omnigateway 0.11.0 → 0.11.2

package/gateway.js

@@ -24927,14 +24927,14 @@ function estimateCachedInputTokens(request) {
   return cached2;
 }
 // packages/ir/src/validate.ts
-function validateRequest(req) {
+function validateRequest(req, newToolUseId = () => `tu_${crypto.randomUUID()}`) {
   const seenToolUseIds = new Set;
   const cleaned = [];
   for (const message of req.messages) {
     const content = [];
     for (const block of message.content) {
       if (block.type === "toolUse") {
-        const id = block.id.length > 0 ? block.id : `tu_${crypto.randomUUID()}`;
+        const id = block.id.length > 0 ? block.id : newToolUseId();
         seenToolUseIds.add(id);
         content.push({ ...block, id });
         continue;
@@ -25574,13 +25574,34 @@ CREATE TRIGGER credential_health_config_version_del
   FOR EACH STATEMENT EXECUTE FUNCTION bump_config_version();
 `;
 
+// packages/store/src/postgres/migrations/003_key_expiry.sql
+var _003_key_expiry_default = `-- The Postgres half of the sqlite migration of the same name. \`BIGINT\`, like
+-- every other epoch-ms column in this schema, and read back through \`numOrNull\`.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`: the column is a deadline, and every
+-- finite default is a date on which somebody's client stops working. NULL is
+-- the only value that says nothing was decided, and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately. Every key on every existing installation was
+-- minted on the promise that it works until revoked, so adding the column and
+-- stopping is what keeps that promise. The absence of an \`UPDATE\` here is the
+-- substance of the migration, not an omission.
+--
+-- Safe to apply under a rolling deploy, unlike migration 2: this adds a
+-- nullable column and drops nothing, so a replica running the previous image
+-- keeps serving \u2014 \`SELECT *\` gains a field its mapper ignores.
+ALTER TABLE api_keys ADD COLUMN expires_at BIGINT;
+`;
+
 // packages/store/src/postgres/db.ts
 var num = (v) => Number(v);
 var numOrNull = (v) => v === null ? null : Number(v);
 var MIGRATION_LOCK = 7140641;
 var MIGRATIONS = [
   { id: 1, sql: _001_init_default },
-  { id: 2, sql: _002_health_measurements_default }
+  { id: 2, sql: _002_health_measurements_default },
+  { id: 3, sql: _003_key_expiry_default }
 ];
 async function openPg(url2) {
   const sql = new SQL({ url: url2 });
@@ -25766,6 +25787,9 @@ function resolvePin(target, accounts) {
     return;
   return accounts.find((account) => servesTarget(target, account));
 }
+var keyUsable = (key, now) => key.revokedAt === null && (key.expiresAt === null || key.expiresAt > now);
+var credentialPastExpiry = (credential, now) => credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now;
+var credentialExpired = (credential, now) => credentialPastExpiry(credential, now) && !credential.hasRefreshToken;
 var NODE_GRACE_MS = 60000;
 var DEFAULT_SETTINGS = {
   weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
@@ -26245,7 +26269,8 @@ var toKey = (r, logger2) => ({
   limits: parseLimits(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out,
   createdAt: num(r.created_at),
-  revokedAt: numOrNull(r.revoked_at)
+  revokedAt: numOrNull(r.revoked_at),
+  expiresAt: numOrNull(r.expires_at)
 });
 function createKeyRepo(sql, logger2) {
   const one = async (where, arg) => {
@@ -26263,8 +26288,8 @@ function createKeyRepo(sql, logger2) {
     async create(input2) {
       const now = Date.now();
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,NULL,$9)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -26272,7 +26297,8 @@ function createKeyRepo(sql, logger2) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -26280,8 +26306,8 @@ function createKeyRepo(sql, logger2) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       await sql.unsafe(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`, [
         row.id,
         row.label,
         row.prefix,
@@ -26290,7 +26316,8 @@ function createKeyRepo(sql, logger2) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -26305,6 +26332,9 @@ function createKeyRepo(sql, logger2) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      await sql.unsafe("UPDATE api_keys SET expires_at = $1 WHERE id = $2", [expiresAt, id]);
+    },
     async revoke(id) {
       await sql.unsafe("UPDATE api_keys SET revoked_at = $1 WHERE id = $2", [Date.now(), id]);
     }
@@ -28109,6 +28139,35 @@ ALTER TABLE credential_health DROP COLUMN ewma_ttft_ms;
 ALTER TABLE credential_health DROP COLUMN last_used_at;
 `;
 
+// packages/store/src/sqlite/migrations/014_key_expiry.sql
+var _014_key_expiry_default = `-- An optional expiry on a gateway API key: an absolute epoch-ms instant after
+-- which the key is refused, spelled exactly as \`credentials.expires_at\` is.
+--
+-- Nullable rather than \`NOT NULL DEFAULT\`, which is the opposite of the choice
+-- migration 9 made for \`limits\`, and for the opposite reason. There, every
+-- possible value is a policy and \`{}\` is the one that means "no ceiling", so a
+-- default gives "unlimited" a single spelling. Here the column is a deadline,
+-- and no number means "no deadline" \u2014 every finite default is a date on which
+-- somebody's client stops working. NULL is the only value that says nothing was
+-- decided, so it is the column's own default and every reader maps it to
+-- "never expires".
+--
+-- No backfill, deliberately, and this is the whole substance of the migration.
+-- Every key on every existing installation was minted on the promise that it
+-- works until revoked; an upgrade that attaches an expiry to those rows breaks
+-- clients on a date the operator never chose, and the failure surfaces days
+-- later as an authentication error with nothing in it that names this change.
+-- Adding the column and stopping is what keeps that promise, so the absence of
+-- an \`UPDATE\` here is load-bearing rather than an omission \u2014
+-- \`packages/store/test/migrations.test.ts\` pins it.
+--
+-- No index. The column is read only after a row has already been found by
+-- \`hash\` or by \`id\`, both of which are unique, so there is no scan for an index
+-- to help; and nothing sweeps expired keys, because an expired key stays listed
+-- exactly as a revoked one does so its usage history keeps its attribution.
+ALTER TABLE api_keys ADD COLUMN expires_at INTEGER;
+`;
+
 // packages/store/src/sqlite/db.ts
 var MIGRATIONS2 = [
   { id: 1, sql: _001_init_default2 },
@@ -28123,7 +28182,8 @@ var MIGRATIONS2 = [
   { id: 10, sql: _010_usage_rollup_default, after: rebuildRollup },
   { id: 11, sql: _011_plugin_migrations_default },
   { id: 12, sql: _012_nodes_default },
-  { id: 13, sql: _013_health_measurements_default }
+  { id: 13, sql: _013_health_measurements_default },
+  { id: 14, sql: _014_key_expiry_default }
 ];
 function statements(sql) {
   return sql.split(`
@@ -28179,7 +28239,8 @@ var toKey2 = (r, logger2) => ({
   limits: parseLimits2(r.id, r.limits, logger2),
   bodyLoggingOptOut: r.body_logging_opt_out === 1,
   createdAt: r.created_at,
-  revokedAt: r.revoked_at
+  revokedAt: r.revoked_at,
+  expiresAt: r.expires_at
 });
 function createKeyRepo2(db, logger2 = noopLogger) {
   return {
@@ -28197,8 +28258,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
     async create(input2) {
       const now = Date.now();
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,NULL)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,NULL,?)`, [
         input2.id,
         input2.label,
         input2.prefix,
@@ -28206,7 +28267,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         input2.modelAllowlist === null ? null : JSON.stringify(input2.modelAllowlist),
         JSON.stringify(parseLimitConfig(input2.limits)),
         input2.bodyLoggingOptOut ? 1 : 0,
-        now
+        now,
+        input2.expiresAt
       ]);
       return { ...input2, createdAt: now, revokedAt: null };
     },
@@ -28214,8 +28276,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
       if (row.limits === null)
         throw new Error(`api key ${row.id} has unreadable limits`);
       db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
-                               body_logging_opt_out, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,?,?)`, [
+                               body_logging_opt_out, created_at, revoked_at, expires_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?)`, [
         row.id,
         row.label,
         row.prefix,
@@ -28224,7 +28286,8 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         JSON.stringify(parseLimitConfig(row.limits)),
         row.bodyLoggingOptOut ? 1 : 0,
         row.createdAt,
-        row.revokedAt
+        row.revokedAt,
+        row.expiresAt
       ]);
     },
     async setLimits(id, limits) {
@@ -28239,6 +28302,9 @@ function createKeyRepo2(db, logger2 = noopLogger) {
         id
       ]);
     },
+    async setExpiry(id, expiresAt) {
+      db.run("UPDATE api_keys SET expires_at = ? WHERE id = ?", [expiresAt, id]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
@@ -28803,6 +28869,7 @@ async function createStore(opts) {
       importRow: (row) => handle.keys.importRow(row),
       setLimits: (id, limits) => handle.keys.setLimits(id, limits),
       setModelAllowlist: (id, modelAllowlist) => handle.keys.setModelAllowlist(id, modelAllowlist),
+      setExpiry: (id, expiresAt) => handle.keys.setExpiry(id, expiresAt),
       revoke: (id) => handle.keys.revoke(id)
     },
     usage: {
@@ -28911,7 +28978,7 @@ function createAdminAuth(store, opts) {
   };
   const keyStillValid = async (apiKeyId) => {
     const key = await store.keys.get(apiKeyId);
-    return key !== null && key.revokedAt === null;
+    return key !== null && keyUsable(key, opts.now());
   };
   const applyPassword = async (password) => {
     if (password.length < MIN_PASSWORD_LENGTH) {
@@ -28965,7 +29032,7 @@ function createAdminAuth(store, opts) {
     },
     async loginClient(rawKey) {
       const key = await store.keys.findByHash(await hashApiKey(rawKey));
-      if (key === null || key.revokedAt !== null)
+      if (key === null || !keyUsable(key, opts.now()))
         return null;
       return issue2({ kind: "client", apiKeyId: key.id });
     },
@@ -36571,16 +36638,19 @@ var modelSchema = exports_external.object({
   isAlias: exports_external.boolean(),
   targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
 });
+var MAX_INSTANT = 8640000000000000;
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable().default(null),
   limits: limitConfigSchema.default({}),
-  bodyLoggingOptOut: exports_external.boolean().default(false)
+  bodyLoggingOptOut: exports_external.boolean().default(false),
+  expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable().default(null)
 }).strict();
 var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
 var keyModelsSchema = exports_external.object({
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable()
 }).strict();
+var keyExpirySchema = exports_external.object({ expiresAt: exports_external.number().int().positive().max(MAX_INSTANT).nullable() }).strict();
 var retentionSchema = exports_external.object({
   keepLatest: exports_external.number().int().min(1).max(100),
   maxAgeDays: exports_external.number().int().min(1).max(3650)
@@ -36795,7 +36865,7 @@ function eligible(input2) {
         drop("disabled");
         continue;
       }
-      if (credential.authType === "oauth" && credential.expiresAt !== null && credential.expiresAt <= now && !credential.hasRefreshToken) {
+      if (credentialExpired(credential, now)) {
         drop("expired");
         continue;
       }
@@ -37741,7 +37811,8 @@ async function toSummary(store, key, now) {
     limitUsage: await readLimitUsage(store, key.id, key.limits, now),
     bodyLoggingOptOut: key.bodyLoggingOptOut,
     createdAt: key.createdAt,
-    revokedAt: key.revokedAt
+    revokedAt: key.revokedAt,
+    expiresAt: key.expiresAt
   };
 }
 async function listKeys(store, now = Date.now()) {
@@ -37764,7 +37835,8 @@ async function createKey(store, input2) {
     hash: await hashApiKey(raw),
     modelAllowlist: body2.modelAllowlist,
     limits: body2.limits,
-    bodyLoggingOptOut: body2.bodyLoggingOptOut
+    bodyLoggingOptOut: body2.bodyLoggingOptOut,
+    expiresAt: body2.expiresAt
   });
   return { id: created.id, label: created.label, prefix: created.prefix, key: raw };
 }
@@ -37784,6 +37856,14 @@ async function setKeyModels(store, id, input2, now = Date.now()) {
   await store.keys.setModelAllowlist(id, body2.modelAllowlist);
   return toSummary(store, { ...key, modelAllowlist: body2.modelAllowlist }, now);
 }
+async function setKeyExpiry(store, id, input2, now = Date.now()) {
+  const body2 = parseOrThrow(keyExpirySchema, input2);
+  const key = await store.keys.get(id);
+  if (key === null)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setExpiry(id, body2.expiresAt);
+  return toSummary(store, { ...key, expiresAt: body2.expiresAt }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -38634,6 +38714,12 @@ async function accountQuota(deps) {
 // packages/control/src/quota/history.ts
 var DAY_MS3 = 24 * 60 * 60 * 1000;
 var HOUR_MS3 = 3600000;
+var MAX_SAMPLES = 50000;
+var SAMPLE_QUERY_LIMIT = MAX_SAMPLES + 1;
+function pageSamples(samples) {
+  const truncated = samples.length > MAX_SAMPLES;
+  return { page: truncated ? samples.slice(0, MAX_SAMPLES) : samples, truncated };
+}
 async function retainedSpan(deps, input2, maxSpanMs) {
   const now = deps.now();
   const settings = await deps.store.config.getSettings();
@@ -38680,26 +38766,26 @@ async function quotaHistory(deps, input2) {
     deps.store.credentials.listQuotaSamples({
       since,
       until,
+      limit: SAMPLE_QUERY_LIMIT,
       ...credentialId === undefined ? {} : { credentialId }
     }),
     deps.store.credentials.listQuota()
   ]);
   const scoped = credentialId === undefined ? quota : quota.filter((w) => w.credentialId === credentialId);
-  return { samples, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
+  const { page, truncated } = pageSamples(samples);
+  return { samples: page, truncated, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
 }
 
 // packages/control/src/quota/clientHistory.ts
 var MAX_SPAN_MS = 16 * 24 * 60 * 60 * 1000;
-var MAX_SAMPLES = 50000;
 async function accountQuotaHistory(deps, input2) {
   const { since, until } = await retainedSpan(deps, input2, MAX_SPAN_MS);
   const [samples, credentials] = await Promise.all([
-    deps.store.credentials.listQuotaSamples({ since, until, limit: MAX_SAMPLES + 1 }),
+    deps.store.credentials.listQuotaSamples({ since, until, limit: SAMPLE_QUERY_LIMIT }),
     deps.store.credentials.list()
   ]);
   const byId = new Map(credentials.map((credential) => [credential.id, credential]));
-  const truncated = samples.length > MAX_SAMPLES;
-  const page = truncated ? samples.slice(0, MAX_SAMPLES) : samples;
+  const { page, truncated } = pageSamples(samples);
   const out = [];
   for (const sample of page) {
     const credential = byId.get(sample.credentialId);
@@ -55121,6 +55207,11 @@ function adminRoutes(deps) {
     const key = await setKeyModels(deps.store, params.id, await readJson(request2));
     changed("res:keys");
     return key;
+  }).put("/api/keys/:id/expiry", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    const key = await setKeyExpiry(deps.store, params.id, await readJson(request2));
+    changed("res:keys");
+    return key;
   }).delete("/api/keys/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await revokeKey(deps.store, params.id);
@@ -55131,6 +55222,7 @@ function adminRoutes(deps) {
     return {
       settings: await getSettings(deps.store),
       bodyLoggingAllowed: deps.bodyLoggingAllowed === true,
+      dayOffsetMinutes: deps.dayOffsetMinutes ?? hostDayOffsetMinutes(),
       viewerConfigured: await deps.admin.isViewerConfigured()
     };
   }).put("/api/settings/password", async ({ request: request2 }) => {
@@ -55265,7 +55357,10 @@ function clientRoutes(deps) {
     return { ok: true };
   }).get("/api/client/summary", async ({ request: request2 }) => {
     const apiKeyId = await requireClient(request2, deps.admin);
-    return readOwnKey(deps.store, apiKeyId, now());
+    return {
+      ...await readOwnKey(deps.store, apiKeyId, now()),
+      dayOffsetMinutes: deps.dayOffsetMinutes ?? hostDayOffsetMinutes()
+    };
   }).get("/api/client/usage", async ({ request: request2, query }) => {
     const apiKeyId = await requireClient(request2, deps.admin);
     return queryUsage({ store: deps.store, now }, {
@@ -55665,12 +55760,12 @@ function injectPonytail(request2, opts) {
 }
 
 // apps/gateway/src/auth/apiKey.ts
-async function authenticateApiKey(store, header, logger2 = noopLogger) {
+async function authenticateApiKey(store, header, now, logger2 = noopLogger) {
   const raw = extractToken(header);
   if (raw === null)
     throw new GatewayError("AUTH", "missing or malformed Authorization header");
   const key = await store.keys.findByHash(await hashApiKey(raw));
-  if (key === null || key.revokedAt !== null) {
+  if (key === null || !keyUsable(key, now)) {
     throw new GatewayError("AUTH", "invalid API key");
   }
   const limits = key.limits;
@@ -59734,7 +59829,7 @@ async function handle(deps, rateLimiter, surface, request2) {
   try {
     let key;
     try {
-      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), deps.logger);
+      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), startedAt, deps.logger);
     } catch (error61) {
       if (error61 instanceof GatewayError && error61.code === "AUTH") {
         deps.logger.warn("authentication rejected", {
@@ -59912,7 +60007,7 @@ function proxyRoutes(deps) {
     return handle(dispatchDeps, rateLimiter, "openai", request2);
   }).get("/v1/models", async ({ request: request2 }) => {
     try {
-      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), logger2);
+      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), deps.now(), logger2);
       const snapshot = await dispatchDeps.snapshots.get(deps.now());
       const models = [...snapshot.models.values()];
       const visibleModels = key.modelAllowlist === null ? models : models.filter((model) => key.modelAllowlist?.includes(model.id));
@@ -59928,7 +60023,7 @@ function proxyRoutes(deps) {
     }
   }).post("/v1/messages/count_tokens", async ({ request: request2 }) => {
     try {
-      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), logger2);
+      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), deps.now(), logger2);
       await rateLimiter.consume(key.id, key.limits, deps.requestId());
       const body2 = await request2.json();
       const chatRequest = parseAnthropicRequest(body2, request2.headers);
@@ -60779,7 +60874,8 @@ function sizeOf(payload) {
     return 0;
   }
 }
-function createRing(limits) {
+var DEFAULT_RING_LIMITS = { frames: 500, bytes: 2 * 1024 * 1024 };
+function createRing(limits = DEFAULT_RING_LIMITS) {
   const topics = new Map;
   const stateFor = (topic) => {
     const existing = topics.get(topic);
@@ -60842,7 +60938,7 @@ function createRing(limits) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.11.0";
+var VERSION = "0.11.2";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
@@ -60929,7 +61025,7 @@ function createApp(deps) {
     now,
     onDetach: (id, topics) => channelsRef?.closed(id, topics)
   });
-  const ring = deps.ring ?? createRing({ frames: 500, bytes: 2 * 1024 * 1024 });
+  const ring = deps.ring ?? createRing();
   const broadcaster = deps.broadcaster ?? createBroadcaster({ registry: registry2, ring, coord, nodeId, now });
   const channels = deps.channels ?? createChannelRegistry({
     sockets: registry2,
@@ -60993,6 +61089,7 @@ function createApp(deps) {
     admin,
     baseUrl: deps.baseUrl,
     bodyLoggingAllowed: deps.bodyLoggingAllowed === true,
+    ...deps.dayOffsetMinutes === undefined ? {} : { dayOffsetMinutes: deps.dayOffsetMinutes },
     now,
     sessionTtlMs: ADMIN_SESSION_TTL_MS,
     logger: logger2,
@@ -61004,6 +61101,7 @@ function createApp(deps) {
     store: deps.store,
     admin,
     sessionTtlMs: ADMIN_SESSION_TTL_MS,
+    ...deps.dayOffsetMinutes === undefined ? {} : { dayOffsetMinutes: deps.dayOffsetMinutes },
     now,
     logger: logger2
   })).use(databaseRoutes({
@@ -61665,7 +61763,7 @@ async function sweep(deps) {
   let touched = 0;
   for (const credential of due(credentials, deps.now())) {
     if (!credential.hasRefreshToken) {
-      if (credential.expiresAt !== null && credential.expiresAt <= deps.now()) {
+      if (credentialExpired(credential, deps.now())) {
         await deps.store.credentials.update(credential.id, {
           enabled: false,
           disabledReason: "expiredNoRefresh",
@@ -62728,7 +62826,7 @@ async function main() {
     now,
     onDetach: (id, topics) => pluginChannelsRef?.closed(id, topics)
   });
-  const streamRing = createRing({ frames: 500, bytes: 2 * 1024 * 1024 });
+  const streamRing = createRing();
   const broadcaster = createBroadcaster({
     registry: streamRegistry,
     ring: streamRing,
@@ -62780,6 +62878,7 @@ async function main() {
     telemetry,
     ...config2.metricsToken === null ? {} : { metricsToken: config2.metricsToken },
     bodyLoggingAllowed: config2.bodyLoggingAllowed,
+    dayOffsetMinutes: config2.dayOffsetMinutes,
     plugins: loadedPlugins.plugins.map((plugin) => ({ id: plugin.id, routes: plugin.routes })),
     pluginUi: loadedPlugins.plugins,
     ...loadedPlugins.plugins.length === 0 ? {} : { emit: (event) => pluginEvents.emitRequestCompleted(event) },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnigateway",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Self-hosted AI gateway with Anthropic- and OpenAI-compatible APIs, an admin console, and a CLI",
   "license": "MIT",
   "author": "Harismawan <mail@harismawan.com>",
@@ -16,7 +16,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@node-rs/argon2": "2.0.2"
+    "@node-rs/argon2": "2.2.0"
   },
   "engines": {
     "bun": ">=1.3.0"

package/public/assets/{Chip-CmL-9rw7.js → Chip-77Q04h7S.js}

@@ -1,6 +1,7 @@
-import{m as e}from"./Rack-_A_3zqxC.js";import{jsx as t}from"react/jsx-runtime";import n from"styled-components";var r={neutral:{fg:`var(--ink-dim)`,bg:`transparent`},ok:{fg:`var(--ok)`,bg:`var(--ok-wash)`},warn:{fg:`var(--warn)`,bg:`var(--warn-wash)`},down:{fg:`var(--down)`,bg:`var(--down-wash)`},accent:{fg:`var(--accent)`,bg:`var(--accent-wash)`}},i=n.span`
+import{m as e}from"./Rack-D3iFlR6e.js";import{jsx as t}from"react/jsx-runtime";import n from"styled-components";var r={neutral:{fg:`var(--ink-dim)`,bg:`transparent`},ok:{fg:`var(--ok)`,bg:`var(--ok-wash)`},warn:{fg:`var(--warn)`,bg:`var(--warn-wash)`},down:{fg:`var(--down)`,bg:`var(--down-wash)`},accent:{fg:`var(--accent)`,bg:`var(--accent-wash)`}},i=n.span`
   display: inline-flex;
   align-items: center;
+  line-height: 1;
   gap: 4px;
   height: 18px;
   padding: 0 6px;

package/public/assets/{CopyValue-CTVbU0O_.js → CopyValue-DDJId-Zo.js}

@@ -1,4 +1,4 @@
-import{C as e,O as t}from"./Panel-BlNr9j6-.js";import{b as n}from"./Rack-_A_3zqxC.js";import{useCallback as r,useEffect as i,useRef as a,useState as o}from"react";import{jsx as s,jsxs as c}from"react/jsx-runtime";import l from"styled-components";var u=n(`check`,[[`path`,{d:`M20 6 9 17l-5-5`,key:`1gmf2c`}]]),d=n(`copy`,[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]);function f(e){if(e===null||typeof getSelection!=`function`)return!1;let t=getSelection();if(t===null)return!1;try{let n=document.createRange();return n.selectNodeContents(e),t.removeAllRanges(),t.addRange(n),!0}catch{return!1}}async function p(e,t){if(typeof navigator<`u`&&navigator.clipboard!==void 0)try{return await navigator.clipboard.writeText(e),`copied`}catch{}let n=f(t??null);if(n&&typeof document.execCommand==`function`)try{if(document.execCommand(`copy`))return`copied`}catch{}return n?`selected`:`failed`}var m=l.div`
+import{C as e,O as t}from"./Panel-BV18WuL1.js";import{b as n}from"./Rack-D3iFlR6e.js";import{useCallback as r,useEffect as i,useRef as a,useState as o}from"react";import{jsx as s,jsxs as c}from"react/jsx-runtime";import l from"styled-components";var u=n(`check`,[[`path`,{d:`M20 6 9 17l-5-5`,key:`1gmf2c`}]]),d=n(`copy`,[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]);function f(e){if(e===null||typeof getSelection!=`function`)return!1;let t=getSelection();if(t===null)return!1;try{let n=document.createRange();return n.selectNodeContents(e),t.removeAllRanges(),t.addRange(n),!0}catch{return!1}}async function p(e,t){if(typeof navigator<`u`&&navigator.clipboard!==void 0)try{return await navigator.clipboard.writeText(e),`copied`}catch{}let n=f(t??null);if(n&&typeof document.execCommand==`function`)try{if(document.execCommand(`copy`))return`copied`}catch{}return n?`selected`:`failed`}var m=l.div`
   display: flex;
   align-items: stretch;
   gap: 0;

package/public/assets/{Field-DcNu4yw-.js → Field-56pmSGrh.js}

@@ -1,4 +1,4 @@
-import{_ as e}from"./Panel-BlNr9j6-.js";import{useId as t}from"react";import{jsx as n,jsxs as r}from"react/jsx-runtime";import i from"styled-components";var a=`
+import{_ as e}from"./Panel-BV18WuL1.js";import{useId as t}from"react";import{jsx as n,jsxs as r}from"react/jsx-runtime";import i from"styled-components";var a=`
   width: 100%;
   border-radius: 3px;
   transition: border-color 120ms ease;