@omnicross/core 0.1.6 → 0.1.8

package/dist/provider-proxy.js

@@ -2,37 +2,68 @@ import {
   DEFAULT_ROUTE_IDLE_MS,
   ProviderProxy,
   ProviderProxyRouteMap,
+  ROUTE_LEASE_API_VERSION,
+  ROUTE_LEASE_CAPABILITIES,
+  ROUTE_LEASE_CAPABILITIES_SCHEMA,
+  ROUTE_LEASE_CODEX_TOKEN_ENV,
+  ROUTE_LEASE_DEFAULT_TTL_SECONDS,
+  ROUTE_LEASE_MAX_CONSUMER_BYTES,
+  ROUTE_LEASE_MAX_EXECUTION_ID_BYTES,
+  ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES,
+  ROUTE_LEASE_MAX_MODEL_BYTES,
+  ROUTE_LEASE_MAX_SESSION_ID_BYTES,
+  ROUTE_LEASE_MAX_TTL_SECONDS,
+  ROUTE_LEASE_REQUEST_SCHEMA,
+  ROUTE_LEASE_RESULT_SCHEMA,
+  ROUTE_LEASE_RUNTIMES,
+  ROUTE_LEASE_RUNTIME_TABLE,
+  ROUTE_LEASE_SESSION_HASH_DOMAIN,
+  RouteLeaseError,
+  RouteLeaseManager,
+  RouteLeaseTargetResolver,
+  SYSTEM_ROUTE_LEASE_CLOCK,
   __resetProviderProxyForTests,
+  canonicalizeRouteLeasePayload,
   extractRouteToken,
-  getProviderProxy
-} from "./chunk-UDCC7EMR.js";
-import "./chunk-WB6PH56J.js";
+  getProviderProxy,
+  hashRouteLeasePayload,
+  hashRouteLeaseSessionId,
+  isLoopbackAddress,
+  normalizeRouteLeaseIdempotencyKey,
+  normalizeRouteLeaseTtl,
+  parseRouteLeaseCreate,
+  routeLeaseRuntime
+} from "./chunk-QYC54PMG.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
-import "./chunk-WNKWAEUR.js";
-import "./chunk-MZNPGW5Q.js";
-import "./chunk-DK4A7DLE.js";
-import "./chunk-VRFBB5DB.js";
+import "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
 import "./chunk-LVUCAWMK.js";
-import "./chunk-OEWZUX4G.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
 import "./chunk-LB6EBS6Y.js";
-import "./chunk-6CL5HTPQ.js";
 import "./chunk-7VU7V2E4.js";
-import "./chunk-UX7VWA46.js";
-import "./chunk-BPKCU575.js";
-import "./chunk-DRWHTIIZ.js";
+import "./chunk-FXR6N3SR.js";
+import "./chunk-UAPBLNN2.js";
+import "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
+import "./chunk-DK4A7DLE.js";
+import "./chunk-XXFYLL7R.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
+import "./chunk-GFIZ6LQI.js";
+import "./chunk-OE6TDIWW.js";
+import "./chunk-DRWHTIIZ.js";
+import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
-import "./chunk-YJVHCHQX.js";
+import "./chunk-PO3XB56Z.js";
+import "./chunk-N7OOJI5V.js";
 import "./chunk-23S5OPIO.js";
 import "./chunk-AVYJ4YBN.js";
-import "./chunk-OE6TDIWW.js";
 import "./chunk-OPRS4IQZ.js";
 import "./chunk-2JYRIADS.js";
 import "./chunk-DE2SRBFZ.js";
 import "./chunk-ZY6KU6P3.js";
-import "./chunk-JWC6APFQ.js";
 import "./chunk-WLYIIEAF.js";
 import "./chunk-TKJMZBAH.js";
 import "./chunk-3QFXFCHG.js";
@@ -40,16 +71,17 @@ import "./chunk-EBLFCNPY.js";
 import "./chunk-AQ5TNQB7.js";
 import "./chunk-XEKD23J5.js";
 import "./chunk-H5JUT3KV.js";
-import "./chunk-IFXJ2BG7.js";
+import "./chunk-7C7DET6S.js";
 import "./chunk-K5NM7VAH.js";
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
-import "./chunk-AT7B7SOZ.js";
+import "./chunk-5NJLQ6T6.js";
 import "./chunk-N5T4M4GU.js";
 import "./chunk-TOVPMMHM.js";
-import "./chunk-SIZQQD6T.js";
-import "./chunk-SYQF7OIR.js";
+import "./chunk-RJ5ZGNI3.js";
+import "./chunk-3WD4HTR2.js";
 import "./chunk-MKF46GNZ.js";
+import "./chunk-GL6XM527.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";
@@ -58,7 +90,35 @@ export {
   DEFAULT_ROUTE_IDLE_MS,
   ProviderProxy,
   ProviderProxyRouteMap,
+  ROUTE_LEASE_API_VERSION,
+  ROUTE_LEASE_CAPABILITIES,
+  ROUTE_LEASE_CAPABILITIES_SCHEMA,
+  ROUTE_LEASE_CODEX_TOKEN_ENV,
+  ROUTE_LEASE_DEFAULT_TTL_SECONDS,
+  ROUTE_LEASE_MAX_CONSUMER_BYTES,
+  ROUTE_LEASE_MAX_EXECUTION_ID_BYTES,
+  ROUTE_LEASE_MAX_IDEMPOTENCY_BYTES,
+  ROUTE_LEASE_MAX_MODEL_BYTES,
+  ROUTE_LEASE_MAX_SESSION_ID_BYTES,
+  ROUTE_LEASE_MAX_TTL_SECONDS,
+  ROUTE_LEASE_REQUEST_SCHEMA,
+  ROUTE_LEASE_RESULT_SCHEMA,
+  ROUTE_LEASE_RUNTIMES,
+  ROUTE_LEASE_RUNTIME_TABLE,
+  ROUTE_LEASE_SESSION_HASH_DOMAIN,
+  RouteLeaseError,
+  RouteLeaseManager,
+  RouteLeaseTargetResolver,
+  SYSTEM_ROUTE_LEASE_CLOCK,
   __resetProviderProxyForTests,
+  canonicalizeRouteLeasePayload,
   extractRouteToken,
-  getProviderProxy
+  getProviderProxy,
+  hashRouteLeasePayload,
+  hashRouteLeaseSessionId,
+  isLoopbackAddress,
+  normalizeRouteLeaseIdempotencyKey,
+  normalizeRouteLeaseTtl,
+  parseRouteLeaseCreate,
+  routeLeaseRuntime
 };

package/dist/{routeResolver-CHTv_Bs5.d.ts → routeResolver-C0mkkZaM.d.ts}

@@ -1,6 +1,6 @@
 import { ProviderConfigSource } from './ports/provider-config-source.js';
 import { IngressFormat, RouteContext } from './provider-proxy/types.js';
-import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-hsoKrVQS.js';
+import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-BB8pxk_3.js';
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 
 /**

package/dist/{routeResolver-kepxnfcC.d.cts → routeResolver-CVFE8KKe.d.cts}

@@ -1,6 +1,6 @@
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
 import { IngressFormat, RouteContext } from './provider-proxy/types.cjs';
-import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-H3wGZSOo.cjs';
+import { s as OutboundEndpoint, Q as ModelRef, c as EndpointRoutingConfig, R as RequestRole } from './types-C2MwkLah.cjs';
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 
 /**

package/dist/transformer/transformers/AnthropicTransformer.cjs

@@ -1,6 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunk4VLRHHFEcjs = require('../../chunk-4VLRHHFE.cjs');
+var _chunkOXHNSZ53cjs = require('../../chunk-OXHNSZ53.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 
 
-exports.AnthropicTransformer = _chunk4VLRHHFEcjs.AnthropicTransformer;
+exports.AnthropicTransformer = _chunkOXHNSZ53cjs.AnthropicTransformer;

package/dist/transformer/transformers/AnthropicTransformer.js

@@ -1,6 +1,7 @@
 import {
   AnthropicTransformer
-} from "../../chunk-6CL5HTPQ.js";
+} from "../../chunk-PEGTIPB3.js";
+import "../../chunk-FU7EAR73.js";
 export {
   AnthropicTransformer
 };

package/dist/transformer/transformers/OpenAIResponseTransformer.cjs

@@ -1,6 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunk6VUQPOV3cjs = require('../../chunk-6VUQPOV3.cjs');
+var _chunkOVQBNVSVcjs = require('../../chunk-OVQBNVSV.cjs');
+require('../../chunk-5RSZYQJH.cjs');
 
 
-exports.OpenAIResponseTransformer = _chunk6VUQPOV3cjs.OpenAIResponseTransformer;
+exports.OpenAIResponseTransformer = _chunkOVQBNVSVcjs.OpenAIResponseTransformer;

package/dist/transformer/transformers/OpenAIResponseTransformer.js

@@ -1,6 +1,7 @@
 import {
   OpenAIResponseTransformer
-} from "../../chunk-OEWZUX4G.js";
+} from "../../chunk-32O35CIF.js";
+import "../../chunk-FU7EAR73.js";
 export {
   OpenAIResponseTransformer
 };

package/dist/transformer/transformers.cjs

@@ -3,19 +3,20 @@
 
 
 
-var _chunk7AK7B36Bcjs = require('../chunk-7AK7B36B.cjs');
+var _chunk2Z4XM3H5cjs = require('../chunk-2Z4XM3H5.cjs');
 
 
-var _chunkV4TXMEJScjs = require('../chunk-V4TXMEJS.cjs');
+var _chunkOXHNSZ53cjs = require('../chunk-OXHNSZ53.cjs');
 
 
-var _chunk6VUQPOV3cjs = require('../chunk-6VUQPOV3.cjs');
+var _chunkV4TXMEJScjs = require('../chunk-V4TXMEJS.cjs');
 
 
-var _chunkOF3BECU2cjs = require('../chunk-OF3BECU2.cjs');
+var _chunkOVQBNVSVcjs = require('../chunk-OVQBNVSV.cjs');
+require('../chunk-5RSZYQJH.cjs');
 
 
-var _chunk4VLRHHFEcjs = require('../chunk-4VLRHHFE.cjs');
+var _chunkOF3BECU2cjs = require('../chunk-OF3BECU2.cjs');
 
 
 var _chunkOKMJLEXXcjs = require('../chunk-OKMJLEXX.cjs');
@@ -30,4 +31,4 @@ require('../chunk-KBM2W6UY.cjs');
 
 
 
-exports.AnthropicTransformer = _chunk4VLRHHFEcjs.AnthropicTransformer; exports.BUILTIN_TRANSFORMER_NAMES = _chunk7AK7B36Bcjs.BUILTIN_TRANSFORMER_NAMES; exports.BuiltinTransformers = _chunk7AK7B36Bcjs.BuiltinTransformers; exports.GeminiCodeAssistTransformer = _chunkOKMJLEXXcjs.GeminiCodeAssistTransformer; exports.GeminiTransformer = _chunkV4TXMEJScjs.GeminiTransformer; exports.OpenAIResponseTransformer = _chunk6VUQPOV3cjs.OpenAIResponseTransformer; exports.OpenAITransformer = _chunkOF3BECU2cjs.OpenAITransformer; exports.getBuiltinTransformers = _chunk7AK7B36Bcjs.getBuiltinTransformers; exports.registerBuiltinTransformers = _chunk7AK7B36Bcjs.registerBuiltinTransformers;
+exports.AnthropicTransformer = _chunkOXHNSZ53cjs.AnthropicTransformer; exports.BUILTIN_TRANSFORMER_NAMES = _chunk2Z4XM3H5cjs.BUILTIN_TRANSFORMER_NAMES; exports.BuiltinTransformers = _chunk2Z4XM3H5cjs.BuiltinTransformers; exports.GeminiCodeAssistTransformer = _chunkOKMJLEXXcjs.GeminiCodeAssistTransformer; exports.GeminiTransformer = _chunkV4TXMEJScjs.GeminiTransformer; exports.OpenAIResponseTransformer = _chunkOVQBNVSVcjs.OpenAIResponseTransformer; exports.OpenAITransformer = _chunkOF3BECU2cjs.OpenAITransformer; exports.getBuiltinTransformers = _chunk2Z4XM3H5cjs.getBuiltinTransformers; exports.registerBuiltinTransformers = _chunk2Z4XM3H5cjs.registerBuiltinTransformers;

package/dist/transformer/transformers.js

@@ -3,19 +3,20 @@ import {
   BuiltinTransformers,
   getBuiltinTransformers,
   registerBuiltinTransformers
-} from "../chunk-VRFBB5DB.js";
+} from "../chunk-MYYR3HZL.js";
+import {
+  AnthropicTransformer
+} from "../chunk-PEGTIPB3.js";
 import {
   GeminiTransformer
 } from "../chunk-LVUCAWMK.js";
 import {
   OpenAIResponseTransformer
-} from "../chunk-OEWZUX4G.js";
+} from "../chunk-32O35CIF.js";
+import "../chunk-FU7EAR73.js";
 import {
   OpenAITransformer
 } from "../chunk-LB6EBS6Y.js";
-import {
-  AnthropicTransformer
-} from "../chunk-6CL5HTPQ.js";
 import {
   GeminiCodeAssistTransformer
 } from "../chunk-N5T4M4GU.js";

package/dist/transformer.cjs

@@ -1,22 +1,23 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-FZ46M34D.cjs');
 
 
+var _chunk2Z4XM3H5cjs = require('./chunk-2Z4XM3H5.cjs');
+require('./chunk-OXHNSZ53.cjs');
+require('./chunk-V4TXMEJS.cjs');
+require('./chunk-OVQBNVSV.cjs');
+require('./chunk-5RSZYQJH.cjs');
+require('./chunk-OF3BECU2.cjs');
+
+
 var _chunkIIRPUVPHcjs = require('./chunk-IIRPUVPH.cjs');
 require('./chunk-GBHYAGX3.cjs');
 
 
 var _chunk3OPYJG76cjs = require('./chunk-3OPYJG76.cjs');
-
-
-var _chunk7AK7B36Bcjs = require('./chunk-7AK7B36B.cjs');
-require('./chunk-V4TXMEJS.cjs');
-require('./chunk-6VUQPOV3.cjs');
-require('./chunk-OF3BECU2.cjs');
-require('./chunk-4VLRHHFE.cjs');
 require('./chunk-OKMJLEXX.cjs');
 require('./chunk-KBM2W6UY.cjs');
 
 
 
 
-exports.TransformerChainExecutor = _chunkIIRPUVPHcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunk7AK7B36Bcjs.registerBuiltinTransformers;
+exports.TransformerChainExecutor = _chunkIIRPUVPHcjs.TransformerChainExecutor; exports.TransformerService = _chunk3OPYJG76cjs.TransformerService; exports.registerBuiltinTransformers = _chunk2Z4XM3H5cjs.registerBuiltinTransformers;

package/dist/transformer.js

@@ -1,4 +1,12 @@
 import "./chunk-46RLHI7D.js";
+import {
+  registerBuiltinTransformers
+} from "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
+import "./chunk-LB6EBS6Y.js";
 import {
   TransformerChainExecutor
 } from "./chunk-WNKWAEUR.js";
@@ -6,13 +14,6 @@ import "./chunk-MZNPGW5Q.js";
 import {
   TransformerService
 } from "./chunk-DK4A7DLE.js";
-import {
-  registerBuiltinTransformers
-} from "./chunk-VRFBB5DB.js";
-import "./chunk-LVUCAWMK.js";
-import "./chunk-OEWZUX4G.js";
-import "./chunk-LB6EBS6Y.js";
-import "./chunk-6CL5HTPQ.js";
 import "./chunk-N5T4M4GU.js";
 import "./chunk-TOVPMMHM.js";
 export {

package/dist/{types-hsoKrVQS.d.ts → types-BB8pxk_3.d.ts}

@@ -6,7 +6,7 @@ import { VoucherRecord, VoucherGrant, VoucherInfo, VoucherConfig } from '@omnicr
 import { WebhookConfig } from '@omnicross/contracts/webhook-types';
 import { L as Logger } from './logger-4GvQNzhE.js';
 import { ProviderConfigSource } from './ports/provider-config-source.js';
-import { P as ProviderProxy } from './ProviderProxy-C-xqrkKi.js';
+import { P as ProviderProxy } from './ProviderProxy--ROec6VI.js';
 import { ProviderProxyDeps } from './provider-proxy/types.js';
 import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.js';
 import { c as KeySpend } from './keyPolicy-zdWTu3CQ.js';
@@ -654,6 +654,13 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -751,6 +758,15 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -803,6 +819,14 @@ interface OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: OutboundEndpoint[];
         loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -830,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident

package/dist/{types-H3wGZSOo.d.cts → types-C2MwkLah.d.cts}

@@ -6,7 +6,7 @@ import { VoucherRecord, VoucherGrant, VoucherInfo, VoucherConfig } from '@omnicr
 import { WebhookConfig } from '@omnicross/contracts/webhook-types';
 import { L as Logger } from './logger-4GvQNzhE.cjs';
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
-import { P as ProviderProxy } from './ProviderProxy-CnMQYN59.cjs';
+import { P as ProviderProxy } from './ProviderProxy-QdwNV6l1.cjs';
 import { ProviderProxyDeps } from './provider-proxy/types.cjs';
 import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.cjs';
 import { c as KeySpend } from './keyPolicy-zdWTu3CQ.cjs';
@@ -654,6 +654,13 @@ interface OutboundApiKeyInfo {
     id: string;
     name: string;
     keyPrefix: string;
+    /**
+     * Whether the operator "view key" affordance is available for this key — true
+     * only when a reversibly-encrypted `keySecret` was persisted at creation.
+     * Legacy hash-only rows (and any DB without a `SecretBox`) read as absent ⇒
+     * not revealable. Optional so a pre-upgrade daemon response type-checks.
+     */
+    revealable?: boolean;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -751,6 +758,15 @@ interface OutboundKeyDbRow {
     name: string;
     keyHash: string;
     keyPrefix: string;
+    /**
+     * OPTIONAL reversibly-encrypted plaintext of the secret (an `enc:v1:…`
+     * envelope produced by the daemon's `SecretBox`). Absent on legacy rows
+     * (created before revealable storage) AND on any DB constructed without a
+     * `SecretBox` — in both cases the key is NOT revealable. The hash above
+     * remains the auth lookup index; this field only powers the operator
+     * "view key" affordance.
+     */
+    keySecret?: string;
     enabled: boolean;
     createdAt: number;
     lastUsedAt: number | null;
@@ -803,6 +819,14 @@ interface OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: OutboundEndpoint[];
         loopbackOnly?: boolean;
+        /**
+         * The generated plaintext secret. When the DB holds a `SecretBox` it
+         * persists a reversibly-encrypted copy as `keySecret` (enabling the
+         * "view key" affordance); when no box is wired the plaintext is dropped
+         * (byte-identical to the legacy hash-only storage). The hash above — NOT
+         * this field — remains the auth lookup index.
+         */
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
@@ -830,6 +854,21 @@ interface OutboundKeyDb {
      * idempotent).
      */
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
+    /**
+     * Reveal the stored plaintext for a key (the operator "view key" affordance),
+     * or `null` when the key is missing OR was persisted without a `keySecret`
+     * (legacy hash-only rows / a DB constructed without a `SecretBox`). The
+     * daemon-owned DB decrypts its stored envelope; core never handles the
+     * master key.
+     */
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    /**
+     * Permanently remove a key row (hard delete), returning whether a row was
+     * removed. Unlike {@link outboundApiKeysRevoke} (a soft revoke that keeps the
+     * row for history), this purges the row entirely — intended for cleaning up
+     * already-revoked keys. Irreversible; the caller confirms.
+     */
+    outboundApiKeysDelete(id: string): Promise<boolean>;
 }
 /**
  * App-session-scoped dependencies the outbound server needs. The resident

package/dist/usage/pricing-engine.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkDLXZEZWOcjs = require('../chunk-DLXZEZWO.cjs');
+var _chunk2E42SAW3cjs = require('../chunk-2E42SAW3.cjs');
 
 
-exports.PricingEngine = _chunkDLXZEZWOcjs.PricingEngine;
+exports.PricingEngine = _chunk2E42SAW3cjs.PricingEngine;

package/dist/usage/pricing-engine.d.cts

@@ -50,6 +50,15 @@ declare class PricingEngine {
      * non-wildcard entry per model wins.
      */
     private cacheByModel;
+    /**
+     * Last-resort fuzzy index: `[normalizedModelId, entry]` pairs over the same
+     * non-wildcard, non-openrouter rows as `cacheByModel`. Used when even the
+     * model-name fallback misses — e.g. usage recorded under a bare model id
+     * (`glm-5.2`) while the catalog only knows prefixed slugs
+     * (`cloudflare/@cf/zai-org/glm-5.2`). This is an ESTIMATE: the matched row
+     * may be an aggregate-route price rather than the direct-vendor rate.
+     */
+    private fuzzyEntries;
     private cacheLoaded;
     /** Coalesce manual and background refreshes to prevent a catalog stampede. */
     private refreshInFlight;
@@ -65,8 +74,19 @@ declare class PricingEngine {
      *   2. wildcard provider ('*', modelId)
      *   3. model name alone (any provider) — tolerates a runtime-alias vs
      *      canonical provider-id mismatch for the same model.
+     *   4. normalized fuzzy match (last resort) — matches a bare id like
+     *      `glm-5.2` against prefixed catalog slugs like
+     *      `cloudflare/@cf/zai-org/glm-5.2`. ESTIMATE only: the matched row may
+     *      be an aggregate-route price, not the direct-vendor rate.
      */
     getEntry(providerId: string, modelId: string): Promise<PricingEntry | null>;
+    /**
+     * Normalized substring match over the catalog's non-openrouter rows. Lowercases
+     * and strips all non-alphanumerics, then matches bidirectionally, preferring
+     * the shortest catalog key (tightest match) to reduce over-matching version
+     * variants. Returns null when nothing matches.
+     */
+    private fuzzyMatch;
     /**
      * Compute the cost (and cache savings) for a single response.
      *

package/dist/usage/pricing-engine.d.ts

@@ -50,6 +50,15 @@ declare class PricingEngine {
      * non-wildcard entry per model wins.
      */
     private cacheByModel;
+    /**
+     * Last-resort fuzzy index: `[normalizedModelId, entry]` pairs over the same
+     * non-wildcard, non-openrouter rows as `cacheByModel`. Used when even the
+     * model-name fallback misses — e.g. usage recorded under a bare model id
+     * (`glm-5.2`) while the catalog only knows prefixed slugs
+     * (`cloudflare/@cf/zai-org/glm-5.2`). This is an ESTIMATE: the matched row
+     * may be an aggregate-route price rather than the direct-vendor rate.
+     */
+    private fuzzyEntries;
     private cacheLoaded;
     /** Coalesce manual and background refreshes to prevent a catalog stampede. */
     private refreshInFlight;
@@ -65,8 +74,19 @@ declare class PricingEngine {
      *   2. wildcard provider ('*', modelId)
      *   3. model name alone (any provider) — tolerates a runtime-alias vs
      *      canonical provider-id mismatch for the same model.
+     *   4. normalized fuzzy match (last resort) — matches a bare id like
+     *      `glm-5.2` against prefixed catalog slugs like
+     *      `cloudflare/@cf/zai-org/glm-5.2`. ESTIMATE only: the matched row may
+     *      be an aggregate-route price, not the direct-vendor rate.
      */
     getEntry(providerId: string, modelId: string): Promise<PricingEntry | null>;
+    /**
+     * Normalized substring match over the catalog's non-openrouter rows. Lowercases
+     * and strips all non-alphanumerics, then matches bidirectionally, preferring
+     * the shortest catalog key (tightest match) to reduce over-matching version
+     * variants. Returns null when nothing matches.
+     */
+    private fuzzyMatch;
     /**
      * Compute the cost (and cache savings) for a single response.
      *

package/dist/usage/pricing-engine.js

@@ -1,6 +1,6 @@
 import {
   PricingEngine
-} from "../chunk-UX7VWA46.js";
+} from "../chunk-FXR6N3SR.js";
 export {
   PricingEngine
 };

package/dist/usage/usage-recorder.cjs

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkSNYBEXLBcjs = require('../chunk-SNYBEXLB.cjs');
+var _chunkEPN67EGPcjs = require('../chunk-EPN67EGP.cjs');
 require('../chunk-XSVNC2UD.cjs');
 
 
-exports.UsageRecorder = _chunkSNYBEXLBcjs.UsageRecorder;
+exports.UsageRecorder = _chunkEPN67EGPcjs.UsageRecorder;

package/dist/usage/usage-recorder.d.cts

@@ -1,5 +1,5 @@
 import { PricingEngine } from './pricing-engine.cjs';
-import { UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
+import { UsageCacheKeySource, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { L as Logger } from '../logger-4GvQNzhE.cjs';
 import { UsageEventStore } from '../ports/usage-event-store.cjs';
@@ -32,8 +32,18 @@ interface UsageRecordInput {
     rawUsage?: unknown;
     /** Host run-correlation id. Optional / additive. */
     runId?: string | null;
+    /** Token-free process-local Route Lease id. */
+    routeLeaseId?: string | null;
+    /** Bounded logical Route Lease consumer. */
+    routeLeaseConsumer?: string | null;
+    /** Bounded Route Lease stage attribution. */
+    routeLeaseStageId?: string | null;
     /** Host event-correlation id for this call. Optional / additive. */
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log). When the
      * OUTBOUND relay taps set this to the request's `http.ServerResponse`, the

package/dist/usage/usage-recorder.d.ts

@@ -1,5 +1,5 @@
 import { PricingEngine } from './pricing-engine.js';
-import { UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
+import { UsageCacheKeySource, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
 import { UsageEngineOrigin, UsageTokens } from '@omnicross/contracts/usage-types';
 import { L as Logger } from '../logger-4GvQNzhE.js';
 import { UsageEventStore } from '../ports/usage-event-store.js';
@@ -32,8 +32,18 @@ interface UsageRecordInput {
     rawUsage?: unknown;
     /** Host run-correlation id. Optional / additive. */
     runId?: string | null;
+    /** Token-free process-local Route Lease id. */
+    routeLeaseId?: string | null;
+    /** Bounded logical Route Lease consumer. */
+    routeLeaseConsumer?: string | null;
+    /** Bounded Route Lease stage attribution. */
+    routeLeaseStageId?: string | null;
     /** Host event-correlation id for this call. Optional / additive. */
     eventId?: string | null;
+    /** Safe prompt-cache-key provenance; raw key material is never recorded. */
+    cacheKeySource?: UsageCacheKeySource;
+    /** Whether the gateway, rather than the client, attached the cache key. */
+    cacheKeyInjected?: boolean;
     /**
      * OPTIONAL per-request audit correlation key (request-audit-log). When the
      * OUTBOUND relay taps set this to the request's `http.ServerResponse`, the

package/dist/usage/usage-recorder.js

@@ -1,6 +1,6 @@
 import {
   UsageRecorder
-} from "../chunk-BPKCU575.js";
+} from "../chunk-UAPBLNN2.js";
 import "../chunk-OZFM4X3S.js";
 export {
   UsageRecorder

package/dist/usage.cjs

@@ -1,12 +1,12 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-EYZYXJTJ.cjs');
 
 
-var _chunkDLXZEZWOcjs = require('./chunk-DLXZEZWO.cjs');
+var _chunk2E42SAW3cjs = require('./chunk-2E42SAW3.cjs');
 
 
-var _chunkSNYBEXLBcjs = require('./chunk-SNYBEXLB.cjs');
+var _chunkEPN67EGPcjs = require('./chunk-EPN67EGP.cjs');
 require('./chunk-XSVNC2UD.cjs');
 
 
 
-exports.PricingEngine = _chunkDLXZEZWOcjs.PricingEngine; exports.UsageRecorder = _chunkSNYBEXLBcjs.UsageRecorder;
+exports.PricingEngine = _chunk2E42SAW3cjs.PricingEngine; exports.UsageRecorder = _chunkEPN67EGPcjs.UsageRecorder;