omnigateway 0.1.4 → 0.1.6

package/gateway.js

@@ -5295,35 +5295,6 @@ function createAdminAuth(store, opts) {
     }
   };
 }
-// packages/control/src/config.ts
-var MIN_KEY_LENGTH = 16;
-var DECIMAL_INTEGER = /^\d+$/;
-function optionalText(value, fallback) {
-  return value?.trim() || fallback;
-}
-function loadConfig(env) {
-  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
-  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
-    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
-  }
-  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
-  const rawPort = env.OMNI_PORT ?? "9000";
-  const port = Number(rawPort);
-  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
-  }
-  const derivedBaseUrl = `http://${host}:${port}`;
-  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
-  const staticDir = env.OMNI_STATIC_DIR?.trim();
-  return {
-    port,
-    host,
-    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
-    encryptionKey,
-    baseUrl,
-    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir
-  };
-}
 // packages/ir/src/capabilities.ts
 var PROVIDER_CAPABILITIES = {
   anthropic: { tools: true, images: true, reasoning: true },
@@ -5380,7 +5351,117 @@ class GatewayError extends Error {
     this.retryAfterMs = opts?.retryAfterMs;
   }
 }
+// packages/ir/src/logger.ts
+var LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+var FIELD_ORDER = [
+  "requestId",
+  "surface",
+  "status",
+  "provider",
+  "model",
+  "requestedModel",
+  "credentialId",
+  "apiKeyId",
+  "attempt",
+  "attempts",
+  "code",
+  "retryable",
+  "stream",
+  "inputTokens",
+  "outputTokens",
+  "cacheReadTokens",
+  "cacheWriteTokens",
+  "costUsd",
+  "ttftMs",
+  "durationMs",
+  "retryAfterMs",
+  "count",
+  "rawCount",
+  "dailyCount",
+  "host",
+  "port",
+  "path",
+  "reason"
+];
+var REASON_MAX = 200;
+var LEVEL_COLOR = {
+  debug: "\x1B[2;37m",
+  info: "\x1B[36m",
+  warn: "\x1B[33m",
+  error: "\x1B[31m"
+};
+var RESET = "\x1B[0m";
+var NEEDS_QUOTING = /[\s="]/;
+function renderValue(value) {
+  if (value === null)
+    return "null";
+  if (typeof value !== "string")
+    return String(value);
+  return NEEDS_QUOTING.test(value) ? JSON.stringify(value) : value;
+}
+function formatLine(level, at, msg, fields, color) {
+  const label = level.toUpperCase().padEnd(5, " ");
+  const head = `${new Date(at).toISOString()} ${color ? `${LEVEL_COLOR[level]}${label}${RESET}` : label} ${msg}`;
+  if (fields === undefined)
+    return head;
+  const parts = [];
+  for (const key of FIELD_ORDER) {
+    const value = fields[key];
+    if (value === undefined)
+      continue;
+    const capped = key === "reason" && typeof value === "string" && value.length > REASON_MAX ? `${value.slice(0, REASON_MAX)}\u2026` : value;
+    parts.push(`${key}=${renderValue(capped)}`);
+  }
+  return parts.length === 0 ? head : `${head}  ${parts.join(" ")}`;
+}
+function createLogger(opts) {
+  const threshold = LEVELS[opts.level];
+  const now = opts.now ?? (() => Date.now());
+  const color = opts.color ?? false;
+  const emit = (level, msg, fields) => {
+    if (LEVELS[level] < threshold)
+      return;
+    try {
+      opts.write(formatLine(level, now(), msg, fields, color));
+    } catch {}
+  };
+  return {
+    debug: (msg, fields) => emit("debug", msg, fields),
+    info: (msg, fields) => emit("info", msg, fields),
+    warn: (msg, fields) => emit("warn", msg, fields),
+    error: (msg, fields) => emit("error", msg, fields),
+    enabled: (level) => LEVELS[level] >= threshold
+  };
+}
+var noopLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  enabled: () => false
+};
+function parseLogLevel(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === undefined || normalized.length === 0)
+    return null;
+  return Object.hasOwn(LEVELS, normalized) ? normalized : null;
+}
+// packages/ir/src/request.ts
+function cacheControlOf(block) {
+  return block.type === "thinking" ? undefined : block.cacheControl;
+}
 // packages/ir/src/stream.ts
+function usageFromPromptTotal(promptTokens, outputTokens, cacheReadTokens, cacheWriteTokens = 0) {
+  return {
+    inputTokens: Math.max(0, promptTokens - cacheReadTokens - cacheWriteTokens),
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens
+  };
+}
+function promptTokens(usage) {
+  return usage.inputTokens + usage.cacheReadTokens + usage.cacheWriteTokens;
+}
 function collect(events) {
   let id = "";
   let model = "";
@@ -5473,6 +5554,39 @@ function validateRequest(req) {
   }
   return { ...req, messages: cleaned };
 }
+// packages/control/src/config.ts
+var MIN_KEY_LENGTH = 16;
+var DECIMAL_INTEGER = /^\d+$/;
+function optionalText(value, fallback) {
+  return value?.trim() || fallback;
+}
+function loadConfig(env) {
+  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
+  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
+    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
+  }
+  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
+  const rawPort = env.OMNI_PORT ?? "9000";
+  const port = Number(rawPort);
+  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
+  }
+  const derivedBaseUrl = `http://${host}:${port}`;
+  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
+  const staticDir = env.OMNI_STATIC_DIR?.trim();
+  const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
+  const logLevel = parseLogLevel(rawLogLevel);
+  return {
+    logLevel: logLevel ?? "info",
+    logLevelFallbackFrom: logLevel === null && rawLogLevel ? rawLogLevel : null,
+    port,
+    host,
+    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
+    encryptionKey,
+    baseUrl,
+    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir
+  };
+}
 // packages/providers/src/body.ts
 var BODY_ORDER = {
   anthropic: [
@@ -5559,8 +5673,13 @@ function applyAnthropicSystem(system) {
     let rewritten = text;
     for (const [from, to] of REWRITES)
       rewritten = rewritten.replaceAll(from, to);
-    if (rewritten.trim().length > 0)
-      kept.push({ type: "text", text: rewritten });
+    if (rewritten.trim().length > 0) {
+      kept.push({
+        type: "text",
+        text: rewritten,
+        ...block.cache_control === undefined ? {} : { cache_control: block.cache_control }
+      });
+    }
   }
   return [{ type: "text", text: billingBlock() }, { type: "text", text: AGENT_PREAMBLE }, ...kept];
 }
@@ -5864,6 +5983,8 @@ async function* decodeAnthropic(messages) {
   let inputTokens = 0;
   let cacheReadTokens = 0;
   let cacheWriteTokens = 0;
+  let cacheWrite5mTokens;
+  let cacheWrite1hTokens;
   let outputTokens = 0;
   let stopReason = "endTurn";
   let terminal = false;
@@ -5877,6 +5998,8 @@ async function* decodeAnthropic(messages) {
         inputTokens = m.usage?.input_tokens ?? 0;
         cacheReadTokens = m.usage?.cache_read_input_tokens ?? 0;
         cacheWriteTokens = m.usage?.cache_creation_input_tokens ?? 0;
+        cacheWrite5mTokens = m.usage?.cache_creation?.ephemeral_5m_input_tokens;
+        cacheWrite1hTokens = m.usage?.cache_creation?.ephemeral_1h_input_tokens;
         yield { type: "start", id: String(m.id ?? ""), model: String(m.model ?? "") };
         break;
       }
@@ -5936,7 +6059,14 @@ async function* decodeAnthropic(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens }
+          usage: {
+            inputTokens,
+            outputTokens,
+            cacheReadTokens,
+            cacheWriteTokens,
+            ...cacheWrite5mTokens === undefined ? {} : { cacheWrite5mTokens },
+            ...cacheWrite1hTokens === undefined ? {} : { cacheWrite1hTokens }
+          }
         };
         break;
       case "error": {
@@ -5966,25 +6096,33 @@ async function* decodeAnthropic(messages) {
 
 // packages/providers/src/anthropic/wire.ts
 var OAUTH_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+function wireCacheControl(c) {
+  if (c === undefined)
+    return {};
+  return { cache_control: { type: c.type, ...c.ttl === undefined ? {} : { ttl: c.ttl } } };
+}
 function encodeBlock(b) {
+  const cache = wireCacheControl(cacheControlOf(b));
   switch (b.type) {
     case "text":
-      return { type: "text", text: b.text };
+      return { type: "text", text: b.text, ...cache };
     case "image":
       return {
         type: "image",
-        source: { type: "base64", media_type: b.mediaType, data: b.data }
+        source: { type: "base64", media_type: b.mediaType, data: b.data },
+        ...cache
       };
     case "thinking":
       return { type: "thinking", thinking: b.text, signature: b.signature };
     case "toolUse":
-      return { type: "tool_use", id: b.id, name: b.name, input: b.input };
+      return { type: "tool_use", id: b.id, name: b.name, input: b.input, ...cache };
     case "toolResult":
       return {
         type: "tool_result",
         tool_use_id: b.toolUseId,
         content: b.content,
-        is_error: b.isError
+        is_error: b.isError,
+        ...cache
       };
   }
 }
@@ -6006,14 +6144,25 @@ function encodeToolChoice(c) {
 }
 function toWire(req, model, opts) {
   const degradations = [];
-  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text }] : []);
+  const note = (d) => {
+    if (!degradations.includes(d))
+      degradations.push(d);
+  };
+  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text, ...wireCacheControl(b.cacheControl) }] : []);
   if (opts.oauth && system?.[0]?.text !== OAUTH_IDENTITY) {
     system = [{ type: "text", text: OAUTH_IDENTITY }, ...system ?? []];
-    degradations.push("anthropic:oauth-system-prefix");
+    note("anthropic:oauth-system-prefix");
   }
   const body = {
     model,
-    messages: req.messages.map((m) => m.role === "system" ? { role: m.role, content: encodeSystemTurn(m.content) } : { role: m.role, content: m.content.map(encodeBlock) }),
+    messages: req.messages.map((m) => {
+      if (m.role !== "system")
+        return { role: m.role, content: m.content.map(encodeBlock) };
+      if (m.content.some((b) => cacheControlOf(b) !== undefined)) {
+        note("anthropic:system-turn-cache-control-dropped");
+      }
+      return { role: m.role, content: encodeSystemTurn(m.content) };
+    }),
     max_tokens: req.maxTokens ?? 4096,
     stream: req.stream
   };
@@ -6027,7 +6176,8 @@ function toWire(req, model, opts) {
     body.tools = req.tools.map((t) => ({
       name: t.name,
       ...t.description === undefined ? {} : { description: t.description },
-      input_schema: t.inputSchema
+      input_schema: t.inputSchema,
+      ...wireCacheControl(t.cacheControl)
     }));
   }
   if (req.toolChoice !== undefined)
@@ -6067,12 +6217,13 @@ var anthropicAdapter = {
     const { body, degradations } = toWire(req.request, req.model, { oauth });
     const withSystem = {
       ...body,
-      system: applyAnthropicSystem(body.system ?? [])
+      system: applyAnthropicSystem(body.system ?? []),
+      stream: true
     };
     const protocol = [
       ["Content-Type", "application/json"],
       ["anthropic-version", API_VERSION],
-      ["Accept", req.request.stream ? "text/event-stream" : "application/json"]
+      ["Accept", "text/event-stream"]
     ];
     const betas = new Set(req.request.betas ?? []);
     if (oauth) {
@@ -6091,6 +6242,7 @@ var anthropicAdapter = {
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const bodyString = signAnthropicBody(JSON.stringify(orderFields(withSystem, BODY_ORDER.anthropic)));
     const res = await req.http({
+      provider: "anthropic",
       url: BASE_URL,
       method: "POST",
       headers,
@@ -6111,22 +6263,26 @@ var ANTHROPIC_MODELS = {
     {
       id: "claude-fable-5",
       label: "Claude Fable 5",
-      pricing: { input: 10, output: 50, cacheRead: 1 }
+      pricing: { input: 10, output: 50, cacheRead: 1, cacheWrite5m: 12.5, cacheWrite1h: 20 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-opus-5",
       label: "Claude Opus 5",
-      pricing: { input: 5, output: 25, cacheRead: 0.5 }
+      pricing: { input: 5, output: 25, cacheRead: 0.5, cacheWrite5m: 6.25, cacheWrite1h: 10 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-sonnet-5",
       label: "Claude Sonnet 5",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 3.75, cacheWrite1h: 6 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-haiku-4-5",
       label: "Claude Haiku 4.5",
-      pricing: { input: 1, output: 5, cacheRead: 0.1 }
+      pricing: { input: 1, output: 5, cacheRead: 0.1, cacheWrite5m: 1.25, cacheWrite1h: 2 },
+      limits: { contextWindow: 200000, maxOutputTokens: 64000 }
     }
   ]
 };
@@ -6138,22 +6294,26 @@ var KIMI_MODELS = {
     {
       id: "k3-256k",
       label: "Kimi K3 \u2014 256K",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "k3",
       label: "Kimi K3 \u2014 up to 1M",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1048576, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding",
       label: "Kimi K2.7 Code",
-      pricing: { input: 0.95, output: 4, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding-highspeed",
       label: "Kimi K2.7 Code \u2014 High Speed",
-      pricing: { input: 0.95, output: 8, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 8, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     }
   ]
 };
@@ -6165,22 +6325,30 @@ var OPENAI_MODELS = {
     {
       id: "gpt-5.6",
       label: "GPT-5.6 \u2014 routes to Sol",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-sol",
       label: "GPT-5.6 Sol \u2014 deepest reasoning",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-terra",
       label: "GPT-5.6 Terra \u2014 balanced",
-      pricing: { input: 2, output: 12, cacheRead: 0.2 }
+      pricing: { input: 2, output: 12, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-luna",
       label: "GPT-5.6 Luna \u2014 fastest",
-      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02 }
+      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     }
   ]
 };
@@ -6192,15 +6360,38 @@ var PROVIDER_MODEL_CATALOG = {
   kimi: KIMI_MODELS
 };
 function catalogPricing(provider, model) {
-  return PROVIDER_MODEL_CATALOG[provider].models.find((entry) => entry.id === model)?.pricing ?? null;
+  return PROVIDER_MODEL_CATALOG[provider]?.models.find((entry) => entry.id === model)?.pricing ?? null;
+}
+function catalogLimits(provider, model, auth = "apiKey") {
+  const entry = PROVIDER_MODEL_CATALOG[provider]?.models.find((choice) => choice.id === model);
+  if (entry === undefined)
+    return null;
+  return (auth === "oauth" ? entry.oauthLimits : undefined) ?? entry.limits;
 }
 // packages/providers/src/http-client.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { Readable } from "stream";
-function nodeHttpClient() {
+function nodeHttpClient(options = {}) {
+  const logger2 = options.logger ?? noopLogger;
+  const now = options.now ?? (() => Date.now());
   return (req) => new Promise((resolve, reject) => {
     const url = new URL(req.url);
+    const startedAt = now();
+    let traced = false;
+    const trace = (status, failed = false) => {
+      if (traced || !logger2.enabled("debug"))
+        return;
+      traced = true;
+      logger2.debug("upstream http", {
+        provider: req.provider,
+        status,
+        host: url.host,
+        path: url.pathname,
+        durationMs: now() - startedAt,
+        reason: failed ? "transport error" : undefined
+      });
+    };
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
     const bodyBytes = Buffer.from(req.body, "utf8");
     const headers = {};
@@ -6228,6 +6419,7 @@ function nodeHttpClient() {
         else if (typeof v === "string")
           responseHeaders.set(k, v);
       }
+      trace(incoming.statusCode);
       resolve({
         status: incoming.statusCode ?? 0,
         headers: responseHeaders,
@@ -6243,17 +6435,17 @@ function nodeHttpClient() {
       });
     });
     const onAbort = () => outgoing.destroy(new Error("aborted"));
-    if (req.signal.aborted) {
-      outgoing.destroy(new Error("aborted"));
-      reject(new Error("aborted"));
-      return;
-    }
-    req.signal.addEventListener("abort", onAbort, { once: true });
     outgoing.on("error", (err) => {
       req.signal.removeEventListener("abort", onAbort);
+      trace(undefined, true);
       reject(err);
     });
     outgoing.on("close", () => req.signal.removeEventListener("abort", onAbort));
+    if (req.signal.aborted) {
+      outgoing.destroy(new Error("aborted"));
+      return;
+    }
+    req.signal.addEventListener("abort", onAbort, { once: true });
     if (bodyBytes.byteLength > 0)
       outgoing.write(bodyBytes);
     outgoing.end();
@@ -6322,12 +6514,8 @@ async function* decodeChat(messages) {
       yield { type: "start", id: String(d.id ?? ""), model: String(d.model ?? "") };
     }
     if (d.usage) {
-      usage = {
-        inputTokens: d.usage.prompt_tokens ?? 0,
-        outputTokens: d.usage.completion_tokens ?? 0,
-        cacheReadTokens: d.usage.prompt_cache_hit_tokens ?? 0,
-        cacheWriteTokens: 0
-      };
+      const details = d.usage.prompt_tokens_details;
+      usage = usageFromPromptTotal(d.usage.prompt_tokens ?? 0, d.usage.completion_tokens ?? 0, details?.cached_tokens ?? d.usage.prompt_cache_hit_tokens ?? 0, details?.cache_creation_tokens ?? details?.cache_write_tokens ?? 0);
     }
     const choice = d.choices?.[0];
     if (!choice)
@@ -6453,7 +6641,12 @@ function toChatWire(req, model) {
 `) });
     }
   }
-  const body = { model, messages, stream: req.stream };
+  const body = {
+    model,
+    messages,
+    stream: req.stream,
+    stream_options: { include_usage: true }
+  };
   if (req.maxTokens !== undefined)
     body.max_tokens = req.maxTokens;
   if (req.temperature !== undefined)
@@ -6494,6 +6687,7 @@ var kimiAdapter = {
     const profile = PROFILES.kimi;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "kimi",
       url: BASE_URL2,
       method: "POST",
       headers,
@@ -6624,12 +6818,7 @@ async function* decodeResponses(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: {
-            inputTokens: r.usage?.input_tokens ?? 0,
-            outputTokens: r.usage?.output_tokens ?? 0,
-            cacheReadTokens: r.usage?.input_tokens_details?.cached_tokens ?? 0,
-            cacheWriteTokens: 0
-          }
+          usage: usageFromPromptTotal(r.usage?.input_tokens ?? 0, r.usage?.output_tokens ?? 0, r.usage?.input_tokens_details?.cached_tokens ?? r.usage?.prompt_tokens_details?.cached_tokens ?? 0)
         };
         break;
       }
@@ -6802,6 +6991,7 @@ var openaiAdapter = {
     const profile = PROFILES.openai;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "openai",
       url: oauth ? OAUTH_URL : API_URL,
       method: "POST",
       headers,
@@ -6822,13 +7012,14 @@ var ADAPTERS = {
   kimi: kimiAdapter
 };
 // packages/control/src/oauth/types.ts
-async function postJson(deps, url, profile2, opts) {
+async function postJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Content-Type", opts.contentType],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "POST",
     headers,
@@ -6842,13 +7033,14 @@ async function postJson(deps, url, profile2, opts) {
   } catch {}
   return { status: res.status, parsed };
 }
-async function getJson(deps, url, profile2, opts) {
+async function getJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Authorization", `Bearer ${opts.accessToken}`],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "GET",
     headers,
@@ -7042,7 +7234,7 @@ function deviceCodeFrom(value) {
   };
 }
 async function post(url, body2, device, deps) {
-  const { status, parsed } = await postJson(deps, url, PROFILES.kimi, {
+  const { status, parsed } = await postJson(deps, "kimi", url, PROFILES.kimi, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID }).toString(),
     extraHeaders: kimiDeviceHeaders(device)
@@ -7145,7 +7337,7 @@ var kimiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const device = deviceFrom(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL, PROFILES.kimi, {
+    const { status, parsed } = await getJson(deps, "kimi", USAGE_URL, PROFILES.kimi, {
       accessToken: secrets.accessToken,
       extraHeaders: kimiDeviceHeaders(device)
     });
@@ -7214,6 +7406,7 @@ function deviceIdFrom(start) {
   return deviceId;
 }
 function createConnectFlows(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const flows = createPendingFlows({ now: deps.now, ttlMs: FLOW_TTL_MS });
   const pollsInFlight = new Map;
   const callbackUri = (provider) => provider === "openai" ? "http://localhost:1455/auth/callback" : "";
@@ -7258,6 +7451,10 @@ function createConnectFlows(deps) {
       disabledAt: null,
       ...result.secrets
     });
+    logger2.info("oauth connect completed", {
+      provider: flow.provider,
+      credentialId: id
+    });
     return { id };
   }
   async function pollOutcome(flowId, poll) {
@@ -21633,28 +21830,18 @@ var modelSchema = exports_external.object({
     costPerMTok: exports_external.object({
       input: exports_external.number().min(0),
       output: exports_external.number().min(0),
-      cacheRead: exports_external.number().min(0)
+      cacheRead: exports_external.number().min(0).optional(),
+      cacheWrite5m: exports_external.number().min(0).optional(),
+      cacheWrite1h: exports_external.number().min(0).optional()
     }),
+    contextWindow: exports_external.number().int().positive().optional(),
+    maxOutputTokens: exports_external.number().int().positive().optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
       reasoning: exports_external.boolean()
     })
-  }).or(exports_external.object({
-    provider: providerIdSchema,
-    model: exports_external.string().min(1),
-    tier: exports_external.number().int().min(1),
-    weight: exports_external.number().positive(),
-    costPerMTok: exports_external.object({
-      input: exports_external.number().min(0),
-      output: exports_external.number().min(0)
-    }),
-    capabilities: exports_external.object({
-      tools: exports_external.boolean(),
-      images: exports_external.boolean(),
-      reasoning: exports_external.boolean()
-    })
-  }))).min(1, "a virtual model needs at least one target")
+  })).min(1, "a virtual model needs at least one target")
 });
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
@@ -21748,6 +21935,12 @@ async function patchCredential(deps, id, input) {
     ...patch.tier === undefined ? {} : { tier: patch.tier },
     ...patch.weight === undefined ? {} : { weight: patch.weight }
   });
+  if (patch.enabled !== undefined && patch.enabled !== existing.enabled) {
+    (deps.logger ?? noopLogger).info(patch.enabled ? "credential enabled" : "credential disabled", {
+      credentialId: id,
+      provider: existing.provider
+    });
+  }
 }
 async function removeCredential(store, id) {
   await store.credentials.remove(id);
@@ -22009,12 +22202,20 @@ var PREFIX_PROVIDER = [
 ];
 function synthesize(provider, model) {
   const listed = catalogPricing(provider, model);
+  const limits = catalogLimits(provider, model);
   const target = {
     provider,
     model,
     tier: 1,
     weight: 1,
-    costPerMTok: listed === null ? { input: 0, output: 0 } : { input: listed.input, output: listed.output, cacheRead: listed.cacheRead },
+    costPerMTok: listed === null ? { input: 0, output: 0 } : {
+      input: listed.input,
+      output: listed.output,
+      cacheRead: listed.cacheRead,
+      cacheWrite5m: listed.cacheWrite5m,
+      cacheWrite1h: listed.cacheWrite1h
+    },
+    ...limits === null ? {} : { contextWindow: limits.contextWindow, maxOutputTokens: limits.maxOutputTokens },
     capabilities: PROVIDER_CAPABILITIES[provider]
   };
   return { id: `${provider}/${model}`, targets: [target], strategy: "score", isAlias: true };
@@ -23017,7 +23218,9 @@ function createUsageRepo(db) {
 
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
+  const logger2 = opts.logger ?? noopLogger;
   const db = openDb(opts.path);
+  logger2.debug("store opened", { path: opts.path });
   const listeners = new Set;
   const emit = (change) => {
     for (const listener of listeners) {
@@ -23104,7 +23307,7 @@ var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 var SCOPES = "org:create_api_key user:profile user:inference";
 var USAGE_URL2 = "https://api.anthropic.com/api/oauth/usage";
 async function postToken(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL2, PROFILES.anthropic, {
+  const { status, parsed } = await postJson(deps, "anthropic", TOKEN_URL2, PROFILES.anthropic, {
     contentType: "application/json",
     body: JSON.stringify({ ...body2, client_id: CLIENT_ID2 })
   });
@@ -23182,7 +23385,7 @@ var anthropicOAuth = {
   async usage(secrets, deps) {
     if (secrets.accessToken === null)
       return null;
-    const { status, parsed } = await getJson(deps, USAGE_URL2, PROFILES.anthropic, {
+    const { status, parsed } = await getJson(deps, "anthropic", USAGE_URL2, PROFILES.anthropic, {
       accessToken: secrets.accessToken,
       extraHeaders: [
         ["anthropic-beta", "oauth-2025-04-20"],
@@ -23240,7 +23443,7 @@ function parseTokenResponse(value) {
   };
 }
 async function postToken2(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL3, PROFILES.openai, {
+  const { status, parsed } = await postJson(deps, "openai", TOKEN_URL3, PROFILES.openai, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID3 }).toString()
   });
@@ -23339,7 +23542,7 @@ var openaiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const accountId = accountIdFromProviderData(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL3, PROFILES.openai, {
+    const { status, parsed } = await getJson(deps, "openai", USAGE_URL3, PROFILES.openai, {
       accessToken: secrets.accessToken,
       ...accountId === null ? {} : { extraHeaders: [["chatgpt-account-id", accountId]] }
     });
@@ -23360,6 +23563,7 @@ var DISPATCH_REFRESH_LEAD_MS = 120000;
 var SCHEDULER_REFRESH_LEAD_MS = 300000;
 // packages/control/src/oauth/refresh.ts
 function createRefresher(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const inFlight = new Map;
   async function run(credential) {
     const secrets = await credential.openForRefresh();
@@ -23367,11 +23571,20 @@ function createRefresher(deps) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
     const provider = deps.providers[credential.provider];
+    logger2.debug("refreshing credential", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     let result;
     try {
       result = await provider.refresh(secrets.refreshToken, { http: deps.http, now: deps.now }, credential.providerData);
     } catch (error51) {
       if (error51 instanceof GatewayError && error51.code === "AUTH") {
+        logger2.warn("credential disabled: refresh token rejected", {
+          provider: credential.provider,
+          credentialId: credential.id,
+          code: "AUTH"
+        });
         await deps.store.credentials.update(credential.id, {
           enabled: false,
           disabledReason: "tokenRejected",
@@ -23385,6 +23598,10 @@ function createRefresher(deps) {
       accountEmail: result.accountEmail ?? credential.accountEmail,
       providerData: { ...credential.providerData, ...result.providerData }
     });
+    logger2.debug("credential refreshed", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     return result.secrets;
   }
   return function refresh(credential) {
@@ -23424,9 +23641,15 @@ async function probe(deps, credential) {
     observedAt
   }));
   await deps.store.credentials.saveQuota(rows);
+  (deps.logger ?? noopLogger).debug("quota snapshot written", {
+    provider: credential.provider,
+    credentialId: credential.id,
+    count: rows.length
+  });
   return rows;
 }
 async function poll(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const now = deps.now();
   const credentials = (await deps.store.credentials.list()).filter((c) => c.enabled && c.authType === "oauth" && deps.providers[c.provider].usage !== undefined && (cooldowns.get(c.id) ?? 0) <= now);
   let written = 0;
@@ -23440,12 +23663,15 @@ async function poll(deps) {
         if (await probe(deps, credential) !== null)
           written += 1;
       } catch (error51) {
-        if (error51 instanceof GatewayError && error51.code === "RATE_LIMIT") {
+        const rateLimited = error51 instanceof GatewayError && error51.code === "RATE_LIMIT";
+        if (rateLimited) {
           cooldowns.set(credential.id, deps.now() + RATE_LIMIT_COOLDOWN_MS);
         }
-        console.warn("quota probe failed", {
-          credentialId: credential.id,
+        logger2.warn(rateLimited ? "quota probe rate limited" : "quota probe failed", {
           provider: credential.provider,
+          credentialId: credential.id,
+          code: error51 instanceof GatewayError ? error51.code : "INTERNAL",
+          ...rateLimited ? { retryAfterMs: RATE_LIMIT_COOLDOWN_MS } : {},
           reason: error51 instanceof Error ? error51.message : "unknown"
         });
       }
@@ -37903,7 +38129,7 @@ class ApiKeyRateLimiter {
 }
 
 // apps/gateway/src/dispatch/snapshotCache.ts
-function createRoutingSnapshotCache(store) {
+function createRoutingSnapshotCache(store, logger2 = noopLogger) {
   let snapshot = null;
   let stale = true;
   let version2 = store.routing.version();
@@ -37942,6 +38168,7 @@ function createRoutingSnapshotCache(store) {
       return inFlight;
     const buildGeneration = generation;
     const buildVersion = currentVersion;
+    logger2.debug("routing snapshot cache miss");
     inFlight = buildSnapshot(store, now).then(async (next) => {
       const completedVersion = store.routing.version();
       if (generation !== buildGeneration || completedVersion !== buildVersion) {
@@ -37961,6 +38188,28 @@ function createRoutingSnapshotCache(store) {
 }
 
 // apps/gateway/src/ingress/schemas.ts
+var cacheControlSchema = exports_external.object({
+  type: exports_external.literal("ephemeral"),
+  ttl: exports_external.enum(["5m", "1h"]).optional()
+});
+function looseCacheControl(value) {
+  const parsed = cacheControlSchema.safeParse(value);
+  return parsed.success ? irCacheControl(parsed.data) : {};
+}
+function irCacheControl(c) {
+  if (c === undefined)
+    return {};
+  return { cacheControl: { type: c.type, ...c.ttl === undefined ? {} : { ttl: c.ttl } } };
+}
+function applyMessageCacheControl(blocks, value) {
+  const control = looseCacheControl(value);
+  if (control.cacheControl === undefined)
+    return;
+  const last = blocks.at(-1);
+  if (last === undefined || last.type === "thinking" || cacheControlOf(last) !== undefined)
+    return;
+  Object.assign(last, control);
+}
 function parseOrThrow2(schema, body2) {
   const result = schema.safeParse(body2);
   if (result.success)
@@ -37988,7 +38237,18 @@ function parseDataUrl(url2) {
   return { mediaType: match[1], data: match[2] };
 }
 
-// apps/gateway/src/routes/admin.ts
+// apps/gateway/src/routes/http.ts
+function readCookie(request2, name) {
+  const header = request2.headers.get("cookie");
+  if (header === null)
+    return null;
+  for (const part of header.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name)
+      return rest.join("=");
+  }
+  return null;
+}
 function sessionCookie(request2, token, maxAge) {
   const secure = new URL(request2.url).protocol === "https:" ? ["Secure"] : [];
   return [
@@ -38000,38 +38260,37 @@ function sessionCookie(request2, token, maxAge) {
     `Max-Age=${maxAge}`
   ].join("; ");
 }
-function readCookie(request2, name) {
-  const header = request2.headers.get("cookie");
-  if (header === null)
-    return null;
-  for (const part of header.split(";")) {
-    const [key, ...rest] = part.trim().split("=");
-    if (key === name)
-      return rest.join("=");
+async function requireAdmin(request2, admin) {
+  const token = readCookie(request2, ADMIN_COOKIE);
+  if (token === null || !await admin.verify(token)) {
+    throw new GatewayError("AUTH", "admin session required");
   }
-  return null;
 }
-async function jsonRecord(request2) {
+async function readJson(request2) {
   try {
-    const body2 = await request2.json();
-    return isRecord3(body2) ? body2 : null;
-  } catch {
-    return null;
+    return await request2.json();
+  } catch (error51) {
+    if (!(error51 instanceof SyntaxError))
+      throw error51;
+    throw new GatewayError("BAD_REQUEST", "invalid JSON body");
   }
 }
+async function readJsonRecord(request2) {
+  const body2 = await readJson(request2);
+  return isRecord3(body2) ? body2 : null;
+}
+function apiErrorResponse(error51) {
+  const gatewayError = error51 instanceof GatewayError ? error51 : new GatewayError("INTERNAL", "internal error");
+  return Response.json({ error: { code: gatewayError.code, message: gatewayError.message } }, { status: HTTP_STATUS[gatewayError.code] });
+}
+function apiErrorHandler(input) {
+  return input.code === "NOT_FOUND" ? undefined : apiErrorResponse(input.error);
+}
+
+// apps/gateway/src/routes/admin.ts
 function adminRoutes(deps) {
-  const app = new Elysia().onError(({ error: error51, set: set2 }) => {
-    const gatewayError = error51 instanceof GatewayError ? error51 : new GatewayError("INTERNAL", "internal error");
-    set2.status = HTTP_STATUS[gatewayError.code];
-    return { error: { code: gatewayError.code, message: gatewayError.message } };
-  });
-  async function requireAdmin(request2) {
-    const token = readCookie(request2, ADMIN_COOKIE);
-    if (token === null || !await deps.admin.verify(token)) {
-      throw new GatewayError("AUTH", "admin session required");
-    }
-  }
-  return app.get("/api/status", async ({ request: request2 }) => {
+  const logger2 = deps.logger ?? noopLogger;
+  return new Elysia().onError(apiErrorHandler).get("/api/status", async ({ request: request2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     return {
       configured: await deps.admin.isConfigured(),
@@ -38042,7 +38301,7 @@ function adminRoutes(deps) {
       set2.status = 409;
       return { error: { code: "CONFLICT", message: "an admin password is already configured" } };
     }
-    const body2 = await jsonRecord(request2);
+    const body2 = await readJsonRecord(request2);
     if (typeof body2?.password !== "string") {
       throw new GatewayError("BAD_REQUEST", "password is required");
     }
@@ -38059,13 +38318,17 @@ function adminRoutes(deps) {
     const token = await deps.admin.login(body2.password);
     if (token === null)
       throw new GatewayError("INTERNAL", "could not create admin session");
+    logger2.info("admin setup completed");
     set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/login", async ({ request: request2, set: set2 }) => {
-    const body2 = await jsonRecord(request2);
+    const body2 = await readJsonRecord(request2);
     const token = typeof body2?.password === "string" ? await deps.admin.login(body2.password) : null;
-    if (token === null)
+    if (token === null) {
+      logger2.info("admin login failed", { reason: "invalid credentials" });
       throw new GatewayError("AUTH", "invalid password");
+    }
+    logger2.info("admin login succeeded");
     set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/logout", async ({ request: request2, set: set2 }) => {
@@ -38075,52 +38338,52 @@ function adminRoutes(deps) {
     set2.headers["set-cookie"] = sessionCookie(request2, "", 0);
     return { ok: true };
   }).get("/api/credentials", async ({ request: request2 }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return { credentials: await listCredentials(deps.store) };
   }).get("/api/credentials/health", async ({ request: request2 }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return credentialHealth(deps.store);
   }).patch("/api/credentials/:id", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
-    await patchCredential(deps, params.id, await request2.json());
+    await requireAdmin(request2, deps.admin);
+    await patchCredential(deps, params.id, await readJson(request2));
     return { ok: true };
   }).delete("/api/credentials/:id", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     await removeCredential(deps.store, params.id);
     return { ok: true };
   }).get("/api/models", async ({ request: request2 }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return { models: await listModels(deps.store) };
   }).put("/api/models/:id", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
-    await putModel(deps.store, params.id, await request2.json());
+    await requireAdmin(request2, deps.admin);
+    await putModel(deps.store, params.id, await readJson(request2));
     return { ok: true };
   }).delete("/api/models/:id", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     await removeModel(deps.store, params.id);
     return { ok: true };
   }).get("/api/keys", async ({ request: request2 }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return { keys: await listKeys(deps.store) };
   }).post("/api/keys", async ({ request: request2 }) => {
-    await requireAdmin(request2);
-    return createKey(deps.store, await request2.json());
+    await requireAdmin(request2, deps.admin);
+    return createKey(deps.store, await readJson(request2));
   }).delete("/api/keys/:id", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     await revokeKey(deps.store, params.id);
     return { ok: true };
   }).get("/api/settings", async ({ request: request2 }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return { settings: await getSettings(deps.store) };
   }).put("/api/settings", async ({ request: request2 }) => {
-    await requireAdmin(request2);
-    await putSettings(deps.store, await request2.json());
+    await requireAdmin(request2, deps.admin);
+    await putSettings(deps.store, await readJson(request2));
     return { ok: true };
   }).post("/api/models/:id/dry-run", async ({ request: request2, params }) => {
-    await requireAdmin(request2);
-    return dryRun(deps, params.id, await request2.json());
+    await requireAdmin(request2, deps.admin);
+    return dryRun(deps, params.id, await readJson(request2));
   }).get("/api/usage", async ({ request: request2, query }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return {
       rows: await queryUsage(deps, {
         grain: query.grain,
@@ -38131,70 +38394,29 @@ function adminRoutes(deps) {
       })
     };
   }).get("/api/logs", async ({ request: request2, query }) => {
-    await requireAdmin(request2);
+    await requireAdmin(request2, deps.admin);
     return { logs: await recentLogs(deps.store, query.limit) };
   });
 }
 
 // apps/gateway/src/routes/connect.ts
-function asGatewayError(error51) {
-  if (error51 instanceof GatewayError)
-    return error51;
-  return new GatewayError("INTERNAL", error51 instanceof Error ? error51.message : "internal error");
-}
-function errorResponse(error51) {
-  const gatewayError = asGatewayError(error51);
-  return new Response(JSON.stringify({ error: { code: gatewayError.code, message: gatewayError.message } }), {
-    status: HTTP_STATUS[gatewayError.code],
-    headers: { "content-type": "application/json" }
-  });
-}
-function readCookie2(request2, name) {
-  const header = request2.headers.get("cookie");
-  if (header === null)
-    return null;
-  for (const part of header.split(";")) {
-    const [key, ...rest] = part.trim().split("=");
-    if (key === name)
-      return rest.join("=");
-  }
-  return null;
-}
 function connectRoutes(deps) {
   const flows = createConnectFlows(deps);
-  async function requireAdmin(request2) {
-    const token = readCookie2(request2, ADMIN_COOKIE);
-    if (token === null || !await deps.admin.verify(token)) {
-      throw new GatewayError("AUTH", "admin session required");
-    }
-  }
-  return new Elysia().post("/api/connect/start", async ({ request: request2 }) => {
-    try {
-      await requireAdmin(request2);
-      const body2 = await request2.json();
-      return await flows.start(isRecord3(body2) ? body2.provider : undefined, isRecord3(body2) ? body2.label : undefined);
-    } catch (error51) {
-      return errorResponse(error51);
-    }
+  return new Elysia().onError(apiErrorHandler).post("/api/connect/start", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const body2 = await readJsonRecord(request2);
+    return flows.start(body2?.provider, body2?.label);
   }).post("/api/connect/finish", async ({ request: request2 }) => {
-    try {
-      await requireAdmin(request2);
-      const body2 = await request2.json();
-      return await flows.finish(isRecord3(body2) ? body2.flowId : undefined, isRecord3(body2) ? body2.code : undefined);
-    } catch (error51) {
-      return errorResponse(error51);
-    }
+    await requireAdmin(request2, deps.admin);
+    const body2 = await readJsonRecord(request2);
+    return flows.finish(body2?.flowId, body2?.code);
   }).post("/api/connect/poll", async ({ request: request2, set: set2 }) => {
-    try {
-      await requireAdmin(request2);
-      const body2 = await request2.json();
-      const outcome = await flows.poll(isRecord3(body2) ? body2.flowId : undefined);
-      if (outcome.status === "pending")
-        set2.status = 202;
-      return outcome;
-    } catch (error51) {
-      return errorResponse(error51);
-    }
+    await requireAdmin(request2, deps.admin);
+    const body2 = await readJsonRecord(request2);
+    const outcome = await flows.poll(body2?.flowId);
+    if (outcome.status === "pending")
+      set2.status = 202;
+    return outcome;
   });
 }
 
@@ -38233,13 +38455,86 @@ function extractToken(header) {
   return match === null ? value : match[1].trim();
 }
 
+// apps/gateway/src/logging.ts
+function requestLogDefaults(id, at) {
+  return {
+    id,
+    state: "done",
+    at,
+    apiKeyId: null,
+    requestedModel: "",
+    resolvedProvider: null,
+    resolvedModel: null,
+    credentialId: null,
+    attempts: 0,
+    status: 0,
+    errorCode: null,
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
+    ttftMs: null,
+    durationMs: 0,
+    costUsd: 0,
+    degradations: []
+  };
+}
+function newCompletedRequestLog(id, at, overrides) {
+  return { ...requestLogDefaults(id, at), ...overrides, id, state: "done", at };
+}
+function newPendingRequestLog(input) {
+  const { id, at, requestedModel, resolvedProvider, resolvedModel, credentialId } = input;
+  return {
+    ...requestLogDefaults(id, at),
+    requestedModel,
+    resolvedProvider,
+    resolvedModel,
+    credentialId,
+    state: "pending",
+    status: 0
+  };
+}
+function report(logger2, what, requestId, error51) {
+  logger2.warn(what, {
+    requestId,
+    reason: error51 instanceof Error ? error51.message : "unknown"
+  });
+}
+async function beginLog(store, log, keyId, logger2 = noopLogger) {
+  try {
+    await store.usage.begin({ ...log, state: "pending", apiKeyId: keyId });
+  } catch (error51) {
+    report(logger2, "failed to record request start", log.id, error51);
+  }
+}
+async function routeLog(store, requestId, target, logger2 = noopLogger) {
+  try {
+    await store.usage.route(requestId, target);
+  } catch (error51) {
+    report(logger2, "failed to record request route", requestId, error51);
+  }
+}
+async function finishLog(store, log, keyId, logger2 = noopLogger) {
+  try {
+    await store.usage.append({ ...log, apiKeyId: keyId });
+  } catch (error51) {
+    report(logger2, "failed to persist request log", log.id, error51);
+  }
+}
+
 // apps/gateway/src/dispatch/attempt.ts
 async function attempt(opts) {
   const { candidate, adapter, http, now, signal, refresh, refreshLeadMs } = opts;
+  const logger2 = opts.logger ?? noopLogger;
   const credential = candidate.credential;
   let secrets = opts.secrets ?? await credential.openForInference();
   const stale = opts.secrets === undefined && credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt - refreshLeadMs <= now;
   if (stale) {
+    logger2.debug("preemptive credential refresh", {
+      requestId: opts.requestId,
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     if (!credential.hasRefreshToken) {
       throw new GatewayError("AUTH", "credential expired with no refresh token", {
         provider: credential.provider
@@ -38285,32 +38580,42 @@ function classify(error51) {
   return { code: "INTERNAL" };
 }
 
+// apps/gateway/src/dispatch/price.ts
+var WRITE_OVER_INPUT = {
+  anthropic: { fiveMinute: 1.25, oneHour: 2 },
+  openai: { fiveMinute: 0, oneHour: 0 },
+  kimi: { fiveMinute: 0, oneHour: 0 }
+};
+var READ_OVER_INPUT = 0.1;
+function splitWrites(usage) {
+  const { cacheWrite5mTokens: five, cacheWrite1hTokens: hour, cacheWriteTokens: total } = usage;
+  if (five !== undefined && hour !== undefined)
+    return { fiveMinute: five, oneHour: hour };
+  if (five !== undefined)
+    return { fiveMinute: five, oneHour: Math.max(0, total - five) };
+  if (hour !== undefined)
+    return { fiveMinute: Math.max(0, total - hour), oneHour: hour };
+  return { fiveMinute: total, oneHour: 0 };
+}
+function priceOf(prices, usage, provider) {
+  const fallback = WRITE_OVER_INPUT[provider];
+  const readRate = prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+  const write5mRate = prices.cacheWrite5m ?? prices.input * fallback.fiveMinute;
+  const write1hRate = prices.cacheWrite1h ?? prices.input * fallback.oneHour;
+  const writes = splitWrites(usage);
+  return (usage.inputTokens * prices.input + usage.outputTokens * prices.output + usage.cacheReadTokens * readRate + writes.fiveMinute * write5mRate + writes.oneHour * write1hRate) / 1e6;
+}
+
 // apps/gateway/src/dispatch/index.ts
-async function dispatch(request2, deps, signal) {
+async function dispatch(request2, deps, signal, requestId) {
+  const logger2 = deps.logger ?? noopLogger;
   const startedAt = deps.now();
   const snapshot = await deps.snapshots.get(startedAt);
   const deadlineAt = startedAt + snapshot.settings.requestDeadlineMs;
-  const log = {
-    id: crypto.randomUUID(),
-    state: "done",
-    at: startedAt,
-    apiKeyId: null,
+  const log = newCompletedRequestLog(requestId, startedAt, {
     requestedModel: request2.model,
-    resolvedProvider: null,
-    resolvedModel: null,
-    credentialId: null,
-    attempts: 0,
-    status: 200,
-    errorCode: null,
-    inputTokens: 0,
-    outputTokens: 0,
-    cacheReadTokens: 0,
-    cacheWriteTokens: 0,
-    ttftMs: null,
-    durationMs: 0,
-    costUsd: 0,
-    degradations: []
-  };
+    status: 0
+  });
   const fail = (code, message) => {
     log.errorCode = code;
     log.status = HTTP_STATUS[code];
@@ -38357,8 +38662,20 @@ async function dispatch(request2, deps, signal) {
     now: startedAt,
     rand: deps.rand()
   });
+  logger2.debug("routing candidates ranked", {
+    requestId,
+    requestedModel: request2.model,
+    model: candidates[0]?.target.model,
+    credentialId: candidates[0]?.credential.id,
+    count: candidates.length
+  });
   for (const e of excluded) {
     log.degradations.push(`excluded:${e.credentialId}:${e.reason}`);
+    logger2.debug("routing candidate excluded", {
+      requestId,
+      credentialId: e.credentialId,
+      reason: e.reason
+    });
   }
   if (candidates.length === 0) {
     clearDeadline();
@@ -38389,6 +38706,13 @@ async function dispatch(request2, deps, signal) {
             model: candidate.target.model,
             credentialId: candidate.credential.id
           });
+          logger2.debug("attempt started", {
+            requestId,
+            provider: candidate.target.provider,
+            model: candidate.target.model,
+            credentialId: candidate.credential.id,
+            attempt: i + 1
+          });
           log.inputTokens = 0;
           log.outputTokens = 0;
           log.cacheReadTokens = 0;
@@ -38410,7 +38734,9 @@ async function dispatch(request2, deps, signal) {
                 signal: dispatchSignal,
                 refresh: (credential) => waitForCancellation(deps.refresh(credential), dispatchSignal),
                 refreshLeadMs: DISPATCH_REFRESH_LEAD_MS,
-                ...retrySecrets === undefined ? {} : { secrets: retrySecrets }
+                ...retrySecrets === undefined ? {} : { secrets: retrySecrets },
+                logger: logger2,
+                requestId
               }), dispatchSignal);
               for (const d of result.degradations)
                 log.degradations.push(d);
@@ -38420,6 +38746,14 @@ async function dispatch(request2, deps, signal) {
                 if (event.type === "blockDelta" && !committed) {
                   committed = true;
                   log.ttftMs = deps.now() - startedAt;
+                  logger2.debug("stream committed", {
+                    requestId,
+                    provider: candidate.target.provider,
+                    model: candidate.target.model,
+                    credentialId: candidate.credential.id,
+                    attempt: i + 1,
+                    ttftMs: log.ttftMs
+                  });
                   for (const buffered of pending)
                     yield buffered;
                   pending.length = 0;
@@ -38430,7 +38764,7 @@ async function dispatch(request2, deps, signal) {
                   log.outputTokens = event.usage.outputTokens;
                   log.cacheReadTokens = event.usage.cacheReadTokens;
                   log.cacheWriteTokens = event.usage.cacheWriteTokens;
-                  log.costUsd = priceOf(candidate, event.usage);
+                  log.costUsd = priceOf(candidate.target.costPerMTok, event.usage, candidate.target.provider);
                 }
                 if (event.type === "error") {
                   terminal = true;
@@ -38484,6 +38818,14 @@ async function dispatch(request2, deps, signal) {
               lastError = retryAfterMs === undefined ? new GatewayError(code2, message) : new GatewayError(code2, message, { retryAfterMs });
               if (code2 === "AUTH" && !committed && !authRefreshRetried && !preemptiveRefreshRequired && candidate.credential.authType === "oauth" && candidate.credential.hasRefreshToken) {
                 authRefreshRetried = true;
+                logger2.warn("attempt authentication failed; refreshing credential", {
+                  requestId,
+                  provider: candidate.target.provider,
+                  model: candidate.target.model,
+                  credentialId: candidate.credential.id,
+                  attempt: i + 1,
+                  code: code2
+                });
                 try {
                   retrySecrets = await waitForCancellation(deps.refresh(candidate.credential), dispatchSignal);
                   continue;
@@ -38505,6 +38847,18 @@ async function dispatch(request2, deps, signal) {
                 ...failure.retryAfterMs === undefined ? {} : { retryAfterMs: failure.retryAfterMs },
                 jitter: deps.rand()
               }));
+              if (!committed && RETRYABLE[failure.code] && i + 1 < maxAttempts) {
+                logger2.warn("attempt failed; retrying", {
+                  requestId,
+                  provider: candidate.target.provider,
+                  model: candidate.target.model,
+                  credentialId: candidate.credential.id,
+                  attempt: i + 1,
+                  code: failure.code,
+                  retryable: true,
+                  retryAfterMs: failure.retryAfterMs
+                });
+              }
               if (committed) {
                 log.status = HTTP_STATUS[failure.code];
                 log.errorCode = failure.code;
@@ -38541,11 +38895,6 @@ async function dispatch(request2, deps, signal) {
   }
   return { events: run(), log: () => log };
 }
-function priceOf(candidate, usage) {
-  const p = candidate.target.costPerMTok;
-  const cacheRate = p.cacheRead ?? p.input * 0.1;
-  return (usage.inputTokens * p.input + usage.outputTokens * p.output + usage.cacheReadTokens * cacheRate) / 1e6;
-}
 function waitForCancellation(promise2, signal) {
   if (signal.aborted)
     return Promise.reject(signal.reason);
@@ -38606,7 +38955,12 @@ async function* anthropicStream(events, requestId) {
             content: [],
             stop_reason: null,
             stop_sequence: null,
-            usage: { input_tokens: 0, output_tokens: 0 }
+            usage: {
+              input_tokens: 0,
+              output_tokens: 0,
+              cache_read_input_tokens: 0,
+              cache_creation_input_tokens: 0
+            }
           }
         });
         break;
@@ -38639,7 +38993,9 @@ async function* anthropicStream(events, requestId) {
           delta: { stop_reason: STOP_REASON2[event.stopReason], stop_sequence: null },
           usage: {
             input_tokens: event.usage.inputTokens,
-            output_tokens: event.usage.outputTokens
+            output_tokens: event.usage.outputTokens,
+            cache_read_input_tokens: event.usage.cacheReadTokens,
+            cache_creation_input_tokens: event.usage.cacheWriteTokens
           }
         });
         yield frame("message_stop", { type: "message_stop" });
@@ -38675,7 +39031,9 @@ function anthropicResponse(collected, requestId) {
     stop_sequence: null,
     usage: {
       input_tokens: collected.usage.inputTokens,
-      output_tokens: collected.usage.outputTokens
+      output_tokens: collected.usage.outputTokens,
+      cache_read_input_tokens: collected.usage.cacheReadTokens,
+      cache_creation_input_tokens: collected.usage.cacheWriteTokens
     }
   };
 }
@@ -38684,6 +39042,15 @@ function anthropicErrorBody(code, message) {
 }
 
 // apps/gateway/src/egress/openai.ts
+function usageBody(usage) {
+  const prompt = promptTokens(usage);
+  return {
+    prompt_tokens: prompt,
+    completion_tokens: usage.outputTokens,
+    total_tokens: prompt + usage.outputTokens,
+    prompt_tokens_details: { cached_tokens: usage.cacheReadTokens }
+  };
+}
 var FINISH2 = {
   endTurn: "stop",
   maxTokens: "length",
@@ -38781,11 +39148,7 @@ async function* openaiStream(events, requestId, created) {
         break;
       case "end":
         completed = true;
-        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH2[event.stopReason] }, {
-          prompt_tokens: event.usage.inputTokens,
-          completion_tokens: event.usage.outputTokens,
-          total_tokens: event.usage.inputTokens + event.usage.outputTokens
-        }));
+        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH2[event.stopReason] }, usageBody(event.usage)));
         break;
       case "error": {
         const e = ERROR_TYPE3[event.code];
@@ -38822,11 +39185,7 @@ function openaiResponse(collected, requestId, created) {
         finish_reason: FINISH2[collected.stopReason]
       }
     ],
-    usage: {
-      prompt_tokens: collected.usage.inputTokens,
-      completion_tokens: collected.usage.outputTokens,
-      total_tokens: collected.usage.inputTokens + collected.usage.outputTokens
-    }
+    usage: usageBody(collected.usage)
   };
 }
 function openaiErrorBody(code, message) {
@@ -38835,14 +39194,19 @@ function openaiErrorBody(code, message) {
 }
 
 // apps/gateway/src/ingress/anthropic.ts
-var textBlock = exports_external.object({ type: exports_external.literal("text"), text: exports_external.string() });
+var textBlock = exports_external.object({
+  type: exports_external.literal("text"),
+  text: exports_external.string(),
+  cache_control: cacheControlSchema.optional()
+});
 var imageBlock = exports_external.object({
   type: exports_external.literal("image"),
   source: exports_external.object({
     type: exports_external.literal("base64"),
     media_type: exports_external.string(),
     data: exports_external.string()
-  })
+  }),
+  cache_control: cacheControlSchema.optional()
 });
 var thinkingBlock = exports_external.object({
   type: exports_external.literal("thinking"),
@@ -38853,13 +39217,15 @@ var toolUseBlock = exports_external.object({
   type: exports_external.literal("tool_use"),
   id: exports_external.string(),
   name: exports_external.string(),
-  input: exports_external.record(exports_external.string(), exports_external.unknown()).default({})
+  input: exports_external.record(exports_external.string(), exports_external.unknown()).default({}),
+  cache_control: cacheControlSchema.optional()
 });
 var toolResultBlock = exports_external.object({
   type: exports_external.literal("tool_result"),
   tool_use_id: exports_external.string(),
   content: exports_external.union([exports_external.string(), exports_external.array(exports_external.unknown())]).optional(),
-  is_error: exports_external.boolean().optional()
+  is_error: exports_external.boolean().optional(),
+  cache_control: cacheControlSchema.optional()
 });
 var block = exports_external.discriminatedUnion("type", [
   textBlock,
@@ -38883,7 +39249,8 @@ var schema = exports_external.object({
   tools: exports_external.array(exports_external.object({
     name: exports_external.string(),
     description: exports_external.string().optional(),
-    input_schema: exports_external.record(exports_external.string(), exports_external.unknown())
+    input_schema: exports_external.record(exports_external.string(), exports_external.unknown()),
+    cache_control: cacheControlSchema.optional()
   })).optional(),
   tool_choice: exports_external.union([
     exports_external.object({ type: exports_external.enum(["auto", "any", "none"]) }),
@@ -38927,9 +39294,14 @@ function flattenToolResult(content) {
 function toIrBlock(b) {
   switch (b.type) {
     case "text":
-      return { type: "text", text: b.text };
+      return { type: "text", text: b.text, ...irCacheControl(b.cache_control) };
     case "image":
-      return { type: "image", mediaType: b.source.media_type, data: b.source.data };
+      return {
+        type: "image",
+        mediaType: b.source.media_type,
+        data: b.source.data,
+        ...irCacheControl(b.cache_control)
+      };
     case "thinking":
       return {
         type: "thinking",
@@ -38937,13 +39309,20 @@ function toIrBlock(b) {
         ...b.signature !== undefined && { signature: b.signature }
       };
     case "tool_use":
-      return { type: "toolUse", id: b.id, name: b.name, input: b.input };
+      return {
+        type: "toolUse",
+        id: b.id,
+        name: b.name,
+        input: b.input,
+        ...irCacheControl(b.cache_control)
+      };
     case "tool_result":
       return {
         type: "toolResult",
         toolUseId: b.tool_use_id,
         content: flattenToolResult(b.content),
-        isError: b.is_error ?? false
+        isError: b.is_error ?? false,
+        ...irCacheControl(b.cache_control)
       };
   }
 }
@@ -38990,7 +39369,11 @@ function parseAnthropicRequest(body2, headers) {
     role: m.role,
     content: typeof m.content === "string" ? [{ type: "text", text: m.content }] : m.content.map(toIrBlock)
   }));
-  const system = parsed.system === undefined ? undefined : typeof parsed.system === "string" ? [{ type: "text", text: parsed.system }] : parsed.system.map((b) => ({ type: "text", text: b.text }));
+  const system = parsed.system === undefined ? undefined : typeof parsed.system === "string" ? [{ type: "text", text: parsed.system }] : parsed.system.map((b) => ({
+    type: "text",
+    text: b.text,
+    ...irCacheControl(b.cache_control)
+  }));
   const request2 = {
     model: parsed.model,
     messages,
@@ -39008,7 +39391,8 @@ function parseAnthropicRequest(body2, headers) {
     request2.tools = parsed.tools.map((t2) => ({
       name: t2.name,
       ...t2.description !== undefined && { description: t2.description },
-      inputSchema: t2.input_schema
+      inputSchema: t2.input_schema,
+      ...irCacheControl(t2.cache_control)
     }));
   }
   if (parsed.tool_choice !== undefined)
@@ -39030,8 +39414,16 @@ function parseAnthropicRequest(body2, headers) {
 
 // apps/gateway/src/ingress/openai.ts
 var part = exports_external.discriminatedUnion("type", [
-  exports_external.object({ type: exports_external.literal("text"), text: exports_external.string() }),
-  exports_external.object({ type: exports_external.literal("image_url"), image_url: exports_external.object({ url: exports_external.string() }) })
+  exports_external.object({
+    type: exports_external.literal("text"),
+    text: exports_external.string(),
+    cache_control: exports_external.unknown().optional()
+  }),
+  exports_external.object({
+    type: exports_external.literal("image_url"),
+    image_url: exports_external.object({ url: exports_external.string() }),
+    cache_control: exports_external.unknown().optional()
+  })
 ]);
 var toolCall = exports_external.object({
   id: exports_external.string(),
@@ -39042,7 +39434,8 @@ var message2 = exports_external.object({
   role: exports_external.enum(["system", "developer", "user", "assistant", "tool"]),
   content: exports_external.union([exports_external.string(), exports_external.array(part), exports_external.null()]).optional(),
   tool_calls: exports_external.array(toolCall).optional(),
-  tool_call_id: exports_external.string().optional()
+  tool_call_id: exports_external.string().optional(),
+  cache_control: exports_external.unknown().optional()
 });
 var schema2 = exports_external.object({
   model: exports_external.string().min(1),
@@ -39057,8 +39450,10 @@ var schema2 = exports_external.object({
     function: exports_external.object({
       name: exports_external.string(),
       description: exports_external.string().optional(),
-      parameters: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
-    })
+      parameters: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
+      cache_control: exports_external.unknown().optional()
+    }),
+    cache_control: exports_external.unknown().optional()
   })).optional(),
   tool_choice: exports_external.union([
     exports_external.enum(["auto", "none", "required"]),
@@ -39096,11 +39491,15 @@ function contentBlocks(content) {
     return [];
   return content.map((p) => {
     if (p.type === "text")
-      return { type: "text", text: p.text };
+      return { type: "text", text: p.text, ...looseCacheControl(p.cache_control) };
     const { mediaType, data } = parseDataUrl(p.image_url.url);
-    return { type: "image", mediaType, data };
+    return { type: "image", mediaType, data, ...looseCacheControl(p.cache_control) };
   });
 }
+function toolCacheControl(outer, inner) {
+  const parsed = looseCacheControl(outer);
+  return parsed.cacheControl === undefined ? looseCacheControl(inner) : parsed;
+}
 function toIrToolChoice2(c) {
   if (typeof c === "string") {
     if (c === "required")
@@ -39118,7 +39517,9 @@ function parseOpenAIRequest(body2) {
   const messages = [];
   for (const m of parsed.messages) {
     if (m.role === "system" || m.role === "developer") {
-      system.push(...contentBlocks(m.content));
+      const blocks = contentBlocks(m.content);
+      applyMessageCacheControl(blocks, m.cache_control);
+      system.push(...blocks);
       continue;
     }
     if (m.role === "tool") {
@@ -39132,7 +39533,8 @@ function parseOpenAIRequest(body2) {
             type: "toolResult",
             toolUseId: m.tool_call_id,
             content: typeof m.content === "string" ? m.content : "",
-            isError: false
+            isError: false,
+            ...looseCacheControl(m.cache_control)
           }
         ]
       });
@@ -39147,6 +39549,7 @@ function parseOpenAIRequest(body2) {
         input: parseArguments(call.function.arguments)
       });
     }
+    applyMessageCacheControl(content, m.cache_control);
     if (content.length > 0)
       messages.push({ role: m.role, content });
   }
@@ -39172,7 +39575,8 @@ function parseOpenAIRequest(body2) {
     request2.tools = parsed.tools.map((t2) => ({
       name: t2.function.name,
       ...t2.function.description !== undefined && { description: t2.function.description },
-      inputSchema: t2.function.parameters ?? { type: "object" }
+      inputSchema: t2.function.parameters ?? { type: "object" },
+      ...toolCacheControl(t2.cache_control, t2.function.cache_control)
     }));
   }
   if (parsed.tool_choice !== undefined)
@@ -39185,33 +39589,83 @@ function parseOpenAIRequest(body2) {
   return validateRequest(request2);
 }
 
-// apps/gateway/src/logging.ts
-function report(what, requestId, error51) {
-  console.error(what, {
-    requestId,
-    reason: error51 instanceof Error ? error51.message : "unknown"
-  });
+// apps/gateway/src/routes/models.ts
+var CREATED_AT = new Date(0).toISOString();
+function narrower(a, b) {
+  const context = [a.contextWindow, b.contextWindow].filter((n) => n !== undefined);
+  const output = [a.maxOutputTokens, b.maxOutputTokens].filter((n) => n !== undefined);
+  return {
+    ...context.length === 0 ? {} : { contextWindow: Math.min(...context) },
+    ...output.length === 0 ? {} : { maxOutputTokens: Math.min(...output) }
+  };
 }
-async function beginLog(store, log, keyId) {
-  try {
-    await store.usage.begin({ ...log, state: "pending", apiKeyId: keyId });
-  } catch (error51) {
-    report("failed to record request start", log.id, error51);
+function targetLimits(target, auths) {
+  const ways = auths.size === 0 ? ["apiKey"] : [...auths];
+  let listed = {};
+  for (const auth of ways) {
+    const entry = catalogLimits(target.provider, target.model, auth);
+    if (entry === null)
+      continue;
+    listed = narrower(listed, {
+      contextWindow: entry.contextWindow,
+      maxOutputTokens: entry.maxOutputTokens
+    });
   }
+  const contextWindow = target.contextWindow ?? listed.contextWindow;
+  const maxOutputTokens = target.maxOutputTokens ?? listed.maxOutputTokens;
+  return {
+    ...contextWindow === undefined ? {} : { contextWindow },
+    ...maxOutputTokens === undefined ? {} : { maxOutputTokens }
+  };
 }
-async function routeLog(store, requestId, target) {
-  try {
-    await store.usage.route(requestId, target);
-  } catch (error51) {
-    report("failed to record request route", requestId, error51);
+function limitsOf(model, authsByProvider) {
+  let limits = {};
+  for (const target of model.targets) {
+    limits = narrower(limits, targetLimits(target, authsByProvider.get(target.provider) ?? new Set));
   }
+  return limits;
 }
-async function finishLog(store, log, keyId) {
-  try {
-    await store.usage.append({ ...log, apiKeyId: keyId });
-  } catch (error51) {
-    report("failed to persist request log", log.id, error51);
+function displayName(model) {
+  const only = model.targets.length === 1 ? model.targets[0] : undefined;
+  if (only === undefined)
+    return model.id;
+  const labelled = PROVIDER_MODEL_CATALOG[only.provider]?.models.find((choice) => choice.id === only.model);
+  return labelled?.label ?? model.id;
+}
+function servingAuths(credentials) {
+  const byProvider = new Map;
+  for (const credential of credentials) {
+    if (!credential.enabled)
+      continue;
+    const ways = byProvider.get(credential.provider) ?? new Set;
+    ways.add(credential.authType);
+    byProvider.set(credential.provider, ways);
   }
+  return byProvider;
+}
+function describeModel(model, credentials) {
+  const limits = limitsOf(model, servingAuths(credentials));
+  return {
+    id: model.id,
+    object: "model",
+    type: "model",
+    display_name: displayName(model),
+    created: 0,
+    created_at: CREATED_AT,
+    owned_by: "omnigateway",
+    ...limits.contextWindow === undefined ? {} : { max_input_tokens: limits.contextWindow },
+    ...limits.maxOutputTokens === undefined ? {} : { max_tokens: limits.maxOutputTokens }
+  };
+}
+function modelListBody(models, credentials) {
+  const data = models.map((model) => describeModel(model, credentials));
+  return {
+    object: "list",
+    data,
+    has_more: false,
+    first_id: data[0]?.id ?? null,
+    last_id: data[data.length - 1]?.id ?? null
+  };
 }
 
 // apps/gateway/src/routes/proxy.ts
@@ -39230,14 +39684,14 @@ var SSE_HEADERS = {
   connection: "keep-alive",
   "x-accel-buffering": "no"
 };
-function errorResponse2(surface, code, message3) {
+function errorResponse(surface, code, message3) {
   const body2 = surface === "anthropic" ? anthropicErrorBody(code, message3) : openaiErrorBody(code, message3);
   return new Response(JSON.stringify(body2), {
     status: HTTP_STATUS[code],
     headers: { "content-type": "application/json" }
   });
 }
-function asGatewayError2(error51) {
+function asGatewayError(error51) {
   if (error51 instanceof GatewayError)
     return error51;
   return new GatewayError("INTERNAL", error51 instanceof Error ? error51.message : "internal error");
@@ -39245,9 +39699,9 @@ function asGatewayError2(error51) {
 function sseResponse(frames, onDone, keepaliveMs) {
   const encoder2 = new TextEncoder;
   let done = null;
-  const runOnce = () => {
+  const runOnce = (cancelled = false) => {
     if (done === null)
-      done = onDone();
+      done = onDone(cancelled);
     return done;
   };
   let inflight = null;
@@ -39280,7 +39734,7 @@ data: ${data}
     },
     async cancel() {
       await frames.return(undefined);
-      await runOnce();
+      await runOnce(true);
     }
   });
   return new Response(stream2, { headers: SSE_HEADERS });
@@ -39291,9 +39745,34 @@ async function handle(deps, rateLimiter, surface, request2) {
   let keyId = null;
   let requestedModel = "";
   try {
-    const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+    let key;
+    try {
+      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+    } catch (error51) {
+      if (error51 instanceof GatewayError && error51.code === "AUTH") {
+        deps.logger.warn("authentication rejected", {
+          requestId,
+          surface,
+          reason: "invalid credentials"
+        });
+      }
+      throw error51;
+    }
     keyId = key.id;
-    rateLimiter.consume(key.id, key.rateLimitPerMin);
+    try {
+      rateLimiter.consume(key.id, key.rateLimitPerMin);
+    } catch (error51) {
+      if (error51 instanceof GatewayError && error51.code === "RATE_LIMIT") {
+        deps.logger.warn("rate limit rejected", {
+          requestId,
+          surface,
+          apiKeyId: key.id,
+          code: error51.code,
+          retryAfterMs: error51.retryAfterMs
+        });
+      }
+      throw error51;
+    }
     const body2 = await request2.json();
     const chatRequest = surface === "anthropic" ? parseAnthropicRequest(body2, request2.headers) : parseOpenAIRequest(body2);
     if (key.modelAllowlist !== null && !key.modelAllowlist.includes(chatRequest.model)) {
@@ -39305,33 +39784,57 @@ async function handle(deps, rateLimiter, surface, request2) {
       ...deps,
       async onRoute(target) {
         if (began) {
-          await routeLog(deps.store, requestId, target);
+          await routeLog(deps.store, requestId, target, deps.logger);
           return;
         }
         began = true;
-        await beginLog(deps.store, {
+        const log2 = newPendingRequestLog({
           id: requestId,
           at: startedAt,
-          apiKeyId: keyId,
           requestedModel,
           resolvedProvider: target.provider,
           resolvedModel: target.model,
-          credentialId: target.credentialId,
-          attempts: 0,
-          status: 0,
-          errorCode: null,
-          inputTokens: 0,
-          outputTokens: 0,
-          cacheReadTokens: 0,
-          cacheWriteTokens: 0,
-          ttftMs: null,
-          durationMs: 0,
-          costUsd: 0,
-          degradations: []
-        }, keyId);
-      }
-    }, request2.signal);
-    const log = () => finishLog(deps.store, { ...outcome.log(), id: requestId }, keyId);
+          credentialId: target.credentialId
+        });
+        await beginLog(deps.store, log2, keyId, deps.logger);
+      }
+    }, request2.signal, requestId);
+    const log = async (cancelled = false) => {
+      const completed = outcome.log();
+      const wasCancelled = cancelled || request2.signal.aborted;
+      if (wasCancelled && completed.status === 0) {
+        completed.status = 499;
+        completed.errorCode = "interrupted";
+        completed.durationMs = deps.now() - startedAt;
+      }
+      await finishLog(deps.store, completed, keyId, deps.logger);
+      const fields = {
+        requestId,
+        surface,
+        status: completed.status,
+        provider: completed.resolvedProvider ?? undefined,
+        model: completed.resolvedModel ?? undefined,
+        requestedModel: completed.requestedModel,
+        credentialId: completed.credentialId ?? undefined,
+        apiKeyId: keyId ?? undefined,
+        attempts: completed.attempts,
+        code: completed.errorCode ?? undefined,
+        stream: chatRequest.stream,
+        inputTokens: completed.inputTokens,
+        outputTokens: completed.outputTokens,
+        cacheReadTokens: completed.cacheReadTokens,
+        cacheWriteTokens: completed.cacheWriteTokens,
+        costUsd: completed.costUsd,
+        ttftMs: completed.ttftMs,
+        durationMs: completed.durationMs
+      };
+      if (wasCancelled)
+        deps.logger.debug("request cancelled", fields);
+      else if (completed.status >= 400)
+        deps.logger.error("request failed", fields);
+      else
+        deps.logger.info("request done", fields);
+    };
     if (chatRequest.stream) {
       const frames = surface === "anthropic" ? anthropicStream(outcome.events, requestId) : openaiStream(outcome.events, requestId, Math.floor(deps.now() / 1000));
       return sseResponse(frames, log, deps.keepaliveMs);
@@ -39342,7 +39845,7 @@ async function handle(deps, rateLimiter, surface, request2) {
     await log();
     const failure = events.find((e) => e.type === "error");
     if (failure !== undefined)
-      return errorResponse2(surface, failure.code, failure.message);
+      return errorResponse(surface, failure.code, failure.message);
     const collected = collect(events);
     const responseBody = surface === "anthropic" ? anthropicResponse(collected, requestId) : openaiResponse(collected, requestId, Math.floor(deps.now() / 1000));
     return new Response(JSON.stringify(responseBody), {
@@ -39350,59 +39853,61 @@ async function handle(deps, rateLimiter, surface, request2) {
       headers: { "content-type": "application/json" }
     });
   } catch (error51) {
-    const gatewayError = asGatewayError2(error51);
-    await finishLog(deps.store, {
-      id: requestId,
-      state: "done",
-      at: startedAt,
-      apiKeyId: keyId,
+    const gatewayError = asGatewayError(error51);
+    const completed = newCompletedRequestLog(requestId, startedAt, {
       requestedModel,
-      resolvedProvider: null,
-      resolvedModel: null,
-      credentialId: null,
-      attempts: 0,
       status: HTTP_STATUS[gatewayError.code],
       errorCode: gatewayError.code,
-      inputTokens: 0,
-      outputTokens: 0,
-      cacheReadTokens: 0,
-      cacheWriteTokens: 0,
-      ttftMs: null,
-      durationMs: 0,
-      costUsd: 0,
-      degradations: []
-    }, keyId);
-    return errorResponse2(surface, gatewayError.code, gatewayError.message);
+      durationMs: deps.now() - startedAt
+    });
+    await finishLog(deps.store, completed, keyId, deps.logger);
+    deps.logger.error("request failed", {
+      requestId,
+      surface,
+      status: completed.status,
+      requestedModel,
+      apiKeyId: keyId ?? undefined,
+      code: gatewayError.code,
+      attempts: completed.attempts,
+      durationMs: completed.durationMs,
+      reason: gatewayError.message
+    });
+    return errorResponse(surface, gatewayError.code, gatewayError.message);
   }
 }
 function proxyRoutes(deps) {
   const rateLimiter = deps.rateLimiter ?? new ApiKeyRateLimiter(deps.now);
+  const logger2 = deps.logger ?? noopLogger;
   const dispatchDeps = {
     ...deps,
-    snapshots: deps.snapshots ?? createRoutingSnapshotCache(deps.store),
+    logger: logger2,
+    snapshots: deps.snapshots ?? createRoutingSnapshotCache(deps.store, logger2),
     keepaliveMs: deps.keepaliveMs ?? KEEPALIVE_MS
   };
   return new Elysia().post("/v1/messages", ({ request: request2 }) => handle(dispatchDeps, rateLimiter, "anthropic", request2)).post("/v1/chat/completions", ({ request: request2 }) => handle(dispatchDeps, rateLimiter, "openai", request2)).get("/v1/models", async ({ request: request2 }) => {
     try {
       const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
-      const models = await deps.store.config.listModels();
+      const snapshot = await dispatchDeps.snapshots.get(deps.now());
+      const models = [...snapshot.models.values()];
       const visibleModels = key.modelAllowlist === null ? models : models.filter((model) => key.modelAllowlist?.includes(model.id));
-      return Response.json({
-        object: "list",
-        data: visibleModels.map((m) => ({
-          id: m.id,
-          object: "model",
-          created: 0,
-          owned_by: "omnigateway"
-        }))
-      });
+      return Response.json(modelListBody(visibleModels, snapshot.credentials));
     } catch (error51) {
-      const gatewayError = asGatewayError2(error51);
-      return errorResponse2("anthropic", gatewayError.code, gatewayError.message);
+      const gatewayError = asGatewayError(error51);
+      logger2.error("model listing failed", {
+        status: HTTP_STATUS[gatewayError.code],
+        code: gatewayError.code,
+        reason: gatewayError.message
+      });
+      return errorResponse("anthropic", gatewayError.code, gatewayError.message);
     }
   }).onError(({ error: error51 }) => {
-    const gatewayError = asGatewayError2(error51);
-    return errorResponse2("anthropic", gatewayError.code, gatewayError.message);
+    const gatewayError = asGatewayError(error51);
+    logger2.error("unhandled proxy route error", {
+      status: HTTP_STATUS[gatewayError.code],
+      code: gatewayError.code,
+      reason: gatewayError.message
+    });
+    return errorResponse("anthropic", gatewayError.code, gatewayError.message);
   });
 }
 
@@ -39410,18 +39915,20 @@ function proxyRoutes(deps) {
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
 function createApp(deps) {
   const now = deps.now ?? (() => Date.now());
+  const logger2 = deps.logger ?? noopLogger;
   const rand = deps.rand ?? Math.random;
-  const http = deps.http ?? nodeHttpClient();
+  const http = deps.http ?? nodeHttpClient({ logger: logger2, now });
   const adapters = deps.adapters ?? ADAPTERS;
   const requestId = deps.requestId ?? (() => `req_${crypto.randomUUID()}`);
   const rateLimiter = new ApiKeyRateLimiter(now);
-  const snapshots = createRoutingSnapshotCache(deps.store);
+  const snapshots = createRoutingSnapshotCache(deps.store, logger2);
   const admin = createAdminAuth(deps.store, { now, sessionTtlMs: ADMIN_SESSION_TTL_MS });
   const refresh = deps.refresh ?? createRefresher({
     store: deps.store,
     providers: OAUTH_PROVIDERS,
     http,
-    now
+    now,
+    logger: logger2
   });
   const staticDir = deps.staticDir ? resolve(deps.staticDir) : undefined;
   let staticRoot;
@@ -39439,13 +39946,21 @@ function createApp(deps) {
     rand,
     refresh,
     requestId,
-    rateLimiter
-  })).use(adminRoutes({ store: deps.store, admin, now, sessionTtlMs: ADMIN_SESSION_TTL_MS })).use(connectRoutes({
+    rateLimiter,
+    logger: logger2
+  })).use(adminRoutes({
+    store: deps.store,
+    admin,
+    now,
+    sessionTtlMs: ADMIN_SESSION_TTL_MS,
+    logger: logger2
+  })).use(connectRoutes({
     store: deps.store,
     admin,
     providers: OAUTH_PROVIDERS,
     http,
-    now
+    now,
+    logger: logger2
   })).get("/*", ({ path, request: request2, set: set2 }) => {
     const rawPath = new URL(request2.url).pathname;
     const error51 = () => {
@@ -39503,13 +40018,15 @@ var DAY_MS = 24 * 60 * 60 * 1000;
 var ROLLUP_RETENTION_DAYS = 400;
 async function pruneLogs(store, now) {
   const settings = await store.config.getSettings();
-  await store.usage.prune(now - settings.logRetentionDays * DAY_MS);
-  await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS);
+  const raw = await store.usage.prune(now - settings.logRetentionDays * DAY_MS);
+  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS);
+  return { raw, daily };
 }
 function startMaintenance(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const timer = setInterval(() => {
-    pruneLogs(deps.store, deps.now()).catch((error51) => {
-      console.error("log pruning failed", {
+    pruneLogs(deps.store, deps.now()).then(({ raw, daily }) => logger2.debug("request logs pruned", { rawCount: raw, dailyCount: daily })).catch((error51) => {
+      logger2.error("log pruning failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     });
@@ -39524,6 +40041,7 @@ function due(credentials, now) {
   return credentials.filter((c) => c.enabled && c.authType === "oauth" && c.expiresAt !== null && c.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= now);
 }
 async function sweep(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const credentials = await deps.store.credentials.list();
   let refreshed = 0;
   for (const credential of due(credentials, deps.now())) {
@@ -39542,23 +40060,25 @@ async function sweep(deps) {
       refreshed += 1;
     } catch (error51) {
       const code = error51 instanceof GatewayError ? error51.code : "INTERNAL";
-      console.warn("scheduled token refresh failed", {
-        credentialId: credential.id,
+      logger2.warn("scheduled token refresh failed", {
         provider: credential.provider,
-        code
+        credentialId: credential.id,
+        code,
+        reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }
   }
   return refreshed;
 }
 function startRefreshScheduler(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   let running = false;
   const timer = setInterval(() => {
     if (running)
       return;
     running = true;
     sweep(deps).catch((error51) => {
-      console.error("token refresh sweep failed", {
+      logger2.error("token refresh sweep failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }).finally(() => {
@@ -39571,6 +40091,7 @@ function startRefreshScheduler(deps) {
 
 // apps/gateway/src/quota/poller.ts
 async function startQuotaPoller(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const { quotaPollIntervalMs } = await deps.store.config.getSettings();
   if (quotaPollIntervalMs <= 0)
     return () => {};
@@ -39580,7 +40101,7 @@ async function startQuotaPoller(deps) {
       return;
     running = true;
     poll(deps).catch((error51) => {
-      console.error("quota poll failed", {
+      logger2.error("quota poll failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }).finally(() => {
@@ -39594,62 +40115,101 @@ async function startQuotaPoller(deps) {
 }
 
 // apps/gateway/src/index.ts
-var config2 = loadConfig(process.env);
-function dashboardDir() {
-  if (config2.staticDir !== null)
-    return config2.staticDir;
-  const candidates = [
-    resolve2(import.meta.dir, "./public"),
-    resolve2(import.meta.dir, "../../dashboard/dist")
-  ];
-  return candidates.find((path) => existsSync(path)) ?? candidates[1];
-}
-var encryptionKey = await deriveKey(config2.encryptionKey);
-var store = await createStore({
-  path: config2.databasePath,
-  encryptionKey
-});
-var swept = await store.usage.sweepPending();
-if (swept > 0)
-  console.log(`retired ${swept} request(s) interrupted by the last shutdown`);
-var now = () => Date.now();
-var http = nodeHttpClient();
-var refresh = createRefresher({ store, providers: OAUTH_PROVIDERS, http, now });
-var app = createApp({
-  store,
-  baseUrl: config2.baseUrl,
-  http,
-  now,
-  refresh,
-  staticDir: dashboardDir()
-});
-var stopMaintenance = startMaintenance({ store, now });
-var stopRefreshScheduler = startRefreshScheduler({ store, refresh, now });
-var stopQuotaPoller = await startQuotaPoller({
-  store,
-  providers: OAUTH_PROVIDERS,
-  http,
-  refresh,
-  now
-});
-app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
-console.log(`omnigateway listening on http://${config2.host}:${config2.port}`);
-var shuttingDown = false;
-function exitAfterClosingStore(code) {
-  try {
-    store.close();
-  } finally {
-    process.exit(code);
+function stdoutLogger(level) {
+  return createLogger({
+    level,
+    color: Boolean(process.stdout.isTTY),
+    write: (line) => {
+      process.stdout.write(`${line}
+`);
+    }
+  });
+}
+var logger2 = stdoutLogger("info");
+async function main() {
+  const config2 = loadConfig(process.env);
+  logger2 = stdoutLogger(config2.logLevel);
+  if (config2.logLevelFallbackFrom !== null) {
+    logger2.info("invalid log level; using info", { reason: config2.logLevelFallbackFrom });
+  }
+  logger2.info("omnigateway booting", { host: config2.host, port: config2.port });
+  function dashboardDir() {
+    if (config2.staticDir !== null)
+      return config2.staticDir;
+    const candidates = [
+      resolve2(import.meta.dir, "./public"),
+      resolve2(import.meta.dir, "../../dashboard/dist")
+    ];
+    return candidates.find((path) => existsSync(path)) ?? candidates[1];
+  }
+  const encryptionKey = await deriveKey(config2.encryptionKey);
+  const store = await createStore({
+    path: config2.databasePath,
+    encryptionKey,
+    logger: logger2
+  });
+  const swept = await store.usage.sweepPending();
+  if (swept > 0)
+    logger2.info("retired interrupted requests", { count: swept });
+  const now = () => Date.now();
+  const http = nodeHttpClient({ logger: logger2, now });
+  const refresh = createRefresher({ store, providers: OAUTH_PROVIDERS, http, now, logger: logger2 });
+  const staticDir = dashboardDir();
+  logger2.info(existsSync(staticDir) ? "dashboard directory resolved" : "dashboard directory absent", {
+    path: staticDir
+  });
+  const app = createApp({
+    store,
+    baseUrl: config2.baseUrl,
+    http,
+    now,
+    refresh,
+    staticDir,
+    logger: logger2
+  });
+  const stopMaintenance = startMaintenance({ store, now, logger: logger2 });
+  const stopRefreshScheduler = startRefreshScheduler({ store, refresh, now, logger: logger2 });
+  const stopQuotaPoller = await startQuotaPoller({
+    store,
+    providers: OAUTH_PROVIDERS,
+    http,
+    refresh,
+    now,
+    logger: logger2
+  });
+  app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
+  logger2.info("omnigateway listening", { host: config2.host, port: config2.port });
+  let shuttingDown = false;
+  function exitAfterClosingStore(code) {
+    try {
+      store.close();
+    } finally {
+      process.exit(code);
+    }
+  }
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      if (shuttingDown)
+        exitAfterClosingStore(1);
+      logger2.info("shutdown requested", { reason: signal });
+      shuttingDown = true;
+      stopMaintenance();
+      stopRefreshScheduler();
+      stopQuotaPoller();
+      app.stop().then(() => exitAfterClosingStore(0), (error51) => {
+        logger2.error("shutdown failed", {
+          reason: error51 instanceof Error ? error51.message : "unknown"
+        });
+        return exitAfterClosingStore(1);
+      });
+    });
   }
 }
-for (const signal of ["SIGINT", "SIGTERM"]) {
-  process.on(signal, () => {
-    if (shuttingDown)
-      exitAfterClosingStore(1);
-    shuttingDown = true;
-    stopMaintenance();
-    stopRefreshScheduler();
-    stopQuotaPoller();
-    app.stop().then(() => exitAfterClosingStore(0), () => exitAfterClosingStore(1));
+try {
+  await main();
+} catch (error51) {
+  logger2.error("gateway boot failed", {
+    reason: error51 instanceof Error ? error51.message : "unknown"
   });
+  process.exit(1);
 }