aigetwey 1.1.0 → 1.3.0

package/dashboard/src/lib/cliTools.ts

@@ -55,20 +55,6 @@ export const CLI_TOOLS: CliTool[] = [
       "The gateway translates Anthropic ↔ provider format, so any provider works behind it.",
     ],
   },
-  {
-    id: "codex",
-    name: "Codex",
-    icon: "code",
-    format: "openai",
-    blurb: "OpenAI-compatible. Use the /v1 base URL.",
-    install: "npm i -g @openai/codex",
-    slots: [{ label: "Model", alias: "gpt-5" }],
-    env: (base, key) => [
-      { name: "OPENAI_BASE_URL", value: `${base}/v1` },
-      { name: "OPENAI_API_KEY", value: KEY(key) },
-    ],
-    steps: ["Set the base URL to the gateway's /v1 path.", "Create a combo named like the slot above, then use it as the model."],
-  },
   {
     id: "opencode",
     name: "opencode",
@@ -84,35 +70,6 @@ export const CLI_TOOLS: CliTool[] = [
     ],
     steps: ["Add an OpenAI-compatible provider with the gateway /v1 base URL.", "Pick a combo alias as the model."],
   },
-  {
-    id: "cursor",
-    name: "Cursor",
-    icon: "edit_square",
-    format: "openai",
-    blurb: "OpenAI-compatible. Override the base URL in settings.",
-    slots: [{ label: "Model", alias: "gpt-5" }],
-    env: (base, key) => [
-      { name: "Base URL", value: `${base}/v1` },
-      { name: "API Key", value: KEY(key) },
-    ],
-    steps: [
-      "Settings → Models → OpenAI API Key → override base URL with the gateway /v1.",
-      "Add your combo aliases as custom model names.",
-    ],
-  },
-  {
-    id: "cline",
-    name: "Cline",
-    icon: "extension",
-    format: "openai",
-    blurb: "OpenAI-compatible VS Code agent.",
-    slots: [{ label: "Model", alias: "gpt-5" }],
-    env: (base, key) => [
-      { name: "Base URL", value: `${base}/v1` },
-      { name: "API Key", value: KEY(key) },
-    ],
-    steps: ["Choose the OpenAI-compatible provider.", "Set the base URL to the gateway /v1 and use a combo alias."],
-  },
 ];
 
 export function toolById(id: string): CliTool | undefined {

package/dashboard/src/lib/client.ts

@@ -12,10 +12,11 @@ import type {
   EndpointPayload,
   HeadroomStatusReply,
   InjectLevel,
+  KeyUsageRow,
+  ModelsPayload,
   PingResult,
   PricingPayload,
   ProviderSnapshot,
-  QuotaSnapshot,
   WireFormat,
 } from "./gateway";
 
@@ -53,16 +54,20 @@ async function api<T>(method: string, path: string, body?: unknown): Promise<Api
 
 export const adminApi = {
   providers: () => api<{ providers: ProviderSnapshot[] }>("GET", "/admin/providers"),
-  quota: () => api<{ quota: QuotaSnapshot[]; budget: BudgetStatus | null }>("GET", "/admin/quota"),
+  budgets: () => api<{ budgets: BudgetStatus[] }>("GET", "/admin/budgets"),
+  models: () => api<ModelsPayload>("GET", "/admin/models"),
+  keys: () => api<Array<{ fingerprint: string; name: string; masked: string }>>("GET", "/admin/keys"),
+  keysUsage: () => api<{ keys: KeyUsageRow[] }>("GET", "/admin/keys/usage"),
+
   setBudget: (body: {
+    scope: { type: "global" } | { type: "provider"; id: string } | { type: "model"; id: string } | { type: "key"; id: string };
     unit: "usd" | "tokens";
     limit: number;
-    window: "5h" | "daily" | "weekly" | "monthly";
-    reset_at?: string;
-    timezone?: string;
+    window: "5h" | "24h" | "7day" | "30day";
     alert_at?: number;
-  }) => api<ConfigReply>("PUT", "/admin/budget", body),
-  clearBudget: () => api<ConfigReply>("DELETE", "/admin/budget"),
+    note?: string;
+  }) => api<ConfigReply>("PUT", "/admin/budgets", body),
+  clearBudget: (key: string) => api<ConfigReply>("DELETE", `/admin/budgets/${encodeURIComponent(key)}`),
 
   addProvider: (p: {
     id: string;
@@ -136,6 +141,8 @@ export const adminApi = {
   setPonytail: (level: InjectLevel) => api<ConfigReply>("PUT", "/admin/endpoint/ponytail", { level }),
   addServerKey: (key: string, name?: string) => api<ConfigReply>("POST", "/admin/endpoint/keys", { key, name }),
   editServerKey: (index: number, name: string) => api<ConfigReply>("PUT", `/admin/endpoint/keys/${index}`, { name }),
+  setServerKeyScope: (index: number, body: { models?: string[]; rpm?: number | null; expires?: number | null }) =>
+    api<ConfigReply>("PUT", `/admin/endpoint/keys/${index}/scope`, body),
   removeServerKey: (index: number) => api<ConfigReply>("DELETE", `/admin/endpoint/keys/${index}`),
   revealServerKey: (index: number) => api<{ key: string }>("GET", `/admin/endpoint/keys/${index}/reveal`),
 

package/dashboard/src/lib/gateway.ts

@@ -7,7 +7,7 @@ import { currentPassword } from "./session";
  * a Bearer token so it never reaches the browser.
  *
  * Scoped to the admin surface the gateway exposes today (usage, logs, providers,
- * quota, whole-config CRUD). Granular provider/combo mutation helpers are added
+ * budgets, whole-config CRUD). Granular provider/combo mutation helpers are added
  * alongside the pages that drive them in phase 11.
  */
 function gatewayUrl(): string {
@@ -67,7 +67,7 @@ export async function checkGatewayAuth(password: string): Promise<boolean> {
 
 export const gateway = {
   providers: () => call<{ providers: ProviderSnapshot[] }>("GET", "/admin/providers"),
-  quota: () => call<{ quota: QuotaSnapshot[]; budget: BudgetStatus | null }>("GET", "/admin/quota"),
+  budgets: () => call<{ budgets: BudgetStatus[] }>("GET", "/admin/budgets"),
   models: () => call<ModelsPayload>("GET", "/admin/models"),
   logs: (limit = 100) => call<{ logs: UsageLog[] }>("GET", `/admin/logs?limit=${limit}`),
   usage: (since = 0) => call<UsageSummary>("GET", `/admin/usage?since=${since}`),
@@ -157,7 +157,6 @@ export interface MaskedProvider {
   auto_models: boolean;
   service_account?: string;
   models: Array<{ id: string; price_in?: number; price_out?: number }>;
-  quota?: { window: "5h" | "daily" | "weekly" | "monthly"; reset_at?: string; timezone: string; limit_tokens?: number };
   cooldown_base_ms: number;
   max_retries: number;
   disabled_keys?: number[];
@@ -178,7 +177,26 @@ export interface EndpointPayload {
   caveman: InjectLevel;
   ponytail: InjectLevel;
   headroom: { enabled: boolean; url: string; compress_user_messages: boolean };
-  keys: Array<{ key: string; name?: string }>;
+  keys: Array<{ key: string; fingerprint: string; name?: string; models?: string[]; rpm?: number; expires?: number }>;
+}
+
+export interface KeyUsageRow {
+  fingerprint: string;
+  name: string;
+  masked: string;
+  expires?: number;
+  spent: number;
+  tokens: number;
+  budget: {
+    unit: "usd" | "tokens";
+    limit: number;
+    spent: number;
+    pct: number;
+    window: "5h" | "24h" | "7day" | "30day";
+    reset_in_ms: number;
+    exhausted: boolean;
+    alert: boolean;
+  } | null;
 }
 
 export interface HeadroomStatusReply {
@@ -233,27 +251,27 @@ export interface ProviderSnapshot {
   format: WireFormat;
   keys: KeySnapshot[];
 }
-export interface QuotaSnapshot {
-  provider: string;
-  window: "5h" | "daily" | "weekly" | "monthly";
-  consumed: number;
-  limit_tokens?: number;
-  reset_in_ms: number;
-  pct?: number;
-  exhausted: boolean;
-  alert: boolean;
-}
+export type BudgetScope =
+  | { type: "global" }
+  | { type: "provider"; id: string }
+  | { type: "model"; id: string }
+  | { type: "key"; id: string };
 
 export interface BudgetStatus {
+  scope: BudgetScope;
+  key: string;
+  label: string;
+  note?: string;
   unit: "usd" | "tokens";
   limit: number;
   spent: number;
   pct: number;
   alert: boolean;
+  alert_at: number;
   exhausted: boolean;
   est_converse: number | null;
   reset_in_ms: number;
-  window: "5h" | "daily" | "weekly" | "monthly";
+  window: "5h" | "24h" | "7day" | "30day";
 }
 export interface UsageLog {
   ts: number;

package/dashboard/src/{middleware.ts → proxy.ts}

@@ -5,11 +5,11 @@ import { openSession, SESSION_COOKIE } from "@/lib/session";
 /**
  * Gate every page and admin-proxy route behind a valid session. The login page
  * and the auth endpoints stay open; everything else redirects to /login (pages)
- * or 401s (api).
+ * or 401s (api). This is Next 16's `proxy` convention (formerly `middleware`).
  */
 const OPEN = ["/login", "/api/login", "/api/logout"];
 
-export function middleware(req: NextRequest): NextResponse {
+export function proxy(req: NextRequest): NextResponse {
   const { pathname } = req.nextUrl;
   if (OPEN.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
     return NextResponse.next();
@@ -30,8 +30,10 @@ export function middleware(req: NextRequest): NextResponse {
 }
 
 export const config = {
-  // run on everything except next internals and static assets
-  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
-  // session verification uses node:crypto, unsupported on the Edge runtime
-  runtime: "nodejs",
+  // run on everything except next internals and static assets. icon.svg is the
+  // App Router favicon — it must stay public, else the auth gate redirects it to
+  // /login and the browser tab shows no icon.
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|icon.svg).*)"],
+  // note: the proxy convention always runs on the Node.js runtime (no `runtime`
+  // key allowed), which is what our node:crypto session check needs anyway.
 };

package/dist/cli.js

@@ -14,7 +14,7 @@
  */
 import { spawn, execSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { existsSync, copyFileSync } from "node:fs";
+import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
@@ -57,21 +57,53 @@ const HELP = `
 `;
 const GATEWAY_PORT = opts.port ?? Number(process.env.AIGETWEY_PORT ?? 18080);
 const DASHBOARD_PORT = Number(process.env.DASHBOARD_PORT ?? 3000);
-// reuse env secrets if present, otherwise generate (admin) / random (session).
+// reuse env secrets if present, otherwise generate (admin) / persist (session).
 const adminPassword = process.env.AIGETWEY_ADMIN_PASSWORD ?? randomBytes(6).toString("hex");
-const sessionSecret = process.env.SESSION_SECRET ?? randomBytes(24).toString("hex");
 const generatedPw = !process.env.AIGETWEY_ADMIN_PASSWORD;
+/**
+ * The dashboard session cookie is signed+encrypted with SESSION_SECRET. A fresh
+ * random secret each boot would invalidate every cookie on restart — the symptom
+ * being "re-enter the password after a relaunch" — so persist a generated one to
+ * the data dir (alongside auth.json) and reuse it. An explicit env var wins.
+ */
+function loadOrCreateSessionSecret() {
+    if (process.env.SESSION_SECRET)
+        return process.env.SESSION_SECRET;
+    const dataDir = resolve(process.env.AIGETWEY_DATA_DIR ?? join(root, "data"));
+    const file = join(dataDir, "session-secret");
+    try {
+        const existing = readFileSync(file, "utf8").trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        // not created yet — fall through and generate.
+    }
+    const secret = randomBytes(24).toString("hex");
+    try {
+        mkdirSync(dataDir, { recursive: true });
+        writeFileSync(file, secret, { mode: 0o600 });
+    }
+    catch {
+        // unwritable data dir — fall back to an ephemeral secret (cookies won't
+        // survive this boot, but the gateway still runs).
+    }
+    return secret;
+}
+const sessionSecret = loadOrCreateSessionSecret();
 function openBrowser(url) {
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     spawn(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
 }
-async function waitForGateway(url, timeoutMs = 20000) {
+async function waitForGateway(url, timeoutMs = 20000, ready = (s) => s > 0) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
         try {
             const res = await fetch(url, { method: "GET" });
-            // any HTTP answer (even 401/503) means the port is up
-            if (res.status > 0)
+            // default: any HTTP answer (even 401/503) means the port is up. A caller
+            // can demand more — e.g. a non-5xx, to wait past a proxy's boot-time 502/500
+            // while the upstream it fronts is still coming up.
+            if (ready(res.status))
                 return true;
         }
         catch {
@@ -331,9 +363,12 @@ async function main() {
         process.exit(code ?? 1);
     });
     // one URL for everything — the gateway reverse-proxies the dashboard. Wait for
-    // the dashboard to answer THROUGH the proxy before opening the browser.
+    // the dashboard to be READY before opening the browser. Probe it directly on
+    // its own port (not through the proxy) and require a non-5xx answer: a proxy
+    // hit during boot returns 500 (ECONNREFUSED upstream), which a bare "port up"
+    // check would mistake for ready and open the browser into a wall of 500s.
     const appUrl = `http://127.0.0.1:${GATEWAY_PORT}`;
-    await waitForGateway(`${appUrl}/login`, 30000);
+    await waitForGateway(`http://127.0.0.1:${DASHBOARD_PORT}/login`, 30000, (s) => s > 0 && s < 500);
     console.log(`\n  aigetwey   ${appUrl}   (dashboard + API, one URL)`);
     if (generatedPw) {
         console.log(`\n  admin password (generated): ${adminPassword}`);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAU7C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,CAAC,GAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,cAAc;YAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;aAC3D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO;YAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;aAC9C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;aAChD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9C,MAAM,IAAI,GAAG;;;;;;;;;;;;;CAaZ,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC;AAC7E,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;AAElE,+EAA+E;AAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpF,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;AAEzD,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,SAAS,GAAG,KAAK;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,sDAAsD;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;AAEpC;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,CAAe,EAAE,MAAsB,SAAS;IAChE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,KAAK,QAAQ,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,KAAK,IAAI;QAClB,uBAAuB,IAAI,eAAe;QAC1C,gBAAgB,IAAI,2BAA2B;KAChD,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,SAAS,GAAG,0BAA0B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CACX,UAAU,IAAI,sCAAsC,GAAG,qBAAqB,MAAM,GAAG,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oCAAoC,GAAG,iBAAiB,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACtB,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI,EAAE,4DAA4D;QAC5E,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;YACnC,2EAA2E;YAC3E,iCAAiC;YACjC,uBAAuB,EAAE,MAAM,CAAC,cAAc,CAAC;SAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,2EAA2E;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QACxB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI,EAAE,gEAAgE;QAChF,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC;YAC5B,WAAW,EAAE,oBAAoB,YAAY,EAAE;YAC/C,cAAc,EAAE,aAAa;YAC7B,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,QAAQ,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAChE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,QAAQ,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,OAAO,CAAC,GAAG,CACT,kBAAkB;QAChB,kEAAkE;QAClE,8DAA8D;QAC9D,8DAA8D;QAC9D,cAAc,CACjB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,mBAAmB;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QAAC,eAAe,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE;QAC7E,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO;IAC5B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,KAAK,KAAK,CAAC;IAEnC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE7D,WAAW,EAAE,CAAC;IAEd,MAAM,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,mBAAmB,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,oBAAoB,YAAY,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrF,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,aAAa,IAAI,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,mBAAmB,CAAC,CAAC;QAChE,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,MAAM,GAAG,oBAAoB,YAAY,EAAE,CAAC;IAClD,MAAM,cAAc,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,+BAA+B,CAAC,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,aAAa,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CACT,OAAO;YACL,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,+FAA+F,CACpG,CAAC;IACJ,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,iCAAiC,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAU7C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,CAAC,GAAY,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,cAAc;YAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;aAC3D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO;YAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;aAC9C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;aAChD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9C,MAAM,IAAI,GAAG;;;;;;;;;;;;;CAaZ,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC;AAC7E,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;AAElE,gFAAgF;AAChF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,SAAS,yBAAyB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,kDAAkD;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;AAElD,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,SAAS,GAAG,KAAK,EACjB,QAAqC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC;IAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,yEAAyE;YACzE,6EAA6E;YAC7E,mDAAmD;YACnD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;AAEpC;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,CAAe,EAAE,MAAsB,SAAS;IAChE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,KAAK,QAAQ,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,KAAK,IAAI;QAClB,uBAAuB,IAAI,eAAe;QAC1C,gBAAgB,IAAI,2BAA2B;KAChD,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,QAAQ,CAAC,SAAS,GAAG,0BAA0B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CACX,UAAU,IAAI,sCAAsC,GAAG,qBAAqB,MAAM,GAAG,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oCAAoC,GAAG,iBAAiB,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACtB,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI,EAAE,4DAA4D;QAC5E,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;YACnC,2EAA2E;YAC3E,iCAAiC;YACjC,uBAAuB,EAAE,MAAM,CAAC,cAAc,CAAC;SAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,2EAA2E;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QACxB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI,EAAE,gEAAgE;QAChF,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC;YAC5B,WAAW,EAAE,oBAAoB,YAAY,EAAE;YAC/C,cAAc,EAAE,aAAa;YAC7B,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,QAAQ,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAChE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,QAAQ,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,OAAO,CAAC,GAAG,CACT,kBAAkB;QAChB,kEAAkE;QAClE,8DAA8D;QAC9D,8DAA8D;QAC9D,cAAc,CACjB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,mBAAmB;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QAAC,eAAe,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE;QAC7E,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO;IAC5B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,KAAK,KAAK,CAAC;IAEnC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE7D,WAAW,EAAE,CAAC;IAEd,MAAM,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,mBAAmB,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,oBAAoB,YAAY,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrF,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,aAAa,IAAI,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,mBAAmB,CAAC,CAAC;QAChE,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,oBAAoB,YAAY,EAAE,CAAC;IAClD,MAAM,cAAc,CAAC,oBAAoB,cAAc,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,+BAA+B,CAAC,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,aAAa,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CACT,OAAO;YACL,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,+FAA+F,CACpG,CAAC;IACJ,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,iCAAiC,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,QAAQ,EAAE,CAAC;IACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.js

@@ -2,24 +2,15 @@ import { readFileSync, writeFileSync, renameSync, copyFileSync, existsSync, mkdi
 import { dirname } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { z } from "zod";
+import { clientKeyFingerprint } from "./middleware/auth.js";
+export { clientKeyFingerprint } from "./middleware/auth.js";
 // ---- schema (PLAN §8) -------------------------------------------------------
 //
 // Shape differs from a flat OpenAI gateway: routing lives in a top-level
 // `models[]` layer (alias -> provider chain), the endpoint block carries the
 // token-saver toggles, and providers may be free passthroughs or service-account
-// backed. The handler/keypool/quota phases read these fields; defining the full
+// backed. The handler/keypool phases read these fields; defining the full
 // shape up front avoids reshaping config across later phases.
-/** Token quota window for a provider — drives the dashboard reset countdown. */
-const QuotaSchema = z.object({
-    window: z.enum(["5h", "daily", "weekly", "monthly"]),
-    // daily: "HH:MM" local reset; weekly: weekday name ("monday"); others: ignored.
-    reset_at: z.string().optional(),
-    timezone: z.string().default("UTC"),
-    // optional ceiling for a progress bar; quota tracking works without it.
-    limit_tokens: z.number().int().positive().optional(),
-    // soft-alert threshold (0..1); UI flags the quota when pct >= this. Default 0.8.
-    alert_at: z.number().gt(0).lte(1).optional(),
-});
 const ProviderModelSchema = z.object({
     id: z.string().min(1),
     price_in: z.number().nonnegative().optional(),
@@ -45,7 +36,6 @@ const ProviderSchema = z
     service_account: z.string().optional(),
     models: z.array(ProviderModelSchema).default([]),
     headers: z.record(z.string()).optional(),
-    quota: QuotaSchema.optional(),
     // when true the provider is skipped in routing (kept in config, like a key's
     // disabled state but for the whole provider).
     disabled: z.boolean().optional(),
@@ -102,20 +92,40 @@ const ServerSchema = z
     // optional friendly label per key, keyed by the key itself. Kept separate so
     // api_keys stays a plain string[] (auth/masking paths untouched).
     key_names: z.record(z.string()).optional(),
+    // per-key model allowlist (call-strings) + rate limit (req/min), keyed by the
+    // raw key like key_names. Absent → unrestricted / unlimited.
+    key_models: z.record(z.array(z.string().min(1))).optional(),
+    key_rpm: z.record(z.number().int().positive()).optional(),
+    // per-key access expiry, epoch ms, keyed by the RAW key. Absent → never expires.
+    key_expires: z.record(z.number().int().positive()).optional(),
 })
     .default({ host: "127.0.0.1", port: 18080, api_keys: [] });
 /**
- * Gateway-wide spend budget. unit picks what `limit` means — USD cost or total
- * tokens across every provider. Soft-alert at alert_at (default 0.8), hard-stop
- * at 100%. Window math reuses the quota calendar engine. Opt-in: omit to disable.
+ * A spend budget scoped to the whole gateway, one provider, or one upstream
+ * model. unit picks what `limit` means — USD cost or total tokens. Soft-alert at
+ * alert_at (default 0.8), hard-stop at 100%. Each window is a rolling tumbling
+ * bucket on the epoch grid (window.ts). Opt-in: omit / empty list to disable.
  */
+const BudgetScopeSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("global") }),
+    z.object({ type: z.literal("provider"), id: z.string().min(1) }),
+    z.object({ type: z.literal("model"), id: z.string().min(1) }),
+    z.object({ type: z.literal("key"), id: z.string().min(1) }),
+]);
+// rolling windows replaced the old calendar windows; coerce any legacy value so
+// existing config.yaml budgets keep loading (daily→24h, weekly→7day, monthly→30day).
+const LEGACY_WINDOW = { daily: "24h", weekly: "7day", monthly: "30day" };
+const WindowSchema = z.preprocess((v) => (typeof v === "string" && v in LEGACY_WINDOW ? LEGACY_WINDOW[v] : v), z.enum(["5h", "24h", "7day", "30day"]));
 const BudgetSchema = z.object({
+    scope: BudgetScopeSchema,
     unit: z.enum(["usd", "tokens"]),
     limit: z.number().positive(),
-    window: z.enum(["5h", "daily", "weekly", "monthly"]),
-    reset_at: z.string().optional(),
-    timezone: z.string().default("UTC"),
+    window: WindowSchema,
+    // epoch ms the recurring cycle is anchored to; stamped by setBudget on create.
+    anchor: z.number().int().nonnegative().optional(),
     alert_at: z.number().gt(0).lte(1).optional(),
+    // optional free-text label so an operator remembers what a budget is for.
+    note: z.string().max(200).optional(),
 });
 const ConfigSchema = z.object({
     server: ServerSchema,
@@ -123,7 +133,7 @@ const ConfigSchema = z.object({
     providers: z.array(ProviderSchema).default([]),
     // the routing layer. Each entry is a "combo": an alias + a provider chain.
     models: z.array(ModelRouteSchema).default([]),
-    budget: BudgetSchema.optional(),
+    budgets: z.array(BudgetSchema).default([]),
 });
 export class GatewayConfig {
     server;
@@ -236,6 +246,16 @@ export class GatewayConfig {
 }
 /** Validate an already-parsed config object. Throws with readable issues. */
 export function validateConfig(parsed) {
+    // migrate the legacy single `budget` (pre-scoped) into a global-scoped entry
+    // before zod runs — zod would otherwise strip the unknown `budget` key.
+    if (parsed && typeof parsed === "object") {
+        const raw = parsed;
+        if (raw.budget && !raw.budgets) {
+            const legacy = raw.budget;
+            raw.budgets = [{ scope: { type: "global" }, ...legacy }];
+        }
+        delete raw.budget;
+    }
     const result = ConfigSchema.safeParse(parsed ?? {});
     if (!result.success) {
         const issues = result.error.issues
@@ -700,17 +720,48 @@ export function setHeadroom(config, patch) {
     }
     return next;
 }
-// ---- global budget ---------------------------------------------------------
-/** Set (or replace) the gateway-wide spend budget. */
-export function setBudget(config, budget) {
+// ---- scoped budgets --------------------------------------------------------
+/** Stable identity key for a budget's scope. */
+export function budgetKey(scope) {
+    return scope.type === "global" ? "global" : `${scope.type}:${scope.id}`;
+}
+/** Add a budget, or replace the existing one with the same scope key. */
+export function setBudget(config, budget, now = Date.now()) {
+    if (budget.scope.type === "provider") {
+        const { id } = budget.scope;
+        if (!config.providers.some((p) => p.id === id)) {
+            throw new Error(`unknown provider "${id}" for budget scope`);
+        }
+    }
+    if (budget.scope.type === "key") {
+        const { id } = budget.scope;
+        if (!config.server.api_keys.some((k) => clientKeyFingerprint(k) === id)) {
+            throw new Error(`unknown API key fingerprint "${id}" for budget scope`);
+        }
+    }
     const next = cloneConfig(config);
-    next.budget = budget;
+    const key = budgetKey(budget.scope);
+    const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+    if (idx === -1) {
+        next.budgets.push({ ...budget, anchor: budget.anchor ?? now });
+    }
+    else {
+        const prev = next.budgets[idx];
+        // keep the running cycle on edit (preserve prev anchor as-is, including a
+        // legacy undefined = epoch grid, so editing a limit never resets spend);
+        // start a fresh cycle only when the window length actually changed.
+        const anchor = budget.anchor ?? (prev.window === budget.window ? prev.anchor : now);
+        next.budgets[idx] = { ...budget, anchor };
+    }
     return next;
 }
-/** Remove the gateway-wide budget (turns the feature off). */
-export function clearBudget(config) {
+/** Remove a budget by its scope key (global | provider:<id> | model:<id> | key:<fp>). */
+export function clearBudget(config, key) {
     const next = cloneConfig(config);
-    delete next.budget;
+    const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+    if (idx === -1)
+        throw new Error(`no budget with scope "${key}"`);
+    next.budgets.splice(idx, 1);
     return next;
 }
 /** Append a gateway-level api key clients must present on /v1/*, with a label. */
@@ -752,6 +803,64 @@ export function removeServerKey(config, index) {
     if (removed && next.server.key_names && removed in next.server.key_names) {
         delete next.server.key_names[removed];
     }
+    if (removed && next.server.key_models && removed in next.server.key_models) {
+        delete next.server.key_models[removed];
+        if (Object.keys(next.server.key_models).length === 0)
+            next.server.key_models = undefined;
+    }
+    if (removed && next.server.key_rpm && removed in next.server.key_rpm) {
+        delete next.server.key_rpm[removed];
+        if (Object.keys(next.server.key_rpm).length === 0)
+            next.server.key_rpm = undefined;
+    }
+    if (removed && next.server.key_expires && removed in next.server.key_expires) {
+        delete next.server.key_expires[removed];
+        if (Object.keys(next.server.key_expires).length === 0)
+            next.server.key_expires = undefined;
+    }
     return next;
 }
+/**
+ * Set or clear a gateway key's scopes (by index, since keys are masked in the
+ * API). `models`/`rpm` are each applied only when present in the patch; an empty
+ * list or null/0 clears that scope. Empty maps are pruned to undefined.
+ */
+export function setServerKeyScope(config, index, patch) {
+    const next = cloneConfig(config);
+    const keys = next.server.api_keys;
+    if (index < 0 || index >= keys.length)
+        throw new Error(`no gateway key at index ${index}`);
+    const key = keys[index];
+    if (patch.models !== undefined) {
+        const models = { ...(next.server.key_models ?? {}) };
+        const list = (patch.models ?? []).map((m) => m.trim()).filter(Boolean);
+        if (list.length > 0)
+            models[key] = list;
+        else
+            delete models[key];
+        next.server.key_models = Object.keys(models).length > 0 ? models : undefined;
+    }
+    if (patch.rpm !== undefined) {
+        const rpm = { ...(next.server.key_rpm ?? {}) };
+        if (patch.rpm && patch.rpm > 0)
+            rpm[key] = Math.floor(patch.rpm);
+        else
+            delete rpm[key];
+        next.server.key_rpm = Object.keys(rpm).length > 0 ? rpm : undefined;
+    }
+    if (patch.expires !== undefined) {
+        const exp = { ...(next.server.key_expires ?? {}) };
+        if (patch.expires && patch.expires > 0)
+            exp[key] = Math.floor(patch.expires);
+        else
+            delete exp[key];
+        next.server.key_expires = Object.keys(exp).length > 0 ? exp : undefined;
+    }
+    return next;
+}
+/** True when `rawKey` has an expiry set and `now` is strictly past it. */
+export function isKeyExpired(server, rawKey, now) {
+    const at = server.key_expires?.[rawKey];
+    return at !== undefined && now > at;
+}
 //# sourceMappingURL=config.js.map