codex-multi-auth 2.10.0 → 2.12.0

package/dist/lib/model-capability-matrix.js

@@ -35,7 +35,15 @@ export function buildModelCapabilityMatrix(input) {
         });
         const entitlementKeys = [accountKey, entitlementKey];
         for (const model of models) {
-            const profile = MODEL_PROFILES[model] ?? MODEL_PROFILES[resolveNormalizedModel(model)];
+            // `Object.hasOwn` before the index: `models` comes from `--model` on
+            // the CLI, so `constructor` and friends reach this lookup and a bare
+            // index returns the matching `Object.prototype` member. It is truthy,
+            // so the `!profile` guard passes it through and the matrix emits a row
+            // whose normalizedModel, promptFamily and capabilities are all
+            // undefined.
+            const profile = Object.hasOwn(MODEL_PROFILES, model)
+                ? MODEL_PROFILES[model]
+                : MODEL_PROFILES[resolveNormalizedModel(model)];
             if (!profile)
                 continue;
             const entitlement = getEntitlementBlock(input.entitlements, entitlementKeys, profile.normalizedModel, now);

package/dist/lib/policy/runtime-policy.d.ts

@@ -2,7 +2,7 @@ import type { CapabilityPolicyStore } from "../capability-policy.js";
 import { type AccountPolicyStore } from "../account-policy.js";
 import { type BudgetGuardEvaluation, type BudgetGuardStore } from "../budget-guard.js";
 import { type ProjectRoutingProfileContext } from "../routing-profiles.js";
-import { appendUsageLedgerRow, type UsageLedgerOperation, type UsageLedgerOutcome, type UsageLedgerSource } from "../usage/index.js";
+import { appendUsageLedgerRow, type UsageLedgerOperation, type UsageLedgerOutcome, type UsageLedgerSource, type UsageServiceTier } from "../usage/index.js";
 export interface RuntimePolicyAccount {
     index: number;
     accountId?: string | null;
@@ -46,6 +46,14 @@ export interface RuntimeUsageRecordInput {
     cachedInputTokens?: number | null;
     reasoningTokens?: number | null;
     totalTokens?: number | null;
+    /**
+     * Billed service tier, when upstream reported one. Carried explicitly
+     * because the row below is rebuilt field by field: a spread from the
+     * usage deferral reaches this input, but anything not named here is
+     * dropped before the ledger, which would price a Fast response at the
+     * standard rate.
+     */
+    serviceTier?: UsageServiceTier;
 }
 export declare function loadRuntimePolicyState(startDir?: string): Promise<RuntimePolicyState>;
 export declare function evaluateRuntimePolicy(input: {

package/dist/lib/policy/runtime-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAgCvB"}
+{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAiCvB"}

package/dist/lib/policy/runtime-policy.js

@@ -187,6 +187,7 @@ export function createRuntimeUsageRecorder(input) {
                 cachedInputTokens: recordInput.cachedInputTokens,
                 reasoningTokens: recordInput.reasoningTokens,
                 totalTokens: recordInput.totalTokens,
+                serviceTier: recordInput.serviceTier,
             };
             await append(row).catch(() => undefined);
         },

package/dist/lib/request/error-classification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-classification.d.ts","sourceRoot":"","sources":["../../../lib/request/error-classification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,gBAAgB;IACzB,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACvB;AAED,sGAAsG;AACtG,eAAO,MAAM,oCAAoC,6CAA6C,CAAC;AAQ/F,eAAO,MAAM,wCAAwC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAoB7E,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sCAAsC;IACtD,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,+BAA+B,EAAE,OAAO,CAAC;IACzC,iCAAiC,EAAE,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AA0CD,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgBzF;AAED,sGAAsG;AACtG,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ3F;AAED,wBAAgB,4BAA4B,CAC3C,SAAS,EAAE,OAAO,GAChB,yBAAyB,CAqD3B;AAED,wBAAgB,oCAAoC,CACnD,OAAO,EAAE,sCAAsC,GAC7C,MAAM,GAAG,SAAS,CAgCpB;AAED;;GAEG;AACH,wBAAgB,uCAAuC,CACtD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,OAAO,GAChB,OAAO,CAgBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACrB,OAAO,CAoDT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAmB1E"}
+{"version":3,"file":"error-classification.d.ts","sourceRoot":"","sources":["../../../lib/request/error-classification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,gBAAgB;IACzB,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACvB;AAED,sGAAsG;AACtG,eAAO,MAAM,oCAAoC,6CAA6C,CAAC;AAQ/F,eAAO,MAAM,wCAAwC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAoD7E,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sCAAsC;IACtD,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,+BAA+B,EAAE,OAAO,CAAC;IACzC,iCAAiC,EAAE,OAAO,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAiDD,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgBzF;AAED,sGAAsG;AACtG,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ3F;AAED,wBAAgB,4BAA4B,CAC3C,SAAS,EAAE,OAAO,GAChB,yBAAyB,CAqD3B;AAED,wBAAgB,oCAAoC,CACnD,OAAO,EAAE,sCAAsC,GAC7C,MAAM,GAAG,SAAS,CAkCpB;AAED;;GAEG;AACH,wBAAgB,uCAAuC,CACtD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,OAAO,GAChB,OAAO,CAgBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACrB,OAAO,CAoDT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAmB1E"}

package/dist/lib/request/error-classification.js

@@ -4,13 +4,45 @@
  * re-exports the public symbols so existing importers are unchanged.
  */
 import { isRecord } from "../utils.js";
-import { HTTP_STATUS } from "../constants.js";
+import { HTTP_STATUS, stripModelEffortSuffix } from "../constants.js";
 /** @internal Exported only for sibling lib/request modules; import via fetch-helpers.ts elsewhere. */
 export const CHATGPT_CODEX_UNSUPPORTED_MODEL_CODE = "model_not_supported_with_chatgpt_account";
 const CHATGPT_CODEX_UNSUPPORTED_MODEL_PATTERN = /model is not supported when using codex with a chatgpt account/i;
 const NORMALIZED_UNSUPPORTED_MODEL_PATTERN = /the model ['"]([^'"]+)['"] is not currently available for this chatgpt account/i;
 const MODEL_ACCESS_DENIED_PATTERN = /the model [`'"]([^`'"]+)[`'"] does not exist or you do not have access to it/i;
 export const DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN = {
+    // GPT-6 Astra rolls out org by org, so an account that is not entitled yet
+    // gets a real unsupported-model response for it. This chain only fires when
+    // the user has opted into `fallbackOnUnsupportedCodexModel` (default
+    // `false`), and only on that response, so it never silently swaps the model
+    // out from under a request the account could have served.
+    //
+    // This table is walked ONE HOP AT A TIME, not as a per-request candidate
+    // list. index.ts reassigns `model` to whatever came back and passes that as
+    // `requestedModel` on the next unsupported response, so reaching `gpt-5.5`
+    // from Astra requires `gpt-5.6-sol` to carry its own entry below. A second
+    // element here is only ever consulted when the first is already in
+    // `attemptedModels` for that same call.
+    //
+    // Depth is not free: every hop spends one of the shared per-request outbound
+    // attempts (`tryConsumeOutboundRequestAttempt`). A single-account balanced
+    // session gets a budget of 5, and the aeon walk needs exactly 5, so it fits
+    // with nothing spare. Spend an attempt on a retry or a stream failover and
+    // the tail hops become unreachable, ending as an attempt-budget-exhausted
+    // 503 rather than `gpt-5.4`. Hops are ordered most-valuable-first so what is
+    // lost first matters least. Do not add a hop to a GPT-6 row without
+    // re-checking that budget; `test/gpt6-astra-models.test.ts` asserts it.
+    "gpt-6-astra": ["gpt-5.6-sol", "gpt-5.5"],
+    // aeon steps to the flagship first: still GPT-6, still Astra, just without
+    // the long-horizon behaviour.
+    "gpt-6-astra-aeon": ["gpt-6-astra", "gpt-5.6-sol"],
+    // The hop that makes the Astra path reach a model every account has. GPT-5.6
+    // shipped without a chain entry, so an unsupported 5.6 response ended the
+    // walk; with Astra above it that would have stranded the fallback one rung
+    // short of the floor it documents. Terra and Luna are deliberately still
+    // absent: nothing steps into them, so giving them a hop would change 5.6
+    // behaviour beyond completing this path.
+    "gpt-5.6-sol": ["gpt-5.5"],
     "gpt-5": ["gpt-5.5"],
     "gpt-5-pro": ["gpt-5.5-pro"],
     "gpt-5-chat-latest": ["gpt-5.5"],
@@ -40,10 +72,17 @@ function canonicalizeModelName(model) {
     const stripped = trimmed.includes("/")
         ? (trimmed.split("/").pop() ?? trimmed)
         : trimmed;
-    return stripped.replace(/-(none|minimal|low|medium|high|xhigh)$/i, "");
+    return stripModelEffortSuffix(stripped);
 }
 function normalizeFallbackChain(customChain) {
-    const normalized = {};
+    // Null-prototype, because both the keys written here and the keys read out of
+    // it are caller-controlled. On a plain object, a `customChain` entry named
+    // `__proto__` reassigns this object's prototype instead of adding a row, and
+    // a lookup for `constructor` returns `Object.prototype.constructor`, a
+    // truthy non-array whose `.length` is 1, so the emptiness check passes and
+    // the `for...of` below throws `targets is not iterable` inside the request
+    // path.
+    const normalized = Object.create(null);
     for (const [key, values] of Object.entries(DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN)) {
         const normalizedKey = canonicalizeModelName(key);
         if (!normalizedKey)
@@ -158,7 +197,9 @@ export function resolveUnsupportedCodexFallbackModel(options) {
     }
     const chain = normalizeFallbackChain(options.customChain);
     const targets = chain[currentModel] ?? [];
-    if (targets.length === 0)
+    // Belt and braces with the null-prototype chain above: a `customChain` the
+    // caller passed straight through could still carry a non-array value.
+    if (!Array.isArray(targets) || targets.length === 0)
         return undefined;
     for (const target of targets) {
         if (!options.fallbackToGpt52OnUnsupportedGpt53 &&

package/dist/lib/request/helpers/model-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-map.d.ts","sourceRoot":"","sources":["../../../../lib/request/helpers/model-map.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EACX,oBAAoB,EACpB,mBAAmB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAC1B,aAAa,GACb,WAAW,GACX,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAMvC,CAAC;AAEX,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,CAAC;IAC7C,yBAAyB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3D,YAAY,EAAE,iBAAiB,CAAC;CAChC;AA6CD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,aAAa,YAAY,CAAC;AAQvC,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAOjD,eAAO,MAAM,uBAAuB,iGAO1B,CAAC;AA4EX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA6G9C,CAAC;AAEX,QAAA,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,CAAC;AAqG7C,OAAO,EAAE,SAAS,EAAE,CAAC;AAoKrB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CA2BxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAavE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAEjF;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,mBAAmB,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD"}
+{"version":3,"file":"model-map.d.ts","sourceRoot":"","sources":["../../../../lib/request/helpers/model-map.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EACX,oBAAoB,EACpB,mBAAmB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAC1B,aAAa,GACb,WAAW,GACX,OAAO,GACP,SAAS,GACT,SAAS,CAAC;AAEb;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,WAAW,EAMvC,CAAC;AAEX,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,CAAC;IAC7C,yBAAyB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3D,YAAY,EAAE,iBAAiB,CAAC;CAChC;AA6CD,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,eAAO,MAAM,aAAa,YAAY,CAAC;AAevC,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAOjD,eAAO,MAAM,uBAAuB,iGAO1B,CAAC;AAoIX;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA+I9C,CAAC;AAEX,QAAA,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,CAAC;AAgI7C,OAAO,EAAE,SAAS,EAAE,CAAC;AAqOrB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAuCxE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAavE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAEjF;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB,mBAAmB,CASrB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/lib/request/helpers/model-map.js

@@ -60,6 +60,13 @@ export const DEFAULT_MODEL = "gpt-5.5";
 // actual request routing and the legacy `gpt-5` alias remain opt-in per 2.5.0.
 // Bare `gpt-5.6` aliases to Sol; we pin the canonical id so the probe display
 // and report `modelSelection` read `gpt-5.6-sol` without a remap arrow.
+//
+// GPT-6 Astra deliberately does NOT lead the probe as of its 2026-09-03 launch.
+// A probe only needs a response's quota headers, and Astra is still rolling out
+// org by org, so leading with it would spend one failed request per probe for
+// every account without entitlement yet and buy nothing. Move DEFAULT_PROBE_MODEL
+// to `gpt-6-astra` once it is broadly available, and put `gpt-5.6-sol` directly
+// behind it in QUOTA_PROBE_MODEL_CHAIN.
 export const DEFAULT_PROBE_MODEL = "gpt-5.6-sol";
 // Single source of truth for the live/quota probe fallback chain. Both the
 // manager probe (lib/quota-probe.ts) and the runtime probe (lib/runtime/quota-probe.ts)
@@ -102,6 +109,57 @@ const GPT_5_6_LUNA_EFFORTS = [
     "xhigh",
     "max",
 ];
+/**
+ * GPT-6 Astra, OpenAI's 2026-09-03 frontier release.
+ *
+ * There is no Sol/Terra/Luna split this generation: the announced lineup is the
+ * flagship plus `aeon`, a long-horizon variant built for runs measured in days.
+ * `gpt-6-astra` is the API model name OpenAI published at launch;
+ * `gpt-6-astra-aeon` is the second slug that shipped beside it in the Codex
+ * model list. "Astra Pro" is a plan tier, not a separate slug we have seen, so
+ * it is deliberately not registered as its own canonical model — the GPT-6
+ * resolver below claims `gpt-6-astra-pro` and every other unrecognised GPT-6 id
+ * for the flagship rather than letting it fall through to GPT-5.5.
+ */
+const GPT_6_ASTRA_MODEL = "gpt-6-astra";
+const GPT_6_ASTRA_AEON_MODEL = "gpt-6-astra-aeon";
+/** Bare `gpt-6` resolves to the flagship, mirroring bare `gpt-5.6` -> Sol. */
+const GPT_6_FLAGSHIP_ALIAS = "gpt-6";
+/**
+ * Astra inherits the GPT-5.6 frontier effort ladder: no `none`/`minimal`, and
+ * `ultra` at the top. OpenAI has published no default effort for Astra, so the
+ * flagship follows the tier it succeeds (Sol, `low`) and the long-horizon
+ * variant follows the catalog's other long-running models (`medium`).
+ */
+const GPT_6_ASTRA_EFFORTS = [
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+];
+/**
+ * Cyber-specialty models from the upstream Codex catalog
+ * (openai/codex `codex-rs/models-manager/models.json`).
+ *
+ * They are hidden in the Codex picker and gated behind the Daybreak program,
+ * but the catalog marks them `supported_in_api`, so a client can and does name
+ * them. Until now every `gpt-daybreak-*` id missed the codex resolver (no
+ * `codex` token) and the general GPT-5 resolver (no `gpt 5` tokens) and landed
+ * on `DEFAULT_MODEL` — asking for the cyber-permissive model silently ran
+ * GPT-5.5. Reasoning ladders and defaults below are the catalog's own values.
+ */
+const DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
+const DAYBREAK_RED_MODEL = "gpt-daybreak-red-latest";
+const DAYBREAK_EFFORTS = [
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+];
 const GPT_5_5_CANONICAL_MODEL = "gpt-5.5";
 const GPT_5_5_PRO_CANONICAL_MODEL = "gpt-5.5-pro";
 const GPT_5_5_RELEASE_MODEL = "gpt-5.5-2026-04-23";
@@ -180,6 +238,40 @@ export const MODEL_PROFILES = {
         supportedReasoningEfforts: ["medium"],
         capabilities: TOOL_CAPABILITIES.compactOnly,
     },
+    // Like GPT-5.6, GPT-6 Astra ships its base instructions inline in the
+    // upstream model catalog rather than as a `gpt_6_prompt.md`, so it stays on
+    // the GPT-5.2 prompt family with every other post-5.2 general model. Adding
+    // a `gpt-6` prompt family here would also widen MODEL_FAMILIES, which is a
+    // persisted key space (`activeIndexByFamily`) and would need a storage
+    // migration to grow.
+    [GPT_6_ASTRA_MODEL]: {
+        normalizedModel: GPT_6_ASTRA_MODEL,
+        promptFamily: "gpt-5.2",
+        defaultReasoningEffort: "low",
+        supportedReasoningEfforts: GPT_6_ASTRA_EFFORTS,
+        capabilities: TOOL_CAPABILITIES.full,
+    },
+    [GPT_6_ASTRA_AEON_MODEL]: {
+        normalizedModel: GPT_6_ASTRA_AEON_MODEL,
+        promptFamily: "gpt-5.2",
+        defaultReasoningEffort: "medium",
+        supportedReasoningEfforts: GPT_6_ASTRA_EFFORTS,
+        capabilities: TOOL_CAPABILITIES.full,
+    },
+    [DAYBREAK_BLUE_MODEL]: {
+        normalizedModel: DAYBREAK_BLUE_MODEL,
+        promptFamily: "gpt-5.2",
+        defaultReasoningEffort: "low",
+        supportedReasoningEfforts: DAYBREAK_EFFORTS,
+        capabilities: TOOL_CAPABILITIES.full,
+    },
+    [DAYBREAK_RED_MODEL]: {
+        normalizedModel: DAYBREAK_RED_MODEL,
+        promptFamily: "gpt-5.2",
+        defaultReasoningEffort: "medium",
+        supportedReasoningEfforts: DAYBREAK_EFFORTS,
+        capabilities: TOOL_CAPABILITIES.full,
+    },
     // GPT-5.6 ships its base instructions inline in the upstream model catalog
     // rather than as a `gpt_5_6_prompt.md`, so these stay on the GPT-5.2 prompt
     // family alongside the other post-5.2 general models.
@@ -282,6 +374,21 @@ function addGpt56Aliases() {
     addEffortAliases(GPT_5_6_LUNA_MODEL, GPT_5_6_LUNA_MODEL, GPT_5_6_LUNA_EFFORTS);
     addEffortAliases(GPT_5_6_FLAGSHIP_ALIAS, GPT_5_6_SOL_MODEL, GPT_5_6_SOL_TERRA_EFFORTS);
 }
+function addGpt6Aliases() {
+    addEffortAliases(GPT_6_ASTRA_MODEL, GPT_6_ASTRA_MODEL, GPT_6_ASTRA_EFFORTS);
+    addEffortAliases(GPT_6_ASTRA_AEON_MODEL, GPT_6_ASTRA_AEON_MODEL, GPT_6_ASTRA_EFFORTS);
+    addEffortAliases(GPT_6_FLAGSHIP_ALIAS, GPT_6_ASTRA_MODEL, GPT_6_ASTRA_EFFORTS);
+    // `astra` on its own is how the model is spoken about everywhere; accept it
+    // rather than letting it fall through to GPT-5.5.
+    addEffortAliases("astra", GPT_6_ASTRA_MODEL, GPT_6_ASTRA_EFFORTS);
+    addEffortAliases("astra-aeon", GPT_6_ASTRA_AEON_MODEL, GPT_6_ASTRA_EFFORTS);
+}
+function addDaybreakAliases() {
+    addEffortAliases(DAYBREAK_BLUE_MODEL, DAYBREAK_BLUE_MODEL, DAYBREAK_EFFORTS);
+    addEffortAliases(DAYBREAK_RED_MODEL, DAYBREAK_RED_MODEL, DAYBREAK_EFFORTS);
+    addEffortAliases("daybreak-blue", DAYBREAK_BLUE_MODEL, DAYBREAK_EFFORTS);
+    addEffortAliases("daybreak-red", DAYBREAK_RED_MODEL, DAYBREAK_EFFORTS);
+}
 function addGeneralAliases() {
     addReasoningAliases(GPT_5_5_CANONICAL_MODEL, GPT_5_5_CANONICAL_MODEL);
     addReasoningAliases(GPT_5_5_RELEASE_MODEL, GPT_5_5_CANONICAL_MODEL);
@@ -320,6 +427,8 @@ function addCodexAliases() {
 addCodexAliases();
 addGeneralAliases();
 addGpt56Aliases();
+addGpt6Aliases();
+addDaybreakAliases();
 export { MODEL_MAP };
 function stripProviderPrefix(modelId) {
     return modelId.includes("/") ? (modelId.split("/").pop() ?? modelId) : modelId;
@@ -395,6 +504,68 @@ function resolveCodexCatalogModel(modelId) {
  * model than the caller asked for. Unrecognised tiers resolve to Sol, matching
  * OpenAI's bare `gpt-5.6` alias.
  */
+/**
+ * Resolve GPT-6 identifiers that are not exact aliases — a dated snapshot id
+ * (`gpt-6-astra-2026-09-03`), the "Astra Pro" plan tier (`gpt-6-astra-pro`), or
+ * any tier name OpenAI adds after this file was written.
+ *
+ * This is the same guard the 5.6 resolver exists for, one major version up:
+ * without it, `resolveGeneralGpt5CatalogModel` never matches (it requires a
+ * `gpt 5` token pair) and every unrecognised GPT-6 id lands on `DEFAULT_MODEL`,
+ * running GPT-5.5 for a caller who asked for the frontier model. `aeon` keeps
+ * its own canonical id because it is a behaviourally different model (long
+ * horizon), not a rename of the flagship; everything else resolves to the
+ * flagship, matching OpenAI's bare `gpt-6` alias.
+ *
+ * Ids carrying a `codex` token are left to `resolveCodexCatalogModel`, exactly
+ * as the 5.6 resolver defers them.
+ */
+function resolveGpt6CatalogModel(modelId) {
+    const tokens = tokenizeModelId(modelId);
+    const gptIndex = tokens.indexOf("gpt");
+    const versionToken = gptIndex === -1 ? undefined : tokens[gptIndex + 1];
+    // `gpt6` with no separator tokenizes as ONE token, so the `gpt` + `6` pair
+    // never forms and it used to fall through to GPT-5.5 while still passing
+    // capability-policy's catalog gate. Gate and resolver have to agree on the
+    // same id or the policy store keys state a request never reads.
+    const isGpt6 = versionToken === "6" || tokens.includes("gpt6");
+    // A bare `astra` token counts too. OpenAI's own launch material and every
+    // picker label say "Astra" without the `gpt-6` prefix, so `Astra Pro` and
+    // `astra-fast` reach this resolver with no version tokens at all; without
+    // this clause they miss every branch and land on GPT-5.5.
+    //
+    // It is anchored, not a free-floating substring: an id that names a
+    // DIFFERENT GPT major version does not get claimed for the frontier model
+    // just because `astra` appears in it, so `gpt-4-astra-x` is declined here
+    // rather than silently running GPT-6.
+    const namesOtherGptVersion = versionToken !== undefined &&
+        /^\d+$/.test(versionToken) &&
+        versionToken !== "6";
+    const isAstra = tokens.includes("astra") && !namesOtherGptVersion;
+    if ((!isGpt6 && !isAstra) || tokens.includes("codex")) {
+        return undefined;
+    }
+    if (tokens.includes("aeon"))
+        return GPT_6_ASTRA_AEON_MODEL;
+    return GPT_6_ASTRA_MODEL;
+}
+/**
+ * Resolve the Daybreak cyber models, including ids that are not exact aliases
+ * (a pinned `gpt-daybreak-red-2026-08-14`, say).
+ *
+ * `red` is the cyber-permissive variant and `blue` the defensive one; an
+ * unrecognised Daybreak id resolves to `blue`, the more restricted of the two,
+ * so a typo cannot silently upgrade a caller into the permissive model.
+ */
+function resolveDaybreakCatalogModel(modelId) {
+    const tokens = tokenizeModelId(modelId);
+    if (!tokens.includes("daybreak")) {
+        return undefined;
+    }
+    if (tokens.includes("red"))
+        return DAYBREAK_RED_MODEL;
+    return DAYBREAK_BLUE_MODEL;
+}
 function resolveGpt56CatalogModel(modelId) {
     const tokens = tokenizeModelId(modelId);
     const gptIndex = tokens.indexOf("gpt");
@@ -476,10 +647,20 @@ export function resolveNormalizedModel(model) {
     if (mappedModel) {
         return mappedModel;
     }
+    // Daybreak first: its slugs carry neither a `codex` nor a `gpt 5` token, so
+    // every other resolver declines them and they would reach DEFAULT_MODEL.
+    const daybreakCatalogModel = resolveDaybreakCatalogModel(modelId);
+    if (daybreakCatalogModel) {
+        return daybreakCatalogModel;
+    }
     const codexCatalogModel = resolveCodexCatalogModel(modelId);
     if (codexCatalogModel) {
         return codexCatalogModel;
     }
+    const gpt6CatalogModel = resolveGpt6CatalogModel(modelId);
+    if (gpt6CatalogModel) {
+        return gpt6CatalogModel;
+    }
     const gpt56CatalogModel = resolveGpt56CatalogModel(modelId);
     if (gpt56CatalogModel) {
         return gpt56CatalogModel;

package/dist/lib/usage/ledger.d.ts

@@ -1,4 +1,4 @@
-import type { UsageLedgerAppendInput, UsageLedgerPaths, UsageLedgerQuery, UsageLedgerRow, UsageSummary, UsageSummaryQuery } from "./types.js";
+import { type UsageLedgerAppendInput, type UsageLedgerPaths, type UsageLedgerQuery, type UsageLedgerRow, type UsageSummary, type UsageSummaryQuery } from "./types.js";
 export declare function getUsageLedgerPaths(): UsageLedgerPaths;
 export declare function appendUsageLedgerRow(input: UsageLedgerAppendInput): Promise<UsageLedgerRow>;
 export declare function readUsageLedgerRows(query?: UsageLedgerQuery): Promise<UsageLedgerRow[]>;

package/dist/lib/usage/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACX,sBAAsB,EAEtB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EAEd,YAAY,EAGZ,iBAAiB,EAEjB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AA+JD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../lib/usage/ledger.ts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAEnB,KAAK,YAAY,EAGjB,KAAK,iBAAiB,EAEtB,MAAM,YAAY,CAAC;AAqOpB,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,sBAAsB,GAC3B,OAAO,CAAC,cAAc,CAAC,CASzB;AAuKD,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B;AAuDD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,cAAc,EAAE,EACtB,KAAK,GAAE,iBAAsB,GAC3B,YAAY,CAwBd;AAED,wBAAsB,oBAAoB,CACzC,KAAK,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9B;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/lib/usage/ledger.js

@@ -4,6 +4,7 @@ import { getCodexMultiAuthDir } from "../runtime-paths.js";
 import { logWarn } from "../logger.js";
 import { isRecord, sleep } from "../utils.js";
 import { normalizeUsageLedgerRow, usageRowToJsonLine, } from "./redaction.js";
+import { isKnownServiceTier, } from "./types.js";
 const USAGE_DIR_NAME = "usage";
 const USAGE_LEDGER_FILE_NAME = "usage-ledger.jsonl";
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
@@ -287,6 +288,14 @@ function normalizeParsedUsageRow(value) {
             Number.isFinite(value.tokens.totalTokens)
             ? Math.max(0, Math.trunc(value.tokens.totalTokens))
             : 0,
+        // Validated against the union rather than passed through: the file is
+        // on disk and can be edited, and an unrecognised string would reach the
+        // pricer as a tier it has no rate for. Rebuilding only the numeric
+        // fields dropped this entirely, so a persisted Fast row read back as
+        // standard in `usage` reports.
+        ...(isKnownServiceTier(value.tokens.serviceTier)
+            ? { serviceTier: value.tokens.serviceTier }
+            : {}),
     };
     const account = isRecord(value.account)
         ? {

package/dist/lib/usage/pricing.d.ts

@@ -1,9 +1,24 @@
-import type { UsageTokenCounts } from "./types.js";
+import type { UsageServiceTier, UsageTokenCounts } from "./types.js";
 export interface UsageModelPricing {
     inputUsdPerMillion: number;
     outputUsdPerMillion: number;
     cachedInputUsdPerMillion?: number;
     reasoningUsdPerMillion?: number;
+    /**
+     * Rates for non-standard service tiers, keyed by `UsageServiceTier`.
+     *
+     * Every entry in `MODEL_PRICING` is a STANDARD-tier rate. OpenAI's Fast tier
+     * costs more (2x for GPT-6 Astra), so pricing a Fast session off the standard
+     * row under-counts it by half and lets a `maxCostUsd` cap overrun.
+     *
+     * A tier absent from this map is deliberately NOT approximated from the
+     * standard rate. Only Astra's Fast multiplier is published; inventing one for
+     * the rest would move a budget's trip point on a guess, which is the failure
+     * this file exists to avoid. `estimateUsageCostUsd` reports an unlisted tier
+     * as unknown cost instead, so a budget fails closed the same way it does for
+     * an unpriced model.
+     */
+    serviceTiers?: Partial<Record<UsageServiceTier, UsageModelPricing>>;
 }
 /**
  * Models the router can normalize to that have no published rate here yet.
@@ -19,7 +34,7 @@ export interface UsageModelPricing {
  * `test/usage-pricing-coverage.test.ts` fails if a NEW routable model appears
  * in neither list.
  */
-export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-5.1", "gpt-5.2-pro", "gpt-5.4-mini", "gpt-5.4-nano", "gpt-5.4-pro", "gpt-5.5-pro", "gpt-5-mini", "gpt-5-nano"];
+export declare const UNPRICED_ROUTABLE_MODELS: readonly ["gpt-6-astra-aeon", "gpt-daybreak-blue-latest", "gpt-daybreak-red-latest", "gpt-5.1", "gpt-5.2-pro", "gpt-5.4-mini", "gpt-5.4-nano", "gpt-5.4-pro", "gpt-5.5-pro", "gpt-5-mini", "gpt-5-nano"];
 export declare function getUsageModelPricing(model: string | null | undefined): UsageModelPricing | null;
 export declare function estimateUsageCostUsd(model: string | null | undefined, tokens: UsageTokenCounts): number | null;
 export declare function listUsageModelPricing(): Record<string, UsageModelPricing>;

package/dist/lib/usage/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AA2DD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,+HAS3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAM1B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CAqBf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../../lib/usage/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,iBAAiB;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACpE;AAyFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,0MAkB3B,CAAC;AAOX,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,iBAAiB,GAAG,IAAI,CAiB1B;AAmBD,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GACtB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAEzE"}

package/dist/lib/usage/pricing.js

@@ -1,4 +1,34 @@
 const MODEL_PRICING = {
+    // GPT-6 Astra, published at the 2026-09-03 launch: $10 / 1M input,
+    // $50 / 1M output on the standard service tier, and $20 / $100 on Fast,
+    // carried in `serviceTiers` below.
+    //
+    // The cached-input rate is the platform-wide 90% cached discount, which every
+    // other row in this table already encodes at exactly input/10. It shipped
+    // absent at first, on the reasoning that no Astra-specific cached figure was
+    // published; that made Astra the only model billing cached tokens at the FULL
+    // input rate, over-stating a cache-heavy session tenfold and tripping a
+    // `maxCostUsd` cap far too early. Over-stating is the safer direction than
+    // under-stating, but a 10x error blocks legitimate work, and the discount is
+    // a uniform platform rate rather than a per-model guess.
+    "gpt-6-astra": {
+        inputUsdPerMillion: 10,
+        outputUsdPerMillion: 50,
+        cachedInputUsdPerMillion: 1,
+        reasoningUsdPerMillion: 50,
+        serviceTiers: {
+            // Published at launch alongside the standard rate: Fast mode is up to
+            // 2.5x the speed at 2x the price, $20 / $100 per 1M. This is the only
+            // tier multiplier OpenAI has published for any model in this table,
+            // which is why it is the only one listed anywhere in this file.
+            priority: {
+                inputUsdPerMillion: 20,
+                outputUsdPerMillion: 100,
+                cachedInputUsdPerMillion: 2,
+                reasoningUsdPerMillion: 100,
+            },
+        },
+    },
     "gpt-5-codex": {
         inputUsdPerMillion: 1.25,
         outputUsdPerMillion: 10,
@@ -69,6 +99,15 @@ const MODEL_PRICING = {
  * in neither list.
  */
 export const UNPRICED_ROUTABLE_MODELS = [
+    // OpenAI published a rate for the Astra flagship at launch but not for the
+    // long-horizon `aeon` variant, and the Daybreak cyber models are sold under
+    // a separate controlled-access agreement with no public per-token rate.
+    // Pricing `aeon` off the flagship would be a guess on the model whose whole
+    // purpose is running for days, which is exactly where a wrong rate does the
+    // most damage.
+    "gpt-6-astra-aeon",
+    "gpt-daybreak-blue-latest",
+    "gpt-daybreak-red-latest",
     "gpt-5.1",
     "gpt-5.2-pro",
     "gpt-5.4-mini",
@@ -87,10 +126,42 @@ export function getUsageModelPricing(model) {
     if (!normalized) {
         return null;
     }
+    // `Object.hasOwn`, not a bare index. The model string arrives raw from the
+    // client (`createUsageLedgerRow` only trims it), so `constructor`,
+    // `toString` and friends reach this lookup and a bare index hands back the
+    // matching `Object.prototype` member. That object is truthy, so it is
+    // returned as a rate, and every field on it is undefined: the cost comes out
+    // `NaN` instead of `null`. A NaN cost is worse than an unknown one, because
+    // `NaN >= limit` is false, so it silently makes a `maxCostUsd` budget
+    // unenforceable rather than failing closed the way an unpriced model does.
+    if (!Object.hasOwn(MODEL_PRICING, normalized)) {
+        return null;
+    }
     return MODEL_PRICING[normalized] ?? null;
 }
+/**
+ * Pick the rate that applies to a response's service tier.
+ *
+ * Returns `null` when the tier is real but this table has no rate for it, which
+ * the caller turns into an unknown cost. `standard` and an absent tier both use
+ * the base row, because every entry in `MODEL_PRICING` is a standard-tier rate.
+ */
+function resolveServiceTierPricing(pricing, serviceTier) {
+    if (!serviceTier || serviceTier === "standard") {
+        return pricing;
+    }
+    return pricing.serviceTiers?.[serviceTier] ?? null;
+}
 export function estimateUsageCostUsd(model, tokens) {
-    const pricing = getUsageModelPricing(model);
+    const basePricing = getUsageModelPricing(model);
+    if (!basePricing) {
+        return null;
+    }
+    // Resolve the tier BEFORE any arithmetic. A response billed at a tier this
+    // table has no rate for must report unknown cost, not a standard-tier
+    // figure: under-counting is what lets a `maxCostUsd` cap overrun, and
+    // `evaluateBudgetGuard` already knows how to fail closed on `null`.
+    const pricing = resolveServiceTierPricing(basePricing, tokens.serviceTier);
     if (!pricing) {
         return null;
     }

package/dist/lib/usage/redaction.d.ts

@@ -1,4 +1,4 @@
-import type { UsageLedgerAccountRef, UsageLedgerAppendInput, UsageLedgerRow } from "./types.js";
+import { type UsageLedgerAccountRef, type UsageLedgerAppendInput, type UsageLedgerRow } from "./types.js";
 export declare function hashUsageIdentifier(value: string): string;
 export declare function createUsageAccountRef(input: {
     accountId?: string | null;

package/dist/lib/usage/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../lib/usage/redaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,sBAAsB,EAGtB,cAAc,EAGd,MAAM,YAAY,CAAC;AA2EpB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,qBAAqB,GAAG,IAAI,CAkB/B;AAsBD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,sBAAsB,GAC3B,cAAc,CA0BhB;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAE9D"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../lib/usage/redaction.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAG3B,KAAK,cAAc,EAGnB,MAAM,YAAY,CAAC;AA2EpB,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,qBAAqB,GAAG,IAAI,CAkB/B;AAkCD,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,sBAAsB,GAC3B,cAAc,CA0BhB;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAE9D"}

package/dist/lib/usage/redaction.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
+import { isKnownServiceTier, } from "./types.js";
 import { estimateUsageCostUsd } from "./pricing.js";
 const VALID_SOURCES = new Set([
     "runtime-proxy",
@@ -98,6 +99,18 @@ function normalizeTokens(input) {
         totalTokens: providedTotal === null
             ? computedTotal
             : Math.max(0, Math.trunc(providedTotal)),
+        // Carried through so `estimateUsageCostUsd` below can refuse to price a
+        // tier it has no rate for. Dropping it here would silently restore the
+        // standard-rate under-count this field exists to prevent.
+        //
+        // Validated, not passed through on truthiness. Every other field in this
+        // normaliser is checked against its allowed set (`normalizeSource`,
+        // `normalizeOperation`, `normalizeOutcome`), and the ledger READ path
+        // already rejects an unknown tier. Accepting one here made the write
+        // path the only unvalidated way onto a row.
+        ...(isKnownServiceTier(input.serviceTier)
+            ? { serviceTier: input.serviceTier }
+            : {}),
     };
 }
 export function normalizeUsageLedgerRow(input) {