@omnicross/core 0.1.9 → 0.2.0

package/dist/outbound-api.d.cts

@@ -1,18 +1,19 @@
 import { VoucherConfig } from '@omnicross/contracts/voucher-types';
-import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-C2MwkLah.cjs';
-export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-C2MwkLah.cjs';
+import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, W as AnthropicConfigSegment, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, y as OutboundProxyConfig, I as ImagesServerConfig, s as OutboundEndpoint, R as RequestRole, T as ModelRef, k as KindMappedEndpoint, l as ModelKind, x as OutboundPermission, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-jjU24eYG.cjs';
+export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, z as ResponsesModelKind, V as VoucherCreateInput, B as VoucherDb, D as computeVoucherGrant, H as generateVoucherCode, J as hashVoucherCode, L as newVoucherId, N as startOfLocalDay, P as startOfLocalWeek, Q as toVoucherInfo, S as voucherCodePrefix } from './types-jjU24eYG.cjs';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
 import { WebhookDestination, WebhookConfig } from '@omnicross/contracts/webhook-types';
+import { e as ImageApiLimits } from './types-CbglB73l.cjs';
 export { AUDIT_REDACTED, redactAuditText } from './outbound-api/auditRedact.cjs';
 export { AuditCaptureContext, beginAuditCapture } from './outbound-api/auditCapture.cjs';
 export { BillingCaptureContext, beginBillingCapture } from './outbound-api/billingCapture.cjs';
 import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-zdWTu3CQ.cjs';
 export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-zdWTu3CQ.cjs';
 import http from 'node:http';
-import { IngressFormat } from './provider-proxy/types.cjs';
-export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-CVFE8KKe.cjs';
+import { D as IngressFormat } from './types-DsHBBk3h.cjs';
+export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-rpKQLyDO.cjs';
 export { BoundAccountFallbackPolicy, BoundAccountSelectionError, BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError } from './pipeline/BoundAccountSelectionError.cjs';
 import '@omnicross/contracts/health-logging-types';
 import './logger-4GvQNzhE.cjs';
@@ -21,7 +22,9 @@ import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';
 import '@omnicross/contracts/completion-types';
 import './transformer/TransformerService.cjs';
-import './ProviderProxy-QdwNV6l1.cjs';
+import './ProviderProxy-CgIcCVwk.cjs';
+import '@omnicross/contracts/image-generation-types';
+import 'node:fs/promises';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
@@ -62,6 +65,8 @@ declare const DEFAULT_OUTBOUND_PORT = 8765;
 interface ApplyConfigInput {
     enabled: boolean;
     networkBinding: boolean;
+    /** Additive Images URL publication; serving still depends on runtime capability. */
+    imagesEnabled?: boolean;
     endpoints: EndpointRoutingConfig[];
     /** Independent resource bindings; absent preserves legacy endpoint routing. */
     bindings?: GatewayBinding[];
@@ -73,6 +78,15 @@ interface ApplyConfigInput {
     /** Voucher segment (voucher-redemption #9). Read live per request; absent ⇒
      *  disabled ⇒ the `/redeem` endpoint is inert (zero regression). */
     voucher?: VoucherConfig;
+    /** Anthropic-protocol segment (claude-api-protocol-fidelity, §10). Read live
+     *  per request; the heartbeat value is hot-applied to the stream synthesizer. */
+    anthropic?: AnthropicConfigSegment;
+}
+/** Prepared listener/config publication used by the daemon's settings transaction. */
+interface PreparedOutboundApiConfig {
+    publish(): Promise<void>;
+    rollback(): Promise<void>;
+    dispose(): Promise<void>;
 }
 declare class OutboundApiServer {
     private readonly deps;
@@ -86,6 +100,10 @@ declare class OutboundApiServer {
     private userMessageQueue;
     private concurrencyQueue;
     private voucherConfig;
+    private anthropicConfig;
+    private imagesEnabled;
+    /** R10 `/api/hello` switch (§10 `anthropic.apiHello`, default true). */
+    private apiHelloEnabled;
     private readonly rateLimiter;
     /**
      * Redeem-attempt limiter (voucher-redemption #9, design D6) — a SEPARATE bucket
@@ -111,12 +129,35 @@ declare class OutboundApiServer {
      * in place (read live per request — no restart).
      */
     applyConfig(input: ApplyConfigInput): Promise<void>;
+    /**
+     * Prepare any new listener before persistence when the target can coexist with
+     * the current socket. A live fixed-port address-only change cannot be made
+     * failure-atomic on every supported platform because the replacement cannot
+     * coexist with the old socket, so reject it before persistence instead of
+     * performing a fallible close-then-bind during publication.
+     */
+    prepareConfig(input: ApplyConfigInput): Promise<PreparedOutboundApiConfig>;
     /** Start the listener on `bindAddr:port`, falling back on EADDRINUSE. */
     start(bindAddr: string, port: number): Promise<number>;
     /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
-    private listen;
+    private listenDetached;
+    private createHttpServer;
+    private installConfigSnapshot;
+    private captureRuntimeSnapshot;
+    private installRuntimeSnapshot;
+    private restoreRuntimeSnapshot;
+    private closeServer;
+    /** Publication already swapped the authoritative pointer; retirement cannot fail it. */
+    private closePublishedServer;
+    private announcePublishedListener;
     /** Per-request handler. Auth is enforced on EVERY request (incl. loopback). */
     private onRequest;
+    /**
+     * Serve `HEAD /api/hello` (exact path, query tolerated) with a bare 200 —
+     * returning true when it handled the request. Unauthenticated by design and
+     * gated on `anthropic.apiHello` (default true).
+     */
+    private tryServeApiHello;
     /**
      * Serve `GET|HEAD /health` (+ `/healthz`) from the injected provider, returning
      * true when it handled the request. 200 when `ok`, else 503; secret-free body.
@@ -197,7 +238,8 @@ declare function normalizeAccountProbe(raw: Partial<OutboundApiServerConfig> | u
  * (request-audit-log, design D2). Lenient like the other segment normalizers:
  * `enabled`/`captureBodies`/`trustForwardedFor` coerce to booleans (default
  * false). `maxBodyBytes:-1` means unlimited; other finite values clamp to
- * `[0, 1_048_576]`. `retentionDays` clamps to `[1, 365]`. Default (all-off) ⇒
+ * `[0, 1_048_576]`. `retentionDays` clamps to `[1, 365]`;
+ * `compactStreamingBodies` coerces to a boolean (default false). Default (all-off) ⇒
  * no capture ⇒ zero regression.
  */
 declare function normalizeAudit(raw: Partial<OutboundApiServerConfig> | undefined | null): AuditConfig;
@@ -320,6 +362,43 @@ declare function saveServerConfig(store: ApiServerSettingsStore, config: Outboun
 /** Apply a partial patch to a config, returning the merged whole. */
 declare function mergeServerConfig(current: OutboundApiServerConfig, patch: Partial<OutboundApiServerConfig>): OutboundApiServerConfig;
 
+/** Immutable upper bounds used by both tolerant reads and strict admin writes. */
+declare const IMAGE_SERVER_HARD_CEILINGS: Readonly<{
+    queue: Readonly<{
+        maxConcurrentJobsPerAccount: 8;
+        maxQueuedJobs: 1000;
+        queueTimeoutMs: number;
+        generationTimeoutMs: number;
+    }>;
+    temporary: Readonly<{
+        maxActiveScopes: 256;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        staleAfterMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    limits: Readonly<ImageApiLimits>;
+    references: Readonly<{
+        ttlMs: number;
+        maxArtifactBytes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        maxEntries: 1000000;
+        maxCalls: 2000000;
+        maxResponses: 1000000;
+        maxTombstones: 2000000;
+        tombstoneTtlMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    evidenceTtlMs: number;
+}>;
+/** Migration-safe default: configured off, finite everywhere, and remote-disabled. */
+declare const DEFAULT_IMAGES_SERVER_CONFIG: Readonly<ImagesServerConfig>;
+/** Tolerant read normalization: malformed members fall back or clamp, never throw. */
+declare function normalizeImagesServerConfig(value: unknown): ImagesServerConfig;
+/** Strict structural/range validation. Daemon validation adds filesystem and resolver policy. */
+declare function validateImagesServerConfig(value: unknown): string[];
+
 /**
  * Either the winning route projected to the resolver shape, or `none` — no
  * enabled route for this key/endpoint could serve the request. There is no
@@ -689,7 +768,15 @@ declare function createNamedKey(db: OutboundKeyDb, name: string): Promise<Outbou
  * Mint the local gateway key used by native CLI configuration adapters. Unlike
  * a user-distributed key it is explicitly loopback-only and endpoint-scoped.
  */
-declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundEndpoint[]): Promise<OutboundApiKeyCreated>;
+declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundPermission[]): Promise<OutboundApiKeyCreated>;
+declare const LEGACY_OUTBOUND_PERMISSIONS: readonly OutboundPermission[];
+/** Strict write-edge validator. Stored-row reads use fail-closed interpretation below. */
+declare function validateOutboundPermissions(value: unknown): OutboundPermission[];
+/**
+ * Authoritative legacy interpretation. Absence preserves only the four historic
+ * families; malformed persisted data denies all instead of widening access.
+ */
+declare function effectiveOutboundPermissions(value: unknown): readonly OutboundPermission[];
 /**
  * A verified key + the enforcement inputs carried from the row so the wire layer
  * runs its policy checks WITHOUT a second DB read (mirrors `maxConcurrency`).
@@ -697,7 +784,7 @@ declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEn
 interface VerifiedKey {
     id: string;
     kind?: 'client' | 'integration';
-    allowedEndpoints?: OutboundEndpoint[];
+    allowedEndpoints: OutboundPermission[];
     loopbackOnly?: boolean;
     /**
      * The key's per-key concurrency ceiling, carried from the row so the wire
@@ -919,4 +1006,4 @@ declare function getOutboundApiServer(deps?: OutboundApiDeps, onPortChange?: (po
 /** Reset the singleton (tests / teardown only). */
 declare function __resetOutboundApiServerForTests(): void;
 
-export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundProxyConfig, OutboundRateLimiter, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, verifyKey, verifyPresentedKey };
+export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_IMAGES_SERVER_CONFIG, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, IMAGE_SERVER_HARD_CEILINGS, ImagesServerConfig, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, LEGACY_OUTBOUND_PERMISSIONS, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundPermission, OutboundProxyConfig, OutboundRateLimiter, type PreparedOutboundApiConfig, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, effectiveOutboundPermissions, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizeImagesServerConfig, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, validateImagesServerConfig, validateOutboundPermissions, verifyKey, verifyPresentedKey };

package/dist/outbound-api.d.ts

@@ -1,18 +1,19 @@
 import { VoucherConfig } from '@omnicross/contracts/voucher-types';
-import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-BB8pxk_3.js';
-export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-BB8pxk_3.js';
+import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, W as AnthropicConfigSegment, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, y as OutboundProxyConfig, I as ImagesServerConfig, s as OutboundEndpoint, R as RequestRole, T as ModelRef, k as KindMappedEndpoint, l as ModelKind, x as OutboundPermission, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-5T223WYQ.js';
+export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, z as ResponsesModelKind, V as VoucherCreateInput, B as VoucherDb, D as computeVoucherGrant, H as generateVoucherCode, J as hashVoucherCode, L as newVoucherId, N as startOfLocalDay, P as startOfLocalWeek, Q as toVoucherInfo, S as voucherCodePrefix } from './types-5T223WYQ.js';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
 import { WebhookDestination, WebhookConfig } from '@omnicross/contracts/webhook-types';
+import { e as ImageApiLimits } from './types-Bd72H4SB.js';
 export { AUDIT_REDACTED, redactAuditText } from './outbound-api/auditRedact.js';
 export { AuditCaptureContext, beginAuditCapture } from './outbound-api/auditCapture.js';
 export { BillingCaptureContext, beginBillingCapture } from './outbound-api/billingCapture.js';
 import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-zdWTu3CQ.js';
 export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-zdWTu3CQ.js';
 import http from 'node:http';
-import { IngressFormat } from './provider-proxy/types.js';
-export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-C0mkkZaM.js';
+import { D as IngressFormat } from './types-CVRge76p.js';
+export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-CTCcSHWu.js';
 export { BoundAccountFallbackPolicy, BoundAccountSelectionError, BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError } from './pipeline/BoundAccountSelectionError.js';
 import '@omnicross/contracts/health-logging-types';
 import './logger-4GvQNzhE.js';
@@ -21,7 +22,9 @@ import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
 import '@omnicross/contracts/completion-types';
 import './transformer/TransformerService.js';
-import './ProviderProxy--ROec6VI.js';
+import './ProviderProxy-DYoY5XoT.js';
+import '@omnicross/contracts/image-generation-types';
+import 'node:fs/promises';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
@@ -62,6 +65,8 @@ declare const DEFAULT_OUTBOUND_PORT = 8765;
 interface ApplyConfigInput {
     enabled: boolean;
     networkBinding: boolean;
+    /** Additive Images URL publication; serving still depends on runtime capability. */
+    imagesEnabled?: boolean;
     endpoints: EndpointRoutingConfig[];
     /** Independent resource bindings; absent preserves legacy endpoint routing. */
     bindings?: GatewayBinding[];
@@ -73,6 +78,15 @@ interface ApplyConfigInput {
     /** Voucher segment (voucher-redemption #9). Read live per request; absent ⇒
      *  disabled ⇒ the `/redeem` endpoint is inert (zero regression). */
     voucher?: VoucherConfig;
+    /** Anthropic-protocol segment (claude-api-protocol-fidelity, §10). Read live
+     *  per request; the heartbeat value is hot-applied to the stream synthesizer. */
+    anthropic?: AnthropicConfigSegment;
+}
+/** Prepared listener/config publication used by the daemon's settings transaction. */
+interface PreparedOutboundApiConfig {
+    publish(): Promise<void>;
+    rollback(): Promise<void>;
+    dispose(): Promise<void>;
 }
 declare class OutboundApiServer {
     private readonly deps;
@@ -86,6 +100,10 @@ declare class OutboundApiServer {
     private userMessageQueue;
     private concurrencyQueue;
     private voucherConfig;
+    private anthropicConfig;
+    private imagesEnabled;
+    /** R10 `/api/hello` switch (§10 `anthropic.apiHello`, default true). */
+    private apiHelloEnabled;
     private readonly rateLimiter;
     /**
      * Redeem-attempt limiter (voucher-redemption #9, design D6) — a SEPARATE bucket
@@ -111,12 +129,35 @@ declare class OutboundApiServer {
      * in place (read live per request — no restart).
      */
     applyConfig(input: ApplyConfigInput): Promise<void>;
+    /**
+     * Prepare any new listener before persistence when the target can coexist with
+     * the current socket. A live fixed-port address-only change cannot be made
+     * failure-atomic on every supported platform because the replacement cannot
+     * coexist with the old socket, so reject it before persistence instead of
+     * performing a fallible close-then-bind during publication.
+     */
+    prepareConfig(input: ApplyConfigInput): Promise<PreparedOutboundApiConfig>;
     /** Start the listener on `bindAddr:port`, falling back on EADDRINUSE. */
     start(bindAddr: string, port: number): Promise<number>;
     /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
-    private listen;
+    private listenDetached;
+    private createHttpServer;
+    private installConfigSnapshot;
+    private captureRuntimeSnapshot;
+    private installRuntimeSnapshot;
+    private restoreRuntimeSnapshot;
+    private closeServer;
+    /** Publication already swapped the authoritative pointer; retirement cannot fail it. */
+    private closePublishedServer;
+    private announcePublishedListener;
     /** Per-request handler. Auth is enforced on EVERY request (incl. loopback). */
     private onRequest;
+    /**
+     * Serve `HEAD /api/hello` (exact path, query tolerated) with a bare 200 —
+     * returning true when it handled the request. Unauthenticated by design and
+     * gated on `anthropic.apiHello` (default true).
+     */
+    private tryServeApiHello;
     /**
      * Serve `GET|HEAD /health` (+ `/healthz`) from the injected provider, returning
      * true when it handled the request. 200 when `ok`, else 503; secret-free body.
@@ -197,7 +238,8 @@ declare function normalizeAccountProbe(raw: Partial<OutboundApiServerConfig> | u
  * (request-audit-log, design D2). Lenient like the other segment normalizers:
  * `enabled`/`captureBodies`/`trustForwardedFor` coerce to booleans (default
  * false). `maxBodyBytes:-1` means unlimited; other finite values clamp to
- * `[0, 1_048_576]`. `retentionDays` clamps to `[1, 365]`. Default (all-off) ⇒
+ * `[0, 1_048_576]`. `retentionDays` clamps to `[1, 365]`;
+ * `compactStreamingBodies` coerces to a boolean (default false). Default (all-off) ⇒
  * no capture ⇒ zero regression.
  */
 declare function normalizeAudit(raw: Partial<OutboundApiServerConfig> | undefined | null): AuditConfig;
@@ -320,6 +362,43 @@ declare function saveServerConfig(store: ApiServerSettingsStore, config: Outboun
 /** Apply a partial patch to a config, returning the merged whole. */
 declare function mergeServerConfig(current: OutboundApiServerConfig, patch: Partial<OutboundApiServerConfig>): OutboundApiServerConfig;
 
+/** Immutable upper bounds used by both tolerant reads and strict admin writes. */
+declare const IMAGE_SERVER_HARD_CEILINGS: Readonly<{
+    queue: Readonly<{
+        maxConcurrentJobsPerAccount: 8;
+        maxQueuedJobs: 1000;
+        queueTimeoutMs: number;
+        generationTimeoutMs: number;
+    }>;
+    temporary: Readonly<{
+        maxActiveScopes: 256;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        staleAfterMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    limits: Readonly<ImageApiLimits>;
+    references: Readonly<{
+        ttlMs: number;
+        maxArtifactBytes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        maxEntries: 1000000;
+        maxCalls: 2000000;
+        maxResponses: 1000000;
+        maxTombstones: 2000000;
+        tombstoneTtlMs: number;
+        cleanupIntervalMs: number;
+    }>;
+    evidenceTtlMs: number;
+}>;
+/** Migration-safe default: configured off, finite everywhere, and remote-disabled. */
+declare const DEFAULT_IMAGES_SERVER_CONFIG: Readonly<ImagesServerConfig>;
+/** Tolerant read normalization: malformed members fall back or clamp, never throw. */
+declare function normalizeImagesServerConfig(value: unknown): ImagesServerConfig;
+/** Strict structural/range validation. Daemon validation adds filesystem and resolver policy. */
+declare function validateImagesServerConfig(value: unknown): string[];
+
 /**
  * Either the winning route projected to the resolver shape, or `none` — no
  * enabled route for this key/endpoint could serve the request. There is no
@@ -689,7 +768,15 @@ declare function createNamedKey(db: OutboundKeyDb, name: string): Promise<Outbou
  * Mint the local gateway key used by native CLI configuration adapters. Unlike
  * a user-distributed key it is explicitly loopback-only and endpoint-scoped.
  */
-declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundEndpoint[]): Promise<OutboundApiKeyCreated>;
+declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEndpoints?: OutboundPermission[]): Promise<OutboundApiKeyCreated>;
+declare const LEGACY_OUTBOUND_PERMISSIONS: readonly OutboundPermission[];
+/** Strict write-edge validator. Stored-row reads use fail-closed interpretation below. */
+declare function validateOutboundPermissions(value: unknown): OutboundPermission[];
+/**
+ * Authoritative legacy interpretation. Absence preserves only the four historic
+ * families; malformed persisted data denies all instead of widening access.
+ */
+declare function effectiveOutboundPermissions(value: unknown): readonly OutboundPermission[];
 /**
  * A verified key + the enforcement inputs carried from the row so the wire layer
  * runs its policy checks WITHOUT a second DB read (mirrors `maxConcurrency`).
@@ -697,7 +784,7 @@ declare function createIntegrationKey(db: OutboundKeyDb, name: string, allowedEn
 interface VerifiedKey {
     id: string;
     kind?: 'client' | 'integration';
-    allowedEndpoints?: OutboundEndpoint[];
+    allowedEndpoints: OutboundPermission[];
     loopbackOnly?: boolean;
     /**
      * The key's per-key concurrency ceiling, carried from the row so the wire
@@ -919,4 +1006,4 @@ declare function getOutboundApiServer(deps?: OutboundApiDeps, onPortChange?: (po
 /** Reset the singleton (tests / teardown only). */
 declare function __resetOutboundApiServerForTests(): void;
 
-export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundProxyConfig, OutboundRateLimiter, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, verifyKey, verifyPresentedKey };
+export { AccountProbeConfig, AllowanceSchedulingConfig, type ApiServerSettingsStore, type ApplyConfigInput, ConcurrencyQueueConfig, ConcurrencyQueueFullError, ConcurrencyWaitCancelledError, ConcurrencyWaitTimeoutError, DEFAULT_ACCOUNT_PROBE, DEFAULT_ALLOWANCE_SCHEDULING, DEFAULT_CONCURRENCY_QUEUE, DEFAULT_FINGERPRINT, DEFAULT_IMAGES_SERVER_CONFIG, DEFAULT_OUTBOUND_PORT, DEFAULT_USER_MESSAGE_QUEUE, EndpointRoutingConfig, FingerprintConfig, type GateAcquireOptions, type GateAcquisition, type GateSlot, type GateStatusEntry, GatewayBinding, type GatewayBindingResolution, IMAGE_SERVER_HARD_CEILINGS, ImagesServerConfig, KeyCostLimits, type KeyVerification, KeyedMutex, KindMappedEndpoint, LEGACY_OUTBOUND_PERMISSIONS, ModelKind, type ModelPrefixKind, ModelPrefixTargets, OUTBOUND_API_SERVER_CONFIG_KEY, OutboundApiDeps, OutboundApiKeyCreated, OutboundApiServer, OutboundApiServerConfig, OutboundApiServerStatus, OutboundConcurrencyGate, OutboundEndpoint, OutboundFormatUrls, OutboundKeyDb, OutboundPermission, OutboundProxyConfig, OutboundRateLimiter, type PreparedOutboundApiConfig, RequestRole, type ResolveGatewayBindingInput, type SerialAcquireOptions, type SerialQueueStatusEntry, SerialQueueTimeoutError, type SerialSlot, UserMessageQueueConfig, UserMessageSerialQueue, type VerifiedKey, __resetOutboundApiServerForTests, candidateBackgroundModelIds, candidateGatewayBindings, classifyModelPrefix, createIntegrationKey, createNamedKey, defaultServerConfig, detectModelKind, detectRequestRole, effectiveOutboundPermissions, endpointToIngressFormat, formatUrls, gatewayBindingToEndpointConfig, getOutboundApiServer, handleVoucherRedeem, hashKey, isConcurrencyRejection, isKindMappedEndpoint, isRedeemRequest, isSerialQueueTimeout, isUserMessageRequest, legacyEndpointsToBindings, loadServerConfig, mergeServerConfig, modelKindsForEndpoint, normalizeAccountProbe, normalizeAllowanceScheduling, normalizeAudit, normalizeBilling, normalizeFingerprint, normalizeGatewayBindings, normalizeImagesServerConfig, normalizePrefixTargets, normalizeProxyConfig, normalizeProxySegment, normalizeQueueSegments, normalizeServerConfig, normalizeVoucher, normalizeWebhookDestination, normalizeWebhookSegment, randomBase62, resolveGatewayBinding, resolvePrefixTarget, saveServerConfig, validateEndpointModelConfig, validateImagesServerConfig, validateOutboundPermissions, verifyKey, verifyPresentedKey };

package/dist/outbound-api.js

@@ -6,10 +6,13 @@ import {
   DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
+  DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_OUTBOUND_PORT,
   DEFAULT_USER_MESSAGE_QUEUE,
+  IMAGE_SERVER_HARD_CEILINGS,
   KeySpendTracker,
   KeyedMutex,
+  LEGACY_OUTBOUND_PERMISSIONS,
   OUTBOUND_API_SERVER_CONFIG_KEY,
   OutboundApiServer,
   OutboundConcurrencyGate,
@@ -25,6 +28,7 @@ import {
   createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
+  effectiveOutboundPermissions,
   formatUrls,
   gatewayBindingToEndpointConfig,
   generateVoucherCode,
@@ -46,6 +50,7 @@ import {
   normalizeBilling,
   normalizeFingerprint,
   normalizeGatewayBindings,
+  normalizeImagesServerConfig,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -60,34 +65,39 @@ import {
   startOfLocalDay,
   startOfLocalWeek,
   toVoucherInfo,
+  validateImagesServerConfig,
+  validateOutboundPermissions,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-CQIJCPMF.js";
+} from "./chunk-WSJE42SG.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-WTQMX2Q6.js";
-import "./chunk-NGYOO5TO.js";
-import "./chunk-HKB656B4.js";
-import "./chunk-55FMGZ3L.js";
-import "./chunk-45FHEOKW.js";
+import "./chunk-EYGBM2VC.js";
+import "./chunk-DK4A7DLE.js";
+import "./chunk-FJNKXOWE.js";
+import "./chunk-V53ZEFXC.js";
+import "./chunk-7PIUVCKK.js";
+import "./chunk-6OC3ORW6.js";
 import "./chunk-FU7EAR73.js";
-import "./chunk-CCVRRJOX.js";
-import "./chunk-7VU7V2E4.js";
+import "./chunk-LFEH7CEO.js";
+import "./chunk-HN74IGEO.js";
+import "./chunk-QIIAMBTM.js";
 import "./chunk-FXR6N3SR.js";
-import "./chunk-UAPBLNN2.js";
-import "./chunk-WNKWAEUR.js";
+import "./chunk-AQDON6MB.js";
 import "./chunk-MZNPGW5Q.js";
-import "./chunk-DK4A7DLE.js";
-import "./chunk-XXFYLL7R.js";
+import "./chunk-ECZ3ZE2C.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
 import "./chunk-GFIZ6LQI.js";
 import "./chunk-OE6TDIWW.js";
 import "./chunk-DRWHTIIZ.js";
+import "./chunk-X335TJNS.js";
+import "./chunk-HOMUGKHR.js";
 import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
 import "./chunk-PO3XB56Z.js";
-import "./chunk-N7OOJI5V.js";
+import "./chunk-V2UKUTJ3.js";
 import "./chunk-23S5OPIO.js";
 import "./chunk-AVYJ4YBN.js";
 import "./chunk-OPRS4IQZ.js";
@@ -96,12 +106,19 @@ import {
   boundAccountSelectionMessage,
   isBoundAccountSelectionError
 } from "./chunk-2JYRIADS.js";
-import "./chunk-DE2SRBFZ.js";
-import "./chunk-ZY6KU6P3.js";
+import {
+  beginAuditCapture
+} from "./chunk-6OKXH2TW.js";
+import "./chunk-WNY4WMRF.js";
+import {
+  AUDIT_REDACTED,
+  redactAuditText
+} from "./chunk-N76KU6F5.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
 import "./chunk-TKJMZBAH.js";
+import "./chunk-OZFM4X3S.js";
 import "./chunk-3QFXFCHG.js";
 import {
   SUBSCRIPTION_PROVIDER_IDS,
@@ -118,34 +135,27 @@ import {
   resolvePrefixTarget,
   resolveRoute,
   validateEndpointModelConfig
-} from "./chunk-EBLFCNPY.js";
+} from "./chunk-U47LQXPB.js";
 import "./chunk-AQ5TNQB7.js";
 import {
   ENDPOINT_MODEL_KINDS
 } from "./chunk-XEKD23J5.js";
+import "./chunk-Y7FO65VT.js";
+import "./chunk-FMOBD2OQ.js";
+import "./chunk-HUZZZ3JL.js";
 import "./chunk-H5JUT3KV.js";
-import {
-  beginAuditCapture
-} from "./chunk-7C7DET6S.js";
-import {
-  AUDIT_REDACTED,
-  redactAuditText
-} from "./chunk-K5NM7VAH.js";
-import "./chunk-WNY4WMRF.js";
-import "./chunk-OZFM4X3S.js";
 import "./chunk-5NJLQ6T6.js";
-import "./chunk-2UTGX6FM.js";
-import "./chunk-S3DYFEBE.js";
+import "./chunk-4VVCXVB7.js";
+import "./chunk-R4VCO2CB.js";
 import "./chunk-WYVGULTQ.js";
-import "./chunk-N2EIM2XJ.js";
-import "./chunk-RJ5ZGNI3.js";
+import "./chunk-ZLNHPUFA.js";
+import "./chunk-CFSGYFOZ.js";
 import "./chunk-3WD4HTR2.js";
 import "./chunk-MKF46GNZ.js";
 import "./chunk-GL6XM527.js";
+import "./chunk-DEIUR2TH.js";
+import "./chunk-4JOU54M5.js";
 import "./chunk-CDHS2QDC.js";
-import "./chunk-Y7FO65VT.js";
-import "./chunk-FMOBD2OQ.js";
-import "./chunk-HUZZZ3JL.js";
 export {
   AUDIT_REDACTED,
   BoundAccountSelectionError,
@@ -156,11 +166,14 @@ export {
   DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
+  DEFAULT_IMAGES_SERVER_CONFIG,
   DEFAULT_OUTBOUND_PORT,
   DEFAULT_USER_MESSAGE_QUEUE,
   ENDPOINT_MODEL_KINDS,
+  IMAGE_SERVER_HARD_CEILINGS,
   KeySpendTracker,
   KeyedMutex,
+  LEGACY_OUTBOUND_PERMISSIONS,
   OUTBOUND_API_SERVER_CONFIG_KEY,
   OutboundApiServer,
   OutboundConcurrencyGate,
@@ -183,6 +196,7 @@ export {
   defaultServerConfig,
   detectModelKind,
   detectRequestRole,
+  effectiveOutboundPermissions,
   endpointSupportsSubscription,
   endpointToIngressFormat,
   formatUrls,
@@ -210,6 +224,7 @@ export {
   normalizeBilling,
   normalizeFingerprint,
   normalizeGatewayBindings,
+  normalizeImagesServerConfig,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -230,6 +245,8 @@ export {
   startOfLocalWeek,
   toVoucherInfo,
   validateEndpointModelConfig,
+  validateImagesServerConfig,
+  validateOutboundPermissions,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -1,30 +1,33 @@
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { a as AllowanceSchedulingConfig } from '../types-C2MwkLah.cjs';
+import { a as AllowanceSchedulingConfig } from '../types-jjU24eYG.cjs';
 import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
-import '@omnicross/contracts/account-tokens-types';
-import '@omnicross/contracts/audit-types';
-import '@omnicross/contracts/billing-types';
-import '@omnicross/contracts/health-logging-types';
-import '@omnicross/contracts/voucher-types';
-import '@omnicross/contracts/webhook-types';
-import '../logger-4GvQNzhE.cjs';
-import '../ports/provider-config-source.cjs';
-import '@omnicross/contracts/llm-config';
-import '../transformer/types.cjs';
-import '@omnicross/contracts/completion-types';
-import '../transformer/TransformerService.cjs';
-import '../ProviderProxy-QdwNV6l1.cjs';
-import '../provider-proxy/types.cjs';
+import '../types-CbglB73l.cjs';
+import '@omnicross/contracts/image-generation-types';
+import '../types-DsHBBk3h.cjs';
 import 'node:http';
+import '@omnicross/contracts/completion-types';
 import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';
+import '@omnicross/contracts/llm-config';
+import '../logger-4GvQNzhE.cjs';
 import './AuthSource.cjs';
 import './BoundAccountSelectionError.cjs';
 import './SubscriptionAuthSource.cjs';
 import './SubscriptionAuthStrategy.cjs';
+import '../ports/provider-config-source.cjs';
+import '../transformer/types.cjs';
+import '../transformer/TransformerService.cjs';
 import '../ports/web-search-backend.cjs';
 import '@omnicross/contracts/websearch-types';
+import 'node:fs/promises';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../ProviderProxy-CgIcCVwk.cjs';
 import '../keyPolicy-zdWTu3CQ.cjs';
 import '@omnicross/contracts/account-allowance-types';