@omnicross/core 0.1.2 → 0.1.4

package/dist/outbound-api/auditRedact.d.ts

@@ -0,0 +1,30 @@
+/**
+ * auditRedact — the pure secret-redaction pass for captured audit bodies
+ * (request-audit-log, design D3/D7).
+ *
+ * Body capture is opt-in and inherently sensitive: a prompt or tool argument can
+ * embed a secret. {@link redactAuditText} is run over EVERY captured body (and
+ * any other free text stored in a record) BEFORE it is persisted — defense in
+ * depth on top of "request headers are NEVER captured" (so an Authorization /
+ * x-api-key HEADER value never enters a record in the first place).
+ *
+ * It masks the obvious, high-confidence secret shapes ONLY (frozen list) — never
+ * a broad heuristic that would gut a legitimate prompt:
+ *  - `sk-…` API keys (covers `sk-ant-…`, `sk-omnicross-…`, `sk-proj-…`, OpenAI).
+ *  - `Bearer <token>` authorization values.
+ *  - `x-api-key` / `api-key` / `authorization` values written inline as text.
+ *  - Google `AIza…` API keys.
+ *
+ * Pure + allocation-light + never throws.
+ *
+ * @module @omnicross/core/outbound-api/auditRedact
+ */
+/** The sentinel a masked secret is replaced with. */
+declare const AUDIT_REDACTED = "***REDACTED***";
+/**
+ * Mask obvious secrets in `text`. Pure; returns the input unchanged when it holds
+ * no recognized secret shape. Never throws (a bad input returns `''`).
+ */
+declare function redactAuditText(text: string): string;
+
+export { AUDIT_REDACTED, redactAuditText };

package/dist/outbound-api/auditRedact.js

@@ -0,0 +1,8 @@
+import {
+  AUDIT_REDACTED,
+  redactAuditText
+} from "../chunk-K5NM7VAH.js";
+export {
+  AUDIT_REDACTED,
+  redactAuditText
+};

package/dist/outbound-api/billingCapture.cjs

@@ -0,0 +1,8 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkAPYG5QD7cjs = require('../chunk-APYG5QD7.cjs');
+require('../chunk-L74VDN4A.cjs');
+require('../chunk-XSVNC2UD.cjs');
+
+
+exports.beginBillingCapture = _chunkAPYG5QD7cjs.beginBillingCapture;

package/dist/outbound-api/billingCapture.d.cts

@@ -0,0 +1,61 @@
+import http from 'node:http';
+
+/**
+ * billingCapture — the outbound server's post-response billing capture hook
+ * (billing-event-stream, design D1/D4).
+ *
+ * {@link beginBillingCapture} is called at the TOP of `handleOutboundRequest`. It
+ * reads the active billing config from the core slot; when billing is DISABLED it
+ * returns `null` immediately (one slot read — no assembly, no listener, zero
+ * regression). When enabled it registers a one-shot `res.close` listener that
+ * assembles a {@link BillingEvent} from the handler-filled context (keyId / model
+ * / provider / authMode), the response `statusCode`, and this request's METERED
+ * FACTS (token counts + the ALREADY-COMPUTED cost) — then hands it to the
+ * no-throw {@link publishBillingEvent}.
+ *
+ * COST REUSE (design D3 — no double pricing): the metered facts are read from the
+ * per-request usage stash the usage tap populates ({@link readAuditUsage} — the
+ * SAME stash `usage-events.jsonl` correlation uses, populated UNCONDITIONALLY by
+ * the taps, independent of whether request-audit is enabled). Token counts are
+ * stashed SYNCHRONOUSLY at `record()`; the cost lands on the recorder's deferred
+ * pricing tick (scheduled BEFORE the response closes). So the assembly is deferred
+ * one macrotask past `close` — by then the earlier-scheduled pricing tick has run
+ * and stashed the computed cost we REUSE (we never re-price).
+ *
+ * BILLABLE-ONLY: an event is emitted ONLY when the request produced usage (an
+ * upstream call was billed). Auth failures / rate-limit / model-restriction
+ * rejections return before dispatch, stash no usage, and emit NO billing event.
+ *
+ * @module @omnicross/core/outbound-api/billingCapture
+ */
+
+/**
+ * The mutable context the request handler enriches as it progresses. `null` is
+ * returned by {@link beginBillingCapture} when billing is disabled — the handler
+ * guards every write with `if (billing)`.
+ */
+interface BillingCaptureContext {
+    /** Outbound key id (set after auth). NEVER the key material. */
+    keyId?: string | null;
+    /** Resolved upstream model (set after route resolution). */
+    model?: string;
+    /** Upstream provider id (set after route resolution). */
+    provider?: string;
+    /** Re-auth mode the request billed under (set after route resolution). */
+    authMode?: 'byo' | 'subscription';
+}
+/**
+ * Deferral used to schedule the event assembly one macrotask past `close`, so the
+ * usage tap's earlier-scheduled pricing tick has stashed the cost we reuse.
+ * Injectable ONLY for deterministic tests; production uses a zero-delay timer.
+ */
+type BillingDefer = (fn: () => void) => void;
+/**
+ * Begin billing capture for one request. Returns a mutable context the handler
+ * enriches, or `null` when billing is disabled (zero-cost path). The event is
+ * emitted on response `close` via the no-throw sink — but ONLY when the request
+ * produced usage (a billable request).
+ */
+declare function beginBillingCapture(_req: http.IncomingMessage, res: http.ServerResponse, now: number, defer?: BillingDefer): BillingCaptureContext | null;
+
+export { type BillingCaptureContext, type BillingDefer, beginBillingCapture };

package/dist/outbound-api/billingCapture.d.ts

@@ -0,0 +1,61 @@
+import http from 'node:http';
+
+/**
+ * billingCapture — the outbound server's post-response billing capture hook
+ * (billing-event-stream, design D1/D4).
+ *
+ * {@link beginBillingCapture} is called at the TOP of `handleOutboundRequest`. It
+ * reads the active billing config from the core slot; when billing is DISABLED it
+ * returns `null` immediately (one slot read — no assembly, no listener, zero
+ * regression). When enabled it registers a one-shot `res.close` listener that
+ * assembles a {@link BillingEvent} from the handler-filled context (keyId / model
+ * / provider / authMode), the response `statusCode`, and this request's METERED
+ * FACTS (token counts + the ALREADY-COMPUTED cost) — then hands it to the
+ * no-throw {@link publishBillingEvent}.
+ *
+ * COST REUSE (design D3 — no double pricing): the metered facts are read from the
+ * per-request usage stash the usage tap populates ({@link readAuditUsage} — the
+ * SAME stash `usage-events.jsonl` correlation uses, populated UNCONDITIONALLY by
+ * the taps, independent of whether request-audit is enabled). Token counts are
+ * stashed SYNCHRONOUSLY at `record()`; the cost lands on the recorder's deferred
+ * pricing tick (scheduled BEFORE the response closes). So the assembly is deferred
+ * one macrotask past `close` — by then the earlier-scheduled pricing tick has run
+ * and stashed the computed cost we REUSE (we never re-price).
+ *
+ * BILLABLE-ONLY: an event is emitted ONLY when the request produced usage (an
+ * upstream call was billed). Auth failures / rate-limit / model-restriction
+ * rejections return before dispatch, stash no usage, and emit NO billing event.
+ *
+ * @module @omnicross/core/outbound-api/billingCapture
+ */
+
+/**
+ * The mutable context the request handler enriches as it progresses. `null` is
+ * returned by {@link beginBillingCapture} when billing is disabled — the handler
+ * guards every write with `if (billing)`.
+ */
+interface BillingCaptureContext {
+    /** Outbound key id (set after auth). NEVER the key material. */
+    keyId?: string | null;
+    /** Resolved upstream model (set after route resolution). */
+    model?: string;
+    /** Upstream provider id (set after route resolution). */
+    provider?: string;
+    /** Re-auth mode the request billed under (set after route resolution). */
+    authMode?: 'byo' | 'subscription';
+}
+/**
+ * Deferral used to schedule the event assembly one macrotask past `close`, so the
+ * usage tap's earlier-scheduled pricing tick has stashed the cost we reuse.
+ * Injectable ONLY for deterministic tests; production uses a zero-delay timer.
+ */
+type BillingDefer = (fn: () => void) => void;
+/**
+ * Begin billing capture for one request. Returns a mutable context the handler
+ * enriches, or `null` when billing is disabled (zero-cost path). The event is
+ * emitted on response `close` via the no-throw sink — but ONLY when the request
+ * produced usage (a billable request).
+ */
+declare function beginBillingCapture(_req: http.IncomingMessage, res: http.ServerResponse, now: number, defer?: BillingDefer): BillingCaptureContext | null;
+
+export { type BillingCaptureContext, type BillingDefer, beginBillingCapture };

package/dist/outbound-api/billingCapture.js

@@ -0,0 +1,8 @@
+import {
+  beginBillingCapture
+} from "../chunk-WLYIIEAF.js";
+import "../chunk-TKJMZBAH.js";
+import "../chunk-OZFM4X3S.js";
+export {
+  beginBillingCapture
+};

package/dist/outbound-api/quotaWarn.cjs

@@ -0,0 +1,12 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+var _chunk4YINUUKQcjs = require('../chunk-4YINUUKQ.cjs');
+
+
+
+
+
+exports.WEBHOOK_QUOTA_WARN_RATIO = _chunk4YINUUKQcjs.WEBHOOK_QUOTA_WARN_RATIO; exports.__resetQuotaWarnGuardForTests = _chunk4YINUUKQcjs.__resetQuotaWarnGuardForTests; exports.computeQuotaWarnings = _chunk4YINUUKQcjs.computeQuotaWarnings; exports.markQuotaWarnedOnce = _chunk4YINUUKQcjs.markQuotaWarnedOnce;

package/dist/outbound-api/quotaWarn.d.cts

@@ -0,0 +1,43 @@
+import { K as KeyCostLimits, c as KeySpend } from '../keyPolicy-Cp0FntZl.cjs';
+
+/**
+ * quotaWarn — the key.quotaWarning threshold helper (webhook-notifications,
+ * design D3, Phase 2).
+ *
+ * A PURE crossing detector ({@link computeQuotaWarnings}) + a tiny module-level
+ * "already warned this window" guard ({@link markQuotaWarnedOnce}). The wire
+ * path (`outboundApiRouter`) computes warnings alongside the existing quota
+ * check and emits `key.quotaWarning` ONCE per window-crossing — so a key sitting
+ * above the warn ratio doesn't spam a webhook every request. The guard is keyed
+ * by `keyId + scope + windowStart`, so a NEW day/week window re-arms the warning
+ * naturally (its `windowStart` differs).
+ *
+ * @module @omnicross/core/outbound-api/quotaWarn
+ */
+
+/** Warn when accumulated spend reaches this fraction of a scope's limit (design OQ2). */
+declare const WEBHOOK_QUOTA_WARN_RATIO = 0.8;
+/** A per-scope warning crossing (not-yet-exceeded, at/over the warn ratio). */
+interface QuotaWarning {
+    scope: 'daily' | 'weekly' | 'total';
+    limitUsd: number;
+    spentUsd: number;
+    /** The window boundary (epoch ms; `0` for the window-less `total` scope). */
+    windowStart: number;
+}
+/**
+ * Detect which cost scopes have crossed the warn ratio but are NOT yet exceeded
+ * (an EXCEEDED scope is handled by `checkKeyQuota` → `key.quotaExceeded`, not a
+ * warning). Pure — the caller owns the emit + the dedupe guard.
+ */
+declare function computeQuotaWarnings(limits: KeyCostLimits, spend: KeySpend, ratio?: number): QuotaWarning[];
+/**
+ * Record a warning for `(keyId, scope, windowStart)` and return whether THIS is
+ * the first time (⇒ the caller should emit). Subsequent calls in the same window
+ * return `false` (deduped). A new window (different `windowStart`) re-arms.
+ */
+declare function markQuotaWarnedOnce(keyId: string, scope: string, windowStart: number): boolean;
+/** TEST SEAM — clear the dedupe guard between suites. */
+declare function __resetQuotaWarnGuardForTests(): void;
+
+export { type QuotaWarning, WEBHOOK_QUOTA_WARN_RATIO, __resetQuotaWarnGuardForTests, computeQuotaWarnings, markQuotaWarnedOnce };

package/dist/outbound-api/quotaWarn.d.ts

@@ -0,0 +1,43 @@
+import { K as KeyCostLimits, c as KeySpend } from '../keyPolicy-Cp0FntZl.js';
+
+/**
+ * quotaWarn — the key.quotaWarning threshold helper (webhook-notifications,
+ * design D3, Phase 2).
+ *
+ * A PURE crossing detector ({@link computeQuotaWarnings}) + a tiny module-level
+ * "already warned this window" guard ({@link markQuotaWarnedOnce}). The wire
+ * path (`outboundApiRouter`) computes warnings alongside the existing quota
+ * check and emits `key.quotaWarning` ONCE per window-crossing — so a key sitting
+ * above the warn ratio doesn't spam a webhook every request. The guard is keyed
+ * by `keyId + scope + windowStart`, so a NEW day/week window re-arms the warning
+ * naturally (its `windowStart` differs).
+ *
+ * @module @omnicross/core/outbound-api/quotaWarn
+ */
+
+/** Warn when accumulated spend reaches this fraction of a scope's limit (design OQ2). */
+declare const WEBHOOK_QUOTA_WARN_RATIO = 0.8;
+/** A per-scope warning crossing (not-yet-exceeded, at/over the warn ratio). */
+interface QuotaWarning {
+    scope: 'daily' | 'weekly' | 'total';
+    limitUsd: number;
+    spentUsd: number;
+    /** The window boundary (epoch ms; `0` for the window-less `total` scope). */
+    windowStart: number;
+}
+/**
+ * Detect which cost scopes have crossed the warn ratio but are NOT yet exceeded
+ * (an EXCEEDED scope is handled by `checkKeyQuota` → `key.quotaExceeded`, not a
+ * warning). Pure — the caller owns the emit + the dedupe guard.
+ */
+declare function computeQuotaWarnings(limits: KeyCostLimits, spend: KeySpend, ratio?: number): QuotaWarning[];
+/**
+ * Record a warning for `(keyId, scope, windowStart)` and return whether THIS is
+ * the first time (⇒ the caller should emit). Subsequent calls in the same window
+ * return `false` (deduped). A new window (different `windowStart`) re-arms.
+ */
+declare function markQuotaWarnedOnce(keyId: string, scope: string, windowStart: number): boolean;
+/** TEST SEAM — clear the dedupe guard between suites. */
+declare function __resetQuotaWarnGuardForTests(): void;
+
+export { type QuotaWarning, WEBHOOK_QUOTA_WARN_RATIO, __resetQuotaWarnGuardForTests, computeQuotaWarnings, markQuotaWarnedOnce };

package/dist/outbound-api/quotaWarn.js

@@ -0,0 +1,12 @@
+import {
+  WEBHOOK_QUOTA_WARN_RATIO,
+  __resetQuotaWarnGuardForTests,
+  computeQuotaWarnings,
+  markQuotaWarnedOnce
+} from "../chunk-3QFXFCHG.js";
+export {
+  WEBHOOK_QUOTA_WARN_RATIO,
+  __resetQuotaWarnGuardForTests,
+  computeQuotaWarnings,
+  markQuotaWarnedOnce
+};

package/dist/outbound-api/routeResolver.cjs

@@ -2,10 +2,13 @@
 
 
 
-var _chunkG2FUJNA2cjs = require('../chunk-G2FUJNA2.cjs');
+
+var _chunkVACWOIREcjs = require('../chunk-VACWOIRE.cjs');
 require('../chunk-QBZJ7P2T.cjs');
+require('../chunk-4IH4EL7M.cjs');
+
 
 
 
 
-exports.isSubscriptionProviderId = _chunkG2FUJNA2cjs.isSubscriptionProviderId; exports.parseModelRef = _chunkG2FUJNA2cjs.parseModelRef; exports.resolveRoute = _chunkG2FUJNA2cjs.resolveRoute;
+exports.isSubscriptionProviderId = _chunkVACWOIREcjs.isSubscriptionProviderId; exports.parseModelRef = _chunkVACWOIREcjs.parseModelRef; exports.pickModelRefFromList = _chunkVACWOIREcjs.pickModelRefFromList; exports.resolveRoute = _chunkVACWOIREcjs.resolveRoute;

package/dist/outbound-api/routeResolver.d.cts

@@ -1,7 +1,7 @@
 import '../ports/provider-config-source.cjs';
 import '../provider-proxy/types.cjs';
-import './types.cjs';
-export { R as RouteResolveError, a as RouteResolveResult, i as isSubscriptionProviderId, p as parseModelRef, r as resolveRoute } from '../routeResolver-BrbK6ja9.cjs';
+import '../types-B8Arpxn0.cjs';
+export { R as RouteResolveError, b as RouteResolveResult, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from '../routeResolver-CB3tvJKy.cjs';
 import '@omnicross/contracts/llm-config';
 import '../transformer/types.cjs';
 import '../transformer/TransformerService.cjs';
@@ -16,4 +16,11 @@ import '../pipeline/SubscriptionAuthSource.cjs';
 import '../pipeline/SubscriptionAuthStrategy.cjs';
 import '../ports/web-search-backend.cjs';
 import '@omnicross/contracts/websearch-types';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
 import '../ProviderProxy-CnMQYN59.cjs';
+import '../keyPolicy-Cp0FntZl.cjs';

package/dist/outbound-api/routeResolver.d.ts

@@ -1,7 +1,7 @@
 import '../ports/provider-config-source.js';
 import '../provider-proxy/types.js';
-import './types.js';
-export { R as RouteResolveError, a as RouteResolveResult, i as isSubscriptionProviderId, p as parseModelRef, r as resolveRoute } from '../routeResolver-HE-ZO0fO.js';
+import '../types-lgPYQuZS.js';
+export { R as RouteResolveError, b as RouteResolveResult, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from '../routeResolver-C4T7yClx.js';
 import '@omnicross/contracts/llm-config';
 import '../transformer/types.js';
 import '../transformer/TransformerService.js';
@@ -16,4 +16,11 @@ import '../pipeline/SubscriptionAuthSource.js';
 import '../pipeline/SubscriptionAuthStrategy.js';
 import '../ports/web-search-backend.js';
 import '@omnicross/contracts/websearch-types';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
 import '../ProviderProxy-C-xqrkKi.js';
+import '../keyPolicy-Cp0FntZl.js';

package/dist/outbound-api/routeResolver.js

@@ -1,11 +1,14 @@
 import {
   isSubscriptionProviderId,
   parseModelRef,
+  pickModelRefFromList,
   resolveRoute
-} from "../chunk-3MEACFK3.js";
+} from "../chunk-UHGVBFU3.js";
 import "../chunk-AQ5TNQB7.js";
+import "../chunk-XEKD23J5.js";
 export {
   isSubscriptionProviderId,
   parseModelRef,
+  pickModelRefFromList,
   resolveRoute
 };

package/dist/outbound-api/types.cjs

@@ -1 +1,6 @@
-"use strict";
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunk4IH4EL7Mcjs = require('../chunk-4IH4EL7M.cjs');
+
+
+exports.ENDPOINT_MODEL_KINDS = _chunk4IH4EL7Mcjs.ENDPOINT_MODEL_KINDS;

package/dist/outbound-api/types.d.cts

@@ -1,6 +1,14 @@
-import { ProviderConfigSource } from '../ports/provider-config-source.cjs';
-import { P as ProviderProxy } from '../ProviderProxy-CnMQYN59.cjs';
-import { ProviderProxyDeps } from '../provider-proxy/types.cjs';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.cjs';
+import '../ports/provider-config-source.cjs';
+import '../ProviderProxy-CnMQYN59.cjs';
+import '../provider-proxy/types.cjs';
+export { H as AccountHealthConfig, A as AccountProbeConfig, C as ChatDispatchMode, a as ConcurrencyQueueConfig, E as ENDPOINT_MODEL_KINDS, b as EndpointRoutingConfig, F as FingerprintConfig, e as KindMappedEndpoint, M as MessagesModelKind, f as ModelKind, g as ModelPrefixTargets, G as ModelRef, h as OutboundApiDeps, i as OutboundApiKeyCreated, j as OutboundApiKeyInfo, k as OutboundApiServerConfig, l as OutboundApiServerStatus, m as OutboundEndpoint, n as OutboundFormatUrls, o as OutboundKeyActivationMode, O as OutboundKeyDb, p as OutboundKeyDbRow, I as OutboundKeyModelRestrictionMode, q as OutboundKeyPolicy, r as OutboundProxyConfig, R as RequestRole, s as ResponsesModelKind, U as UserMessageQueueConfig } from '../types-B8Arpxn0.cjs';
 import '@omnicross/contracts/llm-config';
 import '../transformer/types.cjs';
 import '../transformer/TransformerService.cjs';
@@ -9,149 +17,9 @@ import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';
-import '../logger-4GvQNzhE.cjs';
 import '../pipeline/AuthSource.cjs';
 import '../pipeline/SubscriptionAuthSource.cjs';
 import '../pipeline/SubscriptionAuthStrategy.cjs';
 import '../ports/web-search-backend.cjs';
 import '@omnicross/contracts/websearch-types';
-
-/**
- * Shared contract types for the outbound API server (`outbound-api-server`).
- *
- * The outbound server is a SEPARATE long-lived HTTP listener (distinct from the
- * resident loopback `ProviderProxy`) that authenticates external callers via
- * named API keys and routes their requests through the EXISTING `provider-proxy`
- * ingress parsers + transformer — there is exactly one conversion stack.
- *
- * These types are kept in their own module so the server, router, auth, rate
- * limiter, role detection, and route resolver can share shapes without circular
- * imports.
- *
- * @module outbound-api/types
- */
-
-/** The four endpoints, 1:1 with the four wire-format ingress parsers. */
-type OutboundEndpoint = 'chat' | 'responses' | 'messages' | 'gemini';
-/** A `"providerId,modelId"` model reference (mirrors `RouterConfig` vocab). */
-type ModelRef = string;
-/** The detected request role; precedence vision > background > default. */
-type RequestRole = 'vision' | 'background' | 'default';
-/**
- * Per-endpoint routing config. Persisted independently of the global
- * "默认模型" settings tab; survives restart.
- */
-interface EndpointRoutingConfig {
-    /** Which of the four endpoints this block configures. */
-    endpoint: OutboundEndpoint;
-    /** REQUIRED — model for normal (non-vision, non-background) requests. */
-    defaultModel: ModelRef;
-    /** REQUIRED — model for background/probe/small-task requests. */
-    backgroundModel: ModelRef;
-    /** OPTIONAL — model for requests carrying image/vision content. */
-    visionModel?: ModelRef;
-    /** Gates subscription-vs-BYO provider selection. Default FALSE. */
-    useSubscription: boolean;
-    /**
-     * OPTIONAL per-endpoint "background model id" override list (human decision
-     * after the proposal). When set, an incoming requested model id appearing in
-     * this list is classified as the BACKGROUND role; otherwise the registry
-     * small/haiku-class signal is the baseline. Empty/unset → registry signal
-     * only. Compared against the requested model id (bare or `providerId,modelId`).
-     */
-    backgroundModelIds?: string[];
-}
-/** The persisted server config. */
-interface OutboundApiServerConfig {
-    /** When false the listener never binds (off by default). */
-    enabled: boolean;
-    /** When true the listener binds `0.0.0.0` (LAN) instead of `127.0.0.1`. */
-    networkBinding: boolean;
-    /** Per-endpoint routing config, one per endpoint (4 entries). */
-    endpoints: EndpointRoutingConfig[];
-    /** Persisted port (fixed default; falls back to ephemeral on EADDRINUSE). */
-    port?: number;
-}
-/** A live status snapshot the Settings tab renders. */
-interface OutboundApiServerStatus {
-    running: boolean;
-    /** Actual bound port (0 when not running). */
-    port: number;
-    /** Loopback base URL (always present when running). */
-    loopbackUrl: string | null;
-    /** LAN base URL (present only when network binding is on). */
-    lanUrl: string | null;
-    /** The four format endpoint URLs (loopback). */
-    formats: OutboundFormatUrls | null;
-    /** The four format endpoint URLs over the LAN (only when network binding on). */
-    lanFormats: OutboundFormatUrls | null;
-}
-/** The four format endpoint URLs for one base. */
-interface OutboundFormatUrls {
-    chat: string;
-    responses: string;
-    messages: string;
-    gemini: string;
-}
-/** A stored key DTO (never carries the plaintext secret). */
-interface OutboundApiKeyInfo {
-    id: string;
-    name: string;
-    keyPrefix: string;
-    enabled: boolean;
-    createdAt: number;
-    lastUsedAt: number | null;
-    revoked: boolean;
-}
-/** The one-time create result; `plaintextOnce` is shown exactly once. */
-interface OutboundApiKeyCreated {
-    id: string;
-    name: string;
-    keyPrefix: string;
-    createdAt: number;
-    plaintextOnce: string;
-}
-/**
- * Structural subset of the DB the outbound server needs — the named-key CRUD
- * surface. Kept structural so the server module does not depend on the full
- * `DbRpc`.
- */
-interface OutboundKeyDbRow {
-    id: string;
-    name: string;
-    keyHash: string;
-    keyPrefix: string;
-    enabled: boolean;
-    createdAt: number;
-    lastUsedAt: number | null;
-    revokedAt: number | null;
-}
-interface OutboundKeyDb {
-    outboundApiKeysList(): Promise<OutboundKeyDbRow[]>;
-    outboundApiKeysGetByHash(hash: string): Promise<OutboundKeyDbRow | null>;
-    outboundApiKeysCreate(input: {
-        id: string;
-        name: string;
-        keyHash: string;
-        keyPrefix: string;
-        createdAt?: number;
-    }): Promise<OutboundKeyDbRow>;
-    outboundApiKeysRevoke(id: string): Promise<boolean>;
-    outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
-    outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
-}
-/**
- * App-session-scoped dependencies the outbound server needs. The resident
- * `ProviderProxy` is shared so the new listener mints routes on the SAME route
- * map and reuses the SAME ingress parsers + transformer.
- */
-interface OutboundApiDeps {
-    readonly db: OutboundKeyDb;
-    readonly llmConfig: ProviderConfigSource;
-    /** The resident proxy — shared for route minting + ingress dispatch. */
-    readonly providerProxy: ProviderProxy;
-    /** The proxy's app-session deps (reused verbatim for `routeRequest`). */
-    readonly proxyDeps: ProviderProxyDeps;
-}
-
-export type { EndpointRoutingConfig, ModelRef, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiKeyInfo, OutboundApiServerConfig, OutboundApiServerStatus, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundKeyDbRow, RequestRole };
+import '../keyPolicy-Cp0FntZl.cjs';