@velum-labs/routekit-gateway 0.18.4 → 0.18.6

package/dist/adapters/openai-responses-wire.d.ts

@@ -1,22 +1,22 @@
-export type ResponsesReasoningOwner = {
+export type ResponsesEncryptedContentOwner = {
     provider: string;
     nativeModel: string;
 };
-export type ResponsesReasoningInputPolicy = {
+export type ResponsesEncryptedInputPolicy = {
     mode: "drop";
 } | {
     mode: "relay";
 } | {
     mode: "forward";
-    owner: ResponsesReasoningOwner;
+    owner: ResponsesEncryptedContentOwner;
     /** Keep the RouteKit wrapper for a later Chat-to-Responses provider bridge. */
     unwrap?: boolean;
 };
 export type ParsedResponsesEncryptedContent = {
-    owner: ResponsesReasoningOwner;
+    owner: ResponsesEncryptedContentOwner;
     ciphertext: string;
 };
-export type PreparedResponsesReasoningInput = {
+export type PreparedResponsesEncryptedInput = {
     body: unknown;
     dropped: number;
 };
@@ -26,20 +26,20 @@ export type PreparedResponsesReasoningInput = {
  * `call_id`, so changing only the item `id` preserves the execution pair.
  */
 export declare function repairLegacyToolSearchItemIds(body: unknown): unknown;
-/** Wrap provider-owned opaque reasoning without expanding the ciphertext itself. */
-export declare function wrapResponsesEncryptedContent(ciphertext: string, owner: ResponsesReasoningOwner): string;
-/** Parse a RouteKit-owned encrypted-reasoning envelope. Raw provider ciphertext is ownerless. */
+/** Wrap provider-owned opaque Responses content without expanding the ciphertext itself. */
+export declare function wrapResponsesEncryptedContent(ciphertext: string, owner: ResponsesEncryptedContentOwner): string;
+/** Parse a RouteKit-owned encrypted-content envelope. Raw provider ciphertext is ownerless. */
 export declare function parseResponsesEncryptedContent(value: unknown): ParsedResponsesEncryptedContent | undefined;
 /**
- * Apply the destination policy to Responses input without mutating the request.
- * Incompatible reasoning items are removed while their assistant/tool carriers
- * remain in the portable transcript.
+ * Apply the destination policy to provider-owned Responses input without
+ * mutating the request. Incompatible opaque state is removed while visible
+ * messages and tool-call/output carriers remain in the portable transcript.
  */
-export declare function prepareResponsesReasoningInput(body: unknown, policy: ResponsesReasoningInputPolicy): PreparedResponsesReasoningInput;
+export declare function prepareResponsesEncryptedInput(body: unknown, policy: ResponsesEncryptedInputPolicy): PreparedResponsesEncryptedInput;
 /**
- * Add ownership to encrypted reasoning emitted by a successful native
+ * Add ownership to encrypted Responses state emitted by a successful native
  * Responses call. Provider failures and unrelated response formats pass through.
  */
-export declare function wrapResponsesReasoningResponse(response: Response, owner: ResponsesReasoningOwner): Promise<Response>;
+export declare function wrapResponsesEncryptedResponse(response: Response, owner: ResponsesEncryptedContentOwner): Promise<Response>;
 /** Normalize OpenAI Responses call ids without mutating the caller's request. */
 export declare function normalizeOpenAiResponsesCallIds(body: unknown): unknown;

package/dist/adapters/openai-responses-wire.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 const OPENAI_RESPONSES_CALL_ID_MAX_LENGTH = 64;
 const NORMALIZED_CALL_ID_PREFIX = "rk_";
-const ENCRYPTED_REASONING_PREFIX = "rk1.";
+const ENCRYPTED_CONTENT_PREFIX = "rk1.";
 const LEGACY_TOOL_SEARCH_ITEM_ID_PREFIX = "ttc_";
 const TOOL_SEARCH_ITEM_ID_PREFIX = "tsc_";
 function sameOwner(left, right) {
@@ -39,22 +39,22 @@ export function repairLegacyToolSearchItemIds(body) {
     });
     return changed ? { ...record, input } : body;
 }
-/** Wrap provider-owned opaque reasoning without expanding the ciphertext itself. */
+/** Wrap provider-owned opaque Responses content without expanding the ciphertext itself. */
 export function wrapResponsesEncryptedContent(ciphertext, owner) {
     if (parseResponsesEncryptedContent(ciphertext) !== undefined)
         return ciphertext;
     const encodedOwner = Buffer.from(JSON.stringify({ p: owner.provider, m: owner.nativeModel }), "utf8").toString("base64url");
-    return `${ENCRYPTED_REASONING_PREFIX}${encodedOwner}.${ciphertext}`;
+    return `${ENCRYPTED_CONTENT_PREFIX}${encodedOwner}.${ciphertext}`;
 }
-/** Parse a RouteKit-owned encrypted-reasoning envelope. Raw provider ciphertext is ownerless. */
+/** Parse a RouteKit-owned encrypted-content envelope. Raw provider ciphertext is ownerless. */
 export function parseResponsesEncryptedContent(value) {
-    if (typeof value !== "string" || !value.startsWith(ENCRYPTED_REASONING_PREFIX)) {
+    if (typeof value !== "string" || !value.startsWith(ENCRYPTED_CONTENT_PREFIX)) {
         return undefined;
     }
-    const separator = value.indexOf(".", ENCRYPTED_REASONING_PREFIX.length);
+    const separator = value.indexOf(".", ENCRYPTED_CONTENT_PREFIX.length);
     if (separator === -1)
         return undefined;
-    const encodedOwner = value.slice(ENCRYPTED_REASONING_PREFIX.length, separator);
+    const encodedOwner = value.slice(ENCRYPTED_CONTENT_PREFIX.length, separator);
     const ciphertext = value.slice(separator + 1);
     if (encodedOwner.length === 0 || ciphertext.length === 0)
         return undefined;
@@ -82,72 +82,193 @@ export function parseResponsesEncryptedContent(value) {
         return undefined;
     }
 }
-/**
- * Apply the destination policy to Responses input without mutating the request.
- * Incompatible reasoning items are removed while their assistant/tool carriers
- * remain in the portable transcript.
- */
-export function prepareResponsesReasoningInput(body, policy) {
-    if (typeof body !== "object" || body === null || Array.isArray(body)) {
-        return { body, dropped: 0 };
+function applyEncryptedContentPolicy(value, policy) {
+    const parsed = parseResponsesEncryptedContent(value);
+    if (policy.mode === "drop")
+        return { action: "drop" };
+    if (policy.mode === "relay") {
+        return parsed === undefined
+            ? { action: "drop" }
+            : { action: "keep", value, changed: false };
     }
-    const record = body;
-    if (!Array.isArray(record.input))
-        return { body, dropped: 0 };
-    let dropped = 0;
+    if (parsed === undefined || !sameOwner(parsed.owner, policy.owner)) {
+        return { action: "drop" };
+    }
+    if (policy.unwrap === false) {
+        return { action: "keep", value, changed: false };
+    }
+    return { action: "keep", value: parsed.ciphertext, changed: true };
+}
+function prepareEncryptedContentParts(parts, policy) {
     let changed = false;
-    const input = [];
-    for (const candidate of record.input) {
+    let dropped = 0;
+    const value = [];
+    for (const candidate of parts) {
         if (typeof candidate !== "object" ||
             candidate === null ||
             Array.isArray(candidate)) {
-            input.push(candidate);
+            value.push(candidate);
             continue;
         }
-        const item = candidate;
-        if (item.type !== "reasoning" ||
-            typeof item.encrypted_content !== "string" ||
-            item.encrypted_content.length === 0) {
-            input.push(candidate);
+        const part = candidate;
+        if (part.type !== "encrypted_content" ||
+            typeof part.encrypted_content !== "string" ||
+            part.encrypted_content.length === 0) {
+            value.push(candidate);
             continue;
         }
-        const parsed = parseResponsesEncryptedContent(item.encrypted_content);
-        if (policy.mode === "drop") {
-            dropped += 1;
+        const prepared = applyEncryptedContentPolicy(part.encrypted_content, policy);
+        if (prepared.action === "drop") {
             changed = true;
+            dropped += 1;
             continue;
         }
-        if (policy.mode === "relay") {
-            if (parsed === undefined) {
-                dropped += 1;
-                changed = true;
-                continue;
-            }
-            input.push(candidate);
+        if (prepared.changed) {
+            value.push({ ...part, encrypted_content: prepared.value });
+            changed = true;
             continue;
         }
-        if (parsed === undefined || !sameOwner(parsed.owner, policy.owner)) {
+        value.push(candidate);
+    }
+    return { value, changed, dropped };
+}
+function prepareEncryptedInputItem(candidate, policy) {
+    if (typeof candidate !== "object" ||
+        candidate === null ||
+        Array.isArray(candidate)) {
+        return { value: candidate, changed: false, dropped: 0, remove: false };
+    }
+    const item = candidate;
+    const type = typeof item.type === "string" ? item.type : "";
+    let next = item;
+    let changed = false;
+    let dropped = 0;
+    if (ENCRYPTED_CONTENT_RECORD_TYPES.has(type) &&
+        typeof item.encrypted_content === "string" &&
+        item.encrypted_content.length > 0) {
+        const prepared = applyEncryptedContentPolicy(item.encrypted_content, policy);
+        if (prepared.action === "drop") {
+            if (type === "reasoning" ||
+                type === "compaction" ||
+                type === "encrypted_content") {
+                return { value: candidate, changed: true, dropped: 1, remove: true };
+            }
+            const { encrypted_content: _encryptedContent, ...portable } = next;
+            next = portable;
+            changed = true;
             dropped += 1;
+            if ((type === "message" || type === "agent_message") &&
+                !Array.isArray(item.content)) {
+                return { value: candidate, changed: true, dropped, remove: true };
+            }
+            if ((type === "function_call_output" ||
+                type === "custom_tool_call_output") &&
+                !Object.hasOwn(item, "output")) {
+                next = { ...next, output: "" };
+            }
+        }
+        if (prepared.action === "keep" && prepared.changed) {
+            next = { ...next, encrypted_content: prepared.value };
             changed = true;
-            continue;
         }
-        if (policy.unwrap === false) {
-            input.push(candidate);
-            continue;
+    }
+    if ((type === "message" || type === "agent_message") &&
+        Array.isArray(item.content)) {
+        const prepared = prepareEncryptedContentParts(item.content, policy);
+        dropped += prepared.dropped;
+        if (prepared.changed) {
+            if (prepared.value.length === 0) {
+                return { value: candidate, changed: true, dropped, remove: true };
+            }
+            next = { ...next, content: prepared.value };
+            changed = true;
         }
-        input.push({ ...item, encrypted_content: parsed.ciphertext });
-        changed = true;
+    }
+    if ((type === "function_call_output" ||
+        type === "custom_tool_call_output") &&
+        Array.isArray(item.output)) {
+        const prepared = prepareEncryptedContentParts(item.output, policy);
+        dropped += prepared.dropped;
+        if (prepared.changed) {
+            next = {
+                ...next,
+                output: prepared.value.length === 0 ? "" : prepared.value
+            };
+            changed = true;
+        }
+    }
+    else if ((type === "function_call_output" ||
+        type === "custom_tool_call_output") &&
+        typeof item.output === "object" &&
+        item.output !== null &&
+        !Array.isArray(item.output)) {
+        const output = item.output;
+        if (output.type === "encrypted_content" &&
+            typeof output.encrypted_content === "string" &&
+            output.encrypted_content.length > 0) {
+            const prepared = applyEncryptedContentPolicy(output.encrypted_content, policy);
+            if (prepared.action === "drop") {
+                next = { ...next, output: "" };
+                changed = true;
+                dropped += 1;
+            }
+            else if (prepared.changed) {
+                next = {
+                    ...next,
+                    output: { ...output, encrypted_content: prepared.value }
+                };
+                changed = true;
+            }
+        }
+    }
+    return {
+        value: changed ? next : candidate,
+        changed,
+        dropped,
+        remove: false
+    };
+}
+/**
+ * Apply the destination policy to provider-owned Responses input without
+ * mutating the request. Incompatible opaque state is removed while visible
+ * messages and tool-call/output carriers remain in the portable transcript.
+ */
+export function prepareResponsesEncryptedInput(body, policy) {
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+        return { body, dropped: 0 };
+    }
+    const record = body;
+    if (!Array.isArray(record.input))
+        return { body, dropped: 0 };
+    let dropped = 0;
+    let changed = false;
+    const input = [];
+    for (const candidate of record.input) {
+        const prepared = prepareEncryptedInputItem(candidate, policy);
+        dropped += prepared.dropped;
+        changed ||= prepared.changed;
+        if (!prepared.remove)
+            input.push(prepared.value);
     }
     return {
         body: changed ? { ...record, input } : body,
         dropped
     };
 }
-function wrapEncryptedReasoningValue(value, owner) {
+const ENCRYPTED_CONTENT_RECORD_TYPES = new Set([
+    "reasoning",
+    "compaction",
+    "encrypted_content",
+    "message",
+    "function_call_output",
+    "custom_tool_call_output",
+    "agent_message"
+]);
+function wrapEncryptedResponsesValue(value, owner) {
     if (Array.isArray(value)) {
         let changed = false;
         const items = value.map((item) => {
-            const transformed = wrapEncryptedReasoningValue(item, owner);
+            const transformed = wrapEncryptedResponsesValue(item, owner);
             changed ||= transformed.changed;
             return transformed.value;
         });
@@ -161,7 +282,8 @@ function wrapEncryptedReasoningValue(value, owner) {
     const output = {};
     for (const [key, field] of Object.entries(record)) {
         if (key === "encrypted_content" &&
-            record.type === "reasoning" &&
+            typeof record.type === "string" &&
+            ENCRYPTED_CONTENT_RECORD_TYPES.has(record.type) &&
             typeof field === "string" &&
             field.length > 0) {
             const wrapped = wrapResponsesEncryptedContent(field, owner);
@@ -169,7 +291,7 @@ function wrapEncryptedReasoningValue(value, owner) {
             changed ||= wrapped !== field;
             continue;
         }
-        const transformed = wrapEncryptedReasoningValue(field, owner);
+        const transformed = wrapEncryptedResponsesValue(field, owner);
         output[key] = transformed.value;
         changed ||= transformed.changed;
     }
@@ -200,7 +322,7 @@ function wrapSseFrame(frame, delimiter, owner) {
     catch {
         return `${frame}${delimiter}`;
     }
-    const transformed = wrapEncryptedReasoningValue(parsed, owner);
+    const transformed = wrapEncryptedResponsesValue(parsed, owner);
     if (!transformed.changed)
         return `${frame}${delimiter}`;
     let emittedData = false;
@@ -214,7 +336,7 @@ function wrapSseFrame(frame, delimiter, owner) {
     });
     return `${rewritten.join(lineEnding)}${delimiter}`;
 }
-function wrapResponsesReasoningSse(source, owner) {
+function wrapResponsesEncryptedSse(source, owner) {
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
     let buffer = "";
@@ -239,10 +361,10 @@ function wrapResponsesReasoningSse(source, owner) {
     }));
 }
 /**
- * Add ownership to encrypted reasoning emitted by a successful native
+ * Add ownership to encrypted Responses state emitted by a successful native
  * Responses call. Provider failures and unrelated response formats pass through.
  */
-export async function wrapResponsesReasoningResponse(response, owner) {
+export async function wrapResponsesEncryptedResponse(response, owner) {
     if (!response.ok || response.body === null)
         return response;
     const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
@@ -250,7 +372,7 @@ export async function wrapResponsesReasoningResponse(response, owner) {
         const headers = new Headers(response.headers);
         headers.delete("content-length");
         headers.delete("content-encoding");
-        return new Response(wrapResponsesReasoningSse(response.body, owner), {
+        return new Response(wrapResponsesEncryptedSse(response.body, owner), {
             status: response.status,
             statusText: response.statusText,
             headers
@@ -265,7 +387,7 @@ export async function wrapResponsesReasoningResponse(response, owner) {
     catch {
         return response;
     }
-    const transformed = wrapEncryptedReasoningValue(parsed, owner);
+    const transformed = wrapEncryptedResponsesValue(parsed, owner);
     if (!transformed.changed)
         return response;
     const headers = new Headers(response.headers);

package/dist/adapters/responses.js

@@ -15,7 +15,7 @@
 import { randomId } from "@velum-labs/routekit-runtime";
 import { attachReasoningSelection, attachReasoningSelectionError, attachResponsesReasoningMetadata, reasoningSelectionErrorOf, hasExplicitReasoningSelection, reasoningSelectionOf, routeKitRequestValidationErrorOf, responsesReasoningMetadataOf } from "./openai-chat-wire.js";
 import { droppedField } from "./dropped.js";
-import { prepareResponsesReasoningInput, repairLegacyToolSearchItemIds, wrapResponsesReasoningResponse } from "./openai-responses-wire.js";
+import { prepareResponsesEncryptedInput, repairLegacyToolSearchItemIds, wrapResponsesEncryptedResponse } from "./openai-responses-wire.js";
 import { unwrapUpstreamError } from "./upstream-error.js";
 import { openAiSseToResponses } from "./responses-stream.js";
 import { chatUsageToResponses } from "./responses-usage.js";
@@ -776,7 +776,7 @@ export function chatToResponses(openai, model, toolRegistry = EMPTY_TOOL_REGISTR
 function jsonResponse(status, value) {
     return new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json" } });
 }
-function responsesReasoningOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses) {
+function responsesEncryptedContentOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses) {
     const route = backend.resolveModelRoute?.(upstreamModel);
     return route === undefined
         ? {
@@ -789,9 +789,9 @@ function responsesReasoningOwner(backend, upstreamModel, destinationWireShape, s
         }
         : { provider: route.provider, nativeModel: route.nativeId };
 }
-function recordDroppedEncryptedReasoning(count) {
+function recordDroppedEncryptedContent(count) {
     if (count > 0) {
-        droppedField("responses", "encrypted_content", "input.reasoning");
+        droppedField("responses", "encrypted_content", "input");
     }
 }
 export async function handleResponses(backend, body, modelCallId, signal, backendOptions = {}) {
@@ -848,7 +848,7 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
     const nativeResponses = backend.responses?.bind(backend);
     const supportsNativeResponses = nativeResponses !== undefined &&
         (backend.supportsResponses?.(upstreamModel) ?? true);
-    const reasoningOwner = responsesReasoningOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses);
+    const encryptedContentOwner = responsesEncryptedContentOwner(backend, upstreamModel, destinationWireShape, supportsNativeResponses);
     if (body.previous_response_id != null && !supportsNativeResponses) {
         return jsonResponse(400, {
             error: {
@@ -864,16 +864,16 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
         destinationWireShape === "openai-responses" ||
         destinationWireShape === "routekit-envelope";
     if (supportsNativeResponses && nativeResponses !== undefined) {
-        const prepared = prepareResponsesReasoningInput(repairLegacyToolSearchItemIds(body), {
+        const prepared = prepareResponsesEncryptedInput(repairLegacyToolSearchItemIds(body), {
             mode: "forward",
-            owner: reasoningOwner
+            owner: encryptedContentOwner
         });
-        recordDroppedEncryptedReasoning(prepared.dropped);
+        recordDroppedEncryptedContent(prepared.dropped);
         const response = await nativeResponses(prepared.body, signal, {
             ...backendOptions,
             modelCallId
         });
-        return wrapResponsesReasoningResponse(response, reasoningOwner);
+        return wrapResponsesEncryptedResponse(response, encryptedContentOwner);
     }
     // Server-executed web search is honored when the caller declared the tool,
     // an executor is available (a provider key exists), and no *client* tool
@@ -887,13 +887,13 @@ export async function handleResponses(backend, body, modelCallId, signal, backen
     const includeCompatibleBody = requestsEncryptedReasoning && !preservesOpaqueReasoning
         ? { ...body, include: body.include?.filter((value) => value !== "reasoning.encrypted_content") }
         : body;
-    const reasoningPolicy = destinationWireShape === "routekit-envelope"
+    const encryptedInputPolicy = destinationWireShape === "routekit-envelope"
         ? { mode: "relay" }
         : destinationWireShape === "openai-responses"
-            ? { mode: "forward", owner: reasoningOwner, unwrap: false }
+            ? { mode: "forward", owner: encryptedContentOwner, unwrap: false }
             : { mode: "drop" };
-    const prepared = prepareResponsesReasoningInput(includeCompatibleBody, reasoningPolicy);
-    recordDroppedEncryptedReasoning(prepared.dropped);
+    const prepared = prepareResponsesEncryptedInput(includeCompatibleBody, encryptedInputPolicy);
+    recordDroppedEncryptedContent(prepared.dropped);
     const translatedBody = prepared.body;
     let chat;
     try {

package/dist/bedrock-source.d.ts

@@ -14,9 +14,13 @@ export type BedrockProviderSourceOptions = {
 export declare const BEDROCK_OPENAI_ALLOWLIST: readonly ["openai.gpt-5.4", "openai.gpt-5.5", "openai.gpt-5.6-sol", "openai.gpt-5.6-terra", "openai.gpt-5.6-luna"];
 export declare function isBedrockOpenAiModel(modelId: string): boolean;
 /**
- * Codex advertises `web_search_tool_type: "text_and_image"` and sends
- * `search_content_types` on `{ type: "web_search" }`. Bedrock mantle accepts
- * the tool but rejects that field. Native OpenAI Responses is unchanged.
+ * Codex talks to RouteKit as OpenAI-compatible, so it sends OpenAI/Codex
+ * protocol items that Bedrock mantle rejects. Native OpenAI is unchanged.
+ *
+ * - `search_content_types` on `web_search*`
+ * - `agent_message` (Codex 0.147 subagent handoff)
+ * - `encrypted_content` content parts (same 400 as `agent_message`)
+ * - `compaction` / `reasoning` encrypted blobs without `rsn_` / `smry_`
  */
 export declare function sanitizeBedrockMantleRequestBody(body: unknown): unknown;
 export declare function toBedrockConverseInput(body: unknown): ConverseCommandInput;

package/dist/bedrock-source.js

@@ -15,27 +15,93 @@ export function isBedrockOpenAiModel(modelId) {
     return BEDROCK_OPENAI_MODEL.test(modelId);
 }
 /**
- * Codex advertises `web_search_tool_type: "text_and_image"` and sends
- * `search_content_types` on `{ type: "web_search" }`. Bedrock mantle accepts
- * the tool but rejects that field. Native OpenAI Responses is unchanged.
+ * Codex talks to RouteKit as OpenAI-compatible, so it sends OpenAI/Codex
+ * protocol items that Bedrock mantle rejects. Native OpenAI is unchanged.
+ *
+ * - `search_content_types` on `web_search*`
+ * - `agent_message` (Codex 0.147 subagent handoff)
+ * - `encrypted_content` content parts (same 400 as `agent_message`)
+ * - `compaction` / `reasoning` encrypted blobs without `rsn_` / `smry_`
  */
 export function sanitizeBedrockMantleRequestBody(body) {
     const payload = record(body);
-    if (payload === undefined || !Array.isArray(payload.tools))
+    if (payload === undefined)
         return body;
+    let next = payload;
     let changed = false;
-    const tools = payload.tools.map((tool) => {
-        const entry = record(tool);
-        if (entry === undefined)
-            return tool;
-        const type = typeof entry.type === "string" ? entry.type : "";
-        if (!type.startsWith("web_search") || !("search_content_types" in entry))
-            return tool;
+    if (Array.isArray(payload.tools)) {
+        const tools = payload.tools.map((tool) => {
+            const entry = record(tool);
+            if (entry === undefined)
+                return tool;
+            const type = typeof entry.type === "string" ? entry.type : "";
+            if (!type.startsWith("web_search") || !("search_content_types" in entry))
+                return tool;
+            changed = true;
+            const { search_content_types: _ignored, ...rest } = entry;
+            return rest;
+        });
+        if (changed)
+            next = { ...next, tools };
+    }
+    if (Array.isArray(payload.input)) {
+        const input = [];
+        let inputChanged = false;
+        for (const item of payload.input) {
+            const sanitized = sanitizeBedrockMantleInputItem(item);
+            if (sanitized === undefined) {
+                inputChanged = true;
+                continue;
+            }
+            if (sanitized !== item)
+                inputChanged = true;
+            input.push(sanitized);
+        }
+        if (inputChanged) {
+            changed = true;
+            next = { ...next, input };
+        }
+    }
+    return changed ? next : body;
+}
+function recognizedEncryptedPrefix(value) {
+    return typeof value === "string" && (value.startsWith("rsn_") || value.startsWith("smry_"));
+}
+function sanitizeBedrockMantleContent(content) {
+    if (!Array.isArray(content))
+        return { content, changed: false };
+    const parts = content.filter((part) => record(part)?.type !== "encrypted_content");
+    return { content: parts, changed: parts.length !== content.length };
+}
+function sanitizeBedrockMantleInputItem(item) {
+    const entry = record(item);
+    if (entry === undefined)
+        return item;
+    const type = typeof entry.type === "string" ? entry.type : "";
+    if (type === "compaction" && "encrypted_content" in entry && !recognizedEncryptedPrefix(entry.encrypted_content)) {
+        return undefined;
+    }
+    if (type === "agent_message") {
+        const { content } = sanitizeBedrockMantleContent(entry.content);
+        return { type: "message", role: "user", content };
+    }
+    let next = entry;
+    let changed = false;
+    if (Array.isArray(entry.content)) {
+        const sanitized = sanitizeBedrockMantleContent(entry.content);
+        if (sanitized.changed) {
+            next = { ...next, content: sanitized.content };
+            changed = true;
+        }
+    }
+    if (type === "reasoning" &&
+        "encrypted_content" in next &&
+        !recognizedEncryptedPrefix(next.encrypted_content)) {
+        const { encrypted_content: _ignored, ...rest } = next;
+        next = rest;
         changed = true;
-        const { search_content_types: _ignored, ...rest } = entry;
-        return rest;
-    });
-    return changed ? { ...payload, tools } : body;
+    }
+    return changed ? next : item;
 }
 function mantleApiKey(env) {
     const key = env.AWS_BEARER_TOKEN_BEDROCK ?? env.BEDROCK_API_KEY;

package/dist/provider-backends.js

@@ -1,7 +1,7 @@
 import { randomId } from "@velum-labs/routekit-runtime";
 import { joinPath } from "./backend.js";
 import { droppedField } from "./adapters/dropped.js";
-import { normalizeOpenAiResponsesCallIds, prepareResponsesReasoningInput, wrapResponsesEncryptedContent } from "./adapters/openai-responses-wire.js";
+import { normalizeOpenAiResponsesCallIds, prepareResponsesEncryptedInput, wrapResponsesEncryptedContent } from "./adapters/openai-responses-wire.js";
 import { SseDecoder, SseParseError } from "./sse/parse.js";
 import { anthropicMessageContentOf, anthropicReasoningDetailsOf, anthropicRequestMetadataOf, attachGoogleToolCallIndexes, googleThoughtDetailsOf, googleToolCallIndexesOf, reasoningSelectionOf, routeKitRequestValidationErrorOf, attachResponsesReasoningMetadata, responsesReasoningMetadataOf } from "./adapters/openai-chat-wire.js";
 function invalidReasoningControlResponse(message, metadata = false, path) {
@@ -1059,16 +1059,16 @@ function responsesRequest(body, model, options) {
             }
             : {})
     });
-    const prepared = prepareResponsesReasoningInput(request, {
+    const prepared = prepareResponsesEncryptedInput(request, {
         mode: "forward",
-        owner: codexReasoningOwner(model)
+        owner: codexEncryptedContentOwner(model)
     });
     if (prepared.dropped > 0) {
-        droppedField("responses", "encrypted_content", "input.reasoning");
+        droppedField("responses", "encrypted_content", "input");
     }
     return prepared.body;
 }
-function codexReasoningOwner(model) {
+function codexEncryptedContentOwner(model) {
     return { provider: "codex", nativeModel: model };
 }
 function responsesOutput(payload, model) {
@@ -1089,7 +1089,7 @@ function responsesOutput(payload, model) {
         item.encrypted_content.length > 0
         ? [{
                 ...item,
-                encrypted_content: wrapResponsesEncryptedContent(item.encrypted_content, codexReasoningOwner(model))
+                encrypted_content: wrapResponsesEncryptedContent(item.encrypted_content, codexEncryptedContentOwner(model))
             }]
         : []);
     const toolCalls = (output ?? []).flatMap((item, index) => item.type === "function_call"
@@ -1315,7 +1315,7 @@ export class CodexResponsesBackend extends HttpProviderBackend {
                         const delta = {};
                         const wrappedOutput = {
                             ...output,
-                            encrypted_content: wrapResponsesEncryptedContent(output.encrypted_content, codexReasoningOwner(model))
+                            encrypted_content: wrapResponsesEncryptedContent(output.encrypted_content, codexEncryptedContentOwner(model))
                         };
                         attachResponsesReasoningMetadata(delta, {
                             items: [wrappedOutput],

package/dist/server.js

@@ -5,7 +5,7 @@ import { effectiveModel, isStream, withDefaultModel } from "./adapters/chat.js";
 import { cursorModelVariants, isCursorChatBody, resolveCursorModelSelection, translateCursorRequest } from "./adapters/cursor.js";
 import { droppedField } from "./adapters/dropped.js";
 import { routeKitRequestValidationErrorOf, withReasoningSelection } from "./adapters/openai-chat-wire.js";
-import { prepareResponsesReasoningInput, repairLegacyToolSearchItemIds, wrapResponsesReasoningResponse } from "./adapters/openai-responses-wire.js";
+import { prepareResponsesEncryptedInput, repairLegacyToolSearchItemIds, wrapResponsesEncryptedResponse } from "./adapters/openai-responses-wire.js";
 import { handleResponses } from "./adapters/responses.js";
 import { validateAnthropicRequest, validateChatRequest, validateCountTokensRequest, validateResponsesRequest } from "./adapters/validate.js";
 import { authorizedRequest, parsePrincipalHeader, ROUTEKIT_PRINCIPAL_HEADER } from "./auth.js";
@@ -656,7 +656,7 @@ export async function startGateway(options) {
                 : withModel(routedBody, route.publicId);
             if (codexProviderRelay !== undefined && route?.provider === "codex") {
                 const owner = { provider: "codex", nativeModel: route.nativeId };
-                const prepared = prepareResponsesReasoningInput(repairLegacyToolSearchItemIds(withModel(body, route.nativeId)), {
+                const prepared = prepareResponsesEncryptedInput(repairLegacyToolSearchItemIds(withModel(body, route.nativeId)), {
                     mode: "forward",
                     owner
                 });
@@ -673,13 +673,13 @@ export async function startGateway(options) {
                     },
                     invoke: async (_callId, signal, onAttribution) => {
                         if (prepared.dropped > 0) {
-                            droppedField("responses", "encrypted_content", "input.reasoning");
+                            droppedField("responses", "encrypted_content", "input");
                         }
                         const response = await codexProviderRelay.relay(req.headers, relayBody, signal, {
                             responseMode: isStream(body) ? "streaming" : "buffered",
                             onAttribution
                         });
-                        return await wrapResponsesReasoningResponse(response, owner);
+                        return await wrapResponsesEncryptedResponse(response, owner);
                     }
                 });
                 return;
@@ -692,7 +692,7 @@ export async function startGateway(options) {
                     provider: "codex",
                     nativeModel: requestedModel ?? "codex/default"
                 };
-                const prepared = prepareResponsesReasoningInput(repairLegacyToolSearchItemIds(body), {
+                const prepared = prepareResponsesEncryptedInput(repairLegacyToolSearchItemIds(body), {
                     mode: "forward",
                     owner
                 });
@@ -708,13 +708,13 @@ export async function startGateway(options) {
                     },
                     invoke: async (_callId, signal, onAttribution) => {
                         if (prepared.dropped > 0) {
-                            droppedField("responses", "encrypted_content", "input.reasoning");
+                            droppedField("responses", "encrypted_content", "input");
                         }
                         const response = await codexRequestRelay.relay(req.headers, prepared.body, signal, {
                             responseMode: isStream(body) ? "streaming" : "buffered",
                             onAttribution
                         });
-                        return await wrapResponsesReasoningResponse(response, owner);
+                        return await wrapResponsesEncryptedResponse(response, owner);
                     }
                 });
                 return;

package/dist/test/bedrock-source.test.js

@@ -523,6 +523,48 @@ test("sanitizeBedrockMantleRequestBody strips search_content_types from web_sear
     const untouched = { model: "openai.gpt-5.6-sol", tools: [{ type: "web_search" }] };
     assert.equal(sanitizeBedrockMantleRequestBody(untouched), untouched);
 });
+test("sanitizeBedrockMantleRequestBody rewrites Codex agent_message and drops encrypted_content", () => {
+    const body = {
+        model: "openai.gpt-5.6-sol",
+        input: [
+            {
+                type: "agent_message",
+                author: "/root",
+                recipient: "/root/package_architecture",
+                content: [
+                    { type: "input_text", text: "Reply with exactly PONG" },
+                    { type: "encrypted_content", encrypted_content: " " }
+                ]
+            },
+            {
+                type: "message",
+                role: "user",
+                content: [
+                    { type: "input_text", text: "keep" },
+                    { type: "encrypted_content", encrypted_content: " " }
+                ]
+            },
+            { type: "compaction", encrypted_content: "not-a-prefix" },
+            { type: "reasoning", encrypted_content: "rsn_ok", summary: [] }
+        ]
+    };
+    assert.deepEqual(sanitizeBedrockMantleRequestBody(body), {
+        model: "openai.gpt-5.6-sol",
+        input: [
+            {
+                type: "message",
+                role: "user",
+                content: [{ type: "input_text", text: "Reply with exactly PONG" }]
+            },
+            {
+                type: "message",
+                role: "user",
+                content: [{ type: "input_text", text: "keep" }]
+            },
+            { type: "reasoning", encrypted_content: "rsn_ok", summary: [] }
+        ]
+    });
+});
 test("Bedrock mantle Responses drops Codex search_content_types before egress", async () => {
     const forwarded = [];
     const source = new BedrockProviderSource({
@@ -551,6 +593,40 @@ test("Bedrock mantle Responses drops Codex search_content_types before egress",
         }
     ]);
 });
+test("Bedrock mantle Responses rewrites Codex agent_message before egress", async () => {
+    const forwarded = [];
+    const source = new BedrockProviderSource({
+        env: { AWS_BEARER_TOKEN_BEDROCK: "bedrock-key", AWS_REGION: "us-east-1" },
+        controlClient: { send: async () => ({}) },
+        runtimeClient: { send: async () => ({}) },
+        mantleBackend: {
+            chat: async () => Response.json({}),
+            responses: async (body) => {
+                forwarded.push(body);
+                return Response.json({ id: "resp" });
+            }
+        }
+    });
+    const response = await source.responses({
+        model: "openai.gpt-5.6-sol",
+        input: [{
+                type: "agent_message",
+                author: "/root",
+                recipient: "/root/async_lifecycle",
+                content: [
+                    { type: "input_text", text: "hi" },
+                    { type: "encrypted_content", encrypted_content: " " }
+                ]
+            }]
+    });
+    assert.equal(response.status, 200);
+    assert.deepEqual(forwarded, [
+        {
+            model: "openai.gpt-5.6-sol",
+            input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] }]
+        }
+    ]);
+});
 test("Bedrock OpenAI chat without a mantle key returns 400 and does not call Converse", async () => {
     const runtimeCalls = [];
     const source = new BedrockProviderSource({

package/dist/test/openai-responses-wire.test.js

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
 import { test } from "node:test";
-import { normalizeOpenAiResponsesCallIds, parseResponsesEncryptedContent, prepareResponsesReasoningInput, repairLegacyToolSearchItemIds, wrapResponsesEncryptedContent, wrapResponsesReasoningResponse } from "../adapters/openai-responses-wire.js";
+import { normalizeOpenAiResponsesCallIds, parseResponsesEncryptedContent, prepareResponsesEncryptedInput, repairLegacyToolSearchItemIds, wrapResponsesEncryptedContent, wrapResponsesEncryptedResponse } from "../adapters/openai-responses-wire.js";
 const OWNER_A = {
     provider: "codex",
     nativeModel: "gpt-5.6"
@@ -134,7 +134,7 @@ test("legacy tool-search item ids are repaired narrowly without mutating input",
     const stringInput = { input: "hello" };
     assert.equal(repairLegacyToolSearchItemIds(stringInput), stringInput);
 });
-test("encrypted reasoning ownership round-trips exact opaque content", () => {
+test("encrypted Responses ownership round-trips exact opaque content", () => {
     const ciphertext = "opaque.with.separators/and unicode \u{1f9e0}\nbytes";
     const wrapped = wrapResponsesEncryptedContent(ciphertext, OWNER_A);
     assert.match(wrapped, /^rk1\.[A-Za-z0-9_-]+\./);
@@ -144,7 +144,7 @@ test("encrypted reasoning ownership round-trips exact opaque content", () => {
     });
     assert.equal(wrapResponsesEncryptedContent(wrapped, OWNER_B), wrapped);
 });
-test("reasoning input forward policy unwraps only the matching provider and native model", () => {
+test("encrypted input forward policy unwraps only the matching provider and native model", () => {
     const matching = wrapResponsesEncryptedContent("cipher-a", OWNER_A);
     const otherProvider = wrapResponsesEncryptedContent("cipher-b", OWNER_B);
     const otherModel = wrapResponsesEncryptedContent("cipher-c", {
@@ -164,7 +164,7 @@ test("reasoning input forward policy unwraps only the matching provider and nati
             { type: "function_call", call_id: "call_1", name: "read", arguments: "{}" }
         ]
     };
-    const prepared = prepareResponsesReasoningInput(body, {
+    const prepared = prepareResponsesEncryptedInput(body, {
         mode: "forward",
         owner: OWNER_A
     });
@@ -175,7 +175,7 @@ test("reasoning input forward policy unwraps only the matching provider and nati
     assert.equal(input[4]?.encrypted_content, undefined);
     assert.equal(body.input[1]?.encrypted_content, matching, "caller input is not mutated");
 });
-test("reasoning input relay and drop policies retain the portable transcript", () => {
+test("encrypted input relay and drop policies retain the portable transcript", () => {
     const ownedA = wrapResponsesEncryptedContent("cipher-a", OWNER_A);
     const ownedB = wrapResponsesEncryptedContent("cipher-b", OWNER_B);
     const malformedHeader = `rk1.${ownedA.split(".")[1]}!.cipher-malformed`;
@@ -191,10 +191,10 @@ test("reasoning input relay and drop policies retain the portable transcript", (
             { type: "function_call", call_id: "call_1", name: "read", arguments: "{}" }
         ]
     };
-    const relayed = prepareResponsesReasoningInput(body, { mode: "relay" });
+    const relayed = prepareResponsesEncryptedInput(body, { mode: "relay" });
     assert.equal(relayed.dropped, 3);
     assert.deepEqual(relayed.body.input.map((item) => item.encrypted_content), [ownedA, undefined, ownedB, undefined, undefined]);
-    const dropped = prepareResponsesReasoningInput(body, { mode: "drop" });
+    const dropped = prepareResponsesEncryptedInput(body, { mode: "drop" });
     assert.equal(dropped.dropped, 5);
     assert.deepEqual(dropped.body.input.map((item) => item.type), ["message", "message", "function_call"]);
 });
@@ -203,7 +203,7 @@ test("forward policy can retain a matching wrapper for a later provider bridge",
     const body = {
         input: [{ type: "reasoning", encrypted_content: wrapped }]
     };
-    const prepared = prepareResponsesReasoningInput(body, {
+    const prepared = prepareResponsesEncryptedInput(body, {
         mode: "forward",
         owner: OWNER_A,
         unwrap: false
@@ -211,24 +211,208 @@ test("forward policy can retain a matching wrapper for a later provider bridge",
     assert.equal(prepared.body, body);
     assert.equal(prepared.dropped, 0);
 });
-test("buffered Responses output wraps nested encrypted reasoning only", async () => {
+test("encrypted tool and message parts preserve portable history across provider switches", () => {
+    const matching = wrapResponsesEncryptedContent("matching", OWNER_A);
+    const foreign = wrapResponsesEncryptedContent("foreign", OWNER_B);
+    const otherModel = wrapResponsesEncryptedContent("other-model", {
+        provider: OWNER_A.provider,
+        nativeModel: "gpt-5.7"
+    });
+    const message = {
+        type: "agent_message",
+        id: "amsg_1",
+        content: [
+            { type: "input_text", text: "visible handoff" },
+            { type: "encrypted_content", encrypted_content: foreign }
+        ]
+    };
+    const functionOutput = {
+        type: "function_call_output",
+        call_id: "call_1",
+        output: [
+            { type: "input_text", text: "visible result" },
+            { type: "encrypted_content", encrypted_content: matching },
+            { type: "encrypted_content", encrypted_content: foreign },
+            { type: "encrypted_content", encrypted_content: "legacy-raw" }
+        ]
+    };
+    const customOutput = {
+        type: "custom_tool_call_output",
+        call_id: "call_2",
+        output: [
+            { type: "encrypted_content", encrypted_content: otherModel }
+        ]
+    };
+    const objectOutput = {
+        type: "function_call_output",
+        call_id: "call_3",
+        output: {
+            type: "encrypted_content",
+            encrypted_content: matching
+        }
+    };
+    const compaction = {
+        type: "compaction",
+        encrypted_content: foreign
+    };
+    const body = {
+        input: [
+            message,
+            functionOutput,
+            customOutput,
+            objectOutput,
+            compaction
+        ]
+    };
+    const prepared = prepareResponsesEncryptedInput(body, {
+        mode: "forward",
+        owner: OWNER_A
+    });
+    const input = prepared.body.input;
+    assert.equal(prepared.dropped, 5);
+    assert.deepEqual(input, [
+        {
+            type: "agent_message",
+            id: "amsg_1",
+            content: [{ type: "input_text", text: "visible handoff" }]
+        },
+        {
+            type: "function_call_output",
+            call_id: "call_1",
+            output: [
+                { type: "input_text", text: "visible result" },
+                { type: "encrypted_content", encrypted_content: "matching" }
+            ]
+        },
+        {
+            type: "custom_tool_call_output",
+            call_id: "call_2",
+            output: ""
+        },
+        {
+            type: "function_call_output",
+            call_id: "call_3",
+            output: {
+                type: "encrypted_content",
+                encrypted_content: "matching"
+            }
+        }
+    ]);
+    assert.equal(message.content[1].encrypted_content, foreign, "caller message is not mutated");
+    assert.equal(functionOutput.output[1]
+        .encrypted_content, matching, "caller function output is not mutated");
+});
+test("encrypted-only message carriers are removed while tool outputs retain pairing", () => {
+    const foreign = wrapResponsesEncryptedContent("foreign", OWNER_B);
+    const body = {
+        input: [
+            {
+                type: "message",
+                role: "assistant",
+                content: [
+                    { type: "encrypted_content", encrypted_content: foreign }
+                ]
+            },
+            {
+                type: "agent_message",
+                id: "amsg_1",
+                content: [
+                    { type: "encrypted_content", encrypted_content: "legacy-raw" }
+                ]
+            },
+            {
+                type: "function_call_output",
+                call_id: "call_1",
+                output: [
+                    { type: "encrypted_content", encrypted_content: foreign }
+                ]
+            },
+            {
+                type: "custom_tool_call_output",
+                call_id: "call_2",
+                output: {
+                    type: "encrypted_content",
+                    encrypted_content: "legacy-raw"
+                }
+            }
+        ]
+    };
+    const prepared = prepareResponsesEncryptedInput(body, {
+        mode: "forward",
+        owner: OWNER_A
+    });
+    assert.equal(prepared.dropped, 4);
+    assert.deepEqual(prepared.body.input, [
+        { type: "function_call_output", call_id: "call_1", output: "" },
+        { type: "custom_tool_call_output", call_id: "call_2", output: "" }
+    ]);
+});
+test("relay policy retains owned nested content without unwrapping", () => {
+    const owned = wrapResponsesEncryptedContent("owned", OWNER_A);
+    const body = {
+        input: [
+            {
+                type: "function_call_output",
+                call_id: "call_1",
+                output: [
+                    { type: "encrypted_content", encrypted_content: owned },
+                    { type: "encrypted_content", encrypted_content: "legacy-raw" }
+                ]
+            }
+        ]
+    };
+    const prepared = prepareResponsesEncryptedInput(body, { mode: "relay" });
+    assert.equal(prepared.dropped, 1);
+    assert.deepEqual(prepared.body.input, [
+        {
+            type: "function_call_output",
+            call_id: "call_1",
+            output: [{ type: "encrypted_content", encrypted_content: owned }]
+        }
+    ]);
+});
+test("buffered Responses output wraps all supported encrypted replay content", async () => {
     const response = Response.json({
         id: "resp_1",
         output: [
             { type: "reasoning", encrypted_content: "cipher-a", summary: [] },
+            { type: "compaction", encrypted_content: "compact-a" },
+            {
+                type: "agent_message",
+                content: [
+                    { type: "input_text", text: "handoff" },
+                    { type: "encrypted_content", encrypted_content: "agent-a" }
+                ]
+            },
+            {
+                type: "function_call_output",
+                call_id: "call_1",
+                output: [
+                    { type: "input_text", text: "result" },
+                    { type: "encrypted_content", encrypted_content: "function-a" }
+                ]
+            },
+            {
+                type: "custom_tool_call_output",
+                call_id: "call_2",
+                output: {
+                    type: "encrypted_content",
+                    encrypted_content: "custom-a"
+                }
+            },
             { type: "message", content: [{ type: "output_text", text: "done" }] }
         ]
     }, {
         headers: { "content-length": "1", "x-test": "kept" }
     });
-    const wrapped = await wrapResponsesReasoningResponse(response, OWNER_A);
+    const wrapped = await wrapResponsesEncryptedResponse(response, OWNER_A);
     const payload = await wrapped.json();
-    assert.deepEqual(parseResponsesEncryptedContent(payload.output[0]?.encrypted_content), { owner: OWNER_A, ciphertext: "cipher-a" });
-    assert.equal(payload.output[1]?.encrypted_content, undefined);
+    const encrypted = [...JSON.stringify(payload).matchAll(/"encrypted_content":"([^"]+)"/g)].map((match) => parseResponsesEncryptedContent(match[1]));
+    assert.deepEqual(encrypted, ["cipher-a", "compact-a", "agent-a", "function-a", "custom-a"].map((ciphertext) => ({ owner: OWNER_A, ciphertext })));
     assert.equal(wrapped.headers.get("content-length"), null);
     assert.equal(wrapped.headers.get("x-test"), "kept");
 });
-test("streaming Responses output wraps reasoning and preserves SSE framing", async () => {
+test("streaming Responses output wraps encrypted replay content and preserves SSE framing", async () => {
     const encoder = new TextEncoder();
     const raw = [
         ": keepalive\r\n\r\n",
@@ -237,8 +421,10 @@ test("streaming Responses output wraps reasoning and preserves SSE framing", asy
         "event: response.output_item.done\r\n",
         'data: {"output_index":0,\r\n',
         'data: "item":{"type":"reasoning","encrypted_content":"cipher-\u{1f9e0}"}}\r\n\r\n',
+        "event: response.output_item.done\r\n",
+        'data: {"output_index":1,"item":{"type":"function_call_output","call_id":"call_1","output":[{"type":"encrypted_content","encrypted_content":"function-stream"}]}}\r\n\r\n',
         "event: response.completed\r\n",
-        'data: {"response":{"output":[{"type":"reasoning","encrypted_content":"terminal"}]}}\r\n\r\n',
+        'data: {"response":{"output":[{"type":"agent_message","content":[{"type":"encrypted_content","encrypted_content":"terminal"}]}]}}\r\n\r\n',
         "event: custom\r\n",
         "data: not-json\r\n\r\n",
         "data: [DONE]\r\n\r\n"
@@ -255,7 +441,7 @@ test("streaming Responses output wraps reasoning and preserves SSE framing", asy
     const response = new Response(source, {
         headers: { "content-type": "text/event-stream", "content-length": "5" }
     });
-    const wrapped = await wrapResponsesReasoningResponse(response, OWNER_A);
+    const wrapped = await wrapResponsesEncryptedResponse(response, OWNER_A);
     const text = await wrapped.text();
     assert.match(text, /^: keepalive\r\n\r\n/);
     assert.match(text, /id: event-1\r\nretry: 1000\r\nevent: response\.output_item\.done/);
@@ -266,6 +452,7 @@ test("streaming Responses output wraps reasoning and preserves SSE framing", asy
         .map((match) => parseResponsesEncryptedContent(match[1]));
     assert.deepEqual(envelopes, [
         { owner: OWNER_A, ciphertext: "cipher-\u{1f9e0}" },
+        { owner: OWNER_A, ciphertext: "function-stream" },
         { owner: OWNER_A, ciphertext: "terminal" }
     ]);
 });

package/dist/test/responses.test.js

@@ -1011,7 +1011,7 @@ test("Responses follows ModelRoutedBackend reasoning wire capability", async ()
         await gateway.close();
     }
 });
-test("native Responses swaps isolate provider reasoning and restore it on A to B to A", async () => {
+test("native Responses swaps isolate encrypted replay state and restore it on A to B to A", async () => {
     const requests = [];
     const routes = {
         "provider-a/model-a": {
@@ -1054,6 +1054,17 @@ test("native Responses swaps isolate provider reasoning and restore it on A to B
                         encrypted_content: `raw-${suffix}`,
                         summary: []
                     },
+                    {
+                        type: "function_call_output",
+                        call_id: `call_${suffix}`,
+                        output: [
+                            { type: "input_text", text: `tool-${suffix}` },
+                            {
+                                type: "encrypted_content",
+                                encrypted_content: `raw-tool-${suffix}`
+                            }
+                        ]
+                    },
                     {
                         type: "message",
                         role: "assistant",
@@ -1084,9 +1095,25 @@ test("native Responses swaps isolate provider reasoning and restore it on A to B
             owner: { provider: "provider-a", nativeModel: "model-a" },
             ciphertext: "raw-a"
         });
+        const encryptedToolA = String(firstPayload.output[1]?.output?.[1]?.encrypted_content);
+        assert.deepEqual(parseResponsesEncryptedContent(encryptedToolA), {
+            owner: { provider: "provider-a", nativeModel: "model-a" },
+            ciphertext: "raw-tool-a"
+        });
         const secondInput = [
             { role: "user", content: "start" },
             { type: "reasoning", id: "rs_a", encrypted_content: encryptedA },
+            {
+                type: "function_call_output",
+                call_id: "call_a",
+                output: [
+                    { type: "input_text", text: "tool-a" },
+                    {
+                        type: "encrypted_content",
+                        encrypted_content: encryptedToolA
+                    }
+                ]
+            },
             { type: "message", role: "assistant", content: "visible-a" }
         ];
         const second = await fetch(`${gateway.url()}/v1/responses`, {
@@ -1107,7 +1134,18 @@ test("native Responses swaps isolate provider reasoning and restore it on A to B
         });
         const sentToB = requests[1];
         assert.equal(sentToB.input.some((item) => item.type === "reasoning"), false);
+        assert.deepEqual(sentToB.input.find((item) => item.type === "function_call_output"), {
+            type: "function_call_output",
+            call_id: "call_a",
+            output: [{ type: "input_text", text: "tool-a" }]
+        });
+        assert.equal(JSON.stringify(sentToB).includes("raw-tool-a"), false);
         assert.deepEqual(sentToB.include, ["reasoning.encrypted_content"]);
+        const encryptedToolB = String(secondPayload.output[1]?.output?.[1]?.encrypted_content);
+        assert.deepEqual(parseResponsesEncryptedContent(encryptedToolB), {
+            owner: { provider: "provider-b", nativeModel: "model-b" },
+            ciphertext: "raw-tool-b"
+        });
         const third = await fetch(`${gateway.url()}/v1/responses`, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -1116,6 +1154,17 @@ test("native Responses swaps isolate provider reasoning and restore it on A to B
                 input: [
                     ...secondInput,
                     { type: "reasoning", id: "rs_b", encrypted_content: encryptedB },
+                    {
+                        type: "function_call_output",
+                        call_id: "call_b",
+                        output: [
+                            { type: "input_text", text: "tool-b" },
+                            {
+                                type: "encrypted_content",
+                                encrypted_content: encryptedToolB
+                            }
+                        ]
+                    },
                     { type: "message", role: "assistant", content: "visible-b" }
                 ],
                 include: ["reasoning.encrypted_content"]
@@ -1130,7 +1179,17 @@ test("native Responses swaps isolate provider reasoning and restore it on A to B
                 encrypted_content: "raw-a"
             }]);
         assert.equal(JSON.stringify(sentBackToA).includes("raw-b"), false);
+        assert.equal(JSON.stringify(sentBackToA).includes("raw-tool-b"), false);
         assert.equal(JSON.stringify(sentBackToA).includes("rk1."), false);
+        assert.deepEqual(sentBackToA.input
+            .filter((item) => item.type === "function_call_output")
+            .map((item) => item.output), [
+            [
+                { type: "input_text", text: "tool-a" },
+                { type: "encrypted_content", encrypted_content: "raw-tool-a" }
+            ],
+            [{ type: "input_text", text: "tool-b" }]
+        ]);
         assert.deepEqual(sentBackToA.input
             .filter((item) => item.type === "message")
             .map((item) => item.content), ["visible-a", "visible-b"]);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velum-labs/routekit-gateway",
   "private": false,
-  "version": "0.18.4",
+  "version": "0.18.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/velum-labs/routekit.git",
@@ -29,10 +29,10 @@
     "@aws-sdk/client-bedrock": "3.1095.0",
     "@aws-sdk/client-bedrock-runtime": "3.1095.0",
     "zod": "4.4.3",
-    "@velum-labs/routekit-contracts": "0.18.4",
-    "@velum-labs/routekit-registry": "0.18.4",
-    "@velum-labs/routekit-runtime": "0.18.4",
-    "@velum-labs/routekit-tracing": "0.18.4"
+    "@velum-labs/routekit-contracts": "0.18.6",
+    "@velum-labs/routekit-tracing": "0.18.6",
+    "@velum-labs/routekit-runtime": "0.18.6",
+    "@velum-labs/routekit-registry": "0.18.6"
   },
   "keywords": [
     "routekit",