@omnicross/core 0.1.6 → 0.1.7

package/dist/provider-proxy/matchText.js

@@ -5,7 +5,7 @@ import {
   deriveGatewaySessionKey,
   deriveSubscriptionSessionKey,
   flattenMatchText
-} from "../chunk-WB6PH56J.js";
+} from "../chunk-GFIZ6LQI.js";
 export {
   MATCH_TEXT_PER_MESSAGE_CAP,
   MATCH_TEXT_RECENT_MESSAGES,

package/dist/provider-proxy/types.d.cts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { ThinkLevel } from '@omnicross/contracts/completion-types';
+import { UsageCacheKeySource } from '@omnicross/contracts/usage-stats-types';
 import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
@@ -458,6 +459,10 @@ interface UsageRecordImportInput {
     rawUsage?: unknown;
     runId?: string | null;
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
      * relay taps set this to the request's `http.ServerResponse` so the recorder can

package/dist/provider-proxy/types.d.ts

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import { ThinkLevel } from '@omnicross/contracts/completion-types';
+import { UsageCacheKeySource } from '@omnicross/contracts/usage-stats-types';
 import { SubscriptionProviderId, OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
@@ -458,6 +459,10 @@ interface UsageRecordImportInput {
     rawUsage?: unknown;
     runId?: string | null;
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log) — the outbound
      * relay taps set this to the request's `http.ServerResponse` so the recorder can

package/dist/provider-proxy.cjs

@@ -5,34 +5,37 @@
 
 
 
-var _chunkSQYVORNPcjs = require('./chunk-SQYVORNP.cjs');
-require('./chunk-EJLH6NFT.cjs');
+var _chunk4BB343BIcjs = require('./chunk-4BB343BI.cjs');
 require('./chunk-HQP3K7PU.cjs');
 require('./chunk-FZ46M34D.cjs');
-require('./chunk-IIRPUVPH.cjs');
-require('./chunk-GBHYAGX3.cjs');
-require('./chunk-3OPYJG76.cjs');
-require('./chunk-7AK7B36B.cjs');
+require('./chunk-2Z4XM3H5.cjs');
+require('./chunk-OXHNSZ53.cjs');
 require('./chunk-V4TXMEJS.cjs');
-require('./chunk-6VUQPOV3.cjs');
+require('./chunk-OVQBNVSV.cjs');
+require('./chunk-5RSZYQJH.cjs');
 require('./chunk-OF3BECU2.cjs');
-require('./chunk-4VLRHHFE.cjs');
 require('./chunk-EYZYXJTJ.cjs');
-require('./chunk-DLXZEZWO.cjs');
-require('./chunk-SNYBEXLB.cjs');
-require('./chunk-R3HK6R4B.cjs');
+require('./chunk-2E42SAW3.cjs');
+require('./chunk-OJGQKHN5.cjs');
+require('./chunk-IIRPUVPH.cjs');
+require('./chunk-GBHYAGX3.cjs');
+require('./chunk-3OPYJG76.cjs');
+require('./chunk-3SCOLIPT.cjs');
 require('./chunk-RPII3E6Z.cjs');
 require('./chunk-6RPZADX3.cjs');
+require('./chunk-J3QQ6JS5.cjs');
+require('./chunk-UIBD2YY5.cjs');
+require('./chunk-R3HK6R4B.cjs');
+require('./chunk-QXD4MV2X.cjs');
 require('./chunk-NYUNU75A.cjs');
-require('./chunk-YK57NMIF.cjs');
+require('./chunk-OTZC4TNH.cjs');
+require('./chunk-YWL7YZWS.cjs');
 require('./chunk-YNJNTCSQ.cjs');
 require('./chunk-SVNDB62D.cjs');
-require('./chunk-UIBD2YY5.cjs');
 require('./chunk-6QQG7YG3.cjs');
 require('./chunk-25GXJCEZ.cjs');
 require('./chunk-MUHWHQVM.cjs');
 require('./chunk-Q27JY5RG.cjs');
-require('./chunk-QXD4MV2X.cjs');
 require('./chunk-APYG5QD7.cjs');
 require('./chunk-L74VDN4A.cjs');
 require('./chunk-4YINUUKQ.cjs');
@@ -40,16 +43,17 @@ require('./chunk-4VZX5F4T.cjs');
 require('./chunk-QBZJ7P2T.cjs');
 require('./chunk-4IH4EL7M.cjs');
 require('./chunk-A2YMUCBT.cjs');
-require('./chunk-UNWKG6EI.cjs');
+require('./chunk-XPIOJQS2.cjs');
 require('./chunk-FCR77GYM.cjs');
 require('./chunk-AEOZIDEB.cjs');
 require('./chunk-XSVNC2UD.cjs');
-require('./chunk-WYTEQ4Q5.cjs');
+require('./chunk-GDIXXKF2.cjs');
 require('./chunk-OKMJLEXX.cjs');
 require('./chunk-KBM2W6UY.cjs');
-require('./chunk-KCVJWJST.cjs');
-require('./chunk-3Z5BQZFM.cjs');
+require('./chunk-RJUONLUQ.cjs');
+require('./chunk-235MXAGX.cjs');
 require('./chunk-HVBBDBS3.cjs');
+require('./chunk-NKVZ6Z3Y.cjs');
 require('./chunk-NZYN7C3P.cjs');
 require('./chunk-JMJBSACD.cjs');
 require('./chunk-GMMT7RVN.cjs');
@@ -61,4 +65,4 @@ require('./chunk-UNEFIWXI.cjs');
 
 
 
-exports.DEFAULT_ROUTE_IDLE_MS = _chunkSQYVORNPcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunkSQYVORNPcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunkSQYVORNPcjs.ProviderProxyRouteMap; exports.__resetProviderProxyForTests = _chunkSQYVORNPcjs.__resetProviderProxyForTests; exports.extractRouteToken = _chunkSQYVORNPcjs.extractRouteToken; exports.getProviderProxy = _chunkSQYVORNPcjs.getProviderProxy;
+exports.DEFAULT_ROUTE_IDLE_MS = _chunk4BB343BIcjs.DEFAULT_ROUTE_IDLE_MS; exports.ProviderProxy = _chunk4BB343BIcjs.ProviderProxy; exports.ProviderProxyRouteMap = _chunk4BB343BIcjs.ProviderProxyRouteMap; exports.__resetProviderProxyForTests = _chunk4BB343BIcjs.__resetProviderProxyForTests; exports.extractRouteToken = _chunk4BB343BIcjs.extractRouteToken; exports.getProviderProxy = _chunk4BB343BIcjs.getProviderProxy;

package/dist/provider-proxy.d.cts

@@ -4,6 +4,7 @@ import { ProviderProxyDeps } from './provider-proxy/types.cjs';
 export { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat } from './provider-proxy/types.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import './completion/ApiKeyPoolService.cjs';

package/dist/provider-proxy.d.ts

@@ -4,6 +4,7 @@ import { ProviderProxyDeps } from './provider-proxy/types.js';
 export { AnthropicIngressHandler, AnthropicIngressHandlerFactory, AnthropicRouteHandlerParams, AnthropicSdkHints, ExtendedContextHint, IngressFormat, ProxyAttribution, RetryCallback, RouteAuthMode, RouteContext, StreamEventCallback, SubscriptionDispatchProfile, SubscriptionRequestSummary, TargetProviderFormat } from './provider-proxy/types.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import './completion/ApiKeyPoolService.js';

package/dist/provider-proxy.js

@@ -5,34 +5,37 @@ import {
   __resetProviderProxyForTests,
   extractRouteToken,
   getProviderProxy
-} from "./chunk-UDCC7EMR.js";
-import "./chunk-WB6PH56J.js";
+} from "./chunk-E3COOKUP.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
-import "./chunk-WNKWAEUR.js";
-import "./chunk-MZNPGW5Q.js";
-import "./chunk-DK4A7DLE.js";
-import "./chunk-VRFBB5DB.js";
+import "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
 import "./chunk-LVUCAWMK.js";
-import "./chunk-OEWZUX4G.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
 import "./chunk-LB6EBS6Y.js";
-import "./chunk-6CL5HTPQ.js";
 import "./chunk-7VU7V2E4.js";
-import "./chunk-UX7VWA46.js";
-import "./chunk-BPKCU575.js";
-import "./chunk-DRWHTIIZ.js";
+import "./chunk-FXR6N3SR.js";
+import "./chunk-SOO562NM.js";
+import "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
+import "./chunk-DK4A7DLE.js";
+import "./chunk-XXFYLL7R.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
+import "./chunk-GFIZ6LQI.js";
+import "./chunk-OE6TDIWW.js";
+import "./chunk-DRWHTIIZ.js";
+import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
-import "./chunk-YJVHCHQX.js";
+import "./chunk-PO3XB56Z.js";
+import "./chunk-N7OOJI5V.js";
 import "./chunk-23S5OPIO.js";
 import "./chunk-AVYJ4YBN.js";
-import "./chunk-OE6TDIWW.js";
 import "./chunk-OPRS4IQZ.js";
 import "./chunk-2JYRIADS.js";
 import "./chunk-DE2SRBFZ.js";
 import "./chunk-ZY6KU6P3.js";
-import "./chunk-JWC6APFQ.js";
 import "./chunk-WLYIIEAF.js";
 import "./chunk-TKJMZBAH.js";
 import "./chunk-3QFXFCHG.js";
@@ -40,16 +43,17 @@ import "./chunk-EBLFCNPY.js";
 import "./chunk-AQ5TNQB7.js";
 import "./chunk-XEKD23J5.js";
 import "./chunk-H5JUT3KV.js";
-import "./chunk-IFXJ2BG7.js";
+import "./chunk-7C7DET6S.js";
 import "./chunk-K5NM7VAH.js";
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
-import "./chunk-AT7B7SOZ.js";
+import "./chunk-5NJLQ6T6.js";
 import "./chunk-N5T4M4GU.js";
 import "./chunk-TOVPMMHM.js";
-import "./chunk-SIZQQD6T.js";
-import "./chunk-SYQF7OIR.js";
+import "./chunk-RJ5ZGNI3.js";
+import "./chunk-3WD4HTR2.js";
 import "./chunk-MKF46GNZ.js";
+import "./chunk-GL6XM527.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";

package/dist/{routeResolver-CHTv_Bs5.d.ts → routeResolver-BxOfunbm.d.ts}

@@ -1,6 +1,6 @@
 import { ProviderConfigSource } from './ports/provider-config-source.js';
 import { IngressFormat, RouteContext } from './provider-proxy/types.js';
-import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-hsoKrVQS.js';
+import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-CqZD77rS.js';
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 
 /**

package/dist/{routeResolver-kepxnfcC.d.cts → routeResolver-D5OzD0iM.d.cts}

@@ -1,6 +1,6 @@
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
 import { IngressFormat, RouteContext } from './provider-proxy/types.cjs';
-import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-H3wGZSOo.cjs';
+import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-gjJ5lJ5n.cjs';
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 
 /**

package/dist/transformer/transformers/AnthropicTransformer.cjs

@@ -1,6 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunk4VLRHHFEcjs = require('../../chunk-4VLRHHFE.cjs');
+var _chunkOXHNSZ53cjs = require('../../chunk-OXHNSZ53.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 
 
-exports.AnthropicTransformer = _chunk4VLRHHFEcjs.AnthropicTransformer;
+exports.AnthropicTransformer = _chunkOXHNSZ53cjs.AnthropicTransformer;

package/dist/transformer/transformers/AnthropicTransformer.js

@@ -1,6 +1,7 @@
 import {
   AnthropicTransformer
-} from "../../chunk-6CL5HTPQ.js";
+} from "../../chunk-PEGTIPB3.js";
+import "../../chunk-FU7EAR73.js";
 export {
   AnthropicTransformer
 };

package/dist/transformer/transformers/OpenAIResponseTransformer.cjs

@@ -1,6 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunk6VUQPOV3cjs = require('../../chunk-6VUQPOV3.cjs');
+var _chunkOVQBNVSVcjs = require('../../chunk-OVQBNVSV.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 
 
-exports.OpenAIResponseTransformer = _chunk6VUQPOV3cjs.OpenAIResponseTransformer;
+exports.OpenAIResponseTransformer = _chunkOVQBNVSVcjs.OpenAIResponseTransformer;

package/dist/transformer/transformers/OpenAIResponseTransformer.js

@@ -1,6 +1,7 @@
 import {
   OpenAIResponseTransformer
-} from "../../chunk-OEWZUX4G.js";
+} from "../../chunk-32O35CIF.js";
+import "../../chunk-FU7EAR73.js";
 export {
   OpenAIResponseTransformer
 };

package/dist/transformer/transformers.cjs

@@ -3,19 +3,20 @@
 
 
 
-var _chunk7AK7B36Bcjs = require('../chunk-7AK7B36B.cjs');
+var _chunk2Z4XM3H5cjs = require('../chunk-2Z4XM3H5.cjs');
 
 
-var _chunkV4TXMEJScjs = require('../chunk-V4TXMEJS.cjs');
+var _chunkOXHNSZ53cjs = require('../chunk-OXHNSZ53.cjs');
 
 
-var _chunk6VUQPOV3cjs = require('../chunk-6VUQPOV3.cjs');
+var _chunkV4TXMEJScjs = require('../chunk-V4TXMEJS.cjs');
 
 
-var _chunkOF3BECU2cjs = require('../chunk-OF3BECU2.cjs');
+var _chunkOVQBNVSVcjs = require('../chunk-OVQBNVSV.cjs');
+require('../chunk-5RSZYQJH.cjs');
 
 
-var _chunk4VLRHHFEcjs = require('../chunk-4VLRHHFE.cjs');
+var _chunkOF3BECU2cjs = require('../chunk-OF3BECU2.cjs');
 
 
 var _chunkOKMJLEXXcjs = require('../chunk-OKMJLEXX.cjs');
@@ -30,4 +31,4 @@ require('../chunk-KBM2W6UY.cjs');
 
 
 
-exports.AnthropicTransformer = _chunk4VLRHHFEcjs.AnthropicTransformer; exports.BUILTIN_TRANSFORMER_NAMES = _chunk7AK7B36Bcjs.BUILTIN_TRANSFORMER_NAMES; exports.BuiltinTransformers = _chunk7AK7B36Bcjs.BuiltinTransformers; exports.GeminiCodeAssistTransformer = _chunkOKMJLEXXcjs.GeminiCodeAssistTransformer; exports.GeminiTransformer = _chunkV4TXMEJScjs.GeminiTransformer; exports.OpenAIResponseTransformer = _chunk6VUQPOV3cjs.OpenAIResponseTransformer; exports.OpenAITransformer = _chunkOF3BECU2cjs.OpenAITransformer; exports.getBuiltinTransformers = _chunk7AK7B36Bcjs.getBuiltinTransformers; exports.registerBuiltinTransformers = _chunk7AK7B36Bcjs.registerBuiltinTransformers;
+exports.AnthropicTransformer = _chunkOXHNSZ53cjs.AnthropicTransformer; exports.BUILTIN_TRANSFORMER_NAMES = _chunk2Z4XM3H5cjs.BUILTIN_TRANSFORMER_NAMES; exports.BuiltinTransformers = _chunk2Z4XM3H5cjs.BuiltinTransformers; exports.GeminiCodeAssistTransformer = _chunkOKMJLEXXcjs.GeminiCodeAssistTransformer; exports.GeminiTransformer = _chunkV4TXMEJScjs.GeminiTransformer; exports.OpenAIResponseTransformer = _chunkOVQBNVSVcjs.OpenAIResponseTransformer; exports.OpenAITransformer = _chunkOF3BECU2cjs.OpenAITransformer; exports.getBuiltinTransformers = _chunk2Z4XM3H5cjs.getBuiltinTransformers; exports.registerBuiltinTransformers = _chunk2Z4XM3H5cjs.registerBuiltinTransformers;

package/dist/transformer/transformers.js

@@ -3,19 +3,20 @@ import {
   BuiltinTransformers,
   getBuiltinTransformers,
   registerBuiltinTransformers
-} from "../chunk-VRFBB5DB.js";
+} from "../chunk-MYYR3HZL.js";
+import {
+  AnthropicTransformer
+} from "../chunk-PEGTIPB3.js";
 import {
   GeminiTransformer
 } from "../chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "../chunk-OEWZUX4G.js";
+} from "../chunk-32O35CIF.js";
+import "../chunk-FU7EAR73.js";
 import {
   OpenAITransformer
 } from "../chunk-LB6EBS6Y.js";
-import {
-  AnthropicTransformer
-} from "../chunk-6CL5HTPQ.js";
 import {
   GeminiCodeAssistTransformer
 } from "../chunk-N5T4M4GU.js";

package/dist/transformer.cjs

@@ -1,22 +1,23 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-FZ46M34D.cjs');
 
 
+var _chunk2Z4XM3H5cjs = require('./chunk-2Z4XM3H5.cjs');
+require('./chunk-OXHNSZ53.cjs');
+require('./chunk-V4TXMEJS.cjs');
+require('./chunk-OVQBNVSV.cjs');
+require('./chunk-5RSZYQJH.cjs');
+require('./chunk-OF3BECU2.cjs');
+
+
 var _chunkIIRPUVPHcjs = require('./chunk-IIRPUVPH.cjs');
 require('./chunk-GBHYAGX3.cjs');
 
 
 var _chunk3OPYJG76cjs = require('./chunk-3OPYJG76.cjs');
-
-
-var _chunk7AK7B36Bcjs = require('./chunk-7AK7B36B.cjs');
-require('./chunk-V4TXMEJS.cjs');
-require('./chunk-6VUQPOV3.cjs');
-require('./chunk-OF3BECU2.cjs');
-require('./chunk-4VLRHHFE.cjs');
 require('./chunk-OKMJLEXX.cjs');
 require('./chunk-KBM2W6UY.cjs');
 
 
 
 
-exports.TransformerChainExecutor = _chunkIIRPUVPHcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunk7AK7B36Bcjs.registerBuiltinTransformers;
+exports.TransformerChainExecutor = _chunkIIRPUVPHcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunk2Z4XM3H5cjs.registerBuiltinTransformers;

package/dist/transformer.js

@@ -1,4 +1,12 @@
 import "./chunk-46RLHI7D.js";
+import {
+  registerBuiltinTransformers
+} from "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
+import "./chunk-LB6EBS6Y.js";
 import {
   TransformerChainExecutor
 } from "./chunk-WNKWAEUR.js";
@@ -6,13 +14,6 @@ import "./chunk-MZNPGW5Q.js";
 import {
   TransformerService
 } from "./chunk-DK4A7DLE.js";
-import {
-  registerBuiltinTransformers
-} from "./chunk-VRFBB5DB.js";
-import "./chunk-LVUCAWMK.js";
-import "./chunk-OEWZUX4G.js";
-import "./chunk-LB6EBS6Y.js";
-import "./chunk-6CL5HTPQ.js";
 import "./chunk-N5T4M4GU.js";
 import "./chunk-TOVPMMHM.js";
 export {

package/dist/{types-hsoKrVQS.d.ts → types-CqZD77rS.d.ts}

@@ -654,6 +654,13 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -751,6 +758,15 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -803,6 +819,14 @@ interface OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: OutboundEndpoint[];
         loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -830,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident

package/dist/{types-H3wGZSOo.d.cts → types-gjJ5lJ5n.d.cts}

@@ -654,6 +654,13 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -751,6 +758,15 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -803,6 +819,14 @@ interface OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: OutboundEndpoint[];
         loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -830,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident

package/dist/usage/pricing-engine.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkDLXZEZWOcjs = require('../chunk-DLXZEZWO.cjs');
+var _chunk2E42SAW3cjs = require('../chunk-2E42SAW3.cjs');
 
 
-exports.PricingEngine = _chunkDLXZEZWOcjs.PricingEngine;
+exports.PricingEngine = _chunk2E42SAW3cjs.PricingEngine;

package/dist/usage/pricing-engine.d.cts

@@ -50,6 +50,15 @@ declare class PricingEngine {
      * non-wildcard entry per model wins.
      */
     private cacheByModel;
+    /**
+     * Last-resort fuzzy index: `[normalizedModelId, entry]` pairs over the same
+     * non-wildcard, non-openrouter rows as `cacheByModel`. Used when even the
+     * model-name fallback misses — e.g. usage recorded under a bare model id
+     * (`glm-5.2`) while the catalog only knows prefixed slugs
+     * (`cloudflare/@cf/zai-org/glm-5.2`). This is an ESTIMATE: the matched row
+     * may be an aggregate-route price rather than the direct-vendor rate.
+     */
+    private fuzzyEntries;
     private cacheLoaded;
     /** Coalesce manual and background refreshes to prevent a catalog stampede. */
     private refreshInFlight;
@@ -65,8 +74,19 @@ declare class PricingEngine {
      *   2. wildcard provider ('*', modelId)
      *   3. model name alone (any provider) — tolerates a runtime-alias vs
      *      canonical provider-id mismatch for the same model.
+     *   4. normalized fuzzy match (last resort) — matches a bare id like
+     *      `glm-5.2` against prefixed catalog slugs like
+     *      `cloudflare/@cf/zai-org/glm-5.2`. ESTIMATE only: the matched row may
+     *      be an aggregate-route price, not the direct-vendor rate.
      */
     getEntry(providerId: string, modelId: string): Promise<PricingEntry | null>;
+    /**
+     * Normalized substring match over the catalog's non-openrouter rows. Lowercases
+     * and strips all non-alphanumerics, then matches bidirectionally, preferring
+     * the shortest catalog key (tightest match) to reduce over-matching version
+     * variants. Returns null when nothing matches.
+     */
+    private fuzzyMatch;
     /**
      * Compute the cost (and cache savings) for a single response.
      *

package/dist/usage/pricing-engine.d.ts

@@ -50,6 +50,15 @@ declare class PricingEngine {
      * non-wildcard entry per model wins.
      */
     private cacheByModel;
+    /**
+     * Last-resort fuzzy index: `[normalizedModelId, entry]` pairs over the same
+     * non-wildcard, non-openrouter rows as `cacheByModel`. Used when even the
+     * model-name fallback misses — e.g. usage recorded under a bare model id
+     * (`glm-5.2`) while the catalog only knows prefixed slugs
+     * (`cloudflare/@cf/zai-org/glm-5.2`). This is an ESTIMATE: the matched row
+     * may be an aggregate-route price rather than the direct-vendor rate.
+     */
+    private fuzzyEntries;
     private cacheLoaded;
     /** Coalesce manual and background refreshes to prevent a catalog stampede. */
     private refreshInFlight;
@@ -65,8 +74,19 @@ declare class PricingEngine {
      *   2. wildcard provider ('*', modelId)
      *   3. model name alone (any provider) — tolerates a runtime-alias vs
      *      canonical provider-id mismatch for the same model.
+     *   4. normalized fuzzy match (last resort) — matches a bare id like
+     *      `glm-5.2` against prefixed catalog slugs like
+     *      `cloudflare/@cf/zai-org/glm-5.2`. ESTIMATE only: the matched row may
+     *      be an aggregate-route price, not the direct-vendor rate.
      */
     getEntry(providerId: string, modelId: string): Promise<PricingEntry | null>;
+    /**
+     * Normalized substring match over the catalog's non-openrouter rows. Lowercases
+     * and strips all non-alphanumerics, then matches bidirectionally, preferring
+     * the shortest catalog key (tightest match) to reduce over-matching version
+     * variants. Returns null when nothing matches.
+     */
+    private fuzzyMatch;
     /**
      * Compute the cost (and cache savings) for a single response.
      *

package/dist/usage/pricing-engine.js

@@ -1,6 +1,6 @@
 import {
   PricingEngine
-} from "../chunk-UX7VWA46.js";
+} from "../chunk-FXR6N3SR.js";
 export {
   PricingEngine
 };

package/dist/usage/usage-recorder.cjs

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkSNYBEXLBcjs = require('../chunk-SNYBEXLB.cjs');
+var _chunkOJGQKHN5cjs = require('../chunk-OJGQKHN5.cjs');
 require('../chunk-XSVNC2UD.cjs');
 
 
-exports.UsageRecorder = _chunkSNYBEXLBcjs.UsageRecorder;
+exports.UsageRecorder = _chunkOJGQKHN5cjs.UsageRecorder;