@omnicross/core 0.1.10 → 0.2.0

package/dist/outbound-api.d.ts

@@ -1,18 +1,19 @@
 import { VoucherConfig } from '@omnicross/contracts/voucher-types';
-import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-BB8pxk_3.js';
-export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-BB8pxk_3.js';
+import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, W as AnthropicConfigSegment, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, y as OutboundProxyConfig, I as ImagesServerConfig, s as OutboundEndpoint, R as RequestRole, T as ModelRef, k as KindMappedEndpoint, l as ModelKind, x as OutboundPermission, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-5T223WYQ.js';
+export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, z as ResponsesModelKind, V as VoucherCreateInput, B as VoucherDb, D as computeVoucherGrant, H as generateVoucherCode, J as hashVoucherCode, L as newVoucherId, N as startOfLocalDay, P as startOfLocalWeek, Q as toVoucherInfo, S as voucherCodePrefix } from './types-5T223WYQ.js';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
 import { WebhookDestination, WebhookConfig } from '@omnicross/contracts/webhook-types';
+import { e as ImageApiLimits } from './types-Bd72H4SB.js';
 export { AUDIT_REDACTED, redactAuditText } from './outbound-api/auditRedact.js';
 export { AuditCaptureContext, beginAuditCapture } from './outbound-api/auditCapture.js';
 export { BillingCaptureContext, beginBillingCapture } from './outbound-api/billingCapture.js';
 import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-zdWTu3CQ.js';
 export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-zdWTu3CQ.js';
 import http from 'node:http';
-import { IngressFormat } from './provider-proxy/types.js';
-export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-C0mkkZaM.js';
+import { D as IngressFormat } from './types-CVRge76p.js';
+export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-CTCcSHWu.js';
 export { BoundAccountFallbackPolicy, BoundAccountSelectionError, BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError } from './pipeline/BoundAccountSelectionError.js';
 import '@omnicross/contracts/health-logging-types';
 import './logger-4GvQNzhE.js';
@@ -21,7 +22,9 @@ import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
 import '@omnicross/contracts/completion-types';
 import './transformer/TransformerService.js';
-import './ProviderProxy--ROec6VI.js';
+import './ProviderProxy-DYoY5XoT.js';
+import '@omnicross/contracts/image-generation-types';
+import 'node:fs/promises';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
@@ -62,6 +65,8 @@ declare const DEFAULT_OUTBOUND_PORT = 8765;
 interface ApplyConfigInput {
     enabled: boolean;
     networkBinding: boolean;
+    /** Additive Images URL publication; serving still depends on runtime capability. */
+    imagesEnabled?: boolean;
     endpoints: EndpointRoutingConfig[];
     /** Independent resource bindings; absent preserves legacy endpoint routing. */
     bindings?: GatewayBinding[];
@@ -73,6 +78,15 @@ interface ApplyConfigInput {
     /** Voucher segment (voucher-redemption #9). Read live per request; absent ⇒
      *  disabled ⇒ the `/redeem` endpoint is inert (zero regression). */
     voucher?: VoucherConfig;
+    /** Anthropic-protocol segment (claude-api-protocol-fidelity, §10). Read live
+     *  per request; the heartbeat value is hot-applied to the stream synthesizer. */
+    anthropic?: AnthropicConfigSegment;
+}
+/** Prepared listener/config publication used by the daemon's settings transaction. */
+interface PreparedOutboundApiConfig {
+    publish(): Promise<void>;
+    rollback(): Promise<void>;
+    dispose(): Promise<void>;
 }
 declare class OutboundApiServer {
     private readonly deps;
@@ -86,6 +100,10 @@ declare class OutboundApiServer {
     private userMessageQueue;
     private concurrencyQueue;
     private voucherConfig;
+    private anthropicConfig;
+    private imagesEnabled;
+    /** R10 `/api/hello` switch (§10 `anthropic.apiHello`, default true). */
+    private apiHelloEnabled;
     private readonly rateLimiter;
     /**
      * Redeem-attempt limiter (voucher-redemption #9, design D6) — a SEPARATE bucket
@@ -111,12 +129,35 @@ declare class OutboundApiServer {
      * in place (read live per request — no restart).
      */
     applyConfig(input: ApplyConfigInput): Promise<void>;
+    /**
+     * Prepare any new listener before persistence when the target can coexist with
+     * the current socket. A live fixed-port address-only change cannot be made
+     * failure-atomic on every supported platform because the replacement cannot
+     * coexist with the old socket, so reject it before persistence instead of
+     * performing a fallible close-then-bind during publication.
+     */
+    prepareConfig(input: ApplyConfigInput): Promise<PreparedOutboundApiConfig>;
     /** Start the listener on `bindAddr:port`, falling back on EADDRINUSE. */
     start(bindAddr: string, port: number): Promise<number>;
     /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
-    private listen;
+    private listenDetached;
+    private createHttpServer;
+    private installConfigSnapshot;
+    private captureRuntimeSnapshot;
+    private installRuntimeSnapshot;
+    private restoreRuntimeSnapshot;
+    private closeServer;
+    /** Publication already swapped the authoritative pointer; retirement cannot fail it. */
+    private closePublishedServer;
+    private announcePublishedListener;
     /** Per-request handler. Auth is enforced on EVERY request (incl. loopback). */
     private onRequest;
+    /**
+     * Serve `HEAD /api/hello` (exact path, query tolerated) with a bare 200 —
+     * returning true when it handled the request. Unauthenticated by design and
+     * gated on `anthropic.apiHello` (default true).
+     */
+    private tryServeApiHello;
     /**
      * Serve `GET|HEAD /health` (+ `/healthz`) from the injected provider, returning
      * true when it handled the request. 200 when `ok`, else 503; secret-free body.
@@ -321,6 +362,43 @@ declare function saveServerConfig(store: ApiServerSettingsStore, config: Outboun
 /** Apply a partial patch to a config, returning the merged whole. */
 declare function mergeServerConfig(current: OutboundApiServerConfig, patch: Partial<OutboundApiServerConfig>): OutboundApiServerConfig;
 
+/** Immutable upper bounds used by both tolerant reads and strict admin writes. */
+declare const IMAGE_SERVER_HARD_CEILINGS: Readonly<{
+    queue: Readonly<{
+        maxConcurrentJobsPerAccount: 8;
+        maxQueuedJobs: 1000;
+        queueTimeoutMs: number;
+        generationTimeoutMs: number;
+    }>;
+    temporary: Readonly<{
+        maxActiveScopes: 256;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        staleAfterMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    limits: Readonly<ImageApiLimits>;
+    references: Readonly<{
+        ttlMs: number;
+        maxArtifactBytes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        maxEntries: 1000000;
+        maxCalls: 2000000;
+        maxResponses: 1000000;
+        maxTombstones: 2000000;
+        tombstoneTtlMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    evidenceTtlMs: number;
+}>;
+/** Migration-safe default: configured off, finite everywhere, and remote-disabled. */
+declare const DEFAULT_IMAGES_SERVER_CONFIG: Readonly<ImagesServerConfig>;
+/** Tolerant read normalization: malformed members fall back or clamp, never throw. */
+declare function normalizeImagesServerConfig(value: unknown): ImagesServerConfig;
+/** Strict structural/range validation. Daemon validation adds filesystem and resolver policy. */
+declare function validateImagesServerConfig(value: unknown): string[];
+
 /**
  * Either the winning route projected to the resolver shape, or `none` — no
  * enabled route for this key/endpoint could serve the request. There is no
@@ -690,7 +768,15 @@ declare function createNamedKey(db: OutboundKeyDb, name: string): Promise<Outbou
  * Mint the local gateway key used by native CLI configuration adapters. Unlike
  * a user-distributed key it is explicitly loopback-only and endpoint-scoped.
  */
-declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundEndpoint[]): Promise<OutboundApiKeyCreated>;
+declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundPermission[]): Promise<OutboundApiKeyCreated>;
+declare const LEGACY_OUTBOUND_PERMISSIONS: readonly OutboundPermission[];
+/** Strict write-edge validator. Stored-row reads use fail-closed interpretation below. */
+declare function validateOutboundPermissions(value: unknown): OutboundPermission[];
+/**
+ * Authoritative legacy interpretation. Absence preserves only the four historic
+ * families; malformed persisted data denies all instead of widening access.
+ */
+declare function effectiveOutboundPermissions(value: unknown): readonly OutboundPermission[];
 /**
  * A verified key + the enforcement inputs carried from the row so the wire layer
  * runs its policy checks WITHOUT a second DB read (mirrors `maxConcurrency`).
@@ -698,7 +784,7 @@ declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEn
 interface VerifiedKey {
     id: string;
     kind?: 'client' | 'integration';
-    allowedEndpoints?: OutboundEndpoint[];
+    allowedEndpoints: OutboundPermission[];
     loopbackOnly?: boolean;
     /**
      * The key's per-key concurrency ceiling, carried from the row so the wire
@@ -920,4 +1006,4 @@ declare function getOutboundApiServer(deps?: OutboundApiDeps, onPortChange?: (po
 /** Reset the singleton (tests / teardown only). */
 declare function __resetOutboundApiServerForTests(): void;
 
-export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundProxyConfig, OutboundRateLimiter, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, verifyKey, verifyPresentedKey };
+export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_IMAGES_SERVER_CONFIG, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, IMAGE_SERVER_HARD_CEILINGS, ImagesServerConfig, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, LEGACY_OUTBOUND_PERMISSIONS, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundPermission, OutboundProxyConfig, OutboundRateLimiter, type PreparedOutboundApiConfig, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, effectiveOutboundPermissions, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizeImagesServerConfig, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, validateImagesServerConfig, validateOutboundPermissions, verifyKey, verifyPresentedKey };

package/dist/outbound-api.js

@@ -6,10 +6,13 @@ import {
   DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
+  DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_OUTBOUND_PORT,
   DEFAULT_USER_MESSAGE_QUEUE,
+  IMAGE_SERVER_HARD_CEILINGS,
   KeySpendTracker,
   KeyedMutex,
+  LEGACY_OUTBOUND_PERMISSIONS,
   OUTBOUND_API_SERVER_CONFIG_KEY,
   OutboundApiServer,
   OutboundConcurrencyGate,
@@ -25,6 +28,7 @@ import {
   createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
+  effectiveOutboundPermissions,
   formatUrls,
   gatewayBindingToEndpointConfig,
   generateVoucherCode,
@@ -46,6 +50,7 @@ import {
   normalizeBilling,
   normalizeFingerprint,
   normalizeGatewayBindings,
+  normalizeImagesServerConfig,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -60,34 +65,39 @@ import {
   startOfLocalDay,
   startOfLocalWeek,
   toVoucherInfo,
+  validateImagesServerConfig,
+  validateOutboundPermissions,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-FEBAQI5A.js";
+} from "./chunk-WSJE42SG.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-WTQMX2Q6.js";
-import "./chunk-NGYOO5TO.js";
-import "./chunk-HKB656B4.js";
-import "./chunk-55FMGZ3L.js";
-import "./chunk-45FHEOKW.js";
+import "./chunk-EYGBM2VC.js";
+import "./chunk-DK4A7DLE.js";
+import "./chunk-FJNKXOWE.js";
+import "./chunk-V53ZEFXC.js";
+import "./chunk-7PIUVCKK.js";
+import "./chunk-6OC3ORW6.js";
 import "./chunk-FU7EAR73.js";
-import "./chunk-CCVRRJOX.js";
-import "./chunk-6D4W22P4.js";
+import "./chunk-LFEH7CEO.js";
+import "./chunk-HN74IGEO.js";
+import "./chunk-QIIAMBTM.js";
 import "./chunk-FXR6N3SR.js";
 import "./chunk-AQDON6MB.js";
-import "./chunk-WNKWAEUR.js";
 import "./chunk-MZNPGW5Q.js";
-import "./chunk-DK4A7DLE.js";
-import "./chunk-XXFYLL7R.js";
+import "./chunk-ECZ3ZE2C.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
 import "./chunk-GFIZ6LQI.js";
 import "./chunk-OE6TDIWW.js";
 import "./chunk-DRWHTIIZ.js";
+import "./chunk-X335TJNS.js";
+import "./chunk-HOMUGKHR.js";
 import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
 import "./chunk-PO3XB56Z.js";
-import "./chunk-N7OOJI5V.js";
+import "./chunk-V2UKUTJ3.js";
 import "./chunk-23S5OPIO.js";
 import "./chunk-AVYJ4YBN.js";
 import "./chunk-OPRS4IQZ.js";
@@ -96,12 +106,19 @@ import {
   boundAccountSelectionMessage,
   isBoundAccountSelectionError
 } from "./chunk-2JYRIADS.js";
-import "./chunk-DE2SRBFZ.js";
-import "./chunk-ZY6KU6P3.js";
+import {
+  beginAuditCapture
+} from "./chunk-6OKXH2TW.js";
+import "./chunk-WNY4WMRF.js";
+import {
+  AUDIT_REDACTED,
+  redactAuditText
+} from "./chunk-N76KU6F5.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
 import "./chunk-TKJMZBAH.js";
+import "./chunk-OZFM4X3S.js";
 import "./chunk-3QFXFCHG.js";
 import {
   SUBSCRIPTION_PROVIDER_IDS,
@@ -118,34 +135,27 @@ import {
   resolvePrefixTarget,
   resolveRoute,
   validateEndpointModelConfig
-} from "./chunk-EBLFCNPY.js";
+} from "./chunk-U47LQXPB.js";
 import "./chunk-AQ5TNQB7.js";
 import {
   ENDPOINT_MODEL_KINDS
 } from "./chunk-XEKD23J5.js";
+import "./chunk-Y7FO65VT.js";
+import "./chunk-FMOBD2OQ.js";
+import "./chunk-HUZZZ3JL.js";
 import "./chunk-H5JUT3KV.js";
-import {
-  beginAuditCapture
-} from "./chunk-GXEZ2R3E.js";
-import {
-  AUDIT_REDACTED,
-  redactAuditText
-} from "./chunk-K5NM7VAH.js";
-import "./chunk-WNY4WMRF.js";
-import "./chunk-OZFM4X3S.js";
 import "./chunk-5NJLQ6T6.js";
-import "./chunk-2UTGX6FM.js";
-import "./chunk-S3DYFEBE.js";
+import "./chunk-4VVCXVB7.js";
+import "./chunk-R4VCO2CB.js";
 import "./chunk-WYVGULTQ.js";
-import "./chunk-N2EIM2XJ.js";
-import "./chunk-RJ5ZGNI3.js";
+import "./chunk-ZLNHPUFA.js";
+import "./chunk-CFSGYFOZ.js";
 import "./chunk-3WD4HTR2.js";
 import "./chunk-MKF46GNZ.js";
 import "./chunk-GL6XM527.js";
+import "./chunk-DEIUR2TH.js";
+import "./chunk-4JOU54M5.js";
 import "./chunk-CDHS2QDC.js";
-import "./chunk-Y7FO65VT.js";
-import "./chunk-FMOBD2OQ.js";
-import "./chunk-HUZZZ3JL.js";
 export {
   AUDIT_REDACTED,
   BoundAccountSelectionError,
@@ -156,11 +166,14 @@ export {
   DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
+  DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_OUTBOUND_PORT,
   DEFAULT_USER_MESSAGE_QUEUE,
   ENDPOINT_MODEL_KINDS,
+  IMAGE_SERVER_HARD_CEILINGS,
   KeySpendTracker,
   KeyedMutex,
+  LEGACY_OUTBOUND_PERMISSIONS,
   OUTBOUND_API_SERVER_CONFIG_KEY,
   OutboundApiServer,
   OutboundConcurrencyGate,
@@ -183,6 +196,7 @@ export {
   defaultServerConfig,
   detectModelKind,
   detectRequestRole,
+  effectiveOutboundPermissions,
   endpointSupportsSubscription,
   endpointToIngressFormat,
   formatUrls,
@@ -210,6 +224,7 @@ export {
   normalizeBilling,
   normalizeFingerprint,
   normalizeGatewayBindings,
+  normalizeImagesServerConfig,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -230,6 +245,8 @@ export {
   startOfLocalWeek,
   toVoucherInfo,
   validateEndpointModelConfig,
+  validateImagesServerConfig,
+  validateOutboundPermissions,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -1,30 +1,33 @@
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { a as AllowanceSchedulingConfig } from '../types-C2MwkLah.cjs';
+import { a as AllowanceSchedulingConfig } from '../types-jjU24eYG.cjs';
 import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
-import '@omnicross/contracts/account-tokens-types';
-import '@omnicross/contracts/audit-types';
-import '@omnicross/contracts/billing-types';
-import '@omnicross/contracts/health-logging-types';
-import '@omnicross/contracts/voucher-types';
-import '@omnicross/contracts/webhook-types';
-import '../logger-4GvQNzhE.cjs';
-import '../ports/provider-config-source.cjs';
-import '@omnicross/contracts/llm-config';
-import '../transformer/types.cjs';
-import '@omnicross/contracts/completion-types';
-import '../transformer/TransformerService.cjs';
-import '../ProviderProxy-QdwNV6l1.cjs';
-import '../provider-proxy/types.cjs';
+import '../types-CbglB73l.cjs';
+import '@omnicross/contracts/image-generation-types';
+import '../types-DsHBBk3h.cjs';
 import 'node:http';
+import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';
+import '@omnicross/contracts/llm-config';
+import '../logger-4GvQNzhE.cjs';
 import './AuthSource.cjs';
 import './BoundAccountSelectionError.cjs';
 import './SubscriptionAuthSource.cjs';
 import './SubscriptionAuthStrategy.cjs';
+import '../ports/provider-config-source.cjs';
+import '../transformer/types.cjs';
+import '../transformer/TransformerService.cjs';
 import '../ports/web-search-backend.cjs';
 import '@omnicross/contracts/websearch-types';
+import 'node:fs/promises';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../ProviderProxy-CgIcCVwk.cjs';
 import '../keyPolicy-zdWTu3CQ.cjs';
 import '@omnicross/contracts/account-allowance-types';
 

package/dist/pipeline/AccountAllowanceScheduling.d.ts

@@ -1,30 +1,33 @@
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { a as AllowanceSchedulingConfig } from '../types-BB8pxk_3.js';
+import { a as AllowanceSchedulingConfig } from '../types-5T223WYQ.js';
 import { AccountAllowanceStore } from './AccountAllowanceStore.js';
-import '@omnicross/contracts/account-tokens-types';
-import '@omnicross/contracts/audit-types';
-import '@omnicross/contracts/billing-types';
-import '@omnicross/contracts/health-logging-types';
-import '@omnicross/contracts/voucher-types';
-import '@omnicross/contracts/webhook-types';
-import '../logger-4GvQNzhE.js';
-import '../ports/provider-config-source.js';
-import '@omnicross/contracts/llm-config';
-import '../transformer/types.js';
-import '@omnicross/contracts/completion-types';
-import '../transformer/TransformerService.js';
-import '../ProviderProxy--ROec6VI.js';
-import '../provider-proxy/types.js';
+import '../types-Bd72H4SB.js';
+import '@omnicross/contracts/image-generation-types';
+import '../types-CVRge76p.js';
 import 'node:http';
+import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.js';
+import '@omnicross/contracts/llm-config';
+import '../logger-4GvQNzhE.js';
 import './AuthSource.js';
 import './BoundAccountSelectionError.js';
 import './SubscriptionAuthSource.js';
 import './SubscriptionAuthStrategy.js';
+import '../ports/provider-config-source.js';
+import '../transformer/types.js';
+import '../transformer/TransformerService.js';
 import '../ports/web-search-backend.js';
 import '@omnicross/contracts/websearch-types';
+import 'node:fs/promises';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../ProviderProxy-DYoY5XoT.js';
 import '../keyPolicy-zdWTu3CQ.js';
 import '@omnicross/contracts/account-allowance-types';
 

package/dist/pipeline/LlmConfigProviderAuth.cjs

@@ -1,8 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkQ27JY5RGcjs = require('../chunk-Q27JY5RG.cjs');
-require('../chunk-A2YMUCBT.cjs');
+var _chunkOIKREZVQcjs = require('../chunk-OIKREZVQ.cjs');
 require('../chunk-UNEFIWXI.cjs');
+require('../chunk-A2YMUCBT.cjs');
 
 
-exports.LlmConfigProviderAuth = _chunkQ27JY5RGcjs.LlmConfigProviderAuth;
+exports.LlmConfigProviderAuth = _chunkOIKREZVQcjs.LlmConfigProviderAuth;

package/dist/pipeline/LlmConfigProviderAuth.js

@@ -1,8 +1,8 @@
 import {
   LlmConfigProviderAuth
-} from "../chunk-ZY6KU6P3.js";
-import "../chunk-H5JUT3KV.js";
+} from "../chunk-HOMUGKHR.js";
 import "../chunk-HUZZZ3JL.js";
+import "../chunk-H5JUT3KV.js";
 export {
   LlmConfigProviderAuth
 };

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -10,7 +10,7 @@
 
 
 
-var _chunkYWL7YZWScjs = require('../chunk-YWL7YZWS.cjs');
+var _chunk7LRTPNFLcjs = require('../chunk-7LRTPNFL.cjs');
 
 
 
@@ -23,4 +23,4 @@ var _chunkYWL7YZWScjs = require('../chunk-YWL7YZWS.cjs');
 
 
 
-exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYWL7YZWScjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYWL7YZWScjs.AUTH_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = _chunkYWL7YZWScjs.MAX_QUOTA_COOLDOWN_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYWL7YZWScjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYWL7YZWScjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYWL7YZWScjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYWL7YZWScjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYWL7YZWScjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYWL7YZWScjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYWL7YZWScjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYWL7YZWScjs.setSharedAccountHealth;
+exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunk7LRTPNFLcjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunk7LRTPNFLcjs.AUTH_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = _chunk7LRTPNFLcjs.MAX_QUOTA_COOLDOWN_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunk7LRTPNFLcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunk7LRTPNFLcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunk7LRTPNFLcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunk7LRTPNFLcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunk7LRTPNFLcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunk7LRTPNFLcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunk7LRTPNFLcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunk7LRTPNFLcjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -138,6 +138,13 @@ interface RecordUpstreamOutcomeInput {
     retryAfterSeconds?: number | null;
     /** Bounded response body text for the 403-ban sniff (only read on a 403). */
     bodyText?: string;
+    /**
+     * DIAGNOSTIC-ONLY (claude-api-transform-fidelity, R11): the upstream error
+     * body's `error.type` on failure statuses (429/529/≥500). Logged, never
+     * consulted by any decision branch — a table-driven test pins that outcomes
+     * are identical with and without it.
+     */
+    upstreamErrorType?: string;
     /** Injectable clock (default the tracker's `now`). */
     now?: number;
 }

package/dist/pipeline/SubscriptionAccountHealth.d.ts

@@ -138,6 +138,13 @@ interface RecordUpstreamOutcomeInput {
     retryAfterSeconds?: number | null;
     /** Bounded response body text for the 403-ban sniff (only read on a 403). */
     bodyText?: string;
+    /**
+     * DIAGNOSTIC-ONLY (claude-api-transform-fidelity, R11): the upstream error
+     * body's `error.type` on failure statuses (429/529/≥500). Logged, never
+     * consulted by any decision branch — a table-driven test pins that outcomes
+     * are identical with and without it.
+     */
+    upstreamErrorType?: string;
     /** Injectable clock (default the tracker's `now`). */
     now?: number;
 }

package/dist/pipeline/SubscriptionAccountHealth.js

@@ -10,7 +10,7 @@ import {
   getSharedAccountHealth,
   resolveResetSeconds,
   setSharedAccountHealth
-} from "../chunk-N7OOJI5V.js";
+} from "../chunk-V2UKUTJ3.js";
 export {
   ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,

package/dist/pipeline/executeProviderCall.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkMUHWHQVMcjs = require('../chunk-MUHWHQVM.cjs');
+var _chunkKQBLZMP6cjs = require('../chunk-KQBLZMP6.cjs');
 
 
-exports.executeProviderCall = _chunkMUHWHQVMcjs.executeProviderCall;
+exports.executeProviderCall = _chunkKQBLZMP6cjs.executeProviderCall;

package/dist/pipeline/executeProviderCall.d.cts

@@ -31,8 +31,8 @@ import '@omnicross/contracts/completion-types';
  *      mutated `prepareBody` output. Each site passes a DIFFERENT variable
  *      there today (proxy → post-transform `requestBody`; Adapter/Handler →
  *      the pre-transform `unifiedRequest`), so the core does not hard-code
- *      it — `responseChainRequest` is supplied by the caller when
- *      `runResponseChain` is true.
+ *      it — `responseChainRequest` may be supplied by the caller, while a
+ *      wire ingress can explicitly retain the post-endpoint Unified request.
  *
  *   2. The engine adapter and Handler check `response.ok` on the RAW fetch response
  *      BEFORE running the response chain. Those sites therefore set
@@ -113,12 +113,17 @@ interface ProviderCallContext {
     runResponseChain?: boolean;
     /**
      * The first argument passed to `executeResponseChain` when
-     * `runResponseChain` is true. This is REQUIRED in that mode because the
-     * sites diverge on which variable they pass (proxy → post-transform
-     * `requestBody`; the unified ingresses → the pre-transform request). The
-     * core never assumes it equals `prepareBody`'s output.
+     * `runResponseChain` is true. Sites diverge on which variable they pass
+     * (proxy → post-transform `requestBody`; unified ingresses → the
+     * pre-transform request), so callers can supply it explicitly. The core
+     * never assumes it equals `prepareBody`'s output.
      */
     responseChainRequest?: UnifiedChatRequest;
+    /**
+     * Use the post-endpoint, pre-target Unified request for response encoding.
+     * Opt-in preserves the historical proxy fallback to final `requestBody`.
+     */
+    preserveEndpointRequestForResponseChain?: boolean;
 }
 /**
  * Result of the common exchange.

package/dist/pipeline/executeProviderCall.d.ts

@@ -31,8 +31,8 @@ import '@omnicross/contracts/completion-types';
  *      mutated `prepareBody` output. Each site passes a DIFFERENT variable
  *      there today (proxy → post-transform `requestBody`; Adapter/Handler →
  *      the pre-transform `unifiedRequest`), so the core does not hard-code
- *      it — `responseChainRequest` is supplied by the caller when
- *      `runResponseChain` is true.
+ *      it — `responseChainRequest` may be supplied by the caller, while a
+ *      wire ingress can explicitly retain the post-endpoint Unified request.
  *
  *   2. The engine adapter and Handler check `response.ok` on the RAW fetch response
  *      BEFORE running the response chain. Those sites therefore set
@@ -113,12 +113,17 @@ interface ProviderCallContext {
     runResponseChain?: boolean;
     /**
      * The first argument passed to `executeResponseChain` when
-     * `runResponseChain` is true. This is REQUIRED in that mode because the
-     * sites diverge on which variable they pass (proxy → post-transform
-     * `requestBody`; the unified ingresses → the pre-transform request). The
-     * core never assumes it equals `prepareBody`'s output.
+     * `runResponseChain` is true. Sites diverge on which variable they pass
+     * (proxy → post-transform `requestBody`; unified ingresses → the
+     * pre-transform request), so callers can supply it explicitly. The core
+     * never assumes it equals `prepareBody`'s output.
      */
     responseChainRequest?: UnifiedChatRequest;
+    /**
+     * Use the post-endpoint, pre-target Unified request for response encoding.
+     * Opt-in preserves the historical proxy fallback to final `requestBody`.
+     */
+    preserveEndpointRequestForResponseChain?: boolean;
 }
 /**
  * Result of the common exchange.

package/dist/pipeline/executeProviderCall.js

@@ -1,6 +1,6 @@
 import {
   executeProviderCall
-} from "../chunk-DE2SRBFZ.js";
+} from "../chunk-X335TJNS.js";
 export {
   executeProviderCall
 };