omnigateway 0.1.5 → 0.1.7

package/gateway.js

@@ -535,7 +535,7 @@ function flushChunk(parts, chunk) {
 }
 function pushCodeUnit(parts, chunk, codeUnit) {
   chunk.push(codeUnit);
-  if (chunk.length >= CHUNK)
+  if (chunk.length >= CHUNK2)
     flushChunk(parts, chunk);
 }
 function pushCodePoint(parts, chunk, cp) {
@@ -660,8 +660,8 @@ function decodeUTF16LE(bytes) {
 }
 function decodeASCII(bytes) {
   const parts = [];
-  for (let i = 0;i < bytes.length; i += CHUNK) {
-    const end = Math.min(bytes.length, i + CHUNK);
+  for (let i = 0;i < bytes.length; i += CHUNK2) {
+    const end = Math.min(bytes.length, i + CHUNK2);
     const codes = new Array(end - i);
     for (let j = i, k2 = 0;j < end; j++, k2++) {
       codes[k2] = bytes[j] & 127;
@@ -672,8 +672,8 @@ function decodeASCII(bytes) {
 }
 function decodeLatin1(bytes) {
   const parts = [];
-  for (let i = 0;i < bytes.length; i += CHUNK) {
-    const end = Math.min(bytes.length, i + CHUNK);
+  for (let i = 0;i < bytes.length; i += CHUNK2) {
+    const end = Math.min(bytes.length, i + CHUNK2);
     const codes = new Array(end - i);
     for (let j = i, k2 = 0;j < end; j++, k2++) {
       codes[k2] = bytes[j];
@@ -689,7 +689,7 @@ function decodeWindows1252(bytes) {
     const b = bytes[i];
     const extra = b >= 128 && b <= 159 ? WINDOWS_1252_EXTRA[b] : undefined;
     out += extra !== null && extra !== undefined ? extra : String.fromCharCode(b);
-    if (out.length >= CHUNK) {
+    if (out.length >= CHUNK2) {
       parts.push(out);
       out = "";
     }
@@ -698,7 +698,7 @@ function decodeWindows1252(bytes) {
     parts.push(out);
   return parts.join("");
 }
-var WINDOWS_1252_EXTRA, WINDOWS_1252_REVERSE, _utf8Decoder, CHUNK, REPLACEMENT = 65533;
+var WINDOWS_1252_EXTRA, WINDOWS_1252_REVERSE, _utf8Decoder, CHUNK2, REPLACEMENT = 65533;
 var init_lib = __esm(() => {
   WINDOWS_1252_EXTRA = {
     128: "\u20AC",
@@ -733,7 +733,7 @@ var init_lib = __esm(() => {
   for (const [code, char] of Object.entries(WINDOWS_1252_EXTRA)) {
     WINDOWS_1252_REVERSE[char] = Number.parseInt(code, 10);
   }
-  CHUNK = 32 * 1024;
+  CHUNK2 = 32 * 1024;
 });
 
 // node_modules/.bun/token-types@6.1.2/node_modules/token-types/lib/index.js
@@ -5295,35 +5295,6 @@ function createAdminAuth(store, opts) {
     }
   };
 }
-// packages/control/src/config.ts
-var MIN_KEY_LENGTH = 16;
-var DECIMAL_INTEGER = /^\d+$/;
-function optionalText(value, fallback) {
-  return value?.trim() || fallback;
-}
-function loadConfig(env) {
-  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
-  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
-    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
-  }
-  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
-  const rawPort = env.OMNI_PORT ?? "9000";
-  const port = Number(rawPort);
-  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
-  }
-  const derivedBaseUrl = `http://${host}:${port}`;
-  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
-  const staticDir = env.OMNI_STATIC_DIR?.trim();
-  return {
-    port,
-    host,
-    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
-    encryptionKey,
-    baseUrl,
-    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir
-  };
-}
 // packages/ir/src/capabilities.ts
 var PROVIDER_CAPABILITIES = {
   anthropic: { tools: true, images: true, reasoning: true },
@@ -5380,7 +5351,134 @@ class GatewayError extends Error {
     this.retryAfterMs = opts?.retryAfterMs;
   }
 }
+// packages/ir/src/logger.ts
+var LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+var FIELD_ORDER = [
+  "requestId",
+  "surface",
+  "status",
+  "provider",
+  "model",
+  "requestedModel",
+  "credentialId",
+  "apiKeyId",
+  "attempt",
+  "attempts",
+  "code",
+  "retryable",
+  "stream",
+  "inputTokens",
+  "outputTokens",
+  "cacheReadTokens",
+  "cacheWriteTokens",
+  "costUsd",
+  "ttftMs",
+  "durationMs",
+  "retryAfterMs",
+  "count",
+  "rawCount",
+  "dailyCount",
+  "host",
+  "port",
+  "path",
+  "reason"
+];
+var REASON_MAX = 200;
+var LEVEL_COLOR = {
+  debug: "\x1B[2;37m",
+  info: "\x1B[36m",
+  warn: "\x1B[33m",
+  error: "\x1B[31m"
+};
+var RESET = "\x1B[0m";
+var NEEDS_QUOTING = /[\s="]/;
+function renderValue(value) {
+  if (value === null)
+    return "null";
+  if (typeof value !== "string")
+    return String(value);
+  return NEEDS_QUOTING.test(value) ? JSON.stringify(value) : value;
+}
+function formatLine(level, at, msg, fields, color) {
+  const label = level.toUpperCase().padEnd(5, " ");
+  const head = `${new Date(at).toISOString()} ${color ? `${LEVEL_COLOR[level]}${label}${RESET}` : label} ${msg}`;
+  if (fields === undefined)
+    return head;
+  const parts = [];
+  for (const key of FIELD_ORDER) {
+    const value = fields[key];
+    if (value === undefined)
+      continue;
+    const capped = key === "reason" && typeof value === "string" && value.length > REASON_MAX ? `${value.slice(0, REASON_MAX)}\u2026` : value;
+    parts.push(`${key}=${renderValue(capped)}`);
+  }
+  return parts.length === 0 ? head : `${head}  ${parts.join(" ")}`;
+}
+var ANSI = /\u001B\[[0-9;]*m/g;
+var HEAD = /^(\S+) (DEBUG|INFO|WARN|ERROR) {1,2}(.*)$/;
+var FIELDS = / {2}(?=[a-zA-Z]+=)/;
+function parseLine(raw) {
+  const absent = { raw, at: null, level: null, msg: null };
+  const match = HEAD.exec(raw.replace(ANSI, ""));
+  if (match === null)
+    return absent;
+  const [, instant, label, tail] = match;
+  if (instant === undefined || label === undefined || tail === undefined)
+    return absent;
+  const at = Date.parse(instant);
+  if (Number.isNaN(at))
+    return absent;
+  const msg = tail.split(FIELDS, 1)[0] ?? tail;
+  return { raw, at, level: label.toLowerCase(), msg };
+}
+function createLogger(opts) {
+  const threshold = LEVELS[opts.level];
+  const now = opts.now ?? (() => Date.now());
+  const color = opts.color ?? false;
+  const emit = (level, msg, fields) => {
+    if (LEVELS[level] < threshold)
+      return;
+    try {
+      opts.write(formatLine(level, now(), msg, fields, color));
+    } catch {}
+  };
+  return {
+    debug: (msg, fields) => emit("debug", msg, fields),
+    info: (msg, fields) => emit("info", msg, fields),
+    warn: (msg, fields) => emit("warn", msg, fields),
+    error: (msg, fields) => emit("error", msg, fields),
+    enabled: (level) => LEVELS[level] >= threshold
+  };
+}
+var noopLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  enabled: () => false
+};
+function parseLogLevel(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === undefined || normalized.length === 0)
+    return null;
+  return Object.hasOwn(LEVELS, normalized) ? normalized : null;
+}
+// packages/ir/src/request.ts
+function cacheControlOf(block) {
+  return block.type === "thinking" ? undefined : block.cacheControl;
+}
 // packages/ir/src/stream.ts
+function usageFromPromptTotal(promptTokens, outputTokens, cacheReadTokens, cacheWriteTokens = 0) {
+  return {
+    inputTokens: Math.max(0, promptTokens - cacheReadTokens - cacheWriteTokens),
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens
+  };
+}
+function promptTokens(usage) {
+  return usage.inputTokens + usage.cacheReadTokens + usage.cacheWriteTokens;
+}
 function collect(events) {
   let id = "";
   let model = "";
@@ -5410,7 +5508,7 @@ function collect(events) {
         else if (ev.delta.type === "thinking" && acc.kind === "thinking")
           acc.text += ev.delta.text;
         else if (ev.delta.type === "thinkingSignature" && acc.kind === "thinking")
-          acc.signature = ev.delta.signature;
+          acc.signature = (acc.signature ?? "") + ev.delta.signature;
         else if (ev.delta.type === "toolJson" && acc.kind === "toolUse")
           acc.json += ev.delta.partial;
         break;
@@ -5473,6 +5571,41 @@ function validateRequest(req) {
   }
   return { ...req, messages: cleaned };
 }
+// packages/control/src/config.ts
+var MIN_KEY_LENGTH = 16;
+var DECIMAL_INTEGER = /^\d+$/;
+function optionalText(value, fallback) {
+  return value?.trim() || fallback;
+}
+function loadConfig(env) {
+  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
+  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
+    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
+  }
+  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
+  const rawPort = env.OMNI_PORT ?? "9000";
+  const port = Number(rawPort);
+  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
+  }
+  const derivedBaseUrl = `http://${host}:${port}`;
+  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
+  const staticDir = env.OMNI_STATIC_DIR?.trim();
+  const logFile = env.OMNI_LOG_FILE?.trim();
+  const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
+  const logLevel = parseLogLevel(rawLogLevel);
+  return {
+    logLevel: logLevel ?? "info",
+    logLevelFallbackFrom: logLevel === null && rawLogLevel ? rawLogLevel : null,
+    port,
+    host,
+    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
+    encryptionKey,
+    baseUrl,
+    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
+    logFile: logFile === undefined || logFile.length === 0 ? null : logFile
+  };
+}
 // packages/providers/src/body.ts
 var BODY_ORDER = {
   anthropic: [
@@ -5559,8 +5692,13 @@ function applyAnthropicSystem(system) {
     let rewritten = text;
     for (const [from, to] of REWRITES)
       rewritten = rewritten.replaceAll(from, to);
-    if (rewritten.trim().length > 0)
-      kept.push({ type: "text", text: rewritten });
+    if (rewritten.trim().length > 0) {
+      kept.push({
+        type: "text",
+        text: rewritten,
+        ...block.cache_control === undefined ? {} : { cache_control: block.cache_control }
+      });
+    }
   }
   return [{ type: "text", text: billingBlock() }, { type: "text", text: AGENT_PREAMBLE }, ...kept];
 }
@@ -5864,6 +6002,8 @@ async function* decodeAnthropic(messages) {
   let inputTokens = 0;
   let cacheReadTokens = 0;
   let cacheWriteTokens = 0;
+  let cacheWrite5mTokens;
+  let cacheWrite1hTokens;
   let outputTokens = 0;
   let stopReason = "endTurn";
   let terminal = false;
@@ -5877,6 +6017,8 @@ async function* decodeAnthropic(messages) {
         inputTokens = m.usage?.input_tokens ?? 0;
         cacheReadTokens = m.usage?.cache_read_input_tokens ?? 0;
         cacheWriteTokens = m.usage?.cache_creation_input_tokens ?? 0;
+        cacheWrite5mTokens = m.usage?.cache_creation?.ephemeral_5m_input_tokens;
+        cacheWrite1hTokens = m.usage?.cache_creation?.ephemeral_1h_input_tokens;
         yield { type: "start", id: String(m.id ?? ""), model: String(m.model ?? "") };
         break;
       }
@@ -5886,7 +6028,7 @@ async function* decodeAnthropic(messages) {
         if (cb.type === "text")
           yield { type: "blockStart", index, block: { type: "text" } };
         else if (cb.type === "thinking")
-          yield { type: "blockStart", index, block: { type: "thinking" } };
+          yield { type: "blockStart", index, block: { type: "thinking", signed: true } };
         else if (cb.type === "tool_use")
           yield {
             type: "blockStart",
@@ -5906,7 +6048,7 @@ async function* decodeAnthropic(messages) {
             index,
             delta: { type: "thinking", text: delta.thinking ?? "" }
           };
-        else if (delta.type === "signature_delta")
+        else if (delta.type === "signature_delta" && (delta.signature ?? "") !== "")
           yield {
             type: "blockDelta",
             index,
@@ -5936,7 +6078,14 @@ async function* decodeAnthropic(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens }
+          usage: {
+            inputTokens,
+            outputTokens,
+            cacheReadTokens,
+            cacheWriteTokens,
+            ...cacheWrite5mTokens === undefined ? {} : { cacheWrite5mTokens },
+            ...cacheWrite1hTokens === undefined ? {} : { cacheWrite1hTokens }
+          }
         };
         break;
       case "error": {
@@ -5966,25 +6115,36 @@ async function* decodeAnthropic(messages) {
 
 // packages/providers/src/anthropic/wire.ts
 var OAUTH_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+function wireCacheControl(c) {
+  if (c === undefined)
+    return {};
+  return { cache_control: { type: c.type, ...c.ttl === undefined ? {} : { ttl: c.ttl } } };
+}
+function isReplayableThinking(b) {
+  return b.type !== "thinking" || b.signature !== undefined && b.signature !== "";
+}
 function encodeBlock(b) {
+  const cache = wireCacheControl(cacheControlOf(b));
   switch (b.type) {
     case "text":
-      return { type: "text", text: b.text };
+      return { type: "text", text: b.text, ...cache };
     case "image":
       return {
         type: "image",
-        source: { type: "base64", media_type: b.mediaType, data: b.data }
+        source: { type: "base64", media_type: b.mediaType, data: b.data },
+        ...cache
       };
     case "thinking":
       return { type: "thinking", thinking: b.text, signature: b.signature };
     case "toolUse":
-      return { type: "tool_use", id: b.id, name: b.name, input: b.input };
+      return { type: "tool_use", id: b.id, name: b.name, input: b.input, ...cache };
     case "toolResult":
       return {
         type: "tool_result",
         tool_use_id: b.toolUseId,
         content: b.content,
-        is_error: b.isError
+        is_error: b.isError,
+        ...cache
       };
   }
 }
@@ -5992,6 +6152,16 @@ function encodeSystemTurn(content) {
   return content.flatMap((b) => b.type === "text" ? [b.text] : []).join(`
 `);
 }
+function systemCacheControl(req) {
+  const cacheable = req.messages.flatMap((message) => message.content.flatMap((block) => block.type === "thinking" ? [] : [{ role: message.role, block }]));
+  const markedSystemBlocks = cacheable.filter(({ role, block }) => role === "system" && cacheControlOf(block) !== undefined);
+  const final = markedSystemBlocks.at(-1);
+  const promoted = final !== undefined && final.block.type === "text" && cacheable.at(-1) === final ? cacheControlOf(final.block) : undefined;
+  return {
+    ...promoted === undefined ? {} : { promoted },
+    lost: markedSystemBlocks.length > (promoted === undefined ? 0 : 1)
+  };
+}
 function encodeToolChoice(c) {
   switch (c.type) {
     case "auto":
@@ -6006,16 +6176,39 @@ function encodeToolChoice(c) {
 }
 function toWire(req, model, opts) {
   const degradations = [];
-  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text }] : []);
+  const note = (d) => {
+    if (!degradations.includes(d))
+      degradations.push(d);
+  };
+  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text, ...wireCacheControl(b.cacheControl) }] : []);
   if (opts.oauth && system?.[0]?.text !== OAUTH_IDENTITY) {
     system = [{ type: "text", text: OAUTH_IDENTITY }, ...system ?? []];
-    degradations.push("anthropic:oauth-system-prefix");
+    note("anthropic:oauth-system-prefix");
   }
+  const systemCache = systemCacheControl(req);
+  if (systemCache.lost)
+    note("anthropic:system-turn-cache-control-dropped");
   const body = {
     model,
-    messages: req.messages.map((m) => m.role === "system" ? { role: m.role, content: encodeSystemTurn(m.content) } : { role: m.role, content: m.content.map(encodeBlock) }),
+    messages: req.messages.flatMap((m) => {
+      if (m.role !== "system") {
+        const replayable = m.content.filter(isReplayableThinking);
+        if (replayable.length !== m.content.length)
+          note("anthropic:unsigned-thinking-dropped");
+        if (replayable.length === 0)
+          return [];
+        return [{ role: m.role, content: replayable.map(encodeBlock) }];
+      }
+      return [{ role: m.role, content: encodeSystemTurn(m.content) }];
+    }),
     max_tokens: req.maxTokens ?? 4096,
-    stream: req.stream
+    stream: req.stream,
+    ...systemCache.promoted === undefined ? {} : {
+      cache_control: {
+        type: systemCache.promoted.type,
+        ...systemCache.promoted.ttl === undefined ? {} : { ttl: systemCache.promoted.ttl }
+      }
+    }
   };
   if (system !== undefined && system.length > 0)
     body.system = system;
@@ -6027,7 +6220,8 @@ function toWire(req, model, opts) {
     body.tools = req.tools.map((t) => ({
       name: t.name,
       ...t.description === undefined ? {} : { description: t.description },
-      input_schema: t.inputSchema
+      input_schema: t.inputSchema,
+      ...wireCacheControl(t.cacheControl)
     }));
   }
   if (req.toolChoice !== undefined)
@@ -6067,12 +6261,13 @@ var anthropicAdapter = {
     const { body, degradations } = toWire(req.request, req.model, { oauth });
     const withSystem = {
       ...body,
-      system: applyAnthropicSystem(body.system ?? [])
+      system: applyAnthropicSystem(body.system ?? []),
+      stream: true
     };
     const protocol = [
       ["Content-Type", "application/json"],
       ["anthropic-version", API_VERSION],
-      ["Accept", req.request.stream ? "text/event-stream" : "application/json"]
+      ["Accept", "text/event-stream"]
     ];
     const betas = new Set(req.request.betas ?? []);
     if (oauth) {
@@ -6091,6 +6286,7 @@ var anthropicAdapter = {
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const bodyString = signAnthropicBody(JSON.stringify(orderFields(withSystem, BODY_ORDER.anthropic)));
     const res = await req.http({
+      provider: "anthropic",
       url: BASE_URL,
       method: "POST",
       headers,
@@ -6111,22 +6307,26 @@ var ANTHROPIC_MODELS = {
     {
       id: "claude-fable-5",
       label: "Claude Fable 5",
-      pricing: { input: 10, output: 50, cacheRead: 1 }
+      pricing: { input: 10, output: 50, cacheRead: 1, cacheWrite5m: 12.5, cacheWrite1h: 20 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-opus-5",
       label: "Claude Opus 5",
-      pricing: { input: 5, output: 25, cacheRead: 0.5 }
+      pricing: { input: 5, output: 25, cacheRead: 0.5, cacheWrite5m: 6.25, cacheWrite1h: 10 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-sonnet-5",
       label: "Claude Sonnet 5",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 3.75, cacheWrite1h: 6 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-haiku-4-5",
       label: "Claude Haiku 4.5",
-      pricing: { input: 1, output: 5, cacheRead: 0.1 }
+      pricing: { input: 1, output: 5, cacheRead: 0.1, cacheWrite5m: 1.25, cacheWrite1h: 2 },
+      limits: { contextWindow: 200000, maxOutputTokens: 64000 }
     }
   ]
 };
@@ -6138,22 +6338,26 @@ var KIMI_MODELS = {
     {
       id: "k3-256k",
       label: "Kimi K3 \u2014 256K",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "k3",
       label: "Kimi K3 \u2014 up to 1M",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1048576, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding",
       label: "Kimi K2.7 Code",
-      pricing: { input: 0.95, output: 4, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding-highspeed",
       label: "Kimi K2.7 Code \u2014 High Speed",
-      pricing: { input: 0.95, output: 8, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 8, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     }
   ]
 };
@@ -6165,22 +6369,30 @@ var OPENAI_MODELS = {
     {
       id: "gpt-5.6",
       label: "GPT-5.6 \u2014 routes to Sol",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-sol",
       label: "GPT-5.6 Sol \u2014 deepest reasoning",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-terra",
       label: "GPT-5.6 Terra \u2014 balanced",
-      pricing: { input: 2, output: 12, cacheRead: 0.2 }
+      pricing: { input: 2, output: 12, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-luna",
       label: "GPT-5.6 Luna \u2014 fastest",
-      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02 }
+      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     }
   ]
 };
@@ -6192,15 +6404,38 @@ var PROVIDER_MODEL_CATALOG = {
   kimi: KIMI_MODELS
 };
 function catalogPricing(provider, model) {
-  return PROVIDER_MODEL_CATALOG[provider].models.find((entry) => entry.id === model)?.pricing ?? null;
+  return PROVIDER_MODEL_CATALOG[provider]?.models.find((entry) => entry.id === model)?.pricing ?? null;
+}
+function catalogLimits(provider, model, auth = "apiKey") {
+  const entry = PROVIDER_MODEL_CATALOG[provider]?.models.find((choice) => choice.id === model);
+  if (entry === undefined)
+    return null;
+  return (auth === "oauth" ? entry.oauthLimits : undefined) ?? entry.limits;
 }
 // packages/providers/src/http-client.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { Readable } from "stream";
-function nodeHttpClient() {
+function nodeHttpClient(options = {}) {
+  const logger2 = options.logger ?? noopLogger;
+  const now = options.now ?? (() => Date.now());
   return (req) => new Promise((resolve, reject) => {
     const url = new URL(req.url);
+    const startedAt = now();
+    let traced = false;
+    const trace = (status, failed = false) => {
+      if (traced || !logger2.enabled("debug"))
+        return;
+      traced = true;
+      logger2.debug("upstream http", {
+        provider: req.provider,
+        status,
+        host: url.host,
+        path: url.pathname,
+        durationMs: now() - startedAt,
+        reason: failed ? "transport error" : undefined
+      });
+    };
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
     const bodyBytes = Buffer.from(req.body, "utf8");
     const headers = {};
@@ -6228,6 +6463,7 @@ function nodeHttpClient() {
         else if (typeof v === "string")
           responseHeaders.set(k, v);
       }
+      trace(incoming.statusCode);
       resolve({
         status: incoming.statusCode ?? 0,
         headers: responseHeaders,
@@ -6243,17 +6479,17 @@ function nodeHttpClient() {
       });
     });
     const onAbort = () => outgoing.destroy(new Error("aborted"));
-    if (req.signal.aborted) {
-      outgoing.destroy(new Error("aborted"));
-      reject(new Error("aborted"));
-      return;
-    }
-    req.signal.addEventListener("abort", onAbort, { once: true });
     outgoing.on("error", (err) => {
       req.signal.removeEventListener("abort", onAbort);
+      trace(undefined, true);
       reject(err);
     });
     outgoing.on("close", () => req.signal.removeEventListener("abort", onAbort));
+    if (req.signal.aborted) {
+      outgoing.destroy(new Error("aborted"));
+      return;
+    }
+    req.signal.addEventListener("abort", onAbort, { once: true });
     if (bodyBytes.byteLength > 0)
       outgoing.write(bodyBytes);
     outgoing.end();
@@ -6322,12 +6558,8 @@ async function* decodeChat(messages) {
       yield { type: "start", id: String(d.id ?? ""), model: String(d.model ?? "") };
     }
     if (d.usage) {
-      usage = {
-        inputTokens: d.usage.prompt_tokens ?? 0,
-        outputTokens: d.usage.completion_tokens ?? 0,
-        cacheReadTokens: d.usage.prompt_cache_hit_tokens ?? 0,
-        cacheWriteTokens: 0
-      };
+      const details = d.usage.prompt_tokens_details;
+      usage = usageFromPromptTotal(d.usage.prompt_tokens ?? 0, d.usage.completion_tokens ?? 0, details?.cached_tokens ?? d.usage.prompt_cache_hit_tokens ?? 0, details?.cache_creation_tokens ?? details?.cache_write_tokens ?? 0);
     }
     const choice = d.choices?.[0];
     if (!choice)
@@ -6453,7 +6685,12 @@ function toChatWire(req, model) {
 `) });
     }
   }
-  const body = { model, messages, stream: req.stream };
+  const body = {
+    model,
+    messages,
+    stream: req.stream,
+    stream_options: { include_usage: true }
+  };
   if (req.maxTokens !== undefined)
     body.max_tokens = req.maxTokens;
   if (req.temperature !== undefined)
@@ -6494,6 +6731,7 @@ var kimiAdapter = {
     const profile = PROFILES.kimi;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "kimi",
       url: BASE_URL2,
       method: "POST",
       headers,
@@ -6624,12 +6862,7 @@ async function* decodeResponses(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: {
-            inputTokens: r.usage?.input_tokens ?? 0,
-            outputTokens: r.usage?.output_tokens ?? 0,
-            cacheReadTokens: r.usage?.input_tokens_details?.cached_tokens ?? 0,
-            cacheWriteTokens: 0
-          }
+          usage: usageFromPromptTotal(r.usage?.input_tokens ?? 0, r.usage?.output_tokens ?? 0, r.usage?.input_tokens_details?.cached_tokens ?? r.usage?.prompt_tokens_details?.cached_tokens ?? 0)
         };
         break;
       }
@@ -6802,6 +7035,7 @@ var openaiAdapter = {
     const profile = PROFILES.openai;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "openai",
       url: oauth ? OAUTH_URL : API_URL,
       method: "POST",
       headers,
@@ -6822,13 +7056,14 @@ var ADAPTERS = {
   kimi: kimiAdapter
 };
 // packages/control/src/oauth/types.ts
-async function postJson(deps, url, profile2, opts) {
+async function postJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Content-Type", opts.contentType],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "POST",
     headers,
@@ -6842,13 +7077,14 @@ async function postJson(deps, url, profile2, opts) {
   } catch {}
   return { status: res.status, parsed };
 }
-async function getJson(deps, url, profile2, opts) {
+async function getJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Authorization", `Bearer ${opts.accessToken}`],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "GET",
     headers,
@@ -7042,7 +7278,7 @@ function deviceCodeFrom(value) {
   };
 }
 async function post(url, body2, device, deps) {
-  const { status, parsed } = await postJson(deps, url, PROFILES.kimi, {
+  const { status, parsed } = await postJson(deps, "kimi", url, PROFILES.kimi, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID }).toString(),
     extraHeaders: kimiDeviceHeaders(device)
@@ -7145,7 +7381,7 @@ var kimiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const device = deviceFrom(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL, PROFILES.kimi, {
+    const { status, parsed } = await getJson(deps, "kimi", USAGE_URL, PROFILES.kimi, {
       accessToken: secrets.accessToken,
       extraHeaders: kimiDeviceHeaders(device)
     });
@@ -7214,6 +7450,7 @@ function deviceIdFrom(start) {
   return deviceId;
 }
 function createConnectFlows(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const flows = createPendingFlows({ now: deps.now, ttlMs: FLOW_TTL_MS });
   const pollsInFlight = new Map;
   const callbackUri = (provider) => provider === "openai" ? "http://localhost:1455/auth/callback" : "";
@@ -7258,6 +7495,10 @@ function createConnectFlows(deps) {
       disabledAt: null,
       ...result.secrets
     });
+    logger2.info("oauth connect completed", {
+      provider: flow.provider,
+      credentialId: id
+    });
     return { id };
   }
   async function pollOutcome(flowId, poll) {
@@ -7330,6 +7571,62 @@ function createConnectFlows(deps) {
     }
   };
 }
+// packages/control/src/console.ts
+var UNIT_NAME = "omnigateway.service";
+var MAX_CONSOLE_LINES = 500;
+var DEFAULT_CONSOLE_LINES = 200;
+function resolveConsoleSource(input) {
+  const path = input.logFile?.trim();
+  if (path !== undefined && path.length > 0)
+    return { kind: "file", path };
+  if (input.unitInstalled)
+    return { kind: "journal", unit: UNIT_NAME, scope: input.scope };
+  return { kind: "none" };
+}
+function consoleLimit(requested) {
+  const value = requested === undefined ? DEFAULT_CONSOLE_LINES : Number(requested);
+  if (!Number.isFinite(value))
+    return DEFAULT_CONSOLE_LINES;
+  return Math.floor(Math.min(Math.max(1, value), MAX_CONSOLE_LINES));
+}
+function keep(line, query) {
+  if (query.since !== undefined && (line.at === null || line.at <= query.since))
+    return false;
+  if (query.level === undefined || line.level === null)
+    return true;
+  return LEVELS[line.level] >= LEVELS[query.level];
+}
+var SCAN_FACTOR = 20;
+var SCAN_LIMIT = 5000;
+function scanWidth(query) {
+  const filtered = query.level !== undefined || query.since !== undefined;
+  return filtered ? Math.min(query.lines * SCAN_FACTOR, SCAN_LIMIT) : query.lines;
+}
+async function readSource(deps, source, lines) {
+  if (source.kind === "none")
+    return "";
+  if (source.kind === "file")
+    return deps.readFile(source.path, lines) ?? "";
+  const scope = source.scope === "system" ? [] : ["--user"];
+  const result = await deps.run([
+    "journalctl",
+    ...scope,
+    "-u",
+    source.unit,
+    "-n",
+    String(lines),
+    "--no-pager",
+    "--output=cat"
+  ]);
+  return result.code === 0 ? result.stdout : "";
+}
+async function readConsole(deps, source, query) {
+  const limited = { ...query, lines: consoleLimit(query.lines) };
+  const text = await readSource(deps, source, scanWidth(limited));
+  const lines = text.split(`
+`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
+  return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
+}
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -21633,28 +21930,18 @@ var modelSchema = exports_external.object({
     costPerMTok: exports_external.object({
       input: exports_external.number().min(0),
       output: exports_external.number().min(0),
-      cacheRead: exports_external.number().min(0)
-    }),
-    capabilities: exports_external.object({
-      tools: exports_external.boolean(),
-      images: exports_external.boolean(),
-      reasoning: exports_external.boolean()
-    })
-  }).or(exports_external.object({
-    provider: providerIdSchema,
-    model: exports_external.string().min(1),
-    tier: exports_external.number().int().min(1),
-    weight: exports_external.number().positive(),
-    costPerMTok: exports_external.object({
-      input: exports_external.number().min(0),
-      output: exports_external.number().min(0)
+      cacheRead: exports_external.number().min(0).optional(),
+      cacheWrite5m: exports_external.number().min(0).optional(),
+      cacheWrite1h: exports_external.number().min(0).optional()
     }),
+    contextWindow: exports_external.number().int().positive().optional(),
+    maxOutputTokens: exports_external.number().int().positive().optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
       reasoning: exports_external.boolean()
     })
-  }))).min(1, "a virtual model needs at least one target")
+  })).min(1, "a virtual model needs at least one target")
 });
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
@@ -21748,6 +22035,12 @@ async function patchCredential(deps, id, input) {
     ...patch.tier === undefined ? {} : { tier: patch.tier },
     ...patch.weight === undefined ? {} : { weight: patch.weight }
   });
+  if (patch.enabled !== undefined && patch.enabled !== existing.enabled) {
+    (deps.logger ?? noopLogger).info(patch.enabled ? "credential enabled" : "credential disabled", {
+      credentialId: id,
+      provider: existing.provider
+    });
+  }
 }
 async function removeCredential(store, id) {
   await store.credentials.remove(id);
@@ -22009,12 +22302,20 @@ var PREFIX_PROVIDER = [
 ];
 function synthesize(provider, model) {
   const listed = catalogPricing(provider, model);
+  const limits = catalogLimits(provider, model);
   const target = {
     provider,
     model,
     tier: 1,
     weight: 1,
-    costPerMTok: listed === null ? { input: 0, output: 0 } : { input: listed.input, output: listed.output, cacheRead: listed.cacheRead },
+    costPerMTok: listed === null ? { input: 0, output: 0 } : {
+      input: listed.input,
+      output: listed.output,
+      cacheRead: listed.cacheRead,
+      cacheWrite5m: listed.cacheWrite5m,
+      cacheWrite1h: listed.cacheWrite1h
+    },
+    ...limits === null ? {} : { contextWindow: limits.contextWindow, maxOutputTokens: limits.maxOutputTokens },
     capabilities: PROVIDER_CAPABILITIES[provider]
   };
   return { id: `${provider}/${model}`, targets: [target], strategy: "score", isAlias: true };
@@ -23017,7 +23318,9 @@ function createUsageRepo(db) {
 
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
+  const logger2 = opts.logger ?? noopLogger;
   const db = openDb(opts.path);
+  logger2.debug("store opened", { path: opts.path });
   const listeners = new Set;
   const emit = (change) => {
     for (const listener of listeners) {
@@ -23104,7 +23407,7 @@ var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 var SCOPES = "org:create_api_key user:profile user:inference";
 var USAGE_URL2 = "https://api.anthropic.com/api/oauth/usage";
 async function postToken(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL2, PROFILES.anthropic, {
+  const { status, parsed } = await postJson(deps, "anthropic", TOKEN_URL2, PROFILES.anthropic, {
     contentType: "application/json",
     body: JSON.stringify({ ...body2, client_id: CLIENT_ID2 })
   });
@@ -23182,7 +23485,7 @@ var anthropicOAuth = {
   async usage(secrets, deps) {
     if (secrets.accessToken === null)
       return null;
-    const { status, parsed } = await getJson(deps, USAGE_URL2, PROFILES.anthropic, {
+    const { status, parsed } = await getJson(deps, "anthropic", USAGE_URL2, PROFILES.anthropic, {
       accessToken: secrets.accessToken,
       extraHeaders: [
         ["anthropic-beta", "oauth-2025-04-20"],
@@ -23240,7 +23543,7 @@ function parseTokenResponse(value) {
   };
 }
 async function postToken2(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL3, PROFILES.openai, {
+  const { status, parsed } = await postJson(deps, "openai", TOKEN_URL3, PROFILES.openai, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID3 }).toString()
   });
@@ -23339,7 +23642,7 @@ var openaiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const accountId = accountIdFromProviderData(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL3, PROFILES.openai, {
+    const { status, parsed } = await getJson(deps, "openai", USAGE_URL3, PROFILES.openai, {
       accessToken: secrets.accessToken,
       ...accountId === null ? {} : { extraHeaders: [["chatgpt-account-id", accountId]] }
     });
@@ -23360,6 +23663,7 @@ var DISPATCH_REFRESH_LEAD_MS = 120000;
 var SCHEDULER_REFRESH_LEAD_MS = 300000;
 // packages/control/src/oauth/refresh.ts
 function createRefresher(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const inFlight = new Map;
   async function run(credential) {
     const secrets = await credential.openForRefresh();
@@ -23367,11 +23671,20 @@ function createRefresher(deps) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
     const provider = deps.providers[credential.provider];
+    logger2.debug("refreshing credential", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     let result;
     try {
       result = await provider.refresh(secrets.refreshToken, { http: deps.http, now: deps.now }, credential.providerData);
     } catch (error51) {
       if (error51 instanceof GatewayError && error51.code === "AUTH") {
+        logger2.warn("credential disabled: refresh token rejected", {
+          provider: credential.provider,
+          credentialId: credential.id,
+          code: "AUTH"
+        });
         await deps.store.credentials.update(credential.id, {
           enabled: false,
           disabledReason: "tokenRejected",
@@ -23385,6 +23698,10 @@ function createRefresher(deps) {
       accountEmail: result.accountEmail ?? credential.accountEmail,
       providerData: { ...credential.providerData, ...result.providerData }
     });
+    logger2.debug("credential refreshed", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     return result.secrets;
   }
   return function refresh(credential) {
@@ -23424,9 +23741,15 @@ async function probe(deps, credential) {
     observedAt
   }));
   await deps.store.credentials.saveQuota(rows);
+  (deps.logger ?? noopLogger).debug("quota snapshot written", {
+    provider: credential.provider,
+    credentialId: credential.id,
+    count: rows.length
+  });
   return rows;
 }
 async function poll(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const now = deps.now();
   const credentials = (await deps.store.credentials.list()).filter((c) => c.enabled && c.authType === "oauth" && deps.providers[c.provider].usage !== undefined && (cooldowns.get(c.id) ?? 0) <= now);
   let written = 0;
@@ -23440,12 +23763,15 @@ async function poll(deps) {
         if (await probe(deps, credential) !== null)
           written += 1;
       } catch (error51) {
-        if (error51 instanceof GatewayError && error51.code === "RATE_LIMIT") {
+        const rateLimited = error51 instanceof GatewayError && error51.code === "RATE_LIMIT";
+        if (rateLimited) {
           cooldowns.set(credential.id, deps.now() + RATE_LIMIT_COOLDOWN_MS);
         }
-        console.warn("quota probe failed", {
-          credentialId: credential.id,
+        logger2.warn(rateLimited ? "quota probe rate limited" : "quota probe failed", {
           provider: credential.provider,
+          credentialId: credential.id,
+          code: error51 instanceof GatewayError ? error51.code : "INTERNAL",
+          ...rateLimited ? { retryAfterMs: RATE_LIMIT_COOLDOWN_MS } : {},
           reason: error51 instanceof Error ? error51.message : "unknown"
         });
       }
@@ -23463,6 +23789,43 @@ async function putSettings(store, input) {
   await store.config.putSettings(settings);
   return settings;
 }
+// packages/control/src/tail.ts
+import { closeSync, fstatSync, openSync, readSync, statSync } from "fs";
+var CHUNK = 64 * 1024;
+var MAX_BYTES = 8 * 1024 * 1024;
+function tailFile(path, lines) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0)
+      return "";
+    const budget = Math.min(size, MAX_BYTES);
+    let read = 0;
+    let newlines = 0;
+    const chunks = [];
+    while (read < budget && newlines <= lines) {
+      const span = Math.min(CHUNK, budget - read);
+      const buffer = Buffer.allocUnsafe(span);
+      const position = size - read - span;
+      readSync(fd, buffer, 0, span, position);
+      chunks.unshift(buffer);
+      read += span;
+      for (const byte of buffer)
+        if (byte === 10)
+          newlines++;
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
 // packages/control/src/usage.ts
 var MAX_LOG_LIMIT = 500;
 var DEFAULT_LOG_LIMIT = 100;
@@ -37903,7 +38266,7 @@ class ApiKeyRateLimiter {
 }
 
 // apps/gateway/src/dispatch/snapshotCache.ts
-function createRoutingSnapshotCache(store) {
+function createRoutingSnapshotCache(store, logger2 = noopLogger) {
   let snapshot = null;
   let stale = true;
   let version2 = store.routing.version();
@@ -37942,6 +38305,7 @@ function createRoutingSnapshotCache(store) {
       return inFlight;
     const buildGeneration = generation;
     const buildVersion = currentVersion;
+    logger2.debug("routing snapshot cache miss");
     inFlight = buildSnapshot(store, now).then(async (next) => {
       const completedVersion = store.routing.version();
       if (generation !== buildGeneration || completedVersion !== buildVersion) {
@@ -37961,6 +38325,28 @@ function createRoutingSnapshotCache(store) {
 }
 
 // apps/gateway/src/ingress/schemas.ts
+var cacheControlSchema = exports_external.object({
+  type: exports_external.literal("ephemeral"),
+  ttl: exports_external.enum(["5m", "1h"]).optional()
+});
+function looseCacheControl(value) {
+  const parsed = cacheControlSchema.safeParse(value);
+  return parsed.success ? irCacheControl(parsed.data) : {};
+}
+function irCacheControl(c) {
+  if (c === undefined)
+    return {};
+  return { cacheControl: { type: c.type, ...c.ttl === undefined ? {} : { ttl: c.ttl } } };
+}
+function applyMessageCacheControl(blocks, value) {
+  const control = looseCacheControl(value);
+  if (control.cacheControl === undefined)
+    return;
+  const last = blocks.at(-1);
+  if (last === undefined || last.type === "thinking" || cacheControlOf(last) !== undefined)
+    return;
+  Object.assign(last, control);
+}
 function parseOrThrow2(schema, body2) {
   const result = schema.safeParse(body2);
   if (result.success)
@@ -38040,6 +38426,7 @@ function apiErrorHandler(input) {
 
 // apps/gateway/src/routes/admin.ts
 function adminRoutes(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   return new Elysia().onError(apiErrorHandler).get("/api/status", async ({ request: request2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     return {
@@ -38049,7 +38436,9 @@ function adminRoutes(deps) {
   }).post("/api/setup", async ({ request: request2, set: set2 }) => {
     if (await deps.admin.isConfigured()) {
       set2.status = 409;
-      return { error: { code: "CONFLICT", message: "an admin password is already configured" } };
+      return {
+        error: { code: "CONFLICT", message: "an admin password is already configured" }
+      };
     }
     const body2 = await readJsonRecord(request2);
     if (typeof body2?.password !== "string") {
@@ -38063,18 +38452,24 @@ function adminRoutes(deps) {
     }
     if (!created) {
       set2.status = 409;
-      return { error: { code: "CONFLICT", message: "an admin password is already configured" } };
+      return {
+        error: { code: "CONFLICT", message: "an admin password is already configured" }
+      };
     }
     const token = await deps.admin.login(body2.password);
     if (token === null)
       throw new GatewayError("INTERNAL", "could not create admin session");
+    logger2.info("admin setup completed");
     set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/login", async ({ request: request2, set: set2 }) => {
     const body2 = await readJsonRecord(request2);
     const token = typeof body2?.password === "string" ? await deps.admin.login(body2.password) : null;
-    if (token === null)
+    if (token === null) {
+      logger2.info("admin login failed", { reason: "invalid credentials" });
       throw new GatewayError("AUTH", "invalid password");
+    }
+    logger2.info("admin login succeeded");
     set2.headers["set-cookie"] = sessionCookie(request2, token, Math.floor(deps.sessionTtlMs / 1000));
     return { ok: true };
   }).post("/api/logout", async ({ request: request2, set: set2 }) => {
@@ -38142,6 +38537,17 @@ function adminRoutes(deps) {
   }).get("/api/logs", async ({ request: request2, query }) => {
     await requireAdmin(request2, deps.admin);
     return { logs: await recentLogs(deps.store, query.limit) };
+  }).get("/api/console", async ({ request: request2, query }) => {
+    await requireAdmin(request2, deps.admin);
+    if (deps.console === undefined)
+      return { source: "none", lines: [] };
+    const level = parseLogLevel(query.level);
+    const since = Number(query.since);
+    return readConsole(deps.console.deps, deps.console.source, {
+      lines: consoleLimit(query.lines),
+      ...level === null ? {} : { level },
+      ...Number.isFinite(since) && since > 0 ? { since } : {}
+    });
   });
 }
 
@@ -38240,41 +38646,47 @@ function newPendingRequestLog(input) {
     status: 0
   };
 }
-function report(what, requestId, error51) {
-  console.error(what, {
+function report(logger2, what, requestId, error51) {
+  logger2.warn(what, {
     requestId,
     reason: error51 instanceof Error ? error51.message : "unknown"
   });
 }
-async function beginLog(store, log, keyId) {
+async function beginLog(store, log, keyId, logger2 = noopLogger) {
   try {
     await store.usage.begin({ ...log, state: "pending", apiKeyId: keyId });
   } catch (error51) {
-    report("failed to record request start", log.id, error51);
+    report(logger2, "failed to record request start", log.id, error51);
   }
 }
-async function routeLog(store, requestId, target) {
+async function routeLog(store, requestId, target, logger2 = noopLogger) {
   try {
     await store.usage.route(requestId, target);
   } catch (error51) {
-    report("failed to record request route", requestId, error51);
+    report(logger2, "failed to record request route", requestId, error51);
   }
 }
-async function finishLog(store, log, keyId) {
+async function finishLog(store, log, keyId, logger2 = noopLogger) {
   try {
     await store.usage.append({ ...log, apiKeyId: keyId });
   } catch (error51) {
-    report("failed to persist request log", log.id, error51);
+    report(logger2, "failed to persist request log", log.id, error51);
   }
 }
 
 // apps/gateway/src/dispatch/attempt.ts
 async function attempt(opts) {
   const { candidate, adapter, http, now, signal, refresh, refreshLeadMs } = opts;
+  const logger2 = opts.logger ?? noopLogger;
   const credential = candidate.credential;
   let secrets = opts.secrets ?? await credential.openForInference();
   const stale = opts.secrets === undefined && credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt - refreshLeadMs <= now;
   if (stale) {
+    logger2.debug("preemptive credential refresh", {
+      requestId: opts.requestId,
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     if (!credential.hasRefreshToken) {
       throw new GatewayError("AUTH", "credential expired with no refresh token", {
         provider: credential.provider
@@ -38320,8 +38732,35 @@ function classify(error51) {
   return { code: "INTERNAL" };
 }
 
+// apps/gateway/src/dispatch/price.ts
+var WRITE_OVER_INPUT = {
+  anthropic: { fiveMinute: 1.25, oneHour: 2 },
+  openai: { fiveMinute: 0, oneHour: 0 },
+  kimi: { fiveMinute: 0, oneHour: 0 }
+};
+var READ_OVER_INPUT = 0.1;
+function splitWrites(usage) {
+  const { cacheWrite5mTokens: five, cacheWrite1hTokens: hour, cacheWriteTokens: total } = usage;
+  if (five !== undefined && hour !== undefined)
+    return { fiveMinute: five, oneHour: hour };
+  if (five !== undefined)
+    return { fiveMinute: five, oneHour: Math.max(0, total - five) };
+  if (hour !== undefined)
+    return { fiveMinute: Math.max(0, total - hour), oneHour: hour };
+  return { fiveMinute: total, oneHour: 0 };
+}
+function priceOf(prices, usage, provider) {
+  const fallback = WRITE_OVER_INPUT[provider];
+  const readRate = prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+  const write5mRate = prices.cacheWrite5m ?? prices.input * fallback.fiveMinute;
+  const write1hRate = prices.cacheWrite1h ?? prices.input * fallback.oneHour;
+  const writes = splitWrites(usage);
+  return (usage.inputTokens * prices.input + usage.outputTokens * prices.output + usage.cacheReadTokens * readRate + writes.fiveMinute * write5mRate + writes.oneHour * write1hRate) / 1e6;
+}
+
 // apps/gateway/src/dispatch/index.ts
 async function dispatch(request2, deps, signal, requestId) {
+  const logger2 = deps.logger ?? noopLogger;
   const startedAt = deps.now();
   const snapshot = await deps.snapshots.get(startedAt);
   const deadlineAt = startedAt + snapshot.settings.requestDeadlineMs;
@@ -38375,8 +38814,20 @@ async function dispatch(request2, deps, signal, requestId) {
     now: startedAt,
     rand: deps.rand()
   });
+  logger2.debug("routing candidates ranked", {
+    requestId,
+    requestedModel: request2.model,
+    model: candidates[0]?.target.model,
+    credentialId: candidates[0]?.credential.id,
+    count: candidates.length
+  });
   for (const e of excluded) {
     log.degradations.push(`excluded:${e.credentialId}:${e.reason}`);
+    logger2.debug("routing candidate excluded", {
+      requestId,
+      credentialId: e.credentialId,
+      reason: e.reason
+    });
   }
   if (candidates.length === 0) {
     clearDeadline();
@@ -38407,6 +38858,13 @@ async function dispatch(request2, deps, signal, requestId) {
             model: candidate.target.model,
             credentialId: candidate.credential.id
           });
+          logger2.debug("attempt started", {
+            requestId,
+            provider: candidate.target.provider,
+            model: candidate.target.model,
+            credentialId: candidate.credential.id,
+            attempt: i + 1
+          });
           log.inputTokens = 0;
           log.outputTokens = 0;
           log.cacheReadTokens = 0;
@@ -38428,7 +38886,9 @@ async function dispatch(request2, deps, signal, requestId) {
                 signal: dispatchSignal,
                 refresh: (credential) => waitForCancellation(deps.refresh(credential), dispatchSignal),
                 refreshLeadMs: DISPATCH_REFRESH_LEAD_MS,
-                ...retrySecrets === undefined ? {} : { secrets: retrySecrets }
+                ...retrySecrets === undefined ? {} : { secrets: retrySecrets },
+                logger: logger2,
+                requestId
               }), dispatchSignal);
               for (const d of result.degradations)
                 log.degradations.push(d);
@@ -38438,6 +38898,14 @@ async function dispatch(request2, deps, signal, requestId) {
                 if (event.type === "blockDelta" && !committed) {
                   committed = true;
                   log.ttftMs = deps.now() - startedAt;
+                  logger2.debug("stream committed", {
+                    requestId,
+                    provider: candidate.target.provider,
+                    model: candidate.target.model,
+                    credentialId: candidate.credential.id,
+                    attempt: i + 1,
+                    ttftMs: log.ttftMs
+                  });
                   for (const buffered of pending)
                     yield buffered;
                   pending.length = 0;
@@ -38448,7 +38916,7 @@ async function dispatch(request2, deps, signal, requestId) {
                   log.outputTokens = event.usage.outputTokens;
                   log.cacheReadTokens = event.usage.cacheReadTokens;
                   log.cacheWriteTokens = event.usage.cacheWriteTokens;
-                  log.costUsd = priceOf(candidate, event.usage);
+                  log.costUsd = priceOf(candidate.target.costPerMTok, event.usage, candidate.target.provider);
                 }
                 if (event.type === "error") {
                   terminal = true;
@@ -38502,6 +38970,14 @@ async function dispatch(request2, deps, signal, requestId) {
               lastError = retryAfterMs === undefined ? new GatewayError(code2, message) : new GatewayError(code2, message, { retryAfterMs });
               if (code2 === "AUTH" && !committed && !authRefreshRetried && !preemptiveRefreshRequired && candidate.credential.authType === "oauth" && candidate.credential.hasRefreshToken) {
                 authRefreshRetried = true;
+                logger2.warn("attempt authentication failed; refreshing credential", {
+                  requestId,
+                  provider: candidate.target.provider,
+                  model: candidate.target.model,
+                  credentialId: candidate.credential.id,
+                  attempt: i + 1,
+                  code: code2
+                });
                 try {
                   retrySecrets = await waitForCancellation(deps.refresh(candidate.credential), dispatchSignal);
                   continue;
@@ -38523,6 +38999,18 @@ async function dispatch(request2, deps, signal, requestId) {
                 ...failure.retryAfterMs === undefined ? {} : { retryAfterMs: failure.retryAfterMs },
                 jitter: deps.rand()
               }));
+              if (!committed && RETRYABLE[failure.code] && i + 1 < maxAttempts) {
+                logger2.warn("attempt failed; retrying", {
+                  requestId,
+                  provider: candidate.target.provider,
+                  model: candidate.target.model,
+                  credentialId: candidate.credential.id,
+                  attempt: i + 1,
+                  code: failure.code,
+                  retryable: true,
+                  retryAfterMs: failure.retryAfterMs
+                });
+              }
               if (committed) {
                 log.status = HTTP_STATUS[failure.code];
                 log.errorCode = failure.code;
@@ -38559,11 +39047,6 @@ async function dispatch(request2, deps, signal, requestId) {
   }
   return { events: run(), log: () => log };
 }
-function priceOf(candidate, usage) {
-  const p = candidate.target.costPerMTok;
-  const cacheRate = p.cacheRead ?? p.input * 0.1;
-  return (usage.inputTokens * p.input + usage.outputTokens * p.output + usage.cacheReadTokens * cacheRate) / 1e6;
-}
 function waitForCancellation(promise2, signal) {
   if (signal.aborted)
     return Promise.reject(signal.reason);
@@ -38610,6 +39093,9 @@ var frame = (event, data) => ({
 });
 async function* anthropicStream(events, requestId) {
   let model = "";
+  const suppressed = new Set;
+  const outIndex = new Map;
+  let nextOutIndex = 0;
   for await (const event of events) {
     switch (event.type) {
       case "start":
@@ -38624,32 +39110,50 @@ async function* anthropicStream(events, requestId) {
             content: [],
             stop_reason: null,
             stop_sequence: null,
-            usage: { input_tokens: 0, output_tokens: 0 }
+            usage: {
+              input_tokens: 0,
+              output_tokens: 0,
+              cache_read_input_tokens: 0,
+              cache_creation_input_tokens: 0
+            }
           }
         });
         break;
       case "blockStart": {
         const b = event.block;
+        if (b.type === "thinking" && b.signed !== true) {
+          suppressed.add(event.index);
+          break;
+        }
         const content_block = b.type === "text" ? { type: "text", text: "" } : b.type === "thinking" ? { type: "thinking", thinking: "" } : { type: "tool_use", id: b.id, name: b.name, input: {} };
+        const index = nextOutIndex++;
+        outIndex.set(event.index, index);
         yield frame("content_block_start", {
           type: "content_block_start",
-          index: event.index,
+          index,
           content_block
         });
         break;
       }
       case "blockDelta": {
+        if (suppressed.has(event.index))
+          break;
         const d = event.delta;
         const delta2 = d.type === "text" ? { type: "text_delta", text: d.text } : d.type === "thinking" ? { type: "thinking_delta", thinking: d.text } : d.type === "thinkingSignature" ? { type: "signature_delta", signature: d.signature } : { type: "input_json_delta", partial_json: d.partial };
         yield frame("content_block_delta", {
           type: "content_block_delta",
-          index: event.index,
+          index: outIndex.get(event.index) ?? event.index,
           delta: delta2
         });
         break;
       }
       case "blockEnd":
-        yield frame("content_block_stop", { type: "content_block_stop", index: event.index });
+        if (suppressed.has(event.index))
+          break;
+        yield frame("content_block_stop", {
+          type: "content_block_stop",
+          index: outIndex.get(event.index) ?? event.index
+        });
         break;
       case "end":
         yield frame("message_delta", {
@@ -38657,7 +39161,9 @@ async function* anthropicStream(events, requestId) {
           delta: { stop_reason: STOP_REASON2[event.stopReason], stop_sequence: null },
           usage: {
             input_tokens: event.usage.inputTokens,
-            output_tokens: event.usage.outputTokens
+            output_tokens: event.usage.outputTokens,
+            cache_read_input_tokens: event.usage.cacheReadTokens,
+            cache_creation_input_tokens: event.usage.cacheWriteTokens
           }
         });
         yield frame("message_stop", { type: "message_stop" });
@@ -38677,7 +39183,7 @@ function anthropicResponse(collected, requestId) {
     type: "message",
     role: "assistant",
     model: collected.model,
-    content: collected.content.map((b) => {
+    content: collected.content.filter((b) => b.type !== "thinking" || b.signature !== undefined && b.signature !== "").map((b) => {
       switch (b.type) {
         case "text":
           return { type: "text", text: b.text };
@@ -38693,7 +39199,9 @@ function anthropicResponse(collected, requestId) {
     stop_sequence: null,
     usage: {
       input_tokens: collected.usage.inputTokens,
-      output_tokens: collected.usage.outputTokens
+      output_tokens: collected.usage.outputTokens,
+      cache_read_input_tokens: collected.usage.cacheReadTokens,
+      cache_creation_input_tokens: collected.usage.cacheWriteTokens
     }
   };
 }
@@ -38702,6 +39210,15 @@ function anthropicErrorBody(code, message) {
 }
 
 // apps/gateway/src/egress/openai.ts
+function usageBody(usage) {
+  const prompt = promptTokens(usage);
+  return {
+    prompt_tokens: prompt,
+    completion_tokens: usage.outputTokens,
+    total_tokens: prompt + usage.outputTokens,
+    prompt_tokens_details: { cached_tokens: usage.cacheReadTokens }
+  };
+}
 var FINISH2 = {
   endTurn: "stop",
   maxTokens: "length",
@@ -38799,11 +39316,7 @@ async function* openaiStream(events, requestId, created) {
         break;
       case "end":
         completed = true;
-        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH2[event.stopReason] }, {
-          prompt_tokens: event.usage.inputTokens,
-          completion_tokens: event.usage.outputTokens,
-          total_tokens: event.usage.inputTokens + event.usage.outputTokens
-        }));
+        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH2[event.stopReason] }, usageBody(event.usage)));
         break;
       case "error": {
         const e = ERROR_TYPE3[event.code];
@@ -38840,11 +39353,7 @@ function openaiResponse(collected, requestId, created) {
         finish_reason: FINISH2[collected.stopReason]
       }
     ],
-    usage: {
-      prompt_tokens: collected.usage.inputTokens,
-      completion_tokens: collected.usage.outputTokens,
-      total_tokens: collected.usage.inputTokens + collected.usage.outputTokens
-    }
+    usage: usageBody(collected.usage)
   };
 }
 function openaiErrorBody(code, message) {
@@ -38853,14 +39362,19 @@ function openaiErrorBody(code, message) {
 }
 
 // apps/gateway/src/ingress/anthropic.ts
-var textBlock = exports_external.object({ type: exports_external.literal("text"), text: exports_external.string() });
+var textBlock = exports_external.object({
+  type: exports_external.literal("text"),
+  text: exports_external.string(),
+  cache_control: cacheControlSchema.optional()
+});
 var imageBlock = exports_external.object({
   type: exports_external.literal("image"),
   source: exports_external.object({
     type: exports_external.literal("base64"),
     media_type: exports_external.string(),
     data: exports_external.string()
-  })
+  }),
+  cache_control: cacheControlSchema.optional()
 });
 var thinkingBlock = exports_external.object({
   type: exports_external.literal("thinking"),
@@ -38871,13 +39385,15 @@ var toolUseBlock = exports_external.object({
   type: exports_external.literal("tool_use"),
   id: exports_external.string(),
   name: exports_external.string(),
-  input: exports_external.record(exports_external.string(), exports_external.unknown()).default({})
+  input: exports_external.record(exports_external.string(), exports_external.unknown()).default({}),
+  cache_control: cacheControlSchema.optional()
 });
 var toolResultBlock = exports_external.object({
   type: exports_external.literal("tool_result"),
   tool_use_id: exports_external.string(),
   content: exports_external.union([exports_external.string(), exports_external.array(exports_external.unknown())]).optional(),
-  is_error: exports_external.boolean().optional()
+  is_error: exports_external.boolean().optional(),
+  cache_control: cacheControlSchema.optional()
 });
 var block = exports_external.discriminatedUnion("type", [
   textBlock,
@@ -38901,7 +39417,8 @@ var schema = exports_external.object({
   tools: exports_external.array(exports_external.object({
     name: exports_external.string(),
     description: exports_external.string().optional(),
-    input_schema: exports_external.record(exports_external.string(), exports_external.unknown())
+    input_schema: exports_external.record(exports_external.string(), exports_external.unknown()),
+    cache_control: cacheControlSchema.optional()
   })).optional(),
   tool_choice: exports_external.union([
     exports_external.object({ type: exports_external.enum(["auto", "any", "none"]) }),
@@ -38945,9 +39462,14 @@ function flattenToolResult(content) {
 function toIrBlock(b) {
   switch (b.type) {
     case "text":
-      return { type: "text", text: b.text };
+      return { type: "text", text: b.text, ...irCacheControl(b.cache_control) };
     case "image":
-      return { type: "image", mediaType: b.source.media_type, data: b.source.data };
+      return {
+        type: "image",
+        mediaType: b.source.media_type,
+        data: b.source.data,
+        ...irCacheControl(b.cache_control)
+      };
     case "thinking":
       return {
         type: "thinking",
@@ -38955,13 +39477,20 @@ function toIrBlock(b) {
         ...b.signature !== undefined && { signature: b.signature }
       };
     case "tool_use":
-      return { type: "toolUse", id: b.id, name: b.name, input: b.input };
+      return {
+        type: "toolUse",
+        id: b.id,
+        name: b.name,
+        input: b.input,
+        ...irCacheControl(b.cache_control)
+      };
     case "tool_result":
       return {
         type: "toolResult",
         toolUseId: b.tool_use_id,
         content: flattenToolResult(b.content),
-        isError: b.is_error ?? false
+        isError: b.is_error ?? false,
+        ...irCacheControl(b.cache_control)
       };
   }
 }
@@ -39008,7 +39537,11 @@ function parseAnthropicRequest(body2, headers) {
     role: m.role,
     content: typeof m.content === "string" ? [{ type: "text", text: m.content }] : m.content.map(toIrBlock)
   }));
-  const system = parsed.system === undefined ? undefined : typeof parsed.system === "string" ? [{ type: "text", text: parsed.system }] : parsed.system.map((b) => ({ type: "text", text: b.text }));
+  const system = parsed.system === undefined ? undefined : typeof parsed.system === "string" ? [{ type: "text", text: parsed.system }] : parsed.system.map((b) => ({
+    type: "text",
+    text: b.text,
+    ...irCacheControl(b.cache_control)
+  }));
   const request2 = {
     model: parsed.model,
     messages,
@@ -39026,7 +39559,8 @@ function parseAnthropicRequest(body2, headers) {
     request2.tools = parsed.tools.map((t2) => ({
       name: t2.name,
       ...t2.description !== undefined && { description: t2.description },
-      inputSchema: t2.input_schema
+      inputSchema: t2.input_schema,
+      ...irCacheControl(t2.cache_control)
     }));
   }
   if (parsed.tool_choice !== undefined)
@@ -39048,8 +39582,16 @@ function parseAnthropicRequest(body2, headers) {
 
 // apps/gateway/src/ingress/openai.ts
 var part = exports_external.discriminatedUnion("type", [
-  exports_external.object({ type: exports_external.literal("text"), text: exports_external.string() }),
-  exports_external.object({ type: exports_external.literal("image_url"), image_url: exports_external.object({ url: exports_external.string() }) })
+  exports_external.object({
+    type: exports_external.literal("text"),
+    text: exports_external.string(),
+    cache_control: exports_external.unknown().optional()
+  }),
+  exports_external.object({
+    type: exports_external.literal("image_url"),
+    image_url: exports_external.object({ url: exports_external.string() }),
+    cache_control: exports_external.unknown().optional()
+  })
 ]);
 var toolCall = exports_external.object({
   id: exports_external.string(),
@@ -39060,7 +39602,8 @@ var message2 = exports_external.object({
   role: exports_external.enum(["system", "developer", "user", "assistant", "tool"]),
   content: exports_external.union([exports_external.string(), exports_external.array(part), exports_external.null()]).optional(),
   tool_calls: exports_external.array(toolCall).optional(),
-  tool_call_id: exports_external.string().optional()
+  tool_call_id: exports_external.string().optional(),
+  cache_control: exports_external.unknown().optional()
 });
 var schema2 = exports_external.object({
   model: exports_external.string().min(1),
@@ -39075,8 +39618,10 @@ var schema2 = exports_external.object({
     function: exports_external.object({
       name: exports_external.string(),
       description: exports_external.string().optional(),
-      parameters: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
-    })
+      parameters: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
+      cache_control: exports_external.unknown().optional()
+    }),
+    cache_control: exports_external.unknown().optional()
   })).optional(),
   tool_choice: exports_external.union([
     exports_external.enum(["auto", "none", "required"]),
@@ -39114,11 +39659,15 @@ function contentBlocks(content) {
     return [];
   return content.map((p) => {
     if (p.type === "text")
-      return { type: "text", text: p.text };
+      return { type: "text", text: p.text, ...looseCacheControl(p.cache_control) };
     const { mediaType, data } = parseDataUrl(p.image_url.url);
-    return { type: "image", mediaType, data };
+    return { type: "image", mediaType, data, ...looseCacheControl(p.cache_control) };
   });
 }
+function toolCacheControl(outer, inner) {
+  const parsed = looseCacheControl(outer);
+  return parsed.cacheControl === undefined ? looseCacheControl(inner) : parsed;
+}
 function toIrToolChoice2(c) {
   if (typeof c === "string") {
     if (c === "required")
@@ -39136,7 +39685,9 @@ function parseOpenAIRequest(body2) {
   const messages = [];
   for (const m of parsed.messages) {
     if (m.role === "system" || m.role === "developer") {
-      system.push(...contentBlocks(m.content));
+      const blocks = contentBlocks(m.content);
+      applyMessageCacheControl(blocks, m.cache_control);
+      system.push(...blocks);
       continue;
     }
     if (m.role === "tool") {
@@ -39150,7 +39701,8 @@ function parseOpenAIRequest(body2) {
             type: "toolResult",
             toolUseId: m.tool_call_id,
             content: typeof m.content === "string" ? m.content : "",
-            isError: false
+            isError: false,
+            ...looseCacheControl(m.cache_control)
           }
         ]
       });
@@ -39165,6 +39717,7 @@ function parseOpenAIRequest(body2) {
         input: parseArguments(call.function.arguments)
       });
     }
+    applyMessageCacheControl(content, m.cache_control);
     if (content.length > 0)
       messages.push({ role: m.role, content });
   }
@@ -39190,7 +39743,8 @@ function parseOpenAIRequest(body2) {
     request2.tools = parsed.tools.map((t2) => ({
       name: t2.function.name,
       ...t2.function.description !== undefined && { description: t2.function.description },
-      inputSchema: t2.function.parameters ?? { type: "object" }
+      inputSchema: t2.function.parameters ?? { type: "object" },
+      ...toolCacheControl(t2.cache_control, t2.function.cache_control)
     }));
   }
   if (parsed.tool_choice !== undefined)
@@ -39203,6 +39757,85 @@ function parseOpenAIRequest(body2) {
   return validateRequest(request2);
 }
 
+// apps/gateway/src/routes/models.ts
+var CREATED_AT = new Date(0).toISOString();
+function narrower(a, b) {
+  const context = [a.contextWindow, b.contextWindow].filter((n) => n !== undefined);
+  const output = [a.maxOutputTokens, b.maxOutputTokens].filter((n) => n !== undefined);
+  return {
+    ...context.length === 0 ? {} : { contextWindow: Math.min(...context) },
+    ...output.length === 0 ? {} : { maxOutputTokens: Math.min(...output) }
+  };
+}
+function targetLimits(target, auths) {
+  const ways = auths.size === 0 ? ["apiKey"] : [...auths];
+  let listed = {};
+  for (const auth of ways) {
+    const entry = catalogLimits(target.provider, target.model, auth);
+    if (entry === null)
+      continue;
+    listed = narrower(listed, {
+      contextWindow: entry.contextWindow,
+      maxOutputTokens: entry.maxOutputTokens
+    });
+  }
+  const contextWindow = target.contextWindow ?? listed.contextWindow;
+  const maxOutputTokens = target.maxOutputTokens ?? listed.maxOutputTokens;
+  return {
+    ...contextWindow === undefined ? {} : { contextWindow },
+    ...maxOutputTokens === undefined ? {} : { maxOutputTokens }
+  };
+}
+function limitsOf(model, authsByProvider) {
+  let limits = {};
+  for (const target of model.targets) {
+    limits = narrower(limits, targetLimits(target, authsByProvider.get(target.provider) ?? new Set));
+  }
+  return limits;
+}
+function displayName(model) {
+  const only = model.targets.length === 1 ? model.targets[0] : undefined;
+  if (only === undefined)
+    return model.id;
+  const labelled = PROVIDER_MODEL_CATALOG[only.provider]?.models.find((choice) => choice.id === only.model);
+  return labelled?.label ?? model.id;
+}
+function servingAuths(credentials) {
+  const byProvider = new Map;
+  for (const credential of credentials) {
+    if (!credential.enabled)
+      continue;
+    const ways = byProvider.get(credential.provider) ?? new Set;
+    ways.add(credential.authType);
+    byProvider.set(credential.provider, ways);
+  }
+  return byProvider;
+}
+function describeModel(model, credentials) {
+  const limits = limitsOf(model, servingAuths(credentials));
+  return {
+    id: model.id,
+    object: "model",
+    type: "model",
+    display_name: displayName(model),
+    created: 0,
+    created_at: CREATED_AT,
+    owned_by: "omnigateway",
+    ...limits.contextWindow === undefined ? {} : { max_input_tokens: limits.contextWindow },
+    ...limits.maxOutputTokens === undefined ? {} : { max_tokens: limits.maxOutputTokens }
+  };
+}
+function modelListBody(models, credentials) {
+  const data = models.map((model) => describeModel(model, credentials));
+  return {
+    object: "list",
+    data,
+    has_more: false,
+    first_id: data[0]?.id ?? null,
+    last_id: data[data.length - 1]?.id ?? null
+  };
+}
+
 // apps/gateway/src/routes/proxy.ts
 var KEEPALIVE_MS = 1e4;
 var KEEPALIVE = Symbol("keepalive");
@@ -39234,9 +39867,9 @@ function asGatewayError(error51) {
 function sseResponse(frames, onDone, keepaliveMs) {
   const encoder2 = new TextEncoder;
   let done = null;
-  const runOnce = () => {
+  const runOnce = (cancelled = false) => {
     if (done === null)
-      done = onDone();
+      done = onDone(cancelled);
     return done;
   };
   let inflight = null;
@@ -39269,7 +39902,7 @@ data: ${data}
     },
     async cancel() {
       await frames.return(undefined);
-      await runOnce();
+      await runOnce(true);
     }
   });
   return new Response(stream2, { headers: SSE_HEADERS });
@@ -39280,9 +39913,34 @@ async function handle(deps, rateLimiter, surface, request2) {
   let keyId = null;
   let requestedModel = "";
   try {
-    const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+    let key;
+    try {
+      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+    } catch (error51) {
+      if (error51 instanceof GatewayError && error51.code === "AUTH") {
+        deps.logger.warn("authentication rejected", {
+          requestId,
+          surface,
+          reason: "invalid credentials"
+        });
+      }
+      throw error51;
+    }
     keyId = key.id;
-    rateLimiter.consume(key.id, key.rateLimitPerMin);
+    try {
+      rateLimiter.consume(key.id, key.rateLimitPerMin);
+    } catch (error51) {
+      if (error51 instanceof GatewayError && error51.code === "RATE_LIMIT") {
+        deps.logger.warn("rate limit rejected", {
+          requestId,
+          surface,
+          apiKeyId: key.id,
+          code: error51.code,
+          retryAfterMs: error51.retryAfterMs
+        });
+      }
+      throw error51;
+    }
     const body2 = await request2.json();
     const chatRequest = surface === "anthropic" ? parseAnthropicRequest(body2, request2.headers) : parseOpenAIRequest(body2);
     if (key.modelAllowlist !== null && !key.modelAllowlist.includes(chatRequest.model)) {
@@ -39294,7 +39952,7 @@ async function handle(deps, rateLimiter, surface, request2) {
       ...deps,
       async onRoute(target) {
         if (began) {
-          await routeLog(deps.store, requestId, target);
+          await routeLog(deps.store, requestId, target, deps.logger);
           return;
         }
         began = true;
@@ -39306,10 +39964,19 @@ async function handle(deps, rateLimiter, surface, request2) {
           resolvedModel: target.model,
           credentialId: target.credentialId
         });
-        await beginLog(deps.store, log2, keyId);
+        await beginLog(deps.store, log2, keyId, deps.logger);
       }
     }, request2.signal, requestId);
-    const log = () => finishLog(deps.store, outcome.log(), keyId);
+    const log = async (cancelled = false) => {
+      const completed = outcome.log();
+      const wasCancelled = cancelled || request2.signal.aborted;
+      if (wasCancelled && completed.status === 0) {
+        completed.status = 499;
+        completed.errorCode = "interrupted";
+        completed.durationMs = deps.now() - startedAt;
+      }
+      await finishLog(deps.store, completed, keyId, deps.logger);
+    };
     if (chatRequest.stream) {
       const frames = surface === "anthropic" ? anthropicStream(outcome.events, requestId) : openaiStream(outcome.events, requestId, Math.floor(deps.now() / 1000));
       return sseResponse(frames, log, deps.keepaliveMs);
@@ -39329,41 +39996,55 @@ async function handle(deps, rateLimiter, surface, request2) {
     });
   } catch (error51) {
     const gatewayError = asGatewayError(error51);
-    await finishLog(deps.store, newCompletedRequestLog(requestId, startedAt, {
+    const completed = newCompletedRequestLog(requestId, startedAt, {
       requestedModel,
       status: HTTP_STATUS[gatewayError.code],
-      errorCode: gatewayError.code
-    }), keyId);
+      errorCode: gatewayError.code,
+      durationMs: deps.now() - startedAt
+    });
+    await finishLog(deps.store, completed, keyId, deps.logger);
+    deps.logger.warn("request rejected", {
+      requestId,
+      surface,
+      status: completed.status,
+      code: gatewayError.code,
+      reason: gatewayError.message
+    });
     return errorResponse(surface, gatewayError.code, gatewayError.message);
   }
 }
 function proxyRoutes(deps) {
   const rateLimiter = deps.rateLimiter ?? new ApiKeyRateLimiter(deps.now);
+  const logger2 = deps.logger ?? noopLogger;
   const dispatchDeps = {
     ...deps,
-    snapshots: deps.snapshots ?? createRoutingSnapshotCache(deps.store),
+    logger: logger2,
+    snapshots: deps.snapshots ?? createRoutingSnapshotCache(deps.store, logger2),
     keepaliveMs: deps.keepaliveMs ?? KEEPALIVE_MS
   };
   return new Elysia().post("/v1/messages", ({ request: request2 }) => handle(dispatchDeps, rateLimiter, "anthropic", request2)).post("/v1/chat/completions", ({ request: request2 }) => handle(dispatchDeps, rateLimiter, "openai", request2)).get("/v1/models", async ({ request: request2 }) => {
     try {
       const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
-      const models = await deps.store.config.listModels();
+      const snapshot = await dispatchDeps.snapshots.get(deps.now());
+      const models = [...snapshot.models.values()];
       const visibleModels = key.modelAllowlist === null ? models : models.filter((model) => key.modelAllowlist?.includes(model.id));
-      return Response.json({
-        object: "list",
-        data: visibleModels.map((m) => ({
-          id: m.id,
-          object: "model",
-          created: 0,
-          owned_by: "omnigateway"
-        }))
-      });
+      return Response.json(modelListBody(visibleModels, snapshot.credentials));
     } catch (error51) {
       const gatewayError = asGatewayError(error51);
+      logger2.error("model listing failed", {
+        status: HTTP_STATUS[gatewayError.code],
+        code: gatewayError.code,
+        reason: gatewayError.message
+      });
       return errorResponse("anthropic", gatewayError.code, gatewayError.message);
     }
   }).onError(({ error: error51 }) => {
     const gatewayError = asGatewayError(error51);
+    logger2.error("unhandled proxy route error", {
+      status: HTTP_STATUS[gatewayError.code],
+      code: gatewayError.code,
+      reason: gatewayError.message
+    });
     return errorResponse("anthropic", gatewayError.code, gatewayError.message);
   });
 }
@@ -39372,18 +40053,20 @@ function proxyRoutes(deps) {
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
 function createApp(deps) {
   const now = deps.now ?? (() => Date.now());
+  const logger2 = deps.logger ?? noopLogger;
   const rand = deps.rand ?? Math.random;
-  const http = deps.http ?? nodeHttpClient();
+  const http = deps.http ?? nodeHttpClient({ logger: logger2, now });
   const adapters = deps.adapters ?? ADAPTERS;
   const requestId = deps.requestId ?? (() => `req_${crypto.randomUUID()}`);
   const rateLimiter = new ApiKeyRateLimiter(now);
-  const snapshots = createRoutingSnapshotCache(deps.store);
+  const snapshots = createRoutingSnapshotCache(deps.store, logger2);
   const admin = createAdminAuth(deps.store, { now, sessionTtlMs: ADMIN_SESSION_TTL_MS });
   const refresh = deps.refresh ?? createRefresher({
     store: deps.store,
     providers: OAUTH_PROVIDERS,
     http,
-    now
+    now,
+    logger: logger2
   });
   const staticDir = deps.staticDir ? resolve(deps.staticDir) : undefined;
   let staticRoot;
@@ -39401,13 +40084,22 @@ function createApp(deps) {
     rand,
     refresh,
     requestId,
-    rateLimiter
-  })).use(adminRoutes({ store: deps.store, admin, now, sessionTtlMs: ADMIN_SESSION_TTL_MS })).use(connectRoutes({
+    rateLimiter,
+    logger: logger2
+  })).use(adminRoutes({
+    store: deps.store,
+    admin,
+    now,
+    sessionTtlMs: ADMIN_SESSION_TTL_MS,
+    logger: logger2,
+    ...deps.console === undefined ? {} : { console: deps.console }
+  })).use(connectRoutes({
     store: deps.store,
     admin,
     providers: OAUTH_PROVIDERS,
     http,
-    now
+    now,
+    logger: logger2
   })).get("/*", ({ path, request: request2, set: set2 }) => {
     const rawPath = new URL(request2.url).pathname;
     const error51 = () => {
@@ -39465,13 +40157,15 @@ var DAY_MS = 24 * 60 * 60 * 1000;
 var ROLLUP_RETENTION_DAYS = 400;
 async function pruneLogs(store, now) {
   const settings = await store.config.getSettings();
-  await store.usage.prune(now - settings.logRetentionDays * DAY_MS);
-  await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS);
+  const raw = await store.usage.prune(now - settings.logRetentionDays * DAY_MS);
+  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS);
+  return { raw, daily };
 }
 function startMaintenance(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const timer = setInterval(() => {
-    pruneLogs(deps.store, deps.now()).catch((error51) => {
-      console.error("log pruning failed", {
+    pruneLogs(deps.store, deps.now()).then(({ raw, daily }) => logger2.debug("request logs pruned", { rawCount: raw, dailyCount: daily })).catch((error51) => {
+      logger2.error("log pruning failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     });
@@ -39486,6 +40180,7 @@ function due(credentials, now) {
   return credentials.filter((c) => c.enabled && c.authType === "oauth" && c.expiresAt !== null && c.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= now);
 }
 async function sweep(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const credentials = await deps.store.credentials.list();
   let refreshed = 0;
   for (const credential of due(credentials, deps.now())) {
@@ -39504,23 +40199,25 @@ async function sweep(deps) {
       refreshed += 1;
     } catch (error51) {
       const code = error51 instanceof GatewayError ? error51.code : "INTERNAL";
-      console.warn("scheduled token refresh failed", {
-        credentialId: credential.id,
+      logger2.warn("scheduled token refresh failed", {
         provider: credential.provider,
-        code
+        credentialId: credential.id,
+        code,
+        reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }
   }
   return refreshed;
 }
 function startRefreshScheduler(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   let running = false;
   const timer = setInterval(() => {
     if (running)
       return;
     running = true;
     sweep(deps).catch((error51) => {
-      console.error("token refresh sweep failed", {
+      logger2.error("token refresh sweep failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }).finally(() => {
@@ -39533,6 +40230,7 @@ function startRefreshScheduler(deps) {
 
 // apps/gateway/src/quota/poller.ts
 async function startQuotaPoller(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const { quotaPollIntervalMs } = await deps.store.config.getSettings();
   if (quotaPollIntervalMs <= 0)
     return () => {};
@@ -39542,7 +40240,7 @@ async function startQuotaPoller(deps) {
       return;
     running = true;
     poll(deps).catch((error51) => {
-      console.error("quota poll failed", {
+      logger2.error("quota poll failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });
     }).finally(() => {
@@ -39556,62 +40254,128 @@ async function startQuotaPoller(deps) {
 }
 
 // apps/gateway/src/index.ts
-var config2 = loadConfig(process.env);
-function dashboardDir() {
-  if (config2.staticDir !== null)
-    return config2.staticDir;
-  const candidates = [
-    resolve2(import.meta.dir, "./public"),
-    resolve2(import.meta.dir, "../../dashboard/dist")
-  ];
-  return candidates.find((path) => existsSync(path)) ?? candidates[1];
-}
-var encryptionKey = await deriveKey(config2.encryptionKey);
-var store = await createStore({
-  path: config2.databasePath,
-  encryptionKey
-});
-var swept = await store.usage.sweepPending();
-if (swept > 0)
-  console.log(`retired ${swept} request(s) interrupted by the last shutdown`);
-var now = () => Date.now();
-var http = nodeHttpClient();
-var refresh = createRefresher({ store, providers: OAUTH_PROVIDERS, http, now });
-var app = createApp({
-  store,
-  baseUrl: config2.baseUrl,
-  http,
-  now,
-  refresh,
-  staticDir: dashboardDir()
-});
-var stopMaintenance = startMaintenance({ store, now });
-var stopRefreshScheduler = startRefreshScheduler({ store, refresh, now });
-var stopQuotaPoller = await startQuotaPoller({
-  store,
-  providers: OAUTH_PROVIDERS,
-  http,
-  refresh,
-  now
-});
-app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
-console.log(`omnigateway listening on http://${config2.host}:${config2.port}`);
-var shuttingDown = false;
-function exitAfterClosingStore(code) {
-  try {
-    store.close();
-  } finally {
-    process.exit(code);
+function stdoutLogger(level) {
+  return createLogger({
+    level,
+    color: Boolean(process.stdout.isTTY),
+    write: (line) => {
+      process.stdout.write(`${line}
+`);
+    }
+  });
+}
+var logger2 = stdoutLogger("info");
+function consoleSource(logFile) {
+  const source = resolveConsoleSource({
+    logFile,
+    unitInstalled: process.env.JOURNAL_STREAM !== undefined,
+    scope: process.env.MANAGERPID === undefined ? "system" : "user"
+  });
+  return {
+    source,
+    deps: {
+      readFile: (path, lines) => tailFile(path, lines),
+      run: async (argv) => {
+        const [cmd, ...args] = argv;
+        if (cmd === undefined)
+          return { code: 1, stdout: "", stderr: "empty argv" };
+        const proc = Bun.spawn([cmd, ...args], { stdout: "pipe", stderr: "pipe" });
+        const [stdout, stderr] = await Promise.all([
+          new Response(proc.stdout).text(),
+          new Response(proc.stderr).text()
+        ]);
+        return { code: await proc.exited, stdout, stderr };
+      }
+    }
+  };
+}
+async function main() {
+  const config2 = loadConfig(process.env);
+  logger2 = stdoutLogger(config2.logLevel);
+  if (config2.logLevelFallbackFrom !== null) {
+    logger2.info("invalid log level; using info", { reason: config2.logLevelFallbackFrom });
+  }
+  logger2.info("omnigateway booting", { host: config2.host, port: config2.port });
+  function dashboardDir() {
+    if (config2.staticDir !== null)
+      return config2.staticDir;
+    const candidates = [
+      resolve2(import.meta.dir, "./public"),
+      resolve2(import.meta.dir, "../../dashboard/dist")
+    ];
+    return candidates.find((path) => existsSync(path)) ?? candidates[1];
+  }
+  const encryptionKey = await deriveKey(config2.encryptionKey);
+  const store = await createStore({
+    path: config2.databasePath,
+    encryptionKey,
+    logger: logger2
+  });
+  const swept = await store.usage.sweepPending();
+  if (swept > 0)
+    logger2.info("retired interrupted requests", { count: swept });
+  const console2 = consoleSource(config2.logFile);
+  logger2.info("console log source resolved", { reason: console2.source.kind });
+  const now = () => Date.now();
+  const http = nodeHttpClient({ logger: logger2, now });
+  const refresh = createRefresher({ store, providers: OAUTH_PROVIDERS, http, now, logger: logger2 });
+  const staticDir = dashboardDir();
+  logger2.info(existsSync(staticDir) ? "dashboard directory resolved" : "dashboard directory absent", {
+    path: staticDir
+  });
+  const app = createApp({
+    store,
+    baseUrl: config2.baseUrl,
+    http,
+    now,
+    refresh,
+    staticDir,
+    logger: logger2,
+    console: console2
+  });
+  const stopMaintenance = startMaintenance({ store, now, logger: logger2 });
+  const stopRefreshScheduler = startRefreshScheduler({ store, refresh, now, logger: logger2 });
+  const stopQuotaPoller = await startQuotaPoller({
+    store,
+    providers: OAUTH_PROVIDERS,
+    http,
+    refresh,
+    now,
+    logger: logger2
+  });
+  app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
+  logger2.info("omnigateway listening", { host: config2.host, port: config2.port });
+  let shuttingDown = false;
+  function exitAfterClosingStore(code) {
+    try {
+      store.close();
+    } finally {
+      process.exit(code);
+    }
+  }
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      if (shuttingDown)
+        exitAfterClosingStore(1);
+      logger2.info("shutdown requested", { reason: signal });
+      shuttingDown = true;
+      stopMaintenance();
+      stopRefreshScheduler();
+      stopQuotaPoller();
+      app.stop().then(() => exitAfterClosingStore(0), (error51) => {
+        logger2.error("shutdown failed", {
+          reason: error51 instanceof Error ? error51.message : "unknown"
+        });
+        return exitAfterClosingStore(1);
+      });
+    });
   }
 }
-for (const signal of ["SIGINT", "SIGTERM"]) {
-  process.on(signal, () => {
-    if (shuttingDown)
-      exitAfterClosingStore(1);
-    shuttingDown = true;
-    stopMaintenance();
-    stopRefreshScheduler();
-    stopQuotaPoller();
-    app.stop().then(() => exitAfterClosingStore(0), () => exitAfterClosingStore(1));
+try {
+  await main();
+} catch (error51) {
+  logger2.error("gateway boot failed", {
+    reason: error51 instanceof Error ? error51.message : "unknown"
   });
+  process.exit(1);
 }