@omnicross/core 0.1.5 → 0.1.6

package/dist/{chunk-CGKLE6IW.cjs → chunk-SQYVORNP.cjs}

@@ -1,21 +1,30 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3; var _class4; var _class5; var _class6; var _class7; var _class8; var _class9; var _class10; var _class11; var _class12; var _class13;
 
+
+
+var _chunkEJLH6NFTcjs = require('./chunk-EJLH6NFT.cjs');
+
+
 var _chunkHQP3K7PUcjs = require('./chunk-HQP3K7PU.cjs');
 
 
-var _chunk46ZIFWYGcjs = require('./chunk-46ZIFWYG.cjs');
+var _chunkIIRPUVPHcjs = require('./chunk-IIRPUVPH.cjs');
+
 
+var _chunkGBHYAGX3cjs = require('./chunk-GBHYAGX3.cjs');
 
-var _chunk4XMYPW46cjs = require('./chunk-4XMYPW46.cjs');
 
+var _chunkV4TXMEJScjs = require('./chunk-V4TXMEJS.cjs');
 
-var _chunkK52THW2Ccjs = require('./chunk-K52THW2C.cjs');
 
+var _chunk6VUQPOV3cjs = require('./chunk-6VUQPOV3.cjs');
 
-var _chunk3Q6Z6JTOcjs = require('./chunk-3Q6Z6JTO.cjs');
 
 
-var _chunkGBHYAGX3cjs = require('./chunk-GBHYAGX3.cjs');
+var _chunk4VLRHHFEcjs = require('./chunk-4VLRHHFE.cjs');
+
+
+var _chunkR3HK6R4Bcjs = require('./chunk-R3HK6R4B.cjs');
 
 
 var _chunkRPII3E6Zcjs = require('./chunk-RPII3E6Z.cjs');
@@ -25,37 +34,37 @@ var _chunkRPII3E6Zcjs = require('./chunk-RPII3E6Z.cjs');
 var _chunk6RPZADX3cjs = require('./chunk-6RPZADX3.cjs');
 
 
+var _chunkNYUNU75Acjs = require('./chunk-NYUNU75A.cjs');
 
-var _chunkQWBWGODScjs = require('./chunk-QWBWGODS.cjs');
 
 
-var _chunkUIBD2YY5cjs = require('./chunk-UIBD2YY5.cjs');
+var _chunkYK57NMIFcjs = require('./chunk-YK57NMIF.cjs');
 
 
-var _chunkR3HK6R4Bcjs = require('./chunk-R3HK6R4B.cjs');
+var _chunkYNJNTCSQcjs = require('./chunk-YNJNTCSQ.cjs');
 
 
-var _chunkHYN75H6Gcjs = require('./chunk-HYN75H6G.cjs');
+var _chunkSVNDB62Dcjs = require('./chunk-SVNDB62D.cjs');
 
 
+var _chunkUIBD2YY5cjs = require('./chunk-UIBD2YY5.cjs');
 
-var _chunkQ27JY5RGcjs = require('./chunk-Q27JY5RG.cjs');
 
+var _chunk6QQG7YG3cjs = require('./chunk-6QQG7YG3.cjs');
 
-var _chunkQXD4MV2Xcjs = require('./chunk-QXD4MV2X.cjs');
 
 
-var _chunkNYUNU75Acjs = require('./chunk-NYUNU75A.cjs');
+var _chunk25GXJCEZcjs = require('./chunk-25GXJCEZ.cjs');
 
 
+var _chunkMUHWHQVMcjs = require('./chunk-MUHWHQVM.cjs');
 
-var _chunkVQY5W4YWcjs = require('./chunk-VQY5W4YW.cjs');
 
 
-var _chunkKFI44N2Rcjs = require('./chunk-KFI44N2R.cjs');
+var _chunkQ27JY5RGcjs = require('./chunk-Q27JY5RG.cjs');
 
 
-var _chunkSVNDB62Dcjs = require('./chunk-SVNDB62D.cjs');
+var _chunkQXD4MV2Xcjs = require('./chunk-QXD4MV2X.cjs');
 
 
 var _chunkAPYG5QD7cjs = require('./chunk-APYG5QD7.cjs');
@@ -72,7 +81,8 @@ var _chunk4YINUUKQcjs = require('./chunk-4YINUUKQ.cjs');
 
 
 
-var _chunkVACWOIREcjs = require('./chunk-VACWOIRE.cjs');
+
+var _chunk4VZX5F4Tcjs = require('./chunk-4VZX5F4T.cjs');
 
 
 
@@ -84,10 +94,10 @@ var _chunkUNWKG6EIcjs = require('./chunk-UNWKG6EI.cjs');
 
 
 
-var _chunkSUEGJ75Dcjs = require('./chunk-SUEGJ75D.cjs');
+var _chunkWYTEQ4Q5cjs = require('./chunk-WYTEQ4Q5.cjs');
 
 
-var _chunkPG7PS2NNcjs = require('./chunk-PG7PS2NN.cjs');
+var _chunkKCVJWJSTcjs = require('./chunk-KCVJWJST.cjs');
 
 
 var _chunkJMJBSACDcjs = require('./chunk-JMJBSACD.cjs');
@@ -486,48 +496,61 @@ function readAnthropicUsage(usage) {
     reasoningTokens: 0
   };
 }
+function emitAnthropicUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readAnthropicUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordAnthropicNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readAnthropicUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage,
-      auditResponse: attribution.auditResponse
-    });
+    emitAnthropicUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
   } catch (e4) {
   }
 }
+function recordAnthropicStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitAnthropicUsageRecord(recorder, rawUsage, attribution);
+  } catch (e5) {
+  }
+}
 
 // src/provider-proxy/ingress/providerProxyShared.ts
 var sharedExecutor = null;
 function getSharedExecutor() {
   if (!sharedExecutor) {
-    sharedExecutor = new (0, _chunk46ZIFWYGcjs.TransformerChainExecutor)();
+    sharedExecutor = new (0, _chunkIIRPUVPHcjs.TransformerChainExecutor)();
   }
   return sharedExecutor;
 }
 var sharedResponses = null;
 function getResponsesEndpointTransformer() {
-  if (!sharedResponses) sharedResponses = new (0, _chunk3Q6Z6JTOcjs.OpenAIResponseTransformer)();
+  if (!sharedResponses) sharedResponses = new (0, _chunk6VUQPOV3cjs.OpenAIResponseTransformer)();
   return sharedResponses;
 }
 var sharedAnthropic = null;
 function getAnthropicEndpointTransformer() {
-  if (!sharedAnthropic) sharedAnthropic = new (0, _chunk4XMYPW46cjs.AnthropicTransformer)();
+  if (!sharedAnthropic) sharedAnthropic = new (0, _chunk4VLRHHFEcjs.AnthropicTransformer)();
   return sharedAnthropic;
 }
 var sharedGemini = null;
 function getGeminiEndpointTransformer() {
-  if (!sharedGemini) sharedGemini = new (0, _chunkK52THW2Ccjs.GeminiTransformer)();
+  if (!sharedGemini) sharedGemini = new (0, _chunkV4TXMEJScjs.GeminiTransformer)();
   return sharedGemini;
 }
 function readBody(req) {
@@ -553,7 +576,7 @@ function rewriteJsonModel(bodyText, rewriteModel) {
       changed = true;
     }
     return changed ? JSON.stringify(obj) : bodyText;
-  } catch (e5) {
+  } catch (e6) {
     return bodyText;
   }
 }
@@ -586,11 +609,22 @@ function rewriteSseLine(line, rewriteModel) {
     }
     if (!changed) return line;
     return `data:${leadingSpace}${JSON.stringify(obj)}${newline}`;
-  } catch (e6) {
+  } catch (e7) {
     return line;
   }
 }
-async function relayStreamWithModelRewrite(res, body, rewriteModel) {
+function tapSseDataLine(line, onEvent) {
+  const leadingStripped = line.replace(/^\s+/, "");
+  if (!leadingStripped.startsWith("data:")) return;
+  const payload = leadingStripped.slice(5).trim();
+  if (!payload || payload === "[DONE]") return;
+  try {
+    onEvent(JSON.parse(payload));
+  } catch (e8) {
+  }
+}
+async function relaySseBody(res, body, options) {
+  const { rewriteModel, onSseEvent } = options;
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -604,21 +638,26 @@ async function relayStreamWithModelRewrite(res, body, rewriteModel) {
       while ((nlIndex = buffer.indexOf("\n")) !== -1) {
         const linePart = buffer.slice(0, nlIndex + 1);
         buffer = buffer.slice(nlIndex + 1);
-        out += rewriteSseLine(linePart, rewriteModel);
+        if (onSseEvent) tapSseDataLine(linePart, onSseEvent);
+        out += rewriteModel ? rewriteSseLine(linePart, rewriteModel) : linePart;
       }
       if (out) res.write(out);
     }
     const tail = buffer + decoder.decode();
-    if (tail) res.write(rewriteSseLine(tail, rewriteModel));
+    if (tail) {
+      if (onSseEvent) tapSseDataLine(tail, onSseEvent);
+      res.write(rewriteModel ? rewriteSseLine(tail, rewriteModel) : tail);
+    }
   } finally {
     reader.releaseLock();
     res.end();
   }
 }
-async function relayResponse(res, providerResponse, isStream, rewriteModel) {
+async function relayResponse(res, providerResponse, isStream, rewriteModel, usageTap) {
   const contentType = _nullishCoalesce(providerResponse.headers.get("Content-Type"), () => ( ""));
   const status = providerResponse.status && providerResponse.status >= 100 ? providerResponse.status : 200;
-  if (isStream || contentType.includes("text/event-stream")) {
+  const upstreamIsSse = contentType.includes("text/event-stream");
+  if (upstreamIsSse || isStream && status < 400) {
     res.writeHead(status, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
@@ -628,8 +667,16 @@ async function relayResponse(res, providerResponse, isStream, rewriteModel) {
       res.end();
       return null;
     }
-    if (rewriteModel) {
-      await relayStreamWithModelRewrite(res, providerResponse.body, rewriteModel);
+    if (rewriteModel || usageTap) {
+      let capturedUsage = null;
+      await relaySseBody(res, providerResponse.body, {
+        rewriteModel,
+        onSseEvent: usageTap ? (event) => {
+          const raw = usageTap.extractUsage(event);
+          if (raw) capturedUsage = raw;
+        } : void 0
+      });
+      if (capturedUsage) usageTap.onUsage(capturedUsage);
       return null;
     }
     const reader = providerResponse.body.getReader();
@@ -670,7 +717,7 @@ async function aggregateAnthropicSseToJsonBody(response, rewriteModel) {
     let ev;
     try {
       ev = JSON.parse(payload);
-    } catch (e7) {
+    } catch (e9) {
       continue;
     }
     switch (ev["type"]) {
@@ -725,7 +772,7 @@ async function aggregateAnthropicSseToJsonBody(response, rewriteModel) {
       let input = {};
       try {
         input = blk.inputJson ? JSON.parse(blk.inputJson) : {};
-      } catch (e8) {
+      } catch (e10) {
         input = {};
       }
       return { type: "tool_use", id: _nullishCoalesce(blk.id, () => ( "")), name: _nullishCoalesce(blk.name, () => ( "")), input };
@@ -745,6 +792,27 @@ function writeError(res, status, message) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: { type: "provider_proxy_error", message } }));
 }
+function writeBoundAccountError(res, error) {
+  if (res.headersSent) return;
+  const headers = { "Content-Type": "application/json" };
+  if (error.status === 429 && error.resumeAt) {
+    const resumeMs = Date.parse(error.resumeAt);
+    if (Number.isFinite(resumeMs)) {
+      headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+    }
+  }
+  res.writeHead(error.status, headers);
+  res.end(
+    JSON.stringify({
+      error: {
+        type: "provider_proxy_error",
+        code: error.code,
+        reason: error.reason,
+        message: _chunk25GXJCEZcjs.boundAccountSelectionMessage.call(void 0, error.reason)
+      }
+    })
+  );
+}
 function resolveApiKey(apiKey) {
   if (!apiKey) return "";
   if (apiKey.startsWith("$")) {
@@ -752,7 +820,12 @@ function resolveApiKey(apiKey) {
   }
   return apiKey;
 }
-async function resolvePoolBoundKey(deps, providerId, provider, sessionId) {
+async function resolvePoolBoundKey(deps, providerId, provider, sessionId, preferredKeyId, boundKeyFallbackPolicy) {
+  if (preferredKeyId) {
+    const preferred = await _optionalChain([deps, 'access', _8 => _8.apiKeyPool, 'optionalAccess', _9 => _9.getKeyById, 'call', _10 => _10(providerId, preferredKeyId, sessionId)]);
+    if (preferred) return preferred;
+    if (boundKeyFallbackPolicy !== "pool") return "";
+  }
   if (deps.apiKeyPool && sessionId) {
     const poolKey = await deps.apiKeyPool.getKeyForSession(providerId, sessionId);
     if (poolKey) return poolKey;
@@ -775,7 +848,7 @@ async function buildSubscriptionPlan(res, route, deps, anthropicBody, routeModel
     resolvedModel = mapped.resolvedModel;
     scenario = mapped.scenario;
   }
-  const sessionKey = _chunkQWBWGODScjs.deriveSubscriptionSessionKey.call(void 0, anthropicBody);
+  const sessionKey = _chunkEJLH6NFTcjs.deriveSubscriptionSessionKey.call(void 0, anthropicBody);
   const plan = buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isStream, scenario, sessionKey);
   if (!plan) {
     writeError(res, 502, "Subscription profile is missing resolveUpstreamUrl");
@@ -784,11 +857,11 @@ async function buildSubscriptionPlan(res, route, deps, anthropicBody, routeModel
   return plan;
 }
 function buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isStream, scenario, sessionKey) {
-  const upstreamUrl = _optionalChain([profile, 'access', _8 => _8.resolveUpstreamUrl, 'optionalCall', _9 => _9(resolvedModel, route.subscriptionConfig)]);
+  const upstreamUrl = _optionalChain([profile, 'access', _11 => _11.resolveUpstreamUrl, 'optionalCall', _12 => _12(resolvedModel, route.subscriptionConfig)]);
   if (!upstreamUrl) return null;
-  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkKFI44N2Rcjs.SubscriptionAuthSource)(profile)));
+  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkYNJNTCSQcjs.SubscriptionAuthSource)(profile)));
   const sameFormat = profile.mode === "pass-through" || upstreamUrl.endsWith("/v1/messages");
-  const overrideNames = _optionalChain([profile, 'access', _10 => _10.resolveProviderTransformerNames, 'optionalCall', _11 => _11(
+  const overrideNames = _optionalChain([profile, 'access', _13 => _13.resolveProviderTransformerNames, 'optionalCall', _14 => _14(
     resolvedModel,
     route.subscriptionConfig
   )]);
@@ -807,6 +880,8 @@ function buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isS
   return {
     auth,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -851,7 +926,7 @@ function buildSubscriptionRequestSummary(anthropicBody) {
     estimatedInputTokens: Math.ceil(totalChars / 4),
     // Single source of truth (shared with the dispatcher builder) so both
     // ingress paths yield identical `matchText` for the same body.
-    matchText: _chunkQWBWGODScjs.collectMatchText.call(void 0, anthropicBody)
+    matchText: _chunkEJLH6NFTcjs.collectMatchText.call(void 0, anthropicBody)
   };
 }
 function collectText(value) {
@@ -881,13 +956,15 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
     model: resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive) => {
       proxyAccountId = accountId;
-      _optionalChain([reportSelection, 'optionalCall', _12 => _12(accountId, isActive)]);
+      _optionalChain([reportSelection, 'optionalCall', _15 => _15(accountId, isActive)]);
     }
   });
   let rawStatus = null;
-  const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+  const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
     executor,
     request: anthropicBody,
     provider: transformerProvider,
@@ -905,7 +982,7 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
     },
     fetchFn: (url, headers, body) => {
       console.info(`[ProviderProxy:anthropic] -> ${url} model=${resolvedModel} stream=${isStream}`);
-      return _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+      return _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
         { providerId: proxyProviderId(plan), accountId: proxyAccountId }
@@ -927,10 +1004,12 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
     model: plan.resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive, remapped) => {
       proxyAccountId = accountId;
       remappedModel = remapped;
-      _optionalChain([reportSelection, 'optionalCall', _13 => _13(accountId, isActive, remapped)]);
+      _optionalChain([reportSelection, 'optionalCall', _16 => _16(accountId, isActive, remapped)]);
     }
   });
   if (plan.isSubscription && plan.transformerProvider.name === "claude") {
@@ -948,7 +1027,7 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
   console.info(
     `[ProviderProxy:anthropic] (subscription same-format) -> ${plan.upstreamUrl} model=${outboundModel} stream=${plan.isStream}`
   );
-  const response = await _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+  const response = await _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
     plan.upstreamUrl,
     { method: "POST", headers, body: outboundBody },
     { providerId: proxyProviderId(plan), accountId: proxyAccountId }
@@ -964,7 +1043,7 @@ function rewriteBodyModel(rawBody, model) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return rawBody;
     parsed.model = model;
     return JSON.stringify(parsed);
-  } catch (e9) {
+  } catch (e11) {
     return rawBody;
   }
 }
@@ -977,7 +1056,7 @@ async function runSubscriptionAttemptWith401Retry(anthropicBody, relayBody, plan
   const first = await runOnce();
   let result = first;
   if (first.rawStatus === 401) {
-    const refreshed = await _optionalChain([plan, 'access', _14 => _14.auth, 'access', _15 => _15.onUnauthorized, 'optionalCall', _16 => _16(plan.sessionKey)]);
+    const refreshed = await _optionalChain([plan, 'access', _17 => _17.auth, 'access', _18 => _18.onUnauthorized, 'optionalCall', _19 => _19(plan.sessionKey)]);
     if (refreshed) {
       console.info("[ProviderProxy:anthropic] 401 \u2192 token refreshed; retrying once");
       result = await runOnce();
@@ -992,7 +1071,7 @@ async function readBoundedBody(response, max = 2048) {
   try {
     const text = await response.clone().text();
     return text.slice(0, max);
-  } catch (e10) {
+  } catch (e12) {
     return void 0;
   }
 }
@@ -1000,9 +1079,9 @@ async function markSubscriptionHealth(plan, selectedAccountId, result) {
   if (!plan.isSubscription || selectedAccountId === void 0) return;
   const providerId = plan.transformerProvider.name;
   const status = result.rawStatus;
-  const { resetHeaderSeconds, retryAfterSeconds } = _chunkVQY5W4YWcjs.resolveResetSeconds.call(void 0, providerId, result.response.headers);
+  const { resetHeaderSeconds, retryAfterSeconds } = _chunkYK57NMIFcjs.resolveResetSeconds.call(void 0, providerId, result.response.headers);
   const bodyText = status === 403 ? await readBoundedBody(result.response) : void 0;
-  _chunkVQY5W4YWcjs.getSharedAccountHealth.call(void 0, ).recordUpstreamOutcome(providerId, selectedAccountId, {
+  _chunkYK57NMIFcjs.getSharedAccountHealth.call(void 0, ).recordUpstreamOutcome(providerId, selectedAccountId, {
     status,
     resetHeaderSeconds,
     retryAfterSeconds,
@@ -1020,7 +1099,7 @@ function breakerOutcome(rawStatus) {
 function recordBreakerOutcome(profile, modelId, rawStatus) {
   const outcome = breakerOutcome(rawStatus);
   if (outcome === "neutral") return;
-  _optionalChain([profile, 'optionalAccess', _17 => _17.recordModelOutcome, 'optionalCall', _18 => _18(modelId, outcome === "success")]);
+  _optionalChain([profile, 'optionalAccess', _20 => _20.recordModelOutcome, 'optionalCall', _21 => _21(modelId, outcome === "success")]);
 }
 async function runSubscriptionAttemptOutcome(anthropicBody, relayBody, plan, options = {}) {
   try {
@@ -1039,7 +1118,7 @@ function settleOutcome(outcome) {
 async function runPipelineWithSubscriptionRetry(anthropicBody, rawBody, initialPlan, route, deps, options = {}) {
   const profile = route.subscriptionProfile;
   const scenario = initialPlan.scenario;
-  if (!_optionalChain([profile, 'optionalAccess', _19 => _19.nextFallback]) || scenario === void 0) {
+  if (!_optionalChain([profile, 'optionalAccess', _22 => _22.nextFallback]) || scenario === void 0) {
     const loneOutcome = await runSubscriptionAttemptOutcome(anthropicBody, rawBody, initialPlan, options);
     recordBreakerOutcome(profile, initialPlan.resolvedModel, outcomeStatus(loneOutcome));
     return settleOutcome(loneOutcome);
@@ -1103,7 +1182,7 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
   let anthropicBody;
   try {
     anthropicBody = JSON.parse(rawBody);
-  } catch (e11) {
+  } catch (e13) {
     writeError(res, 400, "Invalid JSON in request body");
     return;
   }
@@ -1119,6 +1198,35 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
     const upstreamSse = (_nullishCoalesce(upstreamResponse.headers.get("content-type"), () => ( ""))).includes(
       "text/event-stream"
     );
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: _nullishCoalesce(route.providerId, () => ( "anthropic")),
+      model: plan.resolvedModel,
+      apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    let anthropicInputUsage;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] === "message_start") {
+          const msg = event["message"];
+          const u = _optionalChain([msg, 'optionalAccess', _23 => _23["usage"]]);
+          if (u) anthropicInputUsage = u;
+          return null;
+        }
+        if (event["type"] === "message_delta") {
+          const outputUsage = event["usage"];
+          if (!outputUsage) return null;
+          return { ...anthropicInputUsage, ...outputUsage };
+        }
+        return null;
+      },
+      onUsage(rawUsage) {
+        recordAnthropicStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
     let bodyText;
     if (!isStream && upstreamSse) {
       bodyText = await aggregateAnthropicSseToJsonBody(upstreamResponse, route.requestedModel);
@@ -1128,22 +1236,19 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
       );
       res.end(bodyText);
     } else {
-      bodyText = await relayResponse(res, upstreamResponse, isStream, route.requestedModel);
+      bodyText = await relayResponse(res, upstreamResponse, isStream, route.requestedModel, usageTap);
     }
     if (bodyText && deps.usageRecorder) {
-      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: _nullishCoalesce(route.providerId, () => ( "anthropic")),
-        model: plan.resolvedModel,
-        apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (_chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = _chunkSVNDB62Dcjs.serializeError.call(void 0, err);
     console.error("[ProviderProxy:anthropic] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError.call(void 0, err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
@@ -1157,7 +1262,14 @@ async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1190,7 +1302,7 @@ async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
     isSubscription: false,
     provider,
     apiKey,
-    extendedContextEnabled: _nullishCoalesce(_optionalChain([route, 'access', _20 => _20.anthropicSdkHints, 'optionalAccess', _21 => _21.extendedContext, 'optionalAccess', _22 => _22.enabled]), () => ( false))
+    extendedContextEnabled: _nullishCoalesce(_optionalChain([route, 'access', _24 => _24.anthropicSdkHints, 'optionalAccess', _25 => _25.extendedContext, 'optionalAccess', _26 => _26.enabled]), () => ( false))
   };
 }
 async function runSameFormatFetch(bodyToSend, plan, options, keyOverride) {
@@ -1200,7 +1312,7 @@ async function runSameFormatFetch(bodyToSend, plan, options, keyOverride) {
   }
   const effectiveKey = _nullishCoalesce(_nullishCoalesce(keyOverride, () => ( apiKey)), () => ( ""));
   const headers = _chunkQ27JY5RGcjs.getProviderHeaders.call(void 0, provider, effectiveKey);
-  const callerBeta = _optionalChain([options, 'access', _23 => _23.callerAnthropicBeta, 'optionalAccess', _24 => _24.trim, 'call', _25 => _25()]);
+  const callerBeta = _optionalChain([options, 'access', _27 => _27.callerAnthropicBeta, 'optionalAccess', _28 => _28.trim, 'call', _29 => _29()]);
   if (callerBeta) {
     const existing = _nullishCoalesce(headers["anthropic-beta"], () => ( headers["Anthropic-Beta"]));
     const parts = new Set(
@@ -1214,7 +1326,7 @@ async function runSameFormatFetch(bodyToSend, plan, options, keyOverride) {
   _chunkGBHYAGX3cjs.injectExtendedContextBeta.call(void 0, headers, resolvedModel, _nullishCoalesce(extendedContextEnabled, () => ( false)));
   const url = _chunkA2YMUCBTcjs.buildProviderApiUrl.call(void 0, provider, { model: resolvedModel, stream: isStream });
   console.info(`[ProviderProxy:anthropic] (same-format) -> ${url} model=${resolvedModel} stream=${isStream}`);
-  const response = await _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+  const response = await _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
     url,
     { method: "POST", headers, body: bodyToSend },
     { providerId: "byo" }
@@ -1226,7 +1338,7 @@ function resolveSameFormatBody(anthropicBody, rawBody, plan) {
   try {
     const m = JSON.parse(rawBody).model;
     originalModel = typeof m === "string" ? m : void 0;
-  } catch (e12) {
+  } catch (e14) {
     originalModel = void 0;
   }
   return plan.resolvedModel !== originalModel ? JSON.stringify(anthropicBody) : rawBody;
@@ -1235,8 +1347,8 @@ async function runPipelineWithPoolReporting(anthropicBody, rawBody, plan, option
   const sameFormatBody = plan.sameFormat ? resolveSameFormatBody(anthropicBody, rawBody, plan) : rawBody;
   const runOnce = (keyOverride) => plan.sameFormat ? runSameFormatFetch(sameFormatBody, plan, options, keyOverride) : runPipeline(anthropicBody, plan);
   const first = await runOnce();
-  const outcome = await _optionalChain([plan, 'access', _26 => _26.auth, 'access', _27 => _27.onResult, 'optionalCall', _28 => _28(first.rawStatus)]);
-  if (_optionalChain([outcome, 'optionalAccess', _29 => _29.rebound])) {
+  const outcome = await _optionalChain([plan, 'access', _30 => _30.auth, 'access', _31 => _31.onResult, 'optionalCall', _32 => _32(first.rawStatus)]);
+  if (_optionalChain([outcome, 'optionalAccess', _33 => _33.rebound])) {
     console.info(
       "[ProviderProxy:anthropic] pool re-bound key after status",
       first.rawStatus,
@@ -1270,11 +1382,31 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     writeError(res, 502, "Anthropic route is missing a providerId");
     return;
   }
+  let delegatedApiKey = hints.apiKey;
+  if (route.authMode === "byo" && route.providerId) {
+    const provider = await deps.llmConfig.getProvider(route.providerId);
+    if (!provider) {
+      writeError(res, 502, `Provider not found: ${route.providerId}`);
+      return;
+    }
+    delegatedApiKey = await resolvePoolBoundKey(
+      deps,
+      route.providerId,
+      provider,
+      route.sessionId,
+      route.preferredKeyId,
+      route.boundKeyFallbackPolicy
+    );
+    if (!delegatedApiKey) {
+      writeError(res, 502, "API key not configured");
+      return;
+    }
+  }
   const handler = handlerFactory({
     llmConfig: deps.llmConfig,
     providerId: _nullishCoalesce(route.providerId, () => ( "")),
     model: route.model,
-    apiKey: hints.apiKey,
+    apiKey: delegatedApiKey,
     backgroundTaskModel: route.backgroundTaskModel,
     isOfficialProvider: hints.isOfficialProvider,
     thinkingLevel: hints.thinkingLevel,
@@ -1283,6 +1415,11 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     passThroughAuthToken: _nullishCoalesce(hints.passThroughAuthToken, () => ( null)),
     resolvePassThroughAuthToken: _nullishCoalesce(hints.resolvePassThroughAuthToken, () => ( null)),
     subscriptionProfile: _nullishCoalesce(hints.subscriptionProfile, () => ( null)),
+    preferredAccountId: hints.preferredAccountId,
+    preferredAccountGroup: hints.preferredAccountGroup,
+    boundAccountFallbackPolicy: hints.boundAccountFallbackPolicy,
+    preferredKeyId: route.preferredKeyId,
+    boundKeyFallbackPolicy: route.boundKeyFallbackPolicy,
     maxConcurrency: hints.maxConcurrency,
     webSearchService: _nullishCoalesce(hints.webSearchService, () => ( null)),
     onRetry: hints.onRetry,
@@ -1309,24 +1446,37 @@ function readGeminiUsage(usage) {
     reasoningTokens
   };
 }
+function emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution) {
+  const tapped = readGeminiUsage(rawUsageMetadata);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage: rawUsageMetadata
+  });
+}
 function recordGeminiNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readGeminiUsage(parsed.usageMetadata);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usageMetadata
-    });
-  } catch (e13) {
+    emitGeminiUsageRecord(
+      recorder,
+      parsed.usageMetadata,
+      attribution
+    );
+  } catch (e15) {
+  }
+}
+function recordGeminiStreamUsage(recorder, rawUsageMetadata, attribution) {
+  try {
+    emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution);
+  } catch (e16) {
   }
 }
 
@@ -1335,14 +1485,14 @@ var GENERATE_CONTENT_ACTION = ":generateContent";
 var STREAM_GENERATE_CONTENT_ACTION = ":streamGenerateContent";
 function isGeminiGenerateContentRequest(method, url) {
   if (method !== "POST" || !url) return false;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _30 => _30.split, 'call', _31 => _31("?"), 'access', _32 => _32[0], 'optionalAccess', _33 => _33.replace, 'call', _34 => _34(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _34 => _34.split, 'call', _35 => _35("?"), 'access', _36 => _36[0], 'optionalAccess', _37 => _37.replace, 'call', _38 => _38(/\/+$/, "")]), () => ( ""));
   const lastSegment = _nullishCoalesce(path.split("/").pop(), () => ( ""));
   return lastSegment.includes(STREAM_GENERATE_CONTENT_ACTION) || lastSegment.includes(GENERATE_CONTENT_ACTION);
 }
 function isGeminiStreamRequest(url) {
   if (!url) return false;
   const [path, query = ""] = url.split("?");
-  const lastSegment = _nullishCoalesce((_nullishCoalesce(_optionalChain([path, 'optionalAccess', _35 => _35.replace, 'call', _36 => _36(/\/+$/, "")]), () => ( ""))).split("/").pop(), () => ( ""));
+  const lastSegment = _nullishCoalesce((_nullishCoalesce(_optionalChain([path, 'optionalAccess', _39 => _39.replace, 'call', _40 => _40(/\/+$/, "")]), () => ( ""))).split("/").pop(), () => ( ""));
   if (lastSegment.includes(STREAM_GENERATE_CONTENT_ACTION)) return true;
   return /(^|&)alt=sse(&|$)/.test(query);
 }
@@ -1350,7 +1500,7 @@ async function handleGeminiGenerateContentRequest(res, rawBody, url, route, deps
   let geminiBody;
   try {
     geminiBody = JSON.parse(rawBody);
-  } catch (e14) {
+  } catch (e17) {
     writeError(res, 400, "Invalid JSON in request body");
     return;
   }
@@ -1366,16 +1516,32 @@ async function handleGeminiGenerateContentRequest(res, rawBody, url, route, deps
     const plan = await buildByoPlan2(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = await runPipelineWithPoolReporting2(geminiBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: _nullishCoalesce(route.providerId, () => ( "gemini")),
+      model: resolvedModel,
+      apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return _nullishCoalesce(event["usageMetadata"], () => ( null));
+      },
+      onUsage(rawUsage) {
+        recordGeminiStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: _nullishCoalesce(route.providerId, () => ( "gemini")),
-        model: resolvedModel,
-        apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
     const errMsg = _chunkSVNDB62Dcjs.serializeError.call(void 0, err);
@@ -1394,7 +1560,14 @@ async function buildByoPlan2(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1431,7 +1604,7 @@ async function runPipeline2(geminiBody, plan) {
   const authHeaders = {};
   await auth.applyHeaders(authHeaders, { upstreamUrl, model: resolvedModel });
   let rawStatus = null;
-  const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+  const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
     executor,
     request: geminiBody,
     provider: transformerProvider,
@@ -1449,7 +1622,7 @@ async function runPipeline2(geminiBody, plan) {
     },
     fetchFn: (url, headers, body) => {
       console.log(`[ProviderProxy:gemini] -> ${url} model=${resolvedModel} stream=${isStream}`);
-      return _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+      return _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
         { providerId: "byo" }
@@ -1464,8 +1637,8 @@ async function runPipeline2(geminiBody, plan) {
 }
 async function runPipelineWithPoolReporting2(geminiBody, plan) {
   const first = await runPipeline2(geminiBody, plan);
-  const outcome = await _optionalChain([plan, 'access', _37 => _37.auth, 'access', _38 => _38.onResult, 'optionalCall', _39 => _39(first.rawStatus)]);
-  if (_optionalChain([outcome, 'optionalAccess', _40 => _40.rebound])) {
+  const outcome = await _optionalChain([plan, 'access', _41 => _41.auth, 'access', _42 => _42.onResult, 'optionalCall', _43 => _43(first.rawStatus)]);
+  if (_optionalChain([outcome, 'optionalAccess', _44 => _44.rebound])) {
     console.log(
       "[ProviderProxy:gemini] pool re-bound key after status",
       first.rawStatus,
@@ -1494,31 +1667,44 @@ function readChatCompletionsUsage(usage) {
     reasoningTokens
   };
 }
+function emitChatCompletionsUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readChatCompletionsUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordChatCompletionsNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readChatCompletionsUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
-  } catch (e15) {
+    emitChatCompletionsUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch (e18) {
+  }
+}
+function recordChatCompletionsStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitChatCompletionsUsageRecord(recorder, rawUsage, attribution);
+  } catch (e19) {
   }
 }
 
 // src/provider-proxy/ingress/openaiChatIngress.ts
 function isOpenAIChatRequest(method, url) {
   if (method !== "POST" || !url) return false;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _41 => _41.split, 'call', _42 => _42("?"), 'access', _43 => _43[0], 'optionalAccess', _44 => _44.replace, 'call', _45 => _45(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _45 => _45.split, 'call', _46 => _46("?"), 'access', _47 => _47[0], 'optionalAccess', _48 => _48.replace, 'call', _49 => _49(/\/+$/, "")]), () => ( ""));
   return path.endsWith("/chat/completions");
 }
 var CHAT_BRIDGE_SUBSCRIPTION_PROVIDERS = /* @__PURE__ */ new Set(["claude"]);
@@ -1527,7 +1713,7 @@ async function handleOpenAIChatRequest(res, rawBody, route, deps) {
   let chatBody;
   try {
     chatBody = JSON.parse(rawBody);
-  } catch (e16) {
+  } catch (e20) {
     writeError(res, 400, "Invalid JSON in request body");
     return;
   }
@@ -1538,21 +1724,41 @@ async function handleOpenAIChatRequest(res, rawBody, route, deps) {
     const plan = route.authMode === "subscription" ? await buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream) : await buildByoPlan3(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = plan.isSubscription ? await runPipelineWithSubscriptionRetry2(chatBody, plan) : await runPipelineWithPoolReporting3(chatBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: _nullishCoalesce(route.providerId, () => ( "openai")),
+      model: resolvedModel,
+      apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return _nullishCoalesce(event["usage"], () => ( null));
+      },
+      onUsage(rawUsage) {
+        recordChatCompletionsStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: _nullishCoalesce(route.providerId, () => ( "openai")),
-        model: resolvedModel,
-        apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (_chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = _chunkSVNDB62Dcjs.serializeError.call(void 0, err);
     console.error("[ProviderProxy:chat] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError.call(void 0, err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
@@ -1566,7 +1772,14 @@ async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1613,12 +1826,12 @@ async function buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream)
     );
     return null;
   }
-  const upstreamUrl = _optionalChain([profile, 'access', _46 => _46.resolveUpstreamUrl, 'optionalCall', _47 => _47(resolvedModel)]);
+  const upstreamUrl = _optionalChain([profile, 'access', _50 => _50.resolveUpstreamUrl, 'optionalCall', _51 => _51(resolvedModel)]);
   if (!upstreamUrl) {
     writeError(res, 502, "Subscription profile is missing resolveUpstreamUrl");
     return null;
   }
-  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkKFI44N2Rcjs.SubscriptionAuthSource)(profile)));
+  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkYNJNTCSQcjs.SubscriptionAuthSource)(profile)));
   const chain = _chunkNYUNU75Acjs.resolveSubscriptionChain.call(void 0, 
     profile,
     deps.llmConfig.getTransformerService(),
@@ -1632,6 +1845,9 @@ async function buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream)
   };
   return {
     auth,
+    preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1650,12 +1866,15 @@ async function runPipeline3(chatBody, plan) {
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
   });
   let rawStatus = null;
-  const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+  const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
     executor,
     request: chatBody,
     provider: transformerProvider,
@@ -1672,7 +1891,7 @@ async function runPipeline3(chatBody, plan) {
     },
     fetchFn: (url, headers, body) => {
       console.log(`[ProviderProxy:chat] -> ${url} model=${resolvedModel} stream=${isStream}`);
-      return _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+      return _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
         { providerId: plan.proxyProviderId, accountId: proxyAccountId }
@@ -1687,8 +1906,8 @@ async function runPipeline3(chatBody, plan) {
 }
 async function runPipelineWithPoolReporting3(chatBody, plan) {
   const first = await runPipeline3(chatBody, plan);
-  const outcome = await _optionalChain([plan, 'access', _48 => _48.auth, 'access', _49 => _49.onResult, 'optionalCall', _50 => _50(first.rawStatus)]);
-  if (_optionalChain([outcome, 'optionalAccess', _51 => _51.rebound])) {
+  const outcome = await _optionalChain([plan, 'access', _52 => _52.auth, 'access', _53 => _53.onResult, 'optionalCall', _54 => _54(first.rawStatus)]);
+  if (_optionalChain([outcome, 'optionalAccess', _55 => _55.rebound])) {
     console.log(
       "[ProviderProxy:chat] pool re-bound key after status",
       first.rawStatus,
@@ -1701,7 +1920,7 @@ async function runPipelineWithPoolReporting3(chatBody, plan) {
 async function runPipelineWithSubscriptionRetry2(chatBody, plan) {
   const first = await runPipeline3(chatBody, plan);
   if (first.rawStatus !== 401) return first;
-  const refreshed = await _optionalChain([plan, 'access', _52 => _52.auth, 'access', _53 => _53.onUnauthorized, 'optionalCall', _54 => _54()]);
+  const refreshed = await _optionalChain([plan, 'access', _56 => _56.auth, 'access', _57 => _57.onUnauthorized, 'optionalCall', _58 => _58()]);
   if (!refreshed) {
     console.warn("[ProviderProxy:chat] 401 not recoverable (onUnauthorized returned false)");
     return first;
@@ -1728,63 +1947,107 @@ function readResponsesUsage(usage) {
     reasoningTokens
   };
 }
+function emitResponsesUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readResponsesUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordResponsesNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readResponsesUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
-  } catch (e17) {
+    emitResponsesUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch (e21) {
+  }
+}
+function recordResponsesStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitResponsesUsageRecord(recorder, rawUsage, attribution);
+  } catch (e22) {
   }
 }
 
 // src/provider-proxy/ingress/openaiResponsesIngress.ts
 function isOpenAIResponsesRequest(method, url) {
   if (method !== "POST" || !url) return false;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _55 => _55.split, 'call', _56 => _56("?"), 'access', _57 => _57[0], 'optionalAccess', _58 => _58.replace, 'call', _59 => _59(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _59 => _59.split, 'call', _60 => _60("?"), 'access', _61 => _61[0], 'optionalAccess', _62 => _62.replace, 'call', _63 => _63(/\/+$/, "")]), () => ( ""));
   return path.endsWith("/responses");
 }
-async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
+async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHeaders = {}) {
   let responsesBody;
   try {
     responsesBody = JSON.parse(rawBody);
-  } catch (e18) {
+  } catch (e23) {
     writeError(res, 400, "Invalid JSON in request body");
     return;
   }
   const isStream = responsesBody.stream === true;
+  const derivedSession = _chunkEJLH6NFTcjs.deriveGatewaySessionKey.call(void 0, responsesBody, requestHeaders, {
+    endpoint: "responses",
+    // A verified outbound key is the strongest route-local fallback. Resident
+    // proxy callers without one still get a stable run/session bucket; the
+    // final `anonymous` fallback is handled inside the shared utility.
+    fallbackKey: _nullishCoalesce(_nullishCoalesce(route.apiKeyId, () => ( route.sessionId)), () => ( void 0))
+  });
+  const sessionKey = derivedSession.key;
   const resolvedModel = route.model;
   responsesBody.model = resolvedModel;
   try {
-    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream, route.requestedModel);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: _nullishCoalesce(route.providerId, () => ( "codex")),
+      model: resolvedModel,
+      apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] !== "response.completed") return null;
+        const response = event["response"];
+        const usage = _optionalChain([response, 'optionalAccess', _64 => _64["usage"]]);
+        return _nullishCoalesce(usage, () => ( null));
+      },
+      onUsage(rawUsage) {
+        recordResponsesStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      route.requestedModel,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: _nullishCoalesce(route.providerId, () => ( "codex")),
-        model: resolvedModel,
-        apiKeyId: _nullishCoalesce(route.apiKeyId, () => ( null)),
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (_chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = _chunkSVNDB62Dcjs.serializeError.call(void 0, err);
     console.error("[ProviderProxy:responses] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError.call(void 0, err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
@@ -1798,7 +2061,14 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1829,18 +2099,18 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     proxyProviderId: "byo"
   };
 }
-async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) {
+async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey) {
   const profile = route.subscriptionProfile;
   if (!profile) {
     writeError(res, 502, "Subscription mode requires a codex subscription profile");
     return null;
   }
-  const upstreamUrl = _optionalChain([profile, 'access', _60 => _60.resolveUpstreamUrl, 'optionalCall', _61 => _61(resolvedModel)]);
+  const upstreamUrl = _optionalChain([profile, 'access', _65 => _65.resolveUpstreamUrl, 'optionalCall', _66 => _66(resolvedModel)]);
   if (!upstreamUrl) {
     writeError(res, 502, "Subscription profile is missing resolveUpstreamUrl");
     return null;
   }
-  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkKFI44N2Rcjs.SubscriptionAuthSource)(profile)));
+  const auth = _nullishCoalesce(route.auth, () => ( new (0, _chunkYNJNTCSQcjs.SubscriptionAuthSource)(profile)));
   const chain = _chunkNYUNU75Acjs.resolveSubscriptionChain.call(void 0, 
     profile,
     deps.llmConfig.getTransformerService(),
@@ -1854,15 +2124,27 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
   };
   if (profile.authStrategy.providerId === "gemini") {
     try {
-      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile);
+      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile, {
+        sessionKey,
+        preferredAccountId: route.preferredAccountId,
+        preferredAccountGroup: route.preferredAccountGroup,
+        boundAccountFallbackPolicy: route.boundAccountFallbackPolicy
+      });
     } catch (err) {
+      if (_chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) {
+        writeBoundAccountError(res, err);
+        return null;
+      }
       writeError(res, 502, _chunkSVNDB62Dcjs.serializeError.call(void 0, err));
       return null;
     }
   }
   return {
     auth,
+    sessionKey,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1875,9 +2157,9 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
     proxyProviderId: profile.authStrategy.providerId
   };
 }
-async function resolveGeminiCodeAssistProject(profile) {
+async function resolveGeminiCodeAssistProject(profile, hints) {
   const probe = {};
-  await profile.authStrategy.applyHeaders(probe);
+  await profile.authStrategy.applyHeaders(probe, hints);
   const bearer = _nullishCoalesce(_nullishCoalesce(probe.Authorization, () => ( probe.authorization)), () => ( ""));
   const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
   if (!accessToken) return void 0;
@@ -1888,19 +2170,22 @@ async function resolveGeminiCodeAssistProject(profile) {
 async function runPipeline4(responsesBody, plan) {
   const executor = getSharedExecutor();
   const endpointTransformer = getResponsesEndpointTransformer();
-  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const { auth, sessionKey, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
   let proxyAccountId;
   const authHeaders = {};
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
   });
   let rawStatus = null;
-  const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+  const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
     executor,
     request: responsesBody,
     provider: transformerProvider,
@@ -1918,7 +2203,7 @@ async function runPipeline4(responsesBody, plan) {
     },
     fetchFn: (url, headers, body) => {
       console.log(`[ProviderProxy:responses] -> ${url} model=${resolvedModel} stream=${isStream}`);
-      return _chunkPG7PS2NNcjs.fetchUpstream.call(void 0, 
+      return _chunkKCVJWJSTcjs.fetchUpstream.call(void 0, 
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
         { providerId: plan.proxyProviderId, accountId: proxyAccountId }
@@ -1933,8 +2218,8 @@ async function runPipeline4(responsesBody, plan) {
 }
 async function runPipelineWithPoolReporting4(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
-  const outcome = await _optionalChain([plan, 'access', _62 => _62.auth, 'access', _63 => _63.onResult, 'optionalCall', _64 => _64(first.rawStatus)]);
-  if (_optionalChain([outcome, 'optionalAccess', _65 => _65.rebound])) {
+  const outcome = await _optionalChain([plan, 'access', _67 => _67.auth, 'access', _68 => _68.onResult, 'optionalCall', _69 => _69(first.rawStatus)]);
+  if (_optionalChain([outcome, 'optionalAccess', _70 => _70.rebound])) {
     console.log(
       "[ProviderProxy:responses] pool re-bound key after status",
       first.rawStatus,
@@ -1947,7 +2232,7 @@ async function runPipelineWithPoolReporting4(responsesBody, plan) {
 async function runPipelineWithSubscriptionRetry3(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
   if (first.rawStatus !== 401) return first;
-  const refreshed = await _optionalChain([plan, 'access', _66 => _66.auth, 'access', _67 => _67.onUnauthorized, 'optionalCall', _68 => _68()]);
+  const refreshed = await _optionalChain([plan, 'access', _71 => _71.auth, 'access', _72 => _72.onUnauthorized, 'optionalCall', _73 => _73(plan.sessionKey)]);
   if (!refreshed) {
     console.warn("[ProviderProxy:responses] 401 not recoverable (onUnauthorized returned false)");
     return first;
@@ -1969,7 +2254,7 @@ function resolveRouteToken(req) {
   if (fromAuth) return fromAuth;
   const googKey = req.headers["x-goog-api-key"];
   const value = Array.isArray(googKey) ? googKey[0] : googKey;
-  return _optionalChain([value, 'optionalAccess', _69 => _69.trim, 'call', _70 => _70()]) || void 0;
+  return _optionalChain([value, 'optionalAccess', _74 => _74.trim, 'call', _75 => _75()]) || void 0;
 }
 async function routeRequest(req, res, routes, deps) {
   const token = resolveRouteToken(req);
@@ -1986,7 +2271,7 @@ async function routeRequest(req, res, routes, deps) {
   }
   if (isOpenAIResponsesRequest(method, url)) {
     const rawBody = await readBody(req);
-    await handleOpenAIResponsesRequest(res, rawBody, route, deps);
+    await handleOpenAIResponsesRequest(res, rawBody, route, deps, req.headers);
     return;
   }
   if (isOpenAIChatRequest(method, url)) {
@@ -2177,11 +2462,11 @@ var DEFAULT_ACCOUNT_HEALTH = {
   overloadCooldownMs: 10 * 6e4
 };
 function normalizeAccountHealth(raw) {
-  const ah = _optionalChain([raw, 'optionalAccess', _71 => _71.accountHealth]);
+  const ah = _optionalChain([raw, 'optionalAccess', _76 => _76.accountHealth]);
   return {
-    overloadCooldownEnabled: _optionalChain([ah, 'optionalAccess', _72 => _72.overloadCooldownEnabled]) !== false,
+    overloadCooldownEnabled: _optionalChain([ah, 'optionalAccess', _77 => _77.overloadCooldownEnabled]) !== false,
     overloadCooldownMs: clampNumber(
-      _optionalChain([ah, 'optionalAccess', _73 => _73.overloadCooldownMs]),
+      _optionalChain([ah, 'optionalAccess', _78 => _78.overloadCooldownMs]),
       6e4,
       36e5,
       DEFAULT_ACCOUNT_HEALTH.overloadCooldownMs
@@ -2196,54 +2481,86 @@ var DEFAULT_ACCOUNT_PROBE = {
   historySize: 10,
   staggerMs: 500
 };
+var DEFAULT_ALLOWANCE_SCHEDULING = {
+  enabled: false,
+  demoteAtPercent: 80,
+  pauseAtPercent: 98,
+  priorityPenalty: 100
+};
+function normalizeAllowanceScheduling(raw) {
+  const value = _optionalChain([raw, 'optionalAccess', _79 => _79.allowanceScheduling]);
+  const demoteAtPercent = clampNumber(
+    _optionalChain([value, 'optionalAccess', _80 => _80.demoteAtPercent]),
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.demoteAtPercent
+  );
+  const requestedPause = clampNumber(
+    _optionalChain([value, 'optionalAccess', _81 => _81.pauseAtPercent]),
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.pauseAtPercent
+  );
+  return {
+    enabled: _optionalChain([value, 'optionalAccess', _82 => _82.enabled]) === true,
+    demoteAtPercent,
+    pauseAtPercent: Math.max(demoteAtPercent, requestedPause),
+    priorityPenalty: Math.trunc(clampNumber(
+      _optionalChain([value, 'optionalAccess', _83 => _83.priorityPenalty]),
+      1,
+      1e3,
+      DEFAULT_ALLOWANCE_SCHEDULING.priorityPenalty
+    ))
+  };
+}
 function normalizeAccountProbe(raw) {
-  const ap = _optionalChain([raw, 'optionalAccess', _74 => _74.accountProbe]);
+  const ap = _optionalChain([raw, 'optionalAccess', _84 => _84.accountProbe]);
   return {
-    enabled: _optionalChain([ap, 'optionalAccess', _75 => _75.enabled]) === true,
-    intervalMs: clampNumber(_optionalChain([ap, 'optionalAccess', _76 => _76.intervalMs]), 6e4, 864e5, DEFAULT_ACCOUNT_PROBE.intervalMs),
-    onlyMultiAccount: _optionalChain([ap, 'optionalAccess', _77 => _77.onlyMultiAccount]) !== false,
-    timeoutMs: clampNumber(_optionalChain([ap, 'optionalAccess', _78 => _78.timeoutMs]), 1e3, 6e4, DEFAULT_ACCOUNT_PROBE.timeoutMs),
+    enabled: _optionalChain([ap, 'optionalAccess', _85 => _85.enabled]) === true,
+    intervalMs: clampNumber(_optionalChain([ap, 'optionalAccess', _86 => _86.intervalMs]), 6e4, 864e5, DEFAULT_ACCOUNT_PROBE.intervalMs),
+    onlyMultiAccount: _optionalChain([ap, 'optionalAccess', _87 => _87.onlyMultiAccount]) !== false,
+    timeoutMs: clampNumber(_optionalChain([ap, 'optionalAccess', _88 => _88.timeoutMs]), 1e3, 6e4, DEFAULT_ACCOUNT_PROBE.timeoutMs),
     historySize: Math.trunc(
-      clampNumber(_optionalChain([ap, 'optionalAccess', _79 => _79.historySize]), 1, 200, DEFAULT_ACCOUNT_PROBE.historySize)
+      clampNumber(_optionalChain([ap, 'optionalAccess', _89 => _89.historySize]), 1, 200, DEFAULT_ACCOUNT_PROBE.historySize)
     ),
-    staggerMs: clampNumber(_optionalChain([ap, 'optionalAccess', _80 => _80.staggerMs]), 0, 6e4, DEFAULT_ACCOUNT_PROBE.staggerMs)
+    staggerMs: clampNumber(_optionalChain([ap, 'optionalAccess', _90 => _90.staggerMs]), 0, 6e4, DEFAULT_ACCOUNT_PROBE.staggerMs)
   };
 }
 function normalizeAudit(raw) {
-  const a = _optionalChain([raw, 'optionalAccess', _81 => _81.audit]);
+  const a = _optionalChain([raw, 'optionalAccess', _91 => _91.audit]);
   return {
-    enabled: _optionalChain([a, 'optionalAccess', _82 => _82.enabled]) === true,
-    captureBodies: _optionalChain([a, 'optionalAccess', _83 => _83.captureBodies]) === true,
+    enabled: _optionalChain([a, 'optionalAccess', _92 => _92.enabled]) === true,
+    captureBodies: _optionalChain([a, 'optionalAccess', _93 => _93.captureBodies]) === true,
     maxBodyBytes: Math.trunc(
-      clampNumber(_optionalChain([a, 'optionalAccess', _84 => _84.maxBodyBytes]), 256, 1048576, _audittypes.DEFAULT_AUDIT_CONFIG.maxBodyBytes)
+      clampNumber(_optionalChain([a, 'optionalAccess', _94 => _94.maxBodyBytes]), 256, 1048576, _audittypes.DEFAULT_AUDIT_CONFIG.maxBodyBytes)
     ),
     retentionDays: Math.trunc(
-      clampNumber(_optionalChain([a, 'optionalAccess', _85 => _85.retentionDays]), 1, 365, _audittypes.DEFAULT_AUDIT_CONFIG.retentionDays)
+      clampNumber(_optionalChain([a, 'optionalAccess', _95 => _95.retentionDays]), 1, 365, _audittypes.DEFAULT_AUDIT_CONFIG.retentionDays)
     ),
-    trustForwardedFor: _optionalChain([a, 'optionalAccess', _86 => _86.trustForwardedFor]) === true
+    trustForwardedFor: _optionalChain([a, 'optionalAccess', _96 => _96.trustForwardedFor]) === true
   };
 }
 function normalizeBilling(raw) {
-  const b = _optionalChain([raw, 'optionalAccess', _87 => _87.billing]);
+  const b = _optionalChain([raw, 'optionalAccess', _97 => _97.billing]);
   const config = {
-    enabled: _optionalChain([b, 'optionalAccess', _88 => _88.enabled]) === true,
+    enabled: _optionalChain([b, 'optionalAccess', _98 => _98.enabled]) === true,
     maxRetryAgeMs: Math.trunc(
-      clampNumber(_optionalChain([b, 'optionalAccess', _89 => _89.maxRetryAgeMs]), 6e4, 2592e6, _billingtypes.DEFAULT_BILLING_CONFIG.maxRetryAgeMs)
+      clampNumber(_optionalChain([b, 'optionalAccess', _99 => _99.maxRetryAgeMs]), 6e4, 2592e6, _billingtypes.DEFAULT_BILLING_CONFIG.maxRetryAgeMs)
     )
   };
-  if (typeof _optionalChain([b, 'optionalAccess', _90 => _90.endpoint]) === "string" && b.endpoint.trim()) config.endpoint = b.endpoint.trim();
-  if (typeof _optionalChain([b, 'optionalAccess', _91 => _91.secret]) === "string" && b.secret.length > 0) config.secret = b.secret;
+  if (typeof _optionalChain([b, 'optionalAccess', _100 => _100.endpoint]) === "string" && b.endpoint.trim()) config.endpoint = b.endpoint.trim();
+  if (typeof _optionalChain([b, 'optionalAccess', _101 => _101.secret]) === "string" && b.secret.length > 0) config.secret = b.secret;
   return config;
 }
 var DEFAULT_FINGERPRINT = { enabled: false };
 function normalizeFingerprint(raw) {
-  const f = _optionalChain([raw, 'optionalAccess', _92 => _92.fingerprint]);
-  const out = { enabled: _optionalChain([f, 'optionalAccess', _93 => _93.enabled]) === true };
-  if (typeof _optionalChain([f, 'optionalAccess', _94 => _94.ua]) === "string" && f.ua.trim().length > 0) out.ua = f.ua.trim();
+  const f = _optionalChain([raw, 'optionalAccess', _102 => _102.fingerprint]);
+  const out = { enabled: _optionalChain([f, 'optionalAccess', _103 => _103.enabled]) === true };
+  if (typeof _optionalChain([f, 'optionalAccess', _104 => _104.ua]) === "string" && f.ua.trim().length > 0) out.ua = f.ua.trim();
   return out;
 }
 function normalizeVoucher(raw) {
-  return { enabled: _optionalChain([raw, 'optionalAccess', _95 => _95.voucher, 'optionalAccess', _96 => _96.enabled]) === true };
+  return { enabled: _optionalChain([raw, 'optionalAccess', _105 => _105.voucher, 'optionalAccess', _106 => _106.enabled]) === true };
 }
 var PROXY_TYPES = ["http", "https", "socks5"];
 function normalizeProxyConfig(raw) {
@@ -2327,14 +2644,14 @@ function clampNumber(value, min, max, fallback) {
   return Math.min(max, Math.max(min, n));
 }
 function normalizeQueueSegments(raw) {
-  const umq = _optionalChain([raw, 'optionalAccess', _97 => _97.userMessageQueue]);
-  const cq = _optionalChain([raw, 'optionalAccess', _98 => _98.concurrencyQueue]);
+  const umq = _optionalChain([raw, 'optionalAccess', _107 => _107.userMessageQueue]);
+  const cq = _optionalChain([raw, 'optionalAccess', _108 => _108.concurrencyQueue]);
   return {
     userMessageQueue: {
-      enabled: _optionalChain([umq, 'optionalAccess', _99 => _99.enabled]) === true,
-      delayMs: clampNumber(_optionalChain([umq, 'optionalAccess', _100 => _100.delayMs]), 0, 1e4, DEFAULT_USER_MESSAGE_QUEUE.delayMs),
+      enabled: _optionalChain([umq, 'optionalAccess', _109 => _109.enabled]) === true,
+      delayMs: clampNumber(_optionalChain([umq, 'optionalAccess', _110 => _110.delayMs]), 0, 1e4, DEFAULT_USER_MESSAGE_QUEUE.delayMs),
       waitTimeoutMs: clampNumber(
-        _optionalChain([umq, 'optionalAccess', _101 => _101.waitTimeoutMs]),
+        _optionalChain([umq, 'optionalAccess', _111 => _111.waitTimeoutMs]),
         1e3,
         3e5,
         DEFAULT_USER_MESSAGE_QUEUE.waitTimeoutMs
@@ -2342,14 +2659,14 @@ function normalizeQueueSegments(raw) {
     },
     concurrencyQueue: {
       maxQueueSizeFactor: clampNumber(
-        _optionalChain([cq, 'optionalAccess', _102 => _102.maxQueueSizeFactor]),
+        _optionalChain([cq, 'optionalAccess', _112 => _112.maxQueueSizeFactor]),
         1,
         10,
         DEFAULT_CONCURRENCY_QUEUE.maxQueueSizeFactor
       ),
-      minQueueSize: clampNumber(_optionalChain([cq, 'optionalAccess', _103 => _103.minQueueSize]), 1, 100, DEFAULT_CONCURRENCY_QUEUE.minQueueSize),
+      minQueueSize: clampNumber(_optionalChain([cq, 'optionalAccess', _113 => _113.minQueueSize]), 1, 100, DEFAULT_CONCURRENCY_QUEUE.minQueueSize),
       waitTimeoutMs: clampNumber(
-        _optionalChain([cq, 'optionalAccess', _104 => _104.waitTimeoutMs]),
+        _optionalChain([cq, 'optionalAccess', _114 => _114.waitTimeoutMs]),
         1e3,
         3e5,
         DEFAULT_CONCURRENCY_QUEUE.waitTimeoutMs
@@ -2360,11 +2677,11 @@ function normalizeQueueSegments(raw) {
 var ALL_ENDPOINTS = ["chat", "responses", "messages", "gemini"];
 function blankModelMap(endpoint) {
   const modelMap = {};
-  for (const kind of _chunkVACWOIREcjs.modelKindsForEndpoint.call(void 0, endpoint)) modelMap[kind] = "";
+  for (const kind of _chunk4VZX5F4Tcjs.modelKindsForEndpoint.call(void 0, endpoint)) modelMap[kind] = "";
   return modelMap;
 }
 function defaultEndpointConfig(endpoint) {
-  if (_chunkVACWOIREcjs.isKindMappedEndpoint.call(void 0, endpoint)) {
+  if (_chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, endpoint)) {
     return { endpoint, modelMap: blankModelMap(endpoint), useSubscription: false };
   }
   if (endpoint === "chat") {
@@ -2390,13 +2707,14 @@ function normalizePrefixTargets(raw) {
 function normalizeEndpointConfig(e) {
   const endpoint = e.endpoint;
   const useSubscription = e.useSubscription === true;
-  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId : void 0;
+  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId.trim() : void 0;
+  const boundAccountFallbackPolicy = boundAccountId ? e.boundAccountFallbackPolicy === "pool" ? "pool" : "strict" : void 0;
   const boundKeyId = typeof e.boundKeyId === "string" && e.boundKeyId.trim() !== "" ? e.boundKeyId : void 0;
   let config;
-  if (_chunkVACWOIREcjs.isKindMappedEndpoint.call(void 0, endpoint)) {
+  if (_chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, endpoint)) {
     const rawMap = e.modelMap && typeof e.modelMap === "object" ? e.modelMap : {};
     const modelMap = {};
-    for (const kind of _chunkVACWOIREcjs.modelKindsForEndpoint.call(void 0, endpoint)) {
+    for (const kind of _chunk4VZX5F4Tcjs.modelKindsForEndpoint.call(void 0, endpoint)) {
       const v = rawMap[kind];
       modelMap[kind] = typeof v === "string" ? v : "";
     }
@@ -2420,21 +2738,186 @@ function normalizeEndpointConfig(e) {
       config.backgroundModelIds = e.backgroundModelIds;
     }
   }
-  if (boundAccountId) config.boundAccountId = boundAccountId;
+  if (boundAccountId) {
+    config.boundAccountId = boundAccountId;
+    config.boundAccountFallbackPolicy = boundAccountFallbackPolicy;
+  }
   if (boundKeyId) config.boundKeyId = boundKeyId;
   return config;
 }
+function normalizeBindingTarget(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const target = raw;
+  const providerId = typeof target.providerId === "string" ? target.providerId.trim() : "";
+  if (!providerId) return null;
+  if (target.kind === "account") {
+    const accountId = typeof target.accountId === "string" ? target.accountId.trim() : "";
+    return accountId ? { kind: "account", providerId, accountId } : null;
+  }
+  if (target.kind === "account-group") {
+    const group = typeof target.group === "string" ? target.group.trim() : "";
+    return group ? { kind: "account-group", providerId, group } : null;
+  }
+  if (target.kind === "account-pool") return { kind: "account-pool", providerId };
+  if (target.kind === "provider") {
+    const keyId = typeof target.keyId === "string" ? target.keyId.trim() : "";
+    return keyId ? { kind: "provider", providerId, keyId } : { kind: "provider", providerId };
+  }
+  return null;
+}
+function normalizeGatewayModelMappings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const mappings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const source = typeof value.source === "string" ? value.source.trim() : "";
+    const target = typeof value.target === "string" ? value.target.trim() : "";
+    if (!source || !target) continue;
+    mappings.push({ source, target });
+  }
+  return mappings;
+}
+function hasConfiguredLegacyModels(config) {
+  return Object.values(_nullishCoalesce(config.modelMap, () => ( {}))).some((value) => typeof value === "string" && value.trim()) || Boolean(_optionalChain([config, 'access', _115 => _115.models, 'optionalAccess', _116 => _116.some, 'call', _117 => _117((value) => typeof value === "string" && value.trim())])) || Boolean(_optionalChain([config, 'access', _118 => _118.defaultModel, 'optionalAccess', _119 => _119.trim, 'call', _120 => _120()])) || Boolean(_optionalChain([config, 'access', _121 => _121.backgroundModel, 'optionalAccess', _122 => _122.trim, 'call', _123 => _123()])) || Boolean(Object.values(_nullishCoalesce(config.prefixTargets, () => ( {}))).some((value) => _optionalChain([value, 'optionalAccess', _124 => _124.trim, 'call', _125 => _125()])));
+}
+function splitModelRef(ref) {
+  if (typeof ref !== "string") return null;
+  const idx = ref.indexOf(",");
+  if (idx <= 0) return null;
+  const providerId = ref.slice(0, idx).trim();
+  const modelId = ref.slice(idx + 1).trim();
+  return providerId && modelId ? { providerId, modelId } : null;
+}
+function legacyTarget(config, providerId) {
+  if (config.useSubscription) {
+    if (config.boundAccountId) {
+      return { kind: "account", providerId, accountId: config.boundAccountId };
+    }
+    if (config.boundAccountGroup) {
+      return { kind: "account-group", providerId, group: config.boundAccountGroup };
+    }
+    return { kind: "account-pool", providerId };
+  }
+  return config.boundKeyId ? { kind: "provider", providerId, keyId: config.boundKeyId } : { kind: "provider", providerId };
+}
+function legacyEndpointToBindings(config) {
+  const fallback = config.boundAccountId && config.boundAccountFallbackPolicy === "strict" ? "fail" : "next";
+  const byProvider = /* @__PURE__ */ new Map();
+  const routeFor = (providerId) => {
+    const existing = byProvider.get(providerId);
+    if (existing) return existing;
+    const created = {
+      id: `legacy-${config.endpoint}-${providerId}`,
+      name: `${config.endpoint} \xB7 ${providerId}`,
+      enabled: true,
+      keyScope: "all",
+      endpoint: config.endpoint,
+      target: legacyTarget(config, providerId),
+      fallback,
+      modelMode: "mapped"
+    };
+    byProvider.set(providerId, created);
+    return created;
+  };
+  for (const [kind, ref] of Object.entries(_nullishCoalesce(config.modelMap, () => ( {})))) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.modelMap = { ...route.modelMap, [kind]: ref };
+  }
+  for (const ref of _nullishCoalesce(config.models, () => ( []))) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.models = [..._nullishCoalesce(route.models, () => ( [])), ref];
+  }
+  for (const [prefix, ref] of Object.entries(_nullishCoalesce(config.prefixTargets, () => ( {})))) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.dispatchMode = "prefix";
+    route.prefixTargets = { ...route.prefixTargets, [prefix]: ref };
+  }
+  for (const [field, ref] of [
+    ["defaultModel", config.defaultModel],
+    ["backgroundModel", config.backgroundModel]
+  ]) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route[field] = ref;
+    if (_optionalChain([config, 'access', _126 => _126.backgroundModelIds, 'optionalAccess', _127 => _127.length])) {
+      route.backgroundModelIds = [...config.backgroundModelIds];
+    }
+  }
+  return [...byProvider.values()];
+}
+function legacyEndpointsToBindings(endpoints) {
+  return endpoints.filter((endpoint) => hasConfiguredLegacyModels(endpoint)).flatMap((endpoint) => legacyEndpointToBindings(endpoint));
+}
+function normalizeGatewayBindings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const bindings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const id = typeof value.id === "string" ? value.id.trim() : "";
+    const name = typeof value.name === "string" ? value.name.trim() : "";
+    const endpoint = value.endpoint;
+    const target = normalizeBindingTarget(value.target);
+    if (!id || seen.has(id) || !name || !ALL_ENDPOINTS.includes(endpoint) || !target) continue;
+    seen.add(id);
+    const normalizedRoute = normalizeEndpointConfig({
+      ...value,
+      endpoint,
+      useSubscription: target.kind !== "provider"
+    });
+    const apiKeyIds = Array.isArray(value.apiKeyIds) ? [...new Set(value.apiKeyIds.filter((key) => typeof key === "string" && key.trim() !== "").map((key) => key.trim()))] : [];
+    const keyScope = value.keyScope === "selected" ? "selected" : value.keyScope === "all" ? "all" : apiKeyIds.length > 0 ? "selected" : "all";
+    const modelMappings = normalizeGatewayModelMappings(value.modelMappings);
+    const modelMode = value.modelMode === "passthrough" ? "passthrough" : value.modelMode === "mapped" ? "mapped" : modelMappings.length > 0 || hasConfiguredLegacyModels(normalizedRoute) ? "mapped" : "passthrough";
+    const priority = typeof value.priority === "number" && Number.isFinite(value.priority) ? Math.max(0, Math.min(1e4, Math.round(value.priority))) : void 0;
+    const binding = {
+      id,
+      name,
+      enabled: value.enabled !== false,
+      keyScope,
+      endpoint,
+      target,
+      // Legacy `'global'` meant "yield to the removed global endpoint fallback";
+      // it now yields to the next matching route, which is the same default.
+      fallback: value.fallback === "fail" ? "fail" : "next",
+      modelMode
+    };
+    if (apiKeyIds.length > 0) binding.apiKeyIds = apiKeyIds;
+    if (modelMappings.length > 0) binding.modelMappings = modelMappings;
+    if (priority !== void 0) binding.priority = priority;
+    if (normalizedRoute.modelMap) binding.modelMap = normalizedRoute.modelMap;
+    if (normalizedRoute.models) binding.models = normalizedRoute.models;
+    if (normalizedRoute.dispatchMode) binding.dispatchMode = normalizedRoute.dispatchMode;
+    if (normalizedRoute.prefixTargets) binding.prefixTargets = normalizedRoute.prefixTargets;
+    if (normalizedRoute.defaultModel !== void 0) binding.defaultModel = normalizedRoute.defaultModel;
+    if (normalizedRoute.backgroundModel !== void 0) binding.backgroundModel = normalizedRoute.backgroundModel;
+    if (normalizedRoute.backgroundModelIds) binding.backgroundModelIds = normalizedRoute.backgroundModelIds;
+    bindings.push(binding);
+  }
+  return bindings;
+}
 function defaultServerConfig() {
   const queues = normalizeQueueSegments(void 0);
   return {
     enabled: false,
     networkBinding: false,
     endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings: [],
     port: DEFAULT_OUTBOUND_PORT,
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(void 0),
     accountProbe: normalizeAccountProbe(void 0),
+    allowanceScheduling: normalizeAllowanceScheduling(void 0),
     audit: normalizeAudit(void 0),
     billing: normalizeBilling(void 0),
     fingerprint: normalizeFingerprint(void 0),
@@ -2451,17 +2934,20 @@ function normalizeServerConfig(raw) {
     }
   }
   const queues = normalizeQueueSegments(raw);
+  const legacyEndpoints = ALL_ENDPOINTS.map((ep) => _nullishCoalesce(byEndpoint.get(ep), () => ( defaultEndpointConfig(ep))));
+  const persistedBindings = normalizeGatewayBindings(raw.bindings);
+  const bindings = persistedBindings.length > 0 ? persistedBindings : normalizeGatewayBindings(legacyEndpointsToBindings(legacyEndpoints));
   const config = {
     enabled: raw.enabled === true,
     networkBinding: raw.networkBinding === true,
-    endpoints: ALL_ENDPOINTS.map(
-      (ep) => _nullishCoalesce(byEndpoint.get(ep), () => ( defaultEndpointConfig(ep)))
-    ),
+    endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings,
     port: _nullishCoalesce(raw.port, () => ( base.port)),
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(raw),
     accountProbe: normalizeAccountProbe(raw),
+    allowanceScheduling: normalizeAllowanceScheduling(raw),
     audit: normalizeAudit(raw),
     billing: normalizeBilling(raw),
     fingerprint: normalizeFingerprint(raw),
@@ -2487,11 +2973,13 @@ function mergeServerConfig(current, patch) {
     enabled: _nullishCoalesce(patch.enabled, () => ( current.enabled)),
     networkBinding: _nullishCoalesce(patch.networkBinding, () => ( current.networkBinding)),
     endpoints: _nullishCoalesce(patch.endpoints, () => ( current.endpoints)),
+    bindings: _nullishCoalesce(patch.bindings, () => ( current.bindings)),
     port: _nullishCoalesce(patch.port, () => ( current.port)),
     userMessageQueue: _nullishCoalesce(patch.userMessageQueue, () => ( current.userMessageQueue)),
     concurrencyQueue: _nullishCoalesce(patch.concurrencyQueue, () => ( current.concurrencyQueue)),
     accountHealth: _nullishCoalesce(patch.accountHealth, () => ( current.accountHealth)),
     accountProbe: _nullishCoalesce(patch.accountProbe, () => ( current.accountProbe)),
+    allowanceScheduling: _nullishCoalesce(patch.allowanceScheduling, () => ( current.allowanceScheduling)),
     audit: _nullishCoalesce(patch.audit, () => ( current.audit)),
     billing: _nullishCoalesce(patch.billing, () => ( current.billing)),
     // Proxy is layer-replaced (not deep-merged): a PUT carrying `proxy` swaps the
@@ -2509,6 +2997,167 @@ function mergeServerConfig(current, patch) {
   });
 }
 
+// src/outbound-api/gatewayBindingResolver.ts
+var MESSAGE_FALLBACK_KINDS = ["sonnet", "opus", "haiku", "fable"];
+function nonBlank(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function gatewayBindingAllowsKey(binding, apiKeyId) {
+  const scope = _nullishCoalesce(binding.keyScope, () => ( (_optionalChain([binding, 'access', _128 => _128.apiKeyIds, 'optionalAccess', _129 => _129.length]) ? "selected" : "all")));
+  return scope === "all" || Boolean(_optionalChain([binding, 'access', _130 => _130.apiKeyIds, 'optionalAccess', _131 => _131.includes, 'call', _132 => _132(apiKeyId)]));
+}
+function wildcardMatches(pattern, value) {
+  const escaped = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`, "iu").test(value);
+}
+function resolveGatewayModelMapping(mappings, requestedModel) {
+  if (!nonBlank(requestedModel)) return void 0;
+  const wanted = requestedModel.trim();
+  const exact = (_nullishCoalesce(mappings, () => ( []))).find(
+    (mapping) => nonBlank(mapping.source) && !mapping.source.includes("*") && mapping.source.trim().toLocaleLowerCase() === wanted.toLocaleLowerCase()
+  );
+  if (exact && nonBlank(exact.target)) return exact.target.trim();
+  const wildcard = (_nullishCoalesce(mappings, () => ( []))).find(
+    (mapping) => nonBlank(mapping.source) && mapping.source.includes("*") && wildcardMatches(mapping.source.trim(), wanted)
+  );
+  return wildcard && nonBlank(wildcard.target) ? wildcard.target.trim() : void 0;
+}
+function routeCanServe(binding, requestedModel, role) {
+  if (binding.modelMode === "passthrough") return nonBlank(requestedModel);
+  if (_optionalChain([binding, 'access', _133 => _133.modelMappings, 'optionalAccess', _134 => _134.length])) {
+    return nonBlank(resolveGatewayModelMapping(binding.modelMappings, requestedModel));
+  }
+  if (_chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, binding.endpoint)) {
+    const map = _nullishCoalesce(binding.modelMap, () => ( {}));
+    const kind = _chunk4VZX5F4Tcjs.detectModelKind.call(void 0, binding.endpoint, requestedModel);
+    if (kind && nonBlank(map[kind])) return true;
+    if (binding.endpoint === "messages") {
+      return MESSAGE_FALLBACK_KINDS.some((candidate) => nonBlank(map[candidate]));
+    }
+    return nonBlank(map.codex);
+  }
+  if (binding.endpoint === "chat" && binding.dispatchMode === "prefix") {
+    return _chunk4VZX5F4Tcjs.resolvePrefixTarget.call(void 0, binding.prefixTargets, requestedModel) !== null;
+  }
+  if (binding.endpoint === "chat") {
+    if (!requestedModel) return false;
+    const wanted = requestedModel.trim().toLowerCase();
+    return (_nullishCoalesce(binding.models, () => ( []))).some((ref) => _optionalChain([modelIdOf, 'call', _135 => _135(ref), 'optionalAccess', _136 => _136.toLowerCase, 'call', _137 => _137()]) === wanted);
+  }
+  return role === "background" ? nonBlank(binding.backgroundModel) : nonBlank(binding.defaultModel);
+}
+function modelIdOf(ref) {
+  if (!nonBlank(ref)) return void 0;
+  const trimmed = ref.trim();
+  const comma = trimmed.indexOf(",");
+  const modelId = comma >= 0 ? trimmed.slice(comma + 1).trim() : trimmed;
+  return modelId || void 0;
+}
+function targetProviderId(target) {
+  return target.providerId.trim();
+}
+function targetRef(target, ref) {
+  const modelId = _nullishCoalesce(modelIdOf(ref), () => ( ""));
+  return modelId ? `${targetProviderId(target)},${modelId}` : "";
+}
+function targetRefs(target, refs) {
+  return (_nullishCoalesce(refs, () => ( []))).map((ref) => targetRef(target, ref)).filter(nonBlank);
+}
+function targetPrefixRefs(target, refs) {
+  if (!refs) return void 0;
+  const mapped = {};
+  for (const kind of ["claude", "gpt", "gemini"]) {
+    const ref = targetRef(target, refs[kind]);
+    if (ref) mapped[kind] = ref;
+  }
+  return mapped.claude || mapped.gpt || mapped.gemini ? mapped : void 0;
+}
+function applySingleModel(config, binding, targetModel) {
+  const ref = targetRef(binding.target, targetModel);
+  if (!ref) return;
+  if (_chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      _chunk4VZX5F4Tcjs.modelKindsForEndpoint.call(void 0, binding.endpoint).map((kind) => [kind, ref])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = [ref];
+    config.dispatchMode = "list";
+  } else {
+    config.defaultModel = ref;
+    config.backgroundModel = ref;
+  }
+}
+function gatewayBindingToEndpointConfig(binding, requestedModel) {
+  const target = binding.target;
+  const config = {
+    endpoint: binding.endpoint,
+    useSubscription: target.kind !== "provider"
+  };
+  const usesGenericModelHandling = binding.modelMode === "passthrough" || Boolean(_optionalChain([binding, 'access', _138 => _138.modelMappings, 'optionalAccess', _139 => _139.length]));
+  const dynamicModel = binding.modelMode === "passthrough" ? requestedModel : resolveGatewayModelMapping(binding.modelMappings, requestedModel);
+  if (usesGenericModelHandling) {
+    if (nonBlank(dynamicModel)) applySingleModel(config, binding, dynamicModel);
+  } else if (_chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      Object.entries(_nullishCoalesce(binding.modelMap, () => ( {}))).map(([kind, ref]) => [kind, targetRef(target, ref)])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = targetRefs(target, binding.models);
+    if (binding.dispatchMode === "prefix") {
+      config.dispatchMode = "prefix";
+      config.prefixTargets = targetPrefixRefs(target, binding.prefixTargets);
+    }
+  } else {
+    config.defaultModel = targetRef(target, binding.defaultModel);
+    config.backgroundModel = targetRef(target, binding.backgroundModel);
+    if (binding.backgroundModelIds) config.backgroundModelIds = [...binding.backgroundModelIds];
+  }
+  if (target.kind === "account") {
+    config.boundAccountId = target.accountId;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "account-group") {
+    config.boundAccountGroup = target.group;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "provider" && target.keyId) {
+    config.boundKeyId = target.keyId;
+    config.boundKeyFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  }
+  return config;
+}
+function candidateGatewayBindings(bindings, apiKeyId, endpoint) {
+  const candidates = (_nullishCoalesce(bindings, () => ( []))).filter(
+    (binding) => binding.enabled && binding.endpoint === endpoint && gatewayBindingAllowsKey(binding, apiKeyId)
+  );
+  const scopeOf = (binding) => _nullishCoalesce(binding.keyScope, () => ( (_optionalChain([binding, 'access', _140 => _140.apiKeyIds, 'optionalAccess', _141 => _141.length]) ? "selected" : "all")));
+  const scoped = candidates.filter((binding) => scopeOf(binding) === "selected");
+  const pool = scoped.length > 0 ? scoped : candidates.filter((binding) => scopeOf(binding) === "all");
+  return pool.sort(
+    (left, right) => (_nullishCoalesce(left.priority, () => ( 100))) - (_nullishCoalesce(right.priority, () => ( 100))) || left.id.localeCompare(right.id)
+  );
+}
+function candidateBackgroundModelIds(bindings, apiKeyId, endpoint) {
+  const ids = [
+    ...new Set(
+      candidateGatewayBindings(bindings, apiKeyId, endpoint).flatMap(
+        (binding) => _nullishCoalesce(binding.backgroundModelIds, () => ( []))
+      )
+    )
+  ];
+  return ids.length > 0 ? ids : void 0;
+}
+function resolveGatewayBinding(input) {
+  const candidates = candidateGatewayBindings(input.bindings, input.apiKeyId, input.endpoint);
+  const binding = _nullishCoalesce(candidates.find(
+    (candidate) => candidate.fallback === "fail" || routeCanServe(candidate, input.requestedModel, input.role)
+  ), () => ( candidates[0]));
+  if (!binding) return { source: "none" };
+  return {
+    source: "binding",
+    binding,
+    config: gatewayBindingToEndpointConfig(binding, input.requestedModel)
+  };
+}
+
 // src/outbound-api/outboundApiKeyAuth.ts
 
 
@@ -2601,6 +3250,27 @@ async function createNamedKey(db, name) {
     plaintextOnce: secret
   };
 }
+async function createIntegrationKey(db, name, allowedEndpoints = ["responses", "messages"]) {
+  const secret = generateSecret();
+  const id = newKeyId();
+  const prefix = keyPrefix(secret);
+  const row = await db.outboundApiKeysCreate({
+    id,
+    name,
+    keyHash: hashKey(secret),
+    keyPrefix: prefix,
+    kind: "integration",
+    allowedEndpoints: [...new Set(allowedEndpoints)],
+    loopbackOnly: true
+  });
+  return {
+    id: row.id,
+    name: row.name,
+    keyPrefix: row.keyPrefix,
+    createdAt: row.createdAt,
+    plaintextOnce: secret
+  };
+}
 function extractCostLimits(row) {
   const limits = {};
   if (row.dailyCostLimitUsd != null) limits.dailyUsd = row.dailyCostLimitUsd;
@@ -2623,7 +3293,12 @@ function extractModelRestriction(row) {
   };
 }
 function toVerifiedKey(row) {
-  const key = { id: row.id };
+  const key = {
+    id: row.id,
+    kind: row.kind,
+    allowedEndpoints: row.allowedEndpoints,
+    loopbackOnly: row.loopbackOnly
+  };
   if (row.maxConcurrency !== void 0 && row.maxConcurrency !== null) {
     key.maxConcurrency = row.maxConcurrency;
   }
@@ -2843,8 +3518,8 @@ var OutboundRateLimiter = (_class8 = class {
    * recorded (no bucket growth).
    */
   check(apiKeyId, now = Date.now(), override) {
-    const maxRequests = _nullishCoalesce(_optionalChain([override, 'optionalAccess', _105 => _105.maxRequests]), () => ( this.maxRequests));
-    const windowMs = _nullishCoalesce(_optionalChain([override, 'optionalAccess', _106 => _106.windowMs]), () => ( this.windowMs));
+    const maxRequests = _nullishCoalesce(_optionalChain([override, 'optionalAccess', _142 => _142.maxRequests]), () => ( this.maxRequests));
+    const windowMs = _nullishCoalesce(_optionalChain([override, 'optionalAccess', _143 => _143.windowMs]), () => ( this.windowMs));
     if (maxRequests === 0) return { allowed: true, retryAfterSeconds: 0 };
     const cutoff = now - windowMs;
     const timestamps = (_nullishCoalesce(this.hits.get(apiKeyId), () => ( []))).filter((ts) => ts > cutoff);
@@ -2889,7 +3564,7 @@ function isUserMessageAnthropic(body) {
   if (typeof content === "string") return true;
   if (Array.isArray(content)) {
     const hasToolResult = content.some(
-      (block) => _optionalChain([asObject, 'call', _107 => _107(block), 'optionalAccess', _108 => _108["type"]]) === "tool_result"
+      (block) => _optionalChain([asObject, 'call', _144 => _144(block), 'optionalAccess', _145 => _145["type"]]) === "tool_result"
     );
     return !hasToolResult;
   }
@@ -2918,7 +3593,7 @@ function isUserMessageGemini(body) {
   if (!lastContent || lastContent["role"] !== "user") return false;
   const parts = asArray(lastContent["parts"]);
   const hasFunctionResponse = parts.some(
-    (part) => _optionalChain([asObject, 'call', _109 => _109(part), 'optionalAccess', _110 => _110["functionResponse"]]) !== void 0
+    (part) => _optionalChain([asObject, 'call', _146 => _146(part), 'optionalAccess', _147 => _147["functionResponse"]]) !== void 0
   );
   return !hasFunctionResponse;
 }
@@ -3092,14 +3767,14 @@ function newVoucherId() {
 }
 function computeVoucherGrant(voucher, currentKey, now) {
   if (voucher.type === "credit") {
-    const current = _nullishCoalesce(_optionalChain([currentKey, 'optionalAccess', _111 => _111.totalCostLimitUsd]), () => ( 0));
+    const current = _nullishCoalesce(_optionalChain([currentKey, 'optionalAccess', _148 => _148.totalCostLimitUsd]), () => ( 0));
     let granted2 = current + (_nullishCoalesce(voucher.creditUsd, () => ( 0)));
     if (voucher.maxTotalCostLimitUsd != null) {
       granted2 = Math.min(granted2, voucher.maxTotalCostLimitUsd);
     }
     return { totalCostLimitUsd: granted2 };
   }
-  const currentExpiry = _nullishCoalesce(_optionalChain([currentKey, 'optionalAccess', _112 => _112.expiresAt]), () => ( now));
+  const currentExpiry = _nullishCoalesce(_optionalChain([currentKey, 'optionalAccess', _149 => _149.expiresAt]), () => ( now));
   let granted = currentExpiry + (_nullishCoalesce(voucher.renewalDays, () => ( 0))) * DAY_MS2;
   if (voucher.maxExpiryDays != null) {
     granted = Math.min(granted, now + voucher.maxExpiryDays * DAY_MS2);
@@ -3130,7 +3805,7 @@ function toVoucherInfo(v) {
 // src/outbound-api/voucherRedeem.ts
 function isRedeemRequest(method, url) {
   if (method !== "POST" || !url) return false;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _113 => _113.split, 'call', _114 => _114("?"), 'access', _115 => _115[0], 'optionalAccess', _116 => _116.replace, 'call', _117 => _117(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _150 => _150.split, 'call', _151 => _151("?"), 'access', _152 => _152[0], 'optionalAccess', _153 => _153.replace, 'call', _154 => _154(/\/+$/, "")]), () => ( ""));
   return path.endsWith("/redeem");
 }
 function writeErr(res, status, message, headers = {}) {
@@ -3160,8 +3835,8 @@ function grantToResult(type, granted) {
 function currentResult(type, keyRow) {
   const result = { type };
   if (type === "credit") {
-    if (_optionalChain([keyRow, 'optionalAccess', _118 => _118.totalCostLimitUsd]) != null) result.totalCostLimitUsd = keyRow.totalCostLimitUsd;
-  } else if (_optionalChain([keyRow, 'optionalAccess', _119 => _119.expiresAt]) != null) {
+    if (_optionalChain([keyRow, 'optionalAccess', _155 => _155.totalCostLimitUsd]) != null) result.totalCostLimitUsd = keyRow.totalCostLimitUsd;
+  } else if (_optionalChain([keyRow, 'optionalAccess', _156 => _156.expiresAt]) != null) {
     result.expiresAt = keyRow.expiresAt;
   }
   return result;
@@ -3199,7 +3874,7 @@ async function handleVoucherRedeem(req, res, deps, voucherEnabled, redeemLimiter
   let code;
   try {
     code = raw ? JSON.parse(raw)["code"] : void 0;
-  } catch (e19) {
+  } catch (e24) {
     writeErr(res, 400, "Invalid JSON in request body");
     return;
   }
@@ -3248,7 +3923,7 @@ async function handleVoucherRedeem(req, res, deps, voucherEnabled, redeemLimiter
     const won = await voucherDb.voucherRedeemCas(voucher.id, verifiedKeyId, absolute, now);
     if (!won) {
       const after = await voucherDb.voucherGetByHash(codeHash);
-      if (_optionalChain([after, 'optionalAccess', _120 => _120.status]) === "redeemed" && after.redeemedByKeyId === verifiedKeyId) {
+      if (_optionalChain([after, 'optionalAccess', _157 => _157.status]) === "redeemed" && after.redeemedByKeyId === verifiedKeyId) {
         return after.grantApplied === true ? { ok: true, result: currentResult(after.type, await deps.db.outboundApiKeysGetByHash(keyHash)) } : await applyFirstPass(after, recordedAbsolute(after));
       }
       return { ok: false, status: 409, message: "Code was already redeemed" };
@@ -3267,10 +3942,10 @@ function getFallbackRedeemLimiter() {
   fallbackRedeemLimiter ??= new OutboundRateLimiter({ maxRequests: 10, windowMs: 6e4 });
   return fallbackRedeemLimiter;
 }
-function writeJsonError(res, status, message, headers = {}) {
+function writeJsonError(res, status, message, headers = {}, details = {}) {
   if (res.headersSent) return;
   res.writeHead(status, { "Content-Type": "application/json", ...headers });
-  res.end(JSON.stringify({ error: { type: "outbound_api_error", message } }));
+  res.end(JSON.stringify({ error: { type: "outbound_api_error", message, ...details } }));
 }
 function writeCostLimitError(res, scope, limitUsd, spentUsd) {
   if (res.headersSent) return;
@@ -3309,14 +3984,19 @@ function extractPresentedKey(req) {
   }
   const xApiKey = req.headers["x-api-key"];
   const xApi = Array.isArray(xApiKey) ? xApiKey[0] : xApiKey;
-  if (_optionalChain([xApi, 'optionalAccess', _121 => _121.trim, 'call', _122 => _122()])) return xApi.trim();
+  if (_optionalChain([xApi, 'optionalAccess', _158 => _158.trim, 'call', _159 => _159()])) return xApi.trim();
   const goog = req.headers["x-goog-api-key"];
   const g = Array.isArray(goog) ? goog[0] : goog;
-  return _optionalChain([g, 'optionalAccess', _123 => _123.trim, 'call', _124 => _124()]) || void 0;
+  return _optionalChain([g, 'optionalAccess', _160 => _160.trim, 'call', _161 => _161()]) || void 0;
+}
+function isLoopbackPeer(address) {
+  if (!address) return false;
+  const normalized = address.toLowerCase().split("%")[0];
+  return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.") || normalized.startsWith("::ffff:127.");
 }
 function selectEndpoint(method, url) {
   if (method !== "POST" || !url) return null;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _125 => _125.split, 'call', _126 => _126("?"), 'access', _127 => _127[0], 'optionalAccess', _128 => _128.replace, 'call', _129 => _129(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _162 => _162.split, 'call', _163 => _163("?"), 'access', _164 => _164[0], 'optionalAccess', _165 => _165.replace, 'call', _166 => _166(/\/+$/, "")]), () => ( ""));
   if (path.endsWith("/chat/completions")) return "chat";
   if (path.endsWith("/responses")) return "responses";
   if (path.includes("/v1/messages")) return "messages";
@@ -3334,12 +4014,36 @@ function extractGeminiModelFromUrl(url) {
 }
 function isModelsListRequest(url) {
   if (!url) return false;
-  const path = _nullishCoalesce(_optionalChain([url, 'access', _130 => _130.split, 'call', _131 => _131("?"), 'access', _132 => _132[0], 'optionalAccess', _133 => _133.replace, 'call', _134 => _134(/\/+$/, "")]), () => ( ""));
+  const path = _nullishCoalesce(_optionalChain([url, 'access', _167 => _167.split, 'call', _168 => _168("?"), 'access', _169 => _169[0], 'optionalAccess', _170 => _170.replace, 'call', _171 => _171(/\/+$/, "")]), () => ( ""));
   return path.endsWith("/models");
 }
-function writeChatModelsList(res, config) {
-  const chat = config.endpoints.find((e) => e.endpoint === "chat");
-  const data = (_nullishCoalesce(_optionalChain([chat, 'optionalAccess', _135 => _135.models]), () => ( []))).map((ref) => _chunkVACWOIREcjs.parseModelRef.call(void 0, ref)).filter((p) => p !== null).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
+function writeModelsList(res, config, apiKeyId, allowedEndpoints) {
+  const refs = [];
+  const endpointConfigs = [];
+  for (const endpoint of ["chat", "responses", "messages", "gemini"]) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint)) continue;
+    endpointConfigs.push(
+      ...candidateGatewayBindings(config.bindings, apiKeyId, endpoint).map(
+        (binding) => gatewayBindingToEndpointConfig(binding)
+      )
+    );
+  }
+  for (const endpoint of endpointConfigs) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint.endpoint)) continue;
+    if (endpoint.endpoint === "chat") refs.push(..._nullishCoalesce(endpoint.models, () => ( [])));
+    else if (endpoint.endpoint === "messages" || endpoint.endpoint === "responses") {
+      refs.push(...Object.values(_nullishCoalesce(endpoint.modelMap, () => ( {}))));
+    } else {
+      if (endpoint.defaultModel) refs.push(endpoint.defaultModel);
+      if (endpoint.backgroundModel) refs.push(endpoint.backgroundModel);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const data = refs.map((ref) => _chunk4VZX5F4Tcjs.parseModelRef.call(void 0, ref)).filter((p) => p !== null).filter((p) => {
+    if (seen.has(p.modelId)) return false;
+    seen.add(p.modelId);
+    return true;
+  }).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ object: "list", data }));
 }
@@ -3373,12 +4077,20 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
   const verified = verification.key;
   if (audit) audit.keyId = verified.id;
   if (billing) billing.keyId = verified.id;
+  if (verified.loopbackOnly && !isLoopbackPeer(_optionalChain([req, 'access', _172 => _172.socket, 'optionalAccess', _173 => _173.remoteAddress]))) {
+    writeJsonError(res, 403, "This integration key is restricted to loopback clients");
+    return;
+  }
   if (isRedeemRequest(req.method, req.url)) {
+    if (verified.kind === "integration") {
+      writeJsonError(res, 403, "Integration keys cannot redeem vouchers");
+      return;
+    }
     await handleVoucherRedeem(
       req,
       res,
       deps,
-      _optionalChain([config, 'access', _136 => _136.voucher, 'optionalAccess', _137 => _137.enabled]) === true,
+      _optionalChain([config, 'access', _174 => _174.voucher, 'optionalAccess', _175 => _175.enabled]) === true,
       _nullishCoalesce(redeemLimiter, () => ( getFallbackRedeemLimiter())),
       verified.id,
       _nullishCoalesce(presented, () => ( "")),
@@ -3395,7 +4107,11 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     return;
   }
   if (req.method === "GET" && isModelsListRequest(req.url)) {
-    writeChatModelsList(res, config);
+    if (verified.allowedEndpoints && verified.allowedEndpoints.length === 0) {
+      writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+      return;
+    }
+    writeModelsList(res, config, verified.id, verified.allowedEndpoints);
     return;
   }
   const endpoint = selectEndpoint(req.method, req.url);
@@ -3403,9 +4119,12 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
     return;
   }
-  const endpointConfig = config.endpoints.find((e) => e.endpoint === endpoint);
-  if (!endpointConfig) {
-    writeJsonError(res, 503, `endpoint '${endpoint}' is not configured`);
+  if (verified.allowedEndpoints && !verified.allowedEndpoints.includes(endpoint)) {
+    writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+    return;
+  }
+  if (candidateGatewayBindings(config.bindings, verified.id, endpoint).length === 0) {
+    writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
     return;
   }
   if (verified.costLimits && deps.keySpendTracker) {
@@ -3464,12 +4183,12 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     res.once("close", release2);
   }
   try {
-    const ingressFormat = _chunkVACWOIREcjs.endpointToIngressFormat.call(void 0, endpoint);
+    const ingressFormat = _chunk4VZX5F4Tcjs.endpointToIngressFormat.call(void 0, endpoint);
     const rawBody = await readBody3(req);
     let parsedBody = {};
     try {
       parsedBody = rawBody ? JSON.parse(rawBody) : {};
-    } catch (e20) {
+    } catch (e25) {
       writeJsonError(res, 400, "Invalid JSON in request body");
       return;
     }
@@ -3478,23 +4197,40 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const urlModel = extractGeminiModelFromUrl(req.url);
       if (urlModel) parsedBody["model"] = urlModel;
     }
-    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}` : null;
-    const resolved = _chunkVACWOIREcjs.isKindMappedEndpoint.call(void 0, endpoint) || endpoint === "chat" ? await _chunkVACWOIREcjs.resolveRoute.call(void 0, {
-      config: endpointConfig,
+    const requestedModel = _chunk4VZX5F4Tcjs.extractRequestedModel.call(void 0, ingressFormat, parsedBody);
+    const role = _chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, endpoint) || endpoint === "chat" ? void 0 : _chunk4VZX5F4Tcjs.detectRequestRole.call(void 0, ingressFormat, parsedBody, {
+      // Role detection precedes the route pick (the pick consumes the
+      // role), so the hint is the union across the candidate routes.
+      backgroundModelIds: candidateBackgroundModelIds(config.bindings, verified.id, endpoint)
+    });
+    const bindingResolution = resolveGatewayBinding({
+      bindings: config.bindings,
+      apiKeyId: verified.id,
+      endpoint,
+      requestedModel,
+      role
+    });
+    if (bindingResolution.source === "none") {
+      writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
+      return;
+    }
+    const effectiveEndpointConfig = bindingResolution.config;
+    const bindingAffinitySuffix = `:${bindingResolution.binding.id}`;
+    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}${bindingAffinitySuffix}` : null;
+    const resolved = _chunk4VZX5F4Tcjs.isKindMappedEndpoint.call(void 0, endpoint) || endpoint === "chat" ? await _chunk4VZX5F4Tcjs.resolveRoute.call(void 0, {
+      config: effectiveEndpointConfig,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
       // Capture the ORIGINAL requested id BEFORE any downstream swap; for
       // kind-mapped endpoints it selects the kind AND is stamped onto
       // `route.requestedModel`; for chat it is matched against the list.
-      requestedModel: _chunkVACWOIREcjs.extractRequestedModel.call(void 0, ingressFormat, parsedBody),
+      requestedModel,
       // Attribution: stamp the verified named-key id onto the route.
       apiKeyId: verified.id
-    }) : await _chunkVACWOIREcjs.resolveRoute.call(void 0, {
-      config: endpointConfig,
-      role: _chunkVACWOIREcjs.detectRequestRole.call(void 0, ingressFormat, parsedBody, {
-        backgroundModelIds: endpointConfig.backgroundModelIds
-      }),
+    }) : await _chunk4VZX5F4Tcjs.resolveRoute.call(void 0, {
+      config: effectiveEndpointConfig,
+      role,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
@@ -3523,7 +4259,7 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     }
     let releaseSerial = null;
     const providerKey = resolved.route.providerId;
-    if (_optionalChain([config, 'access', _138 => _138.userMessageQueue, 'optionalAccess', _139 => _139.enabled]) && providerKey && isUserMessageRequest(endpoint, parsedBody)) {
+    if (_optionalChain([config, 'access', _176 => _176.userMessageQueue, 'optionalAccess', _177 => _177.enabled]) && providerKey && isUserMessageRequest(endpoint, parsedBody)) {
       const umq = config.userMessageQueue;
       try {
         const serialSlot = await serialQueue.acquire(providerKey, {
@@ -3555,12 +4291,29 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const replay = makeReplayRequest(req, rawBody);
       await routeRequest(replay, res, routeMap, deps.proxyDeps);
     } catch (err) {
+      if (_chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) {
+        const headers = {};
+        if (err.status === 429 && err.resumeAt) {
+          const resumeMs = Date.parse(err.resumeAt);
+          if (Number.isFinite(resumeMs)) {
+            headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+          }
+        }
+        writeJsonError(
+          res,
+          err.status,
+          _chunk25GXJCEZcjs.boundAccountSelectionMessage.call(void 0, err.reason),
+          headers,
+          { code: err.code, reason: err.reason }
+        );
+        return;
+      }
       const message = _chunkSVNDB62Dcjs.serializeError.call(void 0, err);
       if (deps.logger) deps.logger.error("[OutboundApi] dispatch error:", message);
       else console.error("[OutboundApi] dispatch error:", message);
       _chunkUIBD2YY5cjs.emitWebhookEvent.call(void 0, { kind: "server.error", at: Date.now(), message });
       if (audit) audit.error = message;
-      writeJsonError(res, 502, message);
+      writeJsonError(res, _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError.call(void 0, err) ? 429 : 502, message);
     } finally {
       routeMap.removeRoute(token);
       if (releaseSerial) releaseSerial();
@@ -3584,18 +4337,8 @@ function makeReplayRequest(req, rawBody) {
 var DEFAULT_OUTBOUND_PORT = 8765;
 var LOOPBACK_ADDR = "127.0.0.1";
 var LAN_ADDR = "0.0.0.0";
-var OutboundApiConfigError = class extends Error {
-  
-  constructor(missing) {
-    super(
-      "Outbound API server cannot start: incomplete model-kind configuration \u2014 " + missing.map((m) => `${m.endpoint} missing [${m.missingKinds.join(", ")}]`).join("; ")
-    );
-    this.name = "OutboundApiConfigError";
-    this.missing = missing;
-  }
-};
 var OutboundApiServer = (_class11 = class {
-  constructor(deps, onPortChange) {;_class11.prototype.__init12.call(this);_class11.prototype.__init13.call(this);_class11.prototype.__init14.call(this);_class11.prototype.__init15.call(this);_class11.prototype.__init16.call(this);_class11.prototype.__init17.call(this);_class11.prototype.__init18.call(this);_class11.prototype.__init19.call(this);_class11.prototype.__init20.call(this);
+  constructor(deps, onPortChange) {;_class11.prototype.__init12.call(this);_class11.prototype.__init13.call(this);_class11.prototype.__init14.call(this);_class11.prototype.__init15.call(this);_class11.prototype.__init16.call(this);_class11.prototype.__init17.call(this);_class11.prototype.__init18.call(this);_class11.prototype.__init19.call(this);_class11.prototype.__init20.call(this);_class11.prototype.__init21.call(this);
     this.deps = deps;
     this.onPortChange = onPortChange;
   }
@@ -3605,25 +4348,26 @@ var OutboundApiServer = (_class11 = class {
   __init13() {this.boundPort = 0}
   __init14() {this.boundAddr = LOOPBACK_ADDR}
   __init15() {this.endpoints = []}
+  __init16() {this.bindings = []}
   
   
   
-  __init16() {this.rateLimiter = new OutboundRateLimiter()}
+  __init17() {this.rateLimiter = new OutboundRateLimiter()}
   /**
    * Redeem-attempt limiter (voucher-redemption #9, design D6) — a SEPARATE bucket
    * from the traffic `rateLimiter`, keyed by the authenticating key id, so
    * brute-forcing `CC_` codes is throttled (a handful/min) without touching the
    * per-key request rate. Conservative fixed defaults (10 / 60s).
    */
-  __init17() {this.redeemLimiter = new OutboundRateLimiter({ maxRequests: 10, windowMs: 6e4 })}
+  __init18() {this.redeemLimiter = new OutboundRateLimiter({ maxRequests: 10, windowMs: 6e4 })}
   /**
    * Per-key redeem mutex (voucher-redemption #9, MJ1 fix). One instance for the
    * server's lifetime so concurrent redeem REQUESTS for the same key serialize
    * (relative grant increments accumulate instead of clobbering a snapshot).
    */
-  __init18() {this.redeemMutex = new KeyedMutex()}
-  __init19() {this.serialQueue = new UserMessageSerialQueue()}
-  __init20() {this.concurrencyGate = new OutboundConcurrencyGate()}
+  __init19() {this.redeemMutex = new KeyedMutex()}
+  __init20() {this.serialQueue = new UserMessageSerialQueue()}
+  __init21() {this.concurrencyGate = new OutboundConcurrencyGate()}
   /**
    * Apply a config. Restarts the listener ONLY when the bind address or port
    * changes (or when toggling enabled); per-endpoint routing config is updated
@@ -3631,6 +4375,7 @@ var OutboundApiServer = (_class11 = class {
    */
   async applyConfig(input) {
     this.endpoints = input.endpoints;
+    this.bindings = _nullishCoalesce(input.bindings, () => ( []));
     this.userMessageQueue = input.userMessageQueue;
     this.concurrencyQueue = input.concurrencyQueue;
     this.voucherConfig = input.voucher;
@@ -3640,16 +4385,6 @@ var OutboundApiServer = (_class11 = class {
       await this.stop();
       return;
     }
-    const missing = _chunkVACWOIREcjs.validateServerModelConfig.call(void 0, {
-      enabled: true,
-      networkBinding: input.networkBinding,
-      endpoints: input.endpoints,
-      port: input.port
-    });
-    if (missing.length > 0) {
-      await this.stop();
-      throw new OutboundApiConfigError(missing);
-    }
     const running = this.server !== null;
     const bindChanged = running && (this.boundAddr !== wantAddr || this.boundPort !== wantPort);
     if (running && !bindChanged) {
@@ -3664,7 +4399,7 @@ var OutboundApiServer = (_class11 = class {
     const actualPort = await this.listen(bindAddr, port);
     this.boundAddr = bindAddr;
     this.boundPort = actualPort;
-    if (actualPort !== port) _optionalChain([this, 'access', _140 => _140.onPortChange, 'optionalCall', _141 => _141(actualPort)]);
+    if (actualPort !== port) _optionalChain([this, 'access', _178 => _178.onPortChange, 'optionalCall', _179 => _179(actualPort)]);
     this.logInfo(`[OutboundApiServer] Listening on ${bindAddr}:${actualPort}`);
     return actualPort;
   }
@@ -3706,6 +4441,7 @@ var OutboundApiServer = (_class11 = class {
       this.deps,
       {
         endpoints: this.endpoints,
+        bindings: this.bindings,
         userMessageQueue: this.userMessageQueue,
         concurrencyQueue: this.concurrencyQueue,
         voucher: this.voucherConfig
@@ -3732,7 +4468,7 @@ var OutboundApiServer = (_class11 = class {
     const provider = this.deps.healthReportProvider;
     if (!provider) return false;
     if (req.method !== "GET" && req.method !== "HEAD") return false;
-    const path = _optionalChain([(_nullishCoalesce(req.url, () => ( "/"))), 'access', _142 => _142.split, 'call', _143 => _143("?"), 'access', _144 => _144[0], 'optionalAccess', _145 => _145.replace, 'call', _146 => _146(/\/+$/, "")]) || "/";
+    const path = _optionalChain([(_nullishCoalesce(req.url, () => ( "/"))), 'access', _180 => _180.split, 'call', _181 => _181("?"), 'access', _182 => _182[0], 'optionalAccess', _183 => _183.replace, 'call', _184 => _184(/\/+$/, "")]) || "/";
     if (path !== "/health" && path !== "/healthz") return false;
     const report = provider();
     res.writeHead(_healthloggingtypes.healthHttpStatus.call(void 0, report.status), { "Content-Type": "application/json" });
@@ -3844,12 +4580,12 @@ function startOfLocalWeek(ts) {
   return day.getTime();
 }
 var KeySpendTracker = (_class12 = class {
-  constructor(seeder) {;_class12.prototype.__init21.call(this);
+  constructor(seeder) {;_class12.prototype.__init22.call(this);
     this.seeder = seeder;
   }
   
   /** apiKeyId → live accumulated spend (seeded lazily). */
-  __init21() {this.spend = /* @__PURE__ */ new Map()}
+  __init22() {this.spend = /* @__PURE__ */ new Map()}
   /**
    * Read the key's accumulated spend, seeding from the durable store on a cache
    * miss and rolling the daily/weekly windows on a hit.
@@ -3937,7 +4673,7 @@ async function callOpenAICompletion(provider, apiKey, options, logger) {
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: false
     // For now, non-streaming only
@@ -3988,7 +4724,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
     const nonSystemMessages = options.messages.filter((m) => m.role !== "system");
     const anthropicRequest2 = {
       model: options.model,
-      max_tokens: options.maxTokens || 16384,
+      max_tokens: _nullishCoalesce(options.maxTokens, () => ( 16384)),
       temperature: options.temperature,
       ...systemMessages.length > 0 ? { system: systemMessages.map((m) => m.content).join("\n\n") } : {},
       messages: nonSystemMessages.map((m) => convertMessageToAnthropic(m)),
@@ -4010,14 +4746,14 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
       };
     }
     const anthropicResponse2 = await response2.json();
-    const openaiResponse2 = _chunkSUEGJ75Dcjs.convertAnthropicToOpenAI.call(void 0, anthropicResponse2);
+    const openaiResponse2 = _chunkWYTEQ4Q5cjs.convertAnthropicToOpenAI.call(void 0, anthropicResponse2);
     const choice2 = openaiResponse2.choices[0];
     return {
       success: true,
       message: {
         id: `assistant-${Date.now()}`,
         role: "assistant",
-        content: _optionalChain([choice2, 'access', _147 => _147.message, 'optionalAccess', _148 => _148.content]) || "",
+        content: _optionalChain([choice2, 'access', _185 => _185.message, 'optionalAccess', _186 => _186.content]) || "",
         timestamp: Date.now()
       },
       usage: openaiResponse2.usage ? {
@@ -4034,14 +4770,14 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
       content: m.content
     })),
     // Anthropic requires max_tokens; use 16384 default if not explicitly set
-    max_tokens: options.maxTokens || 16384,
+    max_tokens: _nullishCoalesce(options.maxTokens, () => ( 16384)),
     temperature: options.temperature,
     stream: false
   };
   const config = {
     defaultModel: options.model
   };
-  const anthropicRequest = _chunkSUEGJ75Dcjs.convertOpenAIToAnthropic.call(void 0, openaiRequest, config);
+  const anthropicRequest = _chunkWYTEQ4Q5cjs.convertOpenAIToAnthropic.call(void 0, openaiRequest, config);
   const apiUrl = _chunkA2YMUCBTcjs.buildProviderApiUrl.call(void 0, provider, { model: options.model, stream: false });
   const headers = _chunkQ27JY5RGcjs.getProviderHeaders.call(void 0, provider, apiKey);
   logger.info("Calling Anthropic completion API", { url: apiUrl, model: options.model });
@@ -4058,7 +4794,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
     };
   }
   const anthropicResponse = await response.json();
-  const openaiResponse = _chunkSUEGJ75Dcjs.convertAnthropicToOpenAI.call(void 0, anthropicResponse);
+  const openaiResponse = _chunkWYTEQ4Q5cjs.convertAnthropicToOpenAI.call(void 0, anthropicResponse);
   const choice = openaiResponse.choices[0];
   return {
     success: true,
@@ -4089,7 +4825,7 @@ async function callGeminiCompletion(provider, apiKey, options, logger) {
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4122,7 +4858,7 @@ async function callGeminiCompletion(provider, apiKey, options, logger) {
   const candidate = candidates[0];
   const content = candidate.content;
   let textContent = "";
-  if (_optionalChain([content, 'optionalAccess', _149 => _149.parts])) {
+  if (_optionalChain([content, 'optionalAccess', _187 => _187.parts])) {
     for (const part of content.parts) {
       if (part.text) {
         textContent += part.text;
@@ -4158,7 +4894,7 @@ async function callOpenAIResponseCompletion(provider, apiKey, options, logger) {
     model: options.model,
     input,
     stream: false,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4223,7 +4959,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: true
   };
@@ -4255,7 +4991,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
   });
   if (!response.ok) {
     const errorText = await response.text();
-    _optionalChain([callbacks, 'access', _150 => _150.onError, 'optionalCall', _151 => _151(`API error (${response.status}): ${errorText}`)]);
+    _optionalChain([callbacks, 'access', _188 => _188.onError, 'optionalCall', _189 => _189(`API error (${response.status}): ${errorText}`)]);
     return;
   }
   const result = await _chunkHQP3K7PUcjs.streamSSEResponse.call(void 0, response, "openai", {
@@ -4265,7 +5001,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
     onVideo: callbacks.onVideo,
     onError: callbacks.onError
   });
-  _optionalChain([callbacks, 'access', _152 => _152.onDone, 'optionalCall', _153 => _153(
+  _optionalChain([callbacks, 'access', _190 => _190.onDone, 'optionalCall', _191 => _191(
     {
       id: messageId,
       role: "assistant",
@@ -4282,7 +5018,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
 async function streamAnthropicCompletion(provider, apiKey, options, messageId, callbacks, logger) {
   const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
   const MAX_TOKENS_FOR_THINKING = 16384;
-  let effectiveMaxTokens = options.maxTokens || 16384;
+  let effectiveMaxTokens = _nullishCoalesce(options.maxTokens, () => ( 16384));
   const thinkingMaxTokens = options.thinkLevel && options.thinkLevel !== "none" ? Math.min(effectiveMaxTokens, MAX_TOKENS_FOR_THINKING) : effectiveMaxTokens;
   const thinkingConfig = options.thinkLevel && options.thinkLevel !== "none" ? _thinkingconfig.buildAnthropicThinking.call(void 0, options.model, options.thinkLevel, thinkingMaxTokens) : void 0;
   if (thinkingConfig) {
@@ -4323,7 +5059,7 @@ async function streamAnthropicCompletion(provider, apiKey, options, messageId, c
       temperature: thinkingConfig ? void 0 : options.temperature,
       stream: true
     };
-    anthropicRequest = _chunkSUEGJ75Dcjs.convertOpenAIToAnthropic.call(void 0, openaiRequest, config);
+    anthropicRequest = _chunkWYTEQ4Q5cjs.convertOpenAIToAnthropic.call(void 0, openaiRequest, config);
     if (thinkingConfig) {
       anthropicRequest.thinking = thinkingConfig;
       delete anthropicRequest.temperature;
@@ -4337,7 +5073,7 @@ async function streamAnthropicCompletion(provider, apiKey, options, messageId, c
   logger.info("Streaming Anthropic completion request", {
     url: apiUrl,
     model: anthropicRequest.model,
-    messagesCount: _optionalChain([anthropicRequest, 'access', _154 => _154.messages, 'optionalAccess', _155 => _155.length]),
+    messagesCount: _optionalChain([anthropicRequest, 'access', _192 => _192.messages, 'optionalAccess', _193 => _193.length]),
     max_tokens: anthropicRequest.max_tokens,
     temperature: anthropicRequest.temperature,
     stream: anthropicRequest.stream,
@@ -4354,7 +5090,7 @@ async function streamAnthropicCompletion(provider, apiKey, options, messageId, c
   if (!response.ok) {
     const errorText = await response.text();
     logger.error("Anthropic API error", void 0, { status: response.status, errorText });
-    _optionalChain([callbacks, 'access', _156 => _156.onError, 'optionalCall', _157 => _157(`API error (${response.status}): ${errorText}`)]);
+    _optionalChain([callbacks, 'access', _194 => _194.onError, 'optionalCall', _195 => _195(`API error (${response.status}): ${errorText}`)]);
     return;
   }
   const result = await _chunkHQP3K7PUcjs.streamSSEResponse.call(void 0, response, "anthropic", {
@@ -4365,10 +5101,10 @@ async function streamAnthropicCompletion(provider, apiKey, options, messageId, c
   });
   logger.info("Anthropic stream complete", {
     contentLength: result.content.length,
-    reasoningLength: _optionalChain([result, 'access', _158 => _158.reasoning, 'optionalAccess', _159 => _159.length]) || 0,
+    reasoningLength: _optionalChain([result, 'access', _196 => _196.reasoning, 'optionalAccess', _197 => _197.length]) || 0,
     blocksCount: result.blocks.length
   });
-  _optionalChain([callbacks, 'access', _160 => _160.onDone, 'optionalCall', _161 => _161(
+  _optionalChain([callbacks, 'access', _198 => _198.onDone, 'optionalCall', _199 => _199(
     {
       id: messageId,
       role: "assistant",
@@ -4394,7 +5130,7 @@ async function streamGeminiCompletion(provider, apiKey, options, messageId, call
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4424,7 +5160,7 @@ async function streamGeminiCompletion(provider, apiKey, options, messageId, call
   if (!response.ok) {
     const errorText = await response.text();
     logger.error("Gemini API error", void 0, { status: response.status, errorText });
-    _optionalChain([callbacks, 'access', _162 => _162.onError, 'optionalCall', _163 => _163(`API error (${response.status}): ${errorText}`)]);
+    _optionalChain([callbacks, 'access', _200 => _200.onError, 'optionalCall', _201 => _201(`API error (${response.status}): ${errorText}`)]);
     return;
   }
   const result = await _chunkHQP3K7PUcjs.streamSSEResponse.call(void 0, response, "gemini", {
@@ -4433,7 +5169,7 @@ async function streamGeminiCompletion(provider, apiKey, options, messageId, call
     onError: callbacks.onError
   });
   logger.info("Gemini stream complete", { contentLength: result.content.length });
-  _optionalChain([callbacks, 'access', _164 => _164.onDone, 'optionalCall', _165 => _165(
+  _optionalChain([callbacks, 'access', _202 => _202.onDone, 'optionalCall', _203 => _203(
     {
       id: messageId,
       role: "assistant",
@@ -4458,7 +5194,7 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
     model: options.model,
     input,
     stream: true,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4485,7 +5221,7 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
   });
   if (!response.ok) {
     const errorText = await response.text();
-    _optionalChain([callbacks, 'access', _166 => _166.onError, 'optionalCall', _167 => _167(`API error (${response.status}): ${errorText}`)]);
+    _optionalChain([callbacks, 'access', _204 => _204.onError, 'optionalCall', _205 => _205(`API error (${response.status}): ${errorText}`)]);
     return;
   }
   const result = await _chunkHQP3K7PUcjs.streamSSEResponse.call(void 0, response, "openai-response", {
@@ -4494,7 +5230,7 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
     onError: callbacks.onError
   });
   logger.info("OpenAI Response API stream complete", { contentLength: result.content.length });
-  _optionalChain([callbacks, 'access', _168 => _168.onDone, 'optionalCall', _169 => _169(
+  _optionalChain([callbacks, 'access', _206 => _206.onDone, 'optionalCall', _207 => _207(
     {
       id: messageId,
       role: "assistant",
@@ -4515,59 +5251,20 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
 
 
 
-async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens) {
+async function resolveEffectiveMaxTokens(llmConfig, _getProvider, logger, _providerId, _modelId, sessionMaxTokens) {
   if (sessionMaxTokens !== void 0 && sessionMaxTokens > 0) {
     logger.debug("Using session maxTokens", { sessionMaxTokens });
     return sessionMaxTokens;
   }
   try {
     const globalParams = await llmConfig.getGlobalModelParameters();
-    if (_optionalChain([globalParams, 'optionalAccess', _170 => _170.maxTokens, 'optionalAccess', _171 => _171.enabled]) && globalParams.maxTokens.value > 0) {
+    if (_optionalChain([globalParams, 'optionalAccess', _208 => _208.maxTokens, 'optionalAccess', _209 => _209.enabled]) && globalParams.maxTokens.value > 0) {
       logger.debug("Using global maxTokens", { maxTokens: globalParams.maxTokens.value });
       return globalParams.maxTokens.value;
     }
   } catch (err) {
     logger.warn("Failed to get global params", err instanceof Error ? err : void 0);
   }
-  const MAX_TOKENS_CAP = 131072;
-  const provider = await getProvider(providerId);
-  if (provider) {
-    const modelConfig = _optionalChain([provider, 'access', _172 => _172.modelConfigs, 'optionalAccess', _173 => _173.find, 'call', _174 => _174((m) => m.id === modelId)]);
-    if (_optionalChain([modelConfig, 'optionalAccess', _175 => _175.maxTokens]) && modelConfig.maxTokens > 0) {
-      const cappedMaxTokens = Math.min(modelConfig.maxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using model config maxTokens", {
-        maxTokens: modelConfig.maxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-    if (provider.modelGroups) {
-      for (const group of provider.modelGroups) {
-        const model = _optionalChain([group, 'access', _176 => _176.models, 'optionalAccess', _177 => _177.find, 'call', _178 => _178((m) => m.id === modelId)]);
-        if (_optionalChain([model, 'optionalAccess', _179 => _179.maxTokens]) && model.maxTokens > 0) {
-          const cappedMaxTokens = Math.min(model.maxTokens, MAX_TOKENS_CAP);
-          logger.debug("Using modelGroup model maxTokens", {
-            maxTokens: model.maxTokens,
-            cappedMaxTokens
-          });
-          return cappedMaxTokens;
-        }
-      }
-    }
-  }
-  try {
-    const discoveredMaxTokens = await llmConfig.getDiscoveredModelMaxTokens(providerId, modelId);
-    if (discoveredMaxTokens && discoveredMaxTokens > 0) {
-      const cappedMaxTokens = Math.min(discoveredMaxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using discovered model maxTokens", {
-        discoveredMaxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-  } catch (err) {
-    logger.warn("Failed to get discovered model maxTokens", err instanceof Error ? err : void 0);
-  }
   logger.debug("No maxTokens configured, returning undefined");
   return void 0;
 }
@@ -4589,7 +5286,7 @@ async function resolveThinkingBudget(getProvider, logger, providerId, modelId, m
   }
   const thinkingBudget = _thinkingconfig.calculateThinkingBudget.call(void 0, modelId, thinkLevel, maxTokens);
   const provider = await getProvider(providerId);
-  const providerName = _optionalChain([provider, 'optionalAccess', _180 => _180.name, 'optionalAccess', _181 => _181.toLowerCase, 'call', _182 => _182()]) || "";
+  const providerName = _optionalChain([provider, 'optionalAccess', _210 => _210.name, 'optionalAccess', _211 => _211.toLowerCase, 'call', _212 => _212()]) || "";
   const apiFormat = provider ? _chunkA2YMUCBTcjs.resolveApiFormat.call(void 0, provider) : "openai";
   if (apiFormat === "anthropic" || providerName === "anthropic" || providerName.includes("claude")) {
     const thinkingConfig = _thinkingconfig.buildAnthropicThinking.call(void 0, modelId, thinkLevel, maxTokens);
@@ -4626,7 +5323,7 @@ function logToolFormat(tools, logger) {
       tools: openaiTools.map((t) => t.function.name),
       firstTool: {
         name: firstTool.function.name,
-        description: _optionalChain([firstTool, 'access', _183 => _183.function, 'access', _184 => _184.description, 'optionalAccess', _185 => _185.slice, 'call', _186 => _186(0, 100)]),
+        description: _optionalChain([firstTool, 'access', _213 => _213.function, 'access', _214 => _214.description, 'optionalAccess', _215 => _215.slice, 'call', _216 => _216(0, 100)]),
         parameters: firstTool.function.parameters
       }
     });
@@ -4637,7 +5334,7 @@ function logToolFormat(tools, logger) {
       tools: anthropicTools.map((t) => t.name),
       firstTool: {
         name: firstTool.name,
-        description: _optionalChain([firstTool, 'access', _187 => _187.description, 'optionalAccess', _188 => _188.slice, 'call', _189 => _189(0, 100)]),
+        description: _optionalChain([firstTool, 'access', _217 => _217.description, 'optionalAccess', _218 => _218.slice, 'call', _219 => _219(0, 100)]),
         input_schema: firstTool.input_schema
       }
     });
@@ -4648,9 +5345,9 @@ function logToolFormat(tools, logger) {
       count: allDeclarations.length,
       tools: allDeclarations.map((t) => t.name),
       firstTool: {
-        name: _optionalChain([allDeclarations, 'access', _190 => _190[0], 'optionalAccess', _191 => _191.name]),
-        description: _optionalChain([allDeclarations, 'access', _192 => _192[0], 'optionalAccess', _193 => _193.description, 'optionalAccess', _194 => _194.slice, 'call', _195 => _195(0, 100)]),
-        parameters: _optionalChain([allDeclarations, 'access', _196 => _196[0], 'optionalAccess', _197 => _197.parameters])
+        name: _optionalChain([allDeclarations, 'access', _220 => _220[0], 'optionalAccess', _221 => _221.name]),
+        description: _optionalChain([allDeclarations, 'access', _222 => _222[0], 'optionalAccess', _223 => _223.description, 'optionalAccess', _224 => _224.slice, 'call', _225 => _225(0, 100)]),
+        parameters: _optionalChain([allDeclarations, 'access', _226 => _226[0], 'optionalAccess', _227 => _227.parameters])
       }
     });
   }
@@ -4670,7 +5367,8 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
     }
     requestBody = {
       contents,
-      tools: options.tools
+      tools: options.tools,
+      ...options.maxTokens !== void 0 ? { generationConfig: { maxOutputTokens: options.maxTokens } } : {}
     };
     url = _chunkA2YMUCBTcjs.buildProviderApiUrl.call(void 0, provider, { model: actualModel, stream: true });
   } else if (apiFormat === "anthropic") {
@@ -4680,7 +5378,10 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      // Native Anthropic Messages requires this field. Resolve an absent
+      // caller cap to the model's real ceiling rather than a small constant —
+      // see `resolveAnthropicMaxTokens`.
+      max_tokens: _chunk4VLRHHFEcjs.resolveAnthropicMaxTokens.call(void 0, actualModel, options.maxTokens),
       temperature: _nullishCoalesce(options.temperature, () => ( 0.7)),
       stream: true,
       tools: options.tools
@@ -4697,7 +5398,7 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
       temperature: _nullishCoalesce(options.temperature, () => ( 0.7)),
       stream: true,
       tools: options.tools
@@ -4709,7 +5410,7 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
 function extractDeltaContent(rawJson, apiFormat) {
   const json = rawJson;
   if (apiFormat === "google") {
-    const parts = _optionalChain([json, 'access', _198 => _198.candidates, 'optionalAccess', _199 => _199[0], 'optionalAccess', _200 => _200.content, 'optionalAccess', _201 => _201.parts]) || [];
+    const parts = _optionalChain([json, 'access', _228 => _228.candidates, 'optionalAccess', _229 => _229[0], 'optionalAccess', _230 => _230.content, 'optionalAccess', _231 => _231.parts]) || [];
     let text = "";
     for (const part of parts) {
       if (part.thought === true) continue;
@@ -4717,15 +5418,15 @@ function extractDeltaContent(rawJson, apiFormat) {
     }
     return text;
   } else if (apiFormat === "anthropic") {
-    return _optionalChain([json, 'access', _202 => _202.delta, 'optionalAccess', _203 => _203.text]) || "";
+    return _optionalChain([json, 'access', _232 => _232.delta, 'optionalAccess', _233 => _233.text]) || "";
   } else {
-    return _optionalChain([json, 'access', _204 => _204.choices, 'optionalAccess', _205 => _205[0], 'optionalAccess', _206 => _206.delta, 'optionalAccess', _207 => _207.content]) || "";
+    return _optionalChain([json, 'access', _234 => _234.choices, 'optionalAccess', _235 => _235[0], 'optionalAccess', _236 => _236.delta, 'optionalAccess', _237 => _237.content]) || "";
   }
 }
 function extractDeltaReasoning(rawJson, apiFormat) {
   const json = rawJson;
   if (apiFormat === "google") {
-    const parts = _optionalChain([json, 'access', _208 => _208.candidates, 'optionalAccess', _209 => _209[0], 'optionalAccess', _210 => _210.content, 'optionalAccess', _211 => _211.parts]) || [];
+    const parts = _optionalChain([json, 'access', _238 => _238.candidates, 'optionalAccess', _239 => _239[0], 'optionalAccess', _240 => _240.content, 'optionalAccess', _241 => _241.parts]) || [];
     let reasoning = "";
     for (const part of parts) {
       if (part.thought === true && part.text) reasoning += part.text;
@@ -4734,14 +5435,14 @@ function extractDeltaReasoning(rawJson, apiFormat) {
   } else if (apiFormat === "anthropic") {
     return "";
   } else {
-    const delta = _optionalChain([json, 'access', _212 => _212.choices, 'optionalAccess', _213 => _213[0], 'optionalAccess', _214 => _214.delta]);
-    return (_optionalChain([delta, 'optionalAccess', _215 => _215.thinking, 'optionalAccess', _216 => _216.content]) || "") + (_optionalChain([delta, 'optionalAccess', _217 => _217.reasoning_content]) || "");
+    const delta = _optionalChain([json, 'access', _242 => _242.choices, 'optionalAccess', _243 => _243[0], 'optionalAccess', _244 => _244.delta]);
+    return (_optionalChain([delta, 'optionalAccess', _245 => _245.thinking, 'optionalAccess', _246 => _246.content]) || "") + (_optionalChain([delta, 'optionalAccess', _247 => _247.reasoning_content]) || "");
   }
 }
 function extractToolCalls(rawJson, apiFormat, toolCalls, callbacks, logger, pendingOpenAIToolCalls) {
   const json = rawJson;
   if (apiFormat === "google") {
-    const parts = _optionalChain([json, 'access', _218 => _218.candidates, 'optionalAccess', _219 => _219[0], 'optionalAccess', _220 => _220.content, 'optionalAccess', _221 => _221.parts]) || [];
+    const parts = _optionalChain([json, 'access', _248 => _248.candidates, 'optionalAccess', _249 => _249[0], 'optionalAccess', _250 => _250.content, 'optionalAccess', _251 => _251.parts]) || [];
     for (const part of parts) {
       if (part.functionCall) {
         logger.info("Function call detected", { functionCall: part.functionCall });
@@ -4751,13 +5452,13 @@ function extractToolCalls(rawJson, apiFormat, toolCalls, callbacks, logger, pend
           args: part.functionCall.args || {}
         };
         toolCalls.push(toolCall);
-        _optionalChain([callbacks, 'access', _222 => _222.onToolCall, 'optionalCall', _223 => _223(toolCall)]);
+        _optionalChain([callbacks, 'access', _252 => _252.onToolCall, 'optionalCall', _253 => _253(toolCall)]);
         logger.info("Tool called", { toolName: toolCall.name });
       }
     }
   } else if (apiFormat !== "anthropic") {
-    const delta = _optionalChain([json, 'access', _224 => _224.choices, 'optionalAccess', _225 => _225[0], 'optionalAccess', _226 => _226.delta]);
-    if (_optionalChain([delta, 'optionalAccess', _227 => _227.tool_calls]) && pendingOpenAIToolCalls) {
+    const delta = _optionalChain([json, 'access', _254 => _254.choices, 'optionalAccess', _255 => _255[0], 'optionalAccess', _256 => _256.delta]);
+    if (_optionalChain([delta, 'optionalAccess', _257 => _257.tool_calls]) && pendingOpenAIToolCalls) {
       for (const tc of delta.tool_calls) {
         const index = _nullishCoalesce(tc.index, () => ( 0));
         let pending = pendingOpenAIToolCalls.get(index);
@@ -4766,8 +5467,8 @@ function extractToolCalls(rawJson, apiFormat, toolCalls, callbacks, logger, pend
           pendingOpenAIToolCalls.set(index, pending);
         }
         if (tc.id) pending.id = tc.id;
-        if (_optionalChain([tc, 'access', _228 => _228.function, 'optionalAccess', _229 => _229.name])) pending.name += tc.function.name;
-        if (_optionalChain([tc, 'access', _230 => _230.function, 'optionalAccess', _231 => _231.arguments])) pending.arguments += tc.function.arguments;
+        if (_optionalChain([tc, 'access', _258 => _258.function, 'optionalAccess', _259 => _259.name])) pending.name += tc.function.name;
+        if (_optionalChain([tc, 'access', _260 => _260.function, 'optionalAccess', _261 => _261.arguments])) pending.arguments += tc.function.arguments;
       }
     }
   }
@@ -4782,7 +5483,7 @@ function finalizeOpenAIToolCalls(pendingOpenAIToolCalls, toolCalls, callbacks, l
           args: JSON.parse(pending.arguments || "{}")
         };
         toolCalls.push(toolCall);
-        _optionalChain([callbacks, 'access', _232 => _232.onToolCall, 'optionalCall', _233 => _233(toolCall)]);
+        _optionalChain([callbacks, 'access', _262 => _262.onToolCall, 'optionalCall', _263 => _263(toolCall)]);
         logger.info("Tool called (OpenAI)", { toolName: toolCall.name, args: toolCall.args });
       } catch (e) {
         logger.error("Failed to parse OpenAI tool call arguments", e instanceof Error ? e : void 0, {
@@ -4796,38 +5497,38 @@ function finalizeOpenAIToolCalls(pendingOpenAIToolCalls, toolCalls, callbacks, l
 function parseStreamChunk(rawJson, apiFormat, callbacks, logger) {
   const json = rawJson;
   if (apiFormat === "google") {
-    const candidate = _optionalChain([json, 'access', _234 => _234.candidates, 'optionalAccess', _235 => _235[0]]);
+    const candidate = _optionalChain([json, 'access', _264 => _264.candidates, 'optionalAccess', _265 => _265[0]]);
     if (!candidate) {
       logger.warn("No candidate found in Gemini response");
       return;
     }
-    const parts = _optionalChain([candidate, 'access', _236 => _236.content, 'optionalAccess', _237 => _237.parts]) || [];
+    const parts = _optionalChain([candidate, 'access', _266 => _266.content, 'optionalAccess', _267 => _267.parts]) || [];
     for (const part of parts) {
       if (part.thought === true && part.text) {
-        _optionalChain([callbacks, 'access', _238 => _238.onReasoning, 'optionalCall', _239 => _239(part.text)]);
+        _optionalChain([callbacks, 'access', _268 => _268.onReasoning, 'optionalCall', _269 => _269(part.text)]);
         continue;
       } else if (part.thoughtSignature && !part.thought) {
         logger.debug("Gemini returned thoughtSignature without thought content");
       }
       if (part.text) {
-        _optionalChain([callbacks, 'access', _240 => _240.onDelta, 'optionalCall', _241 => _241(part.text)]);
+        _optionalChain([callbacks, 'access', _270 => _270.onDelta, 'optionalCall', _271 => _271(part.text)]);
       }
     }
   } else if (apiFormat === "anthropic") {
     const delta = json.delta;
-    if (_optionalChain([delta, 'optionalAccess', _242 => _242.text])) {
-      _optionalChain([callbacks, 'access', _243 => _243.onDelta, 'optionalCall', _244 => _244(delta.text)]);
+    if (_optionalChain([delta, 'optionalAccess', _272 => _272.text])) {
+      _optionalChain([callbacks, 'access', _273 => _273.onDelta, 'optionalCall', _274 => _274(delta.text)]);
     }
   } else {
-    const delta = _optionalChain([json, 'access', _245 => _245.choices, 'optionalAccess', _246 => _246[0], 'optionalAccess', _247 => _247.delta]);
-    if (_optionalChain([delta, 'optionalAccess', _248 => _248.content])) {
-      _optionalChain([callbacks, 'access', _249 => _249.onDelta, 'optionalCall', _250 => _250(delta.content)]);
+    const delta = _optionalChain([json, 'access', _275 => _275.choices, 'optionalAccess', _276 => _276[0], 'optionalAccess', _277 => _277.delta]);
+    if (_optionalChain([delta, 'optionalAccess', _278 => _278.content])) {
+      _optionalChain([callbacks, 'access', _279 => _279.onDelta, 'optionalCall', _280 => _280(delta.content)]);
     }
-    if (_optionalChain([delta, 'optionalAccess', _251 => _251.thinking, 'optionalAccess', _252 => _252.content])) {
-      _optionalChain([callbacks, 'access', _253 => _253.onReasoning, 'optionalCall', _254 => _254(delta.thinking.content)]);
+    if (_optionalChain([delta, 'optionalAccess', _281 => _281.thinking, 'optionalAccess', _282 => _282.content])) {
+      _optionalChain([callbacks, 'access', _283 => _283.onReasoning, 'optionalCall', _284 => _284(delta.thinking.content)]);
     }
-    if (_optionalChain([delta, 'optionalAccess', _255 => _255.reasoning_content])) {
-      _optionalChain([callbacks, 'access', _256 => _256.onReasoning, 'optionalCall', _257 => _257(delta.reasoning_content)]);
+    if (_optionalChain([delta, 'optionalAccess', _285 => _285.reasoning_content])) {
+      _optionalChain([callbacks, 'access', _286 => _286.onReasoning, 'optionalCall', _287 => _287(delta.reasoning_content)]);
     }
   }
 }
@@ -4840,7 +5541,7 @@ function buildIterationBlocks(iteration, content, reasoning, blocks, callbacks)
       content: reasoning
     };
     blocks.push(thinkingBlock);
-    _optionalChain([callbacks, 'access', _258 => _258.onBlock, 'optionalCall', _259 => _259(thinkingBlock)]);
+    _optionalChain([callbacks, 'access', _288 => _288.onBlock, 'optionalCall', _289 => _289(thinkingBlock)]);
   }
   if (content && content.trim()) {
     const textBlock = {
@@ -4849,7 +5550,7 @@ function buildIterationBlocks(iteration, content, reasoning, blocks, callbacks)
       content
     };
     blocks.push(textBlock);
-    _optionalChain([callbacks, 'access', _260 => _260.onBlock, 'optionalCall', _261 => _261(textBlock)]);
+    _optionalChain([callbacks, 'access', _290 => _290.onBlock, 'optionalCall', _291 => _291(textBlock)]);
   }
 }
 async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbacks, logger, builtinExecutor) {
@@ -4864,7 +5565,7 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
       status: "running"
     };
     blocks.push(toolUseBlock);
-    _optionalChain([callbacks, 'access', _262 => _262.onBlock, 'optionalCall', _263 => _263(toolUseBlock)]);
+    _optionalChain([callbacks, 'access', _292 => _292.onBlock, 'optionalCall', _293 => _293(toolUseBlock)]);
     try {
       logger.info("Executing tool", { toolName: toolCall.name });
       const mcpTool = mcpTools.find((t) => t.id === toolCall.name);
@@ -4887,8 +5588,8 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
         result = { isError: true, content: [{ type: "text", text: "MCP service not available" }] };
       }
       logger.info("Tool result received", { result });
-      _optionalChain([callbacks, 'access', _264 => _264.onToolResult, 'optionalCall', _265 => _265(toolCall.id, result)]);
-      const resultText = _optionalChain([result, 'access', _266 => _266.content, 'optionalAccess', _267 => _267[0], 'optionalAccess', _268 => _268.text]) || JSON.stringify(result);
+      _optionalChain([callbacks, 'access', _294 => _294.onToolResult, 'optionalCall', _295 => _295(toolCall.id, result)]);
+      const resultText = _optionalChain([result, 'access', _296 => _296.content, 'optionalAccess', _297 => _297[0], 'optionalAccess', _298 => _298.text]) || JSON.stringify(result);
       const toolResultBlock = {
         id: `${toolCall.id}_result`,
         type: "tool_result",
@@ -4898,11 +5599,11 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
         isError: result.isError
       };
       blocks.push(toolResultBlock);
-      _optionalChain([callbacks, 'access', _269 => _269.onBlock, 'optionalCall', _270 => _270(toolResultBlock)]);
+      _optionalChain([callbacks, 'access', _299 => _299.onBlock, 'optionalCall', _300 => _300(toolResultBlock)]);
       const toolUseBlockRef = blocks.find((b) => b.id === `${toolCall.id}_use`);
       if (toolUseBlockRef && toolUseBlockRef.type === "tool_use") {
         toolUseBlockRef.status = result.isError ? "error" : "completed";
-        _optionalChain([callbacks, 'access', _271 => _271.onBlock, 'optionalCall', _272 => _272({ ...toolUseBlockRef })]);
+        _optionalChain([callbacks, 'access', _301 => _301.onBlock, 'optionalCall', _302 => _302({ ...toolUseBlockRef })]);
       }
       toolResults.push({ toolCall, result });
     } catch (error) {
@@ -4912,7 +5613,7 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
         isError: true,
         content: [{ type: "text", text: `Error: ${errorMessage}` }]
       };
-      _optionalChain([callbacks, 'access', _273 => _273.onToolResult, 'optionalCall', _274 => _274(toolCall.id, errorResult)]);
+      _optionalChain([callbacks, 'access', _303 => _303.onToolResult, 'optionalCall', _304 => _304(toolCall.id, errorResult)]);
       const errorToolResultBlock = {
         id: `${toolCall.id}_result`,
         type: "tool_result",
@@ -4922,11 +5623,11 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
         isError: true
       };
       blocks.push(errorToolResultBlock);
-      _optionalChain([callbacks, 'access', _275 => _275.onBlock, 'optionalCall', _276 => _276(errorToolResultBlock)]);
+      _optionalChain([callbacks, 'access', _305 => _305.onBlock, 'optionalCall', _306 => _306(errorToolResultBlock)]);
       const errorToolUseBlockRef = blocks.find((b) => b.id === `${toolCall.id}_use`);
       if (errorToolUseBlockRef && errorToolUseBlockRef.type === "tool_use") {
         errorToolUseBlockRef.status = "error";
-        _optionalChain([callbacks, 'access', _277 => _277.onBlock, 'optionalCall', _278 => _278({ ...errorToolUseBlockRef })]);
+        _optionalChain([callbacks, 'access', _307 => _307.onBlock, 'optionalCall', _308 => _308({ ...errorToolUseBlockRef })]);
       }
       toolResults.push({ toolCall, result: errorResult });
     }
@@ -4936,7 +5637,7 @@ async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbac
 function mapToolArguments(args, mcpTool, logger) {
   const mappedArgs = { ...args };
   const toolSchema = mcpTool.inputSchema;
-  if (_optionalChain([toolSchema, 'optionalAccess', _279 => _279.properties])) {
+  if (_optionalChain([toolSchema, 'optionalAccess', _309 => _309.properties])) {
     const expectedParams = Object.keys(toolSchema.properties);
     const paramMappings = {
       "search_query": ["query", "q", "searchQuery", "search"],
@@ -4970,25 +5671,25 @@ async function streamWithTools(options, callbacks, mcpService, llmConfig, getPro
       options.providerId,
       options.model
     );
-    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _280 => _280.actualProviderId]) || options.providerId;
-    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _281 => _281.actualModelId]) || options.model;
+    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _310 => _310.actualProviderId]) || options.providerId;
+    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _311 => _311.actualModelId]) || options.model;
     const provider = await getProvider(actualProviderId);
     if (!provider) {
-      _optionalChain([callbacks, 'access', _282 => _282.onError, 'optionalCall', _283 => _283(`Provider not found: ${actualProviderId}`)]);
+      _optionalChain([callbacks, 'access', _312 => _312.onError, 'optionalCall', _313 => _313(`Provider not found: ${actualProviderId}`)]);
       return;
     }
     if (!provider.enabled) {
-      _optionalChain([callbacks, 'access', _284 => _284.onError, 'optionalCall', _285 => _285(`Provider is disabled: ${provider.name}`)]);
+      _optionalChain([callbacks, 'access', _314 => _314.onError, 'optionalCall', _315 => _315(`Provider is disabled: ${provider.name}`)]);
       return;
     }
     const { apiKey: effectiveKey } = _chunkA2YMUCBTcjs.resolveProviderEndpoint.call(void 0, provider);
     const apiKey = resolveApiKey2(effectiveKey);
     if (!apiKey) {
-      _optionalChain([callbacks, 'access', _286 => _286.onError, 'optionalCall', _287 => _287("API key not configured")]);
+      _optionalChain([callbacks, 'access', _316 => _316.onError, 'optionalCall', _317 => _317("API key not configured")]);
       return;
     }
     const messageId = `msg_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-    _optionalChain([callbacks, 'access', _288 => _288.onStart, 'optionalCall', _289 => _289(messageId)]);
+    _optionalChain([callbacks, 'access', _318 => _318.onStart, 'optionalCall', _319 => _319(messageId)]);
     const globalParams = await llmConfig.getGlobalModelParameters();
     const MAX_ITERATIONS = _nullishCoalesce(globalParams.toolMaxTurns, () => ( 100));
     let iteration = 0;
@@ -5035,12 +5736,12 @@ async function streamWithTools(options, callbacks, mcpService, llmConfig, getPro
       });
       if (!response.ok) {
         const errorText = await response.text();
-        _optionalChain([callbacks, 'access', _290 => _290.onError, 'optionalCall', _291 => _291(`API error (${response.status}): ${errorText}`)]);
+        _optionalChain([callbacks, 'access', _320 => _320.onError, 'optionalCall', _321 => _321(`API error (${response.status}): ${errorText}`)]);
         return;
       }
-      const reader = _optionalChain([response, 'access', _292 => _292.body, 'optionalAccess', _293 => _293.getReader, 'call', _294 => _294()]);
+      const reader = _optionalChain([response, 'access', _322 => _322.body, 'optionalAccess', _323 => _323.getReader, 'call', _324 => _324()]);
       if (!reader) {
-        _optionalChain([callbacks, 'access', _295 => _295.onError, 'optionalCall', _296 => _296("No response body")]);
+        _optionalChain([callbacks, 'access', _325 => _325.onError, 'optionalCall', _326 => _326("No response body")]);
         return;
       }
       const decoder = new TextDecoder();
@@ -5073,7 +5774,7 @@ async function streamWithTools(options, callbacks, mcpService, llmConfig, getPro
                 logger.debug("Parsed JSON", { json });
                 if (json.error) {
                   logger.error("API Error", void 0, { error: json.error });
-                  _optionalChain([callbacks, 'access', _297 => _297.onError, 'optionalCall', _298 => _298(`API Error: ${json.error.message || JSON.stringify(json.error)}`)]);
+                  _optionalChain([callbacks, 'access', _327 => _327.onError, 'optionalCall', _328 => _328(`API Error: ${json.error.message || JSON.stringify(json.error)}`)]);
                   return;
                 }
                 parseStreamChunk(json, apiFormat, callbacks, logger);
@@ -5106,7 +5807,7 @@ async function streamWithTools(options, callbacks, mcpService, llmConfig, getPro
           toolCallsLength: toolCalls.length,
           executableToolCallsLength: executableToolCalls.length,
           hasMcpTools: !!options.mcpTools,
-          mcpToolsLength: _optionalChain([options, 'access', _299 => _299.mcpTools, 'optionalAccess', _300 => _300.length]),
+          mcpToolsLength: _optionalChain([options, 'access', _329 => _329.mcpTools, 'optionalAccess', _330 => _330.length]),
           hasMcpService: !!mcpService
         });
         if (executableToolCalls.length > 0 && options.mcpTools && (mcpService || builtinExecutor)) {
@@ -5127,7 +5828,7 @@ async function streamWithTools(options, callbacks, mcpService, llmConfig, getPro
             builtinExecutor
           );
           const toolResultsText = toolResults.map(({ toolCall, result }) => {
-            const resultText = typeof result === "string" ? result : _optionalChain([result, 'access', _301 => _301.content, 'optionalAccess', _302 => _302[0], 'optionalAccess', _303 => _303.text]) || JSON.stringify(result);
+            const resultText = typeof result === "string" ? result : _optionalChain([result, 'access', _331 => _331.content, 'optionalAccess', _332 => _332[0], 'optionalAccess', _333 => _333.text]) || JSON.stringify(result);
             return `Tool ${toolCall.name} result:
 ${resultText}`;
           }).join("\n\n");
@@ -5145,12 +5846,12 @@ ${resultText}`;
         }
       } catch (streamError) {
         logger.error("Stream processing error", streamError instanceof Error ? streamError : void 0);
-        _optionalChain([callbacks, 'access', _304 => _304.onError, 'optionalCall', _305 => _305(`Stream error: ${streamError instanceof Error ? streamError.message : "Unknown error"}`)]);
+        _optionalChain([callbacks, 'access', _334 => _334.onError, 'optionalCall', _335 => _335(`Stream error: ${streamError instanceof Error ? streamError.message : "Unknown error"}`)]);
         return;
       }
     }
     logger.info("Sending final callback", { blocksCount: blocks.length });
-    _optionalChain([callbacks, 'access', _306 => _306.onDone, 'optionalCall', _307 => _307({
+    _optionalChain([callbacks, 'access', _336 => _336.onDone, 'optionalCall', _337 => _337({
       id: messageId,
       role: "assistant",
       content: finalContent,
@@ -5161,7 +5862,7 @@ ${resultText}`;
   } catch (error) {
     logger.error("Error in streamWithTools", error instanceof Error ? error : void 0);
     const message = error instanceof Error ? error.message : "Unknown error";
-    _optionalChain([callbacks, 'access', _308 => _308.onError, 'optionalCall', _309 => _309(message)]);
+    _optionalChain([callbacks, 'access', _338 => _338.onError, 'optionalCall', _339 => _339(message)]);
   }
 }
 
@@ -5187,21 +5888,33 @@ function readUsageFromOpenAIResponse(usage) {
 var sharedExecutor2 = null;
 function getSharedExecutor2() {
   if (!sharedExecutor2) {
-    sharedExecutor2 = new (0, _chunk46ZIFWYGcjs.TransformerChainExecutor)();
+    sharedExecutor2 = new (0, _chunkIIRPUVPHcjs.TransformerChainExecutor)();
   }
   return sharedExecutor2;
 }
 async function resolveChainWithMain(llmConfig, providerId, model) {
   return _chunkQXD4MV2Xcjs.resolveProviderChain.call(void 0, llmConfig, providerId, model);
 }
+function buildUnifiedCompletionRequest(actualModel, options, stream) {
+  return {
+    model: actualModel,
+    messages: options.messages.map((m) => ({
+      role: m.role,
+      content: m.content
+    })),
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
+    temperature: options.temperature,
+    stream
+  };
+}
 async function completeWithTransformers(options, llmConfig, getProvider, resolveApiKey2, completeFallback, logger, recording) {
   try {
     const routedInfo = await llmConfig.resolveRoutedModel(
       options.providerId,
       options.model
     );
-    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _310 => _310.actualProviderId]) || options.providerId;
-    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _311 => _311.actualModelId]) || options.model;
+    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _340 => _340.actualProviderId]) || options.providerId;
+    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _341 => _341.actualModelId]) || options.model;
     const provider = await getProvider(actualProviderId);
     if (!provider) {
       return { success: false, error: `Provider not found: ${actualProviderId}` };
@@ -5222,16 +5935,11 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
     if (!hasTransformers) {
       return completeFallback(options);
     }
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: _nullishCoalesce(options.stream, () => ( false))
-    };
+    const unifiedRequest = buildUnifiedCompletionRequest(
+      actualModel,
+      options,
+      _nullishCoalesce(options.stream, () => ( false))
+    );
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5239,7 +5947,7 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
       models: provider.models || []
     };
     const executor = getSharedExecutor2();
-    const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+    const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
       executor,
       request: unifiedRequest,
       provider: transformerProvider,
@@ -5282,18 +5990,18 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
       { endpointTransformer: void 0 }
     );
     const data = await transformedResponse.json();
-    const choice = _optionalChain([data, 'access', _312 => _312.choices, 'optionalAccess', _313 => _313[0]]);
+    const choice = _optionalChain([data, 'access', _342 => _342.choices, 'optionalAccess', _343 => _343[0]]);
     if (!choice) {
       return { success: false, error: "No choices in response" };
     }
-    const rawToolCalls = _optionalChain([choice, 'access', _314 => _314.message, 'optionalAccess', _315 => _315.tool_calls]);
-    const toolCalls = _optionalChain([rawToolCalls, 'optionalAccess', _316 => _316.map, 'call', _317 => _317((tc) => ({
+    const rawToolCalls = _optionalChain([choice, 'access', _344 => _344.message, 'optionalAccess', _345 => _345.tool_calls]);
+    const toolCalls = _optionalChain([rawToolCalls, 'optionalAccess', _346 => _346.map, 'call', _347 => _347((tc) => ({
       id: tc.id,
       name: tc.function.name,
       args: typeof tc.function.arguments === "string" ? JSON.parse(tc.function.arguments) : tc.function.arguments
     }))]);
     const tapped = readUsageFromOpenAIResponse(data.usage);
-    if (_optionalChain([recording, 'optionalAccess', _318 => _318.recorder]) && tapped) {
+    if (_optionalChain([recording, 'optionalAccess', _348 => _348.recorder]) && tapped) {
       recording.recorder.record({
         messageId: _nullishCoalesce(options.messageId, () => ( null)),
         parentMessageId: _nullishCoalesce(options.parentMessageId, () => ( null)),
@@ -5311,9 +6019,9 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
       message: {
         id: `msg_${Date.now()}`,
         role: "assistant",
-        content: _optionalChain([choice, 'access', _319 => _319.message, 'optionalAccess', _320 => _320.content]) || "",
+        content: _optionalChain([choice, 'access', _349 => _349.message, 'optionalAccess', _350 => _350.content]) || "",
         timestamp: Date.now(),
-        thinking: data.reasoning_content || _optionalChain([choice, 'access', _321 => _321.message, 'optionalAccess', _322 => _322.thinking, 'optionalAccess', _323 => _323.content]) ? { content: data.reasoning_content || _optionalChain([choice, 'access', _324 => _324.message, 'optionalAccess', _325 => _325.thinking, 'optionalAccess', _326 => _326.content]) || "", signature: _optionalChain([choice, 'access', _327 => _327.message, 'optionalAccess', _328 => _328.thinking, 'optionalAccess', _329 => _329.signature]) } : void 0,
+        thinking: data.reasoning_content || _optionalChain([choice, 'access', _351 => _351.message, 'optionalAccess', _352 => _352.thinking, 'optionalAccess', _353 => _353.content]) ? { content: data.reasoning_content || _optionalChain([choice, 'access', _354 => _354.message, 'optionalAccess', _355 => _355.thinking, 'optionalAccess', _356 => _356.content]) || "", signature: _optionalChain([choice, 'access', _357 => _357.message, 'optionalAccess', _358 => _358.thinking, 'optionalAccess', _359 => _359.signature]) } : void 0,
         toolCalls
       },
       usage: data.usage ? {
@@ -5334,21 +6042,21 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
       options.providerId,
       options.model
     );
-    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _330 => _330.actualProviderId]) || options.providerId;
-    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _331 => _331.actualModelId]) || options.model;
+    const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _360 => _360.actualProviderId]) || options.providerId;
+    const actualModel = _optionalChain([routedInfo, 'optionalAccess', _361 => _361.actualModelId]) || options.model;
     const provider = await getProvider(actualProviderId);
     if (!provider) {
-      _optionalChain([callbacks, 'access', _332 => _332.onError, 'optionalCall', _333 => _333(`Provider not found: ${actualProviderId}`)]);
+      _optionalChain([callbacks, 'access', _362 => _362.onError, 'optionalCall', _363 => _363(`Provider not found: ${actualProviderId}`)]);
       return;
     }
     if (!provider.enabled) {
-      _optionalChain([callbacks, 'access', _334 => _334.onError, 'optionalCall', _335 => _335(`Provider is disabled: ${provider.name}`)]);
+      _optionalChain([callbacks, 'access', _364 => _364.onError, 'optionalCall', _365 => _365(`Provider is disabled: ${provider.name}`)]);
       return;
     }
     const { apiKey: effectiveKey } = _chunkA2YMUCBTcjs.resolveProviderEndpoint.call(void 0, provider);
     const apiKey = resolveApiKey2(effectiveKey);
     if (!apiKey) {
-      _optionalChain([callbacks, 'access', _336 => _336.onError, 'optionalCall', _337 => _337("API key not configured")]);
+      _optionalChain([callbacks, 'access', _366 => _366.onError, 'optionalCall', _367 => _367("API key not configured")]);
       return;
     }
     const { chain, hasTransformers } = await resolveChainWithMain(
@@ -5360,17 +6068,8 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
       return completeStreamFallback(options, callbacks);
     }
     const messageId = `msg_${Date.now()}`;
-    _optionalChain([callbacks, 'access', _338 => _338.onStart, 'optionalCall', _339 => _339(messageId)]);
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: true
-    };
+    _optionalChain([callbacks, 'access', _368 => _368.onStart, 'optionalCall', _369 => _369(messageId)]);
+    const unifiedRequest = buildUnifiedCompletionRequest(actualModel, options, true);
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5378,7 +6077,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
       models: provider.models || []
     };
     const executor = getSharedExecutor2();
-    const { response } = await _chunkHYN75H6Gcjs.executeProviderCall.call(void 0, {
+    const { response } = await _chunkMUHWHQVMcjs.executeProviderCall.call(void 0, {
       executor,
       request: unifiedRequest,
       provider: transformerProvider,
@@ -5408,7 +6107,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
     });
     if (!response.ok) {
       const errorText = await response.text();
-      _optionalChain([callbacks, 'access', _340 => _340.onError, 'optionalCall', _341 => _341(`API error (${response.status}): ${errorText}`)]);
+      _optionalChain([callbacks, 'access', _370 => _370.onError, 'optionalCall', _371 => _371(`API error (${response.status}): ${errorText}`)]);
       return;
     }
     const transformedResponse = await executor.executeResponseChain(
@@ -5418,9 +6117,9 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
       chain,
       { endpointTransformer: void 0 }
     );
-    const reader = _optionalChain([transformedResponse, 'access', _342 => _342.body, 'optionalAccess', _343 => _343.getReader, 'call', _344 => _344()]);
+    const reader = _optionalChain([transformedResponse, 'access', _372 => _372.body, 'optionalAccess', _373 => _373.getReader, 'call', _374 => _374()]);
     if (!reader) {
-      _optionalChain([callbacks, 'access', _345 => _345.onError, 'optionalCall', _346 => _346("No response body")]);
+      _optionalChain([callbacks, 'access', _375 => _375.onError, 'optionalCall', _376 => _376("No response body")]);
       return;
     }
     const decoder = new TextDecoder();
@@ -5438,22 +6137,22 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
             if (data === "[DONE]") continue;
             try {
               const json = JSON.parse(data);
-              const delta = _optionalChain([json, 'access', _347 => _347.choices, 'optionalAccess', _348 => _348[0], 'optionalAccess', _349 => _349.delta]);
-              if (_optionalChain([delta, 'optionalAccess', _350 => _350.content])) {
+              const delta = _optionalChain([json, 'access', _377 => _377.choices, 'optionalAccess', _378 => _378[0], 'optionalAccess', _379 => _379.delta]);
+              if (_optionalChain([delta, 'optionalAccess', _380 => _380.content])) {
                 content += delta.content;
-                _optionalChain([callbacks, 'access', _351 => _351.onDelta, 'optionalCall', _352 => _352(delta.content)]);
+                _optionalChain([callbacks, 'access', _381 => _381.onDelta, 'optionalCall', _382 => _382(delta.content)]);
               }
-              if (_optionalChain([delta, 'optionalAccess', _353 => _353.thinking, 'optionalAccess', _354 => _354.content])) {
+              if (_optionalChain([delta, 'optionalAccess', _383 => _383.thinking, 'optionalAccess', _384 => _384.content])) {
                 reasoning += delta.thinking.content;
-                _optionalChain([callbacks, 'access', _355 => _355.onReasoning, 'optionalCall', _356 => _356(delta.thinking.content)]);
+                _optionalChain([callbacks, 'access', _385 => _385.onReasoning, 'optionalCall', _386 => _386(delta.thinking.content)]);
               }
-              if (_optionalChain([delta, 'optionalAccess', _357 => _357.reasoning_content])) {
+              if (_optionalChain([delta, 'optionalAccess', _387 => _387.reasoning_content])) {
                 reasoning += delta.reasoning_content;
-                _optionalChain([callbacks, 'access', _358 => _358.onReasoning, 'optionalCall', _359 => _359(delta.reasoning_content)]);
+                _optionalChain([callbacks, 'access', _388 => _388.onReasoning, 'optionalCall', _389 => _389(delta.reasoning_content)]);
               }
               if (json.usage) {
                 const tapped = readUsageFromOpenAIResponse(json.usage);
-                if (_optionalChain([recording, 'optionalAccess', _360 => _360.recorder]) && tapped) {
+                if (_optionalChain([recording, 'optionalAccess', _390 => _390.recorder]) && tapped) {
                   recording.recorder.record({
                     messageId: _nullishCoalesce(options.messageId, () => ( null)),
                     parentMessageId: _nullishCoalesce(options.parentMessageId, () => ( null)),
@@ -5466,7 +6165,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
                     rawUsage: json.usage
                   });
                 }
-                _optionalChain([callbacks, 'access', _361 => _361.onDone, 'optionalCall', _362 => _362(
+                _optionalChain([callbacks, 'access', _391 => _391.onDone, 'optionalCall', _392 => _392(
                   {
                     id: messageId,
                     role: "assistant",
@@ -5487,7 +6186,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
           }
         }
       }
-      _optionalChain([callbacks, 'access', _363 => _363.onDone, 'optionalCall', _364 => _364({
+      _optionalChain([callbacks, 'access', _393 => _393.onDone, 'optionalCall', _394 => _394({
         id: messageId,
         role: "assistant",
         content,
@@ -5499,13 +6198,13 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
-    _optionalChain([callbacks, 'access', _365 => _365.onError, 'optionalCall', _366 => _366(message)]);
+    _optionalChain([callbacks, 'access', _395 => _395.onError, 'optionalCall', _396 => _396(message)]);
   }
 }
 
 // src/completion/CompletionService.ts
 var CompletionService = (_class13 = class {
-  constructor(paths, llmConfig, logger) {;_class13.prototype.__init22.call(this);_class13.prototype.__init23.call(this);_class13.prototype.__init24.call(this);_class13.prototype.__init25.call(this);
+  constructor(paths, llmConfig, logger) {;_class13.prototype.__init23.call(this);_class13.prototype.__init24.call(this);_class13.prototype.__init25.call(this);_class13.prototype.__init26.call(this);
     this.paths = paths;
     this.llmConfig = llmConfig;
     this.logger = logger;
@@ -5513,10 +6212,10 @@ var CompletionService = (_class13 = class {
   
   
   
-  __init22() {this.apiKeyPool = null}
-  __init23() {this.usageRecorder = null}
-  __init24() {this.usageEventSink = null}
-  __init25() {this.visionFallbackProvider = null}
+  __init23() {this.apiKeyPool = null}
+  __init24() {this.usageRecorder = null}
+  __init25() {this.usageEventSink = null}
+  __init26() {this.visionFallbackProvider = null}
   /**
    * Set the API key pool service for multi-key load balancing.
    * When set, keys are resolved via the pool instead of directly from the provider.
@@ -5566,8 +6265,8 @@ var CompletionService = (_class13 = class {
         options.providerId,
         options.model
       );
-      const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _367 => _367.actualProviderId]) || options.providerId;
-      const actualModel = _optionalChain([routedInfo, 'optionalAccess', _368 => _368.actualModelId]) || options.model;
+      const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _397 => _397.actualProviderId]) || options.providerId;
+      const actualModel = _optionalChain([routedInfo, 'optionalAccess', _398 => _398.actualModelId]) || options.model;
       const provider = await this.getProvider(actualProviderId);
       if (!provider) {
         return { success: false, error: `Provider not found: ${actualProviderId}` };
@@ -5600,7 +6299,7 @@ var CompletionService = (_class13 = class {
         this.apiKeyPool.reportSuccess(options.sessionId);
       }
       if (result.success && result.usage && options.sessionId) {
-        _optionalChain([this, 'access', _369 => _369.usageEventSink, 'optionalAccess', _370 => _370.emit, 'call', _371 => _371({
+        _optionalChain([this, 'access', _399 => _399.usageEventSink, 'optionalAccess', _400 => _400.emit, 'call', _401 => _401({
           sessionId: options.sessionId,
           modelId: actualModel,
           usage: result.usage,
@@ -5629,8 +6328,8 @@ var CompletionService = (_class13 = class {
         options.model
       );
       this.logger.debug("Resolved routed model", { routedInfo });
-      const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _372 => _372.actualProviderId]) || options.providerId;
-      const actualModel = _optionalChain([routedInfo, 'optionalAccess', _373 => _373.actualModelId]) || options.model;
+      const actualProviderId = _optionalChain([routedInfo, 'optionalAccess', _402 => _402.actualProviderId]) || options.providerId;
+      const actualModel = _optionalChain([routedInfo, 'optionalAccess', _403 => _403.actualModelId]) || options.model;
       this.logger.debug("Resolved provider and model", { actualProviderId, actualModel });
       const provider = await this.getProvider(actualProviderId);
       this.logger.debug("Retrieved provider", provider ? {
@@ -5642,22 +6341,22 @@ var CompletionService = (_class13 = class {
         enabled: provider.enabled
       } : { error: "Provider not found" });
       if (!provider) {
-        _optionalChain([callbacks, 'access', _374 => _374.onError, 'optionalCall', _375 => _375(`Provider not found: ${actualProviderId}`)]);
+        _optionalChain([callbacks, 'access', _404 => _404.onError, 'optionalCall', _405 => _405(`Provider not found: ${actualProviderId}`)]);
         return;
       }
       if (!provider.enabled) {
-        _optionalChain([callbacks, 'access', _376 => _376.onError, 'optionalCall', _377 => _377(`Provider is disabled: ${provider.name}`)]);
+        _optionalChain([callbacks, 'access', _406 => _406.onError, 'optionalCall', _407 => _407(`Provider is disabled: ${provider.name}`)]);
         return;
       }
       const apiKey = await this.resolveApiKeyForRequest(provider, actualProviderId, options.sessionId);
       if (!apiKey) {
-        _optionalChain([callbacks, 'access', _378 => _378.onError, 'optionalCall', _379 => _379("API key not configured")]);
+        _optionalChain([callbacks, 'access', _408 => _408.onError, 'optionalCall', _409 => _409("API key not configured")]);
         return;
       }
       const apiFormat = _chunkA2YMUCBTcjs.resolveApiFormat.call(void 0, provider);
       this.logger.info("Using API format for stream", { apiFormat });
       const messageId = `msg_${Date.now()}`;
-      _optionalChain([callbacks, 'access', _380 => _380.onStart, 'optionalCall', _381 => _381(messageId)]);
+      _optionalChain([callbacks, 'access', _410 => _410.onStart, 'optionalCall', _411 => _411(messageId)]);
       const resolvedOptions = { ...options, model: actualModel };
       if (options.sessionId) {
         const sid = options.sessionId;
@@ -5666,14 +6365,14 @@ var CompletionService = (_class13 = class {
           ...callbacks,
           onDone: (message, usage, metrics) => {
             if (usage) {
-              _optionalChain([this, 'access', _382 => _382.usageEventSink, 'optionalAccess', _383 => _383.emit, 'call', _384 => _384({
+              _optionalChain([this, 'access', _412 => _412.usageEventSink, 'optionalAccess', _413 => _413.emit, 'call', _414 => _414({
                 sessionId: sid,
                 modelId: actualModel,
                 usage,
                 engineOrigin: "completion"
               })]);
             }
-            _optionalChain([userOnDone, 'optionalCall', _385 => _385(message, usage, metrics)]);
+            _optionalChain([userOnDone, 'optionalCall', _415 => _415(message, usage, metrics)]);
           }
         };
       }
@@ -5689,11 +6388,11 @@ var CompletionService = (_class13 = class {
               retryState.error = { status, message: error };
               return;
             }
-            _optionalChain([callbacks, 'access', _386 => _386.onError, 'optionalCall', _387 => _387(error)]);
+            _optionalChain([callbacks, 'access', _416 => _416.onError, 'optionalCall', _417 => _417(error)]);
           },
           onDone: (message, usage, metrics) => {
             this.apiKeyPool.reportSuccess(options.sessionId);
-            _optionalChain([callbacks, 'access', _388 => _388.onDone, 'optionalCall', _389 => _389(message, usage, metrics)]);
+            _optionalChain([callbacks, 'access', _418 => _418.onDone, 'optionalCall', _419 => _419(message, usage, metrics)]);
           }
         };
         await this.callStreamHandler(apiFormat, provider, apiKey, resolvedOptions, messageId, interceptCallbacks);
@@ -5714,7 +6413,7 @@ var CompletionService = (_class13 = class {
               // don't fire onStart again
             });
           } else {
-            _optionalChain([callbacks, 'access', _390 => _390.onError, 'optionalCall', _391 => _391(retryState.error.message)]);
+            _optionalChain([callbacks, 'access', _420 => _420.onError, 'optionalCall', _421 => _421(retryState.error.message)]);
           }
         }
       } else {
@@ -5727,7 +6426,7 @@ var CompletionService = (_class13 = class {
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       this.logger.error("Stream completion error", error instanceof Error ? error : void 0, { message });
-      _optionalChain([callbacks, 'access', _392 => _392.onError, 'optionalCall', _393 => _393(message)]);
+      _optionalChain([callbacks, 'access', _422 => _422.onError, 'optionalCall', _423 => _423(message)]);
     }
   }
   /**
@@ -5767,7 +6466,7 @@ var CompletionService = (_class13 = class {
         return {
           success: true,
           message: "Connection successful",
-          response: _optionalChain([result, 'access', _394 => _394.message, 'optionalAccess', _395 => _395.content]) || "",
+          response: _optionalChain([result, 'access', _424 => _424.message, 'optionalAccess', _425 => _425.content]) || "",
           model: modelId,
           durationMs
         };
@@ -5832,7 +6531,7 @@ ${description}`;
    * 3. Legacy single key from provider config
    */
   async resolveApiKeyForRequest(provider, providerId, sessionId) {
-    if (_optionalChain([provider, 'access', _396 => _396.codingPlan, 'optionalAccess', _397 => _397.enabled]) && provider.codingPlan.apiKey) {
+    if (_optionalChain([provider, 'access', _426 => _426.codingPlan, 'optionalAccess', _427 => _427.enabled]) && provider.codingPlan.apiKey) {
       return this.resolveApiKey(provider.codingPlan.apiKey);
     }
     if (this.apiKeyPool) {
@@ -5905,9 +6604,10 @@ ${description}`;
    * Resolve effective max_tokens value with priority:
    * 1. Session settings (if provided)
    * 2. Global model parameters (if enabled)
-   * 3. Model's maxTokens from provider config
-   * 4. Discovered models cache (from API)
-   * 5. undefined - let API use its default
+   * 3. undefined - let API use its default
+   *
+   * Provider and discovery maxTokens values are capability metadata, not
+   * implicit per-request output limits.
    */
   async resolveEffectiveMaxTokens(providerId, modelId, sessionMaxTokens) {
     return resolveEffectiveMaxTokens(
@@ -6082,4 +6782,13 @@ ${description}`;
 
 
 
-exports.CompletionService = CompletionService; exports.register = register; exports.emit = emit; exports.attach = attach; exports.release = release; exports.convertMessageToOpenAI = convertMessageToOpenAI; exports.convertMessageToAnthropic = convertMessageToAnthropic; exports.convertMessageToGemini = convertMessageToGemini; exports.getOpenRouterProviderConfig = getOpenRouterProviderConfig; exports.addOpenRouterProviderToRequest = addOpenRouterProviderToRequest; exports.DEFAULT_ROUTE_IDLE_MS = DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxyRouteMap = ProviderProxyRouteMap; exports.getSharedExecutor = getSharedExecutor; exports.getResponsesEndpointTransformer = getResponsesEndpointTransformer; exports.getAnthropicEndpointTransformer = getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = getGeminiEndpointTransformer; exports.readBody = readBody; exports.relayResponse = relayResponse; exports.aggregateAnthropicSseToJsonBody = aggregateAnthropicSseToJsonBody; exports.writeError = writeError; exports.resolvePoolBoundKey = resolvePoolBoundKey; exports.extractRouteToken = extractRouteToken; exports.isLoopbackAddress = isLoopbackAddress; exports.ProviderProxy = ProviderProxy; exports.getProviderProxy = getProviderProxy; exports.__resetProviderProxyForTests = __resetProviderProxyForTests; exports.KeyedMutex = KeyedMutex; exports.OUTBOUND_API_SERVER_CONFIG_KEY = OUTBOUND_API_SERVER_CONFIG_KEY; exports.DEFAULT_USER_MESSAGE_QUEUE = DEFAULT_USER_MESSAGE_QUEUE; exports.DEFAULT_CONCURRENCY_QUEUE = DEFAULT_CONCURRENCY_QUEUE; exports.DEFAULT_ACCOUNT_PROBE = DEFAULT_ACCOUNT_PROBE; exports.normalizeAccountProbe = normalizeAccountProbe; exports.normalizeAudit = normalizeAudit; exports.normalizeBilling = normalizeBilling; exports.DEFAULT_FINGERPRINT = DEFAULT_FINGERPRINT; exports.normalizeFingerprint = normalizeFingerprint; exports.normalizeVoucher = normalizeVoucher; exports.normalizeProxyConfig = normalizeProxyConfig; exports.normalizeProxySegment = normalizeProxySegment; exports.normalizeWebhookDestination = normalizeWebhookDestination; exports.normalizeWebhookSegment = normalizeWebhookSegment; exports.normalizeQueueSegments = normalizeQueueSegments; exports.normalizePrefixTargets = normalizePrefixTargets; exports.defaultServerConfig = defaultServerConfig; exports.normalizeServerConfig = normalizeServerConfig; exports.loadServerConfig = loadServerConfig; exports.saveServerConfig = saveServerConfig; exports.mergeServerConfig = mergeServerConfig; exports.computeKeyExpiry = computeKeyExpiry; exports.checkKeyQuota = checkKeyQuota; exports.randomBase62 = randomBase62; exports.hashKey = hashKey; exports.createNamedKey = createNamedKey; exports.verifyKey = verifyKey; exports.verifyPresentedKey = verifyPresentedKey; exports.ConcurrencyQueueFullError = ConcurrencyQueueFullError; exports.ConcurrencyWaitTimeoutError = ConcurrencyWaitTimeoutError; exports.ConcurrencyWaitCancelledError = ConcurrencyWaitCancelledError; exports.isConcurrencyRejection = isConcurrencyRejection; exports.OutboundConcurrencyGate = OutboundConcurrencyGate; exports.OutboundRateLimiter = OutboundRateLimiter; exports.isUserMessageRequest = isUserMessageRequest; exports.SerialQueueTimeoutError = SerialQueueTimeoutError; exports.isSerialQueueTimeout = isSerialQueueTimeout; exports.UserMessageSerialQueue = UserMessageSerialQueue; exports.generateVoucherCode = generateVoucherCode; exports.hashVoucherCode = hashVoucherCode; exports.voucherCodePrefix = voucherCodePrefix; exports.newVoucherId = newVoucherId; exports.computeVoucherGrant = computeVoucherGrant; exports.toVoucherInfo = toVoucherInfo; exports.isRedeemRequest = isRedeemRequest; exports.handleVoucherRedeem = handleVoucherRedeem; exports.DEFAULT_OUTBOUND_PORT = DEFAULT_OUTBOUND_PORT; exports.OutboundApiConfigError = OutboundApiConfigError; exports.OutboundApiServer = OutboundApiServer; exports.formatUrls = formatUrls; exports.startOfLocalDay = startOfLocalDay; exports.startOfLocalWeek = startOfLocalWeek; exports.KeySpendTracker = KeySpendTracker; exports.getOutboundApiServer = getOutboundApiServer; exports.__resetOutboundApiServerForTests = __resetOutboundApiServerForTests;
+
+
+
+
+
+
+
+
+
+exports.CompletionService = CompletionService; exports.register = register; exports.emit = emit; exports.attach = attach; exports.release = release; exports.convertMessageToOpenAI = convertMessageToOpenAI; exports.convertMessageToAnthropic = convertMessageToAnthropic; exports.convertMessageToGemini = convertMessageToGemini; exports.getOpenRouterProviderConfig = getOpenRouterProviderConfig; exports.addOpenRouterProviderToRequest = addOpenRouterProviderToRequest; exports.DEFAULT_ROUTE_IDLE_MS = DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxyRouteMap = ProviderProxyRouteMap; exports.getSharedExecutor = getSharedExecutor; exports.getResponsesEndpointTransformer = getResponsesEndpointTransformer; exports.getAnthropicEndpointTransformer = getAnthropicEndpointTransformer; exports.getGeminiEndpointTransformer = getGeminiEndpointTransformer; exports.readBody = readBody; exports.relayResponse = relayResponse; exports.aggregateAnthropicSseToJsonBody = aggregateAnthropicSseToJsonBody; exports.writeError = writeError; exports.writeBoundAccountError = writeBoundAccountError; exports.resolvePoolBoundKey = resolvePoolBoundKey; exports.extractRouteToken = extractRouteToken; exports.isLoopbackAddress = isLoopbackAddress; exports.ProviderProxy = ProviderProxy; exports.getProviderProxy = getProviderProxy; exports.__resetProviderProxyForTests = __resetProviderProxyForTests; exports.KeyedMutex = KeyedMutex; exports.OUTBOUND_API_SERVER_CONFIG_KEY = OUTBOUND_API_SERVER_CONFIG_KEY; exports.DEFAULT_USER_MESSAGE_QUEUE = DEFAULT_USER_MESSAGE_QUEUE; exports.DEFAULT_CONCURRENCY_QUEUE = DEFAULT_CONCURRENCY_QUEUE; exports.DEFAULT_ACCOUNT_PROBE = DEFAULT_ACCOUNT_PROBE; exports.DEFAULT_ALLOWANCE_SCHEDULING = DEFAULT_ALLOWANCE_SCHEDULING; exports.normalizeAllowanceScheduling = normalizeAllowanceScheduling; exports.normalizeAccountProbe = normalizeAccountProbe; exports.normalizeAudit = normalizeAudit; exports.normalizeBilling = normalizeBilling; exports.DEFAULT_FINGERPRINT = DEFAULT_FINGERPRINT; exports.normalizeFingerprint = normalizeFingerprint; exports.normalizeVoucher = normalizeVoucher; exports.normalizeProxyConfig = normalizeProxyConfig; exports.normalizeProxySegment = normalizeProxySegment; exports.normalizeWebhookDestination = normalizeWebhookDestination; exports.normalizeWebhookSegment = normalizeWebhookSegment; exports.normalizeQueueSegments = normalizeQueueSegments; exports.normalizePrefixTargets = normalizePrefixTargets; exports.legacyEndpointsToBindings = legacyEndpointsToBindings; exports.normalizeGatewayBindings = normalizeGatewayBindings; exports.defaultServerConfig = defaultServerConfig; exports.normalizeServerConfig = normalizeServerConfig; exports.loadServerConfig = loadServerConfig; exports.saveServerConfig = saveServerConfig; exports.mergeServerConfig = mergeServerConfig; exports.gatewayBindingToEndpointConfig = gatewayBindingToEndpointConfig; exports.candidateGatewayBindings = candidateGatewayBindings; exports.candidateBackgroundModelIds = candidateBackgroundModelIds; exports.resolveGatewayBinding = resolveGatewayBinding; exports.computeKeyExpiry = computeKeyExpiry; exports.checkKeyQuota = checkKeyQuota; exports.randomBase62 = randomBase62; exports.hashKey = hashKey; exports.createNamedKey = createNamedKey; exports.createIntegrationKey = createIntegrationKey; exports.verifyKey = verifyKey; exports.verifyPresentedKey = verifyPresentedKey; exports.ConcurrencyQueueFullError = ConcurrencyQueueFullError; exports.ConcurrencyWaitTimeoutError = ConcurrencyWaitTimeoutError; exports.ConcurrencyWaitCancelledError = ConcurrencyWaitCancelledError; exports.isConcurrencyRejection = isConcurrencyRejection; exports.OutboundConcurrencyGate = OutboundConcurrencyGate; exports.OutboundRateLimiter = OutboundRateLimiter; exports.isUserMessageRequest = isUserMessageRequest; exports.SerialQueueTimeoutError = SerialQueueTimeoutError; exports.isSerialQueueTimeout = isSerialQueueTimeout; exports.UserMessageSerialQueue = UserMessageSerialQueue; exports.generateVoucherCode = generateVoucherCode; exports.hashVoucherCode = hashVoucherCode; exports.voucherCodePrefix = voucherCodePrefix; exports.newVoucherId = newVoucherId; exports.computeVoucherGrant = computeVoucherGrant; exports.toVoucherInfo = toVoucherInfo; exports.isRedeemRequest = isRedeemRequest; exports.handleVoucherRedeem = handleVoucherRedeem; exports.DEFAULT_OUTBOUND_PORT = DEFAULT_OUTBOUND_PORT; exports.OutboundApiServer = OutboundApiServer; exports.formatUrls = formatUrls; exports.startOfLocalDay = startOfLocalDay; exports.startOfLocalWeek = startOfLocalWeek; exports.KeySpendTracker = KeySpendTracker; exports.getOutboundApiServer = getOutboundApiServer; exports.__resetOutboundApiServerForTests = __resetOutboundApiServerForTests;