aigetwey 1.1.0 → 1.3.0

package/dist/server.js

@@ -4,7 +4,6 @@ import { loadConfig } from "./config.js";
 import { registerRoutes } from "./routes/index.js";
 import { GatewayState } from "./core/state.js";
 import { UsageDB } from "./db.js";
-import { QuotaTracker } from "./core/quota.js";
 import { AuthStore } from "./core/authStore.js";
 import { consoleBuffer } from "./core/console-buffer.js";
 async function main() {
@@ -48,13 +47,8 @@ async function main() {
     // unified data dir (default ./data); usage tracking lives here.
     const dataDir = resolve(process.env.AIGETWEY_DATA_DIR ?? "data");
     const db = new UsageDB(join(dataDir, "usage.sqlite"));
-    // quota counts persist via the DB so a restart within a window keeps the budget.
-    const quota = new QuotaTracker(Date.now, {
-        load: () => db.loadQuota(),
-        save: (id, start, consumed) => db.saveQuota(id, start, consumed),
-    });
     // holder enables runtime config edits (hot-reload) from the dashboard.
-    const state = new GatewayState(configPath, config, quota, db);
+    const state = new GatewayState(configPath, config, db);
     // admin password lives in a hash store (seeded from the env on first run,
     // changeable at runtime from the dashboard).
     const auth = AuthStore.open(dataDir, process.env.AIGETWEY_ADMIN_PASSWORD);
@@ -71,6 +65,10 @@ async function main() {
             prefix: "/",
             // forward the whole HTTP surface the dashboard needs (pages + its API).
             httpMethods: ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"],
+            // forward WebSocket upgrades too, so `next dev`'s HMR socket works when the
+            // dashboard is proxied — this is what lets dev run single-URL on the gateway
+            // port like production. Harmless for the prebuilt prod dashboard (no socket).
+            websocket: true,
             // keep the ORIGINAL Host so Next builds redirects (e.g. → /login) against
             // the gateway's address, not the internal dashboard port.
             replyOptions: {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,iFAAiF;IACjF,kFAAkF;IAClF,4EAA4E;IAC5E,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,IAAY;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC1B,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsD,CAAC;oBAC/E,MAAM,GAAG,GACP,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;oBAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACzG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QACrE,0DAA0D;QAC1D,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IAEH,gEAAgE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAEtD,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE;QAC1B,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC;KACjE,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9D,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAE1E,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAErC,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACzD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE;YAChD,QAAQ,EAAE,oBAAoB,YAAY,EAAE;YAC5C,MAAM,EAAE,GAAG;YACX,wEAAwE;YACxE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC;YACzE,0EAA0E;YAC1E,0DAA0D;YAC1D,YAAY,EAAE;gBACZ,qBAAqB,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;aAClG;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAChG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,iFAAiF;IACjF,kFAAkF;IAClF,4EAA4E;IAC5E,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,IAAY;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC1B,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsD,CAAC;oBAC/E,MAAM,GAAG,GACP,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;oBAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACzG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;QACrE,0DAA0D;QAC1D,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IAEH,gEAAgE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAEtD,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAE1E,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAErC,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACzD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE;YAChD,QAAQ,EAAE,oBAAoB,YAAY,EAAE;YAC5C,MAAM,EAAE,GAAG;YACX,wEAAwE;YACxE,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC;YACzE,4EAA4E;YAC5E,6EAA6E;YAC7E,8EAA8E;YAC9E,SAAS,EAAE,IAAI;YACf,0EAA0E;YAC1E,0DAA0D;YAC1D,YAAY,EAAE;gBACZ,qBAAqB,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;aAClG;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAChG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/stream/openai-stream.js

@@ -16,7 +16,10 @@ export async function* streamToCanonical(events) {
 /** Lift vendor reasoning fields into the canonical `delta.reasoning`. */
 function normalize(chunk) {
     for (const choice of chunk.choices ?? []) {
+        // a finish_reason chunk carries no `delta`; skip it (and any delta-less choice).
         const d = choice.delta;
+        if (!d)
+            continue;
         if (d.reasoning === undefined) {
             const vendor = d["reasoning_content"] ?? d["reasoning"];
             if (vendor)

package/dist/stream/openai-stream.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai-stream.js","sourceRoot":"","sources":["../../src/stream/openai-stream.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,MAA+B;IACtE,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAS;QACzC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,SAAS,CAAC,MAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,KAAqB;IACtC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAyD,CAAC;QAC3E,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAI,CAAC,CAAC,mBAAmB,CAAwB,IAAK,CAAC,CAAC,WAAW,CAAwB,CAAC;YACxG,IAAI,MAAM;gBAAE,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,MAAqC;IAC9E,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"openai-stream.js","sourceRoot":"","sources":["../../src/stream/openai-stream.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,MAA+B;IACtE,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAS;QACzC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,SAAS,CAAC,MAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,KAAqB;IACtC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,iFAAiF;QACjF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAuE,CAAC;QACzF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAI,CAAC,CAAC,mBAAmB,CAAwB,IAAK,CAAC,CAAC,WAAW,CAAwB,CAAC;YACxG,IAAI,MAAM;gBAAE,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,MAAqC;IAC9E,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/upstream/client.js

@@ -57,6 +57,15 @@ function buildBody(provider, req, model, stream, thinkingIntent) {
     const adapter = adapterFor(provider.format);
     const upstreamReq = { ...req, model, stream };
     const out = adapter.requestFromCanonical(upstreamReq);
+    // OpenAI-compatible streams omit usage entirely unless you opt in — without this
+    // every streamed call through an openai-format provider logs 0 tokens in/out
+    // (anthropic/gemini report usage inline, so they're unaffected). Ask for the
+    // final usage chunk; the handler taps it for accounting. Preserve a usage opt-in
+    // the client already set.
+    if (stream && provider.format === "openai") {
+        const existing = (out.stream_options ?? {});
+        out.stream_options = { ...existing, include_usage: true };
+    }
     // Normalize thinking into THIS provider's native format, keyed by the upstream
     // model's capabilities. No-op for non-reasoning models. Runs per-attempt so each
     // provider in a fallback chain gets the right shape.

package/dist/upstream/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/upstream/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAuB,MAAM,kCAAkC,CAAC;AAStF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACzE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC/D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;KAC5B,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAe;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC5E,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAChB,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,MAAe,EACf,cAAsC;IAEtC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAqB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAA4B,CAAC;IACjF,+EAA+E;IAC/E,iFAAiF;IACjF,qDAAqD;IACrD,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,IAAqG;IAErG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAE/E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,0DAA0D;YAC1D,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,oBAAqB,CAAW,CAAC,OAAO,EAAE,CAAkB,CAAC;QAC1G,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,aAAa,GAAG,CAAC,UAAU,EAAE,CAAkB,CAAC;QAC7F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/upstream/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAuB,MAAM,kCAAkC,CAAC;AAStF;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACzE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC/D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;KAC5B,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,mBAAmB,CAAC,KAAK,YAAY,CAAC;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAe;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC5E,OAAO,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAChB,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,MAAe,EACf,cAAsC;IAEtC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAqB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAA4B,CAAC;IACjF,iFAAiF;IACjF,6EAA6E;IAC7E,6EAA6E;IAC7E,iFAAiF;IACjF,0BAA0B;IAC1B,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAC;QACvE,GAAG,CAAC,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,+EAA+E;IAC/E,iFAAiF;IACjF,qDAAqD;IACrD,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,GAAqB,EACrB,KAAa,EACb,IAAqG;IAErG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAE/E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,0DAA0D;YAC1D,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,oBAAqB,CAAW,CAAC,OAAO,EAAE,CAAkB,CAAC;QAC1G,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,aAAa,GAAG,CAAC,UAAU,EAAE,CAAkB,CAAC;QAC7F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;QAC5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,GAAuB;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aigetwey",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "type": "module",
-  "description": "Personal AI gateway — route, translate and track requests across Anthropic / OpenAI / Gemini-compatible providers, with a built-in dashboard.",
+  "description": "Personal AI gateway — route, translate and track requests across Anthropic and OpenAI-compatible providers, with a built-in dashboard.",
   "keywords": [
     "ai",
     "gateway",
@@ -10,7 +10,6 @@
     "proxy",
     "anthropic",
     "openai",
-    "gemini",
     "router",
     "claude",
     "dashboard"
@@ -29,7 +28,7 @@
     "node": ">=22"
   },
   "bin": {
-    "aigetwey": "./dist/cli.js"
+    "aigetwey": "dist/cli.js"
   },
   "files": [
     "dist",

package/src/cli.ts

@@ -14,7 +14,7 @@
  */
 import { spawn, execSync, type ChildProcess } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { existsSync, copyFileSync } from "node:fs";
+import { existsSync, copyFileSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
@@ -65,24 +65,57 @@ const HELP = `
 const GATEWAY_PORT = opts.port ?? Number(process.env.AIGETWEY_PORT ?? 18080);
 const DASHBOARD_PORT = Number(process.env.DASHBOARD_PORT ?? 3000);
 
-// reuse env secrets if present, otherwise generate (admin) / random (session).
+// reuse env secrets if present, otherwise generate (admin) / persist (session).
 const adminPassword = process.env.AIGETWEY_ADMIN_PASSWORD ?? randomBytes(6).toString("hex");
-const sessionSecret = process.env.SESSION_SECRET ?? randomBytes(24).toString("hex");
 const generatedPw = !process.env.AIGETWEY_ADMIN_PASSWORD;
 
+/**
+ * The dashboard session cookie is signed+encrypted with SESSION_SECRET. A fresh
+ * random secret each boot would invalidate every cookie on restart — the symptom
+ * being "re-enter the password after a relaunch" — so persist a generated one to
+ * the data dir (alongside auth.json) and reuse it. An explicit env var wins.
+ */
+function loadOrCreateSessionSecret(): string {
+  if (process.env.SESSION_SECRET) return process.env.SESSION_SECRET;
+  const dataDir = resolve(process.env.AIGETWEY_DATA_DIR ?? join(root, "data"));
+  const file = join(dataDir, "session-secret");
+  try {
+    const existing = readFileSync(file, "utf8").trim();
+    if (existing) return existing;
+  } catch {
+    // not created yet — fall through and generate.
+  }
+  const secret = randomBytes(24).toString("hex");
+  try {
+    mkdirSync(dataDir, { recursive: true });
+    writeFileSync(file, secret, { mode: 0o600 });
+  } catch {
+    // unwritable data dir — fall back to an ephemeral secret (cookies won't
+    // survive this boot, but the gateway still runs).
+  }
+  return secret;
+}
+const sessionSecret = loadOrCreateSessionSecret();
+
 function openBrowser(url: string): void {
   const cmd =
     process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   spawn(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
 }
 
-async function waitForGateway(url: string, timeoutMs = 20000): Promise<boolean> {
+async function waitForGateway(
+  url: string,
+  timeoutMs = 20000,
+  ready: (status: number) => boolean = (s) => s > 0,
+): Promise<boolean> {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
       const res = await fetch(url, { method: "GET" });
-      // any HTTP answer (even 401/503) means the port is up
-      if (res.status > 0) return true;
+      // default: any HTTP answer (even 401/503) means the port is up. A caller
+      // can demand more — e.g. a non-5xx, to wait past a proxy's boot-time 502/500
+      // while the upstream it fronts is still coming up.
+      if (ready(res.status)) return true;
     } catch {
       // not up yet
     }
@@ -349,9 +382,12 @@ async function main(): Promise<void> {
   });
 
   // one URL for everything — the gateway reverse-proxies the dashboard. Wait for
-  // the dashboard to answer THROUGH the proxy before opening the browser.
+  // the dashboard to be READY before opening the browser. Probe it directly on
+  // its own port (not through the proxy) and require a non-5xx answer: a proxy
+  // hit during boot returns 500 (ECONNREFUSED upstream), which a bare "port up"
+  // check would mistake for ready and open the browser into a wall of 500s.
   const appUrl = `http://127.0.0.1:${GATEWAY_PORT}`;
-  await waitForGateway(`${appUrl}/login`, 30000);
+  await waitForGateway(`http://127.0.0.1:${DASHBOARD_PORT}/login`, 30000, (s) => s > 0 && s < 500);
   console.log(`\n  aigetwey   ${appUrl}   (dashboard + API, one URL)`);
   if (generatedPw) {
     console.log(`\n  admin password (generated): ${adminPassword}`);

package/src/config.ts

@@ -9,27 +9,18 @@ import {
 import { dirname } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { z } from "zod";
+import { clientKeyFingerprint } from "./middleware/auth.js";
+
+export { clientKeyFingerprint } from "./middleware/auth.js";
 
 // ---- schema (PLAN §8) -------------------------------------------------------
 //
 // Shape differs from a flat OpenAI gateway: routing lives in a top-level
 // `models[]` layer (alias -> provider chain), the endpoint block carries the
 // token-saver toggles, and providers may be free passthroughs or service-account
-// backed. The handler/keypool/quota phases read these fields; defining the full
+// backed. The handler/keypool phases read these fields; defining the full
 // shape up front avoids reshaping config across later phases.
 
-/** Token quota window for a provider — drives the dashboard reset countdown. */
-const QuotaSchema = z.object({
-  window: z.enum(["5h", "daily", "weekly", "monthly"]),
-  // daily: "HH:MM" local reset; weekly: weekday name ("monday"); others: ignored.
-  reset_at: z.string().optional(),
-  timezone: z.string().default("UTC"),
-  // optional ceiling for a progress bar; quota tracking works without it.
-  limit_tokens: z.number().int().positive().optional(),
-  // soft-alert threshold (0..1); UI flags the quota when pct >= this. Default 0.8.
-  alert_at: z.number().gt(0).lte(1).optional(),
-});
-
 const ProviderModelSchema = z.object({
   id: z.string().min(1),
   price_in: z.number().nonnegative().optional(),
@@ -56,7 +47,6 @@ const ProviderSchema = z
     service_account: z.string().optional(),
     models: z.array(ProviderModelSchema).default([]),
     headers: z.record(z.string()).optional(),
-    quota: QuotaSchema.optional(),
     // when true the provider is skipped in routing (kept in config, like a key's
     // disabled state but for the whole provider).
     disabled: z.boolean().optional(),
@@ -117,21 +107,46 @@ const ServerSchema = z
     // optional friendly label per key, keyed by the key itself. Kept separate so
     // api_keys stays a plain string[] (auth/masking paths untouched).
     key_names: z.record(z.string()).optional(),
+    // per-key model allowlist (call-strings) + rate limit (req/min), keyed by the
+    // raw key like key_names. Absent → unrestricted / unlimited.
+    key_models: z.record(z.array(z.string().min(1))).optional(),
+    key_rpm: z.record(z.number().int().positive()).optional(),
+    // per-key access expiry, epoch ms, keyed by the RAW key. Absent → never expires.
+    key_expires: z.record(z.number().int().positive()).optional(),
   })
   .default({ host: "127.0.0.1", port: 18080, api_keys: [] });
 
 /**
- * Gateway-wide spend budget. unit picks what `limit` means — USD cost or total
- * tokens across every provider. Soft-alert at alert_at (default 0.8), hard-stop
- * at 100%. Window math reuses the quota calendar engine. Opt-in: omit to disable.
+ * A spend budget scoped to the whole gateway, one provider, or one upstream
+ * model. unit picks what `limit` means — USD cost or total tokens. Soft-alert at
+ * alert_at (default 0.8), hard-stop at 100%. Each window is a rolling tumbling
+ * bucket on the epoch grid (window.ts). Opt-in: omit / empty list to disable.
  */
+const BudgetScopeSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("global") }),
+  z.object({ type: z.literal("provider"), id: z.string().min(1) }),
+  z.object({ type: z.literal("model"), id: z.string().min(1) }),
+  z.object({ type: z.literal("key"), id: z.string().min(1) }),
+]);
+
+// rolling windows replaced the old calendar windows; coerce any legacy value so
+// existing config.yaml budgets keep loading (daily→24h, weekly→7day, monthly→30day).
+const LEGACY_WINDOW: Record<string, string> = { daily: "24h", weekly: "7day", monthly: "30day" };
+const WindowSchema = z.preprocess(
+  (v) => (typeof v === "string" && v in LEGACY_WINDOW ? LEGACY_WINDOW[v] : v),
+  z.enum(["5h", "24h", "7day", "30day"]),
+);
+
 const BudgetSchema = z.object({
+  scope: BudgetScopeSchema,
   unit: z.enum(["usd", "tokens"]),
   limit: z.number().positive(),
-  window: z.enum(["5h", "daily", "weekly", "monthly"]),
-  reset_at: z.string().optional(),
-  timezone: z.string().default("UTC"),
+  window: WindowSchema,
+  // epoch ms the recurring cycle is anchored to; stamped by setBudget on create.
+  anchor: z.number().int().nonnegative().optional(),
   alert_at: z.number().gt(0).lte(1).optional(),
+  // optional free-text label so an operator remembers what a budget is for.
+  note: z.string().max(200).optional(),
 });
 
 const ConfigSchema = z.object({
@@ -140,14 +155,14 @@ const ConfigSchema = z.object({
   providers: z.array(ProviderSchema).default([]),
   // the routing layer. Each entry is a "combo": an alias + a provider chain.
   models: z.array(ModelRouteSchema).default([]),
-  budget: BudgetSchema.optional(),
+  budgets: z.array(BudgetSchema).default([]),
 });
 
-export type Quota = z.infer<typeof QuotaSchema>;
 export type ProviderModel = z.infer<typeof ProviderModelSchema>;
 export type Provider = z.infer<typeof ProviderSchema>;
 export type ModelRoute = z.infer<typeof ModelRouteSchema>;
 export type EndpointSettings = z.infer<typeof EndpointSchema>;
+export type BudgetScope = z.infer<typeof BudgetScopeSchema>;
 export type Budget = z.infer<typeof BudgetSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
 
@@ -277,6 +292,16 @@ export class GatewayConfig {
 
 /** Validate an already-parsed config object. Throws with readable issues. */
 export function validateConfig(parsed: unknown): GatewayConfig {
+  // migrate the legacy single `budget` (pre-scoped) into a global-scoped entry
+  // before zod runs — zod would otherwise strip the unknown `budget` key.
+  if (parsed && typeof parsed === "object") {
+    const raw = parsed as Record<string, unknown>;
+    if (raw.budget && !raw.budgets) {
+      const legacy = raw.budget as Record<string, unknown>;
+      raw.budgets = [{ scope: { type: "global" }, ...legacy }];
+    }
+    delete raw.budget;
+  }
   const result = ConfigSchema.safeParse(parsed ?? {});
   if (!result.success) {
     const issues = result.error.issues
@@ -757,19 +782,49 @@ export function setHeadroom(
   return next;
 }
 
-// ---- global budget ---------------------------------------------------------
+// ---- scoped budgets --------------------------------------------------------
 
-/** Set (or replace) the gateway-wide spend budget. */
-export function setBudget(config: Config, budget: Budget): Config {
+/** Stable identity key for a budget's scope. */
+export function budgetKey(scope: BudgetScope): string {
+  return scope.type === "global" ? "global" : `${scope.type}:${scope.id}`;
+}
+
+/** Add a budget, or replace the existing one with the same scope key. */
+export function setBudget(config: Config, budget: Budget, now: number = Date.now()): Config {
+  if (budget.scope.type === "provider") {
+    const { id } = budget.scope;
+    if (!config.providers.some((p) => p.id === id)) {
+      throw new Error(`unknown provider "${id}" for budget scope`);
+    }
+  }
+  if (budget.scope.type === "key") {
+    const { id } = budget.scope;
+    if (!config.server.api_keys.some((k) => clientKeyFingerprint(k) === id)) {
+      throw new Error(`unknown API key fingerprint "${id}" for budget scope`);
+    }
+  }
   const next = cloneConfig(config);
-  next.budget = budget;
+  const key = budgetKey(budget.scope);
+  const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+  if (idx === -1) {
+    next.budgets.push({ ...budget, anchor: budget.anchor ?? now });
+  } else {
+    const prev = next.budgets[idx]!;
+    // keep the running cycle on edit (preserve prev anchor as-is, including a
+    // legacy undefined = epoch grid, so editing a limit never resets spend);
+    // start a fresh cycle only when the window length actually changed.
+    const anchor = budget.anchor ?? (prev.window === budget.window ? prev.anchor : now);
+    next.budgets[idx] = { ...budget, anchor };
+  }
   return next;
 }
 
-/** Remove the gateway-wide budget (turns the feature off). */
-export function clearBudget(config: Config): Config {
+/** Remove a budget by its scope key (global | provider:<id> | model:<id> | key:<fp>). */
+export function clearBudget(config: Config, key: string): Config {
   const next = cloneConfig(config);
-  delete next.budget;
+  const idx = next.budgets.findIndex((b) => budgetKey(b.scope) === key);
+  if (idx === -1) throw new Error(`no budget with scope "${key}"`);
+  next.budgets.splice(idx, 1);
   return next;
 }
 
@@ -807,5 +862,63 @@ export function removeServerKey(config: Config, index: number): Config {
   if (removed && next.server.key_names && removed in next.server.key_names) {
     delete next.server.key_names[removed];
   }
+  if (removed && next.server.key_models && removed in next.server.key_models) {
+    delete next.server.key_models[removed];
+    if (Object.keys(next.server.key_models).length === 0) next.server.key_models = undefined;
+  }
+  if (removed && next.server.key_rpm && removed in next.server.key_rpm) {
+    delete next.server.key_rpm[removed];
+    if (Object.keys(next.server.key_rpm).length === 0) next.server.key_rpm = undefined;
+  }
+  if (removed && next.server.key_expires && removed in next.server.key_expires) {
+    delete next.server.key_expires[removed];
+    if (Object.keys(next.server.key_expires).length === 0) next.server.key_expires = undefined;
+  }
   return next;
 }
+
+/**
+ * Set or clear a gateway key's scopes (by index, since keys are masked in the
+ * API). `models`/`rpm` are each applied only when present in the patch; an empty
+ * list or null/0 clears that scope. Empty maps are pruned to undefined.
+ */
+export function setServerKeyScope(
+  config: Config,
+  index: number,
+  patch: { models?: string[] | null; rpm?: number | null; expires?: number | null },
+): Config {
+  const next = cloneConfig(config);
+  const keys = next.server.api_keys;
+  if (index < 0 || index >= keys.length) throw new Error(`no gateway key at index ${index}`);
+  const key = keys[index]!;
+
+  if (patch.models !== undefined) {
+    const models = { ...(next.server.key_models ?? {}) };
+    const list = (patch.models ?? []).map((m) => m.trim()).filter(Boolean);
+    if (list.length > 0) models[key] = list;
+    else delete models[key];
+    next.server.key_models = Object.keys(models).length > 0 ? models : undefined;
+  }
+
+  if (patch.rpm !== undefined) {
+    const rpm = { ...(next.server.key_rpm ?? {}) };
+    if (patch.rpm && patch.rpm > 0) rpm[key] = Math.floor(patch.rpm);
+    else delete rpm[key];
+    next.server.key_rpm = Object.keys(rpm).length > 0 ? rpm : undefined;
+  }
+
+  if (patch.expires !== undefined) {
+    const exp = { ...(next.server.key_expires ?? {}) };
+    if (patch.expires && patch.expires > 0) exp[key] = Math.floor(patch.expires);
+    else delete exp[key];
+    next.server.key_expires = Object.keys(exp).length > 0 ? exp : undefined;
+  }
+
+  return next;
+}
+
+/** True when `rawKey` has an expiry set and `now` is strictly past it. */
+export function isKeyExpired(server: Config["server"], rawKey: string, now: number): boolean {
+  const at = server.key_expires?.[rawKey];
+  return at !== undefined && now > at;
+}

package/src/core/budget.ts

@@ -1,71 +1,124 @@
 /**
- * Gateway-wide spend budget, derived from the usage table (the single source of
- * truth) rather than a parallel counter. status() sums cost/tokens over the
- * current window and reports spent / pct / alert / exhausted, plus an estimate
- * in the OTHER unit from the window's blended rate. The result is cached for a
- * few seconds so the per-request hard-stop check stays one DB query per window.
+ * Scoped spend budgets, derived from the usage table (the single source of
+ * truth) rather than a parallel counter. Each budget targets the whole gateway,
+ * one provider, or one upstream model. statuses() computes every budget's spend
+ * over its window; the result list is cached a few seconds so the per-request
+ * hard-stop check stays cheap. blocks() answers "is a route to this
+ * provider/model barred by an exhausted budget?".
  */
-import type { Budget } from "../config.js";
-import { currentWindowStart, nextResetAt } from "./quota.js";
+import type { Budget, BudgetScope } from "../config.js";
+import { budgetKey } from "../config.js";
+import { currentWindowStart, nextResetAt } from "./window.js";
 
 export interface BudgetStatus {
+  scope: BudgetScope;
+  key: string;
+  label: string;
+  note?: string;
   unit: "usd" | "tokens";
   limit: number;
   spent: number;
   pct: number;
   alert: boolean;
+  alert_at: number;
   exhausted: boolean;
-  /** estimate in the converse unit (tokens if unit=usd, usd if unit=tokens); null when no usage yet */
   est_converse: number | null;
   reset_in_ms: number;
   window: Budget["window"];
 }
 
-interface SummaryReader {
-  summary(since: number): { total: { tokens_in: number; tokens_out: number; cost: number } };
+interface TotalsReader {
+  totals(sinceMs: number, filter?: { provider?: string; model?: string; client_key?: string }): {
+    tokens_in: number;
+    tokens_out: number;
+    cost: number;
+  };
+}
+
+function scopeLabel(scope: BudgetScope, keyName: (fp: string) => string): string {
+  if (scope.type === "global") return "Global";
+  if (scope.type === "key") return keyName(scope.id);
+  return scope.id;
+}
+
+function scopeFilter(scope: BudgetScope): { provider?: string; model?: string; client_key?: string } | undefined {
+  if (scope.type === "provider") return { provider: scope.id };
+  if (scope.type === "model") return { model: scope.id };
+  if (scope.type === "key") return { client_key: scope.id };
+  return undefined;
 }
 
 export class BudgetTracker {
-  private cached?: { at: number; status: BudgetStatus | null };
+  private cached?: { at: number; list: BudgetStatus[] };
 
   constructor(
-    private readonly getSpec: () => Budget | undefined,
-    private readonly db: SummaryReader,
+    private readonly getBudgets: () => Budget[],
+    private readonly db: TotalsReader,
     private readonly now: () => number = Date.now,
     private readonly cacheMs = 5000,
+    private readonly keyName: (fp: string) => string = (fp) => `key …${fp}`,
   ) {}
 
-  /** Flush the cached status — call after a config reload that may have changed the budget spec. */
   clearCache(): void {
     this.cached = undefined;
   }
 
-  status(): BudgetStatus | null {
+  statuses(): BudgetStatus[] {
     const t = this.now();
-    if (this.cached && t - this.cached.at < this.cacheMs) return this.cached.status;
-    const status = this.compute(t);
-    this.cached = { at: t, status };
-    return status;
+    if (this.cached && t - this.cached.at < this.cacheMs) return this.cached.list;
+    const list = this.getBudgets().map((b) => this.compute(b, t));
+    this.cached = { at: t, list };
+    return list;
+  }
+
+  globalStatus(): BudgetStatus | null {
+    return this.statuses().find((s) => s.scope.type === "global") ?? null;
+  }
+
+  /** First exhausted provider/model budget matching a route, or null. */
+  blocks(providerId: string, model: string): { exhausted: true; reset_in_ms: number } | null {
+    for (const s of this.statuses()) {
+      if (!s.exhausted) continue;
+      if (s.scope.type === "provider" && s.scope.id === providerId)
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+      if (s.scope.type === "model" && s.scope.id === model)
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+    }
+    return null;
+  }
+
+  /** The exhausted key-scoped budget for this fingerprint, or null. */
+  blocksKey(fp: string): { exhausted: true; reset_in_ms: number } | null {
+    for (const s of this.statuses()) {
+      if (s.exhausted && s.scope.type === "key" && s.scope.id === fp) {
+        return { exhausted: true, reset_in_ms: s.reset_in_ms };
+      }
+    }
+    return null;
   }
 
-  private compute(t: number): BudgetStatus | null {
-    const spec = this.getSpec();
-    if (!spec) return null;
+  private compute(spec: Budget, t: number): BudgetStatus {
     const windowStart = currentWindowStart(spec, t);
-    const total = this.db.summary(windowStart).total;
+    const total = this.db.totals(windowStart, scopeFilter(spec.scope));
     const tokens = total.tokens_in + total.tokens_out;
     const cost = total.cost;
-    const rate = tokens > 0 ? cost / tokens : undefined; // $/token, blended over the window
+    const rate = tokens > 0 ? cost / tokens : undefined;
     const spent = spec.unit === "usd" ? cost : tokens;
     const limit = spec.limit;
     const pct = limit > 0 ? Math.min(1, spent / limit) : 0;
+    const alertAt = spec.alert_at ?? 0.8;
     const est_converse = rate === undefined ? null : spec.unit === "usd" ? limit / rate : limit * rate;
     return {
+      scope: spec.scope,
+      key: budgetKey(spec.scope),
+      label: scopeLabel(spec.scope, this.keyName),
+      note: spec.note,
       unit: spec.unit,
       limit,
       spent,
       pct,
-      alert: pct >= (spec.alert_at ?? 0.8),
+      alert: pct >= alertAt,
+      alert_at: alertAt,
       exhausted: spent >= limit,
       est_converse,
       reset_in_ms: Math.max(0, nextResetAt(spec, windowStart, t) - t),

package/src/core/fallback.ts

@@ -32,8 +32,6 @@ export interface FallbackOpts {
   onAttempt?: (log: AttemptLog) => void;
   /** which key the pool handed out for the winning attempt (handler uses it for usage). */
   onServed?: (route: ResolvedRoute, key: string) => void;
-  /** when set, a provider this returns true for is skipped (quota exhausted). */
-  isExhausted?: (provider: ResolvedRoute["provider"]) => boolean;
   /** captured client thinking intent, applied per-attempt in the provider's format. */
   thinkingIntent?: ThinkingConfig | null;
 }
@@ -56,13 +54,6 @@ export async function executeWithFallback(
   for (const route of routes) {
     const { provider } = route;
 
-    // skip a provider whose token budget is spent for this window — like a key
-    // cooling down, but for the whole provider. Falls through to the next route.
-    if (opts.isExhausted?.(provider)) {
-      log({ provider: provider.id, model: route.model, outcome: "skip", detail: "quota exhausted" });
-      continue;
-    }
-
     const attempts = provider.max_retries + 1;
 
     for (let i = 0; i < attempts; i++) {