@omnicross/core 0.1.5 → 0.1.7

package/dist/transformer.js

@@ -1,21 +1,21 @@
 import "./chunk-46RLHI7D.js";
+import {
+  registerBuiltinTransformers
+} from "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
+import "./chunk-LB6EBS6Y.js";
 import {
   TransformerChainExecutor
-} from "./chunk-G2UTNSGU.js";
+} from "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
 import {
   TransformerService
 } from "./chunk-DK4A7DLE.js";
-import {
-  registerBuiltinTransformers
-} from "./chunk-OQWKZCXP.js";
-import "./chunk-IB3FDI4O.js";
-import "./chunk-ZJZAOKI7.js";
-import "./chunk-C6OV7GCC.js";
-import "./chunk-IWQAX3CS.js";
-import "./chunk-BODMAL6G.js";
-import "./chunk-MZNPGW5Q.js";
-import "./chunk-MFZ5437A.js";
-import "./chunk-6QZGDLL4.js";
+import "./chunk-N5T4M4GU.js";
+import "./chunk-TOVPMMHM.js";
 export {
   TransformerChainExecutor,
   TransformerService,

package/dist/{types-lgPYQuZS.d.ts → types-CqZD77rS.d.ts}

@@ -8,7 +8,8 @@ import { L as Logger } from './logger-4GvQNzhE.js';
 import { ProviderConfigSource } from './ports/provider-config-source.js';
 import { P as ProviderProxy } from './ProviderProxy-C-xqrkKi.js';
 import { ProviderProxyDeps } from './provider-proxy/types.js';
-import { c as KeySpend } from './keyPolicy-Cp0FntZl.js';
+import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.js';
+import { c as KeySpend } from './keyPolicy-zdWTu3CQ.js';
 
 /**
  * keySpendTracker — a cheap in-memory per-key accumulated-spend cache
@@ -313,15 +314,30 @@ interface EndpointRoutingConfig {
     /**
      * OPTIONAL subscription-mode binding to ONE specific subscription account id
      * (provider/subscription duality). Absent/blank ⇒ the provider's account pool
-     * auto-schedules (priority/LRU/health). When set and the account is
-     * schedulable it is used directly; otherwise the pool is the fallback.
+     * auto-schedules (priority/LRU/health). When set, strict mode requires this
+     * account to serve; the pool is a fallback only with the explicit policy below.
      */
     boundAccountId?: string;
+    /**
+     * What a bound account does when it cannot serve this request. Meaningful
+     * only with `boundAccountId`; normalization drops it otherwise. A legacy
+     * bound endpoint with no field migrates to `'strict'`. The pool is used only
+     * when this is explicitly set to `'pool'`.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /**
+     * Runtime-only account-group selector used by a {@link GatewayBinding}.
+     * Legacy endpoint persistence does not synthesize this field; it is projected
+     * from an independent binding immediately before route resolution.
+     */
+    boundAccountGroup?: string;
     /**
      * OPTIONAL provider-mode binding to ONE specific BYO key id (from the
      * provider's key pool). Absent/blank ⇒ the provider's default key / key pool.
      */
     boundKeyId?: string;
+    /** Strict by default; `'pool'` permits the provider's normal key pool. */
+    boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /**
      * OPTIONAL "background model id" override list (role-based `gemini` only).
      * When set, an incoming requested model id appearing in this list is
@@ -364,7 +380,7 @@ interface ConcurrencyQueueConfig {
  * Persisted + strictly validated like the queue segments; applied to the shared
  * `SubscriptionAccountHealth` tracker at daemon boot.
  *  - `overloadCooldownEnabled` default **true** — a 529 places the account in
- *    overload cooldown (ON by default; CRS ships it off).
+ *    overload cooldown (enabled by default).
  *  - `overloadCooldownMs`      default **600000** (10 min), valid `60000..3600000`.
  */
 interface AccountHealthConfig {
@@ -397,6 +413,89 @@ interface AccountProbeConfig {
     historySize: number;
     staggerMs: number;
 }
+/** A resource selected by a client-to-upstream gateway binding. */
+type GatewayBindingTarget = {
+    kind: 'account';
+    providerId: string;
+    accountId: string;
+} | {
+    kind: 'account-group';
+    providerId: string;
+    group: string;
+} | {
+    /**
+     * The provider's WHOLE subscription pool, with no account preference —
+     * plain priority/LRU/health scheduling. Distinct from `account-group`,
+     * which pins a preferred group, and from `provider`, which is BYO-key.
+     */
+    kind: 'account-pool';
+    providerId: string;
+} | {
+    kind: 'provider';
+    providerId: string;
+    keyId?: string;
+};
+/**
+ * Behavior when a binding cannot serve the requested model or credential.
+ * `next` yields to the next matching route (and lets a bound account fall back
+ * to its provider pool); `fail` keeps the route strict and errors instead.
+ */
+type GatewayBindingFallback = 'next' | 'fail';
+/** Which named API keys may enter a downstream route. */
+type GatewayBindingKeyScope = 'all' | 'selected';
+/** Whether the downstream model id is forwarded or explicitly remapped. */
+type GatewayBindingModelMode = 'passthrough' | 'mapped';
+/** One exact or `*` wildcard model-name rewrite owned by a downstream route. */
+interface GatewayModelMapping {
+    source: string;
+    target: ModelRef;
+}
+/**
+ * Independent client-to-upstream route aggregate.
+ *
+ * A binding belongs to exactly one endpoint and one upstream resource. Keeping
+ * it separate from account/provider DTOs lets the same resource participate in
+ * multiple client-key routes without changing its identity or secret shape.
+ */
+interface GatewayBinding {
+    id: string;
+    name: string;
+    enabled: boolean;
+    /** Legacy entries without this field keep the former all-vs-list behavior. */
+    keyScope?: GatewayBindingKeyScope;
+    /** Used only when `keyScope` resolves to `selected`. */
+    apiKeyIds?: string[];
+    endpoint: OutboundEndpoint;
+    target: GatewayBindingTarget;
+    /** Lower values win. Key-scoped bindings win before this comparison. */
+    priority?: number;
+    /** Next yields to the following matching route; fail keeps the binding strict. */
+    fallback: GatewayBindingFallback;
+    /** Empty passthrough routes preserve the client's requested model id. */
+    modelMode?: GatewayBindingModelMode;
+    /** Preferred generic mapping shape; legacy endpoint-specific fields remain readable. */
+    modelMappings?: GatewayModelMapping[];
+    modelMap?: Record<string, ModelRef>;
+    models?: ModelRef[];
+    dispatchMode?: ChatDispatchMode;
+    prefixTargets?: ModelPrefixTargets;
+    defaultModel?: ModelRef;
+    backgroundModel?: ModelRef;
+    backgroundModelIds?: string[];
+}
+/**
+ * Optional allowance-aware account scheduling. Default-off keeps allowance
+ * telemetry display-only. When enabled, only fresh Claude/Codex snapshots are
+ * considered: accounts above `demoteAtPercent` receive a temporary priority
+ * penalty; accounts above `pauseAtPercent` are excluded until the provider's
+ * reset/freshness deadline. Missing or stale data never excludes an account.
+ */
+interface AllowanceSchedulingConfig {
+    enabled: boolean;
+    demoteAtPercent: number;
+    pauseAtPercent: number;
+    priorityPenalty: number;
+}
 /**
  * Client-fingerprint segment (subscription-client-fingerprint #7). Opt-in,
  * default OFF: when disabled the claude-subscription outbound headers are
@@ -435,8 +534,19 @@ interface OutboundApiServerConfig {
     enabled: boolean;
     /** When true the listener binds `0.0.0.0` (LAN) instead of `127.0.0.1`. */
     networkBinding: boolean;
-    /** Per-endpoint routing config, one per endpoint (4 entries). */
+    /**
+     * LEGACY per-endpoint routing config, one per endpoint (4 entries). No longer
+     * a routing source: {@link normalizeServerConfig} projects any configured
+     * entry into {@link bindings} once and leaves these blank. Retained as the
+     * projection shape {@link EndpointRoutingConfig} and for embedders that build
+     * a config by hand.
+     */
     endpoints: EndpointRoutingConfig[];
+    /**
+     * Resource-centric routes — the SSOT for routing. Optional in the raw
+     * persisted shape; normalized Omnicross configs always carry an array.
+     */
+    bindings?: GatewayBinding[];
     /** Persisted port (fixed default; falls back to ephemeral on EADDRINUSE). */
     port?: number;
     /**
@@ -463,6 +573,8 @@ interface OutboundApiServerConfig {
      * boot; a change takes effect on restart. Default-off ⇒ no scheduler runs.
      */
     accountProbe?: AccountProbeConfig;
+    /** Default-off allowance-aware scheduling; hot-reloaded by the daemon. */
+    allowanceScheduling?: AllowanceSchedulingConfig;
     /**
      * Layered upstream-proxy segment (upstream-proxy). Optional; when absent no
      * global/provider proxy applies (direct egress). `normalizeServerConfig` drops
@@ -542,10 +654,23 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
     revoked: boolean;
+    /** Intended consumer. Existing rows default to a general client key. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list. Absent means every outbound endpoint. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** When true the key is rejected unless the TCP peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling for the outbound concurrency gate. Absent or
      * `0` = unlimited (the gate is bypassed entirely for this key).
@@ -571,7 +696,7 @@ interface OutboundApiKeyInfo {
     rateLimitWindowMs?: number | null;
     /** Master switch: when false/unset the model list is inert (no restriction). */
     enableModelRestriction?: boolean;
-    /** Restriction mode; absent ⇒ `'blacklist'` (CRS-parity). */
+    /** Restriction mode; absent ⇒ `'blacklist'`. */
     restrictionMode?: OutboundKeyModelRestrictionMode;
     /** The model-id list the mode acts on (bare modelIds; empty allowlist denies all). */
     restrictedModels?: string[];
@@ -633,10 +758,25 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
     revokedAt: number | null;
+    /** Intended consumer. Existing rows without this field remain client keys. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list for least-privilege integration keys. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** Restrict use to requests whose direct socket peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling. Absent/`0` = unlimited = the concurrency gate
      * is bypassed for this key. Persisted by the daemon (`omnicross-uqc-daemon`).
@@ -676,6 +816,17 @@ interface OutboundKeyDb {
         keyHash: string;
         keyPrefix: string;
         createdAt?: number;
+        kind?: 'client' | 'integration';
+        allowedEndpoints?: OutboundEndpoint[];
+        loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -703,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident
@@ -751,4 +917,4 @@ interface OutboundApiDeps {
     readonly logger?: Logger;
 }
 
-export { type AccountProbeConfig as A, toVoucherInfo as B, type ChatDispatchMode as C, voucherCodePrefix as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type ModelRef as G, type AccountHealthConfig as H, type OutboundKeyModelRestrictionMode as I, type KeySpendReader as K, type MessagesModelKind as M, type OutboundKeyDb as O, type RequestRole as R, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type ConcurrencyQueueConfig as a, type EndpointRoutingConfig as b, type KeySpendSeeder as c, KeySpendTracker as d, type KindMappedEndpoint as e, type ModelKind as f, type ModelPrefixTargets as g, type OutboundApiDeps as h, type OutboundApiKeyCreated as i, type OutboundApiKeyInfo as j, type OutboundApiServerConfig as k, type OutboundApiServerStatus as l, type OutboundEndpoint as m, type OutboundFormatUrls as n, type OutboundKeyActivationMode as o, type OutboundKeyDbRow as p, type OutboundKeyPolicy as q, type OutboundProxyConfig as r, type ResponsesModelKind as s, type VoucherDb as t, computeVoucherGrant as u, generateVoucherCode as v, hashVoucherCode as w, newVoucherId as x, startOfLocalDay as y, startOfLocalWeek as z };
+export { type AccountProbeConfig as A, computeVoucherGrant as B, type ChatDispatchMode as C, generateVoucherCode as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, hashVoucherCode as H, newVoucherId as I, startOfLocalDay as J, type KeySpendReader as K, startOfLocalWeek as L, type MessagesModelKind as M, toVoucherInfo as N, type OutboundKeyDb as O, voucherCodePrefix as P, type ModelRef as Q, type RequestRole as R, type AccountHealthConfig as S, type OutboundKeyModelRestrictionMode as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type AllowanceSchedulingConfig as a, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundProxyConfig as x, type ResponsesModelKind as y, type VoucherDb as z };

package/dist/{types-B8Arpxn0.d.cts → types-gjJ5lJ5n.d.cts}

@@ -8,7 +8,8 @@ import { L as Logger } from './logger-4GvQNzhE.cjs';
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
 import { P as ProviderProxy } from './ProviderProxy-CnMQYN59.cjs';
 import { ProviderProxyDeps } from './provider-proxy/types.cjs';
-import { c as KeySpend } from './keyPolicy-Cp0FntZl.cjs';
+import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.cjs';
+import { c as KeySpend } from './keyPolicy-zdWTu3CQ.cjs';
 
 /**
  * keySpendTracker — a cheap in-memory per-key accumulated-spend cache
@@ -313,15 +314,30 @@ interface EndpointRoutingConfig {
     /**
      * OPTIONAL subscription-mode binding to ONE specific subscription account id
      * (provider/subscription duality). Absent/blank ⇒ the provider's account pool
-     * auto-schedules (priority/LRU/health). When set and the account is
-     * schedulable it is used directly; otherwise the pool is the fallback.
+     * auto-schedules (priority/LRU/health). When set, strict mode requires this
+     * account to serve; the pool is a fallback only with the explicit policy below.
      */
     boundAccountId?: string;
+    /**
+     * What a bound account does when it cannot serve this request. Meaningful
+     * only with `boundAccountId`; normalization drops it otherwise. A legacy
+     * bound endpoint with no field migrates to `'strict'`. The pool is used only
+     * when this is explicitly set to `'pool'`.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
+    /**
+     * Runtime-only account-group selector used by a {@link GatewayBinding}.
+     * Legacy endpoint persistence does not synthesize this field; it is projected
+     * from an independent binding immediately before route resolution.
+     */
+    boundAccountGroup?: string;
     /**
      * OPTIONAL provider-mode binding to ONE specific BYO key id (from the
      * provider's key pool). Absent/blank ⇒ the provider's default key / key pool.
      */
     boundKeyId?: string;
+    /** Strict by default; `'pool'` permits the provider's normal key pool. */
+    boundKeyFallbackPolicy?: BoundAccountFallbackPolicy;
     /**
      * OPTIONAL "background model id" override list (role-based `gemini` only).
      * When set, an incoming requested model id appearing in this list is
@@ -364,7 +380,7 @@ interface ConcurrencyQueueConfig {
  * Persisted + strictly validated like the queue segments; applied to the shared
  * `SubscriptionAccountHealth` tracker at daemon boot.
  *  - `overloadCooldownEnabled` default **true** — a 529 places the account in
- *    overload cooldown (ON by default; CRS ships it off).
+ *    overload cooldown (enabled by default).
  *  - `overloadCooldownMs`      default **600000** (10 min), valid `60000..3600000`.
  */
 interface AccountHealthConfig {
@@ -397,6 +413,89 @@ interface AccountProbeConfig {
     historySize: number;
     staggerMs: number;
 }
+/** A resource selected by a client-to-upstream gateway binding. */
+type GatewayBindingTarget = {
+    kind: 'account';
+    providerId: string;
+    accountId: string;
+} | {
+    kind: 'account-group';
+    providerId: string;
+    group: string;
+} | {
+    /**
+     * The provider's WHOLE subscription pool, with no account preference —
+     * plain priority/LRU/health scheduling. Distinct from `account-group`,
+     * which pins a preferred group, and from `provider`, which is BYO-key.
+     */
+    kind: 'account-pool';
+    providerId: string;
+} | {
+    kind: 'provider';
+    providerId: string;
+    keyId?: string;
+};
+/**
+ * Behavior when a binding cannot serve the requested model or credential.
+ * `next` yields to the next matching route (and lets a bound account fall back
+ * to its provider pool); `fail` keeps the route strict and errors instead.
+ */
+type GatewayBindingFallback = 'next' | 'fail';
+/** Which named API keys may enter a downstream route. */
+type GatewayBindingKeyScope = 'all' | 'selected';
+/** Whether the downstream model id is forwarded or explicitly remapped. */
+type GatewayBindingModelMode = 'passthrough' | 'mapped';
+/** One exact or `*` wildcard model-name rewrite owned by a downstream route. */
+interface GatewayModelMapping {
+    source: string;
+    target: ModelRef;
+}
+/**
+ * Independent client-to-upstream route aggregate.
+ *
+ * A binding belongs to exactly one endpoint and one upstream resource. Keeping
+ * it separate from account/provider DTOs lets the same resource participate in
+ * multiple client-key routes without changing its identity or secret shape.
+ */
+interface GatewayBinding {
+    id: string;
+    name: string;
+    enabled: boolean;
+    /** Legacy entries without this field keep the former all-vs-list behavior. */
+    keyScope?: GatewayBindingKeyScope;
+    /** Used only when `keyScope` resolves to `selected`. */
+    apiKeyIds?: string[];
+    endpoint: OutboundEndpoint;
+    target: GatewayBindingTarget;
+    /** Lower values win. Key-scoped bindings win before this comparison. */
+    priority?: number;
+    /** Next yields to the following matching route; fail keeps the binding strict. */
+    fallback: GatewayBindingFallback;
+    /** Empty passthrough routes preserve the client's requested model id. */
+    modelMode?: GatewayBindingModelMode;
+    /** Preferred generic mapping shape; legacy endpoint-specific fields remain readable. */
+    modelMappings?: GatewayModelMapping[];
+    modelMap?: Record<string, ModelRef>;
+    models?: ModelRef[];
+    dispatchMode?: ChatDispatchMode;
+    prefixTargets?: ModelPrefixTargets;
+    defaultModel?: ModelRef;
+    backgroundModel?: ModelRef;
+    backgroundModelIds?: string[];
+}
+/**
+ * Optional allowance-aware account scheduling. Default-off keeps allowance
+ * telemetry display-only. When enabled, only fresh Claude/Codex snapshots are
+ * considered: accounts above `demoteAtPercent` receive a temporary priority
+ * penalty; accounts above `pauseAtPercent` are excluded until the provider's
+ * reset/freshness deadline. Missing or stale data never excludes an account.
+ */
+interface AllowanceSchedulingConfig {
+    enabled: boolean;
+    demoteAtPercent: number;
+    pauseAtPercent: number;
+    priorityPenalty: number;
+}
 /**
  * Client-fingerprint segment (subscription-client-fingerprint #7). Opt-in,
  * default OFF: when disabled the claude-subscription outbound headers are
@@ -435,8 +534,19 @@ interface OutboundApiServerConfig {
     enabled: boolean;
     /** When true the listener binds `0.0.0.0` (LAN) instead of `127.0.0.1`. */
     networkBinding: boolean;
-    /** Per-endpoint routing config, one per endpoint (4 entries). */
+    /**
+     * LEGACY per-endpoint routing config, one per endpoint (4 entries). No longer
+     * a routing source: {@link normalizeServerConfig} projects any configured
+     * entry into {@link bindings} once and leaves these blank. Retained as the
+     * projection shape {@link EndpointRoutingConfig} and for embedders that build
+     * a config by hand.
+     */
     endpoints: EndpointRoutingConfig[];
+    /**
+     * Resource-centric routes — the SSOT for routing. Optional in the raw
+     * persisted shape; normalized Omnicross configs always carry an array.
+     */
+    bindings?: GatewayBinding[];
     /** Persisted port (fixed default; falls back to ephemeral on EADDRINUSE). */
     port?: number;
     /**
@@ -463,6 +573,8 @@ interface OutboundApiServerConfig {
      * boot; a change takes effect on restart. Default-off ⇒ no scheduler runs.
      */
     accountProbe?: AccountProbeConfig;
+    /** Default-off allowance-aware scheduling; hot-reloaded by the daemon. */
+    allowanceScheduling?: AllowanceSchedulingConfig;
     /**
      * Layered upstream-proxy segment (upstream-proxy). Optional; when absent no
      * global/provider proxy applies (direct egress). `normalizeServerConfig` drops
@@ -542,10 +654,23 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
     revoked: boolean;
+    /** Intended consumer. Existing rows default to a general client key. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list. Absent means every outbound endpoint. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** When true the key is rejected unless the TCP peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling for the outbound concurrency gate. Absent or
      * `0` = unlimited (the gate is bypassed entirely for this key).
@@ -571,7 +696,7 @@ interface OutboundApiKeyInfo {
     rateLimitWindowMs?: number | null;
     /** Master switch: when false/unset the model list is inert (no restriction). */
     enableModelRestriction?: boolean;
-    /** Restriction mode; absent ⇒ `'blacklist'` (CRS-parity). */
+    /** Restriction mode; absent ⇒ `'blacklist'`. */
     restrictionMode?: OutboundKeyModelRestrictionMode;
     /** The model-id list the mode acts on (bare modelIds; empty allowlist denies all). */
     restrictedModels?: string[];
@@ -633,10 +758,25 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
     revokedAt: number | null;
+    /** Intended consumer. Existing rows without this field remain client keys. */
+    kind?: 'client' | 'integration';
+    /** Optional endpoint allow-list for least-privilege integration keys. */
+    allowedEndpoints?: OutboundEndpoint[];
+    /** Restrict use to requests whose direct socket peer is loopback. */
+    loopbackOnly?: boolean;
     /**
      * Per-key concurrency ceiling. Absent/`0` = unlimited = the concurrency gate
      * is bypassed for this key. Persisted by the daemon (`omnicross-uqc-daemon`).
@@ -676,6 +816,17 @@ interface OutboundKeyDb {
         keyHash: string;
         keyPrefix: string;
         createdAt?: number;
+        kind?: 'client' | 'integration';
+        allowedEndpoints?: OutboundEndpoint[];
+        loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -703,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident
@@ -751,4 +917,4 @@ interface OutboundApiDeps {
     readonly logger?: Logger;
 }
 
-export { type AccountProbeConfig as A, toVoucherInfo as B, type ChatDispatchMode as C, voucherCodePrefix as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type ModelRef as G, type AccountHealthConfig as H, type OutboundKeyModelRestrictionMode as I, type KeySpendReader as K, type MessagesModelKind as M, type OutboundKeyDb as O, type RequestRole as R, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type ConcurrencyQueueConfig as a, type EndpointRoutingConfig as b, type KeySpendSeeder as c, KeySpendTracker as d, type KindMappedEndpoint as e, type ModelKind as f, type ModelPrefixTargets as g, type OutboundApiDeps as h, type OutboundApiKeyCreated as i, type OutboundApiKeyInfo as j, type OutboundApiServerConfig as k, type OutboundApiServerStatus as l, type OutboundEndpoint as m, type OutboundFormatUrls as n, type OutboundKeyActivationMode as o, type OutboundKeyDbRow as p, type OutboundKeyPolicy as q, type OutboundProxyConfig as r, type ResponsesModelKind as s, type VoucherDb as t, computeVoucherGrant as u, generateVoucherCode as v, hashVoucherCode as w, newVoucherId as x, startOfLocalDay as y, startOfLocalWeek as z };
+export { type AccountProbeConfig as A, computeVoucherGrant as B, type ChatDispatchMode as C, generateVoucherCode as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, hashVoucherCode as H, newVoucherId as I, startOfLocalDay as J, type KeySpendReader as K, startOfLocalWeek as L, type MessagesModelKind as M, toVoucherInfo as N, type OutboundKeyDb as O, voucherCodePrefix as P, type ModelRef as Q, type RequestRole as R, type AccountHealthConfig as S, type OutboundKeyModelRestrictionMode as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type AllowanceSchedulingConfig as a, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundProxyConfig as x, type ResponsesModelKind as y, type VoucherDb as z };

package/dist/usage/pricing-engine.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkYMFAJFQTcjs = require('../chunk-YMFAJFQT.cjs');
+var _chunk2E42SAW3cjs = require('../chunk-2E42SAW3.cjs');
 
 
-exports.PricingEngine = _chunkYMFAJFQTcjs.PricingEngine;
+exports.PricingEngine = _chunk2E42SAW3cjs.PricingEngine;

package/dist/usage/pricing-engine.d.cts

@@ -9,7 +9,8 @@ import { PricingStore } from '../ports/pricing-store.cjs';
  * Persistence goes through the injected `PricingStore` port. Sources of
  * pricing rows:
  *  - 'builtin'  — bundled fallback prices, seeded by the host
- *  - 'litellm'  — refreshed on user demand from LiteLLM's public JSON
+ *  - 'litellm'  — primary catalog from LiteLLM's public JSON
+ *  - 'openrouter' — supplemental OpenRouter route pricing
  *  - 'user'     — hand-edited; protected from auto-overwrite
  *
  * @module usage/pricing-engine
@@ -29,8 +30,12 @@ interface CostCalculation {
 interface PricingEngineOptions {
     /** Override the pricing-source JSON URL — useful for testing. */
     sourceUrl?: string;
+    /** Override the supplemental OpenRouter catalog URL. */
+    openRouterSourceUrl?: string;
     /** Override `fetch` — useful for testing. */
     fetchImpl?: typeof fetch;
+    /** Bound each remote source independently; both sources are fetched in parallel. */
+    fetchTimeoutMs?: number;
 }
 declare class PricingEngine {
     private store;
@@ -45,7 +50,18 @@ declare class PricingEngine {
      * non-wildcard entry per model wins.
      */
     private cacheByModel;
+    /**
+     * Last-resort fuzzy index: `[normalizedModelId, entry]` pairs over the same
+     * non-wildcard, non-openrouter rows as `cacheByModel`. Used when even the
+     * model-name fallback misses — e.g. usage recorded under a bare model id
+     * (`glm-5.2`) while the catalog only knows prefixed slugs
+     * (`cloudflare/@cf/zai-org/glm-5.2`). This is an ESTIMATE: the matched row
+     * may be an aggregate-route price rather than the direct-vendor rate.
+     */
+    private fuzzyEntries;
     private cacheLoaded;
+    /** Coalesce manual and background refreshes to prevent a catalog stampede. */
+    private refreshInFlight;
     constructor(store: PricingStore, logger: Logger, options?: PricingEngineOptions);
     /** Lazy-load and cache the full pricing table. */
     private ensureCache;
@@ -58,8 +74,19 @@ declare class PricingEngine {
      *   2. wildcard provider ('*', modelId)
      *   3. model name alone (any provider) — tolerates a runtime-alias vs
      *      canonical provider-id mismatch for the same model.
+     *   4. normalized fuzzy match (last resort) — matches a bare id like
+     *      `glm-5.2` against prefixed catalog slugs like
+     *      `cloudflare/@cf/zai-org/glm-5.2`. ESTIMATE only: the matched row may
+     *      be an aggregate-route price, not the direct-vendor rate.
      */
     getEntry(providerId: string, modelId: string): Promise<PricingEntry | null>;
+    /**
+     * Normalized substring match over the catalog's non-openrouter rows. Lowercases
+     * and strips all non-alphanumerics, then matches bidirectionally, preferring
+     * the shortest catalog key (tightest match) to reduce over-matching version
+     * variants. Returns null when nothing matches.
+     */
+    private fuzzyMatch;
     /**
      * Compute the cost (and cache savings) for a single response.
      *
@@ -77,6 +104,7 @@ declare class PricingEngine {
     calculateCost(providerId: string, modelId: string, usage: UsageTokens): Promise<CostCalculation>;
     upsertManual(input: PricingEntryInput): Promise<PricingEntry>;
     fetchLatestFromSource(): Promise<PricingFetchResult>;
+    private refreshSources;
     resolveConflicts(decisions: PricingConflictDecision[], pendingIncoming: Map<string, PricingEntryInput>): Promise<PricingResolution>;
 }