omnigateway 0.13.6 → 0.14.0

package/gateway.js

@@ -11250,12 +11250,43 @@ var spendWindows = object({
   "5h": spendLimit.optional(),
   "1w": spendLimit.optional()
 }).strict();
-var limitConfigSchema = object({
+var limitConfigBaseSchema = object({
   requests: countWindows.optional(),
   tokens: countWindows.optional(),
   spend: spendWindows.optional(),
   concurrency: countLimit.optional()
 }).strict();
+var MAX_MODEL_OVERRIDES = 64;
+var MAX_MODEL_NAME_LENGTH = 256;
+function setsAnyLimit(scope) {
+  if (scope.concurrency !== undefined && scope.concurrency !== null)
+    return true;
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = scope[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window2 of WINDOWS) {
+      const limit = windows[window2];
+      if (limit !== undefined && limit !== null)
+        return true;
+    }
+  }
+  return false;
+}
+var modelOverrideSchema = limitConfigBaseSchema.refine(setsAnyLimit, {
+  message: "a model override must set at least one limit; omit the model to remove it"
+});
+var limitConfigSchema = limitConfigBaseSchema.extend({
+  models: record(string2().min(1).max(MAX_MODEL_NAME_LENGTH), modelOverrideSchema).refine((models) => Object.keys(models).length <= MAX_MODEL_OVERRIDES, {
+    message: `at most ${MAX_MODEL_OVERRIDES} model overrides per key`
+  }).optional()
+}).strict();
+function modelOverride(limits, model) {
+  const models = limits.models;
+  if (models === undefined || !Object.hasOwn(models, model))
+    return;
+  return models[model];
+}
 function assertNoProto(value, path) {
   if (typeof value !== "object" || value === null)
     return;
@@ -11372,7 +11403,22 @@ function evaluate(config, counters, now) {
     }
   }
   const violation = lastToClear(violations);
-  return { allowed: violation === null, violation, headroom };
+  return { allowed: violation === null, violation, violations, headroom };
+}
+function combine(key, model) {
+  const violations = [...key.violations, ...model.violations];
+  const violation = lastToClear(violations);
+  const headroom = { ...key.headroom };
+  for (const dimension of WINDOWED) {
+    const candidate = model.headroom[dimension];
+    if (candidate === undefined)
+      continue;
+    const current = headroom[dimension];
+    if (current === undefined || candidate.used / candidate.limit > current.used / current.limit) {
+      headroom[dimension] = candidate;
+    }
+  }
+  return { allowed: violation === null, violation, violations, headroom };
 }
 function retryAfterMs(violation, now) {
   return violation === null ? 0 : Math.max(0, violation.resetAt - now);
@@ -13242,6 +13288,31 @@ var _005_log_filter_indexes_default = `-- An index for the provider filter on \`
 CREATE INDEX idx_request_logs_provider ON request_logs (resolved_provider, at DESC, id DESC);
 `;
 
+// packages/store/src/postgres/migrations/006_model_window_index.sql
+var _006_model_window_index_default = `-- The per-model long-window reads behind a key's model overrides, on this
+-- backend: \`usage.sumSince\`, \`sumBuckets\` and \`oldestSince\` narrowed to one
+-- requested model, read from the log because \`usage_rollup\` has no model
+-- column. The SQLite copy is \`018_model_window_index.sql\`, same shape.
+--
+-- Without it the planner has no prefix to seek and the narrowed sums plan as a
+-- parallel sequential scan of the table. Measured at 500,000 rows in one key's
+-- week, a fifth of them the overridden model and a hundred rows of a rare one:
+--
+--   read                          without index    with index
+--   sumSince 1w, rare model             22.6ms         0.22ms
+--   sumSince 1w, 100k-row model         27.1ms         29.4ms
+--   sumBuckets 1w hour, rare            78.2ms         0.26ms
+--   sumBuckets 1w hour, 100k-row        89.4ms         55.5ms
+--   oldestSince 1w, rare                0.58ms         0.11ms
+--
+-- The heavy-model sum is a bitmap heap scan over that model's rows and does not
+-- beat the sequential scan it replaces: the cost is linear in the model's own
+-- traffic on either plan, and this index removes the part that was linear in
+-- everyone else's. 15MB at 500,000 rows, against 19MB for the key/time index.
+-- Neither partial nor covering, for the reasons the SQLite file records.
+CREATE INDEX idx_request_logs_key_model_at ON request_logs (api_key_id, requested_model, at);
+`;
+
 // packages/store/src/postgres/db.ts
 var num = (v) => Number(v);
 var numOrNull = (v) => v === null ? null : Number(v);
@@ -13251,7 +13322,8 @@ var MIGRATIONS = [
   { id: 2, sql: _002_health_measurements_default },
   { id: 3, sql: _003_key_expiry_default },
   { id: 4, sql: _004_log_keyset_default },
-  { id: 5, sql: _005_log_filter_indexes_default }
+  { id: 5, sql: _005_log_filter_indexes_default },
+  { id: 6, sql: _006_model_window_index_default }
 ];
 async function openPg(url) {
   const sql = new SQL({ url });
@@ -14604,6 +14676,24 @@ var sum = (row) => ({
   tokens: row === undefined ? 0 : num(row.tokens),
   costUsd: row === undefined ? 0 : row.cost_usd
 });
+var NARROWED_SQL = {
+  sumSince: `SELECT COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = $1 AND requested_model = $2 AND state = 'done' AND at >= $3`,
+  sumBuckets: `SELECT (at / $1) * $2 AS bucket, COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = $3 AND requested_model = $4 AND state = 'done' AND at >= $5
+            GROUP BY 1`,
+  oldestSince: `SELECT MIN(at) AS at
+                 FROM request_logs
+                WHERE api_key_id = $1 AND requested_model = $2 AND state = 'done' AND at >= $3`
+};
 function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
   const complete = async (conn, log) => {
     const written = (await conn.unsafe(COMPLETE, values(log, "done", nodeId))).count;
@@ -14661,7 +14751,15 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
                 ORDER BY at, id LIMIT $3`, [cursor.at, cursor.id, limit]);
       return rows.map(toLog);
     },
-    async sumSince(apiKeyId, sinceMs) {
+    async sumSince(apiKeyId, sinceMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const narrowed = await sql.unsafe(NARROWED_SQL.sumSince, [
+          apiKeyId,
+          requestedModel,
+          sinceMs
+        ]);
+        return sum(narrowed[0]);
+      }
       const boundary = hourOf(sinceMs);
       const whole = await sql.unsafe(`SELECT COALESCE(SUM(requests), 0) AS requests,
                 COALESCE(SUM(input_tokens + output_tokens
@@ -14683,7 +14781,18 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
         costUsd: a.costUsd + b.costUsd
       };
     },
-    async sumBuckets(apiKeyId, sinceMs, grainMs) {
+    async sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const from = grainMs === HOUR_MS ? hourOf(sinceMs) * HOUR_MS : sinceMs;
+        const narrowed = await sql.unsafe(NARROWED_SQL.sumBuckets, [
+          grainMs,
+          grainMs,
+          apiKeyId,
+          requestedModel,
+          from
+        ]);
+        return narrowed.map((row) => [num(row.bucket), sum(row)]);
+      }
       const rows = grainMs === HOUR_MS ? await sql.unsafe(`SELECT hour * ${HOUR_MS} AS bucket, requests,
                       input_tokens + output_tokens + cache_read_tokens + cache_write_tokens
                         AS tokens,
@@ -14704,10 +14813,14 @@ function createUsageRepo(sql, nodeId, dayOffsetMinutes) {
     async auditRollup() {
       return auditRollup2(sql);
     },
-    async oldestSince(apiKeyId, sinceMs) {
-      const row = (await sql.unsafe(`SELECT MIN(at) AS at
-             FROM request_logs
-            WHERE api_key_id = $1 AND state = 'done' AND at >= $2`, [apiKeyId, sinceMs]))[0];
+    async oldestSince(apiKeyId, sinceMs, requestedModel) {
+      const row = (requestedModel === undefined ? await sql.unsafe(`SELECT MIN(at) AS at
+                 FROM request_logs
+                WHERE api_key_id = $1 AND state = 'done' AND at >= $2`, [apiKeyId, sinceMs]) : await sql.unsafe(NARROWED_SQL.oldestSince, [
+        apiKeyId,
+        requestedModel,
+        sinceMs
+      ]))[0];
       return row === undefined ? null : numOrNull(row.at);
     },
     async aggregate(q) {
@@ -15989,6 +16102,42 @@ CREATE INDEX idx_request_logs_at
   ON request_logs (at DESC, id DESC, requested_model, resolved_model, error_code);
 `;
 
+// packages/store/src/sqlite/migrations/018_model_window_index.sql
+var _018_model_window_index_default = `-- An index for the per-model long-window reads behind a key's model overrides:
+-- \`usage.sumSince\`, \`sumBuckets\` and \`oldestSince\` narrowed to one requested
+-- model. \`usage_rollup\` has no model column, so those reads come from the log,
+-- and without this they walk \`idx_request_logs_key_at\` across the key's whole
+-- window and reject every other model's row one at a time. \`bun:sqlite\` is
+-- synchronous, so that walk is the event loop \u2014 and the console's key listing
+-- repeats it once per override per window on every fetch.
+--
+-- Key, then model, then time: one seek lands on one key's one model, and the
+-- window is a range from there. Measured at 500,000 rows in one key's week, a
+-- fifth of them the overridden model and a hundred rows of a rare one:
+--
+--   read                          without index    with index
+--   sumSince 1w, rare model             45.9ms         0.03ms
+--   sumSince 1w, 100k-row model         56.1ms         38.1ms
+--   sumBuckets 1w hour, rare            46.1ms         0.07ms
+--   sumBuckets 1w hour, 100k-row        76.8ms         58.9ms
+--   oldestSince 1w, rare                0.57ms         0.00ms
+--
+-- So the read stops costing the key's traffic and starts costing the model's
+-- own, which is still linear: a model that carries most of a key's traffic pays
+-- most of what it did before. That remaining cost is the design's, stated in
+-- \`ARCHITECTURE.md#rate-limiting\`, not something this index claims to remove.
+--
+-- Not partial on \`state = 'done'\`, and not covering, both measured. Partial
+-- bought nothing (37.4ms against 38.1ms) and, once \`ANALYZE\` had run, the
+-- planner moved the key-wide edge read onto it as a skip-scan over every model \u2014
+-- a plan that degrades with the number of models a key calls. Covering the four
+-- token columns and cost cut the heavy case to 9.0ms, for an index nearly three
+-- times as wide written on every completed request, and took the same key-wide
+-- plan. This shape leaves every key-wide read on \`idx_request_logs_key_at\`,
+-- which \`migrations.test.ts\` asserts beside the narrowed plans.
+CREATE INDEX idx_request_logs_key_model_at ON request_logs (api_key_id, requested_model, at);
+`;
+
 // packages/store/src/sqlite/db.ts
 var MIGRATIONS2 = [
   { id: 1, sql: _001_init_default2 },
@@ -16007,7 +16156,8 @@ var MIGRATIONS2 = [
   { id: 14, sql: _014_key_expiry_default },
   { id: 15, sql: _015_log_keyset_default },
   { id: 16, sql: _016_log_filter_indexes_default },
-  { id: 17, sql: _017_log_text_search_default }
+  { id: 17, sql: _017_log_text_search_default },
+  { id: 18, sql: _018_model_window_index_default }
 ];
 function statements(sql) {
   return sql.split(`
@@ -16451,6 +16601,24 @@ var COMPLETE2 = `INSERT INTO request_logs ${COLUMNS2} VALUES ${PLACEHOLDERS2}
     rtk_estimated_tokens_saved = excluded.rtk_estimated_tokens_saved,
     rtk_filters = excluded.rtk_filters
   WHERE request_logs.state = 'pending'`;
+var NARROWED_SQL2 = {
+  sumSince: `SELECT COUNT(*) AS requests,
+                    COALESCE(SUM(input_tokens + output_tokens
+                                 + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                    COALESCE(SUM(cost_usd), 0) AS cost_usd
+               FROM request_logs
+              WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?`,
+  sumBuckets: `SELECT (at / ?) * ? AS bucket, COUNT(*) AS requests,
+                    COALESCE(SUM(input_tokens + output_tokens
+                                 + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                    COALESCE(SUM(cost_usd), 0) AS cost_usd
+               FROM request_logs
+              WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?
+              GROUP BY bucket`,
+  oldestSince: `SELECT MIN(at) AS at
+                   FROM request_logs
+                  WHERE api_key_id = ? AND requested_model = ? AND state = 'done' AND at >= ?`
+};
 function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes()) {
   const complete = db.transaction((log) => {
     if (db.run(COMPLETE2, values2(log, "done", nodeId)).changes === 0)
@@ -16523,7 +16691,15 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
                   ORDER BY at, id LIMIT ?`).all(cursor.at, cursor.at, cursor.id, limit);
       return rows.map(toLog2);
     },
-    async sumSince(apiKeyId, sinceMs) {
+    async sumSince(apiKeyId, sinceMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const row = db.query(NARROWED_SQL2.sumSince).get(apiKeyId, requestedModel, sinceMs);
+        return {
+          requests: row?.requests ?? 0,
+          tokens: row?.tokens ?? 0,
+          costUsd: row?.cost_usd ?? 0
+        };
+      }
       const boundary = hourOf(sinceMs);
       const whole = db.query(`SELECT COALESCE(SUM(requests), 0) AS requests,
                   COALESCE(SUM(input_tokens + output_tokens
@@ -16543,7 +16719,15 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
         costUsd: (whole?.cost_usd ?? 0) + (edge?.cost_usd ?? 0)
       };
     },
-    async sumBuckets(apiKeyId, sinceMs, grainMs) {
+    async sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel) {
+      if (requestedModel !== undefined) {
+        const from = grainMs === HOUR_MS ? hourOf(sinceMs) * HOUR_MS : sinceMs;
+        const narrowed = db.query(NARROWED_SQL2.sumBuckets).all(grainMs, grainMs, apiKeyId, requestedModel, from);
+        return narrowed.map((row) => [
+          row.bucket,
+          { requests: row.requests, tokens: row.tokens, costUsd: row.cost_usd }
+        ]);
+      }
       const rows = grainMs === HOUR_MS ? db.query(`SELECT hour * ${HOUR_MS} AS bucket, requests,
                         input_tokens + output_tokens + cache_read_tokens + cache_write_tokens
                           AS tokens,
@@ -16567,10 +16751,10 @@ function createUsageRepo2(db, nodeId, dayOffsetMinutes = hostDayOffsetMinutes())
     async auditRollup() {
       return auditRollup(db);
     },
-    async oldestSince(apiKeyId, sinceMs) {
-      const row = db.query(`SELECT MIN(at) AS at
-             FROM request_logs
-            WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs);
+    async oldestSince(apiKeyId, sinceMs, requestedModel) {
+      const row = requestedModel === undefined ? db.query(`SELECT MIN(at) AS at
+                   FROM request_logs
+                  WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs) : db.query(NARROWED_SQL2.oldestSince).get(apiKeyId, requestedModel, sinceMs);
       return row?.at ?? null;
     },
     async aggregate(q) {
@@ -16711,9 +16895,9 @@ async function createStore(opts) {
       lastUsedByCredential: (credentialId) => handle.usage.lastUsedByCredential(credentialId),
       scan: (cursor, limit) => handle.usage.scan(cursor, limit),
       aggregate: (q) => handle.usage.aggregate(q),
-      sumSince: (apiKeyId, sinceMs) => handle.usage.sumSince(apiKeyId, sinceMs),
-      sumBuckets: (apiKeyId, sinceMs, grainMs) => handle.usage.sumBuckets(apiKeyId, sinceMs, grainMs),
-      oldestSince: (apiKeyId, sinceMs) => handle.usage.oldestSince(apiKeyId, sinceMs),
+      sumSince: (apiKeyId, sinceMs, requestedModel) => handle.usage.sumSince(apiKeyId, sinceMs, requestedModel),
+      sumBuckets: (apiKeyId, sinceMs, grainMs, requestedModel) => handle.usage.sumBuckets(apiKeyId, sinceMs, grainMs, requestedModel),
+      oldestSince: (apiKeyId, sinceMs, requestedModel) => handle.usage.oldestSince(apiKeyId, sinceMs, requestedModel),
       rebuildRollup: () => handle.usage.rebuildRollup(),
       auditRollup: () => handle.usage.auditRollup(),
       prune: (olderThan) => handle.usage.prune(olderThan),
@@ -17938,6 +18122,22 @@ function codecFailure(id, hook, what) {
     gatewayAuthored: true
   });
 }
+function framingAgrees(headers, body, bodyEncoding) {
+  const named = (name) => headers.filter(([n]) => n.toLowerCase() === name);
+  const lengths = named("content-length");
+  const encodings = named("content-encoding");
+  if (bodyEncoding !== undefined) {
+    return lengths.length === 0 && encodings.length === 1 && encodings[0]?.[1].trim().toLowerCase() === bodyEncoding;
+  }
+  if (lengths.length > 1 || encodings.length > 1)
+    return false;
+  const length = lengths[0]?.[1];
+  const bytes = new TextEncoder().encode(body).byteLength;
+  if (length !== undefined && length !== String(bytes))
+    return false;
+  const encoding = encodings[0]?.[1];
+  return encoding === undefined || encoding.trim().toLowerCase() === "identity";
+}
 function boundedDegradations(entries) {
   if (!Array.isArray(entries))
     return [];
@@ -17994,23 +18194,26 @@ function codecAdapter(id, capabilities, codec, origins) {
         fail,
         ...req.requestId === undefined ? {} : { requestId: req.requestId },
         ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache },
-        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens }
+        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens },
+        ...req.requestStartedAt === undefined ? {} : { requestStartedAt: req.requestStartedAt }
       }));
       const described = built?.request ?? {};
       const request = {
         url: described.url,
         method: described.method,
         headers: Array.isArray(described.headers) ? [...described.headers] : described.headers,
-        body: described.body
+        body: described.body,
+        bodyEncoding: described.bodyEncoding
       };
-      if (typeof request.body !== "string" || !isSendableUrl(request.url) || !isHttpMethod(request.method) || !Array.isArray(request.headers) || !request.headers.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string")) {
+      if (typeof request.body !== "string" || request.bodyEncoding !== undefined && request.bodyEncoding !== "zstd" || !isSendableUrl(request.url) || !isHttpMethod(request.method) || !Array.isArray(request.headers) || !request.headers.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string") || !framingAgrees(request.headers, request.body, request.bodyEncoding)) {
         throw codecFailure(id, "buildRequest", "did not return a usable request");
       }
       const sendable = {
         url: request.url,
         method: request.method,
         headers: request.headers,
-        body: request.body
+        body: request.body,
+        ...request.bodyEncoding === "zstd" ? { bodyEncoding: request.bodyEncoding } : {}
       };
       if (origins !== undefined && !withinOrigins(request.url, origins)) {
         throw codecFailure(id, "buildRequest", "described a request to an origin its manifest does not declare");
@@ -18368,53 +18571,61 @@ var museBodyOrder = [
 ];
 
 // packages/providers/src/openai/profile.ts
-var OPENAI_CLI_VERSION = env("OMNI_OPENAI_CLI_VERSION", "0.159.2");
+var OPENAI_CLI_VERSION = env("OMNI_OPENAI_CLI_VERSION", "0.163.0");
 var OPENAI_UA_PLATFORM = env("OMNI_OPENAI_UA_PLATFORM", "Windows 10.0.26200");
 var OPENAI_UA_ARCH = env("OMNI_OPENAI_UA_ARCH", "x86_64");
 var OPENAI_UA_TERMINAL = env("OMNI_OPENAI_UA_TERMINAL", "WindowsTerminal");
-var originator = env("OMNI_OPENAI_ORIGINATOR", "codex_cli_rs");
+var OPENAI_ORIGINATOR = env("OMNI_OPENAI_ORIGINATOR", "codex-tui");
+var OPENAI_SANDBOX = OPENAI_UA_PLATFORM.startsWith("Windows") ? "windows_elevated" : /^(Mac OS|macOS)/.test(OPENAI_UA_PLATFORM) ? "seatbelt" : "seccomp";
 var openaiProfile = {
   headers: [
     [
       "user-agent",
-      env("OMNI_UA_OPENAI", `${originator}/${OPENAI_CLI_VERSION} (${OPENAI_UA_PLATFORM}; ${OPENAI_UA_ARCH}) ${OPENAI_UA_TERMINAL}`)
+      env("OMNI_UA_OPENAI", `${OPENAI_ORIGINATOR}/${OPENAI_CLI_VERSION} (${OPENAI_UA_PLATFORM}; ${OPENAI_UA_ARCH}) ` + `${OPENAI_UA_TERMINAL} (${OPENAI_ORIGINATOR}; ${OPENAI_CLI_VERSION})`)
     ],
-    ["originator", originator],
+    ["originator", OPENAI_ORIGINATOR],
     ["version", OPENAI_CLI_VERSION],
     ["x-codex-beta-features", "remote_compaction_v2"],
     ["accept", "text/event-stream"]
   ],
   order: envOrder("OMNI_ORDER_OPENAI", [
-    "host",
     "version",
     "x-codex-beta-features",
-    "originator",
+    "x-codex-window-id",
+    "x-codex-turn-metadata",
+    "x-openai-internal-codex-responses-lite",
+    "x-codex-routing-hint",
     "x-client-request-id",
     "session-id",
     "thread-id",
     "accept",
+    "content-encoding",
     "content-type",
     "authorization",
     "chatgpt-account-id",
+    "originator",
     "user-agent",
-    "accept-encoding",
+    "host",
     "content-length"
   ])
 };
 var openaiBodyOrder = [
   "model",
   "stream",
+  "service_tier",
   "input",
   "instructions",
-  "store",
-  "reasoning",
-  "prompt_cache_key",
   "tools",
   "tool_choice",
+  "parallel_tool_calls",
+  "reasoning",
+  "store",
+  "stream_options",
   "include",
-  "service_tier",
+  "prompt_cache_key",
+  "text",
   "client_metadata",
-  "parallel_tool_calls",
+  "access_programs",
   "metadata"
 ];
 
@@ -22226,6 +22437,81 @@ function parseMuseUsage(value, now) {
   ]);
 }
 
+// packages/providers/src/openai/codexIdentity.ts
+import { createHash as createHash3, createHmac } from "crypto";
+var NAMESPACE_OID = "6ba7b812-9dad-11d1-80b4-00c04fd430c8";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var WINDOW_END_MS = Date.UTC(2026, 9, 1);
+var WINDOW_MS2 = 365 * 24 * 60 * 60 * 1000;
+function isUuid(value) {
+  return UUID.test(value);
+}
+function format(bytes) {
+  const hex = Buffer.from(bytes).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function withVersion(bytes, version) {
+  const out = Uint8Array.from(bytes.subarray(0, 16));
+  out[6] = (out[6] ?? 0) & 15 | version << 4;
+  out[8] = (out[8] ?? 0) & 63 | 128;
+  return out;
+}
+var sha256 = (seed) => createHash3("sha256").update(seed).digest();
+function uuidV5(namespace, name) {
+  const digest = createHash3("sha1").update(Buffer.from(namespace.replace(/-/g, ""), "hex")).update(name, "utf8").digest();
+  return format(withVersion(digest, 5));
+}
+function uuidV4From(seed) {
+  return format(withVersion(sha256(seed), 4));
+}
+function uuidV7From(seed, timestampMs) {
+  const bytes = Uint8Array.from(sha256(seed).subarray(0, 16));
+  let ts = Math.max(0, Math.floor(timestampMs));
+  for (let i = 5;i >= 0; i--) {
+    bytes[i] = ts % 256;
+    ts = Math.floor(ts / 256);
+  }
+  return format(withVersion(bytes, 7));
+}
+function threadIdFrom(seed) {
+  const digest = sha256(`thread:${seed}`);
+  const offset = digest.readUIntBE(0, 6) % WINDOW_MS2;
+  return uuidV7From(seed, WINDOW_END_MS - WINDOW_MS2 + offset);
+}
+function threadInstant(threadId, now) {
+  const hex = threadId.replace(/-/g, "");
+  const version = hex[12];
+  const ts = Number.parseInt(hex.slice(0, 12), 16);
+  if (version === "7" && Number.isFinite(ts) && ts <= now)
+    return ts;
+  const digest = sha256(`thread:${threadId}`);
+  return WINDOW_END_MS - WINDOW_MS2 + digest.readUIntBE(0, 6) % WINDOW_MS2;
+}
+var ID_SALT = /^[0-9a-f]{64}$/;
+function codexSecretsFrom(providerData) {
+  const { installationId, idSalt } = providerData;
+  return {
+    ...typeof installationId === "string" && isUuid(installationId) ? { installationId } : {},
+    ...typeof idSalt === "string" && ID_SALT.test(idSalt) ? { idSalt } : {}
+  };
+}
+function ensureCodexSecrets(providerData) {
+  const stored = codexSecretsFrom(providerData);
+  const salt = () => Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+  return {
+    installationId: stored.installationId ?? globalThis.crypto.randomUUID(),
+    idSalt: stored.idSalt ?? salt()
+  };
+}
+function keyed(salt, seed) {
+  if (salt === undefined)
+    return seed;
+  return createHmac("sha256", salt).update(seed).digest("hex");
+}
+function prefixNamespace(threadId) {
+  return uuidV5(NAMESPACE_OID, threadId);
+}
+
 // packages/providers/src/openai/oauth.ts
 var CLIENT_ID6 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL3 = "https://auth.openai.com/oauth/authorize";
@@ -22286,7 +22572,7 @@ async function* postToken4(body, fail) {
   }
   return token;
 }
-function toResult6(token, fallbackRefresh, now, fallbackAccountId = null) {
+function toResult6(token, fallbackRefresh, now, fallbackAccountId, prior) {
   const claims = decodeClaims(token.idToken);
   return {
     secrets: {
@@ -22297,7 +22583,10 @@ function toResult6(token, fallbackRefresh, now, fallbackAccountId = null) {
     },
     expiresAt: token.expiresIn === null ? null : now() + token.expiresIn * 1000,
     accountEmail: claims.email,
-    providerData: { accountId: claims.accountId ?? fallbackAccountId }
+    providerData: {
+      accountId: claims.accountId ?? fallbackAccountId,
+      ...ensureCodexSecrets(prior)
+    }
   };
 }
 function windowSecondsOf(value) {
@@ -22354,11 +22643,11 @@ var openaiOAuthFlow = {
     url.searchParams.set("id_token_add_organizations", "true");
     url.searchParams.set("codex_cli_simplified_flow", "true");
     url.searchParams.set("state", state);
-    url.searchParams.set("originator", "codex_cli_rs");
+    url.searchParams.set("originator", OPENAI_ORIGINATOR);
     url.searchParams.set("prompt", "login");
     return { authorizeUrl: url.toString(), pending: { verifier, challenge, state, redirectUri } };
   },
-  async* exchange({ code, pending, fail, now }) {
+  async* exchange({ code, pending, providerData, fail, now }) {
     const [rawCode, pastedState] = code.split("#");
     if (pastedState !== undefined && pastedState !== pending.state) {
       throw fail("AUTH", "authorization state mismatch");
@@ -22369,11 +22658,11 @@ var openaiOAuthFlow = {
       redirect_uri: pending.redirectUri,
       code_verifier: pending.verifier
     }, fail);
-    return toResult6(token, null, now);
+    return toResult6(token, null, now, null, providerData ?? {});
   },
   async* refresh({ refreshToken, providerData, fail, now }) {
     const token = yield* postToken4({ grant_type: "refresh_token", refresh_token: refreshToken, scope: SCOPES4 }, fail);
-    return toResult6(token, refreshToken, now, accountIdFromProviderData(providerData));
+    return toResult6(token, refreshToken, now, accountIdFromProviderData(providerData), providerData);
   },
   async* usage({ secrets, providerData, now }) {
     if (secrets.accessToken === null)
@@ -23123,7 +23412,7 @@ var customCodec = {
 // packages/providers/src/custom/index.ts
 var customAdapter = codecAdapter("custom", customDescriptor.capabilities, customCodec);
 // packages/providers/src/grok/codec.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // packages/providers/src/grok/decode.ts
 var ERROR_CODE2 = {
@@ -23322,7 +23611,7 @@ async function* decodeGrokResponses(messages) {
 }
 
 // packages/providers/src/grok/wire.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var MAX_TOOLS = 200;
 function encodeToolChoice3(c) {
   switch (c.type) {
@@ -23338,7 +23627,7 @@ function encodeToolChoice3(c) {
 }
 function promptCacheKey(instructions, firstInput) {
   const stable = JSON.stringify({ instructions, firstInput });
-  return createHash3("sha256").update(stable).digest("hex").slice(0, 32);
+  return createHash4("sha256").update(stable).digest("hex").slice(0, 32);
 }
 function toGrokWire(req, model) {
   const degradations = [];
@@ -23478,7 +23767,7 @@ var PROXY_URL = "https://cli-chat-proxy.grok.com/v1/responses";
 var API_URL = "https://api.x.ai/v1/responses";
 var CONV_NAMESPACE = "omni-grok-conv";
 function derivedUuid(value) {
-  const h = createHash4("sha256").update(`${CONV_NAMESPACE}:${value}`).digest("hex");
+  const h = createHash5("sha256").update(`${CONV_NAMESPACE}:${value}`).digest("hex");
   const variant = (Number.parseInt(h[16], 16) & 3 | 8).toString(16);
   return [
     h.slice(0, 8),
@@ -23538,11 +23827,12 @@ var grokAdapter = codecAdapter("grok", grokDescriptor.capabilities, grokCodec);
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { Readable } from "stream";
+import * as zlib from "zlib";
 var CONNECT_ATTEMPT_TIMEOUT_MS = 3000;
 function nodeHttpClient(options = {}) {
   const logger = options.logger ?? noopLogger;
   const now = options.now ?? (() => Date.now());
-  return (req) => new Promise((resolve, reject) => {
+  return (req) => encodeBody(req).then((bodyBytes) => new Promise((resolve, reject) => {
     const url = new URL(req.url);
     const startedAt = now();
     let traced = false;
@@ -23573,7 +23863,6 @@ function nodeHttpClient(options = {}) {
       });
     };
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
-    const bodyBytes = Buffer.from(req.body, "utf8");
     const headers = {};
     for (const [name, value] of req.headers)
       headers[name] = value;
@@ -23631,6 +23920,22 @@ function nodeHttpClient(options = {}) {
     if (bodyBytes.byteLength > 0)
       outgoing.write(bodyBytes);
     outgoing.end();
+  }));
+}
+function encodeBody(req) {
+  const raw = Buffer.from(req.body, "utf8");
+  if (req.bodyEncoding !== "zstd")
+    return Promise.resolve(raw);
+  return zstdEncode(raw);
+}
+function zstdEncode(raw, create = (options) => zlib.createZstdCompress(options)) {
+  return new Promise((resolve, reject) => {
+    const stream = create({ params: { [zlib.constants.ZSTD_c_compressionLevel]: 3 } });
+    const chunks = [];
+    stream.on("data", (chunk) => chunks.push(chunk));
+    stream.on("end", () => resolve(Buffer.concat(chunks)));
+    stream.on("error", reject);
+    stream.end(raw);
   });
 }
 function hasHeader(req, lowerName) {
@@ -24473,7 +24778,7 @@ async function* decodeMuseResponses(messages, options = {}) {
 }
 
 // packages/providers/src/muse/wire.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function suppliedKey(req) {
   const vendor = req.vendor?.openai;
   for (const name of ["prompt_cache_key", "session_id"]) {
@@ -24485,7 +24790,7 @@ function suppliedKey(req) {
 }
 function cacheKey(req, instructions, firstInput) {
   const stable = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
-  return createHash5("sha256").update(stable).digest("hex").slice(0, 32);
+  return createHash6("sha256").update(stable).digest("hex").slice(0, 32);
 }
 function repairOrphanedCalls(input) {
   const answered = new Set;
@@ -24685,6 +24990,49 @@ var museCodec = {
 
 // packages/providers/src/muse/index.ts
 var museAdapter = codecAdapter("muse", museDescriptor.capabilities, museCodec);
+// packages/providers/src/openai/codexCatalog.ts
+var CODEX_EFFORTS = new Set([
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+  "ultra",
+  "persistent"
+]);
+function isCodexEffort(value) {
+  return typeof value === "string" && CODEX_EFFORTS.has(value);
+}
+var entry = (defaultEffort, nodeReplAutoReviewRequired, over = {}) => ({
+  lite: true,
+  verbosity: "low",
+  defaultEffort,
+  lowestEffort: "low",
+  nodeReplAutoReviewRequired,
+  nodeReplDisabled: false,
+  supportsParallelToolCalls: true,
+  ...over
+});
+var UNLISTED = entry("low", false);
+var MODELS = Object.assign(Object.create(null), {
+  "gpt-6-astra": entry("low", true),
+  "gpt-6.1-sol": entry("low", true),
+  "gpt-6-sol": entry("medium", true),
+  "gpt-6-luna": entry("medium", false),
+  "gpt-5.6-sol": entry("low", false),
+  "gpt-5.6-terra": entry("medium", false),
+  "gpt-5.6-luna": entry("medium", false),
+  "gpt-daybreak-blue-latest": entry("low", false),
+  "gpt-daybreak-red-latest": entry("medium", false, { verbosity: "high" }),
+  "gpt-5.5": entry("medium", false, { lite: false }),
+  "codex-auto-review": entry("medium", false)
+});
+function codexModel(model) {
+  return MODELS[model] ?? UNLISTED;
+}
+
 // packages/providers/src/openai/decode.ts
 var ERROR_CODE4 = {
   rate_limit_exceeded: "RATE_LIMIT",
@@ -24716,6 +25064,7 @@ var KNOWN_EVENTS4 = new Set([
   "response.reasoning_text.done",
   "response.function_call_arguments.delta",
   "response.function_call_arguments.done",
+  "response.metadata",
   "response.completed",
   "response.incomplete",
   "response.failed",
@@ -24901,8 +25250,170 @@ async function* decodeResponses(messages, options = {}) {
   }
 }
 
+// packages/providers/src/openai/codexLite.ts
+var PASSTHROUGH = "internal_chat_message_metadata_passthrough";
+function turnId(threadId, index, threadAt, salt) {
+  return uuidV7From(keyed(salt, `${threadId}:turn:${index}`), threadAt + index);
+}
+function contentKinds(content, role) {
+  if (!Array.isArray(content))
+    return;
+  if (role === "assistant")
+    return content.map(() => "unknown");
+  const kinds = [];
+  for (const part of content) {
+    const type = part.type;
+    if (type === "input_text")
+      kinds.push("user.text");
+    else if (type === "input_image")
+      kinds.push("user.image");
+    else
+      return;
+  }
+  return kinds;
+}
+function toLiteInput(args) {
+  const { threadId } = args;
+  const threadAt = threadInstant(threadId, args.startedAt ?? Number.POSITIVE_INFINITY);
+  const startedAt = args.startedAt ?? threadAt;
+  const historySeed = args.requestId ?? threadId;
+  const salt = args.idSalt;
+  const namespace = prefixNamespace(threadId);
+  const prefix = [];
+  if (args.tools !== undefined && args.tools.length > 0) {
+    const tools = [{ type: "namespace", name: "functions", description: "", tools: args.tools }];
+    prefix.push({
+      type: "additional_tools",
+      id: `at_${uuidV5(namespace, JSON.stringify(tools))}`,
+      role: "developer",
+      tools
+    });
+  }
+  if (args.instructions !== undefined && args.instructions.length > 0) {
+    prefix.push({
+      type: "message",
+      id: `msg_${uuidV5(namespace, args.instructions)}`,
+      role: "developer",
+      content: [{ type: "input_text", text: args.instructions }],
+      [PASSTHROUGH]: { content_item_kinds: ["model.base_instructions"] }
+    });
+  }
+  let turn = 0;
+  const history = args.input.map((raw, index) => {
+    const item = raw;
+    turn = args.turnOf.get(item) ?? turn;
+    const turn_id = turnId(threadId, turn, threadAt, salt);
+    const fresh = (prefixName) => `${prefixName}_${uuidV7From(keyed(salt, `${historySeed}:item:${index}`), startedAt)}`;
+    const create_time = (startedAt * 1000 + index) / 1e6;
+    switch (item.type) {
+      case "message": {
+        const role = String(item.role);
+        const kinds = contentKinds(item.content, role);
+        if (role === "assistant") {
+          return {
+            type: "message",
+            status: "completed",
+            id: fresh("msg"),
+            role,
+            content: Array.isArray(item.content) ? item.content.map((part) => part.type === "output_text" ? { ...part, annotations: [] } : part) : item.content,
+            [PASSTHROUGH]: {
+              turn_id,
+              ...kinds === undefined ? {} : { content_item_kinds: kinds }
+            }
+          };
+        }
+        return {
+          type: "message",
+          id: fresh("msg"),
+          role,
+          content: item.content,
+          [PASSTHROUGH]: {
+            turn_id,
+            create_time,
+            ...kinds === undefined ? {} : { content_item_kinds: kinds }
+          }
+        };
+      }
+      case "function_call":
+        return {
+          type: "function_call",
+          status: "completed",
+          id: fresh("fc"),
+          name: item.name,
+          arguments: item.arguments,
+          call_id: item.call_id,
+          [PASSTHROUGH]: { turn_id }
+        };
+      case "function_call_output":
+        return {
+          type: "function_call_output",
+          id: fresh("fco"),
+          call_id: item.call_id,
+          output: item.output,
+          [PASSTHROUGH]: { turn_id, create_time }
+        };
+      case "reasoning": {
+        const { [PASSTHROUGH]: _client, ...rest } = item;
+        return { ...rest, [PASSTHROUGH]: { turn_id } };
+      }
+      default:
+        return item;
+    }
+  });
+  return {
+    input: [...prefix, ...history],
+    turnId: turnId(threadId, turn, threadAt, salt),
+    startedAt
+  };
+}
+function asciiJson(value) {
+  return JSON.stringify(value).replace(/[^\x20-\x7e]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function codexTurn(args) {
+  const { threadId, turnId: turn } = args;
+  const windowId = `${threadId}:0`;
+  const installationId = args.installationId ?? uuidV4From(`installation:${args.installationSeed}`);
+  const threadAt = threadInstant(threadId, args.startedAt);
+  const catalog = codexModel(args.model);
+  const turnMetadata = asciiJson({
+    installation_id: installationId,
+    session_id: threadId,
+    thread_id: threadId,
+    agent_name: "/root",
+    turn_id: turn,
+    window_id: windowId,
+    window_number: 0,
+    context_window_id: uuidV7From(keyed(args.idSalt, `${threadId}:context-window`), threadAt),
+    request_kind: "turn",
+    history_initialization: "new",
+    root_turn_id: turn,
+    thread_source: "user",
+    turn_trigger: "user",
+    sandbox: OPENAI_SANDBOX,
+    sandbox_mode: "workspace-write",
+    auto_review_enabled: false,
+    node_repl_auto_review_required: catalog.nodeReplAutoReviewRequired,
+    node_repl_disabled: catalog.nodeReplDisabled,
+    turn_started_at_unix_ms: args.startedAt,
+    analytics_enabled: false,
+    model: args.model,
+    reasoning_effort: args.effort
+  });
+  const clientMetadata = {
+    turn_id: turn,
+    thread_id: threadId,
+    "x-codex-turn-metadata": turnMetadata,
+    mcp_attribution: '{"status":"none"}',
+    guardian_credits_requested: "true",
+    "x-codex-installation-id": installationId,
+    "x-codex-window-id": windowId,
+    root_turn_id: turn,
+    session_id: threadId
+  };
+  return { windowId, turnMetadata, clientMetadata };
+}
+
 // packages/providers/src/openai/wire.ts
-import { createHash as createHash6 } from "crypto";
 var MAX_CACHE_KEY_LENGTH = 1024;
 var HEADER_SAFE_KEY = /^[\x21-\x7e]+$/;
 function suppliedKey2(req) {
@@ -24914,9 +25425,16 @@ function suppliedKey2(req) {
   }
   return;
 }
-function cacheKey2(req, instructions, firstInput) {
-  const stable = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
-  return createHash6("sha256").update(stable).digest("hex").slice(0, 32);
+function cacheKey2(req, instructions, firstInput, salt) {
+  const supplied = suppliedKey2(req);
+  if (supplied !== undefined) {
+    if (isUuid(supplied))
+      return { key: supplied, seed: supplied };
+    const seed = JSON.stringify({ key: supplied });
+    return { key: threadIdFrom(keyed(salt, seed)), seed };
+  }
+  const seed = req.conversationId !== undefined && req.conversationId.length > 0 ? JSON.stringify({ conversation: req.conversationId }) : JSON.stringify({ instructions, firstInput: firstInput ?? null });
+  return { key: threadIdFrom(keyed(salt, seed)), seed };
 }
 function repairOrphanedCalls2(input) {
   const answered = new Set;
@@ -24947,6 +25465,44 @@ function encodeToolChoice7(c) {
       return { type: "function", name: c.name };
   }
 }
+function codexReasoning(req, model, note) {
+  const catalog = codexModel(model);
+  const context = catalog.lite ? { context: "all_turns" } : {};
+  const r = req.reasoning;
+  if (r === undefined)
+    return { effort: catalog.defaultEffort, ...context };
+  if (r.mode === "off") {
+    note("openai:reasoning-off-as-lowest");
+    return { effort: catalog.lowestEffort, ...context };
+  }
+  if (r.mode === "betweenTools")
+    return { effort: catalog.lowestEffort, ...context };
+  if (r.mode === "budget") {
+    note("openai:reasoning-budget-dropped");
+    return { effort: catalog.defaultEffort, ...context };
+  }
+  return {
+    effort: r.effort ?? catalog.defaultEffort,
+    ...r.display === "omitted" || r.display === "updates" ? {} : { summary: "auto" },
+    ...context
+  };
+}
+var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function mergeCodexVendor(body, vendor, note) {
+  const target = body;
+  for (const [name, value] of Object.entries(vendor)) {
+    if (name === "client_metadata") {
+      note("openai:client-metadata-replaced");
+      continue;
+    }
+    const ours = target[name];
+    if ((name === "text" || name === "reasoning") && isRecord8(ours) && isRecord8(value)) {
+      target[name] = { ...ours, ...value };
+      continue;
+    }
+    target[name] = value;
+  }
+}
 function toResponsesWire(req, model, opts = { oauth: false }) {
   const degradations = [];
   const input = [];
@@ -24954,6 +25510,12 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     if (!degradations.includes(d))
       degradations.push(d);
   };
+  const turnOf = new WeakMap;
+  let turn = -1;
+  const push = (item) => {
+    input.push(item);
+    turnOf.set(item, Math.max(0, turn));
+  };
   if (req.betas?.includes(CONTEXT_1M_BETA))
     note("openai:context-1m-dropped");
   for (const message of req.messages) {
@@ -24965,10 +25527,15 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     const flush = () => {
       if (parts.length === 0)
         return;
-      input.push({ type: "message", role, content: [...parts] });
+      push({ type: "message", role, content: [...parts] });
       parts.length = 0;
     };
+    let opened = false;
     for (const block of message.content) {
+      if (message.role === "user" && !opened && block.type !== "toolResult") {
+        opened = true;
+        turn++;
+      }
       switch (block.type) {
         case "text":
           parts.push({
@@ -24989,7 +25556,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
           break;
         case "toolUse":
           flush();
-          input.push({
+          push({
             type: "function_call",
             call_id: block.id,
             name: block.name,
@@ -25001,7 +25568,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
             note("openai:anthropic-native-block-dropped");
           flush();
           const files = responsesFiles(block.files ?? []);
-          input.push({
+          push({
             type: "function_call_output",
             call_id: block.toolUseId,
             output: withFileText(block.content, files.text)
@@ -25029,7 +25596,7 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
           if (block.provider === "openai") {
             flush();
             const { id: _id, ...rest } = block.data;
-            input.push({ type: block.blockType, ...rest });
+            push({ type: block.blockType, ...rest });
             break;
           }
           note("openai:anthropic-native-block-dropped");
@@ -25041,8 +25608,10 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
   repairOrphanedCalls2(input);
   const body = { model, input, stream: req.stream, store: false };
   const instructions = systemText(req.system, "openai", note);
-  if (instructions !== undefined && instructions.length > 0)
+  const lite = opts.oauth && codexModel(model).lite;
+  if (instructions !== undefined && instructions.length > 0 && !opts.oauth) {
     body.instructions = instructions;
+  }
   if (req.maxTokens !== undefined) {
     if (opts.oauth)
       note("openai:max-tokens-dropped");
@@ -25055,22 +25624,45 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
     else
       body.temperature = req.temperature;
   }
+  let liteTools;
   if (req.tools !== undefined) {
     const custom = req.tools.filter((t) => t.kind === "portable");
     if (custom.length !== req.tools.length)
       note("openai:anthropic-tool-dropped");
-    body.tools = custom.map((t) => ({
-      type: "function",
-      name: t.name,
-      description: t.description,
-      parameters: t.inputSchema
-    }));
+    if (opts.oauth) {
+      const tools = custom.map((t) => ({
+        type: "function",
+        name: t.name,
+        description: t.description,
+        strict: false,
+        parameters: t.inputSchema
+      }));
+      if (lite)
+        liteTools = tools;
+      else
+        body.tools = tools;
+    } else {
+      body.tools = custom.map((t) => ({
+        type: "function",
+        name: t.name,
+        description: t.description,
+        parameters: t.inputSchema
+      }));
+    }
   }
   if (req.toolChoice !== undefined)
     body.tool_choice = encodeToolChoice7(req.toolChoice);
-  if (req.reasoning?.mode === "betweenTools")
-    degradations.push("openai:reasoning-between-tools-as-off");
-  if (req.reasoning !== undefined && req.reasoning.mode !== "off" && req.reasoning.mode !== "betweenTools") {
+  else if (opts.oauth)
+    body.tool_choice = "auto";
+  if (opts.oauth) {
+    body.parallel_tool_calls = !lite && codexModel(model).supportsParallelToolCalls;
+  }
+  if (req.reasoning?.mode === "betweenTools") {
+    note(opts.oauth ? "openai:reasoning-between-tools-as-lowest" : "openai:reasoning-between-tools-as-off");
+  }
+  if (opts.oauth) {
+    body.reasoning = codexReasoning(req, model, note);
+  } else if (req.reasoning !== undefined && req.reasoning.mode !== "off" && req.reasoning.mode !== "betweenTools") {
     if (req.reasoning.mode === "budget") {
       degradations.push("openai:reasoning-budget-dropped");
     } else {
@@ -25081,36 +25673,98 @@ function toResponsesWire(req, model, opts = { oauth: false }) {
       };
     }
   }
-  const key = suppliedKey2(req) ?? cacheKey2(req, instructions ?? "", input[0]);
-  Object.assign(body, req.vendor?.openai ?? {});
+  const salt = opts.oauth ? opts.idSalt : undefined;
+  const { key, seed } = cacheKey2(req, instructions ?? "", input[0], salt);
+  if (opts.oauth) {
+    body.include = ["reasoning.encrypted_content"];
+    body.text = { verbosity: codexModel(model).verbosity };
+    mergeCodexVendor(body, req.vendor?.openai ?? {}, note);
+  } else {
+    Object.assign(body, req.vendor?.openai ?? {});
+  }
   const moved = moveToResponsesText(req, body, "openai");
   if (moved !== undefined)
     note(moved);
   body.prompt_cache_key = key;
-  return { body, degradations, cacheKey: key };
+  if (!opts.oauth)
+    return { body, degradations, cacheKey: key };
+  const built = toLiteInput({
+    threadId: key,
+    input,
+    turnOf,
+    tools: liteTools,
+    instructions,
+    requestId: opts.requestId,
+    startedAt: opts.startedAt,
+    idSalt: salt
+  });
+  body.input = built.input;
+  const sent = body.reasoning?.effort;
+  const codex = codexTurn({
+    threadId: key,
+    turnId: built.turnId,
+    installationId: opts.installationId,
+    installationSeed: opts.accountId ?? seed,
+    idSalt: salt,
+    model,
+    effort: isCodexEffort(sent) ? sent : codexModel(model).defaultEffort,
+    startedAt: built.startedAt
+  });
+  body.client_metadata = codex.clientMetadata;
+  return { body, degradations, cacheKey: key, codex };
 }
 
 // packages/providers/src/openai/codec.ts
 var OAUTH_URL2 = "https://chatgpt.com/backend-api/codex/responses";
 var API_URL3 = "https://api.openai.com/v1/responses";
+var HEADER_SAFE = /^[\x21-\x7e]+$/;
+function routingHint(model, tier) {
+  if (!HEADER_SAFE.test(model))
+    return;
+  if (typeof tier === "string" && HEADER_SAFE.test(tier) && !tier.includes(";")) {
+    return `model=${model};tier=${tier}`;
+  }
+  return `model=${model}`;
+}
 var openaiCodec = {
   buildRequest(input) {
     const oauth = input.credentials.accessToken !== null;
-    const { body, degradations, cacheKey } = toResponsesWire(input.request, input.model, { oauth });
-    const protocol = [["content-type", "application/json"]];
+    const accountId = input.credentials.providerData.accountId;
+    const secrets = oauth ? codexSecretsFrom(input.credentials.providerData) : {};
+    const { body, degradations, cacheKey, codex } = toResponsesWire(input.request, input.model, {
+      oauth,
+      requestId: input.requestId,
+      startedAt: input.requestStartedAt,
+      accountId: typeof accountId === "string" ? accountId : undefined,
+      installationId: secrets.installationId,
+      idSalt: secrets.idSalt
+    });
+    const protocol = [];
+    if (codex !== undefined) {
+      protocol.push(["x-codex-window-id", codex.windowId], ["x-codex-turn-metadata", codex.turnMetadata]);
+      if (codexModel(input.model).lite) {
+        protocol.push(["x-openai-internal-codex-responses-lite", "true"]);
+      }
+      const hint = routingHint(input.model, body.service_tier);
+      if (hint !== undefined)
+        protocol.push(["x-codex-routing-hint", hint]);
+    }
+    protocol.push(["x-client-request-id", cacheKey], ["session-id", cacheKey], ["thread-id", cacheKey]);
+    if (oauth)
+      protocol.push(["content-encoding", "zstd"]);
+    protocol.push(["content-type", "application/json"]);
     if (oauth) {
       protocol.push(["authorization", `Bearer ${input.credentials.accessToken}`]);
-      const accountId = input.credentials.providerData.accountId;
       if (typeof accountId === "string")
         protocol.push(["chatgpt-account-id", accountId]);
+      protocol.push(["host", "chatgpt.com"]);
     } else if (input.credentials.apiKey !== null) {
       protocol.push(["authorization", `Bearer ${input.credentials.apiKey}`]);
     } else {
       throw input.fail("AUTH", "openai credential has no token");
     }
-    protocol.push(["x-client-request-id", cacheKey], ["session-id", cacheKey], ["thread-id", cacheKey]);
     const headers = orderHeaders(mergeHeaders(openaiProfile.headers, protocol), openaiProfile.order);
-    const include = body.include;
+    const include = input.request.vendor?.openai?.include;
     const nativeReasoning = Array.isArray(include) && include.includes("reasoning.encrypted_content");
     return {
       decodeState: { nativeReasoning },
@@ -25118,7 +25772,8 @@ var openaiCodec = {
         url: oauth ? OAUTH_URL2 : API_URL3,
         method: "POST",
         headers,
-        body: JSON.stringify(orderFields({ ...body, stream: true }, openaiBodyOrder))
+        body: JSON.stringify(orderFields({ ...body, stream: true }, openaiBodyOrder)),
+        ...oauth ? { bodyEncoding: "zstd" } : {}
       },
       degradations
     };
@@ -25217,11 +25872,17 @@ function createConnectFlows(deps) {
     const provider = deps.providers[flow.provider];
     if (provider === undefined)
       throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
-    const result = await provider.exchange({ code, pending: flow.pending }, { http: deps.http, now: deps.now });
+    const existing = flow.credentialId === undefined ? null : await deps.store.credentials.get(flow.credentialId);
+    if (flow.credentialId !== undefined && existing === null) {
+      throw new GatewayError("BAD_REQUEST", "credential not found");
+    }
+    const prior = existing !== null && existing.provider === flow.provider ? existing.providerData : undefined;
+    const result = await provider.exchange({
+      code,
+      pending: flow.pending,
+      ...prior === undefined ? {} : { providerData: prior }
+    }, { http: deps.http, now: deps.now });
     if (flow.credentialId !== undefined) {
-      const existing = await deps.store.credentials.get(flow.credentialId);
-      if (existing === null)
-        throw new GatewayError("BAD_REQUEST", "credential not found");
       await deps.store.credentials.updateSecrets(flow.credentialId, result.secrets, result.expiresAt);
       await deps.store.credentials.update(flow.credentialId, {
         enabled: true,
@@ -26552,9 +27213,20 @@ function configuredWindows(limits) {
 async function readLimitUsage(store, id, limits, now) {
   if (limits === null)
     return [];
+  const readings = await readScope(store, id, limits, null, now);
+  for (const model of Object.keys(limits.models ?? {})) {
+    const override = modelOverride(limits, model);
+    if (override === undefined)
+      continue;
+    readings.push(...await readScope(store, id, override, model, now));
+  }
+  return readings;
+}
+async function readScope(store, id, limits, model, now) {
   const sums = new Map;
   for (const window2 of configuredWindows(limits)) {
-    sums.set(window2, await store.usage.sumSince(id, now - WINDOW_MS[window2]));
+    const since = now - WINDOW_MS[window2];
+    sums.set(window2, await store.usage.sumSince(id, since, model ?? undefined));
   }
   const readings = [];
   for (const dimension of ["requests", "tokens", "spend"]) {
@@ -26567,7 +27239,7 @@ async function readLimitUsage(store, id, limits, now) {
         continue;
       const sum = sums.get(window2);
       const used = sum === undefined ? null : dimension === "requests" ? sum.requests : dimension === "tokens" ? sum.tokens : sum.costUsd;
-      readings.push({ dimension, window: window2, limit, used });
+      readings.push({ dimension, window: window2, limit, used, model });
     }
   }
   if (limits.concurrency !== undefined && limits.concurrency !== null) {
@@ -26575,7 +27247,8 @@ async function readLimitUsage(store, id, limits, now) {
       dimension: "concurrency",
       window: null,
       limit: limits.concurrency,
-      used: null
+      used: null,
+      model
     });
   }
   return readings;
@@ -27549,7 +28222,7 @@ function createRefresher(deps) {
   };
 }
 // packages/control/src/pluginProviders.ts
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNumber(value) {
@@ -27560,7 +28233,7 @@ function checkAt(ok, id, path, expected) {
     throw new Error(`provider ${id} descriptor: ${path} must be ${expected}`);
 }
 function checkLimits(id, path, value) {
-  checkAt(isRecord8(value), id, path, "an object");
+  checkAt(isRecord9(value), id, path, "an object");
   const limits = value;
   checkAt(isNumber(limits.contextWindow), id, `${path}.contextWindow`, "a finite number");
   checkAt(isNumber(limits.maxOutputTokens), id, `${path}.maxOutputTokens`, "a finite number");
@@ -27578,19 +28251,19 @@ function checkDescriptor(id, record) {
     }
   }
   const capabilities = record.capabilities;
-  checkAt(isRecord8(capabilities), id, "capabilities", "an object");
+  checkAt(isRecord9(capabilities), id, "capabilities", "an object");
   for (const flag of ["tools", "images", "reasoning"]) {
     const value = capabilities[flag];
     checkAt(typeof value === "boolean", id, `capabilities.${flag}`, "a boolean");
   }
   const write = record.writeOverInput;
-  checkAt(isRecord8(write), id, "writeOverInput", "an object");
+  checkAt(isRecord9(write), id, "writeOverInput", "an object");
   for (const ttl of ["fiveMinute", "oneHour"]) {
     const value = write[ttl];
     checkAt(isNumber(value), id, `writeOverInput.${ttl}`, "a finite number");
   }
   const catalog = record.catalog;
-  checkAt(isRecord8(catalog), id, "catalog", "an object");
+  checkAt(isRecord9(catalog), id, "catalog", "an object");
   const entry = catalog;
   checkAt(typeof entry.defaultModel === "string", id, "catalog.defaultModel", "a string");
   checkAt(Array.isArray(entry.authTypes), id, "catalog.authTypes", "an array");
@@ -27601,11 +28274,11 @@ function checkDescriptor(id, record) {
   checkAt(Array.isArray(entry.models), id, "catalog.models", "an array");
   for (const [index, model] of entry.models.entries()) {
     const at = `catalog.models[${index}]`;
-    checkAt(isRecord8(model), id, at, "an object");
+    checkAt(isRecord9(model), id, at, "an object");
     const choice = model;
     checkAt(typeof choice.id === "string", id, `${at}.id`, "a string");
     checkAt(typeof choice.label === "string", id, `${at}.label`, "a string");
-    checkAt(isRecord8(choice.pricing), id, `${at}.pricing`, "an object");
+    checkAt(isRecord9(choice.pricing), id, `${at}.pricing`, "an object");
     const pricing = choice.pricing;
     for (const field of ["input", "output", "cacheRead", "cacheWrite5m", "cacheWrite1h"]) {
       checkAt(isNumber(pricing[field]), id, `${at}.pricing.${field}`, "a finite number");
@@ -27621,13 +28294,13 @@ function checkDescriptor(id, record) {
     checkAt(typeof prefix === "string", id, `modelPrefixes[${index}]`, "a string");
   }
   const presentation = record.presentation;
-  checkAt(isRecord8(presentation), id, "presentation", "an object");
+  checkAt(isRecord9(presentation), id, "presentation", "an object");
   const shown = presentation;
   for (const field of ["label", "tone"]) {
     checkAt(typeof shown[field] === "string", id, `presentation.${field}`, "a string");
   }
   checkAt(isNumber(shown.order), id, "presentation.order", "a finite number");
-  checkAt(isRecord8(shown.colour), id, "presentation.colour", "an object");
+  checkAt(isRecord9(shown.colour), id, "presentation.colour", "an object");
   for (const scheme of ["light", "dark"]) {
     const value = shown.colour[scheme];
     checkAt(typeof value === "string", id, `presentation.colour.${scheme}`, "a string");
@@ -27639,7 +28312,7 @@ function checkDescriptor(id, record) {
 function validateOAuthFlow(id, value) {
   if (value === undefined)
     return;
-  if (!isRecord8(value))
+  if (!isRecord9(value))
     throw new Error(`provider ${id} oauth must be an object`);
   const kind = value.kind;
   if (kind !== "pkce" && kind !== "device") {
@@ -28296,7 +28969,7 @@ function readFrom(path, offset) {
   }
 }
 // packages/plugin-api/src/events.ts
-var WINDOW_MS2 = {
+var WINDOW_MS3 = {
   "1m": 60000,
   "5h": 5 * 60 * 60 * 1000,
   "1w": 7 * 24 * 60 * 60 * 1000
@@ -41647,8 +42320,26 @@ var SEED_LOCK_MS = 5000;
 var GAUGE_TTL_MS = 300000;
 var RENEW_INTERVAL_MS = 1e5;
 var MAX_RENEWED_MS = 86400000;
-function bucketKey(keyId, window2) {
-  return `lim:${keyId}:${window2}`;
+function bucketKey(subject, window2) {
+  return `lim:${subject}:${window2}`;
+}
+function modelSubjectId(keyId, model) {
+  return `${keyId}/m/${encodeURIComponent(model)}`;
+}
+function keyWide(limits) {
+  const { models: _models, ...base } = limits;
+  return base;
+}
+function subjectsOf(keyId, limits, model) {
+  const subjects = [];
+  const base = keyWide(limits);
+  if (anyLimit(base))
+    subjects.push({ id: keyId, keyId, model: undefined, limits: base });
+  const override = modelOverride(limits, model);
+  if (override !== undefined) {
+    subjects.push({ id: modelSubjectId(keyId, model), keyId, model, limits: override });
+  }
+  return subjects;
 }
 
 class RateLimitExceeded extends GatewayError {
@@ -41703,27 +42394,31 @@ class ApiKeyRateLimiter {
     this.coord = deps.coord ?? memoryCoord();
     this.onRejected = deps.onRejected;
   }
-  async admit(keyId, limits, requestId) {
-    if (!anyLimit(limits))
+  async admit(keyId, limits, model, requestId) {
+    const subjects = subjectsOf(keyId, limits, model);
+    if (subjects.length === 0)
       return { release: () => {}, renew: async () => {}, headroom: {} };
     const now = this.now();
-    this.limits.set(keyId, limits);
-    const holder = configured(limits.concurrency) ? crypto.randomUUID() : undefined;
-    const claim = await this.claim(keyId, now, true, holder);
+    const claims = [];
     let admitted = false;
     try {
-      const counters = await this.counters(keyId, limits, claim, now, requestId);
-      const decision = evaluate(limits, counters, now);
-      await this.refuse(keyId, decision, now, requestId);
+      for (const subject of subjects) {
+        this.limits.set(subject.id, subject.limits);
+        const holder = configured(subject.limits.concurrency) ? crypto.randomUUID() : undefined;
+        claims.push(await this.claim(subject.id, now, true, holder));
+      }
+      const decision = await this.judge(subjects, claims, (scope) => scope, now, requestId);
       admitted = true;
+      const held = claims.flatMap((claim) => claim.holder === undefined ? [] : [{ subject: claim.subject, holder: claim.holder }]);
       let released = false;
       const renewUntil = now + MAX_RENEWED_MS;
       const renew = async () => {
-        if (released || holder === undefined)
+        if (released)
           return;
-        await this.coord.gauge.renew(keyId, holder, GAUGE_TTL_MS);
+        for (const slot of held)
+          await this.coord.gauge.renew(slot.subject, slot.holder, GAUGE_TTL_MS);
       };
-      const renewal = holder === undefined ? null : setInterval(() => {
+      const renewal = held.length === 0 ? null : setInterval(() => {
         if (this.now() >= renewUntil) {
           clearInterval(renewal ?? undefined);
           return;
@@ -41737,91 +42432,153 @@ class ApiKeyRateLimiter {
         released = true;
         if (renewal !== null)
           clearInterval(renewal);
-        this.coord.gauge.release(keyId, holder);
+        for (const claim of claims)
+          this.coord.gauge.release(claim.subject, claim.holder);
       };
       return { release, renew, headroom: decision.headroom };
     } finally {
       if (!admitted)
-        await this.rollback(keyId, claim);
+        for (const claim of claims)
+          await this.rollback(claim);
     }
   }
-  async consume(keyId, limits, requestId) {
-    const requests = limits.requests;
-    if (requests === undefined || !anyRequestLimit(limits))
+  async consume(keyId, limits, model, requestId) {
+    const subjects = subjectsOf(keyId, limits, model).filter((subject) => anyRequestLimit(subject.limits));
+    if (subjects.length === 0)
       return;
     const now = this.now();
-    this.limits.set(keyId, limits);
-    const claim = await this.claim(keyId, now, false);
+    const claims = [];
     let consumed = false;
     try {
-      const counters = await this.counters(keyId, { requests }, claim, now, requestId);
-      await this.refuse(keyId, evaluate({ requests }, counters, now), now, requestId);
+      for (const subject of subjects) {
+        this.limits.set(subject.id, subject.limits);
+        claims.push(await this.claim(subject.id, now, false));
+      }
+      await this.judge(subjects, claims, requestsOnly, now, requestId);
       consumed = true;
     } finally {
       if (!consumed)
-        await this.rollback(keyId, claim);
+        for (const claim of claims)
+          await this.rollback(claim);
+    }
+  }
+  async judge(subjects, claims, scope, now, requestId) {
+    const decisions = [];
+    for (const [index, subject] of subjects.entries()) {
+      const claim = claims[index];
+      if (claim === undefined)
+        throw new Error("rate limit claim missing for a subject");
+      const limits = scope(subject.limits);
+      const counters = await this.counters(subject, limits, claim, now, requestId);
+      decisions.push(evaluate(limits, counters, now));
+    }
+    const decision = combineAll(decisions);
+    if (decision.violation !== null)
+      await this.refuse(subjects, decisions, now, requestId);
+    return decision;
+  }
+  async claim(subject, now, gauge, holder) {
+    const ring = await this.coord.window.claim(subject, WINDOW_MS["1m"], now);
+    let concurrency;
+    try {
+      concurrency = gauge ? await this.coord.gauge.acquire(subject, GAUGE_TTL_MS, holder) : await this.coord.gauge.read(subject);
+    } catch (error) {
+      await this.coord.window.rollback(subject, ring.stamp);
+      throw error;
     }
+    return {
+      subject,
+      stamp: ring.stamp,
+      gauge,
+      holder,
+      before: { requests: ring.before, concurrency }
+    };
   }
-  async claim(keyId, now, gauge, holder) {
-    const ring = await this.coord.window.claim(keyId, WINDOW_MS["1m"], now);
-    const concurrency = gauge ? await this.coord.gauge.acquire(keyId, GAUGE_TTL_MS, holder) : await this.coord.gauge.read(keyId);
-    return { stamp: ring.stamp, gauge, holder, before: { requests: ring.before, concurrency } };
-  }
-  async rollback(keyId, claim) {
-    await this.coord.window.rollback(keyId, claim.stamp);
+  async rollback(claim) {
+    await this.coord.window.rollback(claim.subject, claim.stamp);
     if (claim.gauge)
-      await this.coord.gauge.release(keyId, claim.holder);
+      await this.coord.gauge.release(claim.subject, claim.holder);
   }
-  debit(keyId, usage) {
-    const limits = this.limits.get(keyId);
+  debit(keyId, requestedModel, usage) {
+    const delta = { requests: 1, tokens: usage.tokens, costUsd: usage.costUsd };
+    this.debitSubject(keyId, delta);
+    this.debitSubject(modelSubjectId(keyId, requestedModel), delta);
+  }
+  debitSubject(subject, delta) {
+    const limits = this.limits.get(subject);
     if (limits === undefined || !anyLongLimit(limits))
       return;
     const now = this.now();
-    const delta = { requests: 1, tokens: usage.tokens, costUsd: usage.costUsd };
     for (const window2 of LONG_WINDOWS) {
-      this.coord.buckets.add(bucketKey(keyId, window2), GRAIN_MS[window2], WINDOW_MS[window2], now, delta);
+      this.coord.buckets.add(bucketKey(subject, window2), GRAIN_MS[window2], WINDOW_MS[window2], now, delta);
     }
   }
-  inFlight(keyId) {
-    return this.coord.gauge.read(keyId);
+  inFlight(subject) {
+    return this.coord.gauge.read(subject);
   }
-  async refuse(keyId, decision, now, requestId) {
+  async refuse(subjects, decisions, now, requestId) {
+    const corrected = [];
+    for (const [index, scope] of decisions.entries()) {
+      const subject = subjects[index];
+      if (subject === undefined)
+        throw new Error("rate limit decision from no subject");
+      corrected.push(await this.correct(subject, scope, now, requestId));
+    }
+    const decision = combineAll(corrected);
     const violation = decision.violation;
     if (violation === null)
-      return;
-    const window2 = violation.window;
-    const exact = await this.exactReset(keyId, window2, now, requestId);
-    const resolved = exact === null ? violation : { ...violation, resetAt: exact };
-    const headroom = exact === null || window2 === null ? decision.headroom : withReset(decision.headroom, window2, exact);
+      throw new Error("rate limit refusal with no violation");
     try {
       this.onRejected?.(violation.dimension, violation.window);
     } catch {}
-    throw new RateLimitExceeded(retryAfterMs(resolved, now), headroom);
+    throw new RateLimitExceeded(retryAfterMs(violation, now), refusedHeadroom(decision, violation));
+  }
+  async correct(subject, scope, now, requestId) {
+    if (scope.violations.length === 0)
+      return scope;
+    const exact = new Map;
+    for (const violation of scope.violations) {
+      const window2 = violation.window;
+      if (window2 === null || exact.has(window2))
+        continue;
+      const reset = await this.exactReset(subject, window2, now, requestId);
+      if (reset !== null)
+        exact.set(window2, reset);
+    }
+    const violations = scope.violations.map((violation) => {
+      const reset = violation.window === null ? undefined : exact.get(violation.window);
+      return reset === undefined ? violation : { ...violation, resetAt: reset };
+    });
+    let headroom = scope.headroom;
+    for (const [window2, reset] of exact)
+      headroom = withReset(headroom, window2, reset);
+    return { ...scope, violation: lastToClear(violations), violations, headroom };
   }
-  async exactReset(keyId, window2, now, requestId) {
+  async exactReset(subject, window2, now, requestId) {
     if (window2 === null || window2 === "1m")
       return null;
     const length = WINDOW_MS[window2];
     try {
-      const oldest = await this.store.usage.oldestSince(keyId, now - length);
+      const oldest = await this.store.usage.oldestSince(subject.keyId, now - length, subject.model);
       if (oldest === null)
         return null;
       return oldest + length;
     } catch (error) {
       this.logger.warn("rate limit reset unavailable", {
         ...requestId === undefined ? {} : { requestId },
-        apiKeyId: keyId,
+        apiKeyId: subject.keyId,
+        ...subject.model === undefined ? {} : { model: subject.model },
         reason: describeError(error, "unknown")
       });
       return null;
     }
   }
-  async counters(keyId, limits, claim, now, requestId) {
+  async counters(subject, limits, claim, now, requestId) {
     const requests = { "1m": claim.before.requests };
     const snapshot = { requests, concurrency: claim.before.concurrency };
     if (!anyLongLimit(limits))
       return snapshot;
-    const counts = await this.longCounts(keyId, now, requestId);
+    const counts = await this.longCounts(subject, now, requestId);
     if (counts === null)
       return snapshot;
     const tokens = {};
@@ -41837,20 +42594,21 @@ class ApiKeyRateLimiter {
     snapshot.spend = spend;
     return snapshot;
   }
-  async longCounts(keyId, now, requestId) {
+  async longCounts(subject, now, requestId) {
     const out = {};
     for (const window2 of LONG_WINDOWS) {
-      const key = bucketKey(keyId, window2);
+      const key = bucketKey(subject.id, window2);
       const grain = GRAIN_MS[window2];
       const length = WINDOW_MS[window2];
       let sum = await this.coord.buckets.sum(key, grain, length, now);
       if (sum === null) {
         try {
-          sum = await this.seed(keyId, window2, now);
+          sum = await this.seed(subject, window2, now);
         } catch (error) {
           this.logger.warn("rate limit counters unavailable", {
             ...requestId === undefined ? {} : { requestId },
-            apiKeyId: keyId,
+            apiKeyId: subject.keyId,
+            ...subject.model === undefined ? {} : { model: subject.model },
             reason: describeError(error, "unknown")
           });
           return null;
@@ -41860,15 +42618,15 @@ class ApiKeyRateLimiter {
     }
     return out;
   }
-  async seed(keyId, window2, now) {
-    const key = bucketKey(keyId, window2);
+  async seed(subject, window2, now) {
+    const key = bucketKey(subject.id, window2);
     const grain = GRAIN_MS[window2];
     const length = WINDOW_MS[window2];
     const install = async () => {
       const already = await this.coord.buckets.sum(key, grain, length, now);
       if (already !== null)
         return already;
-      const rows = await this.store.usage.sumBuckets(keyId, now - length, grain);
+      const rows = await this.store.usage.sumBuckets(subject.keyId, now - length, grain, subject.model);
       await this.coord.buckets.seed(key, grain, length, now, rows);
       return await this.coord.buckets.sum(key, grain, length, now) ?? zero();
     };
@@ -41884,6 +42642,9 @@ class ApiKeyRateLimiter {
 function zero() {
   return { requests: 0, tokens: 0, costUsd: 0 };
 }
+function requestsOnly(limits) {
+  return limits.requests === undefined ? {} : { requests: limits.requests };
+}
 function withReset(headroom, window2, resetAt) {
   const corrected = { ...headroom };
   for (const dimension of ["requests", "tokens", "spend"]) {
@@ -41893,6 +42654,27 @@ function withReset(headroom, window2, resetAt) {
   }
   return corrected;
 }
+function refusedHeadroom(decision, violation) {
+  const window2 = violation.window;
+  if (window2 === null || violation.dimension === "concurrency")
+    return decision.headroom;
+  return {
+    ...decision.headroom,
+    [violation.dimension]: {
+      window: window2,
+      limit: violation.limit,
+      used: violation.used,
+      remaining: Math.max(0, violation.limit - violation.used),
+      resetAt: violation.resetAt
+    }
+  };
+}
+function combineAll(decisions) {
+  const [first, ...rest] = decisions;
+  if (first === undefined)
+    return { allowed: true, violation: null, violations: [], headroom: {} };
+  return rest.reduce(combine, first);
+}
 
 // apps/gateway/src/dispatch/loadRegistry.ts
 var PREFIX6 = "load:";
@@ -42810,7 +43592,7 @@ function zodDetail(issue) {
   }
   return issue.message;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null;
 }
 function extraFields(body, known) {
@@ -42953,7 +43735,7 @@ async function readJson(request) {
 }
 async function readJsonRecord(request) {
   const body = await readJson(request);
-  return isRecord9(body) ? body : null;
+  return isRecord10(body) ? body : null;
 }
 function apiErrorResponse(error) {
   const gatewayError = error instanceof GatewayError ? error : new GatewayError("INTERNAL", "internal error");
@@ -46040,7 +46822,7 @@ async function finishLog(store, log, keyId, logger = noopLogger, bodies, debit,
     report(logger, "failed to persist request log", log.id, error);
   }
   if (keyId !== null && debit !== undefined) {
-    debit(keyId, {
+    debit(keyId, log.requestedModel, {
       tokens: log.inputTokens + log.outputTokens + log.cacheReadTokens + log.cacheWriteTokens,
       costUsd: log.costUsd
     });
@@ -46209,6 +46991,7 @@ async function attempt(opts) {
     signal,
     ...opts.requestId === undefined ? {} : { requestId: opts.requestId },
     ...opts.autoCache === undefined ? {} : { autoCache: opts.autoCache },
+    ...opts.requestStartedAt === undefined ? {} : { requestStartedAt: opts.requestStartedAt },
     ...candidate.target.maxOutputTokens === undefined ? {} : { maxOutputTokens: candidate.target.maxOutputTokens }
   });
 }
@@ -46528,6 +47311,7 @@ async function dispatch(request, deps, signal, requestId) {
                   ...retrySecrets === undefined ? {} : { secrets: retrySecrets },
                   logger,
                   requestId,
+                  requestStartedAt: startedAt,
                   autoCache: snapshot.settings.autoCacheEnabled
                 }), dispatchSignal);
                 noteDegradations(result.degradations);
@@ -47373,10 +48157,10 @@ function toIrToolChoice(c) {
 }
 var EFFORTS = REASONING_EFFORTS;
 function readEffort(body) {
-  if (!isRecord9(body))
+  if (!isRecord10(body))
     return;
   const outputConfig = body.output_config;
-  if (!isRecord9(outputConfig))
+  if (!isRecord10(outputConfig))
     return;
   const effort = outputConfig.effort;
   return EFFORTS.find((level) => level === effort);
@@ -47758,7 +48542,7 @@ function roleOf(raw) {
   return "user";
 }
 function contentPart(part) {
-  if (!isRecord9(part))
+  if (!isRecord10(part))
     throw new GatewayError("BAD_REQUEST", "input: content part must be an object");
   const type = part.type;
   if (type === "input_text" || type === "output_text") {
@@ -47782,11 +48566,11 @@ function readToolOutput(output) {
   const images = [];
   const files = [];
   for (const part of output) {
-    if (isRecord9(part) && (part.type === "input_text" || part.type === "output_text")) {
+    if (isRecord10(part) && (part.type === "input_text" || part.type === "output_text")) {
       text.push(String(part.text ?? ""));
-    } else if (isRecord9(part) && part.type === "input_image" && typeof part.image_url === "string" && part.image_url.startsWith("data:")) {
+    } else if (isRecord10(part) && part.type === "input_image" && typeof part.image_url === "string" && part.image_url.startsWith("data:")) {
       images.push({ type: "image", ...parseDataUrl(part.image_url) });
-    } else if (isRecord9(part) && part.type === "input_file" && typeof part.file_data === "string") {
+    } else if (isRecord10(part) && part.type === "input_file" && typeof part.file_data === "string") {
       files.push({
         type: "file",
         ...fileData(part.file_data),
@@ -47837,7 +48621,7 @@ function readInputItems(items) {
       messages.push({ role, content });
   };
   for (const raw of items) {
-    if (!isRecord9(raw))
+    if (!isRecord10(raw))
       throw new GatewayError("BAD_REQUEST", "input: item must be an object");
     const type = raw.type ?? (raw.role === undefined ? undefined : "message");
     switch (type) {
@@ -47893,7 +48677,7 @@ function jsonArguments(raw, callId) {
   const text = typeof raw === "string" ? raw : "";
   try {
     const parsed = text === "" ? {} : JSON.parse(text);
-    return isRecord9(parsed) ? parsed : { value: parsed };
+    return isRecord10(parsed) ? parsed : { value: parsed };
   } catch {
     throw new GatewayError("BAD_REQUEST", `input: arguments for call ${safeToken(callId)} are not valid JSON`);
   }
@@ -47902,7 +48686,7 @@ var TOOL_NAME = /^[A-Za-z0-9_-]{1,128}$/;
 function readTools(raw) {
   const tools = [];
   for (const entry of raw) {
-    if (!isRecord9(entry))
+    if (!isRecord10(entry))
       throw new GatewayError("BAD_REQUEST", "tools: each tool must be an object");
     const type = typeof entry.type === "string" ? entry.type : "";
     const declared = typeof entry.name === "string" ? entry.name : "";
@@ -47915,7 +48699,7 @@ function readTools(raw) {
         kind: "portable",
         name: declared,
         ...description === undefined ? {} : { description },
-        inputSchema: type === "custom" ? { type: "object", properties: { input: { type: "string" } }, required: ["input"] } : isRecord9(entry.parameters) ? entry.parameters : { type: "object" }
+        inputSchema: type === "custom" ? { type: "object", properties: { input: { type: "string" } }, required: ["input"] } : isRecord10(entry.parameters) ? entry.parameters : { type: "object" }
       });
       continue;
     }
@@ -47930,10 +48714,10 @@ function readTools(raw) {
 }
 function customToolNames(body) {
   const names = new Set;
-  if (!isRecord9(body) || !Array.isArray(body.tools))
+  if (!isRecord10(body) || !Array.isArray(body.tools))
     return names;
   for (const entry of body.tools) {
-    if (isRecord9(entry) && entry.type === "custom" && typeof entry.name === "string") {
+    if (isRecord10(entry) && entry.type === "custom" && typeof entry.name === "string") {
       names.add(entry.name);
     }
   }
@@ -48142,8 +48926,8 @@ async function handle(deps, rateLimiter, surface, request) {
   let streaming = false;
   let headroom = {};
   const limitHeaders = () => rateLimitHeaders(surface, release === null ? headroom : afterThisRequest(headroom), startedAt);
-  const debit = (id, usage) => {
-    rateLimiter.debit(id, usage);
+  const debit = (id, model, usage) => {
+    rateLimiter.debit(id, model, usage);
   };
   try {
     let key;
@@ -48160,24 +48944,6 @@ async function handle(deps, rateLimiter, surface, request) {
       throw error;
     }
     keyId = key.id;
-    try {
-      const admitted = await rateLimiter.admit(key.id, key.limits, requestId);
-      release = admitted.release;
-      headroom = admitted.headroom;
-    } catch (error) {
-      if (error instanceof RateLimitExceeded)
-        headroom = error.headroom;
-      if (error instanceof GatewayError && error.code === "RATE_LIMIT") {
-        deps.logger.warn("rate limit rejected", {
-          requestId,
-          surface,
-          apiKeyId: key.id,
-          code: error.code,
-          retryAfterMs: error.retryAfterMs
-        });
-      }
-      throw error;
-    }
     const captured = await bodyCollectorFor(deps, key);
     collector = captured;
     if (captured !== null) {
@@ -48208,6 +48974,25 @@ async function handle(deps, rateLimiter, surface, request) {
       throw new GatewayError("AUTH", `model "${safeToken(chatRequest.model)}" is not allowed for this API key`);
     }
     requestedModel = chatRequest.model;
+    try {
+      const admitted = await rateLimiter.admit(key.id, key.limits, requestedModel, requestId);
+      release = admitted.release;
+      headroom = admitted.headroom;
+    } catch (error) {
+      if (error instanceof RateLimitExceeded)
+        headroom = error.headroom;
+      if (error instanceof GatewayError && error.code === "RATE_LIMIT") {
+        deps.logger.warn("rate limit rejected", {
+          requestId,
+          surface,
+          apiKeyId: key.id,
+          model: requestedModel,
+          code: error.code,
+          retryAfterMs: error.retryAfterMs
+        });
+      }
+      throw error;
+    }
     let began = false;
     const dispatched = await dispatch(chatRequest, {
       ...deps,
@@ -48343,12 +49128,12 @@ function proxyRoutes(deps) {
   }).post("/v1/messages/count_tokens", async ({ request }) => {
     try {
       const key = await authenticateApiKey(deps.store, apiKeyHeader(request.headers), deps.now(), logger);
-      await rateLimiter.consume(key.id, key.limits, deps.requestId());
       const body = await request.json();
       const chatRequest = parseAnthropicRequest(body, request.headers);
       if (key.modelAllowlist !== null && !key.modelAllowlist.includes(chatRequest.model)) {
         throw new GatewayError("AUTH", `model "${safeToken(chatRequest.model)}" is not allowed for this API key`);
       }
+      await rateLimiter.consume(key.id, key.limits, chatRequest.model, deps.requestId());
       const { settings } = await dispatchDeps.snapshots.get(deps.now());
       const counted = injectPonytail(chatRequest, { mode: settings.ponytailMode }).request;
       return Response.json({ input_tokens: estimateInputTokens(counted) });
@@ -48569,11 +49354,11 @@ function topicClass(topic) {
   return null;
 }
 var MAX_TOPIC = 128;
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseClientFrame(raw) {
-  if (!isRecord10(raw))
+  if (!isRecord11(raw))
     return null;
   const { id, type, topic } = raw;
   if (id !== undefined && typeof id !== "string")
@@ -49257,7 +50042,7 @@ function createRing(limits = DEFAULT_RING_LIMITS) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.13.6";
+var VERSION = "0.14.0";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;