@opengeni/codex 0.2.7 → 0.2.9

package/dist/index.d.ts

@@ -1,515 +1,13 @@
-export { CODEX_APPS_MCP_SERVER_ID, CODEX_APPS_MCP_SERVER_NAME, CODEX_APPS_MCP_URL, CODEX_APPS_REQUIRED_SCOPES, CODEX_APPS_STARTUP_TIMEOUT_MS, CODEX_AUTH_BASE, CODEX_AUTO_COMPACTION_PERCENT, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_DEVICE_REDIRECT_URI, CODEX_DEVICE_VERIFICATION_URL, CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT, CODEX_FALLBACK_MODEL_SLUGS, CODEX_ID_TOKEN_AUTH_CLAIM, CODEX_ISSUER, CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT, CODEX_MODEL_CONTEXT_WINDOW_TOKENS, CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS, CODEX_MODEL_ID_PREFIX, CODEX_ORIGINATOR, CODEX_PROVIDER_BASE_URL, CODEX_PROVIDER_ID, CODEX_REFRESH_FALLBACK_MS, CODEX_REFRESH_WINDOW_MS, CODEX_RESPONSES_BASE, CODEX_RESPONSE_HEADERS_TIMEOUT_MS, CODEX_RESPONSE_NO_BYTE_RETRIES, CODEX_RESPONSE_RETRY_BACKOFF_MS, CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS, CODEX_RESPONSE_STREAM_IDLE_TIMEOUT_MS, CODEX_RESPONSE_WHOLE_TIMEOUT_MS, CODEX_TOKEN_URL, CODEX_WHAM_BASE } from './constants.js';
-import { AsyncLocalStorage } from 'node:async_hooks';
-
-/**
- * Pure NECESSARY condition for a Codex-billed turn: the model id is namespaced
- * for the Codex subscription provider (`codex/<slug>`).
- *
- * This is NOT sufficient to bypass billing — an active, connected workspace
- * credential and the deployment flag (`settings.codexSubscriptionEnabled`) are
- * ALSO required (see `isCodexBilledTurn`/`workspaceCodexSubscriptionActive` in
- * `@opengeni/db`). Used only as a cheap, synchronous short-circuit so the common
- * non-codex path never issues a credential read.
- */
-declare function isCodexBilledModel(model: string | null | undefined): boolean;
-
-type CodexFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
-type CodexDeviceStart = {
-    deviceAuthId: string;
-    userCode: string;
-    verificationUri: string;
-    intervalSeconds: number;
-};
-type CodexTokens = {
-    idToken: string;
-    accessToken: string;
-    refreshToken: string;
-};
-type CodexPollResult = {
-    status: "pending";
-} | {
-    status: "expired";
-} | {
-    status: "authorized";
-    authorizationCode: string;
-    codeVerifier: string;
-};
-declare class CodexDeviceError extends Error {
-    constructor(message: string);
-}
-/** Step 1: POST {auth}/deviceauth/usercode {client_id}. device_code_auth.rs:67-95 */
-declare function startDeviceCode(fetchImpl?: CodexFetch): Promise<CodexDeviceStart>;
-/** Step 3 (single, non-blocking): POST {auth}/deviceauth/token. 403/404 => pending. device_code_auth.rs:106-145 */
-declare function pollDeviceCode(input: {
-    deviceAuthId: string;
-    userCode: string;
-}, fetchImpl?: CodexFetch): Promise<CodexPollResult>;
-/** Step 4: POST {issuer}/oauth/token form-encoded grant_type=authorization_code. server.rs:732-766 */
-declare function exchangeDeviceCode(input: {
-    authorizationCode: string;
-    codeVerifier: string;
-}, fetchImpl?: CodexFetch): Promise<CodexTokens>;
-
-/** Permanent — the workspace must reconnect (status => needs_relogin). */
-declare class CodexReloginRequired extends Error {
-    constructor(message: string);
-}
-/** Transient — safe to retry later. */
-declare class CodexRefreshTransient extends Error {
-    constructor(message: string);
-}
-/** Only present fields are returned (the server may rotate any subset). */
-type CodexRefreshTokens = {
-    idToken?: string | undefined;
-    accessToken?: string | undefined;
-    refreshToken?: string | undefined;
-};
-/** POST {issuer}/oauth/token JSON {client_id, grant_type:"refresh_token", refresh_token}. manager.rs:1336-1340 */
-declare function refreshCodexToken(refreshToken: string, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<CodexRefreshTokens>;
-/** Decode a JWT payload (base64url, no signature check). */
-declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
-/** access-token `exp` claim -> Date | null. token_data.rs:101-105 */
-declare function accessTokenExpiry(accessToken: string): Date | null;
-/** id_token -> {chatgptAccountId, planType, isFedramp}. server.rs:827-832; token_data.rs:71-99 */
-declare function parseIdToken(idToken: string): {
-    chatgptAccountId: string | null;
-    planType: string | null;
-    isFedramp: boolean;
-    email: string | null;
-};
-
-/** Mutates a parsed Responses request body in place and returns it. Pure + synchronous + unit-testable. */
-declare function normalizeCodexRequestBody(body: Record<string, unknown>, resolveModel: (slug: string) => string): Record<string, unknown>;
-/**
- * Build a longest-prefix model resolver. Catalog slugs come from GET /models
- * (api-client.ts). One leading `namespace/` segment is stripped first; an
- * unknown slug returns the fallback (caller should log — spec §1.4 step 4).
- */
-declare function buildModelResolver(liveSlugs: readonly string[], fallbackSlug: string): (slug: string) => string;
-
-declare const CODEX_RATE_LIMIT_RESET_OUTCOMES: readonly ["reset", "nothingToReset", "noCredit", "alreadyRedeemed"];
-type CodexRateLimitResetOutcome = (typeof CODEX_RATE_LIMIT_RESET_OUTCOMES)[number];
-type CodexRateLimitResetType = "codexRateLimits" | "unknown";
-type CodexRateLimitResetCreditStatus = "available" | "redeeming" | "redeemed" | "unknown";
-type CodexRateLimitResetCredit = {
-    id: string;
-    resetType: CodexRateLimitResetType;
-    status: CodexRateLimitResetCreditStatus;
-    /** Unix seconds, matching account/rateLimits/read in Codex v0.144.6. */
-    grantedAt: number;
-    /** Unix seconds, or null when the provider says the credit does not expire. */
-    expiresAt: number | null;
-    title: string | null;
-    description: string | null;
-};
-type CodexRateLimitResetCreditsDetails = {
-    availableCount: number;
-    credits: CodexRateLimitResetCredit[];
-};
-type CodexRateLimitResetCreditsSummary = {
-    availableCount: number;
-    /** null means the provider supplied an authoritative count but no detail rows. */
-    credits: null;
-};
-type CodexRateLimitResetConsumeResponse = {
-    outcome: CodexRateLimitResetOutcome;
-};
-/** Parse the exact detailed-credit backend response. Unknown rows stay view-only. */
-declare function parseCodexRateLimitResetCreditsDetails(payload: unknown): CodexRateLimitResetCreditsDetails | null;
-/** Parse the count-only summary carried by GET /wham/usage. */
-declare function parseCodexRateLimitResetCreditsSummary(payload: unknown): CodexRateLimitResetCreditsSummary | null;
-/** Parse one of the exact four v0.144.6 consume outcomes. Unknowns fail closed. */
-declare function parseCodexRateLimitResetConsumeResponse(payload: unknown): CodexRateLimitResetConsumeResponse | null;
-
-/** The 5-hour (primary) window's `limit_window_seconds`. */
-declare const CODEX_FIVE_HOUR_WINDOW_SECONDS = 18000;
-/** The weekly (secondary) window's `limit_window_seconds`. */
-declare const CODEX_WEEKLY_WINDOW_SECONDS = 604800;
-/** One normalized usage window (applied to BOTH primary_window and secondary_window). */
-type CodexUsageWindow = {
-    used: number;
-    limit: number;
-    remaining: number;
-    percent: number;
-    resetAt: string | null;
-    resetAfterSeconds: number | null;
-    limitWindowSeconds: number;
-};
-/** One additional (per-feature) limit (forward-compat; P2 renders nothing from it). */
-type CodexAdditionalLimit = {
-    limitName: string;
-    meteredFeature: string;
-    fiveHour: CodexUsageWindow | null;
-    weekly: CodexUsageWindow | null;
-};
-type CodexUsageStatus = "ok" | "limit_reached" | "error" | "no-data";
-/** The normalized usage payload — the P2/P3 contract. */
-type CodexUsagePayload = {
-    status: CodexUsageStatus;
-    planType: string | null;
-    fiveHour: CodexUsageWindow | null;
-    weekly: CodexUsageWindow | null;
-    limitReached: boolean;
-    fetchedAt: string;
-    /**
-     * Authoritative count-only reset-credit summary from the usage response.
-     * Detail rows are fetched separately and are never synthesized from this.
-     */
-    rateLimitResetCredits: CodexRateLimitResetCreditsSummary | null;
-    /** Present only on a refresh/auth failure path; carries the precise reason. */
-    reason?: "needs_relogin" | undefined;
-    additionalLimits?: CodexAdditionalLimit[] | undefined;
-    credits?: {
-        hasCredits: boolean;
-        unlimited: boolean;
-        overageLimitReached: boolean;
-        balance: string;
-    } | undefined;
-};
-/**
- * Build a normalized window from the PERSISTED cache columns (used_percent +
- * absolute reset timestamp). The same 0–100 synthesis as the live path, with the
- * skew-free countdown derived from `resetAt − now` at read time. Returns null when
- * there is no cached percent yet. `limitWindowSeconds` is the constant that
- * identifies the window (18000 ⇒ 5h, 604800 ⇒ weekly).
- */
-declare function buildCodexUsageWindowFromCache(usedPercent: number | null | undefined, resetAt: Date | string | null | undefined, limitWindowSeconds: number): CodexUsageWindow | null;
-/**
- * Normalize a /wham/usage fetch result into the P2/P3 contract.
- *
- * @param httpStatus the HTTP status from fetchCodexUsage (404 ⇒ a limit body)
- * @param rawPayload the parsed JSON body (or null when the body was unreadable)
- */
-declare function normalizeCodexUsage(httpStatus: number, rawPayload: unknown): CodexUsagePayload;
-
-type CodexAuthHeaders = {
-    accessToken: string;
-    chatgptAccountId: string | null;
-    isFedramp: boolean;
-    clientVersion: string;
-};
-type ResetCreditFetchFailureReason = "http_error" | "invalid_response" | "network_error" | "timeout";
-/** GET /codex/models — login-check + live catalog. A 200 means the token is accepted. spec §1.4/§F */
-declare function fetchCodexModels(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
-    ok: boolean;
-    status: number;
-    slugs: string[];
-}>;
-/** GET /wham/usage — authoritative limits. NB the WHAM base is /backend-api, NOT /codex (spec §1.8a). */
-declare function fetchCodexUsage(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
-    status: number;
-    payload: unknown;
-}>;
-/**
- * GET /wham/rate-limit-reset-credits — detailed earned reset credits.
- *
- * A non-2xx or malformed body returns an explicit non-ok result. The caller may
- * fall back to the count-only summary embedded in /wham/usage, but must never
- * invent actionable rows from that count.
- */
-declare function fetchCodexRateLimitResetCredits(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
-    ok: true;
-    status: number;
-    details: CodexRateLimitResetCreditsDetails;
-} | {
-    ok: false;
-    status: number;
-    reason: ResetCreditFetchFailureReason;
-}>;
-/**
- * POST /wham/rate-limit-reset-credits/consume with the exact v0.144.6 body.
- * `idempotencyKey` identifies one logical human redemption and MUST be reused
- * by the server on retries. Supplying `creditId` is preferred; omission leaves
- * provider selection in control and is therefore not used by OpenGeni's
- * human-only flow.
- */
-declare function consumeCodexRateLimitResetCredit(a: CodexAuthHeaders, input: {
-    idempotencyKey: string;
-    creditId?: string | undefined;
-}, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
-    ok: true;
-    status: number;
-    result: CodexRateLimitResetConsumeResponse;
-} | {
-    ok: false;
-    status: number;
-    reason: ResetCreditFetchFailureReason | "invalid_request";
-}>;
-
-type CodexTokenSnapshot = {
-    accessToken: string;
-    chatgptAccountId: string | null;
-    isFedramp: boolean;
-};
-/**
- * Multi-account P4 (Part A): a full usage snapshot scraped FOR FREE from the
- * `x-codex-primary-*` / `x-codex-secondary-*` response headers the codex backend
- * stamps on every `/codex/responses` turn (success AND 429 hard-cap). Integer-
- * identical to GET /wham/usage but with zero extra round-trip. parseCodexUsageHeaders
- * returns this only when BOTH windows parse, so a write is always a full 5-column
- * snapshot (no partial-window clobber). Shape mirrors db's CodexAccountUsageSnapshot
- * (non-null here: a partial read is filtered to null upstream, never half-written).
- */
-type CodexUsageHeaderSnapshot = {
-    primaryUsedPercent: number;
-    primaryResetAt: Date;
-    secondaryUsedPercent: number;
-    secondaryResetAt: Date;
-    checkedAt: Date;
-};
-type CodexResponseTimeoutClass = "connect" | "headers" | "idle_stream" | "whole_request";
-type CodexResponseTimeoutPolicy = {
-    /** Maximum wait for response headers, including DNS/TCP/TLS establishment. */
-    headersTimeoutMs: number;
-    /** Maximum silence between response-body chunks after headers arrive. */
-    streamIdleTimeoutMs: number;
-    /** Maximum wall time for one logical Responses request. */
-    wholeRequestTimeoutMs: number;
-    /**
-     * Reserved compatibility field. It is currently normalized to zero because
-     * an absent response does not prove that the provider never accepted a
-     * request, so automatic replay is not safe without an operation receipt.
-     */
-    noByteRetries: number;
-    retryBackoffMs: number;
-};
-type CodexModelRequestEvent = {
-    requestId: string;
-    transportAttempt: number;
-    phase: "started" | "headers" | "first_byte" | "completed" | "failed" | "timed_out";
-    model?: string;
-    durationMs: number;
-    responseObserved: boolean;
-    timeoutPolicy: CodexResponseTimeoutPolicy;
-    timeoutClass?: CodexResponseTimeoutClass;
-    providerRequestId?: string;
-    status?: number;
-    willRetry?: boolean;
-};
-type CodexRequestContext = {
-    clientVersion: string;
-    /**
-     * Stable per-session affinity id, sent as the `session_id` header on every
-     * request. This is the backend's STICKY CACHE-ROUTING key — measured
-     * 2026-07-12 with byte-identical ~99k-token gpt-5.6-sol requests on one idle
-     * account: without the header, repeat requests hit the prompt cache ~50% of
-     * the time (a per-request routing lottery across cache shards; matches the
-     * prod fleet's 48.6%); with a stable session_id, 10/10 requests hit at the
-     * 99.0% ceiling — Codex CLI parity (the CLI always sends it; its own last-3d
-     * token-weighted rate here is 94%). `prompt_cache_key` in the body only
-     * influences routing and does NOT pin it. Use the SAME value as
-     * prompt_cache_key (the OpenGeni sessionId) so routing and cache key agree.
-     */
-    sessionId?: string;
-    /** Worker-supplied: proactive refresh + single-flight + db persist. */
-    getToken: () => Promise<CodexTokenSnapshot>;
-    /** Forced refresh used for the 401 retry. */
-    refresh: () => Promise<CodexTokenSnapshot>;
-    /** Model-slug resolver (longest-prefix against the live catalog). */
-    resolveModel: (slug: string) => string;
-    /**
-     * Multi-account P4 (Part A): fire-and-forget usage-header sink. Called by
-     * codexSubscriptionFetch on EVERY response (sync, non-throwing, never awaited)
-     * with the parsed full-window snapshot. The worker records the latest into the
-     * P2 usage cache once per turn in its `finally` — packages/codex stays db-free.
-     */
-    onUsageHeaders?: (snapshot: CodexUsageHeaderSnapshot) => void;
-    /** Optional per-run override, primarily for deterministic transport tests. */
-    responseTimeoutPolicy?: Partial<CodexResponseTimeoutPolicy>;
-    /** Worker-owned durable audit sink; payloads never contain request bodies or auth. */
-    onModelRequestEvent?: (event: CodexModelRequestEvent) => Promise<void> | void;
-    /** Stable request identity supplied by the owning durable execution. */
-    nextRequestId?: () => string;
-};
-declare const codexRequestStorage: AsyncLocalStorage<CodexRequestContext>;
-
-declare const CODEX_RESPONSE_TIMEOUT_ERROR_TYPE = "opengeni_codex_response_timeout";
-declare const DEFAULT_CODEX_RESPONSE_TIMEOUT_POLICY: CodexResponseTimeoutPolicy;
-declare function resolveCodexResponseTimeoutPolicy(override: Partial<CodexResponseTimeoutPolicy> | undefined): CodexResponseTimeoutPolicy;
-declare class CodexResponseTimeoutError extends Error {
-    readonly timeoutClass: CodexResponseTimeoutClass;
-    readonly requestId: string;
-    readonly responseObserved: boolean;
-    readonly code = "opengeni_codex_response_timeout";
-    readonly type = "opengeni_codex_response_timeout";
-    constructor(timeoutClass: CodexResponseTimeoutClass, requestId: string, responseObserved: boolean, message?: string);
-}
-type CodexResponseTimeoutInfo = {
-    timeoutClass: CodexResponseTimeoutClass;
-    requestId: string | null;
-    responseObserved: boolean;
-    message: string;
-};
-/**
- * Recover structured transport timeouts through SDK wrapping. The optional
- * legacy match is deliberately opt-in: `Request timed out.` alone has no
- * provider provenance and the worker enables it only for a confirmed Codex
- * subscription turn.
- */
-declare function classifyCodexResponseTimeoutError(error: unknown, options?: {
-    allowLegacyRequestTimeout?: boolean;
-}): CodexResponseTimeoutInfo | null;
-declare function isPreHeadersTimeoutError(error: unknown): CodexResponseTimeoutClass | null;
-
-type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-/**
- * Internal provenance marker copied onto buffered non-OK Codex responses.
- * OpenAI's APIError preserves response headers, which lets the worker
- * distinguish a model-provider refusal from an unrelated sandbox/MCP HTTP
- * error that happened during the same Codex turn.
- */
-declare const CODEX_TRANSPORT_ERROR_HEADER = "x-opengeni-codex-transport-error";
-/** True only for an error produced from this Codex transport's non-OK response. */
-declare function isCodexTransportError(error: unknown): boolean;
-/**
- * Multi-account P4 (Part A): scrape the full usage snapshot the codex backend
- * stamps on every `/codex/responses` response in `x-codex-primary-*` /
- * `x-codex-secondary-*` headers (integer-identical to GET /wham/usage, for free).
- *
- * CRITICAL clobber-fix: return null unless BOTH windows expose a valid used-percent
- * integer. recordCodexAccountUsage writes all five columns unconditionally, so a
- * primary-only snapshot would null the weekly column. Both windows are always
- * emitted together on `/codex/responses`; gating on both makes every write a full
- * 5-column snapshot byte-identical to the poll path, and a malformed/absent header
- * set simply no-ops (the /wham/usage poll fallback still covers it).
- */
-declare function parseCodexUsageHeaders(headers: Headers): CodexUsageHeaderSnapshot | null;
-declare function codexSubscriptionFetch(base?: FetchLike): FetchLike;
-/** The codex backend's hard-cap error type (ChatGPT/Codex usage limit reached). */
-declare const CODEX_USAGE_LIMIT_ERROR_TYPE = "usage_limit_reached";
-type CodexUsageLimitInfo = {
-    /** Seconds until the usage cap resets, when the backend reported it. */
-    resetsInSeconds: number | null;
-};
-/**
- * Classify a thrown error as a ChatGPT/Codex usage-cap (429 usage_limit_reached)
- * and extract the reset window. The SDK surfaces the codex backend's 429 as an
- * OpenAI APIError whose `.type` (and `.error.type`) is `usage_limit_reached` and
- * whose `.error.resets_in_seconds` carries the cap reset. Walks the cause chain
- * and tolerates the message-only shape so it survives any SDK re-wrapping.
- * Returns null for anything that is not a usage cap.
- */
-declare function classifyCodexUsageLimitError(error: unknown): CodexUsageLimitInfo | null;
-type CodexSseFailureProjection = {
-    status: number;
-    error: {
-        type: string;
-        code: string;
-        message: string;
-        param?: string;
-        event_type?: string;
-        response_id?: string;
-        response_status?: string;
-        diagnostic_truncated?: true;
-    };
-    headers: Headers;
-};
-/**
- * A provider terminal carried inside an accepted HTTP-200 stream. The OpenAI
- * SDK cannot turn that late terminal into a non-2xx APIError because headers
- * have already been accepted, so the body transform throws this equivalent
- * bounded shape. Provider-supplied message/param text is intentionally absent:
- * the worker may persist Error.message, while identifiers/classifications are
- * sufficient for retry, compaction, and incident diagnostics.
- */
-declare class CodexStreamingTerminalError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly type: string;
-    readonly eventType?: string;
-    readonly responseId?: string;
-    readonly responseStatus?: string;
-    readonly headers: Headers;
-    readonly error: Record<string, unknown>;
-    constructor(projection: CodexSseFailureProjection, publicMessage: string);
-}
-
-/**
- * Maps connector tool names to a Responses-API-legal charset and back. One
- * instance per codex_apps transport (i.e. per turn): tools/list populates it,
- * tools/call reads it. Idempotent across repeat listings.
- */
-declare class ToolNameMapper {
-    private readonly sanitizedToOriginal;
-    private readonly used;
-    /** Return a legal, unique name (<= EFFECTIVE_MAX_TOOL_NAME_LEN, so `<prefix>__name` <= 64) for `original`, recording the reverse mapping. */
-    sanitize(original: string): string;
-    /** Reverse a sanitized name back to the MCP server's original, if known. */
-    toOriginal(sanitized: string): string | undefined;
-}
-/** Sanitize a single JSON body (application/json MCP response). */
-declare function sanitizeMcpJsonBody(text: string, mapper?: ToolNameMapper, namespaceSink?: Set<string>): string;
-/** Sanitize an SSE body: each JSON-RPC message rides on a `data:` line. */
-declare function sanitizeMcpSseBody(text: string, mapper?: ToolNameMapper, namespaceSink?: Set<string>): string;
-/** Reverse a sanitized tools/call name back to the original; returns null if no rewrite is needed. */
-declare function remapToolCallRequestBody(body: string, mapper: ToolNameMapper): string | null;
-/**
- * Wrap a base fetch so the codex_apps MCP transport is Responses-API-compatible:
- * tools/list responses get their names sanitized + bad outputSchemas dropped (and
- * the name mapping recorded), and tools/call requests get their name reversed back
- * to the MCP server's original. Only the POST request/response is buffered; the
- * long-lived GET notification SSE stream is passed through untouched.
- *
- * P4 (Part B.1): an optional `namespaceSink` Set accumulates the ORIGINAL-dotted
- * connector namespaces seen across every tools/list this turn (captured before the
- * dot is sanitized away). The worker reads the (live, by-reference) Set after the
- * turn to cache the serving account's connector set — packages/codex stays db-free.
- */
-declare function codexAppsSanitizingFetch(base?: FetchLike, namespaceSink?: Set<string>): FetchLike;
-
-/**
- * Protocol-valid image shown to the model when an inline tool image exceeds the
- * hard model-input allowance. The image channel cannot carry a text marker, so
- * the omission itself is rendered as a legible PNG instead of corrupting the
- * original base64 or pretending the placeholder is the real screenshot.
- *
- * Generated with the dependency-free bitmap/PNG encoder documented in
- * `scripts/gen-screenshot-error-card.mjs`; the source image is 1,076x284 RGBA
- * and 5,255 bytes. Rendered text:
- *
- *   SCREEN CAPTURE OMITTED
- *   THE SCREEN CAPTURE IS TOO LARGE.
- *   THIS IS A PLACEHOLDER, NOT THE REAL SCREEN.
- *   DO NOT SAY THIS IS THE REAL SCREEN.
- *   TELL THE USER TO TAKE A SMALLER CAPTURE.
- */
-declare const MODEL_TOOL_OUTPUT_OVERSIZED_IMAGE_CARD_DATA_URL = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABDQAAAEcCAYAAAA4KeSGAAAUTklEQVR42u3cO5JTvRaAUcZAEXTA0BhZT9GJE8fNEBojbWk/VrCi+2OMjqzHd6vOj88/P78AAAAAKvlhEAAAAABBAwAAAEDQAAAAABA0AAAAAEEDAAAAQNAAAAAAEDQAAAAAQQMAAABA0AAAAAAQNAAAAABBAwAAAEDQAAAAABA0AAAAAEEDAAAAQNAAAAAAEDQAAAAAQQMAAABA0AAAAAAQNAAAAAAEDQAAAEDQAAAAABA0AAAAAAQNAAAAQND4T6/nY8npz8/+faO//7ufvzofbv8gsj3v6r+n2/On+vhkn//Rv+9s65vPP/v7AgAQNAQNQUPQEDQEDUFDcBA0AABBQ9AQNAQNQUPQEDQEDZ8vaAAAgoagIWgIGoKGoCFoCBqCBgBAtqARfYDJ/vnRF7ps43P6wmP+3A1K2f989d9v9vm/euHdvZ7Yf3w/AEDQEDQEDUFD0BA0BA1BQzAQNAAAQcOBUtAQNAQNQUPQEDQEDUEDABA0XEgFDfNH0BA0BA37j+8HAAgagoagEfX52S+EgoagIWjcG5/qLx0WNAQNAEDQcCEVNAQNQUPQEDQEDUEDAEDQEDQEDfNH0BA0BA37j6ABAAgagoagIWgIGoKGoCFoCAaCBgAwK2i8+9K3bC+VfPf7rn7/6p8vaOwd/9WXKO5+yWL1oFHt9yVoCBo7//3Z9l9BAwAQNAQNQUPQEDQEDUFD0BA0AABBQ9AQNAQNQUPQEDQEDUFD0AAABA1BQ9AQNAQNQUPQEDQEDUEDAKgeND6bvVTTgXvvBdBLQWcFoewX6u4XMi+t9VLQTy8FBQAEDUHDgVvQEDQEDUFD0BA0BA0AQNAQNAQNQUPQEDQEDeuroAEAIGgIGoKGoCFouJAJGtYPQQMAEDQEjUv/vQOt8RE04sYn2+9X0BA0BA0AAEFD0HCgFTQEDUFD0LB+WP8BAEFD0BA0BA1BQ9AQNAQNQUPQAAAEDUHDgVvQEDQEDUFD0BA0AADyBI3vXgK5+yWRu/++0wf+6O9fbXxuX/CqzZ/qQWj3+lD995t9/k8f/2rBINv+4hAGAAgagoagIWgIGoKGoCFoCBoAgKAhaAgagoagIWgIGsZf0BA0AABBQ9AQNAQNQcOFWtAQNAQNQQMAmPZSUAAAAABBAwAAABA0AAAAAAQNAAAAAEEDAAAAEDQAAAAABA0AAAAAQQMAAAAQNAAAAAAEDQAAAABBAwAAABA0AAAAAAQNAAAAAEEDAAAAEDQAAAAABA0AAAAAQQMAAABA0AAAAAAEDQAAAABBAwAAAEDQAAAAAAQNAAAAAEEDAAAAQNAAAAAA+gaNj1+/vyK9no+tvvv81e93+vufFv39o59vtu97e/5Ez//p87P676n6+nl7fKrvj6efx7Txif73ZFuPsz3vbPO92vkBoAtBQ9AQNAQN81PQEDRc2I2PoCFoCBoAgoYDuaAhaAgagoagIWgIGoKGoCFoCBoAgoagIWgIGoKGoCFoCBqChqAhaAgaggbA6aARvWGePpBXe8DR3z/7599+vqc/f/XAZ36enT/d/7z1ufb+aHxqrw/WZ+cHAEHDgUTQcOARNByYBQ1BQ9AwPoKG9VnQABA0BA0HEkFD0DB/BA3rs6Dh/GB9tv4IGgCChgOzoCFoCBqChqDhwi5oWB+sz84PAIKGA4mg4cDTaXyyz28HZkFD0BA0nB8EDeuPoAEgaDgwCxqChqAhaLhQuLAbH+uD9dn5AUDQcCARNBx4BA0HZkFD0BA0jI+gYX0WNAAEDUFD0BA0BA3zR9CwPgsazg+ChvVH0AAQNP7tpYjv2v352Q+A2V8qGT3+3T5f0Ji1PlS70FX7fXUL0sZH0LA+3zv/TD9/AggagoagIWgIGtYHQUPQEDQEDeuzoCFoAAgagoagIWg4MAsagoagIWgIGtZnQQNA0BA0BA1BQ9BwYBY0BA1BQ9AQNAQNQQNA0PBS0AoHxuwvvfTS1LUDlZfO9Q5Ct8fHSy9nX2idHwSNyeuP8yeAoGFDETQEDUFD0BA0BA1BQ9CwPgsaAIKGA4kNRdAQNByYBQ1BQ9AQNAQNQcP5E0DQcCARNAQNQUPQsH4KGoKG+S9oWH+cPwEEDRuKoHH7v592IHRgFjROjk+236+gIWgIGnPW59PrT7b9xUtGAUHDgUTQEDQEDQdm66egIWiY/9Zn64+gASBouLAIGoKGoCFoCBqChqAhaFifBQ1BA0DQEDQEDUHDgVnQcKEQNAQNQcP6LGgIGoCgMfNAsur2+EZ/391/X/Xne/rzq19Yqs+f6heO3euD9Tl2vkePz7Tgk21/rL4eV1+fd790O9v5QdAABA1BQ9AQNAQNQUPQsD4LGoKGoCFoCBoAgoagIWgIGoKGoCFoWJ8FDUFD0BA0BA0AQcOBWdAQNAQNQUPQEDQEDUFD0BA0BA1A0AAAAAAQNAAAAAAEDQAAAEDQAAAAABA0AAAAAAQNAAAAQNAAAAAAEDQAAAAABA0AAAAAQQMAAAAQNAAAAAAEDQAAAABBAwAAABA0AAAAAAQNAAAAAEEDAAAAEDQAAAAABA0AAAAAQQMAAAAQNAAAAAAEDQAAAABBAwAAABA0AAAAAAQNAAAAgFpB4/V8bPXd569+v9Pff/ffd3oCGZ/Y8ar2fVefZ/Xxj17fqq2f0eMfPX+yr2fR86f7Aajb/Hd+6H0+tL712l8877v7V/b9N9v5TdCwYQkagoagIWjYEAUNQUPQEDScDwUNQUPQEDQEDUFD0BA0BA1BQ9AQNAQNQUPQEDQEDUFD0BA0BA1Bw4YlaAgagoagIWgIGg5UgoagIWgIGoKGoCFoOL8JGrkPFN3+vAOjf3/l73/6Qjrt+1cfH/PH+nvzgJ99/ts/e/9+7e+eb+fzg/mZe/8SNAQJB0bjI2g48DgwGH9BQ9BwvhA0BA3rs6BhfgoagoY/L2g4MAgavr+gYf5YfwUN+6cLr/XN8xU0nN8EDUHDgcOF3r/fhmJDFDTMH/uToGH/dOG1vnm+zieChqAhaDgwGh9Bw4HHgUHQEDR6rc/R/7vnJ2gIGoKGoGF+Zty/BA1BwoHR+AgaDjwODMZf0BA0nC8EDUHD+ixomJ+ChqDhzwsaDgyChu8vaJg/1l9Bw/7pwmt983wFDec3QUPQcOBwoffvt6HYEAUN88f+JGjYP114rW+er/OJoCFo5Jqwq25P2OjvW31BrTY+t+fn7e+f/aVJq/+e7N+/+vhMOzBne77dAoagMfvCHb2+TTuf2L9+t3oJcrfz27TPFzRsWIKGoCFoCBqChqAhaAgagoagIWgIGoKGoCFoCBqChqBhfAQNQUPQEDQEDUFD0BA0BA1BQ9AwPwUNQUPQEDQEDUFD0BA0BA1BQ9AQNAQNF0ZBQ9AQNAQNLwX10sY536/7SzW9VMpLpbwU1Pyp8vdnv9Dt/vcIGl4K2jno2b8E38r717TzW/f/A0PQcOEUFAQNC76gIWgIGoKGoCFoCBqChqAhaAgagoagIWgYH/PLgcf4GH9BQ9AQNAQNQcP6LGiYn4KGoCFoCBqChqDhQipoCBqChqAhaLjwujB6voKGoCFoCBounIKCoGHBFzQEDfPn4/BLnKddmAUNQaPT+GZ/aaTnOytodJ+f2dbH7EFE0HDhFBQEDQu+oCFomD+ChqAhaAgagoagIWg4vwkagoagYXzMLxd242P8BQ1BQ9AQNAQN67OgYX4KGoKGoCFoCBqChgupoCFoCBrmv6DhwuvC6PkKGoKGoCForP1gV+3+/GzPz/gIGpnnz+0F//T8rz4+3def7s/XhTl2/gsavc+H3YJetfWt2/ON/r6e7+zzm6AhaAgagoagIWjYEAUNQUPQEDScDwUNQUPQcL8TNAQNQUPQEDQEDUFD0BA0BA1BQ9Bw4RU0PF9BQ9AQNGxYLuyChqAhaAgagoagIWgIGs6HgoagIWgIGs5vggYAAACAoAEAAAAIGgAAAACCBgAAAICgAQAAAAgaBgIAAAAQNAAAAAAEDQAAAABBAwAAABA0AAAAAAQNAAAAAEEDAAAAEDQAAAAABA0AAAAAQQMAAAAQNAAAAAAEDQAAAABBAwAAABA0AAAAAAQNAAAAAEEDAAAAEDQAAAAABA0AAAAAQQMAAADgTNB4PR9Lov++2w9g97/39PisPt/sz+P2eGWbP9nG+7vvHz0+p+d/td+X8TH/O49/9fmffX+Y9ry7zc/q6xsgaAgagoagIWi40LmwGx/zX9AQNAQNQUPQAAQNQUPQEDQEDUHDhd34CBqChqAhaAgaggYgaAgagoag4UInaAga5r+gIWgIGoKGoOFSCILGrQtX9wtd9fHJvmFEfz/zv1bw8/uZ9XyNz931p/v4Tt9f7O/m58nPnx7sQNAQNAQNQUPQEDT8fgQN4+PCK2h4vs4PggYgaLjQCRqChvkvaLiwGx9BQ9Bw4bW/m5+CBiBoCBqChqAhaPjzLuzGx4XXhdHzFTQEDUEDEDSyBo3T/7ugUftA0v2AKmi4sBsfQUPQ8HwFDUEj2/kYEDQEDUHDgUfQECRc2I2PoCFoCBqChvkpaACChqAhaAgagoY/70JpfFx4XRg9X0FD0BA0QNAQNAQNQUPQcKHz+xE0zH8XXkFD0BA0BA1A0BA0BI2KF+jdL51aNe3Ct/vfX338o79v9QuH8Tk7/0//nm6v96fX/2zPt1sgzP5SyenzU9AABA1BQ9AQNAQNQUPQEDQEDRdGQUPQEDQEDRA0BA1BQ9AQNFzoXNgFDfNf0BA0BA1BQ9AABA1BQ9AQNAQNQcOF3fgIGoKGoCFomJ+CBiBo9Awa724QgkatIGX8vdSz8kvxqn+/7uPjpZG9zxeeb+35YX7mPj8DgoagIWgIGsZf0HBhNz6ChvVb0LC/m5+CBiBoCBqChgOxoCFouLAbHxdeF0bPV9AQNAQNQNAQNFyoBQ1BQ9AQNAQNQUPQEDQEDUHDpRAEDUHD+Agaxl/QcGE3PoJG1/Ul+0sjPd9ZQaP7/My2PgoiIGgIGoKGoGH8BQ0XduMjaAgagob93fwUNABBw4XDhVrQEDQEDUHD+LjwujB6voKGoCFogKDhwi5ouFALGi501hdBw/wXNAQNQUPQEDQEDRA0/nUB2L1ARH9+9wV59/hUuzDsHh9BY9aFbvd8Or1+Zvt9dR8f83/W/6EQPf8931rnz+7Pt/r8FzRA0BA0BA1BQ9BwoRM0jI/5L2gIGoKGoCFoAIKGoCFoCBqChqAhaAgagoag4fkKGoKGoAEIGoKGoCFouNAJGoKG+e/CK2gIGoKGoCFogKABAAAAIGgAAAAACBoAAACAoAEAAAAgaAAAAAAIGgAAAICgAQAAACBoAAAAAAgaAAAAgKABAAAAIGgAAAAACBoAAACAoAEAAAAgaAAAAAAIGgAAAACCBgAAACBoAAAAAAgaAAAAAIIGAAAAIGgAAAAACBoAAAAAggYAAAAgaAAAAAAIGgAAAADZgsbr+djq9udHj0+1CZR9/G/Pn9PjH/3nq/9+sz/P2/PT+JwdH+tb7PPutl9WW/9vn39Of7796+z8Pz0/s31+9fNztv0dQUPQEDQEDUFD0HBhNz6ChqAhaAga9i9BQ9AQNBA0BA1Bw4Ff0HAgFDQEDUFD0BA0BA1BQ9AQNAQNBA1BQ9AQNAQNQUPQEDQEDUFD0BA0BA1BQ9BA0Kh8IZv2+dOf7+1gVX18p/++qh0QjU/v9SfbhXH6+SD7hXr3f29/sX9NGp/q+2v18REkEDRsiA6kgoYDpwu78RE0rG+ChqBh/xI0BA1BA0FD0BA0XCgEDQdCF3bjI2g4Hwga9hf7l6AhaDifI2gIGoKGoCFoOBAKGtYfQcOFTtBwfjP/BQ1BQ9BA0LAhOpAKGg6cLuzGp9f60/35uNDFfn72+ef8Zv4LGoKGoIGgYcNyIBU0HDhd2AUNQUPQcKETNHy++S9oCBoIGg4sgoYLhfH1+3JhNz6ChucnaNhf7F+ChqAhaCBoCBqChqAhaDgQChrGR9BwoRM07C/mv6Dh/CxoIGi8/1Ksd1+CJWj0er6rL0lbnT/dDvzRv69qn+/CPitonF5/ol8aWW19m/bvyRY0oud/t5eyTt+/so9/9vNhtaBh/iNoCBqChqAhaNgQBQ3rj6AhaAgagobzifOhoCFoIGgIGi4UgoagIWgIGoKGoCFoCBqChqAhaAgaCBqChqAhaAgagoagIWgIGoKGoCFo2L8EDUHD/EfQ8FJQQcNLQf1++v/9gobx8VJQL/XNun55KWjvl75OCxrdxtf+JVAgaNgQHUhdaB3IPH9Bw4HQ/BY0BA1BQ9AQNOxfCBouZIKGoGF8BQ3PX9BwILS+CRqChv1L0LB/2b8QNAQNQcOG5ffjQChoWH8cCAUNQcP5TdBwPrR/CRoIGjZEB1IXWkHjY/NLTz1/QSPT+tN9PjsQCxrOb31+74KG/avSfPaSUUFD0BA0BA2/H0HD78v4CBqChqAhaNi/BA37l6CBoGHDEjQEDUHDgVDQsP4IGoKGoCFoCBqChv1L0EDQEDRcKAQNQUPQEDQcCK1vgoagIWgIGoKG/UvQEDQy/2BXdft8F4pZ47/7+0aPx+nflwv72flj/cl1Yay2vlX//Z5eP83P3p9fff+qNj7V17/T58Pq+5egIWgIGoKGoCFoCBqChvVH0BA0BA1Bw/4laAgaggaChqAhaDjwCxoOhIKGoCFoCBrmp6AhaAgagoaggaAhaLhQCBqChqAhaAgagoagIWgIGoKGoCFoCBqCBgAAAICgAQAAACBoAAAAAIIGAAAAgKABAAAAIGgAAAAAggYAAACAoAEAAAAgaAAAAACCBgAAAICgAQAAACBoAAAAAAgaAAAAgKABAAAAIGgAAAAACBoAAACAoAEAAAAgaAAAAAAIGgAAAICgAQAAACBoAAAAAAgaAAAAgKABAAAAIGgAAAAAbPAXSdffkpULfXUAAAAASUVORK5CYII=";
-
-/**
- * Canonical model-facing tool-output truncation.
- *
- * Ported from openai/codex `rust-v0.144.6` (commit
- * 5d1fbf26c43abc65a203928b2e31561cb039e06d):
- *
- * - `codex-rs/utils/string/src/truncate.rs`
- * - `codex-rs/utils/output-truncation/src/lib.rs`
- * - `codex-rs/core/src/context_manager/history.rs`
- *
- * The live gpt-5.6 model catalog declares a 10,000-token truncation policy.
- * Codex applies a 1.2x allowance before serializing a function-call output, so
- * the effective textual payload budget is 12,000 approximate tokens. Images,
- * files, and encrypted content are preserved; textual content shares one
- * sequential budget and carries an explicit head/tail truncation marker.
- *
- * This module deliberately has no database or Agents SDK dependency. Both the
- * runtime request seam and the database history boundary call the same pure
- * function, so replayed conversation truth is identical to live model input.
- */
-
-type ModelHistoryItem = Record<string, unknown>;
-declare const CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS = 10000;
-declare const CODEX_TOOL_OUTPUT_SERIALIZATION_ALLOWANCE = 1.2;
-declare const DEFAULT_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS = 10000;
-declare const MODEL_TOOL_OUTPUT_OPAQUE_PAYLOAD_MAX_BYTES: number;
-declare function modelToolOutputSerializationBudgetTokens(policyTokens?: number): number;
-declare function approximateTokenCount(value: string): number;
-/** Exact Codex-style middle truncation for a token policy. */
-declare function truncateMiddleWithTokenBudget(value: string, maxTokens: number): string;
-/**
- * Bound every model-visible tool-result item. Non-result items are returned by
- * reference. Result items are cloned only when their textual output changes.
- */
-declare function boundModelToolOutputItem<T extends ModelHistoryItem>(item: T, policyTokens?: number): T;
-declare function boundModelToolOutputItems<T extends ModelHistoryItem>(items: readonly T[], policyTokens?: number): T[];
-
-export { CODEX_FIVE_HOUR_WINDOW_SECONDS, CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS, CODEX_RATE_LIMIT_RESET_OUTCOMES, CODEX_RESPONSE_TIMEOUT_ERROR_TYPE, CODEX_TOOL_OUTPUT_SERIALIZATION_ALLOWANCE, CODEX_TRANSPORT_ERROR_HEADER, CODEX_USAGE_LIMIT_ERROR_TYPE, CODEX_WEEKLY_WINDOW_SECONDS, type CodexAdditionalLimit, type CodexAuthHeaders, CodexDeviceError, type CodexDeviceStart, type CodexFetch, type CodexModelRequestEvent, type CodexPollResult, type CodexRateLimitResetConsumeResponse, type CodexRateLimitResetCredit, type CodexRateLimitResetCreditStatus, type CodexRateLimitResetCreditsDetails, type CodexRateLimitResetCreditsSummary, type CodexRateLimitResetOutcome, type CodexRateLimitResetType, type CodexRefreshTokens, CodexRefreshTransient, CodexReloginRequired, type CodexRequestContext, type CodexResponseTimeoutClass, CodexResponseTimeoutError, type CodexResponseTimeoutInfo, type CodexResponseTimeoutPolicy, type CodexSseFailureProjection, CodexStreamingTerminalError, type CodexTokenSnapshot, type CodexTokens, type CodexUsageHeaderSnapshot, type CodexUsageLimitInfo, type CodexUsagePayload, type CodexUsageStatus, type CodexUsageWindow, DEFAULT_CODEX_RESPONSE_TIMEOUT_POLICY, DEFAULT_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS, type FetchLike, MODEL_TOOL_OUTPUT_OPAQUE_PAYLOAD_MAX_BYTES, MODEL_TOOL_OUTPUT_OVERSIZED_IMAGE_CARD_DATA_URL, type ModelHistoryItem, type ResetCreditFetchFailureReason, ToolNameMapper, accessTokenExpiry, approximateTokenCount, boundModelToolOutputItem, boundModelToolOutputItems, buildCodexUsageWindowFromCache, buildModelResolver, classifyCodexResponseTimeoutError, classifyCodexUsageLimitError, codexAppsSanitizingFetch, codexRequestStorage, codexSubscriptionFetch, consumeCodexRateLimitResetCredit, decodeJwtPayload, exchangeDeviceCode, fetchCodexModels, fetchCodexRateLimitResetCredits, fetchCodexUsage, isCodexBilledModel, isCodexTransportError, isPreHeadersTimeoutError, modelToolOutputSerializationBudgetTokens, normalizeCodexRequestBody, normalizeCodexUsage, parseCodexRateLimitResetConsumeResponse, parseCodexRateLimitResetCreditsDetails, parseCodexRateLimitResetCreditsSummary, parseCodexUsageHeaders, parseIdToken, pollDeviceCode, refreshCodexToken, remapToolCallRequestBody, resolveCodexResponseTimeoutPolicy, sanitizeMcpJsonBody, sanitizeMcpSseBody, startDeviceCode, truncateMiddleWithTokenBudget };
+export * from "./constants";
+export * from "./billing";
+export * from "./device-code";
+export * from "./refresh";
+export * from "./normalize";
+export * from "./usage-normalize";
+export * from "./reset-credits";
+export * from "./api-client";
+export * from "./request-context";
+export * from "./response-timeout";
+export * from "./fetch";
+export * from "./mcp-sanitize";
+export * from "./model-output-truncation";

package/dist/index.js

@@ -261,7 +261,8 @@ var CODEX_ALLOWED_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "stream",
   "include",
   "prompt_cache_key",
-  "text"
+  "text",
+  "service_tier"
 ]);
 function normalizeCodexRequestBody(body, resolveModel) {
   body.store = false;
@@ -652,6 +653,11 @@ async function consumeCodexRateLimitResetCredit(a, input, fetchImpl = fetch, tim
 // src/request-context.ts
 import { AsyncLocalStorage } from "async_hooks";
 var codexRequestStorage = new AsyncLocalStorage();
+function withCodexRequestOverrides(overrides, fn) {
+  const current = codexRequestStorage.getStore();
+  if (!current) return fn();
+  return codexRequestStorage.run({ ...current, ...overrides }, fn);
+}
 
 // src/response-timeout.ts
 var CODEX_RESPONSE_TIMEOUT_ERROR_TYPE = "opengeni_codex_response_timeout";
@@ -767,6 +773,31 @@ function isCodexTransportError(error) {
   }
   return false;
 }
+function classifyCodexEncryptedArtifactRejection(error) {
+  if (!isCodexTransportError(error)) return null;
+  let current = error;
+  for (let depth = 0; depth < 6 && current && typeof current === "object"; depth += 1) {
+    const value = current;
+    const body = value.error && typeof value.error === "object" ? value.error : null;
+    const status = Number(value.status ?? body?.status);
+    const message = [
+      typeof value.message === "string" ? value.message : "",
+      typeof body?.message === "string" ? body.message : "",
+      typeof value.code === "string" ? value.code : "",
+      typeof body?.code === "string" ? body.code : "",
+      typeof value.type === "string" ? value.type : "",
+      typeof body?.type === "string" ? body.type : ""
+    ].join(" ").toLowerCase();
+    const unsupportedFieldShape = /(?:invalid value|supported values?|unsupported|unknown (?:field|parameter|value))/.test(
+      message
+    );
+    if (status === 400 && !unsupportedFieldShape && /(?:encrypted[_ ]content|encrypted reasoning|reasoning artifact)/.test(message) && /(?:decrypt(?:ed|ion)?|could not be parsed|cannot be parsed|failed to parse)/.test(message)) {
+      return { status: 400, kind: "encrypted_content_rejected" };
+    }
+    current = value.cause;
+  }
+  return null;
+}
 function parseIntHeader(value) {
   if (value === null) {
     return null;
@@ -930,7 +961,9 @@ async function observedResponse(res, audit, externalSignal) {
       if (externalSignal?.aborted) {
         abortFromOutside();
       } else {
-        externalSignal?.addEventListener("abort", abortFromOutside, { once: true });
+        externalSignal?.addEventListener("abort", abortFromOutside, {
+          once: true
+        });
       }
     },
     async pull(controller) {
@@ -990,7 +1023,11 @@ async function observedResponse(res, audit, externalSignal) {
   });
   const headers = new Headers(res.headers);
   headers.delete("content-length");
-  return new Response(body, { status: res.status, statusText: res.statusText, headers });
+  return new Response(body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers
+  });
 }
 function timeoutErrorResponse(info) {
   return new Response(
@@ -1045,6 +1082,12 @@ function codexSubscriptionFetch(base = globalThis.fetch) {
       }
       headers.delete("OpenAI-Beta");
       headers.delete("x-api-key");
+      if (ctx.betaFeatures && ctx.betaFeatures.length > 0) {
+        headers.set("x-codex-beta-features", ctx.betaFeatures.join(","));
+      }
+      if (ctx.turnMetadata && Object.keys(ctx.turnMetadata).length > 0) {
+        headers.set("x-codex-turn-metadata", JSON.stringify(ctx.turnMetadata));
+      }
       let callerWantsStream = true;
       let model;
       const nextInit = { ...init, headers };
@@ -2234,6 +2277,7 @@ export {
   boundModelToolOutputItems,
   buildCodexUsageWindowFromCache,
   buildModelResolver,
+  classifyCodexEncryptedArtifactRejection,
   classifyCodexResponseTimeoutError,
   classifyCodexUsageLimitError,
   codexAppsSanitizingFetch,
@@ -2263,6 +2307,7 @@ export {
   sanitizeMcpJsonBody,
   sanitizeMcpSseBody,
   startDeviceCode,
-  truncateMiddleWithTokenBudget
+  truncateMiddleWithTokenBudget,
+  withCodexRequestOverrides
 };
 //# sourceMappingURL=index.js.map