@omnicross/core 0.1.4 → 0.1.6

package/dist/transformer/transformers.js

@@ -1,39 +1,33 @@
 import {
   BUILTIN_TRANSFORMER_NAMES,
   BuiltinTransformers,
-  DeepseekTransformer,
   getBuiltinTransformers,
   registerBuiltinTransformers
-} from "../chunk-VPBAUQ2M.js";
-import {
-  ReasoningTransformer
-} from "../chunk-ZJZAOKI7.js";
-import {
-  AnthropicTransformer
-} from "../chunk-FTQ7IQUC.js";
+} from "../chunk-VRFBB5DB.js";
 import {
   GeminiTransformer
-} from "../chunk-C7PSERMH.js";
+} from "../chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "../chunk-TIER4SUC.js";
+} from "../chunk-OEWZUX4G.js";
 import {
-  OpenCodeGoTransformer
-} from "../chunk-Z7LUNECE.js";
+  OpenAITransformer
+} from "../chunk-LB6EBS6Y.js";
+import {
+  AnthropicTransformer
+} from "../chunk-6CL5HTPQ.js";
 import {
   GeminiCodeAssistTransformer
-} from "../chunk-Z7Y2NPHY.js";
-import "../chunk-S4WBV25P.js";
+} from "../chunk-N5T4M4GU.js";
+import "../chunk-TOVPMMHM.js";
 export {
   AnthropicTransformer,
   BUILTIN_TRANSFORMER_NAMES,
   BuiltinTransformers,
-  DeepseekTransformer,
   GeminiCodeAssistTransformer,
   GeminiTransformer,
   OpenAIResponseTransformer,
-  OpenCodeGoTransformer,
-  ReasoningTransformer,
+  OpenAITransformer,
   getBuiltinTransformers,
   registerBuiltinTransformers
 };

package/dist/transformer/types.d.cts

@@ -145,6 +145,23 @@ interface UnifiedChatRequestMeta {
     engineOrigin?: 'completion' | 'claude-sdk' | 'claude-sdk-direct' | 'codex-ingress' | (string & {});
     /** The api-key-pool entry id selected for this request. */
     apiKeyId?: string | null;
+    /**
+     * codex custom-tool protocol state, recorded while DECODING a Responses
+     * request and read back while ENCODING the response.
+     *
+     * codex declares its tools in an `additional_tools` input item, where one of
+     * them (`exec`) is a `custom` tool taking FREE-FORM text rather than JSON
+     * arguments, and others live under a `namespace`. Neither concept exists in
+     * OpenAI-chat, so the decode flattens them into plain function tools and
+     * records here what has to be restored on the way back: which names must be
+     * re-encoded as `custom_tool_call` items, and which carry a namespace.
+     */
+    codexTools?: {
+        /** Tool names declared `type:'custom'` — re-encode as `custom_tool_call`. */
+        customToolNames?: string[];
+        /** Tool name → codex namespace, restored onto `function_call` items. */
+        toolNamespaces?: Record<string, string>;
+    };
 }
 /**
  * URL citation annotation

package/dist/transformer/types.d.ts

@@ -145,6 +145,23 @@ interface UnifiedChatRequestMeta {
     engineOrigin?: 'completion' | 'claude-sdk' | 'claude-sdk-direct' | 'codex-ingress' | (string & {});
     /** The api-key-pool entry id selected for this request. */
     apiKeyId?: string | null;
+    /**
+     * codex custom-tool protocol state, recorded while DECODING a Responses
+     * request and read back while ENCODING the response.
+     *
+     * codex declares its tools in an `additional_tools` input item, where one of
+     * them (`exec`) is a `custom` tool taking FREE-FORM text rather than JSON
+     * arguments, and others live under a `namespace`. Neither concept exists in
+     * OpenAI-chat, so the decode flattens them into plain function tools and
+     * records here what has to be restored on the way back: which names must be
+     * re-encoded as `custom_tool_call` items, and which carry a namespace.
+     */
+    codexTools?: {
+        /** Tool names declared `type:'custom'` — re-encode as `custom_tool_call`. */
+        customToolNames?: string[];
+        /** Tool name → codex namespace, restored onto `function_call` items. */
+        toolNamespaces?: Record<string, string>;
+    };
 }
 /**
  * URL citation annotation

package/dist/transformer.cjs

@@ -1,23 +1,22 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-FZ46M34D.cjs');
 
 
-var _chunk3OPYJG76cjs = require('./chunk-3OPYJG76.cjs');
+var _chunkIIRPUVPHcjs = require('./chunk-IIRPUVPH.cjs');
+require('./chunk-GBHYAGX3.cjs');
 
 
-var _chunkRGTR7CIOcjs = require('./chunk-RGTR7CIO.cjs');
-require('./chunk-DWKQZ2SK.cjs');
-require('./chunk-4VAVYUZS.cjs');
-require('./chunk-7YN22L2H.cjs');
-require('./chunk-SU2GCLAC.cjs');
-require('./chunk-C72S6TTV.cjs');
+var _chunk3OPYJG76cjs = require('./chunk-3OPYJG76.cjs');
 
 
-var _chunk46ZIFWYGcjs = require('./chunk-46ZIFWYG.cjs');
-require('./chunk-GBHYAGX3.cjs');
-require('./chunk-RSJ3TWJQ.cjs');
-require('./chunk-YGXJGRFI.cjs');
+var _chunk7AK7B36Bcjs = require('./chunk-7AK7B36B.cjs');
+require('./chunk-V4TXMEJS.cjs');
+require('./chunk-6VUQPOV3.cjs');
+require('./chunk-OF3BECU2.cjs');
+require('./chunk-4VLRHHFE.cjs');
+require('./chunk-OKMJLEXX.cjs');
+require('./chunk-KBM2W6UY.cjs');
 
 
 
 
-exports.TransformerChainExecutor = _chunk46ZIFWYGcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunkRGTR7CIOcjs.registerBuiltinTransformers;
+exports.TransformerChainExecutor = _chunkIIRPUVPHcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunk7AK7B36Bcjs.registerBuiltinTransformers;

package/dist/transformer.d.cts

@@ -6,5 +6,4 @@ import './transformer/transformers/AnthropicTransformer.cjs';
 import './transformer/transformers/GeminiCodeAssistTransformer.cjs';
 import './transformer/transformers/GeminiTransformer.cjs';
 import './transformer/transformers/OpenAIResponseTransformer.cjs';
-import './transformer/transformers/OpenCodeGoTransformer.cjs';
-import './transformer/transformers/ReasoningTransformer.cjs';
+import './transformer/transformers/OpenAITransformer.cjs';

package/dist/transformer.d.ts

@@ -6,5 +6,4 @@ import './transformer/transformers/AnthropicTransformer.js';
 import './transformer/transformers/GeminiCodeAssistTransformer.js';
 import './transformer/transformers/GeminiTransformer.js';
 import './transformer/transformers/OpenAIResponseTransformer.js';
-import './transformer/transformers/OpenCodeGoTransformer.js';
-import './transformer/transformers/ReasoningTransformer.js';
+import './transformer/transformers/OpenAITransformer.js';

package/dist/transformer.js

@@ -1,21 +1,20 @@
 import "./chunk-46RLHI7D.js";
+import {
+  TransformerChainExecutor
+} from "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
 import {
   TransformerService
 } from "./chunk-DK4A7DLE.js";
 import {
   registerBuiltinTransformers
-} from "./chunk-VPBAUQ2M.js";
-import "./chunk-ZJZAOKI7.js";
-import "./chunk-FTQ7IQUC.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-TIER4SUC.js";
-import "./chunk-Z7LUNECE.js";
-import {
-  TransformerChainExecutor
-} from "./chunk-G2UTNSGU.js";
-import "./chunk-MZNPGW5Q.js";
-import "./chunk-Z7Y2NPHY.js";
-import "./chunk-S4WBV25P.js";
+} from "./chunk-VRFBB5DB.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-OEWZUX4G.js";
+import "./chunk-LB6EBS6Y.js";
+import "./chunk-6CL5HTPQ.js";
+import "./chunk-N5T4M4GU.js";
+import "./chunk-TOVPMMHM.js";
 export {
   TransformerChainExecutor,
   TransformerService,

package/dist/{types-B8Arpxn0.d.cts → types-H3wGZSOo.d.cts}

@@ -8,7 +8,8 @@ import { L as Logger } from './logger-4GvQNzhE.cjs';
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
 import { P as ProviderProxy } from './ProviderProxy-CnMQYN59.cjs';
 import { ProviderProxyDeps } from './provider-proxy/types.cjs';
-import { c as KeySpend } from './keyPolicy-Cp0FntZl.cjs';
+import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.cjs';
+import { c as KeySpend } from './keyPolicy-zdWTu3CQ.cjs';
 
 /**
  * keySpendTracker — a cheap in-memory per-key accumulated-spend cache
@@ -313,15 +314,30 @@ interface EndpointRoutingConfig {
     /**
      * OPTIONAL subscription-mode binding to ONE specific subscription account id
      * (provider/subscription duality). Absent/blank ⇒ the provider's account pool
-     * auto-schedules (priority/LRU/health). When set and the account is
-     * schedulable it is used directly; otherwise the pool is the fallback.
+     * auto-schedules (priority/LRU/health). When set, strict mode requires this
+     * account to serve; the pool is a fallback only with the explicit policy below.
      */
     boundAccountId?: string;
+    /**
+     * What a bound account does when it cannot serve this request. Meaningful
+     * only with `boundAccountId`; normalization drops it otherwise. A legacy
+     * bound endpoint with no field migrates to `'strict'`. The pool is used only
+     * when this is explicitly set to `'pool'`.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /**
+     * Runtime-only account-group selector used by a {@link GatewayBinding}.
+     * Legacy endpoint persistence does not synthesize this field; it is projected
+     * from an independent binding immediately before route resolution.
+     */
+    boundAccountGroup?: string;
     /**
      * OPTIONAL provider-mode binding to ONE specific BYO key id (from the
      * provider's key pool). Absent/blank ⇒ the provider's default key / key pool.
      */
     boundKeyId?: string;
+    /** Strict by default; `'pool'` permits the provider's normal key pool. */
+    boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /**
      * OPTIONAL "background model id" override list (role-based `gemini` only).
      * When set, an incoming requested model id appearing in this list is
@@ -364,7 +380,7 @@ interface ConcurrencyQueueConfig {
  * Persisted + strictly validated like the queue segments; applied to the shared
  * `SubscriptionAccountHealth` tracker at daemon boot.
  *  - `overloadCooldownEnabled` default **true** — a 529 places the account in
- *    overload cooldown (ON by default; CRS ships it off).
+ *    overload cooldown (enabled by default).
  *  - `overloadCooldownMs`      default **600000** (10 min), valid `60000..3600000`.
  */
 interface AccountHealthConfig {
@@ -397,6 +413,89 @@ interface AccountProbeConfig {
     historySize: number;
     staggerMs: number;
 }
+/** A resource selected by a client-to-upstream gateway binding. */
+type GatewayBindingTarget = {
+    kind: 'account';
+    providerId: string;
+    accountId: string;
+} | {
+    kind: 'account-group';
+    providerId: string;
+    group: string;
+} | {
+    /**
+     * The provider's WHOLE subscription pool, with no account preference —
+     * plain priority/LRU/health scheduling. Distinct from `account-group`,
+     * which pins a preferred group, and from `provider`, which is BYO-key.
+     */
+    kind: 'account-pool';
+    providerId: string;
+} | {
+    kind: 'provider';
+    providerId: string;
+    keyId?: string;
+};
+/**
+ * Behavior when a binding cannot serve the requested model or credential.
+ * `next` yields to the next matching route (and lets a bound account fall back
+ * to its provider pool); `fail` keeps the route strict and errors instead.
+ */
+type GatewayBindingFallback = 'next' | 'fail';
+/** Which named API keys may enter a downstream route. */
+type GatewayBindingKeyScope = 'all' | 'selected';
+/** Whether the downstream model id is forwarded or explicitly remapped. */
+type GatewayBindingModelMode = 'passthrough' | 'mapped';
+/** One exact or `*` wildcard model-name rewrite owned by a downstream route. */
+interface GatewayModelMapping {
+    source: string;
+    target: ModelRef;
+}
+/**
+ * Independent client-to-upstream route aggregate.
+ *
+ * A binding belongs to exactly one endpoint and one upstream resource. Keeping
+ * it separate from account/provider DTOs lets the same resource participate in
+ * multiple client-key routes without changing its identity or secret shape.
+ */
+interface GatewayBinding {
+    id: string;
+    name: string;
+    enabled: boolean;
+    /** Legacy entries without this field keep the former all-vs-list behavior. */
+    keyScope?: GatewayBindingKeyScope;
+    /** Used only when `keyScope` resolves to `selected`. */
+    apiKeyIds?: string[];
+    endpoint: OutboundEndpoint;
+    target: GatewayBindingTarget;
+    /** Lower values win. Key-scoped bindings win before this comparison. */
+    priority?: number;
+    /** Next yields to the following matching route; fail keeps the binding strict. */
+    fallback: GatewayBindingFallback;
+    /** Empty passthrough routes preserve the client's requested model id. */
+    modelMode?: GatewayBindingModelMode;
+    /** Preferred generic mapping shape; legacy endpoint-specific fields remain readable. */
+    modelMappings?: GatewayModelMapping[];
+    modelMap?: Record<string, ModelRef>;
+    models?: ModelRef[];
+    dispatchMode?: ChatDispatchMode;
+    prefixTargets?: ModelPrefixTargets;
+    defaultModel?: ModelRef;
+    backgroundModel?: ModelRef;
+    backgroundModelIds?: string[];
+}
+/**
+ * Optional allowance-aware account scheduling. Default-off keeps allowance
+ * telemetry display-only. When enabled, only fresh Claude/Codex snapshots are
+ * considered: accounts above `demoteAtPercent` receive a temporary priority
+ * penalty; accounts above `pauseAtPercent` are excluded until the provider's
+ * reset/freshness deadline. Missing or stale data never excludes an account.
+ */
+interface AllowanceSchedulingConfig {
+    enabled: boolean;
+    demoteAtPercent: number;
+    pauseAtPercent: number;
+    priorityPenalty: number;
+}
 /**
  * Client-fingerprint segment (subscription-client-fingerprint #7). Opt-in,
  * default OFF: when disabled the claude-subscription outbound headers are
@@ -435,8 +534,19 @@ interface OutboundApiServerConfig {
     enabled: boolean;
     /** When true the listener binds `0.0.0.0` (LAN) instead of `127.0.0.1`. */
     networkBinding: boolean;
-    /** Per-endpoint routing config, one per endpoint (4 entries). */
+    /**
+     * LEGACY per-endpoint routing config, one per endpoint (4 entries). No longer
+     * a routing source: {@link normalizeServerConfig} projects any configured
+     * entry into {@link bindings} once and leaves these blank. Retained as the
+     * projection shape {@link EndpointRoutingConfig} and for embedders that build
+     * a config by hand.
+     */
     endpoints: EndpointRoutingConfig[];
+    /**
+     * Resource-centric routes — the SSOT for routing. Optional in the raw
+     * persisted shape; normalized Omnicross configs always carry an array.
+     */
+    bindings?: GatewayBinding[];
     /** Persisted port (fixed default; falls back to ephemeral on EADDRINUSE). */
     port?: number;
     /**
@@ -463,6 +573,8 @@ interface OutboundApiServerConfig {
      * boot; a change takes effect on restart. Default-off ⇒ no scheduler runs.
      */
     accountProbe?: AccountProbeConfig;
+    /** Default-off allowance-aware scheduling; hot-reloaded by the daemon. */
+    allowanceScheduling?: AllowanceSchedulingConfig;
     /**
      * Layered upstream-proxy segment (upstream-proxy). Optional; when absent no
      * global/provider proxy applies (direct egress). `normalizeServerConfig` drops
@@ -546,6 +658,12 @@ interface OutboundApiKeyInfo {
     createdAt: number;
     lastUsedAt: number | null;
     revoked: boolean;
+    /** Intended consumer. Existing rows default to a general client key. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list. Absent means every outbound endpoint. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** When true the key is rejected unless the TCP peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling for the outbound concurrency gate. Absent or
      * `0` = unlimited (the gate is bypassed entirely for this key).
@@ -571,7 +689,7 @@ interface OutboundApiKeyInfo {
     rateLimitWindowMs?: number | null;
     /** Master switch: when false/unset the model list is inert (no restriction). */
     enableModelRestriction?: boolean;
-    /** Restriction mode; absent ⇒ `'blacklist'` (CRS-parity). */
+    /** Restriction mode; absent ⇒ `'blacklist'`. */
     restrictionMode?: OutboundKeyModelRestrictionMode;
     /** The model-id list the mode acts on (bare modelIds; empty allowlist denies all). */
     restrictedModels?: string[];
@@ -637,6 +755,12 @@ interface OutboundKeyDbRow {
     createdAt: number;
     lastUsedAt: number | null;
     revokedAt: number | null;
+    /** Intended consumer. Existing rows without this field remain client keys. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list for least-privilege integration keys. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** Restrict use to requests whose direct socket peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling. Absent/`0` = unlimited = the concurrency gate
      * is bypassed for this key. Persisted by the daemon (`omnicross-uqc-daemon`).
@@ -676,6 +800,9 @@ interface OutboundKeyDb {
         keyHash: string;
         keyPrefix: string;
         createdAt?: number;
+        kind?: 'client' | 'integration';
+        allowedEndpoints?: OutboundEndpoint[];
+        loopbackOnly?: boolean;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -751,4 +878,4 @@ interface OutboundApiDeps {
     readonly logger?: Logger;
 }
 
-export { type AccountProbeConfig as A, toVoucherInfo as B, type ChatDispatchMode as C, voucherCodePrefix as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type ModelRef as G, type AccountHealthConfig as H, type OutboundKeyModelRestrictionMode as I, type KeySpendReader as K, type MessagesModelKind as M, type OutboundKeyDb as O, type RequestRole as R, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type ConcurrencyQueueConfig as a, type EndpointRoutingConfig as b, type KeySpendSeeder as c, KeySpendTracker as d, type KindMappedEndpoint as e, type ModelKind as f, type ModelPrefixTargets as g, type OutboundApiDeps as h, type OutboundApiKeyCreated as i, type OutboundApiKeyInfo as j, type OutboundApiServerConfig as k, type OutboundApiServerStatus as l, type OutboundEndpoint as m, type OutboundFormatUrls as n, type OutboundKeyActivationMode as o, type OutboundKeyDbRow as p, type OutboundKeyPolicy as q, type OutboundProxyConfig as r, type ResponsesModelKind as s, type VoucherDb as t, computeVoucherGrant as u, generateVoucherCode as v, hashVoucherCode as w, newVoucherId as x, startOfLocalDay as y, startOfLocalWeek as z };
+export { type AccountProbeConfig as A, computeVoucherGrant as B, type ChatDispatchMode as C, generateVoucherCode as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, hashVoucherCode as H, newVoucherId as I, startOfLocalDay as J, type KeySpendReader as K, startOfLocalWeek as L, type MessagesModelKind as M, toVoucherInfo as N, type OutboundKeyDb as O, voucherCodePrefix as P, type ModelRef as Q, type RequestRole as R, type AccountHealthConfig as S, type OutboundKeyModelRestrictionMode as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type AllowanceSchedulingConfig as a, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundProxyConfig as x, type ResponsesModelKind as y, type VoucherDb as z };

package/dist/{types-lgPYQuZS.d.ts → types-hsoKrVQS.d.ts}

@@ -8,7 +8,8 @@ import { L as Logger } from './logger-4GvQNzhE.js';
 import { ProviderConfigSource } from './ports/provider-config-source.js';
 import { P as ProviderProxy } from './ProviderProxy-C-xqrkKi.js';
 import { ProviderProxyDeps } from './provider-proxy/types.js';
-import { c as KeySpend } from './keyPolicy-Cp0FntZl.js';
+import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.js';
+import { c as KeySpend } from './keyPolicy-zdWTu3CQ.js';
 
 /**
  * keySpendTracker — a cheap in-memory per-key accumulated-spend cache
@@ -313,15 +314,30 @@ interface EndpointRoutingConfig {
     /**
      * OPTIONAL subscription-mode binding to ONE specific subscription account id
      * (provider/subscription duality). Absent/blank ⇒ the provider's account pool
-     * auto-schedules (priority/LRU/health). When set and the account is
-     * schedulable it is used directly; otherwise the pool is the fallback.
+     * auto-schedules (priority/LRU/health). When set, strict mode requires this
+     * account to serve; the pool is a fallback only with the explicit policy below.
      */
     boundAccountId?: string;
+    /**
+     * What a bound account does when it cannot serve this request. Meaningful
+     * only with `boundAccountId`; normalization drops it otherwise. A legacy
+     * bound endpoint with no field migrates to `'strict'`. The pool is used only
+     * when this is explicitly set to `'pool'`.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /**
+     * Runtime-only account-group selector used by a {@link GatewayBinding}.
+     * Legacy endpoint persistence does not synthesize this field; it is projected
+     * from an independent binding immediately before route resolution.
+     */
+    boundAccountGroup?: string;
     /**
      * OPTIONAL provider-mode binding to ONE specific BYO key id (from the
      * provider's key pool). Absent/blank ⇒ the provider's default key / key pool.
      */
     boundKeyId?: string;
+    /** Strict by default; `'pool'` permits the provider's normal key pool. */
+    boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /**
      * OPTIONAL "background model id" override list (role-based `gemini` only).
      * When set, an incoming requested model id appearing in this list is
@@ -364,7 +380,7 @@ interface ConcurrencyQueueConfig {
  * Persisted + strictly validated like the queue segments; applied to the shared
  * `SubscriptionAccountHealth` tracker at daemon boot.
  *  - `overloadCooldownEnabled` default **true** — a 529 places the account in
- *    overload cooldown (ON by default; CRS ships it off).
+ *    overload cooldown (enabled by default).
  *  - `overloadCooldownMs`      default **600000** (10 min), valid `60000..3600000`.
  */
 interface AccountHealthConfig {
@@ -397,6 +413,89 @@ interface AccountProbeConfig {
     historySize: number;
     staggerMs: number;
 }
+/** A resource selected by a client-to-upstream gateway binding. */
+type GatewayBindingTarget = {
+    kind: 'account';
+    providerId: string;
+    accountId: string;
+} | {
+    kind: 'account-group';
+    providerId: string;
+    group: string;
+} | {
+    /**
+     * The provider's WHOLE subscription pool, with no account preference —
+     * plain priority/LRU/health scheduling. Distinct from `account-group`,
+     * which pins a preferred group, and from `provider`, which is BYO-key.
+     */
+    kind: 'account-pool';
+    providerId: string;
+} | {
+    kind: 'provider';
+    providerId: string;
+    keyId?: string;
+};
+/**
+ * Behavior when a binding cannot serve the requested model or credential.
+ * `next` yields to the next matching route (and lets a bound account fall back
+ * to its provider pool); `fail` keeps the route strict and errors instead.
+ */
+type GatewayBindingFallback = 'next' | 'fail';
+/** Which named API keys may enter a downstream route. */
+type GatewayBindingKeyScope = 'all' | 'selected';
+/** Whether the downstream model id is forwarded or explicitly remapped. */
+type GatewayBindingModelMode = 'passthrough' | 'mapped';
+/** One exact or `*` wildcard model-name rewrite owned by a downstream route. */
+interface GatewayModelMapping {
+    source: string;
+    target: ModelRef;
+}
+/**
+ * Independent client-to-upstream route aggregate.
+ *
+ * A binding belongs to exactly one endpoint and one upstream resource. Keeping
+ * it separate from account/provider DTOs lets the same resource participate in
+ * multiple client-key routes without changing its identity or secret shape.
+ */
+interface GatewayBinding {
+    id: string;
+    name: string;
+    enabled: boolean;
+    /** Legacy entries without this field keep the former all-vs-list behavior. */
+    keyScope?: GatewayBindingKeyScope;
+    /** Used only when `keyScope` resolves to `selected`. */
+    apiKeyIds?: string[];
+    endpoint: OutboundEndpoint;
+    target: GatewayBindingTarget;
+    /** Lower values win. Key-scoped bindings win before this comparison. */
+    priority?: number;
+    /** Next yields to the following matching route; fail keeps the binding strict. */
+    fallback: GatewayBindingFallback;
+    /** Empty passthrough routes preserve the client's requested model id. */
+    modelMode?: GatewayBindingModelMode;
+    /** Preferred generic mapping shape; legacy endpoint-specific fields remain readable. */
+    modelMappings?: GatewayModelMapping[];
+    modelMap?: Record<string, ModelRef>;
+    models?: ModelRef[];
+    dispatchMode?: ChatDispatchMode;
+    prefixTargets?: ModelPrefixTargets;
+    defaultModel?: ModelRef;
+    backgroundModel?: ModelRef;
+    backgroundModelIds?: string[];
+}
+/**
+ * Optional allowance-aware account scheduling. Default-off keeps allowance
+ * telemetry display-only. When enabled, only fresh Claude/Codex snapshots are
+ * considered: accounts above `demoteAtPercent` receive a temporary priority
+ * penalty; accounts above `pauseAtPercent` are excluded until the provider's
+ * reset/freshness deadline. Missing or stale data never excludes an account.
+ */
+interface AllowanceSchedulingConfig {
+    enabled: boolean;
+    demoteAtPercent: number;
+    pauseAtPercent: number;
+    priorityPenalty: number;
+}
 /**
  * Client-fingerprint segment (subscription-client-fingerprint #7). Opt-in,
  * default OFF: when disabled the claude-subscription outbound headers are
@@ -435,8 +534,19 @@ interface OutboundApiServerConfig {
     enabled: boolean;
     /** When true the listener binds `0.0.0.0` (LAN) instead of `127.0.0.1`. */
     networkBinding: boolean;
-    /** Per-endpoint routing config, one per endpoint (4 entries). */
+    /**
+     * LEGACY per-endpoint routing config, one per endpoint (4 entries). No longer
+     * a routing source: {@link normalizeServerConfig} projects any configured
+     * entry into {@link bindings} once and leaves these blank. Retained as the
+     * projection shape {@link EndpointRoutingConfig} and for embedders that build
+     * a config by hand.
+     */
     endpoints: EndpointRoutingConfig[];
+    /**
+     * Resource-centric routes — the SSOT for routing. Optional in the raw
+     * persisted shape; normalized Omnicross configs always carry an array.
+     */
+    bindings?: GatewayBinding[];
     /** Persisted port (fixed default; falls back to ephemeral on EADDRINUSE). */
     port?: number;
     /**
@@ -463,6 +573,8 @@ interface OutboundApiServerConfig {
      * boot; a change takes effect on restart. Default-off ⇒ no scheduler runs.
      */
     accountProbe?: AccountProbeConfig;
+    /** Default-off allowance-aware scheduling; hot-reloaded by the daemon. */
+    allowanceScheduling?: AllowanceSchedulingConfig;
     /**
      * Layered upstream-proxy segment (upstream-proxy). Optional; when absent no
      * global/provider proxy applies (direct egress). `normalizeServerConfig` drops
@@ -546,6 +658,12 @@ interface OutboundApiKeyInfo {
     createdAt: number;
     lastUsedAt: number | null;
     revoked: boolean;
+    /** Intended consumer. Existing rows default to a general client key. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list. Absent means every outbound endpoint. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** When true the key is rejected unless the TCP peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling for the outbound concurrency gate. Absent or
      * `0` = unlimited (the gate is bypassed entirely for this key).
@@ -571,7 +689,7 @@ interface OutboundApiKeyInfo {
     rateLimitWindowMs?: number | null;
     /** Master switch: when false/unset the model list is inert (no restriction). */
     enableModelRestriction?: boolean;
-    /** Restriction mode; absent ⇒ `'blacklist'` (CRS-parity). */
+    /** Restriction mode; absent ⇒ `'blacklist'`. */
     restrictionMode?: OutboundKeyModelRestrictionMode;
     /** The model-id list the mode acts on (bare modelIds; empty allowlist denies all). */
     restrictedModels?: string[];
@@ -637,6 +755,12 @@ interface OutboundKeyDbRow {
     createdAt: number;
     lastUsedAt: number | null;
     revokedAt: number | null;
+    /** Intended consumer. Existing rows without this field remain client keys. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list for least-privilege integration keys. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** Restrict use to requests whose direct socket peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling. Absent/`0` = unlimited = the concurrency gate
      * is bypassed for this key. Persisted by the daemon (`omnicross-uqc-daemon`).
@@ -676,6 +800,9 @@ interface OutboundKeyDb {
         keyHash: string;
         keyPrefix: string;
         createdAt?: number;
+        kind?: 'client' | 'integration';
+        allowedEndpoints?: OutboundEndpoint[];
+        loopbackOnly?: boolean;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -751,4 +878,4 @@ interface OutboundApiDeps {
     readonly logger?: Logger;
 }
 
-export { type AccountProbeConfig as A, toVoucherInfo as B, type ChatDispatchMode as C, voucherCodePrefix as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type ModelRef as G, type AccountHealthConfig as H, type OutboundKeyModelRestrictionMode as I, type KeySpendReader as K, type MessagesModelKind as M, type OutboundKeyDb as O, type RequestRole as R, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type ConcurrencyQueueConfig as a, type EndpointRoutingConfig as b, type KeySpendSeeder as c, KeySpendTracker as d, type KindMappedEndpoint as e, type ModelKind as f, type ModelPrefixTargets as g, type OutboundApiDeps as h, type OutboundApiKeyCreated as i, type OutboundApiKeyInfo as j, type OutboundApiServerConfig as k, type OutboundApiServerStatus as l, type OutboundEndpoint as m, type OutboundFormatUrls as n, type OutboundKeyActivationMode as o, type OutboundKeyDbRow as p, type OutboundKeyPolicy as q, type OutboundProxyConfig as r, type ResponsesModelKind as s, type VoucherDb as t, computeVoucherGrant as u, generateVoucherCode as v, hashVoucherCode as w, newVoucherId as x, startOfLocalDay as y, startOfLocalWeek as z };
+export { type AccountProbeConfig as A, computeVoucherGrant as B, type ChatDispatchMode as C, generateVoucherCode as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, hashVoucherCode as H, newVoucherId as I, startOfLocalDay as J, type KeySpendReader as K, startOfLocalWeek as L, type MessagesModelKind as M, toVoucherInfo as N, type OutboundKeyDb as O, voucherCodePrefix as P, type ModelRef as Q, type RequestRole as R, type AccountHealthConfig as S, type OutboundKeyModelRestrictionMode as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type AllowanceSchedulingConfig as a, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundProxyConfig as x, type ResponsesModelKind as y, type VoucherDb as z };

package/dist/usage/pricing-engine.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkYMFAJFQTcjs = require('../chunk-YMFAJFQT.cjs');
+var _chunkDLXZEZWOcjs = require('../chunk-DLXZEZWO.cjs');
 
 
-exports.PricingEngine = _chunkYMFAJFQTcjs.PricingEngine;
+exports.PricingEngine = _chunkDLXZEZWOcjs.PricingEngine;