@omnicross/core 0.1.5 → 0.1.7

package/dist/{chunk-FH2P4OCD.js → chunk-E3COOKUP.js}

@@ -2,20 +2,29 @@ import {
   streamSSEResponse
 } from "./chunk-VVEHS2LI.js";
 import {
-  TransformerChainExecutor
-} from "./chunk-G2UTNSGU.js";
-import {
-  AnthropicTransformer
-} from "./chunk-C6OV7GCC.js";
+  AnthropicTransformer,
+  resolveAnthropicMaxTokens
+} from "./chunk-PEGTIPB3.js";
 import {
   GeminiTransformer
-} from "./chunk-IWQAX3CS.js";
+} from "./chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "./chunk-BODMAL6G.js";
+} from "./chunk-32O35CIF.js";
+import {
+  TransformerChainExecutor
+} from "./chunk-WNKWAEUR.js";
 import {
   injectExtendedContextBeta
 } from "./chunk-MZNPGW5Q.js";
+import {
+  DEFAULT_CODEX_CLI_HEADERS,
+  NEVER_FORWARD_HEADERS,
+  codexAcceptHeader,
+  extractCodexClientHeaders,
+  fillMissingHeaders,
+  flattenHeaderValue
+} from "./chunk-XXFYLL7R.js";
 import {
   getSharedIdentityStore
 } from "./chunk-XTEI64OU.js";
@@ -25,37 +34,48 @@ import {
 } from "./chunk-XX6NQJMA.js";
 import {
   collectMatchText,
+  deriveGatewaySessionKey,
   deriveSubscriptionSessionKey
-} from "./chunk-IAXWICZU.js";
+} from "./chunk-GFIZ6LQI.js";
 import {
   emitWebhookEvent
 } from "./chunk-OE6TDIWW.js";
 import {
   getGeminiCodeAssistResolver
 } from "./chunk-DRWHTIIZ.js";
-import {
-  executeProviderCall
-} from "./chunk-IK3KE3AU.js";
-import {
-  LlmConfigProviderAuth,
-  getProviderHeaders
-} from "./chunk-ZY6KU6P3.js";
 import {
   resolveProviderChain
 } from "./chunk-JWC6APFQ.js";
 import {
   resolveSubscriptionChain
 } from "./chunk-5ERIZW3D.js";
+import {
+  getSharedOverloadCounter
+} from "./chunk-PO3XB56Z.js";
 import {
   getSharedAccountHealth,
   resolveResetSeconds
-} from "./chunk-5ENKBSWO.js";
+} from "./chunk-N7OOJI5V.js";
 import {
   SubscriptionAuthSource
-} from "./chunk-HRRYG2AX.js";
+} from "./chunk-23S5OPIO.js";
 import {
   serializeError
 } from "./chunk-AVYJ4YBN.js";
+import {
+  isAccountAllowanceExhaustedError
+} from "./chunk-OPRS4IQZ.js";
+import {
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "./chunk-2JYRIADS.js";
+import {
+  executeProviderCall
+} from "./chunk-DE2SRBFZ.js";
+import {
+  LlmConfigProviderAuth,
+  getProviderHeaders
+} from "./chunk-ZY6KU6P3.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -64,15 +84,16 @@ import {
   markQuotaWarnedOnce
 } from "./chunk-3QFXFCHG.js";
 import {
+  detectModelKind,
   detectRequestRole,
   endpointToIngressFormat,
   extractRequestedModel,
   isKindMappedEndpoint,
   modelKindsForEndpoint,
   parseModelRef,
-  resolveRoute,
-  validateServerModelConfig
-} from "./chunk-UHGVBFU3.js";
+  resolvePrefixTarget,
+  resolveRoute
+} from "./chunk-EBLFCNPY.js";
 import {
   buildProviderApiUrl,
   resolveApiFormat,
@@ -80,14 +101,20 @@ import {
 } from "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-IFXJ2BG7.js";
+} from "./chunk-7C7DET6S.js";
 import {
   convertAnthropicToOpenAI,
   convertOpenAIToAnthropic
-} from "./chunk-5ZQBEOMD.js";
+} from "./chunk-5NJLQ6T6.js";
 import {
   fetchUpstream
-} from "./chunk-D3TDKWRP.js";
+} from "./chunk-RJ5ZGNI3.js";
+import {
+  getSharedAccountAllowanceStore
+} from "./chunk-MKF46GNZ.js";
+import {
+  getSharedAccountRouteActivity
+} from "./chunk-GL6XM527.js";
 import {
   applyAugmentation
 } from "./chunk-Y7FO65VT.js";
@@ -469,6 +496,66 @@ var ProviderProxyRouteMap = class {
   }
 };
 
+// src/provider-proxy/identity/claudeCodeHeaders.ts
+var DEFAULT_ANTHROPIC_VERSION = "2023-06-01";
+var OAUTH_BETA = "oauth-2025-04-20";
+var CLAUDE_CODE_BETA = "claude-code-20250219";
+var INTERLEAVED_THINKING_BETA = "interleaved-thinking-2025-05-14";
+var TOOL_STREAMING_BETA = "fine-grained-tool-streaming-2025-05-14";
+var DEFAULT_CLAUDE_CODE_HEADERS = Object.freeze({
+  "user-agent": "claude-cli/1.0.119 (external, cli)",
+  "x-app": "cli",
+  accept: "application/json",
+  "accept-language": "*",
+  "sec-fetch-mode": "cors",
+  "anthropic-dangerous-direct-browser-access": "true",
+  "x-stainless-lang": "js",
+  "x-stainless-package-version": "0.55.1",
+  "x-stainless-os": "Windows",
+  "x-stainless-arch": "x64",
+  "x-stainless-runtime": "node",
+  "x-stainless-runtime-version": "v20.19.2",
+  "x-stainless-retry-count": "0",
+  "x-stainless-timeout": "60"
+});
+var FORCED_ACCEPT_ENCODING = "identity";
+var CLAUDE_FORWARD_ALLOWLIST = /* @__PURE__ */ new Set([
+  "accept",
+  "accept-language",
+  "sec-fetch-mode",
+  "user-agent",
+  "x-app",
+  "anthropic-dangerous-direct-browser-access",
+  "anthropic-version"
+]);
+var STAINLESS_PREFIX = "x-stainless-";
+function extractClaudeClientHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    const key = rawKey.toLowerCase();
+    if (NEVER_FORWARD_HEADERS.has(key)) continue;
+    if (!CLAUDE_FORWARD_ALLOWLIST.has(key) && !key.startsWith(STAINLESS_PREFIX)) continue;
+    const value = flattenHeaderValue(rawVal);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function buildAnthropicBeta(model, callerBeta) {
+  const isHaiku = typeof model === "string" && model.toLowerCase().includes("haiku");
+  const baseline = isHaiku ? [OAUTH_BETA, INTERLEAVED_THINKING_BETA] : [CLAUDE_CODE_BETA, OAUTH_BETA, INTERLEAVED_THINKING_BETA, TOOL_STREAMING_BETA];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  const add = (flag) => {
+    const trimmed = flag.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    out.push(trimmed);
+  };
+  baseline.forEach(add);
+  if (callerBeta) callerBeta.split(",").forEach(add);
+  return out.join(",");
+}
+
 // src/provider-proxy/usage/recordAnthropicUsage.ts
 function readAnthropicUsage(usage) {
   if (!usage) return null;
@@ -486,23 +573,36 @@ function readAnthropicUsage(usage) {
     reasoningTokens: 0
   };
 }
+function emitAnthropicUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readAnthropicUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordAnthropicNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readAnthropicUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage,
-      auditResponse: attribution.auditResponse
-    });
+    emitAnthropicUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordAnthropicStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitAnthropicUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
@@ -590,7 +690,18 @@ function rewriteSseLine(line, rewriteModel) {
     return line;
   }
 }
-async function relayStreamWithModelRewrite(res, body, rewriteModel) {
+function tapSseDataLine(line, onEvent) {
+  const leadingStripped = line.replace(/^\s+/, "");
+  if (!leadingStripped.startsWith("data:")) return;
+  const payload = leadingStripped.slice(5).trim();
+  if (!payload || payload === "[DONE]") return;
+  try {
+    onEvent(JSON.parse(payload));
+  } catch {
+  }
+}
+async function relaySseBody(res, body, options) {
+  const { rewriteModel, onSseEvent } = options;
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -604,21 +715,26 @@ async function relayStreamWithModelRewrite(res, body, rewriteModel) {
       while ((nlIndex = buffer.indexOf("\n")) !== -1) {
         const linePart = buffer.slice(0, nlIndex + 1);
         buffer = buffer.slice(nlIndex + 1);
-        out += rewriteSseLine(linePart, rewriteModel);
+        if (onSseEvent) tapSseDataLine(linePart, onSseEvent);
+        out += rewriteModel ? rewriteSseLine(linePart, rewriteModel) : linePart;
       }
       if (out) res.write(out);
     }
     const tail = buffer + decoder.decode();
-    if (tail) res.write(rewriteSseLine(tail, rewriteModel));
+    if (tail) {
+      if (onSseEvent) tapSseDataLine(tail, onSseEvent);
+      res.write(rewriteModel ? rewriteSseLine(tail, rewriteModel) : tail);
+    }
   } finally {
     reader.releaseLock();
     res.end();
   }
 }
-async function relayResponse(res, providerResponse, isStream, rewriteModel) {
+async function relayResponse(res, providerResponse, isStream, rewriteModel, usageTap, onSseEvent) {
   const contentType = providerResponse.headers.get("Content-Type") ?? "";
   const status = providerResponse.status && providerResponse.status >= 100 ? providerResponse.status : 200;
-  if (isStream || contentType.includes("text/event-stream")) {
+  const upstreamIsSse = contentType.includes("text/event-stream");
+  if (upstreamIsSse || isStream && status < 400) {
     res.writeHead(status, {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
@@ -628,8 +744,19 @@ async function relayResponse(res, providerResponse, isStream, rewriteModel) {
       res.end();
       return null;
     }
-    if (rewriteModel) {
-      await relayStreamWithModelRewrite(res, providerResponse.body, rewriteModel);
+    if (rewriteModel || usageTap || onSseEvent) {
+      let capturedUsage = null;
+      await relaySseBody(res, providerResponse.body, {
+        rewriteModel,
+        onSseEvent: onSseEvent || usageTap ? (event) => {
+          onSseEvent?.(event);
+          if (usageTap) {
+            const raw = usageTap.extractUsage(event);
+            if (raw) capturedUsage = raw;
+          }
+        } : void 0
+      });
+      if (capturedUsage) usageTap.onUsage(capturedUsage);
       return null;
     }
     const reader = providerResponse.body.getReader();
@@ -745,6 +872,27 @@ function writeError(res, status, message) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: { type: "provider_proxy_error", message } }));
 }
+function writeBoundAccountError(res, error) {
+  if (res.headersSent) return;
+  const headers = { "Content-Type": "application/json" };
+  if (error.status === 429 && error.resumeAt) {
+    const resumeMs = Date.parse(error.resumeAt);
+    if (Number.isFinite(resumeMs)) {
+      headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+    }
+  }
+  res.writeHead(error.status, headers);
+  res.end(
+    JSON.stringify({
+      error: {
+        type: "provider_proxy_error",
+        code: error.code,
+        reason: error.reason,
+        message: boundAccountSelectionMessage(error.reason)
+      }
+    })
+  );
+}
 function resolveApiKey(apiKey) {
   if (!apiKey) return "";
   if (apiKey.startsWith("$")) {
@@ -752,7 +900,12 @@ function resolveApiKey(apiKey) {
   }
   return apiKey;
 }
-async function resolvePoolBoundKey(deps, providerId, provider, sessionId) {
+async function resolvePoolBoundKey(deps, providerId, provider, sessionId, preferredKeyId, boundKeyFallbackPolicy) {
+  if (preferredKeyId) {
+    const preferred = await deps.apiKeyPool?.getKeyById(providerId, preferredKeyId, sessionId);
+    if (preferred) return preferred;
+    if (boundKeyFallbackPolicy !== "pool") return "";
+  }
   if (deps.apiKeyPool && sessionId) {
     const poolKey = await deps.apiKeyPool.getKeyForSession(providerId, sessionId);
     if (poolKey) return poolKey;
@@ -807,6 +960,8 @@ function buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isS
   return {
     auth,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -881,6 +1036,8 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
     model: resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive) => {
       proxyAccountId = accountId;
       reportSelection?.(accountId, isActive);
@@ -908,7 +1065,16 @@ async function runPipeline(anthropicBody, plan, reportSelection) {
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: proxyProviderId(plan), accountId: proxyAccountId }
+        {
+          providerId: proxyProviderId(plan),
+          accountId: proxyAccountId,
+          routeActivity: plan.isSubscription ? {
+            endpoint: "messages",
+            sessionKey: plan.sessionKey,
+            sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
+            model: resolvedModel
+          } : void 0
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -927,13 +1093,16 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
     model: plan.resolvedModel,
     sessionKey: plan.sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId, isActive, remapped) => {
       proxyAccountId = accountId;
       remappedModel = remapped;
       reportSelection?.(accountId, isActive, remapped);
     }
   });
-  if (plan.isSubscription && plan.transformerProvider.name === "claude") {
+  const isClaudeSubscription = plan.isSubscription && plan.transformerProvider.name === "claude";
+  if (isClaudeSubscription) {
     applyFingerprint(
       getSharedIdentityStore(),
       headers,
@@ -942,16 +1111,36 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
       options.callerIdentity
     );
   }
+  if (isClaudeSubscription) {
+    fillMissingHeaders(headers, options.callerClientHeaders ?? {});
+    fillMissingHeaders(headers, DEFAULT_CLAUDE_CODE_HEADERS);
+  }
+  fillMissingHeaders(headers, { "anthropic-version": DEFAULT_ANTHROPIC_VERSION });
+  headers["accept-encoding"] = FORCED_ACCEPT_ENCODING;
   const applyRemap = remappedModel !== void 0 && outboundRemapApplies(plan);
   const outboundBody = applyRemap ? rewriteBodyModel(rawBody, remappedModel) : rawBody;
   const outboundModel = applyRemap ? remappedModel : plan.resolvedModel;
+  if (isClaudeSubscription) {
+    headers["anthropic-beta"] = buildAnthropicBeta(outboundModel, options.callerAnthropicBeta);
+  } else if (options.callerAnthropicBeta) {
+    fillMissingHeaders(headers, { "anthropic-beta": options.callerAnthropicBeta });
+  }
   console.info(
     `[ProviderProxy:anthropic] (subscription same-format) -> ${plan.upstreamUrl} model=${outboundModel} stream=${plan.isStream}`
   );
   const response = await fetchUpstream(
     plan.upstreamUrl,
     { method: "POST", headers, body: outboundBody },
-    { providerId: proxyProviderId(plan), accountId: proxyAccountId }
+    {
+      providerId: proxyProviderId(plan),
+      accountId: proxyAccountId,
+      routeActivity: plan.isSubscription ? {
+        endpoint: "messages",
+        sessionKey: plan.sessionKey,
+        sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
+        model: outboundModel
+      } : void 0
+    }
   );
   return { response, rawStatus: response.status };
 }
@@ -1119,6 +1308,35 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
     const upstreamSse = (upstreamResponse.headers.get("content-type") ?? "").includes(
       "text/event-stream"
     );
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "anthropic",
+      model: plan.resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    let anthropicInputUsage;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] === "message_start") {
+          const msg = event["message"];
+          const u = msg?.["usage"];
+          if (u) anthropicInputUsage = u;
+          return null;
+        }
+        if (event["type"] === "message_delta") {
+          const outputUsage = event["usage"];
+          if (!outputUsage) return null;
+          return { ...anthropicInputUsage, ...outputUsage };
+        }
+        return null;
+      },
+      onUsage(rawUsage) {
+        recordAnthropicStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
     let bodyText;
     if (!isStream && upstreamSse) {
       bodyText = await aggregateAnthropicSseToJsonBody(upstreamResponse, route.requestedModel);
@@ -1128,22 +1346,19 @@ async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {
       );
       res.end(bodyText);
     } else {
-      bodyText = await relayResponse(res, upstreamResponse, isStream, route.requestedModel);
+      bodyText = await relayResponse(res, upstreamResponse, isStream, route.requestedModel, usageTap);
     }
     if (bodyText && deps.usageRecorder) {
-      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "anthropic",
-        model: plan.resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:anthropic] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
@@ -1157,7 +1372,14 @@ async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1258,7 +1480,12 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     const callerBetaRaw = req.headers["anthropic-beta"];
     const callerAnthropicBeta = Array.isArray(callerBetaRaw) ? callerBetaRaw.join(",") : callerBetaRaw;
     const callerIdentity = captureCallerIdentity(getSharedIdentityStore(), req.headers);
-    await handleAnthropicMessagesByo(res, rawBody, route, deps, { callerAnthropicBeta, callerIdentity });
+    const callerClientHeaders = extractClaudeClientHeaders(req.headers);
+    await handleAnthropicMessagesByo(res, rawBody, route, deps, {
+      callerAnthropicBeta,
+      callerIdentity,
+      callerClientHeaders
+    });
     return;
   }
   const hints = route.anthropicSdkHints;
@@ -1270,11 +1497,31 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     writeError(res, 502, "Anthropic route is missing a providerId");
     return;
   }
+  let delegatedApiKey = hints.apiKey;
+  if (route.authMode === "byo" && route.providerId) {
+    const provider = await deps.llmConfig.getProvider(route.providerId);
+    if (!provider) {
+      writeError(res, 502, `Provider not found: ${route.providerId}`);
+      return;
+    }
+    delegatedApiKey = await resolvePoolBoundKey(
+      deps,
+      route.providerId,
+      provider,
+      route.sessionId,
+      route.preferredKeyId,
+      route.boundKeyFallbackPolicy
+    );
+    if (!delegatedApiKey) {
+      writeError(res, 502, "API key not configured");
+      return;
+    }
+  }
   const handler = handlerFactory({
     llmConfig: deps.llmConfig,
     providerId: route.providerId ?? "",
     model: route.model,
-    apiKey: hints.apiKey,
+    apiKey: delegatedApiKey,
     backgroundTaskModel: route.backgroundTaskModel,
     isOfficialProvider: hints.isOfficialProvider,
     thinkingLevel: hints.thinkingLevel,
@@ -1283,6 +1530,11 @@ async function handleAnthropicMessagesRequest(req, res, route, deps) {
     passThroughAuthToken: hints.passThroughAuthToken ?? null,
     resolvePassThroughAuthToken: hints.resolvePassThroughAuthToken ?? null,
     subscriptionProfile: hints.subscriptionProfile ?? null,
+    preferredAccountId: hints.preferredAccountId,
+    preferredAccountGroup: hints.preferredAccountGroup,
+    boundAccountFallbackPolicy: hints.boundAccountFallbackPolicy,
+    preferredKeyId: route.preferredKeyId,
+    boundKeyFallbackPolicy: route.boundKeyFallbackPolicy,
     maxConcurrency: hints.maxConcurrency,
     webSearchService: hints.webSearchService ?? null,
     onRetry: hints.onRetry,
@@ -1309,23 +1561,36 @@ function readGeminiUsage(usage) {
     reasoningTokens
   };
 }
+function emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution) {
+  const tapped = readGeminiUsage(rawUsageMetadata);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage: rawUsageMetadata
+  });
+}
 function recordGeminiNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readGeminiUsage(parsed.usageMetadata);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usageMetadata
-    });
+    emitGeminiUsageRecord(
+      recorder,
+      parsed.usageMetadata,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordGeminiStreamUsage(recorder, rawUsageMetadata, attribution) {
+  try {
+    emitGeminiUsageRecord(recorder, rawUsageMetadata, attribution);
   } catch {
   }
 }
@@ -1366,16 +1631,32 @@ async function handleGeminiGenerateContentRequest(res, rawBody, url, route, deps
     const plan = await buildByoPlan2(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = await runPipelineWithPoolReporting2(geminiBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "gemini",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return event["usageMetadata"] ?? null;
+      },
+      onUsage(rawUsage) {
+        recordGeminiStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "gemini",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
     const errMsg = serializeError(err);
@@ -1394,7 +1675,14 @@ async function buildByoPlan2(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1494,23 +1782,36 @@ function readChatCompletionsUsage(usage) {
     reasoningTokens
   };
 }
+function emitChatCompletionsUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readChatCompletionsUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordChatCompletionsNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readChatCompletionsUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
+    emitChatCompletionsUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordChatCompletionsStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitChatCompletionsUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
@@ -1538,21 +1839,41 @@ async function handleOpenAIChatRequest(res, rawBody, route, deps) {
     const plan = route.authMode === "subscription" ? await buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream) : await buildByoPlan3(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
     const providerResponse = plan.isSubscription ? await runPipelineWithSubscriptionRetry2(chatBody, plan) : await runPipelineWithPoolReporting3(chatBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "openai",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        return event["usage"] ?? null;
+      },
+      onUsage(rawUsage) {
+        recordChatCompletionsStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      void 0,
+      usageTap
+    );
     if (bodyText && deps.usageRecorder) {
-      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "openai",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:chat] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
@@ -1566,7 +1887,14 @@ async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1632,6 +1960,9 @@ async function buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream)
   };
   return {
     auth,
+    preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1650,6 +1981,9 @@ async function runPipeline3(chatBody, plan) {
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
@@ -1728,34 +2062,109 @@ function readResponsesUsage(usage) {
     reasoningTokens
   };
 }
+function emitResponsesUsageRecord(recorder, rawUsage, attribution) {
+  const tapped = readResponsesUsage(rawUsage);
+  if (!tapped) return;
+  recorder.record({
+    messageId: null,
+    parentMessageId: null,
+    sessionId: attribution.sessionId,
+    providerId: attribution.providerId,
+    model: attribution.model,
+    apiKeyId: attribution.apiKeyId,
+    cacheKeySource: attribution.cacheKeySource,
+    cacheKeyInjected: attribution.cacheKeyInjected,
+    auditResponse: attribution.auditResponse,
+    engineOrigin: "codex-ingress",
+    usage: tapped,
+    rawUsage
+  });
+}
 function recordResponsesNonStreamUsage(recorder, bodyText, attribution) {
   try {
     const parsed = JSON.parse(bodyText);
-    const tapped = readResponsesUsage(parsed.usage);
-    if (!tapped) return;
-    recorder.record({
-      messageId: null,
-      parentMessageId: null,
-      sessionId: attribution.sessionId,
-      providerId: attribution.providerId,
-      model: attribution.model,
-      apiKeyId: attribution.apiKeyId,
-      auditResponse: attribution.auditResponse,
-      engineOrigin: "codex-ingress",
-      usage: tapped,
-      rawUsage: parsed.usage
-    });
+    emitResponsesUsageRecord(
+      recorder,
+      parsed.usage,
+      attribution
+    );
+  } catch {
+  }
+}
+function recordResponsesStreamUsage(recorder, rawUsage, attribution) {
+  try {
+    emitResponsesUsageRecord(recorder, rawUsage, attribution);
   } catch {
   }
 }
 
+// src/provider-proxy/ingress/codexUsageLimitDetection.ts
+var PROVIDER_ID = "codex";
+var DEFAULT_QUOTA_COOLDOWN_MS = 5 * 6e4;
+var QUOTA_EXHAUSTED_PERCENT = 90;
+function parseTryAgainDeadline(bodyText) {
+  const match = bodyText.match(/try again (?:at|on)\s+(.+?)(?:[.\n]|$)/i);
+  if (!match) return void 0;
+  const cleaned = match[1].replace(/(\d+)(st|nd|rd|th)/giu, "$1").trim();
+  const ms = Date.parse(cleaned);
+  return Number.isFinite(ms) ? ms : void 0;
+}
+function deadlineFromAllowanceSnapshot(accountId, now) {
+  const snapshot = getSharedAccountAllowanceStore().get(PROVIDER_ID, accountId, now);
+  if (!snapshot) return void 0;
+  const candidates = snapshot.windows.filter(
+    (w) => typeof w.usedPercent === "number" && w.usedPercent >= QUOTA_EXHAUSTED_PERCENT && typeof w.resetsAt === "string"
+  ).map((w) => ({ ms: Date.parse(w.resetsAt), usedPercent: w.usedPercent })).filter((x) => Number.isFinite(x.ms) && x.ms > now).sort((a, b) => b.usedPercent - a.usedPercent);
+  return candidates[0]?.ms;
+}
+function resolveCodexQuotaDeadline(accountId, bodyText, now = Date.now()) {
+  const parsed = parseTryAgainDeadline(bodyText);
+  const parsedDeadline = parsed !== void 0 && parsed > now ? parsed : void 0;
+  return deadlineFromAllowanceSnapshot(accountId, now) ?? parsedDeadline ?? now + DEFAULT_QUOTA_COOLDOWN_MS;
+}
+function markCodexUsageLimitExhaustion(accountId, bodyText, now = Date.now()) {
+  if (!accountId) return;
+  const deadline = resolveCodexQuotaDeadline(accountId, bodyText, now);
+  getSharedAccountHealth().markQuotaExhausted(PROVIDER_ID, accountId, deadline, now);
+}
+
 // src/provider-proxy/ingress/openaiResponsesIngress.ts
+var SERVER_OVERLOADED_CODES = /* @__PURE__ */ new Set(["server_is_overloaded", "slow_down"]);
+function isCodexServerOverloadEvent(event) {
+  if (event["type"] !== "response.failed") return false;
+  const error = event["response"]?.["error"];
+  const code = error?.["code"];
+  return typeof code === "string" && SERVER_OVERLOADED_CODES.has(code);
+}
 function isOpenAIResponsesRequest(method, url) {
   if (method !== "POST" || !url) return false;
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
   return path.endsWith("/responses");
 }
-async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
+var SAFE_INJECTED_CACHE_KEY_SOURCES = /* @__PURE__ */ new Set([
+  "session-header",
+  "thread-header",
+  "body-session-id",
+  "body-thread-id",
+  "content-fingerprint"
+]);
+function isSafeInjectedCacheKeySource(source) {
+  return SAFE_INJECTED_CACHE_KEY_SOURCES.has(source);
+}
+function ensureCodexPromptCacheKey(body, proxyProviderId2, derivedSession) {
+  if (typeof body.prompt_cache_key === "string" && body.prompt_cache_key.trim()) {
+    return { cacheKeySource: "client", cacheKeyInjected: false };
+  }
+  if (proxyProviderId2 !== "codex" || !isSafeInjectedCacheKeySource(derivedSession.source)) {
+    return { cacheKeySource: "none", cacheKeyInjected: false };
+  }
+  body.prompt_cache_key = `omnicross:${derivedSession.source}:${derivedSession.key}`;
+  return {
+    cacheKeySource: derivedSession.source,
+    cacheKeyInjected: true
+  };
+}
+async function handleOpenAIResponsesRequest(res, rawBody, route, deps, requestHeaders = {}) {
   let responsesBody;
   try {
     responsesBody = JSON.parse(rawBody);
@@ -1764,27 +2173,96 @@ async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
     return;
   }
   const isStream = responsesBody.stream === true;
+  const derivedSession = deriveGatewaySessionKey(responsesBody, requestHeaders, {
+    endpoint: "responses",
+    // A verified outbound key is the strongest route-local fallback. Resident
+    // proxy callers without one still get a stable run/session bucket; the
+    // final `anonymous` fallback is handled inside the shared utility.
+    fallbackKey: route.apiKeyId ?? route.sessionId ?? void 0
+  });
+  const sessionKey = derivedSession.key;
   const resolvedModel = route.model;
   responsesBody.model = resolvedModel;
   try {
-    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan3(
+      res,
+      route,
+      deps,
+      resolvedModel,
+      isStream,
+      sessionKey,
+      derivedSession.source,
+      requestHeaders
+    ) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
     if (!plan) return;
-    const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
-    const bodyText = await relayResponse(res, providerResponse.response, isStream, route.requestedModel);
+    const cacheKeyAttribution = ensureCodexPromptCacheKey(
+      responsesBody,
+      plan.proxyProviderId,
+      derivedSession
+    );
+    let providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry3(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
+    providerResponse = await retryAroundCodexUsageLimit(responsesBody, plan, providerResponse);
+    const usageAttribution = {
+      sessionId: route.sessionId,
+      providerId: route.providerId ?? "codex",
+      model: resolvedModel,
+      apiKeyId: route.apiKeyId ?? null,
+      cacheKeySource: cacheKeyAttribution.cacheKeySource,
+      cacheKeyInjected: cacheKeyAttribution.cacheKeyInjected,
+      // request-audit-log: correlate this request's tokens/cost to its audit record.
+      auditResponse: res
+    };
+    const usageRecorder = deps.usageRecorder;
+    const usageTap = usageRecorder ? {
+      extractUsage(event) {
+        if (event["type"] !== "response.completed") return null;
+        const response = event["response"];
+        const usage = response?.["usage"];
+        return usage ?? null;
+      },
+      onUsage(rawUsage) {
+        recordResponsesStreamUsage(usageRecorder, rawUsage, usageAttribution);
+      }
+    } : void 0;
+    const overloadActivityId = providerResponse.activityRecordId;
+    const overloadAccountId = providerResponse.accountId;
+    const overloadProviderId = plan.proxyProviderId;
+    let overloadRecorded = false;
+    const overloadDetector = (event) => {
+      if (overloadRecorded || !isCodexServerOverloadEvent(event)) return;
+      overloadRecorded = true;
+      if (overloadActivityId) {
+        getSharedAccountRouteActivity().amend(overloadActivityId, {
+          streamError: "server_overloaded"
+        });
+      }
+      if (overloadAccountId) {
+        getSharedOverloadCounter().recordOverload({
+          providerId: overloadProviderId,
+          accountId: overloadAccountId,
+          endpoint: "responses"
+        });
+      }
+    };
+    const bodyText = await relayResponse(
+      res,
+      providerResponse.response,
+      isStream,
+      route.requestedModel,
+      usageTap,
+      overloadDetector
+    );
     if (bodyText && deps.usageRecorder) {
-      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, {
-        sessionId: route.sessionId,
-        providerId: route.providerId ?? "codex",
-        model: resolvedModel,
-        apiKeyId: route.apiKeyId ?? null,
-        // request-audit-log: correlate this request's tokens/cost to its audit record.
-        auditResponse: res
-      });
+      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, usageAttribution);
     }
   } catch (err) {
+    if (isBoundAccountSelectionError(err)) {
+      writeBoundAccountError(res, err);
+      return;
+    }
     const errMsg = serializeError(err);
     console.error("[ProviderProxy:responses] Pipeline error:", errMsg);
-    writeError(res, 502, errMsg);
+    writeError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, errMsg);
   }
 }
 async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
@@ -1798,7 +2276,14 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     writeError(res, 502, `Provider not found: ${providerId}`);
     return null;
   }
-  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  const apiKey = await resolvePoolBoundKey(
+    deps,
+    providerId,
+    provider,
+    route.sessionId,
+    route.preferredKeyId,
+    route.boundKeyFallbackPolicy
+  );
   if (!apiKey) {
     writeError(res, 502, "API key not configured");
     return null;
@@ -1829,7 +2314,7 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     proxyProviderId: "byo"
   };
 }
-async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) {
+async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream, sessionKey, sessionSource, requestHeaders) {
   const profile = route.subscriptionProfile;
   if (!profile) {
     writeError(res, 502, "Subscription mode requires a codex subscription profile");
@@ -1854,15 +2339,28 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
   };
   if (profile.authStrategy.providerId === "gemini") {
     try {
-      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile);
+      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile, {
+        sessionKey,
+        preferredAccountId: route.preferredAccountId,
+        preferredAccountGroup: route.preferredAccountGroup,
+        boundAccountFallbackPolicy: route.boundAccountFallbackPolicy
+      });
     } catch (err) {
+      if (isBoundAccountSelectionError(err)) {
+        writeBoundAccountError(res, err);
+        return null;
+      }
       writeError(res, 502, serializeError(err));
       return null;
     }
   }
   return {
     auth,
+    sessionKey,
+    sessionSource,
     preferredAccountId: route.preferredAccountId,
+    preferredAccountGroup: route.preferredAccountGroup,
+    boundAccountFallbackPolicy: route.boundAccountFallbackPolicy,
     chain,
     transformerProvider,
     resolvedModel,
@@ -1872,12 +2370,15 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
     // profile's `resolveUpstreamUrl` for non-Code-Assist subscriptions.
     resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : typeof config.url === "string" ? config.url : upstreamUrl,
     upstreamUrl,
-    proxyProviderId: profile.authStrategy.providerId
+    proxyProviderId: profile.authStrategy.providerId,
+    // Only the codex backend understands these; other subscription providers
+    // (gemini Code Assist) share this relay and must not receive them.
+    callerClientHeaders: profile.authStrategy.providerId === "codex" ? extractCodexClientHeaders(requestHeaders) : void 0
   };
 }
-async function resolveGeminiCodeAssistProject(profile) {
+async function resolveGeminiCodeAssistProject(profile, hints) {
   const probe = {};
-  await profile.authStrategy.applyHeaders(probe);
+  await profile.authStrategy.applyHeaders(probe, hints);
   const bearer = probe.Authorization ?? probe.authorization ?? "";
   const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
   if (!accessToken) return void 0;
@@ -1888,13 +2389,17 @@ async function resolveGeminiCodeAssistProject(profile) {
 async function runPipeline4(responsesBody, plan) {
   const executor = getSharedExecutor();
   const endpointTransformer = getResponsesEndpointTransformer();
-  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const { auth, sessionKey, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
   let proxyAccountId;
+  let activityRecordId;
   const authHeaders = {};
   await auth.applyHeaders(authHeaders, {
     upstreamUrl,
     model: resolvedModel,
+    sessionKey,
     preferredAccountId: plan.preferredAccountId,
+    preferredAccountGroup: plan.preferredAccountGroup,
+    boundAccountFallbackPolicy: plan.boundAccountFallbackPolicy,
     reportSelection: (accountId) => {
       proxyAccountId = accountId;
     }
@@ -1914,6 +2419,11 @@ async function runPipeline4(responsesBody, plan) {
           if (value !== void 0 && !(key in headers)) headers[key] = value;
         }
       }
+      if (plan.proxyProviderId === "codex") {
+        fillMissingHeaders(headers, plan.callerClientHeaders ?? {});
+        fillMissingHeaders(headers, DEFAULT_CODEX_CLI_HEADERS);
+        fillMissingHeaders(headers, { accept: codexAcceptHeader(isStream) });
+      }
       return headers;
     },
     fetchFn: (url, headers, body) => {
@@ -1921,7 +2431,19 @@ async function runPipeline4(responsesBody, plan) {
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: plan.proxyProviderId, accountId: proxyAccountId }
+        {
+          providerId: plan.proxyProviderId,
+          accountId: proxyAccountId,
+          routeActivity: plan.proxyProviderId === "byo" ? void 0 : {
+            endpoint: "responses",
+            sessionKey,
+            sessionSource: plan.sessionSource ?? "none",
+            model: resolvedModel,
+            onRecorded: (record) => {
+              activityRecordId = record.id;
+            }
+          }
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -1929,7 +2451,7 @@ async function runPipeline4(responsesBody, plan) {
     },
     runResponseChain: true
   });
-  return { response, rawStatus };
+  return { response, rawStatus, accountId: proxyAccountId, activityRecordId };
 }
 async function runPipelineWithPoolReporting4(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
@@ -1947,7 +2469,7 @@ async function runPipelineWithPoolReporting4(responsesBody, plan) {
 async function runPipelineWithSubscriptionRetry3(responsesBody, plan) {
   const first = await runPipeline4(responsesBody, plan);
   if (first.rawStatus !== 401) return first;
-  const refreshed = await plan.auth.onUnauthorized?.();
+  const refreshed = await plan.auth.onUnauthorized?.(plan.sessionKey);
   if (!refreshed) {
     console.warn("[ProviderProxy:responses] 401 not recoverable (onUnauthorized returned false)");
     return first;
@@ -1955,6 +2477,22 @@ async function runPipelineWithSubscriptionRetry3(responsesBody, plan) {
   console.log("[ProviderProxy:responses] 401 \u2192 token refreshed; retrying once");
   return runPipeline4(responsesBody, plan);
 }
+var MAX_QUOTA_RETRIES = 3;
+function isCodexAccountQuota429(plan, result) {
+  return plan.proxyProviderId === "codex" && !!result.accountId && result.rawStatus === 429;
+}
+async function retryAroundCodexUsageLimit(responsesBody, plan, first, runAttempt = runPipelineWithSubscriptionRetry3) {
+  if (!isCodexAccountQuota429(plan, first)) return first;
+  let current = first;
+  for (let attempt = 0; attempt < MAX_QUOTA_RETRIES; attempt++) {
+    const errorBody = await current.response.text().catch(() => "");
+    markCodexUsageLimitExhaustion(current.accountId, errorBody);
+    const next = await runAttempt(responsesBody, plan);
+    if (!isCodexAccountQuota429(plan, next)) return next;
+    current = next;
+  }
+  return current;
+}
 
 // src/provider-proxy/providerProxyRouter.ts
 function extractRouteToken(authHeader) {
@@ -1986,7 +2524,7 @@ async function routeRequest(req, res, routes, deps) {
   }
   if (isOpenAIResponsesRequest(method, url)) {
     const rawBody = await readBody(req);
-    await handleOpenAIResponsesRequest(res, rawBody, route, deps);
+    await handleOpenAIResponsesRequest(res, rawBody, route, deps, req.headers);
     return;
   }
   if (isOpenAIChatRequest(method, url)) {
@@ -2196,6 +2734,38 @@ var DEFAULT_ACCOUNT_PROBE = {
   historySize: 10,
   staggerMs: 500
 };
+var DEFAULT_ALLOWANCE_SCHEDULING = {
+  enabled: false,
+  demoteAtPercent: 80,
+  pauseAtPercent: 98,
+  priorityPenalty: 100
+};
+function normalizeAllowanceScheduling(raw) {
+  const value = raw?.allowanceScheduling;
+  const demoteAtPercent = clampNumber(
+    value?.demoteAtPercent,
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.demoteAtPercent
+  );
+  const requestedPause = clampNumber(
+    value?.pauseAtPercent,
+    0,
+    100,
+    DEFAULT_ALLOWANCE_SCHEDULING.pauseAtPercent
+  );
+  return {
+    enabled: value?.enabled === true,
+    demoteAtPercent,
+    pauseAtPercent: Math.max(demoteAtPercent, requestedPause),
+    priorityPenalty: Math.trunc(clampNumber(
+      value?.priorityPenalty,
+      1,
+      1e3,
+      DEFAULT_ALLOWANCE_SCHEDULING.priorityPenalty
+    ))
+  };
+}
 function normalizeAccountProbe(raw) {
   const ap = raw?.accountProbe;
   return {
@@ -2214,15 +2784,20 @@ function normalizeAudit(raw) {
   return {
     enabled: a?.enabled === true,
     captureBodies: a?.captureBodies === true,
-    maxBodyBytes: Math.trunc(
-      clampNumber(a?.maxBodyBytes, 256, 1048576, DEFAULT_AUDIT_CONFIG.maxBodyBytes)
-    ),
+    maxBodyBytes: normalizeMaxBodyBytes(a?.maxBodyBytes),
     retentionDays: Math.trunc(
       clampNumber(a?.retentionDays, 1, 365, DEFAULT_AUDIT_CONFIG.retentionDays)
     ),
     trustForwardedFor: a?.trustForwardedFor === true
   };
 }
+function normalizeMaxBodyBytes(value) {
+  if (value === -1) return -1;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    return DEFAULT_AUDIT_CONFIG.maxBodyBytes;
+  }
+  return Math.trunc(Math.min(1048576, value));
+}
 function normalizeBilling(raw) {
   const b = raw?.billing;
   const config = {
@@ -2390,7 +2965,8 @@ function normalizePrefixTargets(raw) {
 function normalizeEndpointConfig(e) {
   const endpoint = e.endpoint;
   const useSubscription = e.useSubscription === true;
-  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId : void 0;
+  const boundAccountId = typeof e.boundAccountId === "string" && e.boundAccountId.trim() !== "" ? e.boundAccountId.trim() : void 0;
+  const boundAccountFallbackPolicy = boundAccountId ? e.boundAccountFallbackPolicy === "pool" ? "pool" : "strict" : void 0;
   const boundKeyId = typeof e.boundKeyId === "string" && e.boundKeyId.trim() !== "" ? e.boundKeyId : void 0;
   let config;
   if (isKindMappedEndpoint(endpoint)) {
@@ -2420,21 +2996,186 @@ function normalizeEndpointConfig(e) {
       config.backgroundModelIds = e.backgroundModelIds;
     }
   }
-  if (boundAccountId) config.boundAccountId = boundAccountId;
+  if (boundAccountId) {
+    config.boundAccountId = boundAccountId;
+    config.boundAccountFallbackPolicy = boundAccountFallbackPolicy;
+  }
   if (boundKeyId) config.boundKeyId = boundKeyId;
   return config;
 }
+function normalizeBindingTarget(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const target = raw;
+  const providerId = typeof target.providerId === "string" ? target.providerId.trim() : "";
+  if (!providerId) return null;
+  if (target.kind === "account") {
+    const accountId = typeof target.accountId === "string" ? target.accountId.trim() : "";
+    return accountId ? { kind: "account", providerId, accountId } : null;
+  }
+  if (target.kind === "account-group") {
+    const group = typeof target.group === "string" ? target.group.trim() : "";
+    return group ? { kind: "account-group", providerId, group } : null;
+  }
+  if (target.kind === "account-pool") return { kind: "account-pool", providerId };
+  if (target.kind === "provider") {
+    const keyId = typeof target.keyId === "string" ? target.keyId.trim() : "";
+    return keyId ? { kind: "provider", providerId, keyId } : { kind: "provider", providerId };
+  }
+  return null;
+}
+function normalizeGatewayModelMappings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const mappings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const source = typeof value.source === "string" ? value.source.trim() : "";
+    const target = typeof value.target === "string" ? value.target.trim() : "";
+    if (!source || !target) continue;
+    mappings.push({ source, target });
+  }
+  return mappings;
+}
+function hasConfiguredLegacyModels(config) {
+  return Object.values(config.modelMap ?? {}).some((value) => typeof value === "string" && value.trim()) || Boolean(config.models?.some((value) => typeof value === "string" && value.trim())) || Boolean(config.defaultModel?.trim()) || Boolean(config.backgroundModel?.trim()) || Boolean(Object.values(config.prefixTargets ?? {}).some((value) => value?.trim()));
+}
+function splitModelRef(ref) {
+  if (typeof ref !== "string") return null;
+  const idx = ref.indexOf(",");
+  if (idx <= 0) return null;
+  const providerId = ref.slice(0, idx).trim();
+  const modelId = ref.slice(idx + 1).trim();
+  return providerId && modelId ? { providerId, modelId } : null;
+}
+function legacyTarget(config, providerId) {
+  if (config.useSubscription) {
+    if (config.boundAccountId) {
+      return { kind: "account", providerId, accountId: config.boundAccountId };
+    }
+    if (config.boundAccountGroup) {
+      return { kind: "account-group", providerId, group: config.boundAccountGroup };
+    }
+    return { kind: "account-pool", providerId };
+  }
+  return config.boundKeyId ? { kind: "provider", providerId, keyId: config.boundKeyId } : { kind: "provider", providerId };
+}
+function legacyEndpointToBindings(config) {
+  const fallback = config.boundAccountId && config.boundAccountFallbackPolicy === "strict" ? "fail" : "next";
+  const byProvider = /* @__PURE__ */ new Map();
+  const routeFor = (providerId) => {
+    const existing = byProvider.get(providerId);
+    if (existing) return existing;
+    const created = {
+      id: `legacy-${config.endpoint}-${providerId}`,
+      name: `${config.endpoint} \xB7 ${providerId}`,
+      enabled: true,
+      keyScope: "all",
+      endpoint: config.endpoint,
+      target: legacyTarget(config, providerId),
+      fallback,
+      modelMode: "mapped"
+    };
+    byProvider.set(providerId, created);
+    return created;
+  };
+  for (const [kind, ref] of Object.entries(config.modelMap ?? {})) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.modelMap = { ...route.modelMap, [kind]: ref };
+  }
+  for (const ref of config.models ?? []) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.models = [...route.models ?? [], ref];
+  }
+  for (const [prefix, ref] of Object.entries(config.prefixTargets ?? {})) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route.dispatchMode = "prefix";
+    route.prefixTargets = { ...route.prefixTargets, [prefix]: ref };
+  }
+  for (const [field, ref] of [
+    ["defaultModel", config.defaultModel],
+    ["backgroundModel", config.backgroundModel]
+  ]) {
+    const parsed = splitModelRef(ref);
+    if (!parsed) continue;
+    const route = routeFor(parsed.providerId);
+    route[field] = ref;
+    if (config.backgroundModelIds?.length) {
+      route.backgroundModelIds = [...config.backgroundModelIds];
+    }
+  }
+  return [...byProvider.values()];
+}
+function legacyEndpointsToBindings(endpoints) {
+  return endpoints.filter((endpoint) => hasConfiguredLegacyModels(endpoint)).flatMap((endpoint) => legacyEndpointToBindings(endpoint));
+}
+function normalizeGatewayBindings(raw) {
+  if (!Array.isArray(raw)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const bindings = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const value = entry;
+    const id = typeof value.id === "string" ? value.id.trim() : "";
+    const name = typeof value.name === "string" ? value.name.trim() : "";
+    const endpoint = value.endpoint;
+    const target = normalizeBindingTarget(value.target);
+    if (!id || seen.has(id) || !name || !ALL_ENDPOINTS.includes(endpoint) || !target) continue;
+    seen.add(id);
+    const normalizedRoute = normalizeEndpointConfig({
+      ...value,
+      endpoint,
+      useSubscription: target.kind !== "provider"
+    });
+    const apiKeyIds = Array.isArray(value.apiKeyIds) ? [...new Set(value.apiKeyIds.filter((key) => typeof key === "string" && key.trim() !== "").map((key) => key.trim()))] : [];
+    const keyScope = value.keyScope === "selected" ? "selected" : value.keyScope === "all" ? "all" : apiKeyIds.length > 0 ? "selected" : "all";
+    const modelMappings = normalizeGatewayModelMappings(value.modelMappings);
+    const modelMode = value.modelMode === "passthrough" ? "passthrough" : value.modelMode === "mapped" ? "mapped" : modelMappings.length > 0 || hasConfiguredLegacyModels(normalizedRoute) ? "mapped" : "passthrough";
+    const priority = typeof value.priority === "number" && Number.isFinite(value.priority) ? Math.max(0, Math.min(1e4, Math.round(value.priority))) : void 0;
+    const binding = {
+      id,
+      name,
+      enabled: value.enabled !== false,
+      keyScope,
+      endpoint,
+      target,
+      // Legacy `'global'` meant "yield to the removed global endpoint fallback";
+      // it now yields to the next matching route, which is the same default.
+      fallback: value.fallback === "fail" ? "fail" : "next",
+      modelMode
+    };
+    if (apiKeyIds.length > 0) binding.apiKeyIds = apiKeyIds;
+    if (modelMappings.length > 0) binding.modelMappings = modelMappings;
+    if (priority !== void 0) binding.priority = priority;
+    if (normalizedRoute.modelMap) binding.modelMap = normalizedRoute.modelMap;
+    if (normalizedRoute.models) binding.models = normalizedRoute.models;
+    if (normalizedRoute.dispatchMode) binding.dispatchMode = normalizedRoute.dispatchMode;
+    if (normalizedRoute.prefixTargets) binding.prefixTargets = normalizedRoute.prefixTargets;
+    if (normalizedRoute.defaultModel !== void 0) binding.defaultModel = normalizedRoute.defaultModel;
+    if (normalizedRoute.backgroundModel !== void 0) binding.backgroundModel = normalizedRoute.backgroundModel;
+    if (normalizedRoute.backgroundModelIds) binding.backgroundModelIds = normalizedRoute.backgroundModelIds;
+    bindings.push(binding);
+  }
+  return bindings;
+}
 function defaultServerConfig() {
   const queues = normalizeQueueSegments(void 0);
   return {
     enabled: false,
     networkBinding: false,
     endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings: [],
     port: DEFAULT_OUTBOUND_PORT,
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(void 0),
     accountProbe: normalizeAccountProbe(void 0),
+    allowanceScheduling: normalizeAllowanceScheduling(void 0),
     audit: normalizeAudit(void 0),
     billing: normalizeBilling(void 0),
     fingerprint: normalizeFingerprint(void 0),
@@ -2451,17 +3192,20 @@ function normalizeServerConfig(raw) {
     }
   }
   const queues = normalizeQueueSegments(raw);
+  const legacyEndpoints = ALL_ENDPOINTS.map((ep) => byEndpoint.get(ep) ?? defaultEndpointConfig(ep));
+  const persistedBindings = normalizeGatewayBindings(raw.bindings);
+  const bindings = persistedBindings.length > 0 ? persistedBindings : normalizeGatewayBindings(legacyEndpointsToBindings(legacyEndpoints));
   const config = {
     enabled: raw.enabled === true,
     networkBinding: raw.networkBinding === true,
-    endpoints: ALL_ENDPOINTS.map(
-      (ep) => byEndpoint.get(ep) ?? defaultEndpointConfig(ep)
-    ),
+    endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    bindings,
     port: raw.port ?? base.port,
     userMessageQueue: queues.userMessageQueue,
     concurrencyQueue: queues.concurrencyQueue,
     accountHealth: normalizeAccountHealth(raw),
     accountProbe: normalizeAccountProbe(raw),
+    allowanceScheduling: normalizeAllowanceScheduling(raw),
     audit: normalizeAudit(raw),
     billing: normalizeBilling(raw),
     fingerprint: normalizeFingerprint(raw),
@@ -2487,11 +3231,13 @@ function mergeServerConfig(current, patch) {
     enabled: patch.enabled ?? current.enabled,
     networkBinding: patch.networkBinding ?? current.networkBinding,
     endpoints: patch.endpoints ?? current.endpoints,
+    bindings: patch.bindings ?? current.bindings,
     port: patch.port ?? current.port,
     userMessageQueue: patch.userMessageQueue ?? current.userMessageQueue,
     concurrencyQueue: patch.concurrencyQueue ?? current.concurrencyQueue,
     accountHealth: patch.accountHealth ?? current.accountHealth,
     accountProbe: patch.accountProbe ?? current.accountProbe,
+    allowanceScheduling: patch.allowanceScheduling ?? current.allowanceScheduling,
     audit: patch.audit ?? current.audit,
     billing: patch.billing ?? current.billing,
     // Proxy is layer-replaced (not deep-merged): a PUT carrying `proxy` swaps the
@@ -2509,6 +3255,167 @@ function mergeServerConfig(current, patch) {
   });
 }
 
+// src/outbound-api/gatewayBindingResolver.ts
+var MESSAGE_FALLBACK_KINDS = ["sonnet", "opus", "haiku", "fable"];
+function nonBlank(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function gatewayBindingAllowsKey(binding, apiKeyId) {
+  const scope = binding.keyScope ?? (binding.apiKeyIds?.length ? "selected" : "all");
+  return scope === "all" || Boolean(binding.apiKeyIds?.includes(apiKeyId));
+}
+function wildcardMatches(pattern, value) {
+  const escaped = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`, "iu").test(value);
+}
+function resolveGatewayModelMapping(mappings, requestedModel) {
+  if (!nonBlank(requestedModel)) return void 0;
+  const wanted = requestedModel.trim();
+  const exact = (mappings ?? []).find(
+    (mapping) => nonBlank(mapping.source) && !mapping.source.includes("*") && mapping.source.trim().toLocaleLowerCase() === wanted.toLocaleLowerCase()
+  );
+  if (exact && nonBlank(exact.target)) return exact.target.trim();
+  const wildcard = (mappings ?? []).find(
+    (mapping) => nonBlank(mapping.source) && mapping.source.includes("*") && wildcardMatches(mapping.source.trim(), wanted)
+  );
+  return wildcard && nonBlank(wildcard.target) ? wildcard.target.trim() : void 0;
+}
+function routeCanServe(binding, requestedModel, role) {
+  if (binding.modelMode === "passthrough") return nonBlank(requestedModel);
+  if (binding.modelMappings?.length) {
+    return nonBlank(resolveGatewayModelMapping(binding.modelMappings, requestedModel));
+  }
+  if (isKindMappedEndpoint(binding.endpoint)) {
+    const map = binding.modelMap ?? {};
+    const kind = detectModelKind(binding.endpoint, requestedModel);
+    if (kind && nonBlank(map[kind])) return true;
+    if (binding.endpoint === "messages") {
+      return MESSAGE_FALLBACK_KINDS.some((candidate) => nonBlank(map[candidate]));
+    }
+    return nonBlank(map.codex);
+  }
+  if (binding.endpoint === "chat" && binding.dispatchMode === "prefix") {
+    return resolvePrefixTarget(binding.prefixTargets, requestedModel) !== null;
+  }
+  if (binding.endpoint === "chat") {
+    if (!requestedModel) return false;
+    const wanted = requestedModel.trim().toLowerCase();
+    return (binding.models ?? []).some((ref) => modelIdOf(ref)?.toLowerCase() === wanted);
+  }
+  return role === "background" ? nonBlank(binding.backgroundModel) : nonBlank(binding.defaultModel);
+}
+function modelIdOf(ref) {
+  if (!nonBlank(ref)) return void 0;
+  const trimmed = ref.trim();
+  const comma = trimmed.indexOf(",");
+  const modelId = comma >= 0 ? trimmed.slice(comma + 1).trim() : trimmed;
+  return modelId || void 0;
+}
+function targetProviderId(target) {
+  return target.providerId.trim();
+}
+function targetRef(target, ref) {
+  const modelId = modelIdOf(ref) ?? "";
+  return modelId ? `${targetProviderId(target)},${modelId}` : "";
+}
+function targetRefs(target, refs) {
+  return (refs ?? []).map((ref) => targetRef(target, ref)).filter(nonBlank);
+}
+function targetPrefixRefs(target, refs) {
+  if (!refs) return void 0;
+  const mapped = {};
+  for (const kind of ["claude", "gpt", "gemini"]) {
+    const ref = targetRef(target, refs[kind]);
+    if (ref) mapped[kind] = ref;
+  }
+  return mapped.claude || mapped.gpt || mapped.gemini ? mapped : void 0;
+}
+function applySingleModel(config, binding, targetModel) {
+  const ref = targetRef(binding.target, targetModel);
+  if (!ref) return;
+  if (isKindMappedEndpoint(binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      modelKindsForEndpoint(binding.endpoint).map((kind) => [kind, ref])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = [ref];
+    config.dispatchMode = "list";
+  } else {
+    config.defaultModel = ref;
+    config.backgroundModel = ref;
+  }
+}
+function gatewayBindingToEndpointConfig(binding, requestedModel) {
+  const target = binding.target;
+  const config = {
+    endpoint: binding.endpoint,
+    useSubscription: target.kind !== "provider"
+  };
+  const usesGenericModelHandling = binding.modelMode === "passthrough" || Boolean(binding.modelMappings?.length);
+  const dynamicModel = binding.modelMode === "passthrough" ? requestedModel : resolveGatewayModelMapping(binding.modelMappings, requestedModel);
+  if (usesGenericModelHandling) {
+    if (nonBlank(dynamicModel)) applySingleModel(config, binding, dynamicModel);
+  } else if (isKindMappedEndpoint(binding.endpoint)) {
+    config.modelMap = Object.fromEntries(
+      Object.entries(binding.modelMap ?? {}).map(([kind, ref]) => [kind, targetRef(target, ref)])
+    );
+  } else if (binding.endpoint === "chat") {
+    config.models = targetRefs(target, binding.models);
+    if (binding.dispatchMode === "prefix") {
+      config.dispatchMode = "prefix";
+      config.prefixTargets = targetPrefixRefs(target, binding.prefixTargets);
+    }
+  } else {
+    config.defaultModel = targetRef(target, binding.defaultModel);
+    config.backgroundModel = targetRef(target, binding.backgroundModel);
+    if (binding.backgroundModelIds) config.backgroundModelIds = [...binding.backgroundModelIds];
+  }
+  if (target.kind === "account") {
+    config.boundAccountId = target.accountId;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "account-group") {
+    config.boundAccountGroup = target.group;
+    config.boundAccountFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  } else if (target.kind === "provider" && target.keyId) {
+    config.boundKeyId = target.keyId;
+    config.boundKeyFallbackPolicy = binding.fallback === "next" ? "pool" : "strict";
+  }
+  return config;
+}
+function candidateGatewayBindings(bindings, apiKeyId, endpoint) {
+  const candidates = (bindings ?? []).filter(
+    (binding) => binding.enabled && binding.endpoint === endpoint && gatewayBindingAllowsKey(binding, apiKeyId)
+  );
+  const scopeOf = (binding) => binding.keyScope ?? (binding.apiKeyIds?.length ? "selected" : "all");
+  const scoped = candidates.filter((binding) => scopeOf(binding) === "selected");
+  const pool = scoped.length > 0 ? scoped : candidates.filter((binding) => scopeOf(binding) === "all");
+  return pool.sort(
+    (left, right) => (left.priority ?? 100) - (right.priority ?? 100) || left.id.localeCompare(right.id)
+  );
+}
+function candidateBackgroundModelIds(bindings, apiKeyId, endpoint) {
+  const ids = [
+    ...new Set(
+      candidateGatewayBindings(bindings, apiKeyId, endpoint).flatMap(
+        (binding) => binding.backgroundModelIds ?? []
+      )
+    )
+  ];
+  return ids.length > 0 ? ids : void 0;
+}
+function resolveGatewayBinding(input) {
+  const candidates = candidateGatewayBindings(input.bindings, input.apiKeyId, input.endpoint);
+  const binding = candidates.find(
+    (candidate) => candidate.fallback === "fail" || routeCanServe(candidate, input.requestedModel, input.role)
+  ) ?? candidates[0];
+  if (!binding) return { source: "none" };
+  return {
+    source: "binding",
+    binding,
+    config: gatewayBindingToEndpointConfig(binding, input.requestedModel)
+  };
+}
+
 // src/outbound-api/outboundApiKeyAuth.ts
 import { createHash, randomBytes as randomBytes2 } from "crypto";
 
@@ -2591,7 +3498,30 @@ async function createNamedKey(db, name) {
     id,
     name,
     keyHash: hashKey(secret),
-    keyPrefix: prefix
+    keyPrefix: prefix,
+    plaintext: secret
+  });
+  return {
+    id: row.id,
+    name: row.name,
+    keyPrefix: row.keyPrefix,
+    createdAt: row.createdAt,
+    plaintextOnce: secret
+  };
+}
+async function createIntegrationKey(db, name, allowedEndpoints = ["responses", "messages"]) {
+  const secret = generateSecret();
+  const id = newKeyId();
+  const prefix = keyPrefix(secret);
+  const row = await db.outboundApiKeysCreate({
+    id,
+    name,
+    keyHash: hashKey(secret),
+    keyPrefix: prefix,
+    kind: "integration",
+    allowedEndpoints: [...new Set(allowedEndpoints)],
+    loopbackOnly: true,
+    plaintext: secret
   });
   return {
     id: row.id,
@@ -2623,7 +3553,12 @@ function extractModelRestriction(row) {
   };
 }
 function toVerifiedKey(row) {
-  const key = { id: row.id };
+  const key = {
+    id: row.id,
+    kind: row.kind,
+    allowedEndpoints: row.allowedEndpoints,
+    loopbackOnly: row.loopbackOnly
+  };
   if (row.maxConcurrency !== void 0 && row.maxConcurrency !== null) {
     key.maxConcurrency = row.maxConcurrency;
   }
@@ -3267,10 +4202,10 @@ function getFallbackRedeemLimiter() {
   fallbackRedeemLimiter ??= new OutboundRateLimiter({ maxRequests: 10, windowMs: 6e4 });
   return fallbackRedeemLimiter;
 }
-function writeJsonError(res, status, message, headers = {}) {
+function writeJsonError(res, status, message, headers = {}, details = {}) {
   if (res.headersSent) return;
   res.writeHead(status, { "Content-Type": "application/json", ...headers });
-  res.end(JSON.stringify({ error: { type: "outbound_api_error", message } }));
+  res.end(JSON.stringify({ error: { type: "outbound_api_error", message, ...details } }));
 }
 function writeCostLimitError(res, scope, limitUsd, spentUsd) {
   if (res.headersSent) return;
@@ -3314,6 +4249,11 @@ function extractPresentedKey(req) {
   const g = Array.isArray(goog) ? goog[0] : goog;
   return g?.trim() || void 0;
 }
+function isLoopbackPeer(address) {
+  if (!address) return false;
+  const normalized = address.toLowerCase().split("%")[0];
+  return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.") || normalized.startsWith("::ffff:127.");
+}
 function selectEndpoint(method, url) {
   if (method !== "POST" || !url) return null;
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
@@ -3337,9 +4277,33 @@ function isModelsListRequest(url) {
   const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
   return path.endsWith("/models");
 }
-function writeChatModelsList(res, config) {
-  const chat = config.endpoints.find((e) => e.endpoint === "chat");
-  const data = (chat?.models ?? []).map((ref) => parseModelRef(ref)).filter((p) => p !== null).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
+function writeModelsList(res, config, apiKeyId, allowedEndpoints) {
+  const refs = [];
+  const endpointConfigs = [];
+  for (const endpoint of ["chat", "responses", "messages", "gemini"]) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint)) continue;
+    endpointConfigs.push(
+      ...candidateGatewayBindings(config.bindings, apiKeyId, endpoint).map(
+        (binding) => gatewayBindingToEndpointConfig(binding)
+      )
+    );
+  }
+  for (const endpoint of endpointConfigs) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint.endpoint)) continue;
+    if (endpoint.endpoint === "chat") refs.push(...endpoint.models ?? []);
+    else if (endpoint.endpoint === "messages" || endpoint.endpoint === "responses") {
+      refs.push(...Object.values(endpoint.modelMap ?? {}));
+    } else {
+      if (endpoint.defaultModel) refs.push(endpoint.defaultModel);
+      if (endpoint.backgroundModel) refs.push(endpoint.backgroundModel);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const data = refs.map((ref) => parseModelRef(ref)).filter((p) => p !== null).filter((p) => {
+    if (seen.has(p.modelId)) return false;
+    seen.add(p.modelId);
+    return true;
+  }).map((p) => ({ id: p.modelId, object: "model", owned_by: "omnicross" }));
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ object: "list", data }));
 }
@@ -3373,7 +4337,15 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
   const verified = verification.key;
   if (audit) audit.keyId = verified.id;
   if (billing) billing.keyId = verified.id;
+  if (verified.loopbackOnly && !isLoopbackPeer(req.socket?.remoteAddress)) {
+    writeJsonError(res, 403, "This integration key is restricted to loopback clients");
+    return;
+  }
   if (isRedeemRequest(req.method, req.url)) {
+    if (verified.kind === "integration") {
+      writeJsonError(res, 403, "Integration keys cannot redeem vouchers");
+      return;
+    }
     await handleVoucherRedeem(
       req,
       res,
@@ -3395,7 +4367,11 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     return;
   }
   if (req.method === "GET" && isModelsListRequest(req.url)) {
-    writeChatModelsList(res, config);
+    if (verified.allowedEndpoints && verified.allowedEndpoints.length === 0) {
+      writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+      return;
+    }
+    writeModelsList(res, config, verified.id, verified.allowedEndpoints);
     return;
   }
   const endpoint = selectEndpoint(req.method, req.url);
@@ -3403,9 +4379,12 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
     return;
   }
-  const endpointConfig = config.endpoints.find((e) => e.endpoint === endpoint);
-  if (!endpointConfig) {
-    writeJsonError(res, 503, `endpoint '${endpoint}' is not configured`);
+  if (verified.allowedEndpoints && !verified.allowedEndpoints.includes(endpoint)) {
+    writeJsonError(res, 403, "API key is not allowed to access this endpoint");
+    return;
+  }
+  if (candidateGatewayBindings(config.bindings, verified.id, endpoint).length === 0) {
+    writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
     return;
   }
   if (verified.costLimits && deps.keySpendTracker) {
@@ -3478,23 +4457,40 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const urlModel = extractGeminiModelFromUrl(req.url);
       if (urlModel) parsedBody["model"] = urlModel;
     }
-    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}` : null;
+    const requestedModel = extractRequestedModel(ingressFormat, parsedBody);
+    const role = isKindMappedEndpoint(endpoint) || endpoint === "chat" ? void 0 : detectRequestRole(ingressFormat, parsedBody, {
+      // Role detection precedes the route pick (the pick consumes the
+      // role), so the hint is the union across the candidate routes.
+      backgroundModelIds: candidateBackgroundModelIds(config.bindings, verified.id, endpoint)
+    });
+    const bindingResolution = resolveGatewayBinding({
+      bindings: config.bindings,
+      apiKeyId: verified.id,
+      endpoint,
+      requestedModel,
+      role
+    });
+    if (bindingResolution.source === "none") {
+      writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
+      return;
+    }
+    const effectiveEndpointConfig = bindingResolution.config;
+    const bindingAffinitySuffix = `:${bindingResolution.binding.id}`;
+    const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}${bindingAffinitySuffix}` : null;
     const resolved = isKindMappedEndpoint(endpoint) || endpoint === "chat" ? await resolveRoute({
-      config: endpointConfig,
+      config: effectiveEndpointConfig,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
       // Capture the ORIGINAL requested id BEFORE any downstream swap; for
       // kind-mapped endpoints it selects the kind AND is stamped onto
       // `route.requestedModel`; for chat it is matched against the list.
-      requestedModel: extractRequestedModel(ingressFormat, parsedBody),
+      requestedModel,
       // Attribution: stamp the verified named-key id onto the route.
       apiKeyId: verified.id
     }) : await resolveRoute({
-      config: endpointConfig,
-      role: detectRequestRole(ingressFormat, parsedBody, {
-        backgroundModelIds: endpointConfig.backgroundModelIds
-      }),
+      config: effectiveEndpointConfig,
+      role,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
@@ -3555,12 +4551,29 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       const replay = makeReplayRequest(req, rawBody);
       await routeRequest(replay, res, routeMap, deps.proxyDeps);
     } catch (err) {
+      if (isBoundAccountSelectionError(err)) {
+        const headers = {};
+        if (err.status === 429 && err.resumeAt) {
+          const resumeMs = Date.parse(err.resumeAt);
+          if (Number.isFinite(resumeMs)) {
+            headers["Retry-After"] = String(Math.max(1, Math.ceil((resumeMs - Date.now()) / 1e3)));
+          }
+        }
+        writeJsonError(
+          res,
+          err.status,
+          boundAccountSelectionMessage(err.reason),
+          headers,
+          { code: err.code, reason: err.reason }
+        );
+        return;
+      }
       const message = serializeError(err);
       if (deps.logger) deps.logger.error("[OutboundApi] dispatch error:", message);
       else console.error("[OutboundApi] dispatch error:", message);
       emitWebhookEvent({ kind: "server.error", at: Date.now(), message });
       if (audit) audit.error = message;
-      writeJsonError(res, 502, message);
+      writeJsonError(res, isAccountAllowanceExhaustedError(err) ? 429 : 502, message);
     } finally {
       routeMap.removeRoute(token);
       if (releaseSerial) releaseSerial();
@@ -3584,16 +4597,6 @@ function makeReplayRequest(req, rawBody) {
 var DEFAULT_OUTBOUND_PORT = 8765;
 var LOOPBACK_ADDR = "127.0.0.1";
 var LAN_ADDR = "0.0.0.0";
-var OutboundApiConfigError = class extends Error {
-  missing;
-  constructor(missing) {
-    super(
-      "Outbound API server cannot start: incomplete model-kind configuration \u2014 " + missing.map((m) => `${m.endpoint} missing [${m.missingKinds.join(", ")}]`).join("; ")
-    );
-    this.name = "OutboundApiConfigError";
-    this.missing = missing;
-  }
-};
 var OutboundApiServer = class {
   constructor(deps, onPortChange) {
     this.deps = deps;
@@ -3605,6 +4608,7 @@ var OutboundApiServer = class {
   boundPort = 0;
   boundAddr = LOOPBACK_ADDR;
   endpoints = [];
+  bindings = [];
   userMessageQueue;
   concurrencyQueue;
   voucherConfig;
@@ -3631,6 +4635,7 @@ var OutboundApiServer = class {
    */
   async applyConfig(input) {
     this.endpoints = input.endpoints;
+    this.bindings = input.bindings ?? [];
     this.userMessageQueue = input.userMessageQueue;
     this.concurrencyQueue = input.concurrencyQueue;
     this.voucherConfig = input.voucher;
@@ -3640,16 +4645,6 @@ var OutboundApiServer = class {
       await this.stop();
       return;
     }
-    const missing = validateServerModelConfig({
-      enabled: true,
-      networkBinding: input.networkBinding,
-      endpoints: input.endpoints,
-      port: input.port
-    });
-    if (missing.length > 0) {
-      await this.stop();
-      throw new OutboundApiConfigError(missing);
-    }
     const running = this.server !== null;
     const bindChanged = running && (this.boundAddr !== wantAddr || this.boundPort !== wantPort);
     if (running && !bindChanged) {
@@ -3706,6 +4701,7 @@ var OutboundApiServer = class {
       this.deps,
       {
         endpoints: this.endpoints,
+        bindings: this.bindings,
         userMessageQueue: this.userMessageQueue,
         concurrencyQueue: this.concurrencyQueue,
         voucher: this.voucherConfig
@@ -3937,7 +4933,7 @@ async function callOpenAICompletion(provider, apiKey, options, logger) {
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: false
     // For now, non-streaming only
@@ -3988,7 +4984,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
     const nonSystemMessages = options.messages.filter((m) => m.role !== "system");
     const anthropicRequest2 = {
       model: options.model,
-      max_tokens: options.maxTokens || 16384,
+      max_tokens: options.maxTokens ?? 16384,
       temperature: options.temperature,
       ...systemMessages.length > 0 ? { system: systemMessages.map((m) => m.content).join("\n\n") } : {},
       messages: nonSystemMessages.map((m) => convertMessageToAnthropic(m)),
@@ -4034,7 +5030,7 @@ async function callAnthropicCompletion(provider, apiKey, options, logger) {
       content: m.content
     })),
     // Anthropic requires max_tokens; use 16384 default if not explicitly set
-    max_tokens: options.maxTokens || 16384,
+    max_tokens: options.maxTokens ?? 16384,
     temperature: options.temperature,
     stream: false
   };
@@ -4089,7 +5085,7 @@ async function callGeminiCompletion(provider, apiKey, options, logger) {
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4158,7 +5154,7 @@ async function callOpenAIResponseCompletion(provider, apiKey, options, logger) {
     model: options.model,
     input,
     stream: false,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4223,7 +5219,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
     model: options.model,
     messages: options.messages.map((m) => convertMessageToOpenAI(m)),
     // Only set max_tokens if explicitly provided, otherwise let API use its default
-    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
     temperature: options.temperature,
     stream: true
   };
@@ -4282,7 +5278,7 @@ async function streamOpenAICompletion(provider, apiKey, options, messageId, call
 async function streamAnthropicCompletion(provider, apiKey, options, messageId, callbacks, logger) {
   const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
   const MAX_TOKENS_FOR_THINKING = 16384;
-  let effectiveMaxTokens = options.maxTokens || 16384;
+  let effectiveMaxTokens = options.maxTokens ?? 16384;
   const thinkingMaxTokens = options.thinkLevel && options.thinkLevel !== "none" ? Math.min(effectiveMaxTokens, MAX_TOKENS_FOR_THINKING) : effectiveMaxTokens;
   const thinkingConfig = options.thinkLevel && options.thinkLevel !== "none" ? buildAnthropicThinking(options.model, options.thinkLevel, thinkingMaxTokens) : void 0;
   if (thinkingConfig) {
@@ -4394,7 +5390,7 @@ async function streamGeminiCompletion(provider, apiKey, options, messageId, call
   const request = {
     contents,
     generationConfig: {
-      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.maxTokens !== void 0 ? { maxOutputTokens: options.maxTokens } : {},
       ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
     }
   };
@@ -4458,7 +5454,7 @@ async function streamOpenAIResponseCompletion(provider, apiKey, options, message
     model: options.model,
     input,
     stream: true,
-    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
     ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
   };
   if (options.thinkLevel && options.thinkLevel !== "none") {
@@ -4515,7 +5511,7 @@ import {
   getClaudeMaxTokens,
   isReasoningModel
 } from "@omnicross/contracts/thinking-config";
-async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens) {
+async function resolveEffectiveMaxTokens(llmConfig, _getProvider, logger, _providerId, _modelId, sessionMaxTokens) {
   if (sessionMaxTokens !== void 0 && sessionMaxTokens > 0) {
     logger.debug("Using session maxTokens", { sessionMaxTokens });
     return sessionMaxTokens;
@@ -4529,45 +5525,6 @@ async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, provide
   } catch (err) {
     logger.warn("Failed to get global params", err instanceof Error ? err : void 0);
   }
-  const MAX_TOKENS_CAP = 131072;
-  const provider = await getProvider(providerId);
-  if (provider) {
-    const modelConfig = provider.modelConfigs?.find((m) => m.id === modelId);
-    if (modelConfig?.maxTokens && modelConfig.maxTokens > 0) {
-      const cappedMaxTokens = Math.min(modelConfig.maxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using model config maxTokens", {
-        maxTokens: modelConfig.maxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-    if (provider.modelGroups) {
-      for (const group of provider.modelGroups) {
-        const model = group.models?.find((m) => m.id === modelId);
-        if (model?.maxTokens && model.maxTokens > 0) {
-          const cappedMaxTokens = Math.min(model.maxTokens, MAX_TOKENS_CAP);
-          logger.debug("Using modelGroup model maxTokens", {
-            maxTokens: model.maxTokens,
-            cappedMaxTokens
-          });
-          return cappedMaxTokens;
-        }
-      }
-    }
-  }
-  try {
-    const discoveredMaxTokens = await llmConfig.getDiscoveredModelMaxTokens(providerId, modelId);
-    if (discoveredMaxTokens && discoveredMaxTokens > 0) {
-      const cappedMaxTokens = Math.min(discoveredMaxTokens, MAX_TOKENS_CAP);
-      logger.debug("Using discovered model maxTokens", {
-        discoveredMaxTokens,
-        cappedMaxTokens
-      });
-      return cappedMaxTokens;
-    }
-  } catch (err) {
-    logger.warn("Failed to get discovered model maxTokens", err instanceof Error ? err : void 0);
-  }
   logger.debug("No maxTokens configured, returning undefined");
   return void 0;
 }
@@ -4670,7 +5627,8 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
     }
     requestBody = {
       contents,
-      tools: options.tools
+      tools: options.tools,
+      ...options.maxTokens !== void 0 ? { generationConfig: { maxOutputTokens: options.maxTokens } } : {}
     };
     url = buildProviderApiUrl(provider, { model: actualModel, stream: true });
   } else if (apiFormat === "anthropic") {
@@ -4680,7 +5638,10 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      // Native Anthropic Messages requires this field. Resolve an absent
+      // caller cap to the model's real ceiling rather than a small constant —
+      // see `resolveAnthropicMaxTokens`.
+      max_tokens: resolveAnthropicMaxTokens(actualModel, options.maxTokens),
       temperature: options.temperature ?? 0.7,
       stream: true,
       tools: options.tools
@@ -4697,7 +5658,7 @@ function buildToolRequest(apiFormat, conversationMessages, actualModel, options,
         role: m.role,
         content: m.content
       })),
-      max_tokens: options.maxTokens || 4096,
+      ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
       temperature: options.temperature ?? 0.7,
       stream: true,
       tools: options.tools
@@ -5194,6 +6155,18 @@ function getSharedExecutor2() {
 async function resolveChainWithMain(llmConfig, providerId, model) {
   return resolveProviderChain(llmConfig, providerId, model);
 }
+function buildUnifiedCompletionRequest(actualModel, options, stream) {
+  return {
+    model: actualModel,
+    messages: options.messages.map((m) => ({
+      role: m.role,
+      content: m.content
+    })),
+    ...options.maxTokens !== void 0 ? { max_tokens: options.maxTokens } : {},
+    temperature: options.temperature,
+    stream
+  };
+}
 async function completeWithTransformers(options, llmConfig, getProvider, resolveApiKey2, completeFallback, logger, recording) {
   try {
     const routedInfo = await llmConfig.resolveRoutedModel(
@@ -5222,16 +6195,11 @@ async function completeWithTransformers(options, llmConfig, getProvider, resolve
     if (!hasTransformers) {
       return completeFallback(options);
     }
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: options.stream ?? false
-    };
+    const unifiedRequest = buildUnifiedCompletionRequest(
+      actualModel,
+      options,
+      options.stream ?? false
+    );
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5361,16 +6329,7 @@ async function completeStreamWithTransformers(options, callbacks, llmConfig, get
     }
     const messageId = `msg_${Date.now()}`;
     callbacks.onStart?.(messageId);
-    const unifiedRequest = {
-      model: actualModel,
-      messages: options.messages.map((m) => ({
-        role: m.role,
-        content: m.content
-      })),
-      max_tokens: options.maxTokens || 4096,
-      temperature: options.temperature,
-      stream: true
-    };
+    const unifiedRequest = buildUnifiedCompletionRequest(actualModel, options, true);
     const transformerProvider = {
       name: provider.name,
       baseUrl: provider.api_base_url,
@@ -5905,9 +6864,10 @@ ${description}`;
    * Resolve effective max_tokens value with priority:
    * 1. Session settings (if provided)
    * 2. Global model parameters (if enabled)
-   * 3. Model's maxTokens from provider config
-   * 4. Discovered models cache (from API)
-   * 5. undefined - let API use its default
+   * 3. undefined - let API use its default
+   *
+   * Provider and discovery maxTokens values are capability metadata, not
+   * implicit per-request output limits.
    */
   async resolveEffectiveMaxTokens(providerId, modelId, sessionMaxTokens) {
     return resolveEffectiveMaxTokens(
@@ -6020,6 +6980,7 @@ export {
   relayResponse,
   aggregateAnthropicSseToJsonBody,
   writeError,
+  writeBoundAccountError,
   resolvePoolBoundKey,
   extractRouteToken,
   isLoopbackAddress,
@@ -6031,6 +6992,8 @@ export {
   DEFAULT_USER_MESSAGE_QUEUE,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
+  normalizeAllowanceScheduling,
   normalizeAccountProbe,
   normalizeAudit,
   normalizeBilling,
@@ -6043,16 +7006,23 @@ export {
   normalizeWebhookSegment,
   normalizeQueueSegments,
   normalizePrefixTargets,
+  legacyEndpointsToBindings,
+  normalizeGatewayBindings,
   defaultServerConfig,
   normalizeServerConfig,
   loadServerConfig,
   saveServerConfig,
   mergeServerConfig,
+  gatewayBindingToEndpointConfig,
+  candidateGatewayBindings,
+  candidateBackgroundModelIds,
+  resolveGatewayBinding,
   computeKeyExpiry,
   checkKeyQuota,
   randomBase62,
   hashKey,
   createNamedKey,
+  createIntegrationKey,
   verifyKey,
   verifyPresentedKey,
   ConcurrencyQueueFullError,
@@ -6074,7 +7044,6 @@ export {
   isRedeemRequest,
   handleVoucherRedeem,
   DEFAULT_OUTBOUND_PORT,
-  OutboundApiConfigError,
   OutboundApiServer,
   formatUrls,
   startOfLocalDay,