@omnicross/core 0.1.4 → 0.1.6

package/dist/{chunk-QYTT6GE3.js → chunk-UDCC7EMR.js}

@@ -1,21 +1,30 @@
+import {
+  collectMatchText,
+  deriveGatewaySessionKey,
+  deriveSubscriptionSessionKey
+} from "./chunk-WB6PH56J.js";
 import {
   streamSSEResponse
 } from "./chunk-VVEHS2LI.js";
 import {
-  AnthropicTransformer
-} from "./chunk-FTQ7IQUC.js";
+  TransformerChainExecutor
+} from "./chunk-WNKWAEUR.js";
+import {
+  injectExtendedContextBeta
+} from "./chunk-MZNPGW5Q.js";
 import {
   GeminiTransformer
-} from "./chunk-C7PSERMH.js";
+} from "./chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "./chunk-TIER4SUC.js";
+} from "./chunk-OEWZUX4G.js";
 import {
-  TransformerChainExecutor
-} from "./chunk-G2UTNSGU.js";
+  AnthropicTransformer,
+  resolveAnthropicMaxTokens
+} from "./chunk-6CL5HTPQ.js";
 import {
-  injectExtendedContextBeta
-} from "./chunk-MZNPGW5Q.js";
+  getGeminiCodeAssistResolver
+} from "./chunk-DRWHTIIZ.js";
 import {
   getSharedIdentityStore
 } from "./chunk-XTEI64OU.js";
@@ -24,18 +33,31 @@ import {
   captureCallerIdentity
 } from "./chunk-XX6NQJMA.js";
 import {
-  collectMatchText,
-  deriveSubscriptionSessionKey
-} from "./chunk-IAXWICZU.js";
+  resolveSubscriptionChain
+} from "./chunk-5ERIZW3D.js";
+import {
+  getSharedAccountHealth,
+  resolveResetSeconds
+} from "./chunk-YJVHCHQX.js";
+import {
+  SubscriptionAuthSource
+} from "./chunk-23S5OPIO.js";
+import {
+  serializeError
+} from "./chunk-AVYJ4YBN.js";
 import {
   emitWebhookEvent
 } from "./chunk-OE6TDIWW.js";
 import {
-  getGeminiCodeAssistResolver
-} from "./chunk-DRWHTIIZ.js";
+  isAccountAllowanceExhaustedError
+} from "./chunk-OPRS4IQZ.js";
+import {
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "./chunk-2JYRIADS.js";
 import {
   executeProviderCall
-} from "./chunk-IK3KE3AU.js";
+} from "./chunk-DE2SRBFZ.js";
 import {
   LlmConfigProviderAuth,
   getProviderHeaders
@@ -43,19 +65,6 @@ import {
 import {
   resolveProviderChain
 } from "./chunk-JWC6APFQ.js";
-import {
-  resolveSubscriptionChain
-} from "./chunk-5ERIZW3D.js";
-import {
-  getSharedAccountHealth,
-  resolveResetSeconds
-} from "./chunk-5ENKBSWO.js";
-import {
-  SubscriptionAuthSource
-} from "./chunk-HRRYG2AX.js";
-import {
-  serializeError
-} from "./chunk-AVYJ4YBN.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -64,15 +73,16 @@ import {
   markQuotaWarnedOnce
 } from "./chunk-3QFXFCHG.js";
 import {
+  detectModelKind,
   detectRequestRole,
   endpointToIngressFormat,
   extractRequestedModel,
   isKindMappedEndpoint,
   modelKindsForEndpoint,
   parseModelRef,
-  resolveRoute,
-  validateServerModelConfig
-} from "./chunk-UHGVBFU3.js";
+  resolvePrefixTarget,
+  resolveRoute
+} from "./chunk-EBLFCNPY.js";
 import {
   buildProviderApiUrl,
   resolveApiFormat,
@@ -80,14 +90,14 @@ import {
 } from "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-7Y47UCF2.js";
+} from "./chunk-IFXJ2BG7.js";
 import {
   convertAnthropicToOpenAI,
   convertOpenAIToAnthropic
-} from "./chunk-5ZQBEOMD.js";
+} from "./chunk-AT7B7SOZ.js";
 import {
   fetchUpstream
-} from "./chunk-XK5CIRMQ.js";
+} from "./chunk-SIZQQD6T.js";
 import {
   applyAugmentation
 } from "./chunk-Y7FO65VT.js";
@@ -486,23 +496,36 @@ function readAnthropicUsage(usage) {
     reasoningTokens: 0
   };
 }
+function emitAnthropicUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readAnthropicUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordAnthropicNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readAnthropicUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage,
-      auditResponse: attribution.auditResponse
-    });
+    emitAnthropicUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordAnthropicStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitAnthropicUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
@@ -590,7 +613,18 @@ function rewriteSseLine(line, rewriteModel) {
     return line;
   }
 }
-async function relayStreamWithModelRewrite(res, body, rewriteModel) {
+function tapSseDataLine(line, onEvent) {
+  const leadingStripped = line.replace(/^\s+/, "");
+  if (!leadingStripped.startsWith("data:")) return;
+  const payload = leadingStripped.slice(5).trim();
+  if (!payload || payload === "[DONE]") return;
+  try {
+    onEvent(JSON.parse(payload));
+  } catch {
+  }
+}
+async function relaySseBody(res, body, options) {
+  const { rewriteModel, onSseEvent } = options;
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -604,21 +638,26 @@ async function relayStreamWithModelRewrite(res, body, rewriteModel) {
       while ((nlIndex = buffer.indexOf("\n")) !== -1) {
         const linePart = buffer.slice(0, nlIndex + 1);
         buffer = buffer.slice(nlIndex + 1);
-        out += rewriteSseLine(linePart, rewriteModel);
+        if (onSseEvent) tapSseDataLine(linePart, onSseEvent);
+        out += rewriteModel ? rewriteSseLine(linePart, rewriteModel) : linePart;
       }
       if (out) res.write(out);
     }
     const tail = buffer + decoder.decode();
-    if (tail) res.write(rewriteSseLine(tail, rewriteModel));
+    if (tail) {
+      if (onSseEvent) tapSseDataLine(tail, onSseEvent);
+      res.write(rewriteModel ? rewriteSseLine(tail, rewriteModel) : tail);
+    }
   } finally {
     reader.releaseLock();
     res.end();
   }
 }
-async function relayResponse(res, providerResponse, isStream, rewriteModel) {
+async function relayResponse(res, providerResponse, isStream, rewriteModel, usageTap) {
   const contentType = providerResponse.headers.get("Content-Type") ?? "";
   const status = providerResponse.status && providerResponse.status >= 100 ? providerResponse.status : 200;
-  if (isStream || contentType.includes("text/event-stream")) {
+  const upstreamIsSse = contentType.includes("text/event-stream");
+  if (upstreamIsSse || isStream && status < 400) {
     res.writeHead(status, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
@@ -628,8 +667,16 @@ async function relayResponse(res, providerResponse, isStream, rewriteModel) {
       res.end();
       return null;
     }
-    if (rewriteModel) {
-      await relayStreamWithModelRewrite(res, providerResponse.body, rewriteModel);
+    if (rewriteModel || usageTap) {
+      let capturedUsage = null;
+      await relaySseBody(res, providerResponse.body, {
+        rewriteModel,
+        onSseEvent: usageTap ? (event) => {
+          const raw = usageTap.extractUsage(event);
+          if (raw) capturedUsage = raw;
+        } : void 0
+      });
+      if (capturedUsage) usageTap.onUsage(capturedUsage);
       return null;
     }
     const reader = providerResponse.body.getReader();
@@ -651,11 +698,121 @@ async function relayResponse(res, providerResponse, isStream, rewriteModel) {
   res.end(clientText);
   return bodyText;
 }
+async function aggregateAnthropicSseToJsonBody(response, rewriteModel) {
+  const text = await response.text();
+  const message = {
+    type: "message",
+    role: "assistant",
+    content: [],
+    stop_reason: null,
+    stop_sequence: null,
+    usage: {}
+  };
+  const blocks = /* @__PURE__ */ new Map();
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line.startsWith("data:")) continue;
+    const payload = line.slice(5).trim();
+    if (!payload || payload === "[DONE]") continue;
+    let ev;
+    try {
+      ev = JSON.parse(payload);
+    } catch {
+      continue;
+    }
+    switch (ev["type"]) {
+      case "message_start": {
+        const m = ev["message"] ?? {};
+        if (typeof m["id"] === "string") message["id"] = m["id"];
+        if (typeof m["model"] === "string") message["model"] = m["model"];
+        if (m["usage"]) message["usage"] = { ...m["usage"] };
+        break;
+      }
+      case "content_block_start": {
+        const idx = Number(ev["index"]);
+        const cb = ev["content_block"] ?? {};
+        blocks.set(idx, {
+          type: typeof cb["type"] === "string" ? cb["type"] : "text",
+          text: typeof cb["text"] === "string" ? cb["text"] : "",
+          id: typeof cb["id"] === "string" ? cb["id"] : void 0,
+          name: typeof cb["name"] === "string" ? cb["name"] : void 0,
+          inputJson: ""
+        });
+        break;
+      }
+      case "content_block_delta": {
+        const b = blocks.get(Number(ev["index"]));
+        if (!b) break;
+        const d = ev["delta"] ?? {};
+        if (d["type"] === "text_delta" && typeof d["text"] === "string") b.text += d["text"];
+        else if (d["type"] === "input_json_delta" && typeof d["partial_json"] === "string")
+          b.inputJson += d["partial_json"];
+        else if (d["type"] === "thinking_delta" && typeof d["thinking"] === "string")
+          b.text += d["thinking"];
+        else if (d["type"] === "signature_delta" && typeof d["signature"] === "string")
+          b.signature = (b.signature || "") + d["signature"];
+        break;
+      }
+      case "message_delta": {
+        const d = ev["delta"] ?? {};
+        if (d["stop_reason"] !== void 0) message["stop_reason"] = d["stop_reason"];
+        if (d["stop_sequence"] !== void 0) message["stop_sequence"] = d["stop_sequence"];
+        if (ev["usage"])
+          message["usage"] = { ...message["usage"], ...ev["usage"] };
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  message["content"] = [...blocks.keys()].sort((a, b) => a - b).map((idx) => {
+    const blk = blocks.get(idx);
+    if (!blk) return void 0;
+    if (blk.type === "tool_use") {
+      let input = {};
+      try {
+        input = blk.inputJson ? JSON.parse(blk.inputJson) : {};
+      } catch {
+        input = {};
+      }
+      return { type: "tool_use", id: blk.id ?? "", name: blk.name ?? "", input };
+    }
+    if (blk.type === "thinking") {
+      const out = { type: "thinking", thinking: blk.text };
+      if (blk.signature) out.signature = blk.signature;
+      return out;
+    }
+    return { type: blk.type || "text", text: blk.text };
+  }).filter((b) => b !== void 0);
+  if (rewriteModel) message["model"] = rewriteModel;
+  return JSON.stringify(message);
+}
 function writeError(res, status, message) {
   if (res.headersSent) return;
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: { type: "provider_proxy_error", message } }));
 }
+function writeBoundAccountError(res, error) {
+  if (res.headersSent) return;
+  const headers = { "Content-Type": "application/json" };
+  if (error.status === 429 && error.resumeAt) {
+    const resumeMs = Date.parse(error.resumeAt);
+    if (Number.isFinite(resumeMs)) {
+      headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+    }
+  }
+  res.writeHead(error.status, headers);
+  res.end(
+    JSON.stringify({
+      error: {
+        type: "provider_proxy_error",
+        code: error.code,
+        reason: error.reason,
+        message: boundAccountSelectionMessage(error.reason)
+      }
+    })
+  );
+}
 function resolveApiKey(apiKey) {
   if (!apiKey) return "";
   if (apiKey.startsWith("$")) {
@@ -663,7 +820,12 @@ function resolveApiKey(apiKey) {
   }
   return apiKey;
 }
-async function resolvePoolBoundKey(deps, providerId, provider, sessionId) {
+async function resolvePoolBoundKey(deps, providerId, provider, sessionId, preferredKeyId, boundKeyFallbackPolicy) {
+  if (preferredKeyId) {
+    const preferred = await deps.apiKeyPool?.getKeyById(providerId, preferredKeyId, sessionId);
+    if (preferred) return preferred;
+    if (boundKeyFallbackPolicy !== "pool") return "";
+  }
   if (deps.apiKeyPool && sessionId) {
     const poolKey = await deps.apiKeyPool.getKeyForSession(providerId, sessionId);
     if (poolKey) return poolKey;
@@ -718,6 +880,8 @@ function buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isS
   return {
     auth,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -792,6 +956,8 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
     model: resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive) => {
       proxyAccountId = accountId;
       reportSelection?.(accountId, isActive);
@@ -838,6 +1004,8 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
     model: plan.resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive, remapped) => {
       proxyAccountId = accountId;
       remappedModel = remapped;
@@ -1026,21 +1194,61 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
     if (!plan) return;
     anthropicBody.model = plan.resolvedModel;
     const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry(anthropicBody, rawBody, plan, route, deps, options) : await runPipelineWithPoolReporting(anthropicBody, rawBody, plan, options);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream, route.requestedModel);
+    const upstreamResponse = providerResponse.response;
+    const upstreamSse = (upstreamResponse.headers.get("content-type") ?? "").includes(
+      "text/event-stream"
+    );
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "anthropic",
+      model: plan.resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    let anthropicInputUsage;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] === "message_start") {
+          const msg = event["message"];
+          const u = msg?.["usage"];
+          if (u) anthropicInputUsage = u;
+          return null;
+        }
+        if (event["type"] === "message_delta") {
+          const outputUsage = event["usage"];
+          if (!outputUsage) return null;
+          return { ...anthropicInputUsage, ...outputUsage };
+        }
+        return null;
+      },
+      onUsage(rawUsage) {
+        recordAnthropicStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    let bodyText;
+    if (!isStream && upstreamSse) {
+      bodyText = await aggregateAnthropicSseToJsonBody(upstreamResponse, route.requestedModel);
+      res.writeHead(
+        upstreamResponse.status && upstreamResponse.status >= 100 ? upstreamResponse.status : 200,
+        { "Content-Type": "application/json" }
+      );
+      res.end(bodyText);
+    } else {
+      bodyText = await relayResponse(res, upstreamResponse, isStream, route.requestedModel, usageTap);
+    }
     if (bodyText && deps.usageRecorder) {
-      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "anthropic",
-        model: plan.resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:anthropic] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
@@ -1054,7 +1262,14 @@ async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1167,11 +1382,31 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     writeError(res, 502, "Anthropic route is missing a providerId");
     return;
   }
+  let delegatedApiKey = hints.apiKey;
+  if (route.authMode === "byo" && route.providerId) {
+    const provider = await deps.llmConfig.getProvider(route.providerId);
+    if (!provider) {
+      writeError(res, 502, `Provider not found: ${route.providerId}`);
+      return;
+    }
+    delegatedApiKey = await resolvePoolBoundKey(
+      deps,
+      route.providerId,
+      provider,
+      route.sessionId,
+      route.preferredKeyId,
+      route.boundKeyFallbackPolicy
+    );
+    if (!delegatedApiKey) {
+      writeError(res, 502, "API key not configured");
+      return;
+    }
+  }
   const handler = handlerFactory({
     llmConfig: deps.llmConfig,
     providerId: route.providerId ?? "",
     model: route.model,
-    apiKey: hints.apiKey,
+    apiKey: delegatedApiKey,
     backgroundTaskModel: route.backgroundTaskModel,
     isOfficialProvider: hints.isOfficialProvider,
     thinkingLevel: hints.thinkingLevel,
@@ -1180,6 +1415,11 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     passThroughAuthToken: hints.passThroughAuthToken ?? null,
     resolvePassThroughAuthToken: hints.resolvePassThroughAuthToken ?? null,
     subscriptionProfile: hints.subscriptionProfile ?? null,
+    preferredAccountId: hints.preferredAccountId,
+    preferredAccountGroup: hints.preferredAccountGroup,
+    boundAccountFallbackPolicy: hints.boundAccountFallbackPolicy,
+    preferredKeyId: route.preferredKeyId,
+    boundKeyFallbackPolicy: route.boundKeyFallbackPolicy,
     maxConcurrency: hints.maxConcurrency,
     webSearchService: hints.webSearchService ?? null,
     onRetry: hints.onRetry,
@@ -1206,23 +1446,36 @@ function readGeminiUsage(usage) {
     reasoningTokens
   };
 }
+function emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution) {
+  const tapped = readGeminiUsage(rawUsageMetadata);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage: rawUsageMetadata
+  });
+}
 function recordGeminiNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readGeminiUsage(parsed.usageMetadata);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usageMetadata
-    });
+    emitGeminiUsageRecord(
+      recorder,
+      parsed.usageMetadata,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordGeminiStreamUsage(recorder, rawUsageMetadata, attribution) {
+  try {
+    emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution);
   } catch {
   }
 }
@@ -1263,16 +1516,32 @@ async function handleGeminiGenerateContentRequest(res, rawBody, url, route, deps
     const plan = await buildByoPlan2(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = await runPipelineWithPoolReporting2(geminiBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "gemini",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return event["usageMetadata"] ?? null;
+      },
+      onUsage(rawUsage) {
+        recordGeminiStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "gemini",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
     const errMsg = serializeError(err);
@@ -1291,7 +1560,14 @@ async function buildByoPlan2(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1391,23 +1667,36 @@ function readChatCompletionsUsage(usage) {
     reasoningTokens
   };
 }
+function emitChatCompletionsUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readChatCompletionsUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordChatCompletionsNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readChatCompletionsUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
+    emitChatCompletionsUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordChatCompletionsStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitChatCompletionsUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
@@ -1435,21 +1724,41 @@ async function handleOpenAIChatRequest(res, rawBody, route, deps) {
     const plan = route.authMode === "subscription" ? await buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream) : await buildByoPlan3(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = plan.isSubscription ? await runPipelineWithSubscriptionRetry2(chatBody, plan) : await runPipelineWithPoolReporting3(chatBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "openai",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return event["usage"] ?? null;
+      },
+      onUsage(rawUsage) {
+        recordChatCompletionsStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "openai",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:chat] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
@@ -1463,7 +1772,14 @@ async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1529,6 +1845,9 @@ async function buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream)
   };
   return {
     auth,
+    preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1547,6 +1866,9 @@ async function runPipeline3(chatBody, plan) {
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
@@ -1625,23 +1947,36 @@ function readResponsesUsage(usage) {
     reasoningTokens
   };
 }
+function emitResponsesUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readResponsesUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordResponsesNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readResponsesUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
+    emitResponsesUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordResponsesStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitResponsesUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
@@ -1652,7 +1987,7 @@ function isOpenAIResponsesRequest(method, url) {
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
   return path.endsWith("/responses");
 }
-async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
+async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHeaders = {}) {
   let responsesBody;
   try {
     responsesBody = JSON.parse(rawBody);
@@ -1661,27 +1996,58 @@ async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
     return;
   }
   const isStream = responsesBody.stream === true;
+  const derivedSession = deriveGatewaySessionKey(responsesBody, requestHeaders, {
+    endpoint: "responses",
+    // A verified outbound key is the strongest route-local fallback. Resident
+    // proxy callers without one still get a stable run/session bucket; the
+    // final `anonymous` fallback is handled inside the shared utility.
+    fallbackKey: route.apiKeyId ?? route.sessionId ?? void 0
+  });
+  const sessionKey = derivedSession.key;
   const resolvedModel = route.model;
   responsesBody.model = resolvedModel;
   try {
-    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream, route.requestedModel);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "codex",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] !== "response.completed") return null;
+        const response = event["response"];
+        const usage = response?.["usage"];
+        return usage ?? null;
+      },
+      onUsage(rawUsage) {
+        recordResponsesStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      route.requestedModel,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "codex",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:responses] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
@@ -1695,7 +2061,14 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1726,7 +2099,7 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     proxyProviderId: "byo"
   };
 }
-async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) {
+async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) {
   const profile = route.subscriptionProfile;
   if (!profile) {
     writeError(res, 502, "Subscription mode requires a codex subscription profile");
@@ -1751,15 +2124,27 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
   };
   if (profile.authStrategy.providerId === "gemini") {
     try {
-      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile);
+      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile, {
+        sessionKey,
+        preferredAccountId: route.preferredAccountId,
+        preferredAccountGroup: route.preferredAccountGroup,
+        boundAccountFallbackPolicy: route.boundAccountFallbackPolicy
+      });
     } catch (err) {
+      if (isBoundAccountSelectionError(err)) {
+        writeBoundAccountError(res, err);
+        return null;
+      }
       writeError(res, 502, serializeError(err));
       return null;
     }
   }
   return {
     auth,
+    sessionKey,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1772,9 +2157,9 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
     proxyProviderId: profile.authStrategy.providerId
   };
 }
-async function resolveGeminiCodeAssistProject(profile) {
+async function resolveGeminiCodeAssistProject(profile, hints) {
   const probe = {};
-  await profile.authStrategy.applyHeaders(probe);
+  await profile.authStrategy.applyHeaders(probe, hints);
   const bearer = probe.Authorization ?? probe.authorization ?? "";
   const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
   if (!accessToken) return void 0;
@@ -1785,13 +2170,16 @@ async function resolveGeminiCodeAssistProject(profile) {
 async function runPipeline4(responsesBody, plan) {
   const executor = getSharedExecutor();
   const endpointTransformer = getResponsesEndpointTransformer();
-  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const { auth, sessionKey, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
   let proxyAccountId;
   const authHeaders = {};
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
@@ -1844,7 +2232,7 @@ async function runPipelineWithPoolReporting4(responsesBody, plan) {
 async function runPipelineWithSubscriptionRetry3(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
   if (first.rawStatus !== 401) return first;
-  const refreshed = await plan.auth.onUnauthorized?.();
+  const refreshed = await plan.auth.onUnauthorized?.(plan.sessionKey);
   if (!refreshed) {
     console.warn("[ProviderProxy:responses] 401 not recoverable (onUnauthorized returned false)");
     return first;
@@ -1883,7 +2271,7 @@ async function routeRequest(req, res, routes, deps) {
   }
   if (isOpenAIResponsesRequest(method, url)) {
     const rawBody = await readBody(req);
-    await handleOpenAIResponsesRequest(res, rawBody, route, deps);
+    await handleOpenAIResponsesRequest(res, rawBody, route, deps, req.headers);
     return;
   }
   if (isOpenAIChatRequest(method, url)) {
@@ -2093,6 +2481,38 @@ var DEFAULT_ACCOUNT_PROBE = {
   historySize: 10,
   staggerMs: 500
 };
+var DEFAULT_ALLOWANCE_SCHEDULING = {
+  enabled: false,
+  demoteAtPercent: 80,
+  pauseAtPercent: 98,
+  priorityPenalty: 100
+};
+function normalizeAllowanceScheduling(raw) {
+  const value = raw?.allowanceScheduling;
+  const demoteAtPercent = clampNumber(
+    value?.demoteAtPercent,
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.demoteAtPercent
+  );
+  const requestedPause = clampNumber(
+    value?.pauseAtPercent,
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.pauseAtPercent
+  );
+  return {
+    enabled: value?.enabled === true,
+    demoteAtPercent,
+    pauseAtPercent: Math.max(demoteAtPercent, requestedPause),
+    priorityPenalty: Math.trunc(clampNumber(
+      value?.priorityPenalty,
+      1,
+      1e3,
+      DEFAULT_ALLOWANCE_SCHEDULING.priorityPenalty
+    ))
+  };
+}
 function normalizeAccountProbe(raw) {
   const ap = raw?.accountProbe;
   return {
@@ -2287,7 +2707,8 @@ function normalizePrefixTargets(raw) {
 function normalizeEndpointConfig(e) {
   const endpoint = e.endpoint;
   const useSubscription = e.useSubscription === true;
-  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId : void 0;
+  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId.trim() : void 0;
+  const boundAccountFallbackPolicy = boundAccountId ? e.boundAccountFallbackPolicy === "pool" ? "pool" : "strict" : void 0;
   const boundKeyId = typeof e.boundKeyId === "string" && e.boundKeyId.trim() !== "" ? e.boundKeyId : void 0;
   let config;
   if (isKindMappedEndpoint(endpoint)) {
@@ -2317,21 +2738,186 @@ function normalizeEndpointConfig(e) {
       config.backgroundModelIds = e.backgroundModelIds;
     }
   }
-  if (boundAccountId) config.boundAccountId = boundAccountId;
+  if (boundAccountId) {
+    config.boundAccountId = boundAccountId;
+    config.boundAccountFallbackPolicy = boundAccountFallbackPolicy;
+  }
   if (boundKeyId) config.boundKeyId = boundKeyId;
   return config;
 }
+function normalizeBindingTarget(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const target = raw;
+  const providerId = typeof target.providerId === "string" ? target.providerId.trim() : "";
+  if (!providerId) return null;
+  if (target.kind === "account") {
+    const accountId = typeof target.accountId === "string" ? target.accountId.trim() : "";
+    return accountId ? { kind: "account", providerId, accountId } : null;
+  }
+  if (target.kind === "account-group") {
+    const group = typeof target.group === "string" ? target.group.trim() : "";
+    return group ? { kind: "account-group", providerId, group } : null;
+  }
+  if (target.kind === "account-pool") return { kind: "account-pool", providerId };
+  if (target.kind === "provider") {
+    const keyId = typeof target.keyId === "string" ? target.keyId.trim() : "";
+    return keyId ? { kind: "provider", providerId, keyId } : { kind: "provider", providerId };
+  }
+  return null;
+}
+function normalizeGatewayModelMappings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const mappings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const source = typeof value.source === "string" ? value.source.trim() : "";
+    const target = typeof value.target === "string" ? value.target.trim() : "";
+    if (!source || !target) continue;
+    mappings.push({ source, target });
+  }
+  return mappings;
+}
+function hasConfiguredLegacyModels(config) {
+  return Object.values(config.modelMap ?? {}).some((value) => typeof value === "string" && value.trim()) || Boolean(config.models?.some((value) => typeof value === "string" && value.trim())) || Boolean(config.defaultModel?.trim()) || Boolean(config.backgroundModel?.trim()) || Boolean(Object.values(config.prefixTargets ?? {}).some((value) => value?.trim()));
+}
+function splitModelRef(ref) {
+  if (typeof ref !== "string") return null;
+  const idx = ref.indexOf(",");
+  if (idx <= 0) return null;
+  const providerId = ref.slice(0, idx).trim();
+  const modelId = ref.slice(idx + 1).trim();
+  return providerId && modelId ? { providerId, modelId } : null;
+}
+function legacyTarget(config, providerId) {
+  if (config.useSubscription) {
+    if (config.boundAccountId) {
+      return { kind: "account", providerId, accountId: config.boundAccountId };
+    }
+    if (config.boundAccountGroup) {
+      return { kind: "account-group", providerId, group: config.boundAccountGroup };
+    }
+    return { kind: "account-pool", providerId };
+  }
+  return config.boundKeyId ? { kind: "provider", providerId, keyId: config.boundKeyId } : { kind: "provider", providerId };
+}
+function legacyEndpointToBindings(config) {
+  const fallback = config.boundAccountId && config.boundAccountFallbackPolicy === "strict" ? "fail" : "next";
+  const byProvider = /* @__PURE__ */ new Map();
+  const routeFor = (providerId) => {
+    const existing = byProvider.get(providerId);
+    if (existing) return existing;
+    const created = {
+      id: `legacy-${config.endpoint}-${providerId}`,
+      name: `${config.endpoint} \xB7 ${providerId}`,
+      enabled: true,
+      keyScope: "all",
+      endpoint: config.endpoint,
+      target: legacyTarget(config, providerId),
+      fallback,
+      modelMode: "mapped"
+    };
+    byProvider.set(providerId, created);
+    return created;
+  };
+  for (const [kind, ref] of Object.entries(config.modelMap ?? {})) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.modelMap = { ...route.modelMap, [kind]: ref };
+  }
+  for (const ref of config.models ?? []) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.models = [...route.models ?? [], ref];
+  }
+  for (const [prefix, ref] of Object.entries(config.prefixTargets ?? {})) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.dispatchMode = "prefix";
+    route.prefixTargets = { ...route.prefixTargets, [prefix]: ref };
+  }
+  for (const [field, ref] of [
+    ["defaultModel", config.defaultModel],
+    ["backgroundModel", config.backgroundModel]
+  ]) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route[field] = ref;
+    if (config.backgroundModelIds?.length) {
+      route.backgroundModelIds = [...config.backgroundModelIds];
+    }
+  }
+  return [...byProvider.values()];
+}
+function legacyEndpointsToBindings(endpoints) {
+  return endpoints.filter((endpoint) => hasConfiguredLegacyModels(endpoint)).flatMap((endpoint) => legacyEndpointToBindings(endpoint));
+}
+function normalizeGatewayBindings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const bindings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const id = typeof value.id === "string" ? value.id.trim() : "";
+    const name = typeof value.name === "string" ? value.name.trim() : "";
+    const endpoint = value.endpoint;
+    const target = normalizeBindingTarget(value.target);
+    if (!id || seen.has(id) || !name || !ALL_ENDPOINTS.includes(endpoint) || !target) continue;
+    seen.add(id);
+    const normalizedRoute = normalizeEndpointConfig({
+      ...value,
+      endpoint,
+      useSubscription: target.kind !== "provider"
+    });
+    const apiKeyIds = Array.isArray(value.apiKeyIds) ? [...new Set(value.apiKeyIds.filter((key) => typeof key === "string" && key.trim() !== "").map((key) => key.trim()))] : [];
+    const keyScope = value.keyScope === "selected" ? "selected" : value.keyScope === "all" ? "all" : apiKeyIds.length > 0 ? "selected" : "all";
+    const modelMappings = normalizeGatewayModelMappings(value.modelMappings);
+    const modelMode = value.modelMode === "passthrough" ? "passthrough" : value.modelMode === "mapped" ? "mapped" : modelMappings.length > 0 || hasConfiguredLegacyModels(normalizedRoute) ? "mapped" : "passthrough";
+    const priority = typeof value.priority === "number" && Number.isFinite(value.priority) ? Math.max(0, Math.min(1e4, Math.round(value.priority))) : void 0;
+    const binding = {
+      id,
+      name,
+      enabled: value.enabled !== false,
+      keyScope,
+      endpoint,
+      target,
+      // Legacy `'global'` meant "yield to the removed global endpoint fallback";
+      // it now yields to the next matching route, which is the same default.
+      fallback: value.fallback === "fail" ? "fail" : "next",
+      modelMode
+    };
+    if (apiKeyIds.length > 0) binding.apiKeyIds = apiKeyIds;
+    if (modelMappings.length > 0) binding.modelMappings = modelMappings;
+    if (priority !== void 0) binding.priority = priority;
+    if (normalizedRoute.modelMap) binding.modelMap = normalizedRoute.modelMap;
+    if (normalizedRoute.models) binding.models = normalizedRoute.models;
+    if (normalizedRoute.dispatchMode) binding.dispatchMode = normalizedRoute.dispatchMode;
+    if (normalizedRoute.prefixTargets) binding.prefixTargets = normalizedRoute.prefixTargets;
+    if (normalizedRoute.defaultModel !== void 0) binding.defaultModel = normalizedRoute.defaultModel;
+    if (normalizedRoute.backgroundModel !== void 0) binding.backgroundModel = normalizedRoute.backgroundModel;
+    if (normalizedRoute.backgroundModelIds) binding.backgroundModelIds = normalizedRoute.backgroundModelIds;
+    bindings.push(binding);
+  }
+  return bindings;
+}
 function defaultServerConfig() {
   const queues = normalizeQueueSegments(void 0);
   return {
     enabled: false,
     networkBinding: false,
     endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings: [],
     port: DEFAULT_OUTBOUND_PORT,
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(void 0),
     accountProbe: normalizeAccountProbe(void 0),
+    allowanceScheduling: normalizeAllowanceScheduling(void 0),
     audit: normalizeAudit(void 0),
     billing: normalizeBilling(void 0),
     fingerprint: normalizeFingerprint(void 0),
@@ -2348,17 +2934,20 @@ function normalizeServerConfig(raw) {
     }
   }
   const queues = normalizeQueueSegments(raw);
+  const legacyEndpoints = ALL_ENDPOINTS.map((ep) => byEndpoint.get(ep) ?? defaultEndpointConfig(ep));
+  const persistedBindings = normalizeGatewayBindings(raw.bindings);
+  const bindings = persistedBindings.length > 0 ? persistedBindings : normalizeGatewayBindings(legacyEndpointsToBindings(legacyEndpoints));
   const config = {
     enabled: raw.enabled === true,
     networkBinding: raw.networkBinding === true,
-    endpoints: ALL_ENDPOINTS.map(
-      (ep) => byEndpoint.get(ep) ?? defaultEndpointConfig(ep)
-    ),
+    endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings,
     port: raw.port ?? base.port,
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(raw),
     accountProbe: normalizeAccountProbe(raw),
+    allowanceScheduling: normalizeAllowanceScheduling(raw),
     audit: normalizeAudit(raw),
     billing: normalizeBilling(raw),
     fingerprint: normalizeFingerprint(raw),
@@ -2384,11 +2973,13 @@ function mergeServerConfig(current, patch) {
     enabled: patch.enabled ?? current.enabled,
     networkBinding: patch.networkBinding ?? current.networkBinding,
     endpoints: patch.endpoints ?? current.endpoints,
+    bindings: patch.bindings ?? current.bindings,
     port: patch.port ?? current.port,
     userMessageQueue: patch.userMessageQueue ?? current.userMessageQueue,
     concurrencyQueue: patch.concurrencyQueue ?? current.concurrencyQueue,
     accountHealth: patch.accountHealth ?? current.accountHealth,
     accountProbe: patch.accountProbe ?? current.accountProbe,
+    allowanceScheduling: patch.allowanceScheduling ?? current.allowanceScheduling,
     audit: patch.audit ?? current.audit,
     billing: patch.billing ?? current.billing,
     // Proxy is layer-replaced (not deep-merged): a PUT carrying `proxy` swaps the
@@ -2406,6 +2997,167 @@ function mergeServerConfig(current, patch) {
   });
 }
 
+// src/outbound-api/gatewayBindingResolver.ts
+var MESSAGE_FALLBACK_KINDS = ["sonnet", "opus", "haiku", "fable"];
+function nonBlank(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function gatewayBindingAllowsKey(binding, apiKeyId) {
+  const scope = binding.keyScope ?? (binding.apiKeyIds?.length ? "selected" : "all");
+  return scope === "all" || Boolean(binding.apiKeyIds?.includes(apiKeyId));
+}
+function wildcardMatches(pattern, value) {
+  const escaped = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`, "iu").test(value);
+}
+function resolveGatewayModelMapping(mappings, requestedModel) {
+  if (!nonBlank(requestedModel)) return void 0;
+  const wanted = requestedModel.trim();
+  const exact = (mappings ?? []).find(
+    (mapping) => nonBlank(mapping.source) && !mapping.source.includes("*") && mapping.source.trim().toLocaleLowerCase() === wanted.toLocaleLowerCase()
+  );
+  if (exact && nonBlank(exact.target)) return exact.target.trim();
+  const wildcard = (mappings ?? []).find(
+    (mapping) => nonBlank(mapping.source) && mapping.source.includes("*") && wildcardMatches(mapping.source.trim(), wanted)
+  );
+  return wildcard && nonBlank(wildcard.target) ? wildcard.target.trim() : void 0;
+}
+function routeCanServe(binding, requestedModel, role) {
+  if (binding.modelMode === "passthrough") return nonBlank(requestedModel);
+  if (binding.modelMappings?.length) {
+    return nonBlank(resolveGatewayModelMapping(binding.modelMappings, requestedModel));
+  }
+  if (isKindMappedEndpoint(binding.endpoint)) {
+    const map = binding.modelMap ?? {};
+    const kind = detectModelKind(binding.endpoint, requestedModel);
+    if (kind && nonBlank(map[kind])) return true;
+    if (binding.endpoint === "messages") {
+      return MESSAGE_FALLBACK_KINDS.some((candidate) => nonBlank(map[candidate]));
+    }
+    return nonBlank(map.codex);
+  }
+  if (binding.endpoint === "chat" && binding.dispatchMode === "prefix") {
+    return resolvePrefixTarget(binding.prefixTargets, requestedModel) !== null;
+  }
+  if (binding.endpoint === "chat") {
+    if (!requestedModel) return false;
+    const wanted = requestedModel.trim().toLowerCase();
+    return (binding.models ?? []).some((ref) => modelIdOf(ref)?.toLowerCase() === wanted);
+  }
+  return role === "background" ? nonBlank(binding.backgroundModel) : nonBlank(binding.defaultModel);
+}
+function modelIdOf(ref) {
+  if (!nonBlank(ref)) return void 0;
+  const trimmed = ref.trim();
+  const comma = trimmed.indexOf(",");
+  const modelId = comma >= 0 ? trimmed.slice(comma + 1).trim() : trimmed;
+  return modelId || void 0;
+}
+function targetProviderId(target) {
+  return target.providerId.trim();
+}
+function targetRef(target, ref) {
+  const modelId = modelIdOf(ref) ?? "";
+  return modelId ? `${targetProviderId(target)},${modelId}` : "";
+}
+function targetRefs(target, refs) {
+  return (refs ?? []).map((ref) => targetRef(target, ref)).filter(nonBlank);
+}
+function targetPrefixRefs(target, refs) {
+  if (!refs) return void 0;
+  const mapped = {};
+  for (const kind of ["claude", "gpt", "gemini"]) {
+    const ref = targetRef(target, refs[kind]);
+    if (ref) mapped[kind] = ref;
+  }
+  return mapped.claude || mapped.gpt || mapped.gemini ? mapped : void 0;
+}
+function applySingleModel(config, binding, targetModel) {
+  const ref = targetRef(binding.target, targetModel);
+  if (!ref) return;
+  if (isKindMappedEndpoint(binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      modelKindsForEndpoint(binding.endpoint).map((kind) => [kind, ref])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = [ref];
+    config.dispatchMode = "list";
+  } else {
+    config.defaultModel = ref;
+    config.backgroundModel = ref;
+  }
+}
+function gatewayBindingToEndpointConfig(binding, requestedModel) {
+  const target = binding.target;
+  const config = {
+    endpoint: binding.endpoint,
+    useSubscription: target.kind !== "provider"
+  };
+  const usesGenericModelHandling = binding.modelMode === "passthrough" || Boolean(binding.modelMappings?.length);
+  const dynamicModel = binding.modelMode === "passthrough" ? requestedModel : resolveGatewayModelMapping(binding.modelMappings, requestedModel);
+  if (usesGenericModelHandling) {
+    if (nonBlank(dynamicModel)) applySingleModel(config, binding, dynamicModel);
+  } else if (isKindMappedEndpoint(binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      Object.entries(binding.modelMap ?? {}).map(([kind, ref]) => [kind, targetRef(target, ref)])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = targetRefs(target, binding.models);
+    if (binding.dispatchMode === "prefix") {
+      config.dispatchMode = "prefix";
+      config.prefixTargets = targetPrefixRefs(target, binding.prefixTargets);
+    }
+  } else {
+    config.defaultModel = targetRef(target, binding.defaultModel);
+    config.backgroundModel = targetRef(target, binding.backgroundModel);
+    if (binding.backgroundModelIds) config.backgroundModelIds = [...binding.backgroundModelIds];
+  }
+  if (target.kind === "account") {
+    config.boundAccountId = target.accountId;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "account-group") {
+    config.boundAccountGroup = target.group;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "provider" && target.keyId) {
+    config.boundKeyId = target.keyId;
+    config.boundKeyFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  }
+  return config;
+}
+function candidateGatewayBindings(bindings, apiKeyId, endpoint) {
+  const candidates = (bindings ?? []).filter(
+    (binding) => binding.enabled && binding.endpoint === endpoint && gatewayBindingAllowsKey(binding, apiKeyId)
+  );
+  const scopeOf = (binding) => binding.keyScope ?? (binding.apiKeyIds?.length ? "selected" : "all");
+  const scoped = candidates.filter((binding) => scopeOf(binding) === "selected");
+  const pool = scoped.length > 0 ? scoped : candidates.filter((binding) => scopeOf(binding) === "all");
+  return pool.sort(
+    (left, right) => (left.priority ?? 100) - (right.priority ?? 100) || left.id.localeCompare(right.id)
+  );
+}
+function candidateBackgroundModelIds(bindings, apiKeyId, endpoint) {
+  const ids = [
+    ...new Set(
+      candidateGatewayBindings(bindings, apiKeyId, endpoint).flatMap(
+        (binding) => binding.backgroundModelIds ?? []
+      )
+    )
+  ];
+  return ids.length > 0 ? ids : void 0;
+}
+function resolveGatewayBinding(input) {
+  const candidates = candidateGatewayBindings(input.bindings, input.apiKeyId, input.endpoint);
+  const binding = candidates.find(
+    (candidate) => candidate.fallback === "fail" || routeCanServe(candidate, input.requestedModel, input.role)
+  ) ?? candidates[0];
+  if (!binding) return { source: "none" };
+  return {
+    source: "binding",
+    binding,
+    config: gatewayBindingToEndpointConfig(binding, input.requestedModel)
+  };
+}
+
 // src/outbound-api/outboundApiKeyAuth.ts
 import { createHash, randomBytes as randomBytes2 } from "crypto";
 
@@ -2498,6 +3250,27 @@ async function createNamedKey(db, name) {
     plaintextOnce: secret
   };
 }
+async function createIntegrationKey(db, name, allowedEndpoints = ["responses", "messages"]) {
+  const secret = generateSecret();
+  const id = newKeyId();
+  const prefix = keyPrefix(secret);
+  const row = await db.outboundApiKeysCreate({
+    id,
+    name,
+    keyHash: hashKey(secret),
+    keyPrefix: prefix,
+    kind: "integration",
+    allowedEndpoints: [...new Set(allowedEndpoints)],
+    loopbackOnly: true
+  });
+  return {
+    id: row.id,
+    name: row.name,
+    keyPrefix: row.keyPrefix,
+    createdAt: row.createdAt,
+    plaintextOnce: secret
+  };
+}
 function extractCostLimits(row) {
   const limits = {};
   if (row.dailyCostLimitUsd != null) limits.dailyUsd = row.dailyCostLimitUsd;
@@ -2520,7 +3293,12 @@ function extractModelRestriction(row) {
   };
 }
 function toVerifiedKey(row) {
-  const key = { id: row.id };
+  const key = {
+    id: row.id,
+    kind: row.kind,
+    allowedEndpoints: row.allowedEndpoints,
+    loopbackOnly: row.loopbackOnly
+  };
   if (row.maxConcurrency !== void 0 && row.maxConcurrency !== null) {
     key.maxConcurrency = row.maxConcurrency;
   }
@@ -3164,10 +3942,10 @@ function getFallbackRedeemLimiter() {
   fallbackRedeemLimiter ??= new OutboundRateLimiter({ maxRequests: 10, windowMs: 6e4 });
   return fallbackRedeemLimiter;
 }
-function writeJsonError(res, status, message, headers = {}) {
+function writeJsonError(res, status, message, headers = {}, details = {}) {
   if (res.headersSent) return;
   res.writeHead(status, { "Content-Type": "application/json", ...headers });
-  res.end(JSON.stringify({ error: { type: "outbound_api_error", message } }));
+  res.end(JSON.stringify({ error: { type: "outbound_api_error", message, ...details } }));
 }
 function writeCostLimitError(res, scope, limitUsd, spentUsd) {
   if (res.headersSent) return;
@@ -3211,6 +3989,11 @@ function extractPresentedKey(req) {
   const g = Array.isArray(goog) ? goog[0] : goog;
   return g?.trim() || void 0;
 }
+function isLoopbackPeer(address) {
+  if (!address) return false;
+  const normalized = address.toLowerCase().split("%")[0];
+  return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.") || normalized.startsWith("::ffff:127.");
+}
 function selectEndpoint(method, url) {
   if (method !== "POST" || !url) return null;
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
@@ -3234,9 +4017,33 @@ function isModelsListRequest(url) {
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
   return path.endsWith("/models");
 }
-function writeChatModelsList(res, config) {
-  const chat = config.endpoints.find((e) => e.endpoint === "chat");
-  const data = (chat?.models ?? []).map((ref) => parseModelRef(ref)).filter((p) => p !== null).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
+function writeModelsList(res, config, apiKeyId, allowedEndpoints) {
+  const refs = [];
+  const endpointConfigs = [];
+  for (const endpoint of ["chat", "responses", "messages", "gemini"]) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint)) continue;
+    endpointConfigs.push(
+      ...candidateGatewayBindings(config.bindings, apiKeyId, endpoint).map(
+        (binding) => gatewayBindingToEndpointConfig(binding)
+      )
+    );
+  }
+  for (const endpoint of endpointConfigs) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint.endpoint)) continue;
+    if (endpoint.endpoint === "chat") refs.push(...endpoint.models ?? []);
+    else if (endpoint.endpoint === "messages" || endpoint.endpoint === "responses") {
+      refs.push(...Object.values(endpoint.modelMap ?? {}));
+    } else {
+      if (endpoint.defaultModel) refs.push(endpoint.defaultModel);
+      if (endpoint.backgroundModel) refs.push(endpoint.backgroundModel);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const data = refs.map((ref) => parseModelRef(ref)).filter((p) => p !== null).filter((p) => {
+    if (seen.has(p.modelId)) return false;
+    seen.add(p.modelId);
+    return true;
+  }).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ object: "list", data }));
 }
@@ -3270,7 +4077,15 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
   const verified = verification.key;
   if (audit) audit.keyId = verified.id;
   if (billing) billing.keyId = verified.id;
+  if (verified.loopbackOnly && !isLoopbackPeer(req.socket?.remoteAddress)) {
+    writeJsonError(res, 403, "This integration key is restricted to loopback clients");
+    return;
+  }
   if (isRedeemRequest(req.method, req.url)) {
+    if (verified.kind === "integration") {
+      writeJsonError(res, 403, "Integration keys cannot redeem vouchers");
+      return;
+    }
     await handleVoucherRedeem(
       req,
       res,
@@ -3292,7 +4107,11 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     return;
   }
   if (req.method === "GET" && isModelsListRequest(req.url)) {
-    writeChatModelsList(res, config);
+    if (verified.allowedEndpoints && verified.allowedEndpoints.length === 0) {
+      writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+      return;
+    }
+    writeModelsList(res, config, verified.id, verified.allowedEndpoints);
     return;
   }
   const endpoint = selectEndpoint(req.method, req.url);
@@ -3300,9 +4119,12 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
     return;
   }
-  const endpointConfig = config.endpoints.find((e) => e.endpoint === endpoint);
-  if (!endpointConfig) {
-    writeJsonError(res, 503, `endpoint '${endpoint}' is not configured`);
+  if (verified.allowedEndpoints && !verified.allowedEndpoints.includes(endpoint)) {
+    writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+    return;
+  }
+  if (candidateGatewayBindings(config.bindings, verified.id, endpoint).length === 0) {
+    writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
     return;
   }
   if (verified.costLimits && deps.keySpendTracker) {
@@ -3375,23 +4197,40 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const urlModel = extractGeminiModelFromUrl(req.url);
       if (urlModel) parsedBody["model"] = urlModel;
     }
-    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}` : null;
+    const requestedModel = extractRequestedModel(ingressFormat, parsedBody);
+    const role = isKindMappedEndpoint(endpoint) || endpoint === "chat" ? void 0 : detectRequestRole(ingressFormat, parsedBody, {
+      // Role detection precedes the route pick (the pick consumes the
+      // role), so the hint is the union across the candidate routes.
+      backgroundModelIds: candidateBackgroundModelIds(config.bindings, verified.id, endpoint)
+    });
+    const bindingResolution = resolveGatewayBinding({
+      bindings: config.bindings,
+      apiKeyId: verified.id,
+      endpoint,
+      requestedModel,
+      role
+    });
+    if (bindingResolution.source === "none") {
+      writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
+      return;
+    }
+    const effectiveEndpointConfig = bindingResolution.config;
+    const bindingAffinitySuffix = `:${bindingResolution.binding.id}`;
+    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}${bindingAffinitySuffix}` : null;
     const resolved = isKindMappedEndpoint(endpoint) || endpoint === "chat" ? await resolveRoute({
-      config: endpointConfig,
+      config: effectiveEndpointConfig,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
       // Capture the ORIGINAL requested id BEFORE any downstream swap; for
       // kind-mapped endpoints it selects the kind AND is stamped onto
       // `route.requestedModel`; for chat it is matched against the list.
-      requestedModel: extractRequestedModel(ingressFormat, parsedBody),
+      requestedModel,
       // Attribution: stamp the verified named-key id onto the route.
       apiKeyId: verified.id
     }) : await resolveRoute({
-      config: endpointConfig,
-      role: detectRequestRole(ingressFormat, parsedBody, {
-        backgroundModelIds: endpointConfig.backgroundModelIds
-      }),
+      config: effectiveEndpointConfig,
+      role,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
@@ -3452,12 +4291,29 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const replay = makeReplayRequest(req, rawBody);
       await routeRequest(replay, res, routeMap, deps.proxyDeps);
     } catch (err) {
+      if (isBoundAccountSelectionError(err)) {
+        const headers = {};
+        if (err.status === 429 && err.resumeAt) {
+          const resumeMs = Date.parse(err.resumeAt);
+          if (Number.isFinite(resumeMs)) {
+            headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+          }
+        }
+        writeJsonError(
+          res,
+          err.status,
+          boundAccountSelectionMessage(err.reason),
+          headers,
+          { code: err.code, reason: err.reason }
+        );
+        return;
+      }
       const message = serializeError(err);
       if (deps.logger) deps.logger.error("[OutboundApi] dispatch error:", message);
       else console.error("[OutboundApi] dispatch error:", message);
       emitWebhookEvent({ kind: "server.error", at: Date.now(), message });
       if (audit) audit.error = message;
-      writeJsonError(res, 502, message);
+      writeJsonError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, message);
     } finally {
       routeMap.removeRoute(token);
       if (releaseSerial) releaseSerial();
@@ -3481,16 +4337,6 @@ function makeReplayRequest(req, rawBody) {
 var DEFAULT_OUTBOUND_PORT = 8765;
 var LOOPBACK_ADDR = "127.0.0.1";
 var LAN_ADDR = "0.0.0.0";
-var OutboundApiConfigError = class extends Error {
-  missing;
-  constructor(missing) {
-    super(
-      "Outbound API server cannot start: incomplete model-kind configuration \u2014 " + missing.map((m) => `${m.endpoint} missing [${m.missingKinds.join(", ")}]`).join("; ")
-    );
-    this.name = "OutboundApiConfigError";
-    this.missing = missing;
-  }
-};
 var OutboundApiServer = class {
   constructor(deps, onPortChange) {
     this.deps = deps;
@@ -3502,6 +4348,7 @@ var OutboundApiServer = class {
   boundPort = 0;
   boundAddr = LOOPBACK_ADDR;
   endpoints = [];
+  bindings = [];
   userMessageQueue;
   concurrencyQueue;
   voucherConfig;
@@ -3528,6 +4375,7 @@ var OutboundApiServer = class {
    */
   async applyConfig(input) {
     this.endpoints = input.endpoints;
+    this.bindings = input.bindings ?? [];
     this.userMessageQueue = input.userMessageQueue;
     this.concurrencyQueue = input.concurrencyQueue;
     this.voucherConfig = input.voucher;
@@ -3537,16 +4385,6 @@ var OutboundApiServer = class {
       await this.stop();
       return;
     }
-    const missing = validateServerModelConfig({
-      enabled: true,
-      networkBinding: input.networkBinding,
-      endpoints: input.endpoints,
-      port: input.port
-    });
-    if (missing.length > 0) {
-      await this.stop();
-      throw new OutboundApiConfigError(missing);
-    }
     const running = this.server !== null;
     const bindChanged = running && (this.boundAddr !== wantAddr || this.boundPort !== wantPort);
     if (running && !bindChanged) {
@@ -3595,6 +4433,7 @@ var OutboundApiServer = class {
   }
   /** Per-request handler. Auth is enforced on EVERY request (incl. loopback). */
   onRequest(req, res) {
+    if (req.url) req.url = normalizeDoubledEndpointPath(req.url);
     if (this.deps.healthReportProvider && this.tryServeHealth(req, res)) return;
     handleOutboundRequest(
       req,
@@ -3602,6 +4441,7 @@ var OutboundApiServer = class {
       this.deps,
       {
         endpoints: this.endpoints,
+        bindings: this.bindings,
         userMessageQueue: this.userMessageQueue,
         concurrencyQueue: this.concurrencyQueue,
         voucher: this.voucherConfig
@@ -3717,6 +4557,16 @@ function firstLanIPv4() {
   }
   return null;
 }
+function normalizeDoubledEndpointPath(url) {
+  const queryIdx = url.indexOf("?");
+  const path = queryIdx === -1 ? url : url.slice(0, queryIdx);
+  const query = queryIdx === -1 ? "" : url.slice(queryIdx);
+  const collapsed = path.replace(
+    /^(.*?)(\/v1\/(?:messages|responses|chat\/completions))\2$/,
+    "$1$2"
+  );
+  return collapsed + query;
+}
 
 // src/outbound-api/keySpendTracker.ts
 function startOfLocalDay(ts) {
@@ -3823,7 +4673,7 @@ async function callOpenAICompletion(provider, apiKey, options, logger) {
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: false
     // For now, non-streaming only
@@ -3874,7 +4724,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
     const nonSystemMessages = options.messages.filter((m) => m.role !== "system");
     const anthropicRequest2 = {
       model: options.model,
-      max_tokens: options.maxTokens || 16384,
+      max_tokens: options.maxTokens ?? 16384,
       temperature: options.temperature,
       ...systemMessages.length > 0 ? { system: systemMessages.map((m) => m.content).join("\n\n") } : {},
       messages: nonSystemMessages.map((m) => convertMessageToAnthropic(m)),
@@ -3920,7 +4770,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
       content: m.content
     })),
     // Anthropic requires max_tokens; use 16384 default if not explicitly set
-    max_tokens: options.maxTokens || 16384,
+    max_tokens: options.maxTokens ?? 16384,
     temperature: options.temperature,
     stream: false
   };
@@ -3975,7 +4825,7 @@ async function callGeminiCompletion(provider, apiKey, options, logger) {
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4044,7 +4894,7 @@ async function callOpenAIResponseCompletion(provider, apiKey, options, logger) {
     model: options.model,
     input,
     stream: false,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4109,7 +4959,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: true
   };
@@ -4168,7 +5018,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
 async function streamAnthropicCompletion(provider, apiKey, options, messageId, callbacks, logger) {
   const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
   const MAX_TOKENS_FOR_THINKING = 16384;
-  let effectiveMaxTokens = options.maxTokens || 16384;
+  let effectiveMaxTokens = options.maxTokens ?? 16384;
   const thinkingMaxTokens = options.thinkLevel && options.thinkLevel !== "none" ? Math.min(effectiveMaxTokens, MAX_TOKENS_FOR_THINKING) : effectiveMaxTokens;
   const thinkingConfig = options.thinkLevel && options.thinkLevel !== "none" ? buildAnthropicThinking(options.model, options.thinkLevel, thinkingMaxTokens) : void 0;
   if (thinkingConfig) {
@@ -4280,7 +5130,7 @@ async function streamGeminiCompletion(provider, apiKey, options, messageId, call
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4344,7 +5194,7 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
     model: options.model,
     input,
     stream: true,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4401,7 +5251,7 @@ import {
   getClaudeMaxTokens,
   isReasoningModel
 } from "@omnicross/contracts/thinking-config";
-async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens) {
+async function resolveEffectiveMaxTokens(llmConfig, _getProvider, logger, _providerId, _modelId, sessionMaxTokens) {
   if (sessionMaxTokens !== void 0 && sessionMaxTokens > 0) {
     logger.debug("Using session maxTokens", { sessionMaxTokens });
     return sessionMaxTokens;
@@ -4415,45 +5265,6 @@ async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, provide
   } catch (err) {
     logger.warn("Failed to get global params", err instanceof Error ? err : void 0);
   }
-  const MAX_TOKENS_CAP = 131072;
-  const provider = await getProvider(providerId);
-  if (provider) {
-    const modelConfig = provider.modelConfigs?.find((m) => m.id === modelId);
-    if (modelConfig?.maxTokens && modelConfig.maxTokens > 0) {
-      const cappedMaxTokens = Math.min(modelConfig.maxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using model config maxTokens", {
-        maxTokens: modelConfig.maxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-    if (provider.modelGroups) {
-      for (const group of provider.modelGroups) {
-        const model = group.models?.find((m) => m.id === modelId);
-        if (model?.maxTokens && model.maxTokens > 0) {
-          const cappedMaxTokens = Math.min(model.maxTokens, MAX_TOKENS_CAP);
-          logger.debug("Using modelGroup model maxTokens", {
-            maxTokens: model.maxTokens,
-            cappedMaxTokens
-          });
-          return cappedMaxTokens;
-        }
-      }
-    }
-  }
-  try {
-    const discoveredMaxTokens = await llmConfig.getDiscoveredModelMaxTokens(providerId, modelId);
-    if (discoveredMaxTokens && discoveredMaxTokens > 0) {
-      const cappedMaxTokens = Math.min(discoveredMaxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using discovered model maxTokens", {
-        discoveredMaxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-  } catch (err) {
-    logger.warn("Failed to get discovered model maxTokens", err instanceof Error ? err : void 0);
-  }
   logger.debug("No maxTokens configured, returning undefined");
   return void 0;
 }
@@ -4556,7 +5367,8 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
     }
     requestBody = {
       contents,
-      tools: options.tools
+      tools: options.tools,
+      ...options.maxTokens !== void 0 ? { generationConfig: { maxOutputTokens: options.maxTokens } } : {}
     };
     url = buildProviderApiUrl(provider, { model: actualModel, stream: true });
   } else if (apiFormat === "anthropic") {
@@ -4566,7 +5378,10 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      // Native Anthropic Messages requires this field. Resolve an absent
+      // caller cap to the model's real ceiling rather than a small constant —
+      // see `resolveAnthropicMaxTokens`.
+      max_tokens: resolveAnthropicMaxTokens(actualModel, options.maxTokens),
       temperature: options.temperature ?? 0.7,
       stream: true,
       tools: options.tools
@@ -4583,7 +5398,7 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
       temperature: options.temperature ?? 0.7,
       stream: true,
       tools: options.tools
@@ -5080,6 +5895,18 @@ function getSharedExecutor2() {
 async function resolveChainWithMain(llmConfig, providerId, model) {
   return resolveProviderChain(llmConfig, providerId, model);
 }
+function buildUnifiedCompletionRequest(actualModel, options, stream) {
+  return {
+    model: actualModel,
+    messages: options.messages.map((m) => ({
+      role: m.role,
+      content: m.content
+    })),
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
+    temperature: options.temperature,
+    stream
+  };
+}
 async function completeWithTransformers(options, llmConfig, getProvider, resolveApiKey2, completeFallback, logger, recording) {
   try {
     const routedInfo = await llmConfig.resolveRoutedModel(
@@ -5108,16 +5935,11 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
     if (!hasTransformers) {
       return completeFallback(options);
     }
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: options.stream ?? false
-    };
+    const unifiedRequest = buildUnifiedCompletionRequest(
+      actualModel,
+      options,
+      options.stream ?? false
+    );
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5247,16 +6069,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
     }
     const messageId = `msg_${Date.now()}`;
     callbacks.onStart?.(messageId);
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: true
-    };
+    const unifiedRequest = buildUnifiedCompletionRequest(actualModel, options, true);
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5791,9 +6604,10 @@ ${description}`;
    * Resolve effective max_tokens value with priority:
    * 1. Session settings (if provided)
    * 2. Global model parameters (if enabled)
-   * 3. Model's maxTokens from provider config
-   * 4. Discovered models cache (from API)
-   * 5. undefined - let API use its default
+   * 3. undefined - let API use its default
+   *
+   * Provider and discovery maxTokens values are capability metadata, not
+   * implicit per-request output limits.
    */
   async resolveEffectiveMaxTokens(providerId, modelId, sessionMaxTokens) {
     return resolveEffectiveMaxTokens(
@@ -5904,7 +6718,9 @@ export {
   getGeminiEndpointTransformer,
   readBody,
   relayResponse,
+  aggregateAnthropicSseToJsonBody,
   writeError,
+  writeBoundAccountError,
   resolvePoolBoundKey,
   extractRouteToken,
   isLoopbackAddress,
@@ -5916,6 +6732,8 @@ export {
   DEFAULT_USER_MESSAGE_QUEUE,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
+  normalizeAllowanceScheduling,
   normalizeAccountProbe,
   normalizeAudit,
   normalizeBilling,
@@ -5928,16 +6746,23 @@ export {
   normalizeWebhookSegment,
   normalizeQueueSegments,
   normalizePrefixTargets,
+  legacyEndpointsToBindings,
+  normalizeGatewayBindings,
   defaultServerConfig,
   normalizeServerConfig,
   loadServerConfig,
   saveServerConfig,
   mergeServerConfig,
+  gatewayBindingToEndpointConfig,
+  candidateGatewayBindings,
+  candidateBackgroundModelIds,
+  resolveGatewayBinding,
   computeKeyExpiry,
   checkKeyQuota,
   randomBase62,
   hashKey,
   createNamedKey,
+  createIntegrationKey,
   verifyKey,
   verifyPresentedKey,
   ConcurrencyQueueFullError,
@@ -5959,7 +6784,6 @@ export {
   isRedeemRequest,
   handleVoucherRedeem,
   DEFAULT_OUTBOUND_PORT,
-  OutboundApiConfigError,
   OutboundApiServer,
   formatUrls,
   startOfLocalDay,