omnigateway 0.12.12 → 0.13.0

package/gateway.js

@@ -30177,12 +30177,18 @@ var ANTHROPIC_MODELS = {
 };
 var ONE_M_SUFFIX = "[1m]";
 var DATED_SUFFIX = /-\d{8}$/;
-function anthropicReasoningForm(model) {
+function anthropicChoice(model) {
   let id = model.trim();
   if (id.toLowerCase().endsWith(ONE_M_SUFFIX))
     id = id.slice(0, -ONE_M_SUFFIX.length).trim();
   id = id.replace(DATED_SUFFIX, "");
-  return ANTHROPIC_MODELS.models.find((m) => m.id === id)?.reasoningForm ?? "adaptive";
+  return ANTHROPIC_MODELS.models.find((m) => m.id === id);
+}
+function anthropicReasoningForm(model) {
+  return anthropicChoice(model)?.reasoningForm ?? "adaptive";
+}
+function anthropicMaxOutputTokens(model) {
+  return anthropicChoice(model)?.limits.maxOutputTokens;
 }
 
 // packages/providers/src/anthropic/descriptor.ts
@@ -31181,7 +31187,8 @@ function codecAdapter(id, capabilities2, codec2, origins) {
         credentials: req.credentials,
         fail,
         ...req.requestId === undefined ? {} : { requestId: req.requestId },
-        ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache }
+        ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache },
+        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens }
       }));
       const described = built?.request ?? {};
       const request2 = {
@@ -32902,6 +32909,12 @@ function addAutoCacheBreakpoints(body, req, note) {
   lastHistory.cache_control = { type: "ephemeral" };
   note("anthropic:history-cache-breakpoint-added");
 }
+function defaultMaxTokens(model, saved) {
+  const ceiling = anthropicMaxOutputTokens(model);
+  if (saved === undefined)
+    return ceiling ?? 4096;
+  return ceiling === undefined ? saved : Math.min(saved, ceiling);
+}
 function toWire(req, model, opts) {
   const cloak = opts.cloak ?? null;
   const degradations = [];
@@ -32948,7 +32961,7 @@ function toWire(req, model, opts) {
       }
       return [{ role: m.role, content: encodeSystemTurn(m.content, cloak) }];
     }),
-    max_tokens: req.maxTokens ?? 4096,
+    max_tokens: req.maxTokens ?? defaultMaxTokens(model, opts.maxOutputTokens),
     stream: req.stream
   };
   if (systemCache.retarget !== undefined) {
@@ -33087,7 +33100,8 @@ var anthropicCodec = {
     const { body, degradations } = toWire(input2.request, input2.model, {
       oauth,
       cloak,
-      autoCache: input2.autoCacheEnabled === true
+      autoCache: input2.autoCacheEnabled === true,
+      ...input2.maxOutputTokens === undefined ? {} : { maxOutputTokens: input2.maxOutputTokens }
     });
     const firstUser = input2.request.messages.find((m) => m.role === "user");
     const firstText = firstUser?.content.find((b) => b.type === "text");
@@ -33420,8 +33434,125 @@ var anthropicOAuthFlow = {
     if (!usageReadable(res.status, "anthropic"))
       return null;
     return parseAnthropicUsage(parsed(res.body), now());
+  },
+  async* resetCredits({ secrets }) {
+    if (secrets.accessToken === null)
+      return null;
+    const res = yield getJsonRequest(RESET_STATUS_URL, anthropicProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: SIDE_HEADERS
+    });
+    if (!usageReadable(res.status, "anthropic"))
+      return null;
+    const root = recordOf(parsed(res.body));
+    return root === null ? null : parseResetGrants(root.cedar_ember ?? null);
+  },
+  async* redeemReset({ secrets, creditId, requestId, fail }) {
+    if (secrets.accessToken === null)
+      throw fail("AUTH", "credential holds no access token");
+    const grantId = grantOf(creditId);
+    if (grantId === null)
+      throw fail("CONFLICT", "that reset credit is not available");
+    const profile = yield getJsonRequest(PROFILE_URL, anthropicProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: SIDE_HEADERS
+    });
+    if (profile.status < 200 || profile.status >= 300) {
+      throw fail(redeemErrorCode(profile.status), `profile read refused: http_${profile.status}`, {
+        status: profile.status
+      });
+    }
+    const orgId = orgIdOf(parsed(profile.body));
+    if (orgId === null)
+      throw fail("UPSTREAM", "profile names no organization");
+    const res = yield postJsonRequest(`https://api.anthropic.com/api/organizations/${orgId}/reset_rate_limits`, anthropicProfile, {
+      contentType: "application/json",
+      body: JSON.stringify({ program: RESET_PROGRAM, grant_id: grantId, request_id: requestId }),
+      extraHeaders: [["Authorization", `Bearer ${secrets.accessToken}`], ...SIDE_HEADERS]
+    });
+    if (res.status < 200 || res.status >= 300) {
+      throw fail(redeemErrorCode(res.status), `reset claim refused: http_${res.status}`, {
+        status: res.status
+      });
+    }
+    return claimOutcome(parsed(res.body), fail);
   }
 };
+var RESET_PROGRAM = "cedar_ember";
+var RESET_STATUS_URL = `${USAGE_URL}?cedar_ember=1&skip_spend=1`;
+var PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+var ORG_ID = /^[A-Za-z0-9-]{1,64}$/;
+var SIDE_HEADERS = [["anthropic-beta", "oauth-2025-04-20"]];
+var USE_SUFFIX = /-u(\d+)$/;
+function creditIdOf(grantId, left) {
+  return `${grantId}-u${left}`;
+}
+function grantOf(creditId) {
+  const grant = creditId.replace(USE_SUFFIX, "");
+  return grant === creditId || grant === "" ? null : grant;
+}
+function orgIdOf(value) {
+  const org = recordOf(recordOf(value)?.organization);
+  const uuid3 = org?.uuid;
+  return typeof uuid3 === "string" && ORG_ID.test(uuid3) ? uuid3 : null;
+}
+function parseResetGrants(value) {
+  if (value === null)
+    return { available: 0, credits: [] };
+  const block = recordOf(value);
+  if (block === null || !Array.isArray(block.grants))
+    return null;
+  const next = typeof block.next_grant_id === "string" ? block.next_grant_id : null;
+  const atLimit = block.at_limit === true;
+  let available = 0;
+  const credits = block.grants.flatMap((raw) => {
+    const g = recordOf(raw);
+    if (g === null || typeof g.id !== "string")
+      return [];
+    const left = typeof g.resets_left === "number" ? g.resets_left : 0;
+    const claimable = left > 0 && g.usable_now === true && g.paused !== true && (g.use_requires_limit !== true || atLimit) && (next === null || next === g.id);
+    if (claimable)
+      available += left;
+    return [
+      {
+        id: creditIdOf(g.id, left),
+        status: claimable ? "available" : left > 0 ? "unavailable" : "used",
+        title: typeof g.label === "string" && g.label !== "" ? g.label : null,
+        grantedAt: isoOrNull(g.starts_at),
+        expiresAt: isoOrNull(g.ends_at)
+      }
+    ];
+  });
+  return { available, credits };
+}
+function claimOutcome(value, fail) {
+  const body = recordOf(value);
+  const result = typeof body?.result === "string" ? body.result : null;
+  if (result === "reset") {
+    return { windowsReset: Array.isArray(body?.cleared) ? body.cleared.length : null };
+  }
+  if (result === "cooldown")
+    throw fail("RATE_LIMIT", "reset claim refused: cooldown");
+  if (result === "already_used" || result === "not_limited" || result === "ineligible") {
+    throw fail("CONFLICT", `reset claim refused: ${result}`);
+  }
+  throw fail("UPSTREAM", "reset claim answered without a reset");
+}
+function redeemErrorCode(status) {
+  if (status === 429)
+    return "RATE_LIMIT";
+  if (status === 401 || status === 403)
+    return "AUTH";
+  if (status >= 400 && status < 500)
+    return "CONFLICT";
+  return "UPSTREAM";
+}
+function isoOrNull(value) {
+  if (typeof value !== "string")
+    return null;
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? null : at;
+}
 // packages/providers/src/antigravity/codec.ts
 import { createHash as createHash2 } from "crypto";
 
@@ -34743,7 +34874,7 @@ var grokOAuthFlow = {
 
 // packages/providers/src/kilo/oauth.ts
 var CODES_URL = "https://api.kilo.ai/api/device-auth/codes";
-var PROFILE_URL = "https://api.kilo.ai/api/profile";
+var PROFILE_URL2 = "https://api.kilo.ai/api/profile";
 var FALLBACK_VERIFICATION_URL = "https://kilo.ai";
 var DEFAULT_EXPIRES_SECONDS = 300;
 var POLL_INTERVAL_SECONDS = 3;
@@ -34775,7 +34906,7 @@ function deviceCodeFrom(value, fail) {
 }
 async function* orgIdFor(accessToken) {
   try {
-    const res = yield getJsonRequest(PROFILE_URL, kiloProfile, { accessToken });
+    const res = yield getJsonRequest(PROFILE_URL2, kiloProfile, { accessToken });
     if (res.status < 200 || res.status >= 300)
       return null;
     const record2 = recordFrom(parsed(res.body));
@@ -35283,6 +35414,7 @@ var AUTHORIZE_URL3 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL5 = "https://auth.openai.com/oauth/token";
 var SCOPES4 = "openid profile email offline_access";
 var USAGE_URL3 = "https://chatgpt.com/backend-api/wham/usage";
+var RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
 function isRecord7(value) {
   return typeof value === "object" && value !== null;
 }
@@ -35436,8 +35568,78 @@ var openaiOAuthFlow = {
     if (!usageReadable(res.status, "openai"))
       return null;
     return parseOpenAIUsage(parsed(res.body), now());
+  },
+  async* resetCredits({ secrets, providerData }) {
+    if (secrets.accessToken === null)
+      return null;
+    const res = yield getJsonRequest(RESET_CREDITS_URL, openaiProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: accountHeader(providerData)
+    });
+    if (!usageReadable(res.status, "openai"))
+      return null;
+    return parseResetCredits(parsed(res.body));
+  },
+  async* redeemReset({ secrets, providerData, creditId, requestId, fail }) {
+    if (secrets.accessToken === null)
+      throw fail("AUTH", "credential holds no access token");
+    const res = yield postJsonRequest(`${RESET_CREDITS_URL}/consume`, openaiProfile, {
+      contentType: "application/json",
+      body: JSON.stringify({ credit_id: creditId, redeem_request_id: requestId }),
+      extraHeaders: [
+        ["Authorization", `Bearer ${secrets.accessToken}`],
+        ...accountHeader(providerData)
+      ]
+    });
+    if (res.status < 200 || res.status >= 300) {
+      throw fail(redeemErrorCode2(res.status), `reset credit redeem refused: http_${res.status}`, {
+        status: res.status
+      });
+    }
+    const body = recordOf(parsed(res.body));
+    const windowsReset = body === null ? null : numberOf(body, ["windows_reset"]);
+    return { windowsReset };
   }
 };
+function accountHeader(providerData) {
+  const accountId = accountIdFromProviderData(providerData);
+  return accountId === null ? [] : [["chatgpt-account-id", accountId]];
+}
+function redeemErrorCode2(status) {
+  if (status === 429)
+    return "RATE_LIMIT";
+  if (status === 401 || status === 403)
+    return "AUTH";
+  if (status >= 400 && status < 500)
+    return "CONFLICT";
+  return "UPSTREAM";
+}
+function isoOrNull2(value) {
+  if (typeof value !== "string")
+    return null;
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? at : null;
+}
+function parseResetCredits(value) {
+  const root = recordOf(value);
+  if (root === null || !Array.isArray(root.credits))
+    return null;
+  const credits = root.credits.flatMap((raw) => {
+    const c = recordOf(raw);
+    if (c === null || typeof c.id !== "string" || typeof c.status !== "string")
+      return [];
+    return [
+      {
+        id: c.id,
+        status: c.status,
+        title: typeof c.title === "string" ? c.title : null,
+        grantedAt: isoOrNull2(c.granted_at),
+        expiresAt: isoOrNull2(c.expires_at)
+      }
+    ];
+  });
+  return { available: credits.filter((c) => c.status === "available").length, credits };
+}
 
 // packages/providers/src/builtinOAuth.ts
 function builtinOAuthFlows() {
@@ -38170,6 +38372,24 @@ function createConnectFlows(deps) {
     if (provider === undefined)
       throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
     const result = await provider.exchange({ code, pending: flow.pending }, { http: deps.http, now: deps.now });
+    if (flow.credentialId !== undefined) {
+      const existing = await deps.store.credentials.get(flow.credentialId);
+      if (existing === null)
+        throw new GatewayError("BAD_REQUEST", "credential not found");
+      await deps.store.credentials.updateSecrets(flow.credentialId, result.secrets, result.expiresAt);
+      await deps.store.credentials.update(flow.credentialId, {
+        enabled: true,
+        disabledReason: null,
+        disabledAt: null,
+        accountEmail: result.accountEmail,
+        providerData: result.providerData
+      });
+      logger2.info("oauth reconnect completed", {
+        provider: flow.provider,
+        credentialId: flow.credentialId
+      });
+      return { id: flow.credentialId };
+    }
     const id = crypto.randomUUID();
     await deps.store.credentials.create({
       id,
@@ -38206,13 +38426,25 @@ function createConnectFlows(deps) {
   }
   return {
     connectableIds,
-    async start(providerInput, labelInput) {
+    async start(providerInput, labelInput, credentialIdInput) {
       const unconnectable = () => new GatewayError("BAD_REQUEST", `provider must be one of ${connectableIds().join(", ")}`);
       if (!exists(providerInput))
         throw unconnectable();
       const provider = deps.providers[providerInput];
       if (provider === undefined)
         throw unconnectable();
+      let credentialId;
+      if (credentialIdInput !== undefined) {
+        if (typeof credentialIdInput !== "string" || credentialIdInput.trim().length === 0) {
+          throw new GatewayError("BAD_REQUEST", "invalid credential for reconnect");
+        }
+        const id = credentialIdInput.trim();
+        const existing = await deps.store.credentials.get(id);
+        if (existing === null || existing.provider !== providerInput || existing.authType !== "oauth") {
+          throw new GatewayError("BAD_REQUEST", "invalid credential for reconnect");
+        }
+        credentialId = id;
+      }
       const label3 = typeof labelInput === "string" && labelInput.trim().length > 0 ? labelInput.trim() : providerInput;
       const redirectUri = callbackUri(providerInput);
       const oauthDeps = { http: deps.http, now: deps.now };
@@ -38222,6 +38454,7 @@ function createConnectFlows(deps) {
         provider: providerInput,
         label: label3,
         pending: start.pending,
+        ...credentialId === undefined ? {} : { credentialId },
         ...start.userCode === undefined ? {} : { userCode: start.userCode }
       });
       return {
@@ -38375,6 +38608,11 @@ var quotaRefreshSchema = exports_external.discriminatedUnion("kind", [
   }).strict(),
   exports_external.object({ kind: exports_external.literal("all") }).strict()
 ]);
+var accountIdSchema = exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id");
+var redeemResetSchema = exports_external.object({
+  credentialId: accountIdSchema,
+  creditId: exports_external.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/).optional()
+}).strict();
 var dimensionSchema = exports_external.enum([
   "credential",
   "model",
@@ -40267,6 +40505,29 @@ function oauthAdapter(id, flow, opts = {}) {
           return Promise.resolve(null);
         return runStep(id, "usage", step, deps, origins);
       }
+    },
+    ...flow.resetCredits === undefined ? {} : {
+      resetCredits: (secrets, deps, providerData) => {
+        const step = flow.resetCredits?.({ secrets, providerData, ...helpers(deps) });
+        if (step === undefined)
+          return Promise.resolve(null);
+        return runStep(id, "resetCredits", step, deps, origins);
+      }
+    },
+    ...flow.redeemReset === undefined ? {} : {
+      redeemReset: (secrets, deps, providerData, creditId, requestId) => {
+        const step = flow.redeemReset?.({
+          secrets,
+          providerData,
+          creditId,
+          requestId,
+          ...helpers(deps)
+        });
+        if (step === undefined) {
+          return Promise.reject(flowFailure(id, "redeemReset", "has no redeem step"));
+        }
+        return runStep(id, "redeemReset", step, deps, origins);
+      }
     }
   };
   if (flow.kind === "pkce")
@@ -40302,11 +40563,32 @@ function isAuthorizeStart(value) {
   const candidate = value;
   return typeof candidate.authorizeUrl === "string" && typeof candidate.pending === "object" && candidate.pending !== null;
 }
+function isResetCreditsOrNull(value) {
+  if (value === null)
+    return true;
+  if (typeof value !== "object")
+    return false;
+  const candidate = value;
+  return typeof candidate.available === "number" && Array.isArray(candidate.credits) && candidate.credits.every((c) => {
+    if (typeof c !== "object" || c === null)
+      return false;
+    const row = c;
+    return typeof row.id === "string" && typeof row.status === "string" && (row.title === null || typeof row.title === "string") && (row.grantedAt === null || typeof row.grantedAt === "number") && (row.expiresAt === null || typeof row.expiresAt === "number");
+  });
+}
+function isResetRedeemed(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const held = value.windowsReset;
+  return held === null || typeof held === "number";
+}
 var RETURN_SHAPE = {
   start: isAuthorizeStart,
   begin: isAuthorizeStart,
   exchange: isFlowResult,
-  refresh: isFlowResult
+  refresh: isFlowResult,
+  resetCredits: isResetCreditsOrNull,
+  redeemReset: isResetRedeemed
 };
 
 // packages/control/src/oauth/index.ts
@@ -40523,6 +40805,11 @@ function validateOAuthFlow(id, value) {
   if (value.usage !== undefined) {
     checkAt(typeof value.usage === "function", id, "oauth.usage", "a function");
   }
+  for (const fn of ["resetCredits", "redeemReset"]) {
+    if (value[fn] !== undefined) {
+      checkAt(typeof value[fn] === "function", id, `oauth.${fn}`, "a function");
+    }
+  }
   if (kind === "device") {
     checkAt(typeof value.begin === "function", id, "oauth.begin", "a function");
     checkAt(typeof value.needsDeviceId === "boolean", id, "oauth.needsDeviceId", "a boolean");
@@ -40721,6 +41008,52 @@ async function accountQuotaHistory(deps, input2) {
     truncated
   };
 }
+// packages/control/src/quota/resets.ts
+async function resettable(deps, credentialId) {
+  const credential = await deps.store.credentials.get(credentialId.trim());
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  const provider = deps.providers[credential.provider];
+  const list = provider?.resetCredits;
+  const redeem = provider?.redeemReset;
+  if (credential.authType !== "oauth" || list === undefined || redeem === undefined) {
+    throw new GatewayError("BAD_REQUEST", "this account's provider has no quota resets");
+  }
+  return { credential, list, redeem };
+}
+async function listFor(deps, r) {
+  const secrets = await usageSecretsFor(deps, r.credential);
+  const read = await r.list(secrets, { http: deps.http, now: deps.now }, r.credential.providerData);
+  if (read === null) {
+    throw new GatewayError("UPSTREAM", "provider answered the reset list with nothing usable", {
+      gatewayAuthored: true
+    });
+  }
+  return read;
+}
+async function listResetCredits(deps, credentialId) {
+  const r = await resettable(deps, credentialId);
+  return { credentialId: r.credential.id, ...await listFor(deps, r) };
+}
+async function redeemResetCredit(deps, request2) {
+  const r = await resettable(deps, request2.credentialId);
+  return deps.coord.mutex.withLock(PROBE_LOCK_PREFIX + r.credential.id, PROBE_LOCK_TTL_MS, PROBE_LOCK_WAIT_MS, () => redeemLocked(deps, r, request2));
+}
+async function redeemLocked(deps, r, request2) {
+  const available = (await listFor(deps, r)).credits.filter((c) => c.status === "available").sort((a, b) => (a.expiresAt ?? Number.POSITIVE_INFINITY) - (b.expiresAt ?? Number.POSITIVE_INFINITY));
+  const credit = request2.creditId === undefined ? available[0] : available.find((c) => c.id === request2.creditId);
+  if (credit === undefined) {
+    throw new GatewayError("CONFLICT", request2.creditId === undefined ? "no reset credit is available for this account" : "that reset credit is not available");
+  }
+  const secrets = await usageSecretsFor(deps, r.credential);
+  const { windowsReset } = await r.redeem(secrets, { http: deps.http, now: deps.now }, r.credential.providerData, credit.id, crypto.randomUUID());
+  let quotaRefreshed = false;
+  try {
+    quotaRefreshed = await probe(deps, r.credential) !== null;
+  } catch {}
+  return { credentialId: r.credential.id, creditId: credit.id, windowsReset, quotaRefreshed };
+}
+
 // packages/control/src/quota/poll.ts
 var CONCURRENCY = 4;
 var RATE_LIMIT_COOLDOWN_MS = 180000;
@@ -40728,14 +41061,17 @@ var COOLDOWN_PREFIX = "quota:cooldown:";
 var PROBE_LOCK_PREFIX = "quota:probe:";
 var PROBE_LOCK_TTL_MS = 60000;
 var PROBE_LOCK_WAIT_MS = 30000;
+async function usageSecretsFor(deps, credential) {
+  const refreshed = credential.hasRefreshToken && credential.expiresAt !== null && credential.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= deps.now() ? await deps.refresh(credential) : null;
+  return refreshed === null ? await credential.openForUsage() : { accessToken: refreshed.accessToken };
+}
 async function probe(deps, credential) {
   if (credential.authType !== "oauth")
     return null;
   const provider = deps.providers[credential.provider];
   if (provider?.usage === undefined)
     return null;
-  const refreshed = credential.hasRefreshToken && credential.expiresAt !== null && credential.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= deps.now() ? await deps.refresh(credential) : null;
-  const secrets = refreshed === null ? await credential.openForUsage() : { accessToken: refreshed.accessToken };
+  const secrets = await usageSecretsFor(deps, credential);
   const report = await provider.usage(secrets, { http: deps.http, now: deps.now }, credential.providerData);
   if (report === null || report.windows.length === 0)
     return null;
@@ -40898,6 +41234,12 @@ function quotaOps(deps) {
         outcomes.push(result?.outcome ?? { kind: "failed", credentialId: credential.id, code: "INTERNAL" });
       }
       return { outcomes };
+    },
+    resetCredits: (credentialId) => listResetCredits(deps, credentialId),
+    redeemReset: (request2) => redeemResetCredit(deps, request2),
+    hasResets: (provider) => {
+      const flow = deps.providers[provider];
+      return flow?.resetCredits !== undefined && flow.redeemReset !== undefined;
     }
   };
 }
@@ -57094,6 +57436,12 @@ function adminRoutes(deps) {
     });
   };
   const changed = (topic) => deps.broadcaster?.invalidate(topic);
+  const quotaOrRefuse = () => {
+    if (deps.quota === undefined) {
+      throw new GatewayError("INTERNAL", "quota operations are not available on this process");
+    }
+    return deps.quota;
+  };
   return new Elysia().onError(apiErrorHandler).get("/api/status", async ({ request: request2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     const principal = token === null ? null : await deps.admin.verify(token);
@@ -57182,6 +57530,18 @@ function adminRoutes(deps) {
       changed("res:quota");
     }
     return result;
+  }).get("/api/credentials/:id/resets", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    return quotaOrRefuse().resetCredits(params.id);
+  }).post("/api/credentials/:id/resets/redeem", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    const raw = await readJsonRecord(request2);
+    if (raw === null)
+      throw new GatewayError("BAD_REQUEST", "body must be a JSON object");
+    const body2 = parseOrThrow(redeemResetSchema, { ...raw, credentialId: params.id });
+    const result = await quotaOrRefuse().redeemReset(body2);
+    changed("res:quota");
+    return result;
   }).patch("/api/credentials/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await patchCredential(deps, params.id, await readJson(request2));
@@ -57197,7 +57557,10 @@ function adminRoutes(deps) {
     return { models: await listModels(deps.store) };
   }).get("/api/catalog", async ({ request: request2 }) => {
     await requireReader(request2, deps.admin);
-    return { providers: providerCatalog(reportCatalogProblem) };
+    const quota = deps.quota;
+    return {
+      providers: providerCatalog(reportCatalogProblem).map((provider) => quota?.hasResets(provider.id) === true ? { ...provider, quotaResets: true } : provider)
+    };
   }).put("/api/models/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await putModel(deps.store, params.id, await readJson(request2));
@@ -57466,7 +57829,7 @@ function connectRoutes(deps) {
   return new Elysia().onError(apiErrorHandler).post("/api/connect/start", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     const body2 = await readJsonRecord(request2);
-    return flows.start(body2?.provider, body2?.label);
+    return flows.start(body2?.provider, body2?.label, body2?.credentialId);
   }).post("/api/connect/finish", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     const body2 = await readJsonRecord(request2);
@@ -60084,7 +60447,8 @@ async function attempt(opts) {
     http,
     signal,
     ...opts.requestId === undefined ? {} : { requestId: opts.requestId },
-    ...opts.autoCache === undefined ? {} : { autoCache: opts.autoCache }
+    ...opts.autoCache === undefined ? {} : { autoCache: opts.autoCache },
+    ...candidate.target.maxOutputTokens === undefined ? {} : { maxOutputTokens: candidate.target.maxOutputTokens }
   });
 }
 
@@ -63124,7 +63488,7 @@ function createRing(limits = DEFAULT_RING_LIMITS) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.12.12";
+var VERSION = "0.13.0";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnigateway",
-  "version": "0.12.12",
+  "version": "0.13.0",
   "description": "Self-hosted AI gateway with Anthropic- and OpenAI-compatible APIs, an admin console, and a CLI",
   "license": "MIT",
   "author": "Harismawan <mail@harismawan.com>",

package/public/assets/{Chip-D4qvhu1D.js → Chip-D0XSbQUr.js}

@@ -1,4 +1,4 @@
-import{w as e}from"./Rack-CEuCdVXc.js";import{jsx as t}from"react/jsx-runtime";import n from"styled-components";var r={neutral:{fg:`var(--ink-dim)`,bg:`transparent`},ok:{fg:`var(--ok)`,bg:`var(--ok-wash)`},warn:{fg:`var(--warn)`,bg:`var(--warn-wash)`},down:{fg:`var(--down)`,bg:`var(--down-wash)`},accent:{fg:`var(--accent)`,bg:`var(--accent-wash)`}},i=n.span`
+import{w as e}from"./Rack-CDUOJkS2.js";import{jsx as t}from"react/jsx-runtime";import n from"styled-components";var r={neutral:{fg:`var(--ink-dim)`,bg:`transparent`},ok:{fg:`var(--ok)`,bg:`var(--ok-wash)`},warn:{fg:`var(--warn)`,bg:`var(--warn-wash)`},down:{fg:`var(--down)`,bg:`var(--down-wash)`},accent:{fg:`var(--accent)`,bg:`var(--accent-wash)`}},i=n.span`
   display: inline-flex;
   align-items: center;
   line-height: 1;

package/public/assets/{CopyValue-SnsT2LML.js → CopyValue-DAlmkISB.js}

@@ -1,4 +1,4 @@
-import{C as e,O as t}from"./Panel-CWmOTDAP.js";import{A as n}from"./Rack-CEuCdVXc.js";import{useCallback as r,useEffect as i,useRef as a,useState as o}from"react";import{jsx as s,jsxs as c}from"react/jsx-runtime";import l from"styled-components";var u={name:`check`,size:24,node:[[`path`,{d:`M20 6 9 17l-5-5`,key:`1gmf2c`}]]};u.node;var d=n(u),f={name:`copy`,size:24,node:[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]};f.node;var p=n(f);function m(e){if(e===null||typeof getSelection!=`function`)return!1;let t=getSelection();if(t===null)return!1;try{let n=document.createRange();return n.selectNodeContents(e),t.removeAllRanges(),t.addRange(n),!0}catch{return!1}}async function h(e,t){if(typeof navigator<`u`&&navigator.clipboard!==void 0)try{return await navigator.clipboard.writeText(e),`copied`}catch{}let n=m(t??null);if(n&&typeof document.execCommand==`function`)try{if(document.execCommand(`copy`))return`copied`}catch{}return n?`selected`:`failed`}var g=l.div`
+import{A as e,T as t}from"./Panel-CsovmtxF.js";import{A as n}from"./Rack-CDUOJkS2.js";import{useCallback as r,useEffect as i,useRef as a,useState as o}from"react";import{jsx as s,jsxs as c}from"react/jsx-runtime";import l from"styled-components";var u={name:`check`,size:24,node:[[`path`,{d:`M20 6 9 17l-5-5`,key:`1gmf2c`}]]};u.node;var d=n(u),f={name:`copy`,size:24,node:[[`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`,key:`17jyea`}],[`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`,key:`zix9uf`}]]};f.node;var p=n(f);function m(e){if(e===null||typeof getSelection!=`function`)return!1;let t=getSelection();if(t===null)return!1;try{let n=document.createRange();return n.selectNodeContents(e),t.removeAllRanges(),t.addRange(n),!0}catch{return!1}}async function h(e,t){if(typeof navigator<`u`&&navigator.clipboard!==void 0)try{return await navigator.clipboard.writeText(e),`copied`}catch{}let n=m(t??null);if(n&&typeof document.execCommand==`function`)try{if(document.execCommand(`copy`))return`copied`}catch{}return n?`selected`:`failed`}var g=l.div`
   display: flex;
   align-items: stretch;
   gap: 0;
@@ -14,7 +14,7 @@ import{C as e,O as t}from"./Panel-CWmOTDAP.js";import{A as n}from"./Rack-CEuCdVX
   font-size: 12px;
   word-break: break-all;
   user-select: all;
-`,v=l(t)`
+`,v=l(e)`
   border: 0;
   border-left: 1px solid ${({theme:e})=>e.color.ruleStrong};
   border-radius: 0;
@@ -24,4 +24,4 @@ import{C as e,O as t}from"./Panel-CWmOTDAP.js";import{A as n}from"./Rack-CEuCdVX
 `,y=l.p`
   font-size: 11px;
   color: ${({theme:e})=>e.color.warn};
-`,b={selected:`Your browser would not copy it. The value is selected — copy it with your keyboard.`,failed:`Your browser would not copy it. Select the value and copy it by hand.`};function x({value:t,label:n}){let[l,u]=o(null),f=a(null);i(()=>{if(l!==`copied`)return;let e=setTimeout(()=>u(null),1600);return()=>clearTimeout(e)},[l]);let m=r(()=>{h(t,f.current).then(u)},[t]),x=l===`copied`,S=l===null?void 0:b[l];return c(e,{$gap:1,children:[c(g,{children:[s(_,{ref:f,children:t}),s(v,{type:`button`,$variant:`ghost`,onClick:m,"aria-label":x?`Copied`:n,title:x?`Copied`:n,children:s(x?d:p,{})})]}),S===void 0?null:s(y,{role:`status`,children:S})]})}export{x as t};
+`,b={selected:`Your browser would not copy it. The value is selected — copy it with your keyboard.`,failed:`Your browser would not copy it. Select the value and copy it by hand.`};function x({value:e,label:n}){let[l,u]=o(null),f=a(null);i(()=>{if(l!==`copied`)return;let e=setTimeout(()=>u(null),1600);return()=>clearTimeout(e)},[l]);let m=r(()=>{h(e,f.current).then(u)},[e]),x=l===`copied`,S=l===null?void 0:b[l];return c(t,{$gap:1,children:[c(g,{children:[s(_,{ref:f,children:e}),s(v,{type:`button`,$variant:`ghost`,onClick:m,"aria-label":x?`Copied`:n,title:x?`Copied`:n,children:s(x?d:p,{})})]}),S===void 0?null:s(y,{role:`status`,children:S})]})}export{x as t};

package/public/assets/{Field-BYBri2NV.js → Field-DG1317zr.js}

@@ -1,4 +1,4 @@
-import{_ as e}from"./Panel-CWmOTDAP.js";import{useId as t}from"react";import{jsx as n,jsxs as r}from"react/jsx-runtime";import i from"styled-components";var a=`
+import{y as e}from"./Panel-CsovmtxF.js";import{useId as t}from"react";import{jsx as n,jsxs as r}from"react/jsx-runtime";import i from"styled-components";var a=`
   width: 100%;
   border-radius: 3px;
   transition: border-color 120ms ease;