@sema-agent/core 7.51.2 → 7.53.0

package/dist/brain/request-params.js

@@ -1,3 +1,4 @@
+import { isCredentialHeaderName } from "../core/secret-env.js";
 export const OPENAI_RESERVED = new Set([
     "model",
     "messages",
@@ -52,7 +53,6 @@ export function applyExtraBody(body, extraBody, reserved) {
     }
     return { body: { ...passthrough, ...body }, dropped: dropped.length === 0 ? NO_KEYS : dropped };
 }
-export const AUTH_CARRIER_NAMES = new Set(["authorization", "x-api-key"]);
 export function lockHeader(headers, lowerName, value) {
     for (const k of Object.keys(headers)) {
         if (k !== lowerName && k.toLowerCase() === lowerName)
@@ -70,6 +70,9 @@ export function takeHeaderCasefold(headers, lowerName) {
     }
     return undefined;
 }
+export function headerBagOnce(bag) {
+    return bag === undefined ? undefined : { ...bag };
+}
 export function mergeHeaders(...bags) {
     const out = {};
     const spellingByFold = new Map();
@@ -78,7 +81,7 @@ export function mergeHeaders(...bags) {
             continue;
         for (const [name, value] of Object.entries(bag)) {
             const fold = name.toLowerCase();
-            if (AUTH_CARRIER_NAMES.has(fold)) {
+            if (isCredentialHeaderName(name)) {
                 out[name] = value;
                 continue;
             }

package/dist/brain/request-route.d.ts

@@ -13,8 +13,8 @@
 import type { RouteCredential } from "../internal/llm.js";
 /** Where the credential a request would carry came from.
  *  - `"per-model"` — resolved FOR this model: a per-call key/headers from the per-model auth hook
- *    (`getApiKeyAndHeaders`), or an auth-bearing header declared on `Model.headers`. Paired by
- *    construction (the resolver was asked about THIS entry), so the adjudicator never refuses it.
+ *    (`getApiKeyAndHeaders`), or a credential header declared on `Model.headers`. Bound to the
+ *    origin of the first request sent carrying it; refused only on its way to another origin.
  *  - `"deployment-config"` — the brain construction-time fallback (`config.apiKey` / an auth header
  *    in `config.headers`). Paired only with the deployment's own root (`config.baseUrl`, else the lane's default).
  *  - `"absent"` — no credential anywhere. Legal for keyless gateways; refused only where an entry
@@ -40,8 +40,9 @@ export type RequestRootOrigin = (typeof REQUEST_ROOT_ORIGINS)[number];
  *  - `credentialSource` — {@link RouteCredentialSource}.
  *  - `carrier` — how the credential rode ({@link RouteCarrier}); absent exactly when `credentialSource` is `"absent"`.
  *  - `carrierBag` — the header bag whose auth header rode ({@link RouteCarrierBag}); present exactly when one did:
- *    with carrier `"header"`, and beside carrier `"apiKey"` in the deployment shape that sets both `config.apiKey`
- *    and an auth header in `config.headers` (both ride).
+ *    with carrier `"header"`, and beside carrier `"apiKey"` when one source sets both — the per-model hook's answer
+ *    (`apiKey` and an auth header in its `headers`) or the deployment (`config.apiKey` and an auth header in
+ *    `config.headers`); both ride.
  *  - `root` — which knob named the request's root ({@link RequestRootOrigin}).
  * The legal shapes are exactly the rows of {@link ROUTE_CREDENTIAL_PAIRING}.
  */
@@ -62,16 +63,16 @@ export interface RouteCredentialPairingRow {
     /** The knob(s) the credential is read from, in this engine's own spelling (`getApiKeyAndHeaders` is the per-model
      *  auth hook, whose answer reaches the brain as the per-call options). Empty for `"absent"`. */
     readonly credentialKnobs: readonly string[];
-    /** The root knob the credential is paired with: `"Model.baseUrl"` for a per-model credential (paired by
-     *  construction — it was resolved for this entry), `"config.baseUrl"` for the deployment credential (paired only
+    /** The root knob the credential is paired with: `"Model.baseUrl"` for a per-model credential (paired with the
+     *  ORIGIN that knob named the first time the credential was judged), `"config.baseUrl"` for the deployment credential (paired only
      *  when the request targets that root — or, undeclared, the lane's own default endpoint). Absent for
      *  `"absent"`. */
     readonly pairsWith?: "Model.baseUrl" | "config.baseUrl";
 }
 /**
  * The pairing law as a table — one row per route shape a request can carry, in resolution precedence (an earlier
- * row's source wins when several are configured; the three deployment rows are one rank, the deployment credential
- * judged as one). A consumer naming "which key was that" reads the row a {@link RequestRoute} lands on (same
+ * row's source wins when several are configured; one rank per source — the first three rows are the per-model hook's
+ * answer, the three deployment rows the deployment config, each source's credential judged as one). A consumer naming "which key was that" reads the row a {@link RequestRoute} lands on (same
  * `credentialSource` / `carrier` / `carrierBag`), never a sentence. The verdicts the law gives these shapes are the
  * conformance corpus's (`ROUTE_ADJUDICATION_CONFORMANCE_CORPUS`).
  */

package/dist/brain/request-route.js

@@ -14,6 +14,7 @@ export function requestRouteOf(credential, root) {
 }
 export const ROUTE_CREDENTIAL_PAIRING = Object.freeze([
     { credentialSource: "per-model", carrier: "apiKey", credentialKnobs: ["getApiKeyAndHeaders().apiKey"], pairsWith: "Model.baseUrl" },
+    { credentialSource: "per-model", carrier: "apiKey", carrierBag: "options", credentialKnobs: ["getApiKeyAndHeaders().apiKey", "getApiKeyAndHeaders().headers"], pairsWith: "Model.baseUrl" },
     { credentialSource: "per-model", carrier: "header", carrierBag: "options", credentialKnobs: ["getApiKeyAndHeaders().headers"], pairsWith: "Model.baseUrl" },
     { credentialSource: "per-model", carrier: "header", carrierBag: "model", credentialKnobs: ["Model.headers"], pairsWith: "Model.baseUrl" },
     { credentialSource: "deployment-config", carrier: "apiKey", credentialKnobs: ["config.apiKey"], pairsWith: "config.baseUrl" },

package/dist/brain/route-adjudicator.d.ts

@@ -11,10 +11,19 @@
  * external consumers (a server annotating a model roster, a conformance suite) import so there is
  * exactly one implementation of the law.
  *
- * The judgment, by credential source (see {@link RouteCredentialSource}):
- *  - `per-model` → OK always. A per-model credential was resolved FOR this entry (auth hook or an
- *    auth header on `Model.headers`); it is paired by construction, so the per-model lane pays no
- *    new cost.
+ * The judgment, by credential source (see {@link RouteCredentialSource}). ONE law for both credential
+ * sources — **a credential has exactly one root** — differing only in where that root comes from:
+ *  - `per-model` → a per-model credential (auth hook or a credential header on `Model.headers`) is bound to the
+ *    ORIGIN (scheme + host + port) of the first request the engine SENT carrying it, in the engine's one
+ *    credential-origin table ({@link credentialOriginTable}) — written only by a brain's request gate when the request
+ *    goes out ({@link admitRouteRequest}), read by every judgment; a request carrying it to another origin is
+ *    refused (`route.credential_origin_mismatch`), a request to another path of the same origin is not. An
+ *    entry whose `baseUrl` moves to another host while its credential stays the same therefore sends
+ *    nothing: the credential belongs to the host it was first sent to, and a NEW credential (the entry's
+ *    credential reference changed with its address) is a new binding. The binding lasts for the process. Before any
+ *    origin is read, a per-model credential is ONE value per header: a request whose per-call `apiKey` is set beside a
+ *    header of the very name its lane writes that key in carries two values for one header, and is refused
+ *    (`route.credential_answer_conflict`) wherever it is going.
  *  - `deployment-config` → a deployment credential has exactly ONE root: the one its brain sends to when
  *    an entry names none — `config.baseUrl`, else the lane's own default endpoint
  *    (`RoutePairingConfig.laneDefault`). A request to that root is `"paired"`; a request to any other
@@ -32,13 +41,18 @@
  * Bad-value loudness (garbage / contradiction / absence / misplacement):
  *  - garbage — non-string URL/credential inputs throw a `TypeError` here (a programmer error must
  *    not be laundered into a polite verdict); whitespace-only URLs normalize to "" (undeclared).
- *  - contradiction — the torn pair refuses with `route.credential_mismatch` + both halves named.
+ *  - contradiction — the torn pair refuses with `route.credential_mismatch` + both halves named; a bound
+ *    per-model credential sent elsewhere refuses with `route.credential_origin_mismatch` + both origins named; a
+ *    per-call key beside its own header refuses with `route.credential_answer_conflict` + both header names named.
+ *    Each is a VERDICT, one shape for every caller of the law ({@link adjudicateModelRoute}, which throws on garbage
+ *    alone): the request gate, a pre-flight, the read face and a failover chain read the same refusal.
  *  - absence — `route.credential_missing` with the fix hint, exactly where absence is a hole.
  *  - misplacement — a credential in the URL, or a non-http(s) root: {@link assertServableRequestRoot}.
  */
 import type { Model } from "../internal/llm.js";
 import type { RouteAdjudication, RouteCredential, RoutePairingConfig, RoutePairingPosture } from "../internal/llm.js";
 import type { Brain, EngineNotice } from "../core/types.js";
+import { BrainError } from "./errors.js";
 import type { RequestRootOrigin } from "./request-route.js";
 /** A base URL's ROUTE KEY — the value the pairing law COMPARES, folded to WIRE equivalence: the
  *  halves the wire itself treats as case-insensitive (scheme and host, RFC 9110) fold, the scheme's
@@ -119,25 +133,39 @@ export declare function resolveRequestRootOf(modelBaseUrl: string | undefined, c
     root: string;
     origin: RequestRootOrigin;
 };
-/** Whether a header bag carries an auth-bearing header (any case). */
+/** Whether a header bag carries a credential header (any case) — the engine's one reading of which header carries a
+ *  credential ({@link isCredentialHeaderName}: `Authorization`, `X-Api-Key`, Azure's `api-key`, `x-goog-api-key`,
+ *  `Cookie`, …), the same reading the withheld-value intake keeps. */
 export declare function hasAuthCarrier(headers: Record<string, string> | undefined): boolean;
+/** Test seam: empties the process's credential-origin table — every per-model credential is unbound again, as at a
+ *  process start. Never called by production code (a binding lasts as long as the process; restarting rebinds). A test
+ *  suite that sends one fixture credential to two local mock upstreams (two `listen(0)` ports are two origins) calls it
+ *  between cases, or gives each case its own fixture credential. */
+export declare function __resetCredentialOriginBindings(): void;
 /**
  * Resolve WHICH credential a request would carry, tagged with its source — the input half of the
- * adjudication. Precedence (most-specific wins):
- *   1. `options.apiKey` (per-call, from the per-model auth hook — presence, not truthiness: an
- *      empty string is a present credential that fails closed at emit),
- *   2. an auth carrier in `options.headers` (per-call headers-borne). The bag MUST be per-model
- *      sourced (the per-model auth hook's headers) — that provenance is what licenses the
- *      "paired by construction" verdict below. A caller that folds run-wide headers into the
- *      per-call options must strip auth carriers first (the harness merge does), or a deployment
+ * adjudication. One rank per SOURCE, most-specific wins; within a rank the apiKey knob and the rank's
+ * credential headers are ONE credential (they ride together and are bound together):
+ *   1. the per-model auth hook's answer — `options.apiKey` (presence, not truthiness: an empty string
+ *      is a present credential that fails closed at emit — no key header, no fallback to the
+ *      deployment's) and/or a credential header ({@link hasAuthCarrier}) in `options.headers` (a
+ *      gateway's own `Helicone-Auth` beside the key, or the key spelled as a header — not both: an `apiKey`
+ *      beside a header of the very name the lane writes the key in (`keyHeader`) is resolved all the same, with
+ *      that conflict recorded beside it for the law to refuse). The bag MUST be
+ *      per-model sourced (the hook's headers) — that provenance is what makes it a credential of THIS
+ *      entry, bound to its own origin below. A caller that folds run-wide headers into the per-call
+ *      options must strip credential headers first (the harness merge does), or a deployment
  *      credential would ride here and be judged per-model,
- *   3. an auth carrier in `model.headers` (the ENTRY's own declared credential),
- *   4. the deployment config (`config.apiKey` and/or an auth carrier in `config.headers` —
- *      deliberately ONE rank, not two: a config carrying BOTH forms is the documented gateway
- *      dual-auth escape shape, and both ride exactly as they always have; the pairing gate judges
+ *   2. a credential header in `model.headers` (the ENTRY's own declared credential),
+ *   3. the deployment config (`config.apiKey` and/or a credential header in `config.headers` — the
+ *      documented gateway dual-auth shape, both riding as they always have; the pairing gate judges
  *      the pair as one deployment credential),
- *   5. absent.
- * 1–3 are `per-model`; 4 is `deployment-config`.
+ *   4. absent.
+ * 1–2 are `per-model`; 3 is `deployment-config`. A per-model credential that carries a secret leaves
+ * here with its identity beside it (a digest, held by this module and never a member of the returned
+ * object), which {@link adjudicateModelRoute} reads against the origin table and {@link admitRouteRequest}
+ * binds when its request is sent. Resolution does not judge the route: what it found — an identity, a key beside
+ * its own header — is the law's to rule on, in one verdict shape for every caller.
  */
 export declare function resolveRouteCredential(input: {
     optionsApiKey?: string;
@@ -145,10 +173,23 @@ export declare function resolveRouteCredential(input: {
     modelHeaders?: Record<string, string>;
     configApiKey?: string;
     configHeaders?: Record<string, string>;
+    /** The header the caller's lane writes a per-call `apiKey` in (`authorization`, `x-api-key`), when it has one. Per-call
+     *  options that carry an `apiKey` and a header of that name (any case) are two values for one header: the credential
+     *  is resolved with that conflict beside it, and the law refuses it (`route.credential_answer_conflict`) rather than
+     *  let the key win. Optional like every input here: a caller that does not know its lane leaves it out, and then no
+     *  conflict is recorded and none is refused. */
+    keyHeader?: string;
 }): RouteCredential;
 /**
- * The pairing law (module note above). Pure and deterministic: same inputs, same verdict — safe to
- * call both at a resolution seat (pre-flight) and again inside a brain's request build.
+ * The pairing law (module note above). A READ: it judges against the engine's credential-origin table and writes
+ * nothing, so a pre-flight, the read face ({@link routePairingStatus}) and any consumer may call it freely — same
+ * inputs and same table, same verdict. A per-model credential {@link resolveRouteCredential} resolved with a key beside
+ * its own header is refused first (`route.credential_answer_conflict`, both header names in the fix — wherever the
+ * request goes, since the request itself is contradictory); otherwise it is judged against the origin it is bound to
+ * (refused when that is another one); one not bound yet, or built by hand (no resolution facts — the published corpus
+ * is such input), is servable. Every refusal is a verdict: the law throws on garbage alone. The table is written by one
+ * seat only: a first-party brain's request gate ({@link admitRouteRequest}), when the engine commits the request to be
+ * sent. The verdict reports nothing either: the request gate's refusal is {@link routeRefusalError}.
  */
 export declare function adjudicateModelRoute(model: Pick<Model, "id" | "baseUrl">, credential: RouteCredential, config: RoutePairingConfig): RouteAdjudication;
 /** Render a refusal as the one-line detail text the brains put in their thrown error (the machine
@@ -156,43 +197,83 @@ export declare function adjudicateModelRoute(model: Pick<Model, "id" | "baseUrl"
 export declare function routeRefusalText(verdict: Extract<RouteAdjudication, {
     ok: false;
 }>): string;
+/** The request gate's refusal — the ONE error a first-party brain throws when the pairing law refuses the request it is
+ *  building ({@link admitRouteRequest}). A credential-origin refusal is also reported to the run it happens in (the run
+ *  announces `route.credential_origin_mismatch`): here, at the request that is refused, and not in the law, whose other
+ *  callers only advise (a pre-flight, the read face) and leave the outcome to the seat that asked. */
+export declare function routeRefusalError(verdict: Extract<RouteAdjudication, {
+    ok: false;
+}>): BrainError;
 /**
- * Enforce "the resolved credential is the request's ONLY credential" on an already-merged header
- * bag — the per-call-auth-replaces rule, generalized to the per-model sources:
- *  - PER-MODEL apiKey-form winner → every auth carrier is stripped; the brain then emits the key in
- *    its own wire posture, the single credential on the wire (the pre-existing per-call rule).
- *  - PER-MODEL headers-borne winner (per-call or entry bag) → carriers are stripped and the winning
- *    bag's own carriers re-asserted (an entry-declared credential must survive a same- or
- *    variant-case deployment spelling that the plain merge order would have let win).
- *  - DEPLOYMENT-CONFIG winner → untouched. The historical bytes stand exactly: a header-only config
- *    keeps its own spelling, and a config carrying BOTH the apiKey knob and an auth header is the
- *    documented gateway dual-auth escape shape — the knob's hard-lock write plus the surviving
- *    header, both on the wire, as they always were.
- *  - absent → untouched (no carriers exist).
+ * THE request gate of a first-party brain — the one seat that writes the credential-origin table. Judged while the
+ * request is built ({@link adjudicateModelRoute}, the same law the pre-flight and the read face read): a refusal is
+ * thrown here ({@link routeRefusalError}) before the body is built, and binds nothing — every refusal the law rules,
+ * a key beside its own header included, leaves as that one error (`<code>: <fix>`); the gate rules nothing of its
+ * own. An admitted request hands back its
+ * ADMISSION, which the brain runs from `SSERequest.onCommitted` — the engine's one point at which THIS request is the one
+ * that is sent: the law judged again and, admitted, the per-model credential bound to the request's origin, in ONE
+ * synchronous step; refused (the credential went out to another origin since the build — caller code runs while a body
+ * is built), the same refusal is thrown there, before anything is sent. A request built speculatively and declined (the
+ * context-overflow recovery's candidate), or one whose build fails after the gate, never reaches its admission and binds
+ * nothing. A credential is bound to the origin it was first SENT to, never to one it was only judged for. The request's
+ * halves (the entry's id and root, the brain's root and lane default) are read ONCE, here: both judgments and the binding
+ * are of the request this build is sending, whatever the caller's objects say by the time it is committed.
+ *
+ * Exported from the package root for a HOST that sends a request itself (its own `fetch`, outside a first-party brain): it
+ * passes this same gate, so the binding does not depend on who sends first. Resolve the credential with
+ * {@link resolveRouteCredential} (a credential built by hand carries no identity: it is judged and binds nothing), call this
+ * before building, and run the admission it returns immediately before the request goes out; a refusal is the very error a
+ * first-party brain throws for the same request. {@link adjudicateModelRoute} stays the read: it judges and binds nothing.
  */
-export declare function applyRouteCredentialHeaders(merged: Record<string, string>, credential: RouteCredential, bags: {
-    model?: Record<string, string>;
-    options?: Record<string, string>;
-}): void;
+export declare function admitRouteRequest(model: Pick<Model, "id" | "baseUrl">, credential: RouteCredential, config: RoutePairingConfig): () => void;
 /**
- * The first-party brains' `adjudicateRoute` face, closed over the brain's construction config —
- * EXACTLY the resolution + judgment the brain's own request build runs (single source, two call
- * sites), so a pre-flight verdict and the request-time verdict can never disagree.
+ * Enforce "the resolved credential is the request's ONLY credential" on an already-merged header
+ * bag — one source's credential rides, the other sources' credential headers do not:
+ *  - PER-MODEL winner → every credential header ({@link isCredentialHeaderName}) is stripped and the
+ *    winning bag's own credential headers written back — exactly the ones {@link resolveRouteCredential}
+ *    read and hashed ({@link ResolvedCredentialFacts}; the caller's bag is not read again): the hook's
+ *    answer (`options`) or the entry (`model`). The hook's answer is one credential — beside its apiKey,
+ *    which the brain then writes in its lane's key header (a request that also holds a header of that name
+ *    never gets here in a first-party brain: its request gate refused it first, `route.credential_answer_conflict`,
+ *    so the lock supersedes nothing the answer carried), its other credential headers ride (a gateway's `Helicone-Auth`); an
+ *    entry's credential survives a same- or variant-case deployment spelling that the plain merge order
+ *    would have let win. A credential header from any OTHER bag (the entry's under a hook answer, the
+ *    deployment's under either) never rides beside a per-model credential. Whether a header is stripped
+ *    is decided by its SOURCE, not its name.
+ *  - DEPLOYMENT-CONFIG winner → untouched. A header-only config keeps its own spelling, and a config
+ *    carrying BOTH the apiKey knob and an auth header is the documented gateway dual-auth shape — the
+ *    knob's lock write plus the surviving header, both on the wire.
+ *  - absent → untouched (no carriers exist).
  */
+export declare function applyRouteCredentialHeaders(merged: Record<string, string>, credential: RouteCredential): void;
 /** A brain's construction config, received ONCE by the engine's receipt law for caller objects
  *  ({@link receiveOwnProperties}: a plain object, every own member read once): the request gate and the pre-flight
  *  judge both read this frozen copy, so a config object mutated after construction moves neither and the two cannot
  *  disagree about the root a credential is paired with. The header bag is a caller object too: it is received by the
- *  same law from that one reading into a frozen bag of the copy's own. */
+ *  same law from that one reading into a frozen bag of the copy's own. The copy's credential — `apiKey` and the
+ *  credential headers — is a credential the engine now holds: no child spawned on this host inherits a variable whose
+ *  value equals it (`holdOwnCredentialValues`). */
 export declare function brainConfigSnapshot<T extends {
+    apiKey?: string;
     headers?: Record<string, string>;
 }>(given: T, subject: string): Readonly<T>;
+/**
+ * The first-party brains' `adjudicateRoute` face, closed over the brain's construction config —
+ * EXACTLY the resolution + judgment the brain's own request build runs (single source, two call
+ * sites), so a pre-flight verdict and the request-time verdict agree on the same inputs. A refusal is
+ * always a verdict here, never a throw. The pre-flight sees the
+ * per-model auth it is handed, nothing later: a header a provider-request hook adds afterwards reaches
+ * the request build alone, which judges it by the same law.
+ */
 export declare function createBrainRouteJudge(config: {
     apiKey?: string;
     baseUrl?: string;
     headers?: Record<string, string>;
     /** The lane's own default endpoint (the brain's constant), when it has one. */
     laneDefault?: string;
+    /** The header the lane writes a per-call apiKey in ({@link resolveRouteCredential}'s `keyHeader`): the brain's own
+     *  constant, so the judge refuses the requests its request build refuses. */
+    keyHeader?: string;
 }): (model: Model, perModelAuth?: {
     apiKey?: string;
     headers?: Record<string, string>;
@@ -203,7 +284,7 @@ export declare function createBrainRouteJudge(config: {
  * `judge` is a brain's optional `adjudicateRoute` face; absent ⇒ `"unknown"` (a custom brain core
  * cannot see into — never guessed at).
  */
-export type RoutePairingStatus = `ok:${RoutePairingPosture}` | `broken:${"credential_mismatch" | "credential_missing"}` | "unknown";
+export type RoutePairingStatus = `ok:${RoutePairingPosture}` | `broken:${"credential_mismatch" | "credential_missing" | "credential_origin_mismatch" | "credential_answer_conflict"}` | "unknown";
 export declare function routePairingStatus(brain: {
     adjudicateRoute?: (model: Model, perModelAuth?: {
         apiKey?: string;
@@ -294,8 +375,3 @@ export declare function unroutableSeatNotice(args: {
     sessionId?: string;
     runId?: string;
 }): EngineNotice;
-/** The auth carriers of a header bag, canonicalized (case-fold name → value, sorted) — the
- *  Model-visible credential fingerprint used by catalog-change disclosure (a same-name entry whose
- *  URL moved while this fingerprint did not is the "address changed, credential reference did not"
- *  shape worth announcing). */
-export declare function authCarrierFingerprint(headers: Record<string, string> | undefined): string;

package/dist/brain/route-adjudicator.js

@@ -1,6 +1,8 @@
-import { AUTH_CARRIER_NAMES } from "./request-params.js";
+import { createHash } from "node:crypto";
 import { BrainError } from "./errors.js";
+import { reportCredentialOriginRefusal } from "./status-sink.js";
 import { receiptRefusal, receiveOwnProperties } from "../core/own-property-receipt.js";
+import { credentialHeaderValues, holdOwnCredentialValues, isCredentialHeaderName, isSchemedCredentialHeader } from "../core/secret-env.js";
 const REDACTED_VALUE = "«redacted»";
 const REDACTED_CREDENTIALS = "[redacted-credentials]";
 function servableParse(raw) {
@@ -191,23 +193,96 @@ export function resolveRequestRootOf(modelBaseUrl, configBaseUrl, laneDefault =
 export function hasAuthCarrier(headers) {
     if (!headers)
         return false;
-    for (const k of Object.keys(headers)) {
-        if (AUTH_CARRIER_NAMES.has(k.toLowerCase()))
-            return true;
+    return Object.keys(headers).some((name) => isCredentialHeaderName(name));
+}
+function routeOriginOf(rootKey) {
+    if (rootKey === "")
+        return "";
+    const u = servableParse(rootKey);
+    return u === undefined ? rootKey : `${u.protocol}//${u.host}`;
+}
+const CREDENTIAL_ORIGIN_BINDINGS_MAX = 16_384;
+const CREDENTIAL_ORIGIN_TABLE = Symbol.for("sema.core.credentialOriginTable");
+function credentialOriginTable() {
+    const held = Reflect.get(globalThis, CREDENTIAL_ORIGIN_TABLE);
+    if (held instanceof Map)
+        return held;
+    const table = new Map();
+    Reflect.set(globalThis, CREDENTIAL_ORIGIN_TABLE, table);
+    return table;
+}
+export function __resetCredentialOriginBindings() {
+    credentialOriginTable().clear();
+}
+const resolvedCredentialFacts = new WeakMap();
+const HEADER_VALUE_ENDS = /^[\t\n\r ]+|[\t\n\r ]+$/g;
+const AUTH_SCHEME_CREDENTIALS = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+[\t ]+(\S[\s\S]*)$/;
+function perModelCredential(credential, apiKey, bag, conflict) {
+    const headers = {};
+    for (const [name, value] of Object.entries(bag ?? {})) {
+        if (isCredentialHeaderName(name) && typeof value === "string")
+            headers[name] = value;
     }
-    return false;
+    const headerValues = Object.entries(headers).map(([name, value]) => {
+        const wire = value.replace(HEADER_VALUE_ENDS, "");
+        return isSchemedCredentialHeader(name) ? (AUTH_SCHEME_CREDENTIALS.exec(wire)?.[1] ?? wire) : wire;
+    });
+    const values = apiKey !== undefined ? [apiKey, ...headerValues] : headerValues;
+    const secrets = [...new Set(values.map((v) => v.replace(HEADER_VALUE_ENDS, "")).filter((v) => v !== ""))];
+    if (secrets.length === 0 && Object.keys(headers).length === 0 && conflict === undefined)
+        return credential;
+    const proof = Object.freeze(credential);
+    resolvedCredentialFacts.set(proof, Object.freeze({
+        identities: Object.freeze(secrets.map((s) => createHash("sha256").update(s).digest("base64url"))),
+        headers: Object.freeze(headers),
+        ...(conflict !== undefined ? { keyHeaderConflict: Object.freeze(conflict) } : {}),
+    }));
+    return proof;
+}
+function boundElsewhere(identities, requestOrigin) {
+    const table = credentialOriginTable();
+    return identities.map((id) => table.get(id)).find((bound) => bound !== undefined && bound !== requestOrigin);
+}
+function bindCredentialOrigin(identities, requestOrigin) {
+    const table = credentialOriginTable();
+    for (const id of identities) {
+        table.delete(id);
+        if (table.size >= CREDENTIAL_ORIGIN_BINDINGS_MAX) {
+            const oldest = table.keys().next();
+            if (oldest.done !== true)
+                table.delete(oldest.value);
+        }
+        table.set(id, requestOrigin);
+    }
+}
+function routeHalves(model, config) {
+    const entry = routeKeyOf(model.baseUrl);
+    const declared = routeKeyOf(config.baseUrl);
+    const deploymentRoot = declared || routeKeyOf(config.laneDefault);
+    return { entry, declared, deploymentRoot, request: entry || deploymentRoot };
+}
+function keyHeaderConflict(apiKey, headers, keyHeader) {
+    if (apiKey === undefined || apiKey === "" || keyHeader === undefined || headers === undefined)
+        return undefined;
+    const fold = keyHeader.toLowerCase();
+    const written = Object.keys(headers).find((name) => name.toLowerCase() === fold);
+    return written === undefined ? undefined : { header: written, keyHeader };
 }
 export function resolveRouteCredential(input) {
-    const { optionsApiKey, optionsHeaders, modelHeaders, configApiKey, configHeaders } = input;
-    if (optionsApiKey !== undefined) {
-        if (typeof optionsApiKey !== "string")
+    const { optionsApiKey, optionsHeaders, modelHeaders, configApiKey, configHeaders, keyHeader } = input;
+    holdOwnCredentialValues(credentialHeaderValues(modelHeaders));
+    const answerHeadersBorne = hasAuthCarrier(optionsHeaders);
+    if (optionsApiKey !== undefined || answerHeadersBorne) {
+        if (optionsApiKey !== undefined && typeof optionsApiKey !== "string")
             throw new TypeError(`route pairing: apiKey must be a string (got ${typeof optionsApiKey})`);
-        return { source: "per-model", apiKey: optionsApiKey };
+        return perModelCredential({
+            source: "per-model",
+            ...(optionsApiKey !== undefined ? { apiKey: optionsApiKey } : {}),
+            ...(answerHeadersBorne ? { headersBorne: true, carrierBag: "options" } : {}),
+        }, optionsApiKey, answerHeadersBorne ? optionsHeaders : undefined, keyHeaderConflict(optionsApiKey, optionsHeaders, keyHeader));
     }
-    if (hasAuthCarrier(optionsHeaders))
-        return { source: "per-model", headersBorne: true, carrierBag: "options" };
     if (hasAuthCarrier(modelHeaders))
-        return { source: "per-model", headersBorne: true, carrierBag: "model" };
+        return perModelCredential({ source: "per-model", headersBorne: true, carrierBag: "model" }, undefined, modelHeaders);
     const configHeadersBorne = hasAuthCarrier(configHeaders);
     if (configApiKey !== undefined || configHeadersBorne) {
         if (configApiKey !== undefined && typeof configApiKey !== "string") {
@@ -222,15 +297,53 @@ export function resolveRouteCredential(input) {
     return { source: "absent" };
 }
 export function adjudicateModelRoute(model, credential, config) {
-    const entry = routeKeyOf(model.baseUrl);
-    const declared = routeKeyOf(config.baseUrl);
-    const deploymentRoot = declared || routeKeyOf(config.laneDefault);
-    const request = entry || deploymentRoot;
+    const { entry, declared, deploymentRoot, request } = routeHalves(model, config);
     const entryShown = displayUrlOf(entry);
     const declaredShown = displayUrlOf(declared);
     const requestShown = displayUrlOf(request);
-    if (credential.source === "per-model")
-        return { ok: true, posture: "per-model" };
+    if (credential.source === "per-model") {
+        const facts = resolvedCredentialFacts.get(credential);
+        const conflict = facts?.keyHeaderConflict;
+        if (conflict !== undefined) {
+            return {
+                ok: false,
+                code: "route.credential_answer_conflict",
+                detail: {
+                    modelId: model.id,
+                    entryBaseUrl: entryShown,
+                    requestBaseUrl: requestShown,
+                    configBaseUrl: declaredShown,
+                    fixHint: `model "${model.id}": the request carries both an apiKey and a "${conflict.header}" header, and this lane writes the apiKey in ` +
+                        `"${conflict.keyHeader}" — one header cannot hold two credentials; hand the key as apiKey or as the header, not both`,
+                },
+            };
+        }
+        const identities = facts?.identities;
+        const requestOrigin = routeOriginOf(request);
+        if (identities === undefined || requestOrigin === "")
+            return { ok: true, posture: "per-model" };
+        const boundOrigin = boundElsewhere(identities, requestOrigin);
+        if (boundOrigin === undefined)
+            return { ok: true, posture: "per-model" };
+        const boundShown = displayUrlOf(boundOrigin);
+        const requestOriginShown = displayUrlOf(requestOrigin);
+        return {
+            ok: false,
+            code: "route.credential_origin_mismatch",
+            detail: {
+                modelId: model.id,
+                entryBaseUrl: entryShown,
+                requestBaseUrl: requestShown,
+                configBaseUrl: declaredShown,
+                boundOrigin: boundShown,
+                requestOrigin: requestOriginShown,
+                fixHint: `model "${model.id}" targets ${requestShown} (origin ${requestOriginShown}) but its own credential is bound to ${boundShown}, ` +
+                    `the origin it was first sent to — a credential does not follow its entry to another host: change the entry's credential ` +
+                    `reference in the same step as its baseUrl (a new credential is a new binding), or point the entry back at ${boundShown}; ` +
+                    `a binding lasts as long as the engine process, so a provider that only moved domains and accepts the same credential there needs a restart`,
+            },
+        };
+    }
     if (credential.source === "deployment-config") {
         if (request !== "" && request === deploymentRoot)
             return { ok: true, posture: "paired" };
@@ -273,22 +386,40 @@ export function adjudicateModelRoute(model, credential, config) {
 export function routeRefusalText(verdict) {
     return `${verdict.code}: ${verdict.detail.fixHint}`;
 }
-export function applyRouteCredentialHeaders(merged, credential, bags) {
+export function routeRefusalError(verdict) {
+    const { modelId, boundOrigin, requestOrigin } = verdict.detail;
+    if (verdict.code === "route.credential_origin_mismatch" && boundOrigin !== undefined && requestOrigin !== undefined) {
+        reportCredentialOriginRefusal({ modelId, boundOrigin, requestOrigin });
+    }
+    return new BrainError("invalid_request", routeRefusalText(verdict));
+}
+export function admitRouteRequest(model, credential, config) {
+    const judged = { id: model.id, baseUrl: model.baseUrl };
+    const { baseUrl, laneDefault } = config;
+    const pairing = { ...(baseUrl !== undefined ? { baseUrl } : {}), ...(laneDefault !== undefined ? { laneDefault } : {}) };
+    const judgeOrRefuse = () => {
+        const verdict = adjudicateModelRoute(judged, credential, pairing);
+        if (!verdict.ok)
+            throw routeRefusalError(verdict);
+    };
+    judgeOrRefuse();
+    const identities = credential.source === "per-model" ? resolvedCredentialFacts.get(credential)?.identities : undefined;
+    const requestOrigin = routeOriginOf(routeHalves(judged, pairing).request);
+    if (identities === undefined || identities.length === 0 || requestOrigin === "")
+        return () => { };
+    return () => {
+        judgeOrRefuse();
+        bindCredentialOrigin(identities, requestOrigin);
+    };
+}
+export function applyRouteCredentialHeaders(merged, credential) {
     if (credential.source !== "per-model")
         return;
     for (const k of Object.keys(merged)) {
-        if (AUTH_CARRIER_NAMES.has(k.toLowerCase()))
+        if (isCredentialHeaderName(k))
             delete merged[k];
     }
-    if (credential.headersBorne !== true)
-        return;
-    const winner = credential.carrierBag === "options" ? bags.options : bags.model;
-    if (!winner)
-        return;
-    for (const [k, v] of Object.entries(winner)) {
-        if (AUTH_CARRIER_NAMES.has(k.toLowerCase()))
-            merged[k] = v;
-    }
+    Object.assign(merged, resolvedCredentialFacts.get(credential)?.headers);
 }
 export function brainConfigSnapshot(given, subject) {
     const words = { subject, unit: "member", moment: "at construction" };
@@ -299,7 +430,9 @@ export function brainConfigSnapshot(given, subject) {
             throw receiptRefusal(`${subject}.headers must be an object of header names to values`);
         Object.defineProperty(received, "headers", { value: Object.freeze(receiveOwnProperties(headers, { ...words, subject: `${subject}.headers`, unit: "header" })), enumerable: true });
     }
-    return Object.freeze(received);
+    const snapshot = Object.freeze(received);
+    holdOwnCredentialValues([snapshot.apiKey, ...credentialHeaderValues(snapshot.headers)]);
+    return snapshot;
 }
 export function createBrainRouteJudge(config) {
     return (model, perModelAuth) => {
@@ -309,17 +442,24 @@ export function createBrainRouteJudge(config) {
             modelHeaders: model.headers,
             configApiKey: config.apiKey,
             configHeaders: config.headers,
+            keyHeader: config.keyHeader,
         });
         return adjudicateModelRoute(model, credential, { baseUrl: config.baseUrl, laneDefault: config.laneDefault });
     };
 }
+const BROKEN_PAIRING_STATUS = {
+    "route.credential_mismatch": "broken:credential_mismatch",
+    "route.credential_missing": "broken:credential_missing",
+    "route.credential_origin_mismatch": "broken:credential_origin_mismatch",
+    "route.credential_answer_conflict": "broken:credential_answer_conflict",
+};
 export function routePairingStatus(brain, model, perModelAuth) {
     const verdict = brain.adjudicateRoute?.(model, perModelAuth);
     if (verdict === undefined)
         return "unknown";
     if (verdict.ok)
         return `ok:${verdict.posture}`;
-    return verdict.code === "route.credential_mismatch" ? "broken:credential_mismatch" : "broken:credential_missing";
+    return BROKEN_PAIRING_STATUS[verdict.code];
 }
 export const DERIVED_ROUTE_PREFLIGHT_HOOK_BOUND_MS = 5_000;
 export async function adjudicateDerivedRoute(args) {
@@ -391,14 +531,3 @@ export function unroutableSeatNotice(args) {
         },
     };
 }
-export function authCarrierFingerprint(headers) {
-    if (!headers)
-        return "";
-    const rows = [];
-    for (const [k, v] of Object.entries(headers)) {
-        const fold = k.toLowerCase();
-        if (AUTH_CARRIER_NAMES.has(fold))
-            rows.push(`${fold}=${v}`);
-    }
-    return rows.sort().join("\n");
-}