@omnicross/core 0.4.3 → 0.4.5

package/dist/{chunk-SWY2LTMR.js → chunk-L4L77G3X.js}

@@ -11,7 +11,7 @@ import {
 import {
   fetchWithAntigravityFailover,
   maybeAntigravityFailoverUrl
-} from "./chunk-K6J2RIEX.js";
+} from "./chunk-NDJSLJIA.js";
 import {
   GeminiTransformer
 } from "./chunk-OXBGNEYR.js";
@@ -40,10 +40,10 @@ import {
   streamSSEResponse
 } from "./chunk-VVEHS2LI.js";
 import {
-  DEFAULT_CODEX_CLI_HEADERS,
   codexAcceptHeader,
-  extractCodexClientHeaders
-} from "./chunk-M6PKXP6T.js";
+  extractCodexClientHeaders,
+  fillMissingCodexCliIdentity
+} from "./chunk-4LSZ7NFM.js";
 import {
   getSharedIdentityStore
 } from "./chunk-XTEI64OU.js";
@@ -53,7 +53,7 @@ import {
 } from "./chunk-XX6NQJMA.js";
 import {
   extractOpenCodeSessionHeader
-} from "./chunk-HRBXQ5AC.js";
+} from "./chunk-WYUXJKMK.js";
 import {
   NEVER_FORWARD_HEADERS,
   fillMissingHeaders,
@@ -147,19 +147,20 @@ import {
 } from "./chunk-5NJLQ6T6.js";
 import {
   getAntigravityProjectResolver
-} from "./chunk-EE7VP4O3.js";
+} from "./chunk-HQ7C3VB6.js";
 import {
+  extractReasoningIntent,
   resolveReasoningPlan
 } from "./chunk-ZLNHPUFA.js";
 import {
   fetchUpstream
-} from "./chunk-NTF7TLT7.js";
+} from "./chunk-LBIXTHP7.js";
 import {
   getSharedAccountAllowanceStore
 } from "./chunk-FYPKKMB3.js";
 import {
   getSharedAccountRouteActivity
-} from "./chunk-GL6XM527.js";
+} from "./chunk-TX7ZM4OI.js";
 import {
   DEFAULT_IMAGE_API_LIMITS,
   ImageGenerationError,
@@ -953,6 +954,21 @@ async function resolvePoolBoundKey(deps, providerId, provider, sessionId, prefer
   }
   return resolveApiKey(resolveProviderEndpoint(provider).apiKey);
 }
+function buildByoRouteActivityMeta(deps, providerId, sessionId) {
+  return {
+    providerId,
+    resolveKeyId: () => {
+      if (!sessionId) return void 0;
+      const pool = deps.apiKeyPool;
+      if (!pool || typeof pool.getKeyIdForSession !== "function") return void 0;
+      try {
+        return pool.getKeyIdForSession(providerId, sessionId) ?? void 0;
+      } catch {
+        return void 0;
+      }
+    }
+  };
+}
 
 // src/provider-proxy/providerProxyRouteMap.ts
 import { randomBytes } from "crypto";
@@ -1666,6 +1682,31 @@ function collectText(value) {
 function proxyProviderId(plan) {
   return plan.isSubscription ? plan.transformerProvider.name : "byo";
 }
+function buildAnthropicRouteActivity(plan, proxyAccountId, model, onRecorded) {
+  if (!plan.isSubscription) {
+    const routeSessionId = plan.byoSessionId || void 0;
+    return {
+      providerId: plan.byoActivity?.providerId ?? plan.transformerProvider.name,
+      credentialKind: "provider-key",
+      keyId: plan.byoActivity?.resolveKeyId(),
+      endpoint: "messages",
+      sessionKey: routeSessionId,
+      sessionSource: routeSessionId ? "route-session-id" : "none",
+      model,
+      onRecorded
+    };
+  }
+  return {
+    providerId: proxyProviderId(plan),
+    credentialKind: "subscription-account",
+    accountId: proxyAccountId,
+    endpoint: "messages",
+    sessionKey: plan.sessionKey,
+    sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
+    model,
+    onRecorded
+  };
+}
 async function runPipeline(anthropicBody, plan, reportSelection, signal, callerOpenCodeSession) {
   const executor = getSharedExecutor();
   const endpointTransformer = getAnthropicEndpointTransformer();
@@ -1715,15 +1756,14 @@ async function runPipeline(anthropicBody, plan, reportSelection, signal, callerO
         {
           providerId: proxyProviderId(plan),
           accountId: proxyAccountId,
-          routeActivity: plan.isSubscription ? {
-            endpoint: "messages",
-            sessionKey: plan.sessionKey,
-            sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
-            model: resolvedModel,
-            onRecorded: (record5) => {
+          routeActivity: buildAnthropicRouteActivity(
+            plan,
+            proxyAccountId,
+            resolvedModel,
+            (record5) => {
               activityRecordId = record5.id;
             }
-          } : void 0
+          )
         }
       ).then((r) => {
         rawStatus = r.status;
@@ -1786,15 +1826,14 @@ async function runSubscriptionSameFormatFetch(rawBody, plan, reportSelection, op
     {
       providerId: proxyProviderId(plan),
       accountId: proxyAccountId,
-      routeActivity: plan.isSubscription ? {
-        endpoint: "messages",
-        sessionKey: plan.sessionKey,
-        sessionSource: plan.sessionKey ? "content-fingerprint" : "none",
-        model: outboundModel,
-        onRecorded: (record5) => {
+      routeActivity: buildAnthropicRouteActivity(
+        plan,
+        proxyAccountId,
+        outboundModel,
+        (record5) => {
           activityRecordId = record5.id;
         }
-      } : void 0
+      )
     }
   );
   return {
@@ -2818,7 +2857,7 @@ async function resolveResponsesRouteProfile(route, deps, resolvedModel) {
 }
 async function buildResponsesCallPlan(route, deps, resolved, resolvedModel, isStream, sessionKey, sessionSource, requestHeaders, affinity) {
   if (route.authMode === "byo") {
-    return buildByoPlan(route, deps, resolved, resolvedModel, isStream, affinity);
+    return buildByoPlan(route, deps, resolved, resolvedModel, isStream, sessionKey, sessionSource, affinity);
   }
   return buildSubscriptionPlan2(
     route,
@@ -2832,7 +2871,7 @@ async function buildResponsesCallPlan(route, deps, resolved, resolvedModel, isSt
     affinity
   );
 }
-async function buildByoPlan(route, deps, resolved, resolvedModel, isStream, affinity) {
+async function buildByoPlan(route, deps, resolved, resolvedModel, isStream, sessionKey, sessionSource, affinity) {
   const providerId = route.providerId;
   const provider = resolved.provider;
   const affinityKeyId = affinity?.credential.kind === "byo-key" ? affinity.credential.id : void 0;
@@ -2883,7 +2922,11 @@ async function buildByoPlan(route, deps, resolved, resolvedModel, isStream, affi
     resolveCredential: () => {
       const keyId = route.sessionId && typeof deps.apiKeyPool?.getKeyIdForSession === "function" ? deps.apiKeyPool.getKeyIdForSession(providerId, route.sessionId) : null;
       return keyId ? { kind: "byo-key", id: keyId } : credential;
-    }
+    },
+    byoActivity: buildByoRouteActivityMeta(deps, providerId, route.sessionId),
+    byoSessionId: route.sessionId ?? null,
+    sessionKey,
+    sessionSource
   };
 }
 async function buildSubscriptionPlan2(route, deps, resolved, resolvedModel, isStream, sessionKey, sessionSource, requestHeaders, affinity) {
@@ -2985,6 +3028,32 @@ async function executeResponsesUpstream(body, plan, operation, signal) {
   }
   return result;
 }
+function buildResponsesRouteActivity(plan, accountId, actualModel, onRecorded) {
+  if (plan.proxyProviderId === "byo") {
+    const contentKey = plan.sessionKey?.trim() || void 0;
+    const routeSessionId = plan.byoSessionId || void 0;
+    return {
+      providerId: plan.byoActivity?.providerId ?? plan.providerIdentity,
+      credentialKind: "provider-key",
+      keyId: plan.byoActivity?.resolveKeyId(),
+      endpoint: "responses",
+      sessionKey: contentKey ?? routeSessionId,
+      sessionSource: contentKey ? plan.sessionSource ?? "none" : routeSessionId ? "route-session-id" : "none",
+      model: actualModel,
+      onRecorded
+    };
+  }
+  return {
+    providerId: plan.proxyProviderId,
+    credentialKind: "subscription-account",
+    accountId,
+    endpoint: "responses",
+    sessionKey: plan.sessionKey,
+    sessionSource: plan.sessionSource ?? "none",
+    model: actualModel,
+    onRecorded
+  };
+}
 async function applyPlanAuth(body, plan) {
   let accountId;
   let actualModel = plan.resolvedModel;
@@ -3004,13 +3073,14 @@ async function applyPlanAuth(body, plan) {
   });
   body.model = actualModel;
   plan.transformerProvider.models = [actualModel];
+  if (plan.proxyProviderId === "codex") body.store = false;
   return { headers, accountId, actualModel };
 }
 function decorateCodexHeaders(headers, plan) {
   if (plan.proxyProviderId !== "codex") return;
   fillMissingHeaders(headers, plan.callerClientHeaders ?? {});
-  fillMissingHeaders(headers, DEFAULT_CODEX_CLI_HEADERS);
   fillMissingHeaders(headers, { accept: codexAcceptHeader(plan.isStream) });
+  fillMissingCodexCliIdentity(headers);
 }
 async function runNative(body, plan, operation, signal) {
   throwIfResponsesAborted(signal);
@@ -3025,15 +3095,9 @@ async function runNative(body, plan, operation, signal) {
     {
       providerId: plan.proxyProviderId,
       accountId,
-      routeActivity: plan.proxyProviderId === "byo" ? void 0 : {
-        endpoint: "responses",
-        sessionKey: plan.sessionKey,
-        sessionSource: plan.sessionSource ?? "none",
-        model: actualModel,
-        onRecorded: (record5) => {
-          activityRecordId = record5.id;
-        }
-      }
+      routeActivity: buildResponsesRouteActivity(plan, accountId, actualModel, (record5) => {
+        activityRecordId = record5.id;
+      })
     }
   );
   return {
@@ -3078,15 +3142,9 @@ async function runReduced(body, plan, signal) {
         {
           providerId: plan.proxyProviderId,
           accountId,
-          routeActivity: plan.proxyProviderId === "byo" ? void 0 : {
-            endpoint: "responses",
-            sessionKey: plan.sessionKey,
-            sessionSource: plan.sessionSource ?? "none",
-            model: actualModel,
-            onRecorded: (record5) => {
-              activityRecordId = record5.id;
-            }
-          }
+          routeActivity: buildResponsesRouteActivity(plan, accountId, actualModel, (record5) => {
+            activityRecordId = record5.id;
+          })
         }
       );
       const upstream = plan.proxyProviderId === "antigravity" ? await fetchWithAntigravityFailover(url, send, signal) : await send(url);
@@ -4329,7 +4387,9 @@ async function buildByoPlan2(res, route, deps, resolvedModel, isStream) {
     isSubscription: false,
     provider,
     apiKey,
-    extendedContextEnabled: route.anthropicSdkHints?.extendedContext?.enabled ?? false
+    extendedContextEnabled: route.anthropicSdkHints?.extendedContext?.enabled ?? false,
+    byoActivity: buildByoRouteActivityMeta(deps, providerId, route.sessionId),
+    byoSessionId: route.sessionId ?? null
   };
 }
 async function runSameFormatFetch(bodyToSend, plan, options, keyOverride, urlOverride) {
@@ -4355,12 +4415,30 @@ async function runSameFormatFetch(bodyToSend, plan, options, keyOverride, urlOve
   headers["anthropic-version"] = callerVersion || DEFAULT_ANTHROPIC_VERSION;
   const url = urlOverride ?? buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
   console.info(`[ProviderProxy:anthropic] (same-format) -> ${url} model=${resolvedModel} stream=${isStream}`);
+  let activityRecordId;
   const response = await fetchUpstream(
     url,
     { method: "POST", headers, body: bodyToSend, signal: options.signal },
-    { providerId: "byo" }
+    {
+      providerId: "byo",
+      routeActivity: {
+        providerId: plan.byoActivity?.providerId ?? provider.name,
+        credentialKind: "provider-key",
+        // LIVE resolution: a pool rebind retry re-invokes this fetch, and the
+        // binding has already rotated, so the retried attempt attributes the
+        // NEW key. `keyOverride` is a key STRING (never recorded).
+        keyId: plan.byoActivity?.resolveKeyId(),
+        endpoint: "messages",
+        sessionKey: plan.byoSessionId || void 0,
+        sessionSource: plan.byoSessionId ? "route-session-id" : "none",
+        model: resolvedModel,
+        onRecorded: (record5) => {
+          activityRecordId = record5.id;
+        }
+      }
+    }
   );
-  return { response, rawStatus: response.status };
+  return { response, rawStatus: response.status, activityRecordId };
 }
 function resolveSameFormatBody(anthropicBody, rawBody, plan) {
   let originalModel;
@@ -4903,7 +4981,9 @@ async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
     resolvedModel,
     isStream,
     resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
-    upstreamUrl: byoUrl
+    upstreamUrl: byoUrl,
+    byoActivity: buildByoRouteActivityMeta(deps, providerId, route.sessionId),
+    byoSessionId: route.sessionId ?? null
   };
 }
 async function runPipeline2(geminiBody, plan) {
@@ -4934,7 +5014,18 @@ async function runPipeline2(geminiBody, plan) {
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: "byo" }
+        {
+          providerId: "byo",
+          routeActivity: {
+            providerId: plan.byoActivity?.providerId ?? transformerProvider.name,
+            credentialKind: "provider-key",
+            keyId: plan.byoActivity?.resolveKeyId(),
+            endpoint: "generateContent",
+            sessionKey: plan.byoSessionId || void 0,
+            sessionSource: plan.byoSessionId ? "route-session-id" : "none",
+            model: resolvedModel
+          }
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -5118,7 +5209,9 @@ async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
     resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
     upstreamUrl: byoUrl,
     proxyProviderId: "byo",
-    isSubscription: false
+    isSubscription: false,
+    byoActivity: buildByoRouteActivityMeta(deps, providerId, route.sessionId),
+    routeSessionId: route.sessionId ?? null
   };
 }
 async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream) {
@@ -5165,7 +5258,8 @@ async function buildSubscriptionPlan3(res, route, deps, resolvedModel, isStream)
     resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : typeof config.url === "string" ? config.url : upstreamUrl,
     upstreamUrl,
     proxyProviderId: providerId,
-    isSubscription: true
+    isSubscription: true,
+    routeSessionId: route.sessionId ?? null
   };
 }
 async function runPipeline3(chatBody, plan) {
@@ -5201,10 +5295,31 @@ async function runPipeline3(chatBody, plan) {
     },
     fetchFn: (url, headers, body) => {
       console.log(`[ProviderProxy:chat] -> ${url} model=${resolvedModel} stream=${isStream}`);
+      const sessionKey = plan.routeSessionId || void 0;
       return fetchUpstream(
         url,
         { method: "POST", headers, body: JSON.stringify(body) },
-        { providerId: plan.proxyProviderId, accountId: proxyAccountId }
+        {
+          providerId: plan.proxyProviderId,
+          accountId: proxyAccountId,
+          routeActivity: plan.isSubscription ? {
+            providerId: plan.proxyProviderId,
+            credentialKind: "subscription-account",
+            accountId: proxyAccountId,
+            endpoint: "chat",
+            sessionKey,
+            sessionSource: sessionKey ? "route-session-id" : "none",
+            model: resolvedModel
+          } : {
+            providerId: plan.byoActivity?.providerId ?? transformerProvider.name,
+            credentialKind: "provider-key",
+            keyId: plan.byoActivity?.resolveKeyId(),
+            endpoint: "chat",
+            sessionKey,
+            sessionSource: sessionKey ? "route-session-id" : "none",
+            model: resolvedModel
+          }
+        }
       ).then((r) => {
         rawStatus = r.status;
         return r;
@@ -5983,17 +6098,22 @@ function wildcardMatches(pattern, value) {
   const escaped = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join(".*");
   return new RegExp(`^${escaped}$`, "iu").test(value);
 }
-function resolveGatewayModelMapping(mappings, requestedModel) {
+function resolveGatewayModelMappingRow(mappings, requestedModel) {
   if (!nonBlank(requestedModel)) return void 0;
   const wanted = requestedModel.trim();
   const exact = (mappings ?? []).find(
     (mapping) => nonBlank(mapping.source) && !mapping.source.includes("*") && mapping.source.trim().toLocaleLowerCase() === wanted.toLocaleLowerCase()
   );
-  if (exact && nonBlank(exact.target)) return exact.target.trim();
+  if (exact && nonBlank(exact.target)) {
+    return { target: exact.target.trim(), effort: exact.effort };
+  }
   const wildcard = (mappings ?? []).find(
     (mapping) => nonBlank(mapping.source) && mapping.source.includes("*") && wildcardMatches(mapping.source.trim(), wanted)
   );
-  return wildcard && nonBlank(wildcard.target) ? wildcard.target.trim() : void 0;
+  return wildcard && nonBlank(wildcard.target) ? { target: wildcard.target.trim(), effort: wildcard.effort } : void 0;
+}
+function resolveGatewayModelMapping(mappings, requestedModel) {
+  return resolveGatewayModelMappingRow(mappings, requestedModel)?.target;
 }
 function routeCanServe(binding, requestedModel, role) {
   if (binding.modelMode === "passthrough") return nonBlank(requestedModel);
@@ -6067,9 +6187,11 @@ function gatewayBindingToEndpointConfig(binding, requestedModel) {
     useSubscription: target.kind !== "provider"
   };
   const usesGenericModelHandling = binding.modelMode === "passthrough" || Boolean(binding.modelMappings?.length);
-  const dynamicModel = binding.modelMode === "passthrough" ? requestedModel : resolveGatewayModelMapping(binding.modelMappings, requestedModel);
+  const winningMapping = binding.modelMode === "passthrough" ? void 0 : resolveGatewayModelMappingRow(binding.modelMappings, requestedModel);
+  const dynamicModel = binding.modelMode === "passthrough" ? requestedModel : winningMapping?.target;
   if (usesGenericModelHandling) {
     if (nonBlank(dynamicModel)) applySingleModel(config, binding, dynamicModel);
+    if (winningMapping?.effort) config.reasoningEffort = winningMapping.effort;
   } else if (isKindMappedEndpoint(binding.endpoint)) {
     config.modelMap = Object.fromEntries(
       Object.entries(binding.modelMap ?? {}).map(([kind, ref]) => [kind, targetRef(target, ref)])
@@ -8494,6 +8616,7 @@ function normalizeBindingTarget(raw) {
   }
   return null;
 }
+var MAPPING_EFFORT_MAX_LENGTH = 32;
 function normalizeGatewayModelMappings(raw) {
   if (!Array.isArray(raw)) return [];
   const mappings = [];
@@ -8503,7 +8626,9 @@ function normalizeGatewayModelMappings(raw) {
     const source = typeof value.source === "string" ? value.source.trim() : "";
     const target = typeof value.target === "string" ? value.target.trim() : "";
     if (!source || !target) continue;
-    mappings.push({ source, target });
+    const rawEffort = typeof value.effort === "string" ? value.effort.trim() : "";
+    const effort = rawEffort && rawEffort.length <= MAPPING_EFFORT_MAX_LENGTH ? rawEffort : void 0;
+    mappings.push(effort ? { source, target, effort } : { source, target });
   }
   return mappings;
 }
@@ -8795,6 +8920,61 @@ function deriveAuditSessionKey(body, headers = {}, options = {}) {
   return gateway.key;
 }
 
+// src/outbound-api/mappingEffortInjection.ts
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function hasOpenAiWireReasoningIntent(body) {
+  return extractReasoningIntent({
+    model: typeof body["model"] === "string" ? body["model"] : "",
+    reasoning: isPlainObject(body["reasoning"]) ? body["reasoning"] : void 0,
+    reasoning_effort: body["reasoning_effort"]
+  }) !== void 0;
+}
+function injectMappingEffortDefault(endpoint, effort, body) {
+  if (!effort) return false;
+  switch (endpoint) {
+    case "chat":
+      if (hasOpenAiWireReasoningIntent(body)) {
+        return false;
+      }
+      body["reasoning_effort"] = effort;
+      return true;
+    case "responses": {
+      if (hasOpenAiWireReasoningIntent(body)) {
+        return false;
+      }
+      const reasoning = body["reasoning"];
+      body["reasoning"] = {
+        ...isPlainObject(reasoning) ? reasoning : {},
+        effort
+      };
+      return true;
+    }
+    case "messages": {
+      if (body["thinking"] !== void 0) return false;
+      if (effort === "none") return false;
+      body["thinking"] = { type: "adaptive" };
+      const outputConfig = body["output_config"];
+      body["output_config"] = {
+        ...isPlainObject(outputConfig) ? outputConfig : {},
+        effort
+      };
+      return true;
+    }
+    case "gemini": {
+      const generationConfig = body["generationConfig"];
+      const config = isPlainObject(generationConfig) ? generationConfig : {};
+      if (config["thinkingConfig"] !== void 0) return false;
+      body["generationConfig"] = {
+        ...config,
+        thinkingConfig: { thinkingLevel: effort }
+      };
+      return true;
+    }
+  }
+}
+
 // src/outbound-api/outboundApiKeyAuth.ts
 import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 
@@ -8981,8 +9161,23 @@ function toVerifiedKey(row) {
   if (rateLimit) key.rateLimit = rateLimit;
   const modelRestriction = extractModelRestriction(row);
   if (modelRestriction) key.modelRestriction = modelRestriction;
+  const directTarget = extractBoundUpstream(row);
+  if (directTarget) key.boundUpstream = directTarget;
   return key;
 }
+function extractBoundUpstream(row) {
+  if (row.boundUpstream && typeof row.boundUpstream === "object") {
+    const target = row.boundUpstream;
+    if (target.kind === "provider" && typeof target.providerId === "string" && target.providerId || target.kind === "account-pool" && typeof target.providerId === "string" && target.providerId || target.kind === "account" && target.providerId && target.accountId || target.kind === "account-group" && target.providerId && target.group) {
+      return target;
+    }
+    return void 0;
+  }
+  if (typeof row.boundUpstreamProviderId === "string" && row.boundUpstreamProviderId) {
+    return { kind: "provider", providerId: row.boundUpstreamProviderId };
+  }
+  return void 0;
+}
 async function verifyKey(db, presentedKey, now = Date.now()) {
   if (!presentedKey) return { status: "invalid" };
   const trimmed = presentedKey.trim();
@@ -9908,7 +10103,102 @@ function resolveModelsShape(modelsShape, allowedEndpoints) {
   if (!allowedEndpoints || allowedEndpoints.length === 0) return "anthropic";
   return allowedEndpoints.includes("messages") ? "anthropic" : "openai";
 }
+var UPSTREAM_MODELS_TTL_MS = 6e4;
+var UPSTREAM_MODELS_NEGATIVE_TTL_MS = 5e3;
+var UPSTREAM_MODELS_TIMEOUT_MS = 1e4;
+var upstreamModelsCache = /* @__PURE__ */ new Map();
+var upstreamModelsInFlight = /* @__PURE__ */ new Map();
+function resolveProviderKeyLiteral(apiKey) {
+  if (!apiKey) return "";
+  if (apiKey.startsWith("$")) return process.env[apiKey.slice(1)] || "";
+  return apiKey;
+}
+function buildProviderModelsUrl(baseUrl, format) {
+  const base = baseUrl.trim().replace(/\/+$/, "");
+  if (!base) return null;
+  if (format === "google") {
+    return /\/models$/.test(base) ? base : `${base}/models`;
+  }
+  if (format === "anthropic") {
+    if (base.endsWith("/messages")) return `${base.slice(0, -"/messages".length)}/models`;
+    if (/\/v\d+$/.test(base)) return `${base}/models`;
+    return `${base}/v1/models`;
+  }
+  const completionSuffix = format === "openai-response" ? "/responses" : "/chat/completions";
+  const root = base.endsWith(completionSuffix) ? base.slice(0, -completionSuffix.length) : base;
+  if (root !== base || /\/v\d+$/.test(base)) return `${root}/models`;
+  return `${base}/v1/models`;
+}
+async function fetchUpstreamModelsUncached(provider) {
+  const format = resolveApiFormat(provider);
+  const url = buildProviderModelsUrl(provider.api_base_url ?? "", format);
+  if (!url) return [];
+  const headers = getProviderHeaders(provider, resolveProviderKeyLiteral(provider.api_key));
+  delete headers["Content-Type"];
+  headers["Accept"] = "application/json";
+  const response = await fetchUpstream(
+    url,
+    { method: "GET", headers, signal: AbortSignal.timeout(UPSTREAM_MODELS_TIMEOUT_MS) },
+    { providerId: "byo" }
+  );
+  if (!response.ok) return [];
+  const body = await response.json();
+  const fromData = Array.isArray(body?.data) ? body.data.map((entry) => typeof entry?.id === "string" ? entry.id.trim() : "").filter((id) => id !== "") : [];
+  if (fromData.length > 0) return fromData;
+  return Array.isArray(body?.models) ? body.models.map(
+    (entry) => typeof entry?.name === "string" ? entry.name.replace(/^models\//, "").trim() : ""
+  ).filter((id) => id !== "") : [];
+}
+async function discoverUpstreamModels(provider) {
+  const cached = upstreamModelsCache.get(provider.id);
+  if (cached) {
+    const ttl = cached.ok ? UPSTREAM_MODELS_TTL_MS : UPSTREAM_MODELS_NEGATIVE_TTL_MS;
+    if (Date.now() - cached.at < ttl) return cached.ids;
+    upstreamModelsCache.delete(provider.id);
+  }
+  const existing = upstreamModelsInFlight.get(provider.id);
+  if (existing) return existing;
+  const pending = (async () => {
+    let ids = [];
+    try {
+      ids = await fetchUpstreamModelsUncached(provider);
+    } catch {
+      ids = [];
+    }
+    upstreamModelsCache.set(provider.id, { at: Date.now(), ids, ok: ids.length > 0 });
+    return ids;
+  })();
+  upstreamModelsInFlight.set(provider.id, pending);
+  try {
+    return await pending;
+  } finally {
+    upstreamModelsInFlight.delete(provider.id);
+  }
+}
+async function passthroughProviderModelIds(llmConfig, providerId) {
+  const provider = await llmConfig.getProvider(providerId);
+  if (!provider) return [];
+  const configured = provider.models ?? [];
+  return configured.length > 0 ? configured : await discoverUpstreamModels(provider);
+}
 var ANTHROPIC_MODELS_CREATED_AT = (/* @__PURE__ */ new Date()).toISOString();
+function hasWildcardMapping(binding) {
+  return (binding.modelMappings ?? []).some(
+    (mapping) => mapping.source.includes("*") && mapping.target.trim() !== ""
+  );
+}
+async function pushTargetCatalog(llmConfig, target, push) {
+  if (target.kind === "provider") {
+    for (const id of await passthroughProviderModelIds(llmConfig, target.providerId)) {
+      push(id);
+    }
+  } else if (Object.prototype.hasOwnProperty.call(SUBSCRIPTION_MODEL_CATALOG, target.providerId)) {
+    for (const id of SUBSCRIPTION_MODEL_CATALOG[target.providerId]) {
+      push(id);
+    }
+  }
+}
+var MODEL_LIST_ENDPOINTS = ["chat", "responses", "messages", "gemini"];
 function parseModelsLimit(url) {
   const query = url?.split("?")[1];
   if (!query) return void 0;
@@ -9917,8 +10207,7 @@ function parseModelsLimit(url) {
   const n = Number.parseInt(raw, 10);
   return Number.isFinite(n) && n > 0 ? n : void 0;
 }
-async function writeModelsListAnthropic(res, llmConfig, config, apiKeyId, allowedEndpoints, limit) {
-  void allowedEndpoints;
+async function writeModelsListAnthropic(res, llmConfig, config, apiKeyId, allowedEndpoints, limit, directTarget) {
   const entries2 = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (id, displayName) => {
@@ -9932,29 +10221,37 @@ async function writeModelsListAnthropic(res, llmConfig, config, apiKeyId, allowe
     const modelId = ref ? parseModelRef(ref)?.modelId : void 0;
     return modelId ? `${name} (via ${modelId})` : void 0;
   };
-  for (const binding of candidateGatewayBindings(config.bindings, apiKeyId, "messages")) {
-    if (binding.modelMode === "passthrough") {
-      if (binding.target.kind === "provider") {
-        const provider = await llmConfig.getProvider(binding.target.providerId);
-        for (const id of provider?.models ?? []) push(id);
-      } else if (Object.prototype.hasOwnProperty.call(SUBSCRIPTION_MODEL_CATALOG, binding.target.providerId)) {
-        for (const id of SUBSCRIPTION_MODEL_CATALOG[binding.target.providerId]) {
-          push(id);
+  for (const endpoint of MODEL_LIST_ENDPOINTS) {
+    if (allowedEndpoints && !allowedEndpoints.includes(endpoint)) continue;
+    for (const binding of candidateGatewayBindings(config.bindings, apiKeyId, endpoint)) {
+      if (binding.modelMode === "passthrough") {
+        await pushTargetCatalog(llmConfig, binding.target, push);
+        continue;
+      }
+      if (binding.modelMappings?.length) {
+        for (const mapping of binding.modelMappings) {
+          const source = mapping.source.trim();
+          if (source === "" || source.includes("*")) continue;
+          push(source, viaLabel(source, mapping.target));
+        }
+        if (hasWildcardMapping(binding)) {
+          await pushTargetCatalog(llmConfig, binding.target, push);
+          for (const mapping of binding.modelMappings ?? []) {
+            if (!mapping.source.includes("*") || mapping.target.trim() === "") continue;
+            push(parseModelRef(mapping.target)?.modelId ?? mapping.target.trim());
+          }
         }
+        continue;
       }
-      continue;
-    }
-    if (binding.modelMappings?.length) {
-      for (const mapping of binding.modelMappings) {
-        const source = mapping.source.trim();
-        if (source === "" || source.includes("*")) continue;
-        push(source, viaLabel(source, mapping.target));
+      for (const [kind, ref] of Object.entries(binding.modelMap ?? {})) {
+        if (typeof ref !== "string" || ref.trim() === "") continue;
+        push(kind, viaLabel(kind, ref));
       }
-      continue;
     }
-    for (const [kind, ref] of Object.entries(binding.modelMap ?? {})) {
-      if (typeof ref !== "string" || ref.trim() === "") continue;
-      push(kind, viaLabel(kind, ref));
+  }
+  if (directTarget?.kind === "provider") {
+    for (const id of await passthroughProviderModelIds(llmConfig, directTarget.providerId)) {
+      push(id);
     }
   }
   const limited = limit !== void 0 ? entries2.slice(0, limit) : entries2;
@@ -9996,29 +10293,172 @@ function handleOauthUsageProxy(res, config, apiKeyId) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-async function writeModelsList(res, llmConfig, config, apiKeyId, allowedEndpoints, imageModels = []) {
+function directUpstreamRoot(baseUrl, format) {
+  const base = baseUrl.trim().replace(/\/+$/, "");
+  if (!base) return null;
+  if (format === "google") return base.replace(/\/models$/, "");
+  if (format === "anthropic") return base.replace(/\/messages$/, "");
+  if (format === "openai-response") return base.replace(/\/responses$/, "");
+  return base.replace(/\/chat\/completions$/, "");
+}
+function directUpstreamUrl(provider, requestUrl) {
+  const root = directUpstreamRoot(
+    provider.api_base_url ?? "",
+    resolveApiFormat(provider)
+  );
+  if (!root) return null;
+  const raw = requestUrl ?? "/";
+  const queryIndex = raw.indexOf("?");
+  const path = (queryIndex >= 0 ? raw.slice(0, queryIndex) : raw) || "/";
+  const query = queryIndex >= 0 ? raw.slice(queryIndex) : "";
+  const versionSegment = /\/v\d+[a-z]*$/.exec(root)?.[0];
+  let tail = path;
+  if (versionSegment) {
+    if (path === versionSegment) tail = "";
+    else if (path.startsWith(`${versionSegment}/`)) tail = path.slice(versionSegment.length);
+  }
+  return `${root}${tail}${query}`;
+}
+function directUpstreamBinding(target, apiKeyId, priority = 1e3) {
+  return {
+    id: `direct:${apiKeyId}`,
+    name: "direct upstream",
+    enabled: true,
+    keyScope: "selected",
+    apiKeyIds: [apiKeyId],
+    endpoint: "messages",
+    target,
+    priority,
+    fallback: "fail",
+    modelMode: "passthrough"
+  };
+}
+async function relayDirectUpstream(req, res, deps, verified, config, concurrencyGate, audit, preReadBody) {
+  const direct = verified.boundUpstream;
+  const providerId = direct?.kind === "provider" ? direct.providerId : "";
+  const provider = await deps.llmConfig.getProvider(providerId);
+  if (!provider) {
+    writeJsonError(
+      res,
+      503,
+      `direct upstream provider '${providerId}' is not configured for this key`
+    );
+    return;
+  }
+  const url = directUpstreamUrl(provider, req.url);
+  if (!url) {
+    writeJsonError(res, 503, `direct upstream provider '${providerId}' has no base URL`);
+    return;
+  }
+  const concurrencyLimit = verified.maxConcurrency;
+  let releaseConcurrency = null;
+  if (typeof concurrencyLimit === "number" && concurrencyLimit > 0) {
+    const cq = config.concurrencyQueue ?? DEFAULT_CONCURRENCY_QUEUE;
+    const acquisition = concurrencyGate.acquire(verified.id, concurrencyLimit, {
+      maxQueueSizeFactor: cq.maxQueueSizeFactor,
+      minQueueSize: cq.minQueueSize,
+      waitTimeoutMs: cq.waitTimeoutMs
+    });
+    const cancelOnClose = () => acquisition.cancel();
+    res.once("close", cancelOnClose);
+    let slot;
+    try {
+      slot = await acquisition.granted;
+    } catch (err) {
+      res.removeListener("close", cancelOnClose);
+      if (isConcurrencyRejection(err)) {
+        writeJsonError(res, 429, "Concurrency limit exceeded", { "Retry-After": "5" });
+        return;
+      }
+      throw err;
+    }
+    res.removeListener("close", cancelOnClose);
+    const release2 = () => slot.release();
+    releaseConcurrency = release2;
+    res.once("close", release2);
+  }
+  try {
+    const rawBody = preReadBody !== void 0 ? preReadBody : await readBody3(req);
+    if (audit) {
+      audit.setRequestBody(rawBody);
+      try {
+        audit.sessionKey = deriveAuditSessionKey(
+          rawBody ? JSON.parse(rawBody) : {},
+          req.headers,
+          { fallbackKey: verified.id, endpoint: "direct" }
+        );
+      } catch {
+      }
+    }
+    const headers = getProviderHeaders(provider, resolveProviderKeyLiteral(provider.api_key));
+    delete headers["Content-Type"];
+    const clientContentType = req.headers["content-type"];
+    if (typeof clientContentType === "string" && clientContentType) {
+      headers["Content-Type"] = clientContentType;
+    }
+    const clientAccept = req.headers["accept"];
+    if (typeof clientAccept === "string" && clientAccept) headers["Accept"] = clientAccept;
+    const hasRequestBody = req.method !== "GET" && req.method !== "HEAD";
+    const upstream = await fetchUpstream(
+      url,
+      {
+        method: req.method ?? "GET",
+        headers,
+        ...hasRequestBody ? { body: rawBody } : {},
+        // Client hang-up aborts the upstream call (no egress after cancel).
+        signal: requestLifecycleSignal(req, res)
+      },
+      { providerId: "byo" }
+    );
+    if (audit) audit.provider = provider.id;
+    const responseHeaders = {};
+    const contentType = upstream.headers.get("content-type");
+    if (contentType) responseHeaders["Content-Type"] = contentType;
+    res.writeHead(upstream.status, responseHeaders);
+    if (!upstream.body) {
+      res.end();
+      return;
+    }
+    const bodyStream = Readable2.fromWeb(
+      upstream.body
+    );
+    bodyStream.on("error", () => {
+      res.destroy();
+    });
+    bodyStream.pipe(res);
+    await new Promise((resolve) => {
+      res.once("close", resolve);
+    });
+  } catch (err) {
+    const message = serializeError(err);
+    if (deps.logger) deps.logger.error("[OutboundApi] direct relay error:", message);
+    else console.error("[OutboundApi] direct relay error:", message);
+    emitWebhookEvent({ kind: "server.error", at: Date.now(), message });
+    if (audit) audit.error = message;
+    if (!res.headersSent) writeJsonError(res, 502, message);
+    else res.destroy();
+  }
+}
+async function writeModelsList(res, llmConfig, config, apiKeyId, allowedEndpoints, imageModels = [], directTarget) {
   const modelIds = [];
-  for (const endpoint of ["chat", "responses", "messages", "gemini"]) {
+  for (const endpoint of MODEL_LIST_ENDPOINTS) {
     if (allowedEndpoints && !allowedEndpoints.includes(endpoint)) continue;
     for (const binding of candidateGatewayBindings(config.bindings, apiKeyId, endpoint)) {
       if (binding.modelMode === "passthrough") {
-        if (binding.target.kind === "provider") {
-          const provider = await llmConfig.getProvider(binding.target.providerId);
-          modelIds.push(...provider?.models ?? []);
-        } else if (Object.prototype.hasOwnProperty.call(
-          SUBSCRIPTION_MODEL_CATALOG,
-          binding.target.providerId
-        )) {
-          modelIds.push(
-            ...SUBSCRIPTION_MODEL_CATALOG[binding.target.providerId]
-          );
-        }
+        await pushTargetCatalog(llmConfig, binding.target, (id) => modelIds.push(id));
         continue;
       }
       if (binding.modelMappings?.length) {
         modelIds.push(
           ...binding.modelMappings.map((mapping) => mapping.source.trim()).filter((source) => source !== "" && !source.includes("*"))
         );
+        if (hasWildcardMapping(binding)) {
+          await pushTargetCatalog(llmConfig, binding.target, (id) => modelIds.push(id));
+          for (const mapping of binding.modelMappings ?? []) {
+            if (!mapping.source.includes("*") || mapping.target.trim() === "") continue;
+            modelIds.push(parseModelRef(mapping.target)?.modelId ?? mapping.target.trim());
+          }
+        }
         continue;
       }
       const endpointConfig = gatewayBindingToEndpointConfig(binding);
@@ -10035,6 +10475,9 @@ async function writeModelsList(res, llmConfig, config, apiKeyId, allowedEndpoint
       );
     }
   }
+  if (directTarget?.kind === "provider") {
+    modelIds.push(...await passthroughProviderModelIds(llmConfig, directTarget.providerId));
+  }
   modelIds.push(...imageModels);
   const seen = /* @__PURE__ */ new Set();
   const data = modelIds.filter((modelId) => {
@@ -10129,6 +10572,16 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     });
     return;
   }
+  const directProvider = verified.boundUpstream?.kind === "provider" ? verified.boundUpstream : null;
+  if (verified.boundUpstream && !directProvider) {
+    config = {
+      ...config,
+      bindings: [
+        ...config.bindings ?? [],
+        directUpstreamBinding(verified.boundUpstream, verified.id, 1e3)
+      ]
+    };
+  }
   if (isOauthUsagePath) {
     if (req.method !== "GET") {
       writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
@@ -10192,7 +10645,8 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
         config,
         verified.id,
         verified.allowedEndpoints,
-        parseModelsLimit(req.url)
+        parseModelsLimit(req.url),
+        verified.boundUpstream
       );
     } else {
       let imageModels = [];
@@ -10208,21 +10662,26 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
         config,
         verified.id,
         verified.allowedEndpoints,
-        imageModels
+        imageModels,
+        verified.boundUpstream
       );
     }
     return;
   }
   const endpoint = selectEndpoint(req.method, req.url);
   if (!endpoint) {
+    if (directProvider) {
+      await relayDirectUpstream(req, res, deps, verified, config, concurrencyGate, audit);
+      return;
+    }
     writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
     return;
   }
-  if (verified.allowedEndpoints && !verified.allowedEndpoints.includes(endpoint)) {
+  if (verified.allowedEndpoints && !verified.boundUpstream && !verified.allowedEndpoints.includes(endpoint)) {
     writeJsonError(res, 403, "API key is not allowed to access this endpoint");
     return;
   }
-  if (candidateGatewayBindings(config.bindings, verified.id, endpoint).length === 0) {
+  if (candidateGatewayBindings(config.bindings, verified.id, endpoint).length === 0 && !directProvider) {
     writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
     return;
   }
@@ -10316,22 +10775,31 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       role
     });
     if (bindingResolution.source === "none") {
+      if (directProvider) {
+        await relayDirectUpstream(req, res, deps, verified, config, concurrencyGate, audit, rawBody);
+        return;
+      }
       writeJsonError(res, 503, `endpoint '${endpoint}' has no downstream route for this key`);
       return;
     }
     const effectiveEndpointConfig = bindingResolution.config;
     const bindingAffinitySuffix = `:${bindingResolution.binding.id}`;
     const sessionId = deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}${bindingAffinitySuffix}` : null;
+    let replayBody = rawBody;
+    if (!isCountTokens && effectiveEndpointConfig.reasoningEffort && injectMappingEffortDefault(endpoint, effectiveEndpointConfig.reasoningEffort, parsedBody)) {
+      replayBody = JSON.stringify(parsedBody);
+    }
     const hostedImageGenerationAllowed = verified.allowedEndpoints.includes("images");
+    const listResolvedModel = endpoint === "chat" && bindingResolution.binding.modelMode === "mapped" ? resolveGatewayModelMappingRow(bindingResolution.binding.modelMappings, requestedModel)?.target ?? requestedModel : requestedModel;
     const resolved = isKindMappedEndpoint(endpoint) || endpoint === "chat" ? await resolveRoute({
       config: effectiveEndpointConfig,
       ingressFormat,
       llmConfig: deps.llmConfig,
       sessionId,
-      // Capture the ORIGINAL requested id BEFORE any downstream swap; for
-      // kind-mapped endpoints it selects the kind AND is stamped onto
-      // `route.requestedModel`; for chat it is matched against the list.
-      requestedModel,
+      // The id the route resolves against: the client's ORIGINAL id for
+      // kind-mapped endpoints (it selects the kind AND is stamped onto
+      // `route.requestedModel`), the mapping-resolved target for chat.
+      requestedModel: listResolvedModel,
       // Attribution: stamp the verified named-key id onto the route.
       apiKeyId: verified.id,
       hostedImageGenerationAllowed
@@ -10346,6 +10814,10 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
       hostedImageGenerationAllowed
     });
     if (!resolved.ok) {
+      if (directProvider) {
+        await relayDirectUpstream(req, res, deps, verified, config, concurrencyGate, audit, rawBody);
+        return;
+      }
       writeJsonError(res, resolved.error.status, resolved.error.message);
       return;
     }
@@ -10407,7 +10879,7 @@ async function handleOutboundRequest(req, res, deps, config, rateLimiter, serial
     );
     try {
       shimAuthHeader(req, token);
-      const replay = makeReplayRequest(req, rawBody);
+      const replay = makeReplayRequest(req, replayBody);
       await routeRequest(replay, res, routeMap, deps.proxyDeps);
     } catch (err) {
       if (isBoundAccountSelectionError(err)) {
@@ -13108,6 +13580,7 @@ export {
   writeError,
   writeBoundAccountError,
   resolvePoolBoundKey,
+  buildByoRouteActivityMeta,
   DEFAULT_ROUTE_IDLE_MS,
   ProviderProxyRouteMap,
   previousResponseNotFound,
@@ -13187,6 +13660,7 @@ export {
   loadServerConfig,
   saveServerConfig,
   mergeServerConfig,
+  injectMappingEffortDefault,
   computeKeyExpiry,
   checkKeyQuota,
   randomBase62,