 export { ProviderConfigSource } from './ports/provider-config-source.cjs';
 export { UsageEventStore } from './ports/usage-event-store.cjs';
 export { WebSearchBackend } from './ports/web-search-backend.cjs';
-export { U as UsageSink } from './types-BSIJdsyl.cjs';
-export { O as OutboundCredentialStore } from './types-C6m-Db26.cjs';
+export { U as UsageSink } from './types-Dpr5IAaP.cjs';
+export { O as OutboundCredentialStore } from './types-BpSkj2JA.cjs';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';
@@ -25,7 +25,7 @@ import './frontends-Doz0RaWu.cjs';
 import '@omnicross/contracts/search-types';
 import './runtime-t8AZacFF.cjs';
 import '@omnicross/contracts/image-generation-types';
-import './types-BVwJQ9ZS.cjs';
+import './types-BsZ1s_a_.cjs';
 import 'node:fs/promises';
 import '@omnicross/contracts/account-tokens-types';
 import '@omnicross/contracts/audit-types';
@@ -33,6 +33,6 @@ import '@omnicross/contracts/billing-types';
 import '@omnicross/contracts/health-logging-types';
 import '@omnicross/contracts/voucher-types';
 import '@omnicross/contracts/webhook-types';
-import './ProviderProxy-Bz_nkOwq.cjs';
+import './ProviderProxy-OuQPYW2I.cjs';
 import './types-CbCZqLGg.cjs';
 import './keyPolicy-zdWTu3CQ.cjs';

package/dist/ports.d.ts

@@ -4,8 +4,8 @@ export { AutomaticPricingSource, PricingStore } from './ports/pricing-store.js';
 export { ProviderConfigSource } from './ports/provider-config-source.js';
 export { UsageEventStore } from './ports/usage-event-store.js';
 export { WebSearchBackend } from './ports/web-search-backend.js';
-export { U as UsageSink } from './types-By9Tg6-I.js';
-export { O as OutboundCredentialStore } from './types-Da735j2d.js';
+export { U as UsageSink } from './types-Di8VH1c9.js';
+export { O as OutboundCredentialStore } from './types-EReErShW.js';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
@@ -25,7 +25,7 @@ import './frontends-Doz0RaWu.js';
 import '@omnicross/contracts/search-types';
 import './runtime-t8AZacFF.js';
 import '@omnicross/contracts/image-generation-types';
-import './types-VAHRysdP.js';
+import './types-USaixzVP.js';
 import 'node:fs/promises';
 import '@omnicross/contracts/account-tokens-types';
 import '@omnicross/contracts/audit-types';
@@ -33,6 +33,6 @@ import '@omnicross/contracts/billing-types';
 import '@omnicross/contracts/health-logging-types';
 import '@omnicross/contracts/voucher-types';
 import '@omnicross/contracts/webhook-types';
-import './ProviderProxy-Ckr6oTrE.js';
+import './ProviderProxy-DxsNi3cO.js';
 import './types-CbCZqLGg.js';
 import './keyPolicy-zdWTu3CQ.js';

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,17 +1,17 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkRX3BCX53cjs = require('../chunk-RX3BCX53.cjs');
+var _chunkDV7656NNcjs = require('../chunk-DV7656NN.cjs');
 require('../chunk-QVOB2DNX.cjs');
-require('../chunk-UOOLU64V.cjs');
+require('../chunk-QLVRJ5FS.cjs');
 require('../chunk-NOITAVHA.cjs');
-require('../chunk-QWNUOR7F.cjs');
+require('../chunk-ZTN2PVKO.cjs');
 require('../chunk-47E3I5PF.cjs');
 require('../chunk-5RSZYQJH.cjs');
 require('../chunk-VGBJPHHD.cjs');
-require('../chunk-CGEZQC2G.cjs');
-require('../chunk-X6GHTNDL.cjs');
-require('../chunk-E5RCCGE7.cjs');
+require('../chunk-F3TT5XPV.cjs');
+require('../chunk-ZG57GAVU.cjs');
+require('../chunk-DF5JXK36.cjs');
 require('../chunk-BTSADEX4.cjs');
 require('../chunk-32SRZFFP.cjs');
 require('../chunk-2E42SAW3.cjs');
@@ -25,7 +25,7 @@ require('../chunk-HQP3K7PU.cjs');
 require('../chunk-SQU2FGXI.cjs');
 require('../chunk-RPII3E6Z.cjs');
 require('../chunk-6RPZADX3.cjs');
-require('../chunk-GWC7HCZI.cjs');
+require('../chunk-LWBXQXZ3.cjs');
 require('../chunk-UKQHBK4Q.cjs');
 require('../chunk-UIBD2YY5.cjs');
 require('../chunk-R3HK6R4B.cjs');
@@ -47,7 +47,7 @@ require('../chunk-APYG5QD7.cjs');
 require('../chunk-L74VDN4A.cjs');
 require('../chunk-XSVNC2UD.cjs');
 require('../chunk-4YINUUKQ.cjs');
-require('../chunk-57Y2EA2G.cjs');
+require('../chunk-JGRNVH7C.cjs');
 require('../chunk-QBZJ7P2T.cjs');
 require('../chunk-LL3MZ7O5.cjs');
 require('../chunk-JMJBSACD.cjs');
@@ -55,19 +55,19 @@ require('../chunk-GMMT7RVN.cjs');
 require('../chunk-UNEFIWXI.cjs');
 require('../chunk-A2YMUCBT.cjs');
 require('../chunk-GDIXXKF2.cjs');
-require('../chunk-NDIBVTBZ.cjs');
+require('../chunk-XYFCNDJK.cjs');
 require('../chunk-N3MGNLCU.cjs');
 require('../chunk-4NAMH4UE.cjs');
 require('../chunk-77USGNRW.cjs');
 require('../chunk-IUL4VWNU.cjs');
-require('../chunk-VFFCV4J6.cjs');
+require('../chunk-CXRJMNJJ.cjs');
 require('../chunk-235MXAGX.cjs');
 require('../chunk-VYOBVPNB.cjs');
-require('../chunk-NKVZ6Z3Y.cjs');
+require('../chunk-4HMAS74X.cjs');
 require('../chunk-INY54AYX.cjs');
 require('../chunk-G4CZIUIB.cjs');
 require('../chunk-2RCCLQYV.cjs');
 
 
 
-exports.ProviderProxy = _chunkRX3BCX53cjs.ProviderProxy; exports.isLoopbackAddress = _chunkRX3BCX53cjs.isLoopbackAddress;
+exports.ProviderProxy = _chunkDV7656NNcjs.ProviderProxy; exports.isLoopbackAddress = _chunkDV7656NNcjs.isLoopbackAddress;

package/dist/provider-proxy/ProviderProxy.d.cts

@@ -1,5 +1,5 @@
-export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-Bz_nkOwq.cjs';
-import '../types-BSIJdsyl.cjs';
+export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-OuQPYW2I.cjs';
+import '../types-Dpr5IAaP.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';

package/dist/provider-proxy/ProviderProxy.d.ts

@@ -1,5 +1,5 @@
-export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-Ckr6oTrE.js';
-import '../types-By9Tg6-I.js';
+export { P as ProviderProxy, i as isLoopbackAddress } from '../ProviderProxy-DxsNi3cO.js';
+import '../types-Di8VH1c9.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';

package/dist/provider-proxy/ProviderProxy.js

@@ -1,17 +1,17 @@
 import {
   ProviderProxy,
   isLoopbackAddress
-} from "../chunk-YV4JSBPA.js";
+} from "../chunk-TU4BB776.js";
 import "../chunk-WTQMX2Q6.js";
-import "../chunk-MPFOC7AT.js";
+import "../chunk-5XG6FR5F.js";
 import "../chunk-V53ZEFXC.js";
-import "../chunk-7PIUVCKK.js";
+import "../chunk-MZCJL3QU.js";
 import "../chunk-TKZ3DZS5.js";
 import "../chunk-FU7EAR73.js";
 import "../chunk-IDPMD4B7.js";
-import "../chunk-K6J2RIEX.js";
-import "../chunk-ZJJBITUN.js";
-import "../chunk-F6P4DIBL.js";
+import "../chunk-NDJSLJIA.js";
+import "../chunk-IAWLTZUP.js";
+import "../chunk-TLYFFUW4.js";
 import "../chunk-OXBGNEYR.js";
 import "../chunk-QIIAMBTM.js";
 import "../chunk-FXR6N3SR.js";
@@ -25,7 +25,7 @@ import "../chunk-VVEHS2LI.js";
 import "../chunk-4LSZ7NFM.js";
 import "../chunk-XTEI64OU.js";
 import "../chunk-XX6NQJMA.js";
-import "../chunk-NCZDUBC2.js";
+import "../chunk-DRUT7H5H.js";
 import "../chunk-ONTTXSRL.js";
 import "../chunk-OE6TDIWW.js";
 import "../chunk-DRWHTIIZ.js";
@@ -47,7 +47,7 @@ import "../chunk-WLYIIEAF.js";
 import "../chunk-TKJMZBAH.js";
 import "../chunk-OZFM4X3S.js";
 import "../chunk-3QFXFCHG.js";
-import "../chunk-ZMERU7D3.js";
+import "../chunk-VXHN5IDL.js";
 import "../chunk-AQ5TNQB7.js";
 import "../chunk-6I4SAWCN.js";
 import "../chunk-Y7FO65VT.js";
@@ -55,15 +55,15 @@ import "../chunk-FMOBD2OQ.js";
 import "../chunk-HUZZZ3JL.js";
 import "../chunk-H5JUT3KV.js";
 import "../chunk-5NJLQ6T6.js";
-import "../chunk-EE7VP4O3.js";
+import "../chunk-HQ7C3VB6.js";
 import "../chunk-QSOHEDKO.js";
 import "../chunk-YEHQ5FXZ.js";
 import "../chunk-WYVGULTQ.js";
 import "../chunk-ZLNHPUFA.js";
-import "../chunk-NTF7TLT7.js";
+import "../chunk-LBIXTHP7.js";
 import "../chunk-3WD4HTR2.js";
 import "../chunk-FYPKKMB3.js";
-import "../chunk-GL6XM527.js";
+import "../chunk-TX7ZM4OI.js";
 import "../chunk-4RM22ETG.js";
 import "../chunk-4JOU54M5.js";
 import "../chunk-4PFWFODB.js";

package/dist/provider-proxy/identity/codexCliHeaders.d.cts

@@ -36,10 +36,12 @@ declare function fillMissingHeaders(headers: Record<string, string>, source: Rea
  *
  * NOT DONE HERE (deliberate, see the relay call site):
  *  - `chatgpt-account-id`: compatible implementations send the ChatGPT account
- *    id parsed out of the OAuth `id_token`. Guessing it wrong risks a 403 on a
- *    path that currently works, so it is left to a follow-up that can verify it.
- *  - forcing `store: false` on the body: a body mutation with its own regression
- *    surface, tracked separately.
+ *    id parsed out of the OAuth `id_token`. Verified 2026-09-12 against the
+ *    live backend: the header is NOT required (a request without it authorizes
+ *    fine), so it stays omitted — sending a guessed id risks a 403.
+ *  - forcing `store: false` on the body: DONE since 2026-09-12 in the driver's
+ *    `applyPlanAuth` — the backend now 400s any /codex/responses call without
+ *    it (`{"detail":"Store must be set to false"}`).
  *
  * @module provider-proxy/identity/codexCliHeaders
  */

package/dist/provider-proxy/identity/codexCliHeaders.d.ts

@@ -36,10 +36,12 @@ declare function fillMissingHeaders(headers: Record<string, string>, source: Rea
  *
  * NOT DONE HERE (deliberate, see the relay call site):
  *  - `chatgpt-account-id`: compatible implementations send the ChatGPT account
- *    id parsed out of the OAuth `id_token`. Guessing it wrong risks a 403 on a
- *    path that currently works, so it is left to a follow-up that can verify it.
- *  - forcing `store: false` on the body: a body mutation with its own regression
- *    surface, tracked separately.
+ *    id parsed out of the OAuth `id_token`. Verified 2026-09-12 against the
+ *    live backend: the header is NOT required (a request without it authorizes
+ *    fine), so it stays omitted — sending a guessed id risks a 403.
+ *  - forcing `store: false` on the body: DONE since 2026-09-12 in the driver's
+ *    `applyPlanAuth` — the backend now 400s any /codex/responses call without
+ *    it (`{"detail":"Store must be set to false"}`).
  *
  * @module provider-proxy/identity/codexCliHeaders
  */

package/dist/provider-proxy/identity/openCodeGoHeaders.cjs

@@ -5,7 +5,7 @@
 
 
 
-var _chunkGWC7HCZIcjs = require('../../chunk-GWC7HCZI.cjs');
+var _chunkLWBXQXZ3cjs = require('../../chunk-LWBXQXZ3.cjs');
 require('../../chunk-UKQHBK4Q.cjs');
 
 
@@ -14,4 +14,4 @@ require('../../chunk-UKQHBK4Q.cjs');
 
 
 
-exports.OPENCODE_SESSION_HEADER = _chunkGWC7HCZIcjs.OPENCODE_SESSION_HEADER; exports.__resetOpenCodeGoHeadersForTests = _chunkGWC7HCZIcjs.__resetOpenCodeGoHeadersForTests; exports.extractOpenCodeSessionHeader = _chunkGWC7HCZIcjs.extractOpenCodeSessionHeader; exports.getOpenCodeGoUserAgent = _chunkGWC7HCZIcjs.getOpenCodeGoUserAgent; exports.resolveOpenCodeSessionHeader = _chunkGWC7HCZIcjs.resolveOpenCodeSessionHeader; exports.setOpenCodeGoUserAgent = _chunkGWC7HCZIcjs.setOpenCodeGoUserAgent;
+exports.OPENCODE_SESSION_HEADER = _chunkLWBXQXZ3cjs.OPENCODE_SESSION_HEADER; exports.__resetOpenCodeGoHeadersForTests = _chunkLWBXQXZ3cjs.__resetOpenCodeGoHeadersForTests; exports.extractOpenCodeSessionHeader = _chunkLWBXQXZ3cjs.extractOpenCodeSessionHeader; exports.getOpenCodeGoUserAgent = _chunkLWBXQXZ3cjs.getOpenCodeGoUserAgent; exports.resolveOpenCodeSessionHeader = _chunkLWBXQXZ3cjs.resolveOpenCodeSessionHeader; exports.setOpenCodeGoUserAgent = _chunkLWBXQXZ3cjs.setOpenCodeGoUserAgent;

package/dist/provider-proxy/identity/openCodeGoHeaders.js

@@ -5,7 +5,7 @@ import {
   getOpenCodeGoUserAgent,
   resolveOpenCodeSessionHeader,
   setOpenCodeGoUserAgent
-} from "../../chunk-NCZDUBC2.js";
+} from "../../chunk-DRUT7H5H.js";
 import "../../chunk-ONTTXSRL.js";
 export {
   OPENCODE_SESSION_HEADER,

package/dist/provider-proxy/ingress/providerProxyShared.cjs

@@ -11,17 +11,21 @@
 
 
 
-var _chunkRX3BCX53cjs = require('../../chunk-RX3BCX53.cjs');
+
+
+
+
+var _chunkDV7656NNcjs = require('../../chunk-DV7656NN.cjs');
 require('../../chunk-QVOB2DNX.cjs');
-require('../../chunk-UOOLU64V.cjs');
+require('../../chunk-QLVRJ5FS.cjs');
 require('../../chunk-NOITAVHA.cjs');
-require('../../chunk-QWNUOR7F.cjs');
+require('../../chunk-ZTN2PVKO.cjs');
 require('../../chunk-47E3I5PF.cjs');
 require('../../chunk-5RSZYQJH.cjs');
 require('../../chunk-VGBJPHHD.cjs');
-require('../../chunk-CGEZQC2G.cjs');
-require('../../chunk-X6GHTNDL.cjs');
-require('../../chunk-E5RCCGE7.cjs');
+require('../../chunk-F3TT5XPV.cjs');
+require('../../chunk-ZG57GAVU.cjs');
+require('../../chunk-DF5JXK36.cjs');
 require('../../chunk-BTSADEX4.cjs');
 require('../../chunk-32SRZFFP.cjs');
 require('../../chunk-2E42SAW3.cjs');
@@ -35,7 +39,7 @@ require('../../chunk-HQP3K7PU.cjs');
 require('../../chunk-SQU2FGXI.cjs');
 require('../../chunk-RPII3E6Z.cjs');
 require('../../chunk-6RPZADX3.cjs');
-require('../../chunk-GWC7HCZI.cjs');
+require('../../chunk-LWBXQXZ3.cjs');
 require('../../chunk-UKQHBK4Q.cjs');
 require('../../chunk-UIBD2YY5.cjs');
 require('../../chunk-R3HK6R4B.cjs');
@@ -57,7 +61,7 @@ require('../../chunk-APYG5QD7.cjs');
 require('../../chunk-L74VDN4A.cjs');
 require('../../chunk-XSVNC2UD.cjs');
 require('../../chunk-4YINUUKQ.cjs');
-require('../../chunk-57Y2EA2G.cjs');
+require('../../chunk-JGRNVH7C.cjs');
 require('../../chunk-QBZJ7P2T.cjs');
 require('../../chunk-LL3MZ7O5.cjs');
 require('../../chunk-JMJBSACD.cjs');
@@ -65,15 +69,15 @@ require('../../chunk-GMMT7RVN.cjs');
 require('../../chunk-UNEFIWXI.cjs');
 require('../../chunk-A2YMUCBT.cjs');
 require('../../chunk-GDIXXKF2.cjs');
-require('../../chunk-NDIBVTBZ.cjs');
+require('../../chunk-XYFCNDJK.cjs');
 require('../../chunk-N3MGNLCU.cjs');
 require('../../chunk-4NAMH4UE.cjs');
 require('../../chunk-77USGNRW.cjs');
 require('../../chunk-IUL4VWNU.cjs');
-require('../../chunk-VFFCV4J6.cjs');
+require('../../chunk-CXRJMNJJ.cjs');
 require('../../chunk-235MXAGX.cjs');
 require('../../chunk-VYOBVPNB.cjs');
-require('../../chunk-NKVZ6Z3Y.cjs');
+require('../../chunk-4HMAS74X.cjs');
 require('../../chunk-INY54AYX.cjs');
 require('../../chunk-G4CZIUIB.cjs');
 require('../../chunk-2RCCLQYV.cjs');
@@ -90,4 +94,8 @@ require('../../chunk-2RCCLQYV.cjs');
 
 
 
-exports.aggregateAnthropicSseToJsonBody = _chunkRX3BCX53cjs.aggregateAnthropicSseToJsonBody; exports.cancelDiscardedResponse = _chunkRX3BCX53cjs.cancelDiscardedResponse; exports.getAnthropicEndpointTransformer = _chunkRX3BCX53cjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkRX3BCX53cjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkRX3BCX53cjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkRX3BCX53cjs.getSharedExecutor; exports.projectUpstreamResponseHeaders = _chunkRX3BCX53cjs.projectUpstreamResponseHeaders; exports.readBody = _chunkRX3BCX53cjs.readBody; exports.relayResponse = _chunkRX3BCX53cjs.relayResponse; exports.resolvePoolBoundKey = _chunkRX3BCX53cjs.resolvePoolBoundKey; exports.writeBoundAccountError = _chunkRX3BCX53cjs.writeBoundAccountError; exports.writeError = _chunkRX3BCX53cjs.writeError;
+
+
+
+
+exports.aggregateAnthropicSseToJsonBody = _chunkDV7656NNcjs.aggregateAnthropicSseToJsonBody; exports.aggregateOpenAIChatChunksToJsonBody = _chunkDV7656NNcjs.aggregateOpenAIChatChunksToJsonBody; exports.aggregateResponsesSseToJsonBody = _chunkDV7656NNcjs.aggregateResponsesSseToJsonBody; exports.buildByoRouteActivityMeta = _chunkDV7656NNcjs.buildByoRouteActivityMeta; exports.cancelDiscardedResponse = _chunkDV7656NNcjs.cancelDiscardedResponse; exports.getAnthropicEndpointTransformer = _chunkDV7656NNcjs.getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = _chunkDV7656NNcjs.getGeminiEndpointTransformer; exports.getResponsesEndpointTransformer = _chunkDV7656NNcjs.getResponsesEndpointTransformer; exports.getSharedExecutor = _chunkDV7656NNcjs.getSharedExecutor; exports.projectUpstreamResponseHeaders = _chunkDV7656NNcjs.projectUpstreamResponseHeaders; exports.readBody = _chunkDV7656NNcjs.readBody; exports.relayResponse = _chunkDV7656NNcjs.relayResponse; exports.resolvePoolBoundKey = _chunkDV7656NNcjs.resolvePoolBoundKey; exports.sniffIsSseResponse = _chunkDV7656NNcjs.sniffIsSseResponse; exports.writeBoundAccountError = _chunkDV7656NNcjs.writeBoundAccountError; exports.writeError = _chunkDV7656NNcjs.writeError;

package/dist/provider-proxy/ingress/providerProxyShared.d.cts

@@ -3,7 +3,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.cjs';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.cjs';
 import { Transformer } from '../../transformer/types.cjs';
-import { W as ProviderProxyDeps } from '../../types-BSIJdsyl.cjs';
+import { W as ProviderProxyDeps } from '../../types-Dpr5IAaP.cjs';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
@@ -127,6 +127,40 @@ onSseEvent?: (event: Record<string, unknown>) => void, signal?: AbortSignal): Pr
  * Best-effort: a malformed event is skipped, never thrown.
  */
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string>;
+/**
+ * Collapse an OpenAI Responses SSE stream into the single `response` JSON a
+ * NON-streaming client expects. The Responses wire carries the complete final
+ * response object on its terminal event, so aggregation = keep the LAST
+ * `response.completed` / `response.failed` / `response.incomplete` payload
+ * (`response.failed`/`incomplete` surface the upstream's own error state —
+ * relayed verbatim, not rewritten into an error envelope). `rewriteModel`
+ * overrides `model` to mirror `relayResponse`'s non-stream branch.
+ *
+ * Serves the codex subscription contract on BOTH ingress paths: the backend
+ * rejects `stream:false` outright, so a non-streaming client is answered by
+ * forcing `stream:true` upstream and collapsing the SSE back. Best-effort like
+ * the Anthropic twin: a malformed event is skipped; no terminal event found →
+ * null (the caller surfaces its own 502).
+ */
+declare function aggregateResponsesSseToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string | null>;
+/**
+ * Collapse an OpenAI Chat Completions SSE chunk stream into the single
+ * `chat.completion` JSON a NON-streaming client expects. Accumulates the FIRST
+ * `id`/`created`/`model`, every `delta` (content text, `reasoning_content`,
+ * `tool_calls` by index with concatenated argument fragments), the last non-null
+ * `finish_reason`, and the last `usage` (present on the final chunk when the
+ * caller asked for `stream_options.include_usage`, else omitted). Mirrors the
+ * Anthropic twin's best-effort contract; no terminal/finish found → null.
+ */
+declare function aggregateOpenAIChatChunksToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string | null>;
+/**
+ * Whether a response body is an SSE stream. The header check is the cheap
+ * first pass; ChatGPT's codex backend OMITS Content-Type on its SSE streams
+ * (see OpenAIResponseTransformer's twin sniff), so a header-less body is
+ * decided by peeking the first chunk for an `event:`/`data:` frame start.
+ * The peek clones — the original body is left unread for the consumer.
+ */
+declare function sniffIsSseResponse(response: Response): Promise<boolean>;
 /**
  * Write a JSON error response if the headers have not been sent.
  *
@@ -173,5 +207,23 @@ declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAc
  * so the pool branch needs no further `$ENV` expansion.
  */
 declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
+/**
+ * BYO route-activity metadata for one plan — everything the fetch seam needs to
+ * record a `provider-key` row, resolved LIVE at fetch time so an ApiKeyPool
+ * rebind retry (the rotated-key `runOnce(newKey)` re-run) attributes the SECOND
+ * attempt to the NEW key.
+ *
+ * `providerId` is the provider ROW id (the display identity an operator
+ * recognizes) — never the egress proxy key `'byo'`. `resolveKeyId` reads the
+ * pool's CURRENT session binding (the same map `resolvePoolBoundKey` seeds and
+ * `reportError` rotates), so it is exactly the key this attempt sends whenever
+ * the pool is bound; `undefined` for non-pool BYO (static row key) — the store
+ * then records the row without a key id and affinity treats it as one identity.
+ */
+interface ByoRouteActivityMeta {
+    readonly providerId: string;
+    readonly resolveKeyId: () => string | undefined;
+}
+declare function buildByoRouteActivityMeta(deps: ProviderProxyDeps, providerId: string, sessionId: string | null | undefined): ByoRouteActivityMeta;
 
-export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, cancelDiscardedResponse, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, projectUpstreamResponseHeaders, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };
+export { type ByoRouteActivityMeta, type StreamUsageTap, aggregateAnthropicSseToJsonBody, aggregateOpenAIChatChunksToJsonBody, aggregateResponsesSseToJsonBody, buildByoRouteActivityMeta, cancelDiscardedResponse, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, projectUpstreamResponseHeaders, readBody, relayResponse, resolvePoolBoundKey, sniffIsSseResponse, writeBoundAccountError, writeError };

package/dist/provider-proxy/ingress/providerProxyShared.d.ts

@@ -3,7 +3,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { BoundAccountSelectionError } from '../../pipeline/BoundAccountSelectionError.js';
 import { TransformerChainExecutor } from '../../transformer/TransformerChainExecutor.js';
 import { Transformer } from '../../transformer/types.js';
-import { W as ProviderProxyDeps } from '../../types-By9Tg6-I.js';
+import { W as ProviderProxyDeps } from '../../types-Di8VH1c9.js';
 import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
@@ -127,6 +127,40 @@ onSseEvent?: (event: Record<string, unknown>) => void, signal?: AbortSignal): Pr
  * Best-effort: a malformed event is skipped, never thrown.
  */
 declare function aggregateAnthropicSseToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string>;
+/**
+ * Collapse an OpenAI Responses SSE stream into the single `response` JSON a
+ * NON-streaming client expects. The Responses wire carries the complete final
+ * response object on its terminal event, so aggregation = keep the LAST
+ * `response.completed` / `response.failed` / `response.incomplete` payload
+ * (`response.failed`/`incomplete` surface the upstream's own error state —
+ * relayed verbatim, not rewritten into an error envelope). `rewriteModel`
+ * overrides `model` to mirror `relayResponse`'s non-stream branch.
+ *
+ * Serves the codex subscription contract on BOTH ingress paths: the backend
+ * rejects `stream:false` outright, so a non-streaming client is answered by
+ * forcing `stream:true` upstream and collapsing the SSE back. Best-effort like
+ * the Anthropic twin: a malformed event is skipped; no terminal event found →
+ * null (the caller surfaces its own 502).
+ */
+declare function aggregateResponsesSseToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string | null>;
+/**
+ * Collapse an OpenAI Chat Completions SSE chunk stream into the single
+ * `chat.completion` JSON a NON-streaming client expects. Accumulates the FIRST
+ * `id`/`created`/`model`, every `delta` (content text, `reasoning_content`,
+ * `tool_calls` by index with concatenated argument fragments), the last non-null
+ * `finish_reason`, and the last `usage` (present on the final chunk when the
+ * caller asked for `stream_options.include_usage`, else omitted). Mirrors the
+ * Anthropic twin's best-effort contract; no terminal/finish found → null.
+ */
+declare function aggregateOpenAIChatChunksToJsonBody(response: Response, rewriteModel?: string, signal?: AbortSignal): Promise<string | null>;
+/**
+ * Whether a response body is an SSE stream. The header check is the cheap
+ * first pass; ChatGPT's codex backend OMITS Content-Type on its SSE streams
+ * (see OpenAIResponseTransformer's twin sniff), so a header-less body is
+ * decided by peeking the first chunk for an `event:`/`data:` frame start.
+ * The peek clones — the original body is left unread for the consumer.
+ */
+declare function sniffIsSseResponse(response: Response): Promise<boolean>;
 /**
  * Write a JSON error response if the headers have not been sent.
  *
@@ -173,5 +207,23 @@ declare function writeBoundAccountError(res: http.ServerResponse, error: BoundAc
  * so the pool branch needs no further `$ENV` expansion.
  */
 declare function resolvePoolBoundKey(deps: ProviderProxyDeps, providerId: string, provider: LLMProvider, sessionId: string | null, preferredKeyId?: string, boundKeyFallbackPolicy?: 'strict' | 'pool'): Promise<string>;
+/**
+ * BYO route-activity metadata for one plan — everything the fetch seam needs to
+ * record a `provider-key` row, resolved LIVE at fetch time so an ApiKeyPool
+ * rebind retry (the rotated-key `runOnce(newKey)` re-run) attributes the SECOND
+ * attempt to the NEW key.
+ *
+ * `providerId` is the provider ROW id (the display identity an operator
+ * recognizes) — never the egress proxy key `'byo'`. `resolveKeyId` reads the
+ * pool's CURRENT session binding (the same map `resolvePoolBoundKey` seeds and
+ * `reportError` rotates), so it is exactly the key this attempt sends whenever
+ * the pool is bound; `undefined` for non-pool BYO (static row key) — the store
+ * then records the row without a key id and affinity treats it as one identity.
+ */
+interface ByoRouteActivityMeta {
+    readonly providerId: string;
+    readonly resolveKeyId: () => string | undefined;
+}
+declare function buildByoRouteActivityMeta(deps: ProviderProxyDeps, providerId: string, sessionId: string | null | undefined): ByoRouteActivityMeta;
 
-export { type StreamUsageTap, aggregateAnthropicSseToJsonBody, cancelDiscardedResponse, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, projectUpstreamResponseHeaders, readBody, relayResponse, resolvePoolBoundKey, writeBoundAccountError, writeError };
+export { type ByoRouteActivityMeta, type StreamUsageTap, aggregateAnthropicSseToJsonBody, aggregateOpenAIChatChunksToJsonBody, aggregateResponsesSseToJsonBody, buildByoRouteActivityMeta, cancelDiscardedResponse, getAnthropicEndpointTransformer, getGeminiEndpointTransformer, getResponsesEndpointTransformer, getSharedExecutor, projectUpstreamResponseHeaders, readBody, relayResponse, resolvePoolBoundKey, sniffIsSseResponse, writeBoundAccountError, writeError };