@omnicross/core 0.1.5 → 0.1.6

package/dist/outbound-api.d.ts

@@ -1,6 +1,6 @@
 import { VoucherConfig } from '@omnicross/contracts/voucher-types';
-import { e as KindMappedEndpoint, f as ModelKind, m as OutboundEndpoint, b as EndpointRoutingConfig, k as OutboundApiServerConfig, U as UserMessageQueueConfig, a as ConcurrencyQueueConfig, h as OutboundApiDeps, l as OutboundApiServerStatus, n as OutboundFormatUrls, A as AccountProbeConfig, F as FingerprintConfig, g as ModelPrefixTargets, r as OutboundProxyConfig, G as ModelRef, O as OutboundKeyDb, i as OutboundApiKeyCreated, R as RequestRole } from './types-lgPYQuZS.js';
-export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, K as KeySpendReader, c as KeySpendSeeder, d as KeySpendTracker, M as MessagesModelKind, j as OutboundApiKeyInfo, o as OutboundKeyActivationMode, p as OutboundKeyDbRow, q as OutboundKeyPolicy, s as ResponsesModelKind, V as VoucherCreateInput, t as VoucherDb, u as computeVoucherGrant, v as generateVoucherCode, w as hashVoucherCode, x as newVoucherId, y as startOfLocalDay, z as startOfLocalWeek, B as toVoucherInfo, D as voucherCodePrefix } from './types-lgPYQuZS.js';
+import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-hsoKrVQS.js';
+export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-hsoKrVQS.js';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
@@ -8,11 +8,12 @@ import { WebhookDestination, WebhookConfig } from '@omnicross/contracts/webhook-
 export { AUDIT_REDACTED, redactAuditText } from './outbound-api/auditRedact.js';
 export { AuditCaptureContext, beginAuditCapture } from './outbound-api/auditCapture.js';
 export { BillingCaptureContext, beginBillingCapture } from './outbound-api/billingCapture.js';
-import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-Cp0FntZl.js';
-export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-Cp0FntZl.js';
+import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-zdWTu3CQ.js';
+export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-zdWTu3CQ.js';
 import http from 'node:http';
 import { IngressFormat } from './provider-proxy/types.js';
-export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-C4T7yClx.js';
+export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-CHTv_Bs5.js';
+export { BoundAccountFallbackPolicy, BoundAccountSelectionError, BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError } from './pipeline/BoundAccountSelectionError.js';
 import '@omnicross/contracts/health-logging-types';
 import './logger-4GvQNzhE.js';
 import './ports/provider-config-source.js';
@@ -30,70 +31,6 @@ import './pipeline/SubscriptionAuthStrategy.js';
 import './ports/web-search-backend.js';
 import '@omnicross/contracts/websearch-types';
 
-/**
- * kindDetection — classify an outbound request's model KIND for the kind-mapped
- * endpoints (`messages`/`responses`) and validate their config completeness
- * (`outbound-api-server`, model-kind-mapping contract).
- *
- * The kind-mapped endpoints route by a version-INDEPENDENT model KIND rather
- * than by role: the user configures one upstream ref per kind
- * ({@link ENDPOINT_MODEL_KINDS}) and an incoming versioned client id
- * (`claude-opus-4-8-2026xxxx`) is classified to its kind (`opus`) so CLI
- * upgrades need no reconfig. `chat`/`gemini` stay on `roleDetection`.
- *
- * Pure module — no I/O. The router decides, per endpoint, whether to call
- * `detectModelKind` (messages/responses) or `detectRequestRole` (chat/gemini);
- * the routing RESOLUTION and the startup-gate ENFORCEMENT live downstream.
- *
- * @module outbound-api/kindDetection
- */
-
-/**
- * Narrow an endpoint to the kind-mapped set (`messages`/`responses`). `chat`
- * and `gemini` are role-based and return false.
- */
-declare function isKindMappedEndpoint(endpoint: OutboundEndpoint): endpoint is KindMappedEndpoint;
-/** The canonical kinds for a kind-mapped endpoint (in declaration order). */
-declare function modelKindsForEndpoint(endpoint: KindMappedEndpoint): readonly ModelKind[];
-/**
- * Extract the version-INDEPENDENT model KIND for a kind-mapped endpoint.
- *  - `messages`: the FIRST id token that is one of {fable,opus,sonnet,haiku};
- *    `undefined` when no token matches (the unmatched-kind fallback is SERVING's
- *    decision, not core's).
- *  - `responses`: `mini` when {@link isBackgroundTierModel}; else `codex`
- *    (codex is the else-branch — a present id always resolves).
- *  - Any empty/blank id ⇒ `undefined`.
- *
- * Reuses `normalizeModelId` + the shared `/[-._:/\s]+/` tokenizer
- * (`modelTokens`) + the small-tier token set (`isBackgroundTierModel`) so the
- * kind and role detectors stay token-boundary-consistent.
- */
-declare function detectModelKind(endpoint: KindMappedEndpoint, requestedModelId: string | undefined): ModelKind | undefined;
-/**
- * The kinds THIS endpoint declares but leaves unconfigured (blank/absent ref).
- * Role-based endpoints (`chat`/`gemini`) have no declared kinds → `[]`.
- * Absent and blank refs are treated identically; a malformed-but-non-blank ref
- * is a serving-time concern, not a startup-gate one.
- */
-declare function validateEndpointModelConfig(config: EndpointRoutingConfig): ModelKind[];
-/** One incomplete kind-mapped endpoint and the kinds it is missing. */
-interface EndpointModelConfigError {
-    endpoint: KindMappedEndpoint;
-    missingKinds: ModelKind[];
-}
-/**
- * Server-level completeness, PER-ENDPOINT: a kind-mapped endpoint whose
- * declared kinds are ALL blank/absent counts as UNCONFIGURED — the operator
- * simply doesn't use that endpoint, so it does NOT block startup (its requests
- * 503 per-request instead). Only a PARTIALLY configured endpoint (some kinds
- * set, some blank — a real config mistake that would silently misroute) is
- * returned as an error. Empty result ⇒ the config satisfies the startup gate.
- *
- * Serving consumes this for the gate ENFORCEMENT; it MAY tighten to an
- * all-endpoints-strict policy by composing {@link validateEndpointModelConfig}.
- */
-declare function validateServerModelConfig(config: OutboundApiServerConfig): EndpointModelConfigError[];
-
 /**
  * OutboundApiServer — the external-facing HTTP listener for the outbound API
  * server (`outbound-api-server`, design D1/D4/D5).
@@ -125,6 +62,8 @@ interface ApplyConfigInput {
     enabled: boolean;
     networkBinding: boolean;
     endpoints: EndpointRoutingConfig[];
+    /** Independent resource bindings; absent preserves legacy endpoint routing. */
+    bindings?: GatewayBinding[];
     port?: number;
     /** User-message serial-queue segment (normalized/defaulted by core). */
     userMessageQueue?: UserMessageQueueConfig;
@@ -134,17 +73,6 @@ interface ApplyConfigInput {
      *  disabled ⇒ the `/redeem` endpoint is inert (zero regression). */
     voucher?: VoucherConfig;
 }
-/**
- * Thrown by {@link OutboundApiServer.applyConfig} when an ENABLED server is asked
- * to bind with an INCOMPLETE model-kind map (the "未配置 → 无法启动接口服务" gate,
- * design D6). Carries the per-endpoint missing kinds so the daemon/UI can render
- * an actionable message; the server does NOT bind. Exported from the barrel so
- * the daemon (surface) can `instanceof`-narrow it.
- */
-declare class OutboundApiConfigError extends Error {
-    readonly missing: EndpointModelConfigError[];
-    constructor(missing: EndpointModelConfigError[]);
-}
 declare class OutboundApiServer {
     private readonly deps;
     /** Called when the actual bound port differs from the requested one. */
@@ -153,6 +81,7 @@ declare class OutboundApiServer {
     private boundPort;
     private boundAddr;
     private endpoints;
+    private bindings;
     private userMessageQueue;
     private concurrencyQueue;
     private voucherConfig;
@@ -256,6 +185,10 @@ declare const DEFAULT_CONCURRENCY_QUEUE: ConcurrencyQueueConfig;
  * a load-safety valve (see `AccountProbeConfig`).
  */
 declare const DEFAULT_ACCOUNT_PROBE: AccountProbeConfig;
+/** Default-off thresholds for allowance-aware account scheduling. */
+declare const DEFAULT_ALLOWANCE_SCHEDULING: AllowanceSchedulingConfig;
+/** Fill and clamp the optional allowance scheduling segment. */
+declare function normalizeAllowanceScheduling(raw: Partial<OutboundApiServerConfig> | undefined | null): AllowanceSchedulingConfig;
 /** Fill + range-CLAMP the account-probe segment to the frozen defaults. */
 declare function normalizeAccountProbe(raw: Partial<OutboundApiServerConfig> | undefined | null): AccountProbeConfig;
 /**
@@ -359,6 +292,17 @@ interface ApiServerSettingsStore {
  * targets simply routes nothing until configured). Never throws.
  */
 declare function normalizePrefixTargets(raw: unknown): ModelPrefixTargets | undefined;
+/**
+ * One-time migration off the removed global endpoint fallback: every configured
+ * legacy endpoint block becomes an equivalent downstream route. Runs only when
+ * the config carries no routes yet, so a user who has since deleted their routes
+ * does not get the old ones resurrected. Idempotent by construction —
+ * {@link normalizeServerConfig} blanks the legacy blocks in the same pass, so a
+ * second run finds nothing to project.
+ */
+declare function legacyEndpointsToBindings(endpoints: readonly EndpointRoutingConfig[]): GatewayBinding[];
+/** Normalize independent gateway bindings while dropping malformed entries. */
+declare function normalizeGatewayBindings(raw: unknown): GatewayBinding[];
 /** The default server config: disabled, loopback, four blank endpoints. */
 declare function defaultServerConfig(): OutboundApiServerConfig;
 /**
@@ -374,6 +318,51 @@ declare function saveServerConfig(store: ApiServerSettingsStore, config: Outboun
 /** Apply a partial patch to a config, returning the merged whole. */
 declare function mergeServerConfig(current: OutboundApiServerConfig, patch: Partial<OutboundApiServerConfig>): OutboundApiServerConfig;
 
+/**
+ * Either the winning route projected to the resolver shape, or `none` — no
+ * enabled route for this key/endpoint could serve the request. There is no
+ * global fallback: `none` is terminal and the caller answers with a route error.
+ */
+type GatewayBindingResolution = {
+    source: 'binding';
+    binding: GatewayBinding;
+    config: EndpointRoutingConfig;
+} | {
+    source: 'none';
+};
+interface ResolveGatewayBindingInput {
+    bindings: readonly GatewayBinding[] | undefined;
+    apiKeyId: string;
+    endpoint: OutboundEndpoint;
+    requestedModel?: string;
+    role?: RequestRole;
+}
+/** Project one downstream route into the legacy route-resolver shape. */
+declare function gatewayBindingToEndpointConfig(binding: GatewayBinding, requestedModel?: string): EndpointRoutingConfig;
+/**
+ * The enabled routes one verified key may enter on one endpoint, in resolution
+ * order. Exact key-scoped routes outrank unscoped ones (and suppress them
+ * entirely); within a tier the lower priority value wins, id breaking ties.
+ */
+declare function candidateGatewayBindings(bindings: readonly GatewayBinding[] | undefined, apiKeyId: string, endpoint: OutboundEndpoint): GatewayBinding[];
+/**
+ * The background-tier model ids the role-based endpoint should recognize for
+ * this request. Role detection runs BEFORE a route is picked (the pick needs the
+ * role), so the hint is the union across every candidate route.
+ */
+declare function candidateBackgroundModelIds(bindings: readonly GatewayBinding[] | undefined, apiKeyId: string, endpoint: OutboundEndpoint): string[] | undefined;
+/**
+ * Resolve the resource route for one verified client key. A route with
+ * `fallback: next` that has no model for this request yields to the next
+ * candidate, while `fail` remains selected immediately.
+ *
+ * When no candidate can serve, the FIRST candidate is still selected so route
+ * resolution produces its specific, actionable error (e.g. 404 for a model
+ * outside a chat route's list) rather than a generic one. `none` is reserved
+ * for having no candidate route at all.
+ */
+declare function resolveGatewayBinding(input: ResolveGatewayBindingInput): GatewayBindingResolution;
+
 /**
  * modelPrefixDispatch — pure model-name PREFIX classification for the `chat`
  * endpoint's opt-in `dispatchMode: 'prefix'` (openai-chat-bridge #11, design D2).
@@ -426,8 +415,7 @@ declare function resolvePrefixTarget(targets: ModelPrefixTargets | undefined, mo
  * waiter can be CANCELLED (the wire layer binds this to `res.close` so a client
  * that disconnects mid-queue frees its spot). Release + cancel are idempotent
  * (guarded by a per-acquisition `settled` flag) so the wire's `finally` +
- * `res.once('close')` double-fire is safe — this directly avoids the CRS #1130
- * slot leak.
+ * `res.once('close')` double-fire is safe and cannot leak a concurrency slot.
  *
  * Memory-only, injected clock, resets on restart. `limit <= 0` means unlimited
  * (the wire layer bypasses the gate entirely for such keys; a defensive call
@@ -526,8 +514,7 @@ declare class OutboundConcurrencyGate {
  * concurrent humans. Only human-INITIATED turns should be serialized; a
  * tool-loop turn (the client feeding a tool result back) must NOT be throttled
  * or it stalls the agent. This module classifies the LAST turn per ingress
- * format, aligned to claude-relay-service's `isUserMessageRequest` semantics but
- * covering all four omnicross ingress formats.
+ * format and covers all four Omnicross ingress formats.
  *
  * SAFETY BIAS: default `false` (bypass) on any shape it cannot POSITIVELY
  * classify as a human turn. Under-serializing only costs the (opt-in, default-
@@ -623,6 +610,53 @@ declare class UserMessageSerialQueue {
     reset(): void;
 }
 
+/**
+ * kindDetection — classify an outbound request's model KIND for the kind-mapped
+ * endpoints (`messages`/`responses`) and validate their config completeness
+ * (`outbound-api-server`, model-kind-mapping contract).
+ *
+ * The kind-mapped endpoints route by a version-INDEPENDENT model KIND rather
+ * than by role: the user configures one upstream ref per kind
+ * ({@link ENDPOINT_MODEL_KINDS}) and an incoming versioned client id
+ * (`claude-opus-4-8-2026xxxx`) is classified to its kind (`opus`) so CLI
+ * upgrades need no reconfig. `chat`/`gemini` stay on `roleDetection`.
+ *
+ * Pure module — no I/O. The router decides, per endpoint, whether to call
+ * `detectModelKind` (messages/responses) or `detectRequestRole` (chat/gemini);
+ * the routing RESOLUTION and the startup-gate ENFORCEMENT live downstream.
+ *
+ * @module outbound-api/kindDetection
+ */
+
+/**
+ * Narrow an endpoint to the kind-mapped set (`messages`/`responses`). `chat`
+ * and `gemini` are role-based and return false.
+ */
+declare function isKindMappedEndpoint(endpoint: OutboundEndpoint): endpoint is KindMappedEndpoint;
+/** The canonical kinds for a kind-mapped endpoint (in declaration order). */
+declare function modelKindsForEndpoint(endpoint: KindMappedEndpoint): readonly ModelKind[];
+/**
+ * Extract the version-INDEPENDENT model KIND for a kind-mapped endpoint.
+ *  - `messages`: the FIRST id token that is one of {fable,opus,sonnet,haiku};
+ *    `undefined` when no token matches (the unmatched-kind fallback is SERVING's
+ *    decision, not core's).
+ *  - `responses`: `mini` when {@link isBackgroundTierModel}; else `codex`
+ *    (codex is the else-branch — a present id always resolves).
+ *  - Any empty/blank id ⇒ `undefined`.
+ *
+ * Reuses `normalizeModelId` + the shared `/[-._:/\s]+/` tokenizer
+ * (`modelTokens`) + the small-tier token set (`isBackgroundTierModel`) so the
+ * kind and role detectors stay token-boundary-consistent.
+ */
+declare function detectModelKind(endpoint: KindMappedEndpoint, requestedModelId: string | undefined): ModelKind | undefined;
+/**
+ * The kinds THIS endpoint declares but leaves unconfigured (blank/absent ref).
+ * Role-based endpoints (`chat`/`gemini`) have no declared kinds → `[]`.
+ * Absent and blank refs are treated identically; a malformed-but-non-blank ref
+ * is a serving-time concern, not a startup-gate one.
+ */
+declare function validateEndpointModelConfig(config: EndpointRoutingConfig): ModelKind[];
+
 /**
  * outboundApiKeyAuth — named-key generation, hashing, and verification for the
  * outbound API server (`outbound-api-server`).
@@ -649,12 +683,20 @@ declare function hashKey(secret: string): string;
  * prefix are stored.
  */
 declare function createNamedKey(db: OutboundKeyDb, name: string): Promise<OutboundApiKeyCreated>;
+/**
+ * Mint the local gateway key used by native CLI configuration adapters. Unlike
+ * a user-distributed key it is explicitly loopback-only and endpoint-scoped.
+ */
+declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundEndpoint[]): Promise<OutboundApiKeyCreated>;
 /**
  * A verified key + the enforcement inputs carried from the row so the wire layer
  * runs its policy checks WITHOUT a second DB read (mirrors `maxConcurrency`).
  */
 interface VerifiedKey {
     id: string;
+    kind?: 'client' | 'integration';
+    allowedEndpoints?: OutboundEndpoint[];
+    loopbackOnly?: boolean;
     /**
      * The key's per-key concurrency ceiling, carried from the row so the wire
      * layer keys the concurrency gate without a second DB read. Absent/`0` =
@@ -875,4 +917,4 @@ declare function getOutboundApiServer(deps?: OutboundApiDeps, onPortChange?: (po
 /** Reset the singleton (tests / teardown only). */
 declare function __resetOutboundApiServerForTests(): void;
 
-export { AccountProbeConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, type EndpointModelConfigError, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiConfigError, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundProxyConfig, OutboundRateLimiter, RequestRole, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, classifyModelPrefix, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, endpointToIngressFormat, formatUrls, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, validateServerModelConfig, verifyKey, verifyPresentedKey };
+export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundProxyConfig, OutboundRateLimiter, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, verifyKey, verifyPresentedKey };

package/dist/outbound-api.js

@@ -3,6 +3,7 @@ import {
   ConcurrencyWaitCancelledError,
   ConcurrencyWaitTimeoutError,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
@@ -10,19 +11,22 @@ import {
   KeySpendTracker,
   KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
-  OutboundApiConfigError,
   OutboundApiServer,
   OutboundConcurrencyGate,
   OutboundRateLimiter,
   SerialQueueTimeoutError,
   UserMessageSerialQueue,
   __resetOutboundApiServerForTests,
+  candidateBackgroundModelIds,
+  candidateGatewayBindings,
   checkKeyQuota,
   computeKeyExpiry,
   computeVoucherGrant,
+  createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
   formatUrls,
+  gatewayBindingToEndpointConfig,
   generateVoucherCode,
   getOutboundApiServer,
   handleVoucherRedeem,
@@ -32,13 +36,16 @@ import {
   isRedeemRequest,
   isSerialQueueTimeout,
   isUserMessageRequest,
+  legacyEndpointsToBindings,
   loadServerConfig,
   mergeServerConfig,
   newVoucherId,
   normalizeAccountProbe,
+  normalizeAllowanceScheduling,
   normalizeAudit,
   normalizeBilling,
   normalizeFingerprint,
+  normalizeGatewayBindings,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -48,6 +55,7 @@ import {
   normalizeWebhookDestination,
   normalizeWebhookSegment,
   randomBase62,
+  resolveGatewayBinding,
   saveServerConfig,
   startOfLocalDay,
   startOfLocalWeek,
@@ -55,33 +63,38 @@ import {
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-FH2P4OCD.js";
+} from "./chunk-UDCC7EMR.js";
+import "./chunk-WB6PH56J.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
-import "./chunk-G2UTNSGU.js";
+import "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
 import "./chunk-DK4A7DLE.js";
-import "./chunk-OQWKZCXP.js";
-import "./chunk-IB3FDI4O.js";
-import "./chunk-ZJZAOKI7.js";
-import "./chunk-C6OV7GCC.js";
-import "./chunk-IWQAX3CS.js";
-import "./chunk-BODMAL6G.js";
+import "./chunk-VRFBB5DB.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-OEWZUX4G.js";
+import "./chunk-LB6EBS6Y.js";
+import "./chunk-6CL5HTPQ.js";
 import "./chunk-7VU7V2E4.js";
-import "./chunk-ZLX3KGXX.js";
+import "./chunk-UX7VWA46.js";
 import "./chunk-BPKCU575.js";
-import "./chunk-MZNPGW5Q.js";
+import "./chunk-DRWHTIIZ.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
-import "./chunk-IAXWICZU.js";
+import "./chunk-5ERIZW3D.js";
+import "./chunk-YJVHCHQX.js";
+import "./chunk-23S5OPIO.js";
+import "./chunk-AVYJ4YBN.js";
 import "./chunk-OE6TDIWW.js";
-import "./chunk-DRWHTIIZ.js";
-import "./chunk-IK3KE3AU.js";
+import "./chunk-OPRS4IQZ.js";
+import {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "./chunk-2JYRIADS.js";
+import "./chunk-DE2SRBFZ.js";
 import "./chunk-ZY6KU6P3.js";
 import "./chunk-JWC6APFQ.js";
-import "./chunk-5ERIZW3D.js";
-import "./chunk-5ENKBSWO.js";
-import "./chunk-HRRYG2AX.js";
-import "./chunk-AVYJ4YBN.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -101,9 +114,8 @@ import {
   pickModelRefFromList,
   resolvePrefixTarget,
   resolveRoute,
-  validateEndpointModelConfig,
-  validateServerModelConfig
-} from "./chunk-UHGVBFU3.js";
+  validateEndpointModelConfig
+} from "./chunk-EBLFCNPY.js";
 import "./chunk-AQ5TNQB7.js";
 import {
   ENDPOINT_MODEL_KINDS
@@ -118,21 +130,24 @@ import {
 } from "./chunk-K5NM7VAH.js";
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
-import "./chunk-5ZQBEOMD.js";
-import "./chunk-MFZ5437A.js";
-import "./chunk-6QZGDLL4.js";
-import "./chunk-D3TDKWRP.js";
+import "./chunk-AT7B7SOZ.js";
+import "./chunk-N5T4M4GU.js";
+import "./chunk-TOVPMMHM.js";
+import "./chunk-SIZQQD6T.js";
 import "./chunk-SYQF7OIR.js";
+import "./chunk-MKF46GNZ.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";
 import "./chunk-HUZZZ3JL.js";
 export {
   AUDIT_REDACTED,
+  BoundAccountSelectionError,
   ConcurrencyQueueFullError,
   ConcurrencyWaitCancelledError,
   ConcurrencyWaitTimeoutError,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
@@ -141,7 +156,6 @@ export {
   KeySpendTracker,
   KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
-  OutboundApiConfigError,
   OutboundApiServer,
   OutboundConcurrencyGate,
   OutboundRateLimiter,
@@ -151,10 +165,14 @@ export {
   __resetOutboundApiServerForTests,
   beginAuditCapture,
   beginBillingCapture,
+  boundAccountSelectionMessage,
+  candidateBackgroundModelIds,
+  candidateGatewayBindings,
   checkKeyQuota,
   classifyModelPrefix,
   computeKeyExpiry,
   computeVoucherGrant,
+  createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
   detectModelKind,
@@ -162,25 +180,30 @@ export {
   endpointSupportsSubscription,
   endpointToIngressFormat,
   formatUrls,
+  gatewayBindingToEndpointConfig,
   generateVoucherCode,
   getOutboundApiServer,
   handleVoucherRedeem,
   hashKey,
   hashVoucherCode,
+  isBoundAccountSelectionError,
   isConcurrencyRejection,
   isKindMappedEndpoint,
   isRedeemRequest,
   isSerialQueueTimeout,
   isSubscriptionProviderId,
   isUserMessageRequest,
+  legacyEndpointsToBindings,
   loadServerConfig,
   mergeServerConfig,
   modelKindsForEndpoint,
   newVoucherId,
   normalizeAccountProbe,
+  normalizeAllowanceScheduling,
   normalizeAudit,
   normalizeBilling,
   normalizeFingerprint,
+  normalizeGatewayBindings,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -193,6 +216,7 @@ export {
   pickModelRefFromList,
   randomBase62,
   redactAuditText,
+  resolveGatewayBinding,
   resolvePrefixTarget,
   resolveRoute,
   saveServerConfig,
@@ -200,7 +224,6 @@ export {
   startOfLocalWeek,
   toVoucherInfo,
   validateEndpointModelConfig,
-  validateServerModelConfig,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix

package/dist/pipeline/AccountAllowanceScheduling.cjs

@@ -0,0 +1,15 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunk6QQG7YG3cjs = require('../chunk-6QQG7YG3.cjs');
+require('../chunk-HVBBDBS3.cjs');
+
+
+
+
+
+
+exports.AccountAllowanceExhaustedError = _chunk6QQG7YG3cjs.AccountAllowanceExhaustedError; exports.AccountAllowanceScheduling = _chunk6QQG7YG3cjs.AccountAllowanceScheduling; exports.__resetSharedAccountAllowanceSchedulingForTests = _chunk6QQG7YG3cjs.__resetSharedAccountAllowanceSchedulingForTests; exports.getSharedAccountAllowanceScheduling = _chunk6QQG7YG3cjs.getSharedAccountAllowanceScheduling; exports.isAccountAllowanceExhaustedError = _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError;

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -0,0 +1,90 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-H3wGZSOo.cjs';
+import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.cjs';
+import '../ports/provider-config-source.cjs';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.cjs';
+import '../transformer/TransformerService.cjs';
+import '../ProviderProxy-CnMQYN59.cjs';
+import '../provider-proxy/types.cjs';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.cjs';
+import './AuthSource.cjs';
+import './BoundAccountSelectionError.cjs';
+import './SubscriptionAuthSource.cjs';
+import './SubscriptionAuthStrategy.cjs';
+import '../ports/web-search-backend.cjs';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.cjs';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };