omnigateway 0.2.1 → 0.2.2

package/gateway.js

@@ -4683,8 +4683,8 @@ class FileTypeParser {
       if (jsonSize > 12 && this.buffer.length >= jsonSize + 16) {
         try {
           const header = new TextDecoder().decode(this.buffer.subarray(16, jsonSize + 16));
-          const json5 = JSON.parse(header);
-          if (json5.files) {
+          const json7 = JSON.parse(header);
+          if (json7.files) {
             return {
               ext: "asar",
               mime: "application/x-asar"
@@ -5295,17 +5295,24 @@ function createAdminAuth(store, opts) {
     }
   };
 }
+// packages/ir/src/betas.ts
+var CONTEXT_1M_BETA = "context-1m-2025-08-07";
+var CONTEXT_1M_TOKENS = 1e6;
 // packages/ir/src/capabilities.ts
 var ANTHROPIC_NATIVE_TOOLS = {
   anthropic: true,
   openai: false,
   kimi: false,
+  kilo: false,
+  grok: false,
   custom: false
 };
 var PROVIDER_CAPABILITIES = {
   anthropic: { tools: true, images: true, reasoning: true },
   openai: { tools: true, images: true, reasoning: true },
   kimi: { tools: true, images: false, reasoning: false },
+  kilo: { tools: true, images: true, reasoning: true },
+  grok: { tools: true, images: true, reasoning: true },
   custom: { tools: true, images: true, reasoning: true }
 };
 // packages/ir/src/errors.ts
@@ -5387,6 +5394,7 @@ var FIELD_ORDER = [
   "count",
   "rawCount",
   "dailyCount",
+  "quotaSampleCount",
   "host",
   "port",
   "path",
@@ -5720,9 +5728,50 @@ function loadConfig(env) {
     logFile: logFile === undefined || logFile.length === 0 ? null : logFile
   };
 }
-// packages/providers/src/betas.ts
-var CONTEXT_1M_BETA = "context-1m-2025-08-07";
-var CONTEXT_1M_TOKENS = 1e6;
+// packages/control/src/oauth/pending.ts
+function createPendingFlows(opts) {
+  const flows = new Map;
+  const expired = (entry) => entry.expiresAt <= opts.now();
+  return {
+    put(flow) {
+      const id = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64url");
+      flows.set(id, { flow, expiresAt: opts.now() + opts.ttlMs });
+      return id;
+    },
+    take(id) {
+      const entry = flows.get(id);
+      if (entry === undefined)
+        return null;
+      flows.delete(id);
+      return expired(entry) ? null : entry.flow;
+    },
+    peek(id) {
+      const entry = flows.get(id);
+      if (entry === undefined || expired(entry))
+        return null;
+      return entry.flow;
+    },
+    byState(state) {
+      if (state.trim().length === 0)
+        return null;
+      for (const [id, entry] of flows) {
+        if (entry.flow.pending.state === state) {
+          return expired(entry) ? null : { ...entry.flow, id };
+        }
+      }
+      return null;
+    },
+    sweep() {
+      for (const [id, entry] of flows) {
+        if (expired(entry))
+          flows.delete(id);
+      }
+    },
+    size() {
+      return flows.size;
+    }
+  };
+}
 
 // packages/providers/src/body.ts
 var BODY_ORDER = {
@@ -5757,6 +5806,32 @@ var BODY_ORDER = {
     "metadata"
   ],
   kimi: ["model", "messages", "tools", "tool_choice", "max_tokens", "temperature", "stream"],
+  kilo: [
+    "model",
+    "messages",
+    "tools",
+    "tool_choice",
+    "max_tokens",
+    "temperature",
+    "reasoning",
+    "stream"
+  ],
+  grok: [
+    "model",
+    "stream",
+    "input",
+    "instructions",
+    "store",
+    "reasoning",
+    "prompt_cache_key",
+    "tools",
+    "tool_choice",
+    "include",
+    "service_tier",
+    "client_metadata",
+    "parallel_tool_calls",
+    "metadata"
+  ],
   custom: []
 };
 function orderFields(obj, order) {
@@ -5835,6 +5910,7 @@ function signAnthropicBody(json) {
 // packages/providers/src/anthropic/models.ts
 var ANTHROPIC_MODELS = {
   defaultModel: "claude-opus-5",
+  authTypes: ["oauth", "apiKey"],
   models: [
     {
       id: "claude-fable-5",
@@ -5873,9 +5949,247 @@ function anthropicReasoningForm(model) {
   return ANTHROPIC_MODELS.models.find((m) => m.id === id)?.reasoningForm ?? "adaptive";
 }
 
+// packages/providers/src/grok/models.ts
+var GROK_MODELS = {
+  defaultModel: "grok-4.6",
+  authTypes: ["oauth", "apiKey"],
+  models: [
+    {
+      id: "grok-4.6",
+      label: "Grok 4.6",
+      pricing: { input: 2, output: 6, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 500000, maxOutputTokens: 128000 }
+    },
+    {
+      id: "grok-4.5",
+      label: "Grok 4.5",
+      pricing: { input: 2, output: 6, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 500000, maxOutputTokens: 128000 }
+    },
+    {
+      id: "grok-4.3",
+      label: "Grok 4.3",
+      pricing: { input: 1.25, output: 2.5, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "grok-4.20-0309-reasoning",
+      label: "Grok 4.20 \u2014 reasoning",
+      pricing: { input: 1.25, output: 2.5, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "grok-4.20-0309-non-reasoning",
+      label: "Grok 4.20 \u2014 non-reasoning",
+      pricing: { input: 1.25, output: 2.5, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "grok-4.20-multi-agent-0309",
+      label: "Grok 4.20 \u2014 multi-agent",
+      pricing: { input: 1.25, output: 2.5, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    }
+  ]
+};
+
+// packages/providers/src/kilo/models.ts
+var KILO_MODELS = {
+  defaultModel: "anthropic/claude-sonnet-5",
+  authTypes: ["oauth", "apiKey"],
+  models: [
+    {
+      id: "anthropic/claude-fable-5",
+      label: "Claude Fable 5",
+      pricing: { input: 10, output: 50, cacheRead: 1, cacheWrite5m: 12.5, cacheWrite1h: 12.5 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "anthropic/claude-opus-5",
+      label: "Claude Opus 5",
+      pricing: { input: 5, output: 25, cacheRead: 0.5, cacheWrite5m: 6.25, cacheWrite1h: 6.25 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "anthropic/claude-sonnet-5",
+      label: "Claude Sonnet 5",
+      pricing: { input: 2, output: 10, cacheRead: 0.2, cacheWrite5m: 2.5, cacheWrite1h: 2.5 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
+    },
+    {
+      id: "anthropic/claude-haiku-4.5",
+      label: "Claude Haiku 4.5",
+      pricing: { input: 1, output: 5, cacheRead: 0.1, cacheWrite5m: 1.25, cacheWrite1h: 1.25 },
+      limits: { contextWindow: 200000, maxOutputTokens: 64000 }
+    },
+    {
+      id: "openai/gpt-5.6-sol",
+      label: "GPT-5.6 Sol",
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 6.25, cacheWrite1h: 6.25 },
+      limits: { contextWindow: 1050000, maxOutputTokens: 128000 }
+    },
+    {
+      id: "openai/gpt-5.6-terra",
+      label: "GPT-5.6 Terra",
+      pricing: { input: 2, output: 12, cacheRead: 0.2, cacheWrite5m: 2.5, cacheWrite1h: 2.5 },
+      limits: { contextWindow: 1050000, maxOutputTokens: 128000 }
+    },
+    {
+      id: "openai/gpt-5.6-luna",
+      label: "GPT-5.6 Luna",
+      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02, cacheWrite5m: 0.25, cacheWrite1h: 0.25 },
+      limits: { contextWindow: 1050000, maxOutputTokens: 128000 }
+    },
+    {
+      id: "google/gemini-3.1-pro-preview",
+      label: "Gemini 3.1 Pro Preview",
+      pricing: { input: 2, output: 12, cacheRead: 0.2, cacheWrite5m: 0.375, cacheWrite1h: 0.375 },
+      limits: { contextWindow: 1048576, maxOutputTokens: 65536 }
+    },
+    {
+      id: "google/gemini-3.7-flash",
+      label: "Gemini 3.7 Flash",
+      pricing: {
+        input: 0.75,
+        output: 3.75,
+        cacheRead: 0.075,
+        cacheWrite5m: 0.041667,
+        cacheWrite1h: 0.041667
+      },
+      limits: { contextWindow: 1048576, maxOutputTokens: 65536 }
+    },
+    {
+      id: "moonshotai/kimi-k3",
+      label: "Kimi K3",
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1048576, maxOutputTokens: 131072 }
+    },
+    {
+      id: "nvidia/nemotron-3-ultra-550b-a55b:free",
+      label: "Nemotron 3 Ultra 550B \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 65536 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "nvidia/nemotron-3.5-lightning:free",
+      label: "Nemotron 3.5 Lightning \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 65536 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "dots-studio/dots-3-note-preview:free",
+      label: "Dots 3 Note Preview \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 512000, maxOutputTokens: 512000 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "cohere/north-mini-code:free",
+      label: "North Mini Code \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 256000, maxOutputTokens: 64000 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
+      label: "Nemotron 3 Nano Omni 30B Reasoning \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 256000, maxOutputTokens: 65536 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "stepfun/step-3.7-flash:free",
+      label: "Step 3.7 Flash \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 262144 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "nvidia/nemotron-3-super-120b-a12b:free",
+      label: "Nemotron 3 Super 120B \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 262144 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "tencent/hy3:free",
+      label: "Tencent HY3 \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 128000 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "poolside/laguna-s-2.1:free",
+      label: "Laguna S 2.1 \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 32768 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "poolside/laguna-xs-2.1:free",
+      label: "Laguna XS 2.1 \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 32768 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "liquid/lfm-2.5-2.6b:free",
+      label: "LFM 2.5 2.6B \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 128000, maxOutputTokens: 8192 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "nvidia/nemotron-3.5-content-safety:free",
+      label: "Nemotron 3.5 Content Safety \u2014 free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 128000, maxOutputTokens: 8192 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "kilo-auto/frontier",
+      label: "Kilo Auto \u2014 Frontier",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "kilo-auto/balanced",
+      label: "Kilo Auto \u2014 Balanced",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 65536 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "kilo-auto/efficient",
+      label: "Kilo Auto \u2014 Efficient",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 65536 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "kilo-auto/small",
+      label: "Kilo Auto \u2014 Small",
+      pricing: { input: 0.05, output: 0.4, cacheRead: 0.005, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 32768 },
+      auth: ["apiKey"]
+    },
+    {
+      id: "kilo-auto/free",
+      label: "Kilo Auto \u2014 Free",
+      pricing: { input: 0, output: 0, cacheRead: 0, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 256000, maxOutputTokens: 1e4 },
+      auth: ["apiKey"]
+    }
+  ]
+};
+
 // packages/providers/src/kimi/models.ts
 var KIMI_MODELS = {
   defaultModel: "k3-256k",
+  authTypes: ["oauth", "apiKey"],
   models: [
     {
       id: "k3-256k",
@@ -5907,6 +6221,7 @@ var KIMI_MODELS = {
 // packages/providers/src/openai/models.ts
 var OPENAI_MODELS = {
   defaultModel: "gpt-5.6",
+  authTypes: ["oauth", "apiKey"],
   models: [
     {
       id: "gpt-5.6",
@@ -5944,11 +6259,17 @@ var PROVIDER_MODEL_CATALOG = {
   anthropic: ANTHROPIC_MODELS,
   openai: OPENAI_MODELS,
   kimi: KIMI_MODELS,
-  custom: { defaultModel: "", models: [] }
+  kilo: KILO_MODELS,
+  grok: GROK_MODELS,
+  custom: { defaultModel: "", authTypes: ["apiKey"], models: [] }
 };
 function catalogPricing(provider, model) {
   return PROVIDER_MODEL_CATALOG[provider]?.models.find((entry) => entry.id === model)?.pricing ?? null;
 }
+function catalogModelAuths(provider, model) {
+  const entry = PROVIDER_MODEL_CATALOG[provider];
+  return entry.models.find((choice) => choice.id === model)?.auth ?? entry.authTypes;
+}
 function catalogLimits(provider, model, auth = "apiKey") {
   const entry = PROVIDER_MODEL_CATALOG[provider]?.models.find((choice) => choice.id === model);
   if (entry === undefined)
@@ -6036,6 +6357,9 @@ function stainlessHost(platform, arch) {
   const os = platform === "darwin" ? "MacOS" : platform === "linux" ? "Linux" : platform === "win32" ? "Windows" : "Unknown";
   return { os, arch };
 }
+function grokHost(platform, arch) {
+  return { os: platform.toLowerCase(), arch: arch === "arm64" ? "aarch64" : arch };
+}
 function orderHeaders(pairs, order) {
   const remaining = [...pairs];
   const out = [];
@@ -6154,10 +6478,64 @@ var kimi = {
     "Content-Length"
   ]
 };
+var KILO_CLI_VERSION = env("OMNI_KILO_CLI_VERSION", "4.140.0");
+var kilo = {
+  headers: [
+    ["User-Agent", env("OMNI_UA_KILO", `Kilo-Code/${KILO_CLI_VERSION}`)],
+    ["X-KILOCODE-EDITORNAME", env("OMNI_KILO_EDITOR_NAME", "vscode")],
+    ["Accept", "text/event-stream"]
+  ],
+  order: [
+    "Host",
+    "Content-Type",
+    "Authorization",
+    "X-Kilocode-OrganizationID",
+    "X-KILOCODE-EDITORNAME",
+    "User-Agent",
+    "Accept",
+    "Accept-Encoding",
+    "Content-Length"
+  ]
+};
+var GROK_CLI_VERSION = env("OMNI_GROK_CLI_VERSION", "0.2.120");
+var grokUa = grokHost(process.platform, process.arch);
+var grok = {
+  headers: [
+    [
+      "User-Agent",
+      env("OMNI_UA_GROK", `grok-shell/${GROK_CLI_VERSION} (${grokUa.os}; ${grokUa.arch})`)
+    ],
+    ["x-grok-client-identifier", "grok-shell"],
+    ["x-grok-client-version", GROK_CLI_VERSION],
+    ["x-grok-client-mode", "headless"],
+    ["Accept", "text/event-stream"]
+  ],
+  order: [
+    "Host",
+    "Content-Type",
+    "Authorization",
+    "X-XAI-Token-Auth",
+    "x-authenticateresponse",
+    "x-grok-client-identifier",
+    "x-grok-client-version",
+    "x-grok-client-mode",
+    "x-grok-agent-id",
+    "x-grok-req-id",
+    "x-grok-conv-id",
+    "x-grok-session-id",
+    "x-grok-model-override",
+    "User-Agent",
+    "Accept",
+    "Accept-Encoding",
+    "Content-Length"
+  ]
+};
 var PROFILES = {
   anthropic: { ...anthropic, order: envOrder("OMNI_ORDER_ANTHROPIC", anthropic.order) },
   openai: { ...openai, order: envOrder("OMNI_ORDER_OPENAI", openai.order) },
   kimi: { ...kimi, order: envOrder("OMNI_ORDER_KIMI", kimi.order) },
+  kilo: { ...kilo, order: envOrder("OMNI_ORDER_KILO", kilo.order) },
+  grok: { ...grok, order: envOrder("OMNI_ORDER_GROK", grok.order) },
   custom: { headers: [], order: [] }
 };
 
@@ -6874,19 +7252,19 @@ var anthropicAdapter = {
       ["anthropic-version", API_VERSION],
       ["Accept", "text/event-stream"]
     ];
-    const betas = new Set(req.request.betas ?? []);
+    const betas2 = new Set(req.request.betas ?? []);
     const notes = [...degradations];
-    if (betas.has(CONTEXT_1M_BETA)) {
+    if (betas2.has(CONTEXT_1M_BETA)) {
       const limits = catalogLimits("anthropic", req.model, oauth ? "oauth" : "apiKey");
       const window2 = limits?.contextWindow;
       if (window2 !== undefined && window2 < CONTEXT_1M_TOKENS) {
-        betas.delete(CONTEXT_1M_BETA);
+        betas2.delete(CONTEXT_1M_BETA);
         notes.push("anthropic:context-1m-dropped");
       }
     }
     if (oauth) {
       protocol.push(["Authorization", `Bearer ${req.credentials.accessToken}`]);
-      betas.add(OAUTH_BETA);
+      betas2.add(OAUTH_BETA);
     } else if (req.credentials.apiKey !== null) {
       protocol.push(["x-api-key", req.credentials.apiKey]);
     } else {
@@ -6894,8 +7272,8 @@ var anthropicAdapter = {
         provider: "anthropic"
       });
     }
-    if (betas.size > 0)
-      protocol.push(["anthropic-beta", [...betas].join(",")]);
+    if (betas2.size > 0)
+      protocol.push(["anthropic-beta", [...betas2].join(",")]);
     const profile = PROFILES.anthropic;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const bodyString = signAnthropicBody(JSON.stringify(orderFields(withSystem, BODY_ORDER.anthropic)));
@@ -6931,13 +7309,13 @@ function json2(data) {
 }
 async function* decodeChat(messages) {
   let started = false;
-  let textOpen = false;
-  let textIndex;
   let done = false;
   let stopReason = "endTurn";
   let usage = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
   const toolIndex = new Map;
   let nextIndex = 0;
+  let openKind;
+  let openIndex = 0;
   for await (const msg of messages) {
     if (msg.data === "[DONE]") {
       done = true;
@@ -6959,14 +7337,16 @@ async function* decodeChat(messages) {
       continue;
     const delta = choice.delta ?? {};
     if (typeof delta.content === "string" && delta.content.length > 0) {
-      if (!textOpen) {
-        textOpen = true;
-        textIndex = nextIndex++;
-        yield { type: "blockStart", index: textIndex, block: { type: "text" } };
+      if (openKind !== "text") {
+        if (openKind !== undefined)
+          yield { type: "blockEnd", index: openIndex };
+        openKind = "text";
+        openIndex = nextIndex++;
+        yield { type: "blockStart", index: openIndex, block: { type: "text" } };
       }
       yield {
         type: "blockDelta",
-        index: textIndex ?? 0,
+        index: openIndex,
         delta: { type: "text", text: delta.content }
       };
     }
@@ -6974,8 +7354,12 @@ async function* decodeChat(messages) {
       const wireIndex = call.index ?? 0;
       let index = toolIndex.get(wireIndex);
       if (index === undefined) {
+        if (openKind !== undefined)
+          yield { type: "blockEnd", index: openIndex };
         index = nextIndex++;
         toolIndex.set(wireIndex, index);
+        openKind = "tool";
+        openIndex = index;
         yield {
           type: "blockStart",
           index,
@@ -6996,10 +7380,8 @@ async function* decodeChat(messages) {
     }
   }
   if (done) {
-    if (textOpen)
-      yield { type: "blockEnd", index: textIndex ?? 0 };
-    for (const index of toolIndex.values())
-      yield { type: "blockEnd", index };
+    if (openKind !== undefined)
+      yield { type: "blockEnd", index: openIndex };
     yield { type: "end", stopReason, usage };
   } else {
     yield {
@@ -7428,6 +7810,393 @@ var customAdapter = {
     };
   }
 };
+// packages/providers/src/grok/device.ts
+import { randomUUID } from "crypto";
+function mintGrokDevice() {
+  return { agentId: randomUUID() };
+}
+function grokDeviceHeaders(providerData) {
+  const agentId = providerData.agentId;
+  if (typeof agentId !== "string" || agentId.length === 0)
+    return [];
+  return [["x-grok-agent-id", agentId]];
+}
+// packages/providers/src/grok/index.ts
+import { createHash as createHash2 } from "crypto";
+
+// packages/providers/src/grok/decode.ts
+var ERROR_CODE2 = {
+  rate_limit_exceeded: "RATE_LIMIT",
+  insufficient_quota: "QUOTA_EXHAUSTED",
+  invalid_api_key: "AUTH",
+  server_error: "UPSTREAM",
+  context_length_exceeded: "BAD_REQUEST",
+  content_policy_violation: "CONTENT_FILTER"
+};
+var KNOWN_EVENTS2 = new Set([
+  "response.created",
+  "response.queued",
+  "response.in_progress",
+  "response.output_item.added",
+  "response.output_item.done",
+  "response.content_part.added",
+  "response.content_part.done",
+  "response.output_text.delta",
+  "response.output_text.done",
+  "response.output_text.annotation.added",
+  "response.refusal.delta",
+  "response.refusal.done",
+  "response.reasoning_summary_part.added",
+  "response.reasoning_summary_part.done",
+  "response.reasoning_summary_text.delta",
+  "response.reasoning_summary_text.done",
+  "response.reasoning_text.delta",
+  "response.reasoning_text.done",
+  "response.function_call_arguments.delta",
+  "response.function_call_arguments.done",
+  "response.completed",
+  "response.incomplete",
+  "response.failed",
+  "error"
+]);
+function json4(data) {
+  try {
+    const v = JSON.parse(data);
+    return typeof v === "object" && v !== null ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function* decodeGrokResponses(messages) {
+  const indices = new Map;
+  let next = 0;
+  const irIndex = (outputIndex, contentIndex = 0) => {
+    const key = `${outputIndex}:${contentIndex}`;
+    const existing = indices.get(key);
+    if (existing !== undefined)
+      return existing;
+    const assigned = next++;
+    indices.set(key, assigned);
+    return assigned;
+  };
+  let sawToolCall = false;
+  let terminal = false;
+  const ownsBlock = new Set;
+  for await (const msg of messages) {
+    if (msg.data === "[DONE]")
+      continue;
+    if (!KNOWN_EVENTS2.has(msg.event)) {
+      yield {
+        type: "error",
+        code: "UPSTREAM",
+        message: `unrecognized xAI stream event "${msg.event}"`,
+        retryable: false
+      };
+      return;
+    }
+    const d = json4(msg.data);
+    if (d === null)
+      continue;
+    switch (msg.event) {
+      case "response.created":
+        yield {
+          type: "start",
+          id: String(d.response?.id ?? ""),
+          model: String(d.response?.model ?? "")
+        };
+        break;
+      case "response.output_item.added": {
+        const item = d.item ?? {};
+        if (item.type === "reasoning") {
+          ownsBlock.add(d.output_index ?? 0);
+          yield {
+            type: "blockStart",
+            index: irIndex(d.output_index ?? 0),
+            block: { type: "thinking" }
+          };
+        } else if (item.type === "function_call") {
+          sawToolCall = true;
+          ownsBlock.add(d.output_index ?? 0);
+          yield {
+            type: "blockStart",
+            index: irIndex(d.output_index ?? 0),
+            block: { type: "toolUse", id: String(item.call_id), name: String(item.name) }
+          };
+        }
+        break;
+      }
+      case "response.content_part.added":
+        if (d.part?.type === "output_text") {
+          yield {
+            type: "blockStart",
+            index: irIndex(d.output_index ?? 0, d.content_index ?? 0),
+            block: { type: "text" }
+          };
+        }
+        break;
+      case "response.output_text.delta":
+        yield {
+          type: "blockDelta",
+          index: irIndex(d.output_index ?? 0, d.content_index ?? 0),
+          delta: { type: "text", text: String(d.delta ?? "") }
+        };
+        break;
+      case "response.reasoning_summary_text.delta":
+      case "response.reasoning_text.delta":
+        yield {
+          type: "blockDelta",
+          index: irIndex(d.output_index ?? 0),
+          delta: { type: "thinking", text: String(d.delta ?? "") }
+        };
+        break;
+      case "response.function_call_arguments.delta":
+        yield {
+          type: "blockDelta",
+          index: irIndex(d.output_index ?? 0),
+          delta: { type: "toolJson", partial: String(d.delta ?? "") }
+        };
+        break;
+      case "response.content_part.done":
+        yield { type: "blockEnd", index: irIndex(d.output_index ?? 0, d.content_index ?? 0) };
+        break;
+      case "response.output_item.done": {
+        const outputIndex = d.output_index ?? 0;
+        if (ownsBlock.delete(outputIndex)) {
+          yield { type: "blockEnd", index: irIndex(outputIndex) };
+        }
+        break;
+      }
+      case "response.completed":
+      case "response.incomplete": {
+        terminal = true;
+        const r = d.response ?? {};
+        const reason = r.incomplete_details?.reason;
+        let stopReason = sawToolCall ? "toolUse" : "endTurn";
+        if (reason === "max_output_tokens")
+          stopReason = "maxTokens";
+        else if (reason === "content_filter")
+          stopReason = "contentFilter";
+        yield {
+          type: "end",
+          stopReason,
+          usage: usageFromPromptTotal(r.usage?.input_tokens ?? 0, r.usage?.output_tokens ?? 0, r.usage?.input_tokens_details?.cached_tokens ?? 0)
+        };
+        break;
+      }
+      case "response.failed":
+      case "error": {
+        terminal = true;
+        const err = d.response?.error ?? d.error ?? {};
+        const code = ERROR_CODE2[String(err.code ?? err.type)] ?? "UPSTREAM";
+        yield {
+          type: "error",
+          code,
+          message: String(err.message ?? "upstream error"),
+          retryable: RETRYABLE[code]
+        };
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  if (!terminal) {
+    yield {
+      type: "error",
+      code: "UPSTREAM",
+      message: "upstream stream ended before response completion",
+      retryable: RETRYABLE.UPSTREAM
+    };
+  }
+}
+
+// packages/providers/src/grok/wire.ts
+import { createHash } from "crypto";
+var MAX_TOOLS = 200;
+function encodeToolChoice4(c) {
+  switch (c.type) {
+    case "auto":
+      return "auto";
+    case "any":
+      return "required";
+    case "none":
+      return "none";
+    case "tool":
+      return { type: "function", name: c.name };
+  }
+}
+function promptCacheKey(instructions, firstInput) {
+  const stable = JSON.stringify({ instructions, firstInput });
+  return createHash("sha256").update(stable).digest("hex").slice(0, 32);
+}
+function toGrokWire(req, model) {
+  const degradations = [];
+  const input = [];
+  const note = (d) => {
+    if (!degradations.includes(d))
+      degradations.push(d);
+  };
+  if (req.betas?.includes(CONTEXT_1M_BETA))
+    note("grok:context-1m-dropped");
+  for (const message of req.messages) {
+    const parts = [];
+    const inlined = message.role === "system";
+    if (inlined)
+      note("grok:system-turn-inlined");
+    const role = inlined ? "user" : message.role;
+    const flush = () => {
+      if (parts.length === 0)
+        return;
+      input.push({ type: "message", role, content: [...parts] });
+      parts.length = 0;
+    };
+    for (const block of message.content) {
+      switch (block.type) {
+        case "text":
+          parts.push({
+            type: role === "assistant" ? "output_text" : "input_text",
+            text: inlined ? `<system-reminder>
+${block.text}
+</system-reminder>` : block.text
+          });
+          break;
+        case "image":
+          parts.push({
+            type: "input_image",
+            image_url: `data:${block.mediaType};base64,${block.data}`
+          });
+          break;
+        case "thinking":
+          note("grok:thinking-dropped");
+          break;
+        case "toolUse":
+          flush();
+          input.push({
+            type: "function_call",
+            call_id: block.id,
+            name: block.name,
+            arguments: JSON.stringify(block.input)
+          });
+          break;
+        case "toolResult":
+          flush();
+          input.push({
+            type: "function_call_output",
+            call_id: block.toolUseId,
+            output: block.content
+          });
+          break;
+        case "anthropicNative":
+          note("grok:anthropic-native-block-dropped");
+          break;
+      }
+    }
+    flush();
+  }
+  const instructions = req.system?.flatMap((b) => b.type === "text" ? [b.text] : []).join(`
+
+`);
+  const body = {
+    model,
+    input,
+    stream: req.stream,
+    store: false,
+    include: ["reasoning.encrypted_content"],
+    prompt_cache_key: promptCacheKey(instructions ?? "", input[0])
+  };
+  if (instructions !== undefined && instructions.length > 0)
+    body.instructions = instructions;
+  if (req.maxTokens !== undefined)
+    body.max_output_tokens = req.maxTokens;
+  if (req.temperature !== undefined)
+    body.temperature = req.temperature;
+  if (req.tools !== undefined) {
+    const custom = req.tools.filter((t) => t.provider === "custom");
+    if (custom.length !== req.tools.length)
+      note("grok:anthropic-tool-dropped");
+    if (custom.length > MAX_TOOLS)
+      note("grok:tools-truncated");
+    body.tools = custom.slice(0, MAX_TOOLS).map((t) => ({
+      type: "function",
+      name: t.name,
+      description: t.description,
+      parameters: t.inputSchema
+    }));
+  }
+  if (req.toolChoice !== undefined)
+    body.tool_choice = encodeToolChoice4(req.toolChoice);
+  if (req.reasoning !== undefined && req.reasoning.mode !== "off") {
+    const effort = req.reasoning.mode === "adaptive" ? req.reasoning.effort ?? "medium" : "medium";
+    body.reasoning = { effort, summary: "concise" };
+    if (req.reasoning.mode === "budget")
+      note("grok:reasoning-budget-dropped");
+  }
+  Object.assign(body, req.vendor?.grok ?? {});
+  return { body, degradations };
+}
+
+// packages/providers/src/grok/index.ts
+var PROXY_URL = "https://cli-chat-proxy.grok.com/v1/responses";
+var API_URL = "https://api.x.ai/v1/responses";
+var CONV_NAMESPACE = "omni-grok-conv";
+function derivedUuid(value) {
+  const h = createHash2("sha256").update(`${CONV_NAMESPACE}:${value}`).digest("hex");
+  const variant = (Number.parseInt(h[16], 16) & 3 | 8).toString(16);
+  return [
+    h.slice(0, 8),
+    h.slice(8, 12),
+    `5${h.slice(13, 16)}`,
+    `${variant}${h.slice(17, 20)}`,
+    h.slice(20, 32)
+  ].join("-");
+}
+function requestIdentityHeaders(model, requestId) {
+  const headers = [["x-grok-model-override", model]];
+  if (requestId === undefined || requestId.length === 0)
+    return headers;
+  const conversation = derivedUuid(requestId);
+  return [
+    ...headers,
+    ["x-grok-req-id", requestId],
+    ["x-grok-conv-id", conversation],
+    ["x-grok-session-id", conversation]
+  ];
+}
+var grokAdapter = {
+  id: "grok",
+  capabilities: PROVIDER_CAPABILITIES.grok,
+  async send(req) {
+    const oauth = req.credentials.accessToken !== null;
+    const { body, degradations } = toGrokWire(req.request, req.model);
+    const protocol = [["Content-Type", "application/json"]];
+    if (oauth) {
+      protocol.push(["Authorization", `Bearer ${req.credentials.accessToken}`]);
+      protocol.push(["X-XAI-Token-Auth", "xai-grok-cli"]);
+      protocol.push(["x-authenticateresponse", "authenticate-response"]);
+    } else if (req.credentials.apiKey !== null) {
+      protocol.push(["Authorization", `Bearer ${req.credentials.apiKey}`]);
+    } else {
+      throw new GatewayError("AUTH", "grok credential has no token", { provider: "grok" });
+    }
+    protocol.push(...requestIdentityHeaders(req.model, req.requestId));
+    protocol.push(...grokDeviceHeaders(req.credentials.providerData));
+    const profile = PROFILES.grok;
+    const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
+    const res = await req.http({
+      provider: "grok",
+      url: oauth ? PROXY_URL : API_URL,
+      method: "POST",
+      headers,
+      body: JSON.stringify(orderFields({ ...body, stream: true }, BODY_ORDER.grok)),
+      signal: req.signal
+    });
+    if (res.status < 200 || res.status >= 300)
+      throw await httpError(res, "grok");
+    if (res.body === null)
+      throw new GatewayError("UPSTREAM", "empty response body", { provider: "grok" });
+    return { events: decodeGrokResponses(parseSse(res.body)), degradations };
+  }
+};
 // packages/providers/src/http-client.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
@@ -7514,11 +8283,316 @@ function nodeHttpClient(options = {}) {
 function hasHeader(req, lowerName) {
   return req.headers.some(([name]) => name.toLowerCase() === lowerName);
 }
-// packages/providers/src/kimi-device.ts
-import { randomUUID } from "crypto";
+// packages/providers/src/kilo/decode.ts
+var FINISH2 = {
+  stop: "endTurn",
+  length: "maxTokens",
+  tool_calls: "toolUse",
+  content_filter: "contentFilter"
+};
+function reasoningText(delta) {
+  if (typeof delta.reasoning === "string" && delta.reasoning.length > 0)
+    return delta.reasoning;
+  if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+    return delta.reasoning_content;
+  }
+  if (!Array.isArray(delta.reasoning_details))
+    return "";
+  return delta.reasoning_details.flatMap((entry) => {
+    if (entry === null || typeof entry !== "object")
+      return [];
+    if (typeof entry.text === "string" && entry.text.length > 0)
+      return [entry.text];
+    if (typeof entry.summary === "string" && entry.summary.length > 0)
+      return [entry.summary];
+    return [];
+  }).join("");
+}
+function json5(data) {
+  try {
+    const v = JSON.parse(data);
+    return typeof v === "object" && v !== null ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function* decodeKiloChat(messages) {
+  let started = false;
+  let done = false;
+  let stopReason = "endTurn";
+  let usage = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
+  const toolIndex = new Map;
+  let nextIndex = 0;
+  let openKind;
+  let openIndex = 0;
+  for await (const msg of messages) {
+    if (msg.data === "[DONE]") {
+      done = true;
+      break;
+    }
+    const d = json5(msg.data);
+    if (d === null)
+      continue;
+    if (!started && (d.id !== undefined || d.model !== undefined)) {
+      started = true;
+      yield { type: "start", id: String(d.id ?? ""), model: String(d.model ?? "") };
+    }
+    if (d.usage) {
+      const details = d.usage.prompt_tokens_details;
+      usage = usageFromPromptTotal(d.usage.prompt_tokens ?? 0, d.usage.completion_tokens ?? 0, details?.cached_tokens ?? d.usage.prompt_cache_hit_tokens ?? 0, details?.cache_creation_tokens ?? details?.cache_write_tokens ?? 0);
+    }
+    const choice = d.choices?.[0];
+    if (!choice)
+      continue;
+    const delta = choice.delta ?? {};
+    const reasoning = reasoningText(delta);
+    if (reasoning.length > 0) {
+      if (openKind !== "thinking") {
+        if (openKind !== undefined)
+          yield { type: "blockEnd", index: openIndex };
+        openKind = "thinking";
+        openIndex = nextIndex++;
+        yield { type: "blockStart", index: openIndex, block: { type: "thinking" } };
+      }
+      yield {
+        type: "blockDelta",
+        index: openIndex,
+        delta: { type: "thinking", text: reasoning }
+      };
+    }
+    const calls = delta.tool_calls ?? [];
+    if (typeof delta.content === "string" && delta.content.length > 0) {
+      if (openKind !== "text") {
+        if (openKind !== undefined)
+          yield { type: "blockEnd", index: openIndex };
+        openKind = "text";
+        openIndex = nextIndex++;
+        yield { type: "blockStart", index: openIndex, block: { type: "text" } };
+      }
+      yield {
+        type: "blockDelta",
+        index: openIndex,
+        delta: { type: "text", text: delta.content }
+      };
+    }
+    for (const call of calls) {
+      const wireIndex = call.index ?? 0;
+      let index = toolIndex.get(wireIndex);
+      if (index === undefined) {
+        if (openKind !== undefined)
+          yield { type: "blockEnd", index: openIndex };
+        index = nextIndex++;
+        toolIndex.set(wireIndex, index);
+        openKind = "tool";
+        openIndex = index;
+        yield {
+          type: "blockStart",
+          index,
+          block: {
+            type: "toolUse",
+            id: String(call.id ?? `call_${wireIndex}`),
+            name: String(call.function?.name ?? "")
+          }
+        };
+      }
+      const args = call.function?.arguments;
+      if (typeof args === "string" && args.length > 0) {
+        yield { type: "blockDelta", index, delta: { type: "toolJson", partial: args } };
+      }
+    }
+    if (typeof choice.finish_reason === "string") {
+      stopReason = FINISH2[choice.finish_reason] ?? "endTurn";
+    }
+  }
+  if (done) {
+    if (openKind !== undefined)
+      yield { type: "blockEnd", index: openIndex };
+    yield { type: "end", stopReason, usage };
+  } else {
+    yield {
+      type: "error",
+      code: "UPSTREAM",
+      message: "upstream stream ended before [DONE]",
+      retryable: RETRYABLE.UPSTREAM
+    };
+  }
+}
+
+// packages/providers/src/kilo/wire.ts
+function encodeToolChoice5(c) {
+  switch (c.type) {
+    case "auto":
+      return "auto";
+    case "any":
+      return "required";
+    case "none":
+      return "none";
+    case "tool":
+      return { type: "function", function: { name: c.name } };
+  }
+}
+function hasCacheBreakpoint(req) {
+  const marked = (block) => ("cacheControl" in block) && block.cacheControl !== undefined;
+  if (req.system?.some(marked) === true)
+    return true;
+  return req.messages.some((message) => message.content.some(marked));
+}
+function collapse(parts) {
+  if (parts.length === 0)
+    return null;
+  if (parts.every((part) => part.type === "text")) {
+    return parts.map((part) => part.type === "text" ? part.text : "").join(`
+`);
+  }
+  return [...parts];
+}
+function toKiloWire(req, model) {
+  const degradations = [];
+  const note = (d) => {
+    if (!degradations.includes(d))
+      degradations.push(d);
+  };
+  if (req.betas?.includes(CONTEXT_1M_BETA))
+    note("kilo:context-1m-dropped");
+  if (hasCacheBreakpoint(req))
+    note("kilo:cache-control-dropped");
+  const messages = [];
+  const system = req.system?.flatMap((b) => b.type === "text" ? [b.text] : []).join(`
+
+`);
+  if (system !== undefined && system.length > 0)
+    messages.push({ role: "system", content: system });
+  for (const message of req.messages) {
+    let parts = [];
+    const toolCalls = [];
+    const flush = () => {
+      if (toolCalls.length > 0) {
+        messages.push({ role: message.role, content: collapse(parts), tool_calls: [...toolCalls] });
+      } else if (parts.length > 0) {
+        messages.push({ role: message.role, content: collapse(parts) });
+      }
+      parts = [];
+      toolCalls.length = 0;
+    };
+    for (const block of message.content) {
+      switch (block.type) {
+        case "text":
+          parts.push({ type: "text", text: block.text });
+          break;
+        case "image":
+          parts.push({
+            type: "image_url",
+            image_url: { url: `data:${block.mediaType};base64,${block.data}` }
+          });
+          break;
+        case "thinking":
+          note("kilo:thinking-dropped");
+          break;
+        case "toolUse":
+          toolCalls.push({
+            id: block.id,
+            type: "function",
+            function: { name: block.name, arguments: JSON.stringify(block.input) }
+          });
+          break;
+        case "toolResult":
+          flush();
+          messages.push({
+            role: "tool",
+            tool_call_id: block.toolUseId,
+            content: block.content
+          });
+          break;
+        case "anthropicNative":
+          note("kilo:anthropic-native-block-dropped");
+          break;
+      }
+    }
+    flush();
+  }
+  const body = {
+    model,
+    messages,
+    stream: req.stream,
+    stream_options: { include_usage: true }
+  };
+  if (req.maxTokens !== undefined)
+    body.max_tokens = req.maxTokens;
+  if (req.temperature !== undefined)
+    body.temperature = req.temperature;
+  if (req.stopSequences !== undefined)
+    body.stop = req.stopSequences;
+  if (req.tools !== undefined) {
+    const custom = req.tools.filter((t) => t.provider === "custom");
+    if (custom.length !== req.tools.length)
+      note("kilo:anthropic-tool-dropped");
+    body.tools = custom.map((t) => ({
+      type: "function",
+      function: { name: t.name, description: t.description, parameters: t.inputSchema }
+    }));
+  }
+  if (req.toolChoice !== undefined)
+    body.tool_choice = encodeToolChoice5(req.toolChoice);
+  if (req.reasoning !== undefined && req.reasoning.mode !== "off") {
+    if (req.reasoning.mode === "budget") {
+      body.reasoning = { max_tokens: req.reasoning.budgetTokens };
+    } else {
+      const effort = req.reasoning.effort ?? "medium";
+      if (effort === "xhigh" || effort === "max")
+        note("kilo:reasoning-effort-clamped");
+      body.reasoning = { effort: effort === "xhigh" || effort === "max" ? "high" : effort };
+    }
+  }
+  Object.assign(body, req.vendor?.kilo ?? {});
+  return { body, degradations };
+}
+
+// packages/providers/src/kilo/index.ts
+var OAUTH_URL = "https://api.kilo.ai/api/openrouter/chat/completions";
+var API_URL2 = "https://api.kilo.ai/api/gateway/chat/completions";
+function organizationHeaders(providerData) {
+  const orgId = providerData.orgId;
+  if (typeof orgId !== "string" || orgId.length === 0)
+    return [];
+  return [["X-Kilocode-OrganizationID", orgId]];
+}
+var kiloAdapter = {
+  id: "kilo",
+  capabilities: PROVIDER_CAPABILITIES.kilo,
+  async send(req) {
+    const oauth = req.credentials.accessToken !== null;
+    const token = req.credentials.accessToken ?? req.credentials.apiKey;
+    if (token === null) {
+      throw new GatewayError("AUTH", "kilo credential has no token", { provider: "kilo" });
+    }
+    const { body, degradations } = toKiloWire(req.request, req.model);
+    const protocol = [
+      ["Content-Type", "application/json"],
+      ["Authorization", `Bearer ${token}`],
+      ...organizationHeaders(req.credentials.providerData)
+    ];
+    const profile = PROFILES.kilo;
+    const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
+    const res = await req.http({
+      provider: "kilo",
+      url: oauth ? OAUTH_URL : API_URL2,
+      method: "POST",
+      headers,
+      body: JSON.stringify(orderFields({ ...body, stream: true }, BODY_ORDER.kilo)),
+      signal: req.signal
+    });
+    if (res.status < 200 || res.status >= 300)
+      throw await httpError(res, "kilo");
+    if (res.body === null)
+      throw new GatewayError("UPSTREAM", "empty response body", { provider: "kilo" });
+    return { events: decodeKiloChat(parseSse(res.body)), degradations };
+  }
+};
+// packages/providers/src/kimi/device.ts
+import { randomUUID as randomUUID2 } from "crypto";
 function mintKimiDevice() {
   return {
-    deviceId: randomUUID(),
+    deviceId: randomUUID2(),
     deviceName: "MacBook-Pro",
     deviceModel: "MacBookPro18,3",
     osVersion: "15.3.1"
@@ -7536,7 +8610,6 @@ function kimiDeviceHeaders(providerData) {
     ["X-Msh-Os-Version", str(providerData.osVersion)]
   ];
 }
-
 // packages/providers/src/kimi/index.ts
 var BASE_URL2 = "https://api.kimi.com/coding/v1/chat/completions";
 var kimiAdapter = {
@@ -7572,8 +8645,8 @@ var kimiAdapter = {
   }
 };
 // packages/providers/src/openai/index.ts
-var OAUTH_URL = "https://chatgpt.com/backend-api/codex/responses";
-var API_URL = "https://api.openai.com/v1/responses";
+var OAUTH_URL2 = "https://chatgpt.com/backend-api/codex/responses";
+var API_URL3 = "https://api.openai.com/v1/responses";
 var openaiAdapter = {
   id: "openai",
   capabilities: PROVIDER_CAPABILITIES.openai,
@@ -7595,7 +8668,7 @@ var openaiAdapter = {
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
       provider: "openai",
-      url: oauth ? OAUTH_URL : API_URL,
+      url: oauth ? OAUTH_URL2 : API_URL3,
       method: "POST",
       headers,
       body: JSON.stringify(orderFields({ ...body, stream: true }, BODY_ORDER.openai)),
@@ -7613,9 +8686,20 @@ var ADAPTERS = {
   anthropic: anthropicAdapter,
   openai: openaiAdapter,
   kimi: kimiAdapter,
+  kilo: kiloAdapter,
+  grok: grokAdapter,
   custom: customAdapter
 };
 // packages/control/src/oauth/types.ts
+var PENDING_MARKER = "__omni_authorization_pending";
+function isAuthorizationPending(error) {
+  return error instanceof GatewayError && error[PENDING_MARKER] === true;
+}
+function pendingError(reason) {
+  const error = new GatewayError("AUTH", `authorization not yet complete: ${reason}`);
+  error[PENDING_MARKER] = true;
+  return error;
+}
 async function postJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Content-Type", opts.contentType],
@@ -7637,11 +8721,11 @@ async function postJson(deps, provider, url, profile2, opts) {
   } catch {}
   return { status: res.status, parsed };
 }
-async function getJson(deps, provider, url, profile2, opts) {
+async function sendGet(deps, provider, url, profile2, authHeaders, extraHeaders) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
-    ["Authorization", `Bearer ${opts.accessToken}`],
+    ...authHeaders,
     ["Accept", "application/json"],
-    ...opts.extraHeaders ?? []
+    ...extraHeaders
   ]), profile2.order);
   const res = await deps.http({
     provider,
@@ -7658,6 +8742,12 @@ async function getJson(deps, provider, url, profile2, opts) {
   } catch {}
   return { status: res.status, parsed };
 }
+function getJson(deps, provider, url, profile2, opts) {
+  return sendGet(deps, provider, url, profile2, [["Authorization", `Bearer ${opts.accessToken}`]], opts.extraHeaders ?? []);
+}
+function getJsonUnauthenticated(deps, provider, url, profile2, opts) {
+  return sendGet(deps, provider, url, profile2, [], opts?.extraHeaders ?? []);
+}
 function tokenErrorCode(status) {
   if (status === 429)
     return "RATE_LIMIT";
@@ -7670,366 +8760,55 @@ function tokenErrorMessage(status, body2) {
   return `token endpoint rejected the request: ${code}`;
 }
 
-// packages/control/src/oauth/usage.ts
-function usageReadable(status, provider) {
-  if (status === 429) {
-    throw new GatewayError("RATE_LIMIT", `${provider} usage endpoint is rate limited`);
-  }
-  return status >= 200 && status < 300;
-}
-function recordOf(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-}
-function numberOf(record, keys) {
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "number" && Number.isFinite(value))
-      return value;
-    if (typeof value === "string" && value.trim().length > 0) {
-      const parsed = Number(value);
-      if (Number.isFinite(parsed))
-        return parsed;
-    }
-  }
-  return null;
-}
-function nestedOf(record, keys) {
-  for (const key of keys) {
-    const nested = recordOf(record[key]);
-    if (nested !== null)
-      return nested;
-  }
-  return null;
-}
-function resetAtOf(record, keys, now) {
-  for (const key of keys.absolute) {
-    const value = record[key];
-    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
-      return value < 1000000000000 ? Math.round(value * 1000) : Math.round(value);
-    }
-    if (typeof value === "string") {
-      const parsed = Date.parse(value);
-      if (!Number.isNaN(parsed))
-        return parsed;
-    }
-  }
-  for (const key of keys.relativeSeconds ?? []) {
-    const value = record[key];
-    if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
-      return now + Math.round(value * 1000);
-    }
-  }
-  return null;
-}
-var USED_KEYS = ["used", "used_units", "usage", "consumed"];
-var LIMIT_KEYS = ["limit", "limit_units", "total", "quota", "allowed"];
-var PERCENT_KEYS = [
-  "utilization",
-  "used_percent",
-  "usedPercent",
-  "percent_used",
-  "percentUsed",
-  "percent"
-];
-var RESET_ABSOLUTE_KEYS = [
-  "resets_at",
-  "resetsAt",
-  "reset_at",
-  "resetAt",
-  "resetTime",
-  "reset_time",
-  "resets_at_epoch",
-  "reset"
-];
-var RESET_RELATIVE_KEYS = [
-  "resets_in_seconds",
-  "resetsInSeconds",
-  "reset_after_seconds",
-  "resetAfterSeconds",
-  "seconds_until_reset",
-  "resets_in"
-];
-function windowFrom(value, windowType, now) {
-  const record = recordOf(value);
-  if (record === null)
-    return null;
-  const resetsAt = resetAtOf(record, { absolute: RESET_ABSOLUTE_KEYS, relativeSeconds: RESET_RELATIVE_KEYS }, now);
-  const used = numberOf(record, USED_KEYS);
-  const limit = numberOf(record, LIMIT_KEYS);
-  if (used !== null) {
-    return { windowType, used: Math.max(0, used), limit, resetsAt };
-  }
-  const remaining = numberOf(record, ["remaining", "remaining_units", "left"]);
-  if (remaining !== null && limit !== null) {
-    return { windowType, used: Math.max(0, limit - remaining), limit, resetsAt };
-  }
-  const percent = numberOf(record, PERCENT_KEYS);
-  if (percent !== null) {
-    return { windowType, used: Math.max(0, Math.min(100, percent)), limit: 100, resetsAt };
-  }
-  return null;
-}
-function reportFrom(windows) {
-  const kept = windows.filter((w) => w !== null);
-  return kept.length === 0 ? null : { windows: kept };
-}
-
-// packages/control/src/oauth/kimi.ts
-var CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-var DEVICE_CODE_URL = "https://auth.kimi.com/api/oauth/device_authorization";
-var TOKEN_URL = "https://auth.kimi.com/api/oauth/token";
-var USAGE_URL = "https://api.kimi.com/coding/v1/usages";
-var DEFAULT_INTERVAL_SECONDS = 5;
-var PENDING_ERRORS = new Set(["authorization_pending", "slow_down"]);
-var PENDING_MARKER = "__omni_authorization_pending";
-function isAuthorizationPending(error) {
-  return error instanceof GatewayError && error[PENDING_MARKER] === true;
-}
-function pendingError(code) {
-  const error = new GatewayError("AUTH", `authorization not yet complete: ${code}`);
-  error[PENDING_MARKER] = true;
-  return error;
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-function recordFrom(value) {
-  return isRecord2(value) ? value : null;
-}
-function stringFrom(value, field) {
-  const candidate = value[field];
-  return typeof candidate === "string" && candidate.trim().length > 0 ? candidate : null;
-}
-function positiveNumberFrom(value, field) {
-  const candidate = value[field];
-  return typeof candidate === "number" && Number.isFinite(candidate) && candidate > 0 ? candidate : null;
-}
-function tokenFrom(value) {
-  const record = recordFrom(value);
-  if (record === null) {
-    throw new GatewayError("AUTH", "token endpoint returned no access_token");
-  }
-  const accessToken = stringFrom(record, "access_token");
-  if (accessToken === null) {
-    throw new GatewayError("AUTH", "token endpoint returned no access_token");
-  }
-  return {
-    accessToken,
-    refreshToken: stringFrom(record, "refresh_token"),
-    expiresIn: positiveNumberFrom(record, "expires_in"),
-    email: stringFrom(record, "email")
-  };
-}
-function deviceCodeFrom(value) {
-  const record = recordFrom(value);
-  if (record === null) {
-    throw new GatewayError("AUTH", "device code endpoint returned an unusable response");
-  }
-  const deviceCode = stringFrom(record, "device_code");
-  const userCode = stringFrom(record, "user_code");
-  if (deviceCode === null || userCode === null) {
-    throw new GatewayError("AUTH", "device code endpoint returned an unusable response");
-  }
-  return {
-    deviceCode,
-    userCode,
-    verificationUri: stringFrom(record, "verification_uri_complete") ?? stringFrom(record, "verification_uri") ?? "https://www.kimi.com/device",
-    interval: positiveNumberFrom(record, "interval") ?? DEFAULT_INTERVAL_SECONDS
-  };
-}
-async function post(url, body2, device, deps) {
-  const { status, parsed } = await postJson(deps, "kimi", url, PROFILES.kimi, {
-    contentType: "application/x-www-form-urlencoded",
-    body: new URLSearchParams({ ...body2, client_id: CLIENT_ID }).toString(),
-    extraHeaders: kimiDeviceHeaders(device)
-  });
-  if (status >= 200 && status < 300)
-    return parsed;
-  const record = recordFrom(parsed);
-  const code = record === null ? `http_${status}` : stringFrom(record, "error") ?? `http_${status}`;
-  if (PENDING_ERRORS.has(code))
-    throw pendingError(code);
-  throw new GatewayError(tokenErrorCode(status), tokenErrorMessage(status, parsed));
-}
-function deviceFrom(source) {
-  if (typeof source?.deviceId === "string" && source.deviceId.length > 0) {
-    const fresh = mintKimiDevice();
-    const field = (key, fallback) => {
-      const value = source[key];
-      return typeof value === "string" && value.length > 0 ? value : fallback;
-    };
-    return {
-      deviceId: source.deviceId,
-      deviceName: field("deviceName", fresh.deviceName),
-      deviceModel: field("deviceModel", fresh.deviceModel),
-      osVersion: field("osVersion", fresh.osVersion)
-    };
-  }
-  return mintKimiDevice();
-}
-function deviceForBegin(deviceId) {
-  return { ...mintKimiDevice(), deviceId };
-}
-function toResult(token, device, fallbackRefresh, deps) {
-  return {
-    secrets: {
-      accessToken: token.accessToken,
-      refreshToken: token.refreshToken ?? fallbackRefresh,
-      apiKey: null,
-      idToken: null
-    },
-    expiresAt: token.expiresIn === null ? null : deps.now() + token.expiresIn * 1000,
-    accountEmail: token.email,
-    providerData: { ...device }
-  };
-}
-function parseKimiUsage(value, now) {
-  const root = recordOf(value);
-  if (root === null)
-    return null;
-  return reportFrom([windowFrom(root.usage ?? root.Usage, "weekly", now)]);
-}
-var kimiOAuth = {
-  id: "kimi",
-  kind: "device",
-  supportsManualPaste: false,
-  start() {
-    const device = mintKimiDevice();
-    return {
-      authorizeUrl: "https://www.kimi.com/device",
-      pending: { verifier: "", challenge: "", state: "", redirectUri: "", extra: { ...device } }
-    };
-  },
-  async begin({ deviceId }, deps) {
-    if (deviceId.trim().length === 0) {
-      throw new Error("kimi begin requires a non-blank deviceId");
-    }
-    const device = deviceForBegin(deviceId);
-    const response = deviceCodeFrom(await post(DEVICE_CODE_URL, {}, device, deps));
-    return {
-      authorizeUrl: response.verificationUri,
-      userCode: response.userCode,
-      pending: {
-        verifier: "",
-        challenge: "",
-        state: "",
-        redirectUri: "",
-        deviceCode: response.deviceCode,
-        interval: response.interval,
-        extra: { ...device }
-      }
-    };
-  },
-  async exchange({ pending }, deps) {
-    if (pending.deviceCode === undefined) {
-      throw new Error("kimi exchange requires a pending flow produced by begin()");
-    }
-    const device = deviceFrom(pending.extra);
-    const token = tokenFrom(await post(TOKEN_URL, {
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      device_code: pending.deviceCode,
-      device_id: device.deviceId
-    }, device, deps));
-    return toResult(token, device, null, deps);
-  },
-  async refresh(refreshToken, deps, providerData) {
-    const device = deviceFrom(providerData);
-    const token = tokenFrom(await post(TOKEN_URL, { grant_type: "refresh_token", refresh_token: refreshToken, device_id: device.deviceId }, device, deps));
-    return toResult(token, device, refreshToken, deps);
-  },
-  async usage(secrets, deps, providerData) {
-    if (secrets.accessToken === null)
-      return null;
-    const device = deviceFrom(providerData);
-    const { status, parsed } = await getJson(deps, "kimi", USAGE_URL, PROFILES.kimi, {
-      accessToken: secrets.accessToken,
-      extraHeaders: kimiDeviceHeaders(device)
-    });
-    if (!usageReadable(status, "kimi"))
-      return null;
-    return parseKimiUsage(parsed, deps.now());
-  }
-};
-
-// packages/control/src/oauth/pending.ts
-function createPendingFlows(opts) {
-  const flows = new Map;
-  const expired = (entry) => entry.expiresAt <= opts.now();
-  return {
-    put(flow) {
-      const id = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64url");
-      flows.set(id, { flow, expiresAt: opts.now() + opts.ttlMs });
-      return id;
-    },
-    take(id) {
-      const entry = flows.get(id);
-      if (entry === undefined)
-        return null;
-      flows.delete(id);
-      return expired(entry) ? null : entry.flow;
-    },
-    peek(id) {
-      const entry = flows.get(id);
-      if (entry === undefined || expired(entry))
-        return null;
-      return entry.flow;
-    },
-    byState(state) {
-      if (state.trim().length === 0)
-        return null;
-      for (const [id, entry] of flows) {
-        if (entry.flow.pending.state === state) {
-          return expired(entry) ? null : { ...entry.flow, id };
-        }
-      }
-      return null;
-    },
-    sweep() {
-      for (const [id, entry] of flows) {
-        if (expired(entry))
-          flows.delete(id);
-      }
-    },
-    size() {
-      return flows.size;
-    }
-  };
-}
-
 // packages/control/src/connect.ts
-var PROVIDER_IDS = ["anthropic", "openai", "kimi", "custom"];
+var PROVIDER_IDS = [
+  "anthropic",
+  "openai",
+  "kimi",
+  "kilo",
+  "grok",
+  "custom"
+];
 var FLOW_TTL_MS = 600000;
+var CALLBACKS = {
+  openai: { uri: "http://localhost:1455/auth/callback", label: "OpenAI" },
+  grok: { uri: "http://127.0.0.1:56121/callback", label: "Grok" }
+};
 function isProviderId(value) {
   return typeof value === "string" && PROVIDER_IDS.includes(value);
 }
-function deviceIdFrom(start) {
+function deviceIdFrom(provider, start) {
   const deviceId = start.pending.extra?.deviceId;
-  if (typeof deviceId !== "string" || deviceId.trim().length === 0) {
+  if (typeof deviceId === "string" && deviceId.trim().length > 0)
+    return deviceId;
+  if (provider.needsDeviceId) {
     throw new GatewayError("INTERNAL", "device authorization did not provide a device id");
   }
-  return deviceId;
+  return "";
 }
 function createConnectFlows(deps) {
   const logger2 = deps.logger ?? noopLogger;
   const flows = createPendingFlows({ now: deps.now, ttlMs: FLOW_TTL_MS });
   const pollsInFlight = new Map;
-  const callbackUri = (provider) => provider === "openai" ? "http://localhost:1455/auth/callback" : "";
+  const callbackUri = (provider) => CALLBACKS[provider]?.uri ?? "";
   function normalizeAuthorizationCode(flow, input) {
-    if (flow.provider !== "openai")
+    const callback = CALLBACKS[flow.provider];
+    if (callback === undefined)
       return input;
+    const expected = new URL(callback.uri);
     let url;
     try {
       url = new URL(input);
     } catch {
       return input;
     }
-    if (url.origin !== "http://localhost:1455" || url.pathname !== "/auth/callback") {
-      throw new GatewayError("BAD_REQUEST", "invalid OpenAI callback URL");
+    if (url.origin !== expected.origin || url.pathname !== expected.pathname) {
+      throw new GatewayError("BAD_REQUEST", `invalid ${callback.label} callback URL`);
     }
     const code = url.searchParams.get("code")?.trim() ?? "";
     const state = url.searchParams.get("state")?.trim() ?? "";
     if (code.length === 0 || state.length === 0) {
-      throw new GatewayError("BAD_REQUEST", "OpenAI callback URL must contain code and state");
+      throw new GatewayError("BAD_REQUEST", `${callback.label} callback URL must contain code and state`);
     }
     if (state !== flow.pending.state) {
       throw new GatewayError("AUTH", "authorization state mismatch");
@@ -8079,7 +8858,7 @@ function createConnectFlows(deps) {
     async start(providerInput, labelInput) {
       flows.sweep();
       if (!isProviderId(providerInput)) {
-        throw new GatewayError("BAD_REQUEST", "provider must be one of anthropic, openai, kimi");
+        throw new GatewayError("BAD_REQUEST", "provider must be one of anthropic, openai, kimi, kilo, grok");
       }
       const label = typeof labelInput === "string" && labelInput.trim().length > 0 ? labelInput.trim() : providerInput;
       const provider = deps.providers[providerInput];
@@ -8087,13 +8866,9 @@ function createConnectFlows(deps) {
         throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
       }
       const redirectUri = callbackUri(providerInput);
-      const start = provider.begin === undefined ? provider.start({ redirectUri }) : await (async () => {
-        const initial = provider.start({ redirectUri });
-        return provider.begin?.({ deviceId: deviceIdFrom(initial) }, { http: deps.http, now: deps.now });
-      })();
-      if (start === undefined) {
-        throw new GatewayError("INTERNAL", "device authorization could not start");
-      }
+      const oauthDeps = { http: deps.http, now: deps.now };
+      const initial = await provider.start({ redirectUri }, oauthDeps);
+      const start = provider.kind === "device" ? await provider.begin({ deviceId: deviceIdFrom(provider, initial) }, oauthDeps) : initial;
       const flowId = flows.put({
         provider: providerInput,
         label,
@@ -8136,60 +8911,6 @@ function createConnectFlows(deps) {
     }
   };
 }
-// packages/control/src/console.ts
-var UNIT_NAME = "omnigateway.service";
-var MAX_CONSOLE_LINES = 500;
-var DEFAULT_CONSOLE_LINES = 200;
-function resolveConsoleSource(input) {
-  const path = input.logFile?.trim();
-  if (path !== undefined && path.length > 0)
-    return { kind: "file", path };
-  if (input.unitInstalled)
-    return { kind: "journal", unit: UNIT_NAME, scope: input.scope };
-  return { kind: "none" };
-}
-function consoleLimit(requested) {
-  const value = requested === undefined ? DEFAULT_CONSOLE_LINES : Number(requested);
-  if (!Number.isFinite(value))
-    return DEFAULT_CONSOLE_LINES;
-  return Math.floor(Math.min(Math.max(1, value), MAX_CONSOLE_LINES));
-}
-function keep(line, query) {
-  if (query.since !== undefined && (line.at === null || line.at <= query.since))
-    return false;
-  if (query.level === undefined || line.level === null)
-    return true;
-  return LEVELS[line.level] >= LEVELS[query.level];
-}
-var SCAN_FACTOR = 20;
-var SCAN_LIMIT = 5000;
-function scanWidth(query) {
-  const filtered = query.level !== undefined || query.since !== undefined;
-  return filtered ? Math.min(query.lines * SCAN_FACTOR, SCAN_LIMIT) : query.lines;
-}
-async function readSource(deps, source, lines) {
-  if (source.kind === "none")
-    return "";
-  if (source.kind === "file")
-    return deps.readFile(source.path, lines) ?? "";
-  const unit = source.scope === "system" ? ["-u", source.unit] : [`--user-unit=${source.unit}`];
-  const result = await deps.run([
-    "journalctl",
-    ...unit,
-    "-n",
-    String(lines),
-    "--no-pager",
-    "--output=cat"
-  ]);
-  return result.code === 0 ? result.stdout : "";
-}
-async function readConsole(deps, source, query) {
-  const limited = { ...query, lines: consoleLimit(query.lines) };
-  const text = await readSource(deps, source, scanWidth(limited));
-  const lines = text.split(`
-`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
-  return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
-}
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -8335,7 +9056,7 @@ __export(exports_external, {
   ipv4: () => ipv42,
   ipv6: () => ipv62,
   iso: () => exports_iso,
-  json: () => json4,
+  json: () => json6,
   jwt: () => jwt,
   keyof: () => keyof,
   ksuid: () => ksuid2,
@@ -19776,29 +20497,29 @@ var formatMap = {
   regex: ""
 };
 var stringProcessor = (schema, ctx, _json, _params) => {
-  const json4 = _json;
-  json4.type = "string";
+  const json6 = _json;
+  json6.type = "string";
   const { minimum, maximum, format, patterns, contentEncoding } = schema._zod.bag;
   if (typeof minimum === "number")
-    json4.minLength = minimum;
+    json6.minLength = minimum;
   if (typeof maximum === "number")
-    json4.maxLength = maximum;
+    json6.maxLength = maximum;
   if (format) {
-    json4.format = formatMap[format] ?? format;
-    if (json4.format === "")
-      delete json4.format;
+    json6.format = formatMap[format] ?? format;
+    if (json6.format === "")
+      delete json6.format;
     if (format === "time") {
-      delete json4.format;
+      delete json6.format;
     }
   }
   if (contentEncoding)
-    json4.contentEncoding = contentEncoding;
+    json6.contentEncoding = contentEncoding;
   if (patterns && patterns.size > 0) {
     const regexes = [...patterns];
     if (regexes.length === 1)
-      json4.pattern = regexes[0].source;
+      json6.pattern = regexes[0].source;
     else if (regexes.length > 1) {
-      json4.allOf = [
+      json6.allOf = [
         ...regexes.map((regex) => ({
           ...ctx.target === "draft-07" || ctx.target === "draft-04" || ctx.target === "openapi-3.0" ? { type: "string" } : {},
           pattern: regex.source
@@ -19808,40 +20529,40 @@ var stringProcessor = (schema, ctx, _json, _params) => {
   }
 };
 var numberProcessor = (schema, ctx, _json, _params) => {
-  const json4 = _json;
+  const json6 = _json;
   const { minimum, maximum, format, multipleOf, exclusiveMaximum, exclusiveMinimum } = schema._zod.bag;
   if (typeof format === "string" && format.includes("int"))
-    json4.type = "integer";
+    json6.type = "integer";
   else
-    json4.type = "number";
+    json6.type = "number";
   const exMin = typeof exclusiveMinimum === "number" && exclusiveMinimum >= (minimum ?? Number.NEGATIVE_INFINITY);
   const exMax = typeof exclusiveMaximum === "number" && exclusiveMaximum <= (maximum ?? Number.POSITIVE_INFINITY);
   const legacy = ctx.target === "draft-04" || ctx.target === "openapi-3.0";
   if (exMin) {
     if (legacy) {
-      json4.minimum = exclusiveMinimum;
-      json4.exclusiveMinimum = true;
+      json6.minimum = exclusiveMinimum;
+      json6.exclusiveMinimum = true;
     } else {
-      json4.exclusiveMinimum = exclusiveMinimum;
+      json6.exclusiveMinimum = exclusiveMinimum;
     }
   } else if (typeof minimum === "number") {
-    json4.minimum = minimum;
+    json6.minimum = minimum;
   }
   if (exMax) {
     if (legacy) {
-      json4.maximum = exclusiveMaximum;
-      json4.exclusiveMaximum = true;
+      json6.maximum = exclusiveMaximum;
+      json6.exclusiveMaximum = true;
     } else {
-      json4.exclusiveMaximum = exclusiveMaximum;
+      json6.exclusiveMaximum = exclusiveMaximum;
     }
   } else if (typeof maximum === "number") {
-    json4.maximum = maximum;
+    json6.maximum = maximum;
   }
   if (typeof multipleOf === "number")
-    json4.multipleOf = multipleOf;
+    json6.multipleOf = multipleOf;
 };
-var booleanProcessor = (_schema, _ctx, json4, _params) => {
-  json4.type = "boolean";
+var booleanProcessor = (_schema, _ctx, json6, _params) => {
+  json6.type = "boolean";
 };
 var bigintProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
@@ -19853,13 +20574,13 @@ var symbolProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("Symbols cannot be represented in JSON Schema");
   }
 };
-var nullProcessor = (_schema, ctx, json4, _params) => {
+var nullProcessor = (_schema, ctx, json6, _params) => {
   if (ctx.target === "openapi-3.0") {
-    json4.type = "string";
-    json4.nullable = true;
-    json4.enum = [null];
+    json6.type = "string";
+    json6.nullable = true;
+    json6.enum = [null];
   } else {
-    json4.type = "null";
+    json6.type = "null";
   }
 };
 var undefinedProcessor = (_schema, ctx, _json, _params) => {
@@ -19872,8 +20593,8 @@ var voidProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("Void cannot be represented in JSON Schema");
   }
 };
-var neverProcessor = (_schema, _ctx, json4, _params) => {
-  json4.not = {};
+var neverProcessor = (_schema, _ctx, json6, _params) => {
+  json6.not = {};
 };
 var anyProcessor = (_schema, _ctx, _json, _params) => {};
 var unknownProcessor = (_schema, _ctx, _json, _params) => {};
@@ -19882,16 +20603,16 @@ var dateProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("Date cannot be represented in JSON Schema");
   }
 };
-var enumProcessor = (schema, _ctx, json4, _params) => {
+var enumProcessor = (schema, _ctx, json6, _params) => {
   const def = schema._zod.def;
   const values = getEnumValues(def.entries);
   if (values.every((v) => typeof v === "number"))
-    json4.type = "number";
+    json6.type = "number";
   if (values.every((v) => typeof v === "string"))
-    json4.type = "string";
-  json4.enum = values;
+    json6.type = "string";
+  json6.enum = values;
 };
-var literalProcessor = (schema, ctx, json4, _params) => {
+var literalProcessor = (schema, ctx, json6, _params) => {
   const def = schema._zod.def;
   const vals = [];
   for (const val of def.values) {
@@ -19911,22 +20632,22 @@ var literalProcessor = (schema, ctx, json4, _params) => {
   }
   if (vals.length === 0) {} else if (vals.length === 1) {
     const val = vals[0];
-    json4.type = val === null ? "null" : typeof val;
+    json6.type = val === null ? "null" : typeof val;
     if (ctx.target === "draft-04" || ctx.target === "openapi-3.0") {
-      json4.enum = [val];
+      json6.enum = [val];
     } else {
-      json4.const = val;
+      json6.const = val;
     }
   } else {
     if (vals.every((v) => typeof v === "number"))
-      json4.type = "number";
+      json6.type = "number";
     if (vals.every((v) => typeof v === "string"))
-      json4.type = "string";
+      json6.type = "string";
     if (vals.every((v) => typeof v === "boolean"))
-      json4.type = "boolean";
+      json6.type = "boolean";
     if (vals.every((v) => v === null))
-      json4.type = "null";
-    json4.enum = vals;
+      json6.type = "null";
+    json6.enum = vals;
   }
 };
 var nanProcessor = (_schema, ctx, _json, _params) => {
@@ -19934,16 +20655,16 @@ var nanProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("NaN cannot be represented in JSON Schema");
   }
 };
-var templateLiteralProcessor = (schema, _ctx, json4, _params) => {
-  const _json = json4;
+var templateLiteralProcessor = (schema, _ctx, json6, _params) => {
+  const _json = json6;
   const pattern = schema._zod.pattern;
   if (!pattern)
     throw new Error("Pattern not found in template literal");
   _json.type = "string";
   _json.pattern = pattern.source;
 };
-var fileProcessor = (schema, _ctx, json4, _params) => {
-  const _json = json4;
+var fileProcessor = (schema, _ctx, json6, _params) => {
+  const _json = json6;
   const file = {
     type: "string",
     format: "binary",
@@ -19966,8 +20687,8 @@ var fileProcessor = (schema, _ctx, json4, _params) => {
     Object.assign(_json, file);
   }
 };
-var successProcessor = (_schema, _ctx, json4, _params) => {
-  json4.type = "boolean";
+var successProcessor = (_schema, _ctx, json6, _params) => {
+  json6.type = "boolean";
 };
 var customProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
@@ -19995,27 +20716,27 @@ var setProcessor = (_schema, ctx, _json, _params) => {
   }
 };
 var arrayProcessor = (schema, ctx, _json, params) => {
-  const json4 = _json;
+  const json6 = _json;
   const def = schema._zod.def;
   const { minimum, maximum } = schema._zod.bag;
   if (typeof minimum === "number")
-    json4.minItems = minimum;
+    json6.minItems = minimum;
   if (typeof maximum === "number")
-    json4.maxItems = maximum;
-  json4.type = "array";
-  json4.items = process2(def.element, ctx, {
+    json6.maxItems = maximum;
+  json6.type = "array";
+  json6.items = process2(def.element, ctx, {
     ...params,
     path: [...params.path, "items"]
   });
 };
 var objectProcessor = (schema, ctx, _json, params) => {
-  const json4 = _json;
+  const json6 = _json;
   const def = schema._zod.def;
-  json4.type = "object";
-  json4.properties = {};
+  json6.type = "object";
+  json6.properties = {};
   const shape = def.shape;
   for (const key in shape) {
-    json4.properties[key] = process2(shape[key], ctx, {
+    json6.properties[key] = process2(shape[key], ctx, {
       ...params,
       path: [...params.path, "properties", key]
     });
@@ -20030,21 +20751,21 @@ var objectProcessor = (schema, ctx, _json, params) => {
     }
   }));
   if (requiredKeys.size > 0) {
-    json4.required = Array.from(requiredKeys);
+    json6.required = Array.from(requiredKeys);
   }
   if (def.catchall?._zod.def.type === "never") {
-    json4.additionalProperties = false;
+    json6.additionalProperties = false;
   } else if (!def.catchall) {
     if (ctx.io === "output")
-      json4.additionalProperties = false;
+      json6.additionalProperties = false;
   } else if (def.catchall) {
-    json4.additionalProperties = process2(def.catchall, ctx, {
+    json6.additionalProperties = process2(def.catchall, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
   }
 };
-var unionProcessor = (schema, ctx, json4, params) => {
+var unionProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   const isExclusive = def.inclusive === false;
   const options = def.options.map((x, i) => process2(x, ctx, {
@@ -20052,12 +20773,12 @@ var unionProcessor = (schema, ctx, json4, params) => {
     path: [...params.path, isExclusive ? "oneOf" : "anyOf", i]
   }));
   if (isExclusive) {
-    json4.oneOf = options;
+    json6.oneOf = options;
   } else {
-    json4.anyOf = options;
+    json6.anyOf = options;
   }
 };
-var intersectionProcessor = (schema, ctx, json4, params) => {
+var intersectionProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   const a = process2(def.left, ctx, {
     ...params,
@@ -20072,12 +20793,12 @@ var intersectionProcessor = (schema, ctx, json4, params) => {
     ...isSimpleIntersection(a) ? a.allOf : [a],
     ...isSimpleIntersection(b) ? b.allOf : [b]
   ];
-  json4.allOf = allOf;
+  json6.allOf = allOf;
 };
 var tupleProcessor = (schema, ctx, _json, params) => {
-  const json4 = _json;
+  const json6 = _json;
   const def = schema._zod.def;
-  json4.type = "array";
+  json6.type = "array";
   const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
   const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
   const prefixItems = def.items.map((x, i) => process2(x, ctx, {
@@ -20089,37 +20810,37 @@ var tupleProcessor = (schema, ctx, _json, params) => {
     path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
   }) : null;
   if (ctx.target === "draft-2020-12") {
-    json4.prefixItems = prefixItems;
+    json6.prefixItems = prefixItems;
     if (rest) {
-      json4.items = rest;
+      json6.items = rest;
     }
   } else if (ctx.target === "openapi-3.0") {
-    json4.items = {
+    json6.items = {
       anyOf: prefixItems
     };
     if (rest) {
-      json4.items.anyOf.push(rest);
+      json6.items.anyOf.push(rest);
     }
-    json4.minItems = prefixItems.length;
+    json6.minItems = prefixItems.length;
     if (!rest) {
-      json4.maxItems = prefixItems.length;
+      json6.maxItems = prefixItems.length;
     }
   } else {
-    json4.items = prefixItems;
+    json6.items = prefixItems;
     if (rest) {
-      json4.additionalItems = rest;
+      json6.additionalItems = rest;
     }
   }
   const { minimum, maximum } = schema._zod.bag;
   if (typeof minimum === "number")
-    json4.minItems = minimum;
+    json6.minItems = minimum;
   if (typeof maximum === "number")
-    json4.maxItems = maximum;
+    json6.maxItems = maximum;
 };
 var recordProcessor = (schema, ctx, _json, params) => {
-  const json4 = _json;
+  const json6 = _json;
   const def = schema._zod.def;
-  json4.type = "object";
+  json6.type = "object";
   const keyType = def.keyType;
   const keyBag = keyType._zod.bag;
   const patterns = keyBag?.patterns;
@@ -20128,18 +20849,18 @@ var recordProcessor = (schema, ctx, _json, params) => {
       ...params,
       path: [...params.path, "patternProperties", "*"]
     });
-    json4.patternProperties = {};
+    json6.patternProperties = {};
     for (const pattern of patterns) {
-      json4.patternProperties[pattern.source] = valueSchema;
+      json6.patternProperties[pattern.source] = valueSchema;
     }
   } else {
     if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
-      json4.propertyNames = process2(def.keyType, ctx, {
+      json6.propertyNames = process2(def.keyType, ctx, {
         ...params,
         path: [...params.path, "propertyNames"]
       });
     }
-    json4.additionalProperties = process2(def.valueType, ctx, {
+    json6.additionalProperties = process2(def.valueType, ctx, {
       ...params,
       path: [...params.path, "additionalProperties"]
     });
@@ -20148,19 +20869,19 @@ var recordProcessor = (schema, ctx, _json, params) => {
   if (keyValues) {
     const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
     if (validKeyValues.length > 0) {
-      json4.required = validKeyValues;
+      json6.required = validKeyValues;
     }
   }
 };
-var nullableProcessor = (schema, ctx, json4, params) => {
+var nullableProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   const inner = process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   if (ctx.target === "openapi-3.0") {
     seen.ref = def.innerType;
-    json4.nullable = true;
+    json6.nullable = true;
   } else {
-    json4.anyOf = [inner, { type: "null" }];
+    json6.anyOf = [inner, { type: "null" }];
   }
 };
 var nonoptionalProcessor = (schema, ctx, _json, params) => {
@@ -20169,22 +20890,22 @@ var nonoptionalProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
 };
-var defaultProcessor = (schema, ctx, json4, params) => {
+var defaultProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
-  json4.default = JSON.parse(JSON.stringify(def.defaultValue));
+  json6.default = JSON.parse(JSON.stringify(def.defaultValue));
 };
-var prefaultProcessor = (schema, ctx, json4, params) => {
+var prefaultProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
   if (ctx.io === "input")
-    json4._prefault = JSON.parse(JSON.stringify(def.defaultValue));
+    json6._prefault = JSON.parse(JSON.stringify(def.defaultValue));
 };
-var catchProcessor = (schema, ctx, json4, params) => {
+var catchProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
@@ -20195,7 +20916,7 @@ var catchProcessor = (schema, ctx, json4, params) => {
   } catch {
     throw new Error("Dynamic catch values are not supported in JSON Schema");
   }
-  json4.default = catchValue;
+  json6.default = catchValue;
 };
 var pipeProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
@@ -20205,12 +20926,12 @@ var pipeProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
-var readonlyProcessor = (schema, ctx, json4, params) => {
+var readonlyProcessor = (schema, ctx, json6, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
   const seen = ctx.seen.get(schema);
   seen.ref = def.innerType;
-  json4.readOnly = true;
+  json6.readOnly = true;
 };
 var promiseProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
@@ -20480,7 +21201,7 @@ __export(exports_schemas2, {
   invertCodec: () => invertCodec,
   ipv4: () => ipv42,
   ipv6: () => ipv62,
-  json: () => json4,
+  json: () => json6,
   jwt: () => jwt,
   keyof: () => keyof,
   ksuid: () => ksuid2,
@@ -20831,7 +21552,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
 var _ZodString = /* @__PURE__ */ $constructor("_ZodString", (inst, def) => {
   $ZodString.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => stringProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => stringProcessor(inst, ctx, json6, params);
   const bag = inst._zod.bag;
   inst.format = bag.format ?? null;
   inst.minLength = bag.minimum ?? null;
@@ -21102,7 +21823,7 @@ function hash2(alg, params) {
 var ZodNumber = /* @__PURE__ */ $constructor("ZodNumber", (inst, def) => {
   $ZodNumber.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => numberProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => numberProcessor(inst, ctx, json6, params);
   _installLazyMethods(inst, "ZodNumber", {
     gt(value, params) {
       return this.check(_gt(value, params));
@@ -21182,7 +21903,7 @@ function uint32(params) {
 var ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
   $ZodBoolean.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => booleanProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => booleanProcessor(inst, ctx, json6, params);
 });
 function boolean2(params) {
   return _boolean(ZodBoolean, params);
@@ -21190,7 +21911,7 @@ function boolean2(params) {
 var ZodBigInt = /* @__PURE__ */ $constructor("ZodBigInt", (inst, def) => {
   $ZodBigInt.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => bigintProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => bigintProcessor(inst, ctx, json6, params);
   inst.gte = (value, params) => inst.check(_gte(value, params));
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.gt = (value, params) => inst.check(_gt(value, params));
@@ -21225,7 +21946,7 @@ function uint64(params) {
 var ZodSymbol = /* @__PURE__ */ $constructor("ZodSymbol", (inst, def) => {
   $ZodSymbol.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => symbolProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => symbolProcessor(inst, ctx, json6, params);
 });
 function symbol(params) {
   return _symbol(ZodSymbol, params);
@@ -21233,7 +21954,7 @@ function symbol(params) {
 var ZodUndefined = /* @__PURE__ */ $constructor("ZodUndefined", (inst, def) => {
   $ZodUndefined.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => undefinedProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => undefinedProcessor(inst, ctx, json6, params);
 });
 function _undefined3(params) {
   return _undefined2(ZodUndefined, params);
@@ -21241,7 +21962,7 @@ function _undefined3(params) {
 var ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
   $ZodNull.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => nullProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => nullProcessor(inst, ctx, json6, params);
 });
 function _null3(params) {
   return _null2(ZodNull, params);
@@ -21249,7 +21970,7 @@ function _null3(params) {
 var ZodAny = /* @__PURE__ */ $constructor("ZodAny", (inst, def) => {
   $ZodAny.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => anyProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => anyProcessor(inst, ctx, json6, params);
 });
 function any() {
   return _any(ZodAny);
@@ -21257,7 +21978,7 @@ function any() {
 var ZodUnknown = /* @__PURE__ */ $constructor("ZodUnknown", (inst, def) => {
   $ZodUnknown.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => unknownProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => unknownProcessor(inst, ctx, json6, params);
 });
 function unknown() {
   return _unknown(ZodUnknown);
@@ -21265,7 +21986,7 @@ function unknown() {
 var ZodNever = /* @__PURE__ */ $constructor("ZodNever", (inst, def) => {
   $ZodNever.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => neverProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => neverProcessor(inst, ctx, json6, params);
 });
 function never(params) {
   return _never(ZodNever, params);
@@ -21273,7 +21994,7 @@ function never(params) {
 var ZodVoid = /* @__PURE__ */ $constructor("ZodVoid", (inst, def) => {
   $ZodVoid.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => voidProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => voidProcessor(inst, ctx, json6, params);
 });
 function _void2(params) {
   return _void(ZodVoid, params);
@@ -21281,7 +22002,7 @@ function _void2(params) {
 var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   $ZodDate.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => dateProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => dateProcessor(inst, ctx, json6, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
   const c = inst._zod.bag;
@@ -21294,7 +22015,7 @@ function date3(params) {
 var ZodArray = /* @__PURE__ */ $constructor("ZodArray", (inst, def) => {
   $ZodArray.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => arrayProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => arrayProcessor(inst, ctx, json6, params);
   inst.element = def.element;
   _installLazyMethods(inst, "ZodArray", {
     min(n, params) {
@@ -21324,7 +22045,7 @@ function keyof(schema) {
 var ZodObject = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
   $ZodObjectJIT.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => objectProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => objectProcessor(inst, ctx, json6, params);
   exports_util.defineLazy(inst, "shape", () => {
     return def.shape;
   });
@@ -21397,7 +22118,7 @@ function looseObject(shape, params) {
 var ZodUnion = /* @__PURE__ */ $constructor("ZodUnion", (inst, def) => {
   $ZodUnion.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => unionProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => unionProcessor(inst, ctx, json6, params);
   inst.options = def.options;
 });
 function union(options, params) {
@@ -21410,7 +22131,7 @@ function union(options, params) {
 var ZodXor = /* @__PURE__ */ $constructor("ZodXor", (inst, def) => {
   ZodUnion.init(inst, def);
   $ZodXor.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => unionProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => unionProcessor(inst, ctx, json6, params);
   inst.options = def.options;
 });
 function xor(options, params) {
@@ -21436,7 +22157,7 @@ function discriminatedUnion(discriminator, options, params) {
 var ZodIntersection = /* @__PURE__ */ $constructor("ZodIntersection", (inst, def) => {
   $ZodIntersection.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => intersectionProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => intersectionProcessor(inst, ctx, json6, params);
 });
 function intersection(left, right) {
   return new ZodIntersection({
@@ -21448,7 +22169,7 @@ function intersection(left, right) {
 var ZodTuple = /* @__PURE__ */ $constructor("ZodTuple", (inst, def) => {
   $ZodTuple.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => tupleProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => tupleProcessor(inst, ctx, json6, params);
   inst.rest = (rest) => inst.clone({
     ...inst._zod.def,
     rest
@@ -21468,7 +22189,7 @@ function tuple(items, _paramsOrRest, _params) {
 var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
   $ZodRecord.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => recordProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => recordProcessor(inst, ctx, json6, params);
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
 });
@@ -21510,7 +22231,7 @@ function looseRecord(keyType, valueType, params) {
 var ZodMap = /* @__PURE__ */ $constructor("ZodMap", (inst, def) => {
   $ZodMap.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => mapProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => mapProcessor(inst, ctx, json6, params);
   inst.keyType = def.keyType;
   inst.valueType = def.valueType;
   inst.min = (...args) => inst.check(_minSize(...args));
@@ -21529,7 +22250,7 @@ function map(keyType, valueType, params) {
 var ZodSet = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
   $ZodSet.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => setProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => setProcessor(inst, ctx, json6, params);
   inst.min = (...args) => inst.check(_minSize(...args));
   inst.nonempty = (params) => inst.check(_minSize(1, params));
   inst.max = (...args) => inst.check(_maxSize(...args));
@@ -21545,7 +22266,7 @@ function set(valueType, params) {
 var ZodEnum = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
   $ZodEnum.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => enumProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => enumProcessor(inst, ctx, json6, params);
   inst.enum = def.entries;
   inst.options = Object.values(def.entries);
   const keys = new Set(Object.keys(def.entries));
@@ -21598,7 +22319,7 @@ function nativeEnum(entries, params) {
 var ZodLiteral = /* @__PURE__ */ $constructor("ZodLiteral", (inst, def) => {
   $ZodLiteral.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => literalProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => literalProcessor(inst, ctx, json6, params);
   inst.values = new Set(def.values);
   Object.defineProperty(inst, "value", {
     get() {
@@ -21619,7 +22340,7 @@ function literal(value, params) {
 var ZodFile = /* @__PURE__ */ $constructor("ZodFile", (inst, def) => {
   $ZodFile.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => fileProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => fileProcessor(inst, ctx, json6, params);
   inst.min = (size, params) => inst.check(_minSize(size, params));
   inst.max = (size, params) => inst.check(_maxSize(size, params));
   inst.mime = (types2, params) => inst.check(_mime(Array.isArray(types2) ? types2 : [types2], params));
@@ -21630,7 +22351,7 @@ function file(params) {
 var ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
   $ZodTransform.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => transformProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => transformProcessor(inst, ctx, json6, params);
   inst._zod.parse = (payload, _ctx) => {
     if (_ctx.direction === "backward") {
       throw new $ZodEncodeError(inst.constructor.name);
@@ -21670,7 +22391,7 @@ function transform(fn) {
 var ZodOptional = /* @__PURE__ */ $constructor("ZodOptional", (inst, def) => {
   $ZodOptional.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => optionalProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => optionalProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function optional(innerType) {
@@ -21682,7 +22403,7 @@ function optional(innerType) {
 var ZodExactOptional = /* @__PURE__ */ $constructor("ZodExactOptional", (inst, def) => {
   $ZodExactOptional.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => optionalProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => optionalProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function exactOptional(innerType) {
@@ -21694,7 +22415,7 @@ function exactOptional(innerType) {
 var ZodNullable = /* @__PURE__ */ $constructor("ZodNullable", (inst, def) => {
   $ZodNullable.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => nullableProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => nullableProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function nullable(innerType) {
@@ -21709,7 +22430,7 @@ function nullish2(innerType) {
 var ZodDefault = /* @__PURE__ */ $constructor("ZodDefault", (inst, def) => {
   $ZodDefault.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => defaultProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => defaultProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
   inst.removeDefault = inst.unwrap;
 });
@@ -21725,7 +22446,7 @@ function _default2(innerType, defaultValue) {
 var ZodPrefault = /* @__PURE__ */ $constructor("ZodPrefault", (inst, def) => {
   $ZodPrefault.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => prefaultProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => prefaultProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function prefault(innerType, defaultValue) {
@@ -21740,7 +22461,7 @@ function prefault(innerType, defaultValue) {
 var ZodNonOptional = /* @__PURE__ */ $constructor("ZodNonOptional", (inst, def) => {
   $ZodNonOptional.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => nonoptionalProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => nonoptionalProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function nonoptional(innerType, params) {
@@ -21753,7 +22474,7 @@ function nonoptional(innerType, params) {
 var ZodSuccess = /* @__PURE__ */ $constructor("ZodSuccess", (inst, def) => {
   $ZodSuccess.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => successProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => successProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function success(innerType) {
@@ -21765,7 +22486,7 @@ function success(innerType) {
 var ZodCatch = /* @__PURE__ */ $constructor("ZodCatch", (inst, def) => {
   $ZodCatch.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => catchProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => catchProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
   inst.removeCatch = inst.unwrap;
 });
@@ -21779,7 +22500,7 @@ function _catch2(innerType, catchValue) {
 var ZodNaN = /* @__PURE__ */ $constructor("ZodNaN", (inst, def) => {
   $ZodNaN.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => nanProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => nanProcessor(inst, ctx, json6, params);
 });
 function nan(params) {
   return _nan(ZodNaN, params);
@@ -21787,7 +22508,7 @@ function nan(params) {
 var ZodPipe = /* @__PURE__ */ $constructor("ZodPipe", (inst, def) => {
   $ZodPipe.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => pipeProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => pipeProcessor(inst, ctx, json6, params);
   inst.in = def.in;
   inst.out = def.out;
 });
@@ -21828,7 +22549,7 @@ var ZodPreprocess = /* @__PURE__ */ $constructor("ZodPreprocess", (inst, def) =>
 var ZodReadonly = /* @__PURE__ */ $constructor("ZodReadonly", (inst, def) => {
   $ZodReadonly.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => readonlyProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => readonlyProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function readonly(innerType) {
@@ -21840,7 +22561,7 @@ function readonly(innerType) {
 var ZodTemplateLiteral = /* @__PURE__ */ $constructor("ZodTemplateLiteral", (inst, def) => {
   $ZodTemplateLiteral.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => templateLiteralProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => templateLiteralProcessor(inst, ctx, json6, params);
 });
 function templateLiteral(parts, params) {
   return new ZodTemplateLiteral({
@@ -21852,7 +22573,7 @@ function templateLiteral(parts, params) {
 var ZodLazy = /* @__PURE__ */ $constructor("ZodLazy", (inst, def) => {
   $ZodLazy.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => lazyProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => lazyProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.getter();
 });
 function lazy(getter) {
@@ -21864,7 +22585,7 @@ function lazy(getter) {
 var ZodPromise = /* @__PURE__ */ $constructor("ZodPromise", (inst, def) => {
   $ZodPromise.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => promiseProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => promiseProcessor(inst, ctx, json6, params);
   inst.unwrap = () => inst._zod.def.innerType;
 });
 function promise(innerType) {
@@ -21876,7 +22597,7 @@ function promise(innerType) {
 var ZodFunction = /* @__PURE__ */ $constructor("ZodFunction", (inst, def) => {
   $ZodFunction.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => functionProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => functionProcessor(inst, ctx, json6, params);
 });
 function _function(params) {
   return new ZodFunction({
@@ -21888,7 +22609,7 @@ function _function(params) {
 var ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
   $ZodCustom.init(inst, def);
   ZodType.init(inst, def);
-  inst._zod.processJSONSchema = (ctx, json4, params) => customProcessor(inst, ctx, json4, params);
+  inst._zod.processJSONSchema = (ctx, json6, params) => customProcessor(inst, ctx, json6, params);
 });
 function check(fn) {
   const ch = new $ZodCheck({
@@ -21935,7 +22656,7 @@ var stringbool = (...args) => _stringbool({
   Boolean: ZodBoolean,
   String: ZodString
 }, ...args);
-function json4(params) {
+function json6(params) {
   const jsonSchema = lazy(() => {
     return union([string2(params), number2(), boolean2(), _null3(), array(jsonSchema), record(string2(), jsonSchema)]);
   });
@@ -22475,7 +23196,15 @@ function parseOrThrow(schema, body2) {
   const path = issue2?.path.join(".") ?? "(root)";
   throw new GatewayError("BAD_REQUEST", `${path}: ${issue2?.message ?? "invalid request"}`);
 }
-var providerIdSchema = exports_external.enum(["anthropic", "openai", "kimi", "custom"]);
+function optionalNumber(value, fallback) {
+  if (value === undefined)
+    return fallback;
+  if (typeof value === "string" && value.trim().length === 0)
+    return fallback;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+var providerIdSchema = exports_external.enum(["anthropic", "openai", "kimi", "kilo", "grok", "custom"]);
 var dryRunSchema = exports_external.object({
   tools: exports_external.boolean().default(false),
   images: exports_external.boolean().default(false),
@@ -22483,7 +23212,7 @@ var dryRunSchema = exports_external.object({
 }).strict();
 var targetSchema = exports_external.discriminatedUnion("provider", [
   exports_external.object({
-    provider: exports_external.enum(["anthropic", "openai", "kimi"]),
+    provider: exports_external.enum(["anthropic", "openai", "kimi", "kilo", "grok"]),
     model: exports_external.string().min(1),
     tier: exports_external.number().int().min(1),
     weight: exports_external.number().positive(),
@@ -22580,124 +23309,57 @@ function requireDimension(grain, dimension) {
   throw new GatewayError("BAD_REQUEST", `usage grain "${grain}" cannot group by "${dimension}"`);
 }
 
-// packages/control/src/credentials.ts
-function summarizeCredential(credential) {
-  return {
-    id: credential.id,
-    provider: credential.provider,
-    label: credential.label,
-    authType: credential.authType,
-    enabled: credential.enabled,
-    tier: credential.tier,
-    weight: credential.weight,
-    expiresAt: credential.expiresAt,
-    accountEmail: credential.accountEmail,
-    providerData: credential.providerData,
-    disabledReason: credential.disabledReason,
-    disabledAt: credential.disabledAt,
-    hasRefreshToken: credential.hasRefreshToken,
-    createdAt: credential.createdAt,
-    updatedAt: credential.updatedAt
-  };
-}
-async function listCredentials(store) {
-  return (await store.credentials.list()).map(summarizeCredential);
-}
-function requiredString(value, field) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new GatewayError("BAD_REQUEST", `${field}: must not be empty`);
-  }
-  return value.trim();
+// packages/control/src/console.ts
+var UNIT_NAME = "omnigateway.service";
+var MAX_CONSOLE_LINES = 500;
+var DEFAULT_CONSOLE_LINES = 200;
+function resolveConsoleSource(input) {
+  const path = input.logFile?.trim();
+  if (path !== undefined && path.length > 0)
+    return { kind: "file", path };
+  if (input.unitInstalled)
+    return { kind: "journal", unit: UNIT_NAME, scope: input.scope };
+  return { kind: "none" };
 }
-function customProviderData(input) {
-  const endpointId = requiredString(input.endpointId, "endpointId");
-  const endpointLabel = requiredString(input.endpointLabel, "endpointLabel");
-  const originInput = requiredString(input.origin, "origin");
-  if (input.protocol !== "chat_completions" && input.protocol !== "responses") {
-    throw new GatewayError("BAD_REQUEST", "protocol: unsupported protocol");
-  }
-  let url2;
-  try {
-    url2 = new URL(originInput);
-  } catch {
-    throw new GatewayError("BAD_REQUEST", "origin: must be a valid URL");
-  }
-  if (url2.protocol !== "http:" && url2.protocol !== "https:" || url2.hostname.length === 0 || url2.username.length > 0 || url2.password.length > 0 || url2.pathname !== "" && url2.pathname !== "/" || url2.search.length > 0 || url2.hash.length > 0) {
-    throw new GatewayError("BAD_REQUEST", "origin: must be an HTTP(S) server origin");
-  }
-  return { endpointId, endpointLabel, origin: url2.origin, protocol: input.protocol };
+function consoleLimit(requested) {
+  const value = optionalNumber(requested, DEFAULT_CONSOLE_LINES);
+  return Math.floor(Math.min(Math.max(1, value), MAX_CONSOLE_LINES));
 }
-function sameCustomEndpoint(a, b) {
-  return a.endpointId === b.endpointId && a.endpointLabel === b.endpointLabel && a.origin === b.origin && a.protocol === b.protocol;
+function keep(line, query) {
+  if (query.since !== undefined && (line.at === null || line.at <= query.since))
+    return false;
+  if (query.level === undefined || line.level === null)
+    return true;
+  return LEVELS[line.level] >= LEVELS[query.level];
 }
-async function createApiKeyCredential(store, input, logger2 = noopLogger) {
-  const provider = parseOrThrow(providerIdSchema, input.provider);
-  const apiKey = requiredString(input.apiKey, "apiKey");
-  if (input.label !== undefined && typeof input.label !== "string") {
-    throw new GatewayError("BAD_REQUEST", "label: must be a string");
-  }
-  let providerData = {};
-  if (provider === "custom") {
-    const custom2 = customProviderData(input);
-    const existing = (await store.credentials.list()).filter((credential) => credential.provider === "custom" && credential.providerData.endpointId === custom2.endpointId);
-    if (existing.some((credential) => !sameCustomEndpoint(credential.providerData, custom2))) {
-      throw new GatewayError("CONFLICT", `endpointId: metadata conflicts with existing endpoint`);
-    }
-    providerData = custom2;
-  }
-  const label = input.label?.trim() || `${provider} api key`;
-  const created = await store.credentials.create({
-    id: crypto.randomUUID(),
-    provider,
-    label,
-    authType: "apiKey",
-    enabled: true,
-    tier: 1,
-    weight: 1,
-    expiresAt: null,
-    accountEmail: null,
-    providerData,
-    disabledReason: null,
-    disabledAt: null,
-    accessToken: null,
-    refreshToken: null,
-    apiKey,
-    idToken: null
-  });
-  logger2.info("credential added", { credentialId: created.id, provider: created.provider });
-  return summarizeCredential(created);
+var SCAN_FACTOR = 20;
+var SCAN_LIMIT = 5000;
+function scanWidth(query) {
+  const filtered = query.level !== undefined || query.since !== undefined;
+  return filtered ? Math.min(query.lines * SCAN_FACTOR, SCAN_LIMIT) : query.lines;
 }
-async function credentialHealth(store) {
-  const [health, quota] = await Promise.all([
-    store.credentials.listHealth(),
-    store.credentials.listQuota()
+async function readSource(deps, source, lines) {
+  if (source.kind === "none")
+    return "";
+  if (source.kind === "file")
+    return deps.readFile(source.path, lines) ?? "";
+  const unit = source.scope === "system" ? ["-u", source.unit] : [`--user-unit=${source.unit}`];
+  const result = await deps.run([
+    "journalctl",
+    ...unit,
+    "-n",
+    String(lines),
+    "--no-pager",
+    "--output=cat"
   ]);
-  return { health, quota };
-}
-async function patchCredential(deps, id, input) {
-  const patch = parseOrThrow(credentialPatchSchema, input);
-  const existing = await deps.store.credentials.get(id);
-  if (existing === null)
-    throw new GatewayError("BAD_REQUEST", "no such credential");
-  await deps.store.credentials.update(id, {
-    ...patch.label === undefined ? {} : { label: patch.label },
-    ...patch.enabled === undefined ? {} : {
-      enabled: patch.enabled,
-      disabledReason: patch.enabled ? null : "manual",
-      disabledAt: patch.enabled ? null : deps.now()
-    },
-    ...patch.tier === undefined ? {} : { tier: patch.tier },
-    ...patch.weight === undefined ? {} : { weight: patch.weight }
-  });
-  if (patch.enabled !== undefined && patch.enabled !== existing.enabled) {
-    (deps.logger ?? noopLogger).info(patch.enabled ? "credential enabled" : "credential disabled", {
-      credentialId: id,
-      provider: existing.provider
-    });
-  }
+  return result.code === 0 ? result.stdout : "";
 }
-async function removeCredential(store, id) {
-  await store.credentials.remove(id);
+async function readConsole(deps, source, query) {
+  const limited = { ...query, lines: consoleLimit(query.lines) };
+  const text = await readSource(deps, source, scanWidth(limited));
+  const lines = text.split(`
+`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
+  return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
 }
 // packages/router/src/snapshot.ts
 var HEALTH_KEY_SEP = "::";
@@ -22804,12 +23466,37 @@ function eligible(input) {
   return { pairs, excluded };
 }
 
-// packages/router/src/quota.ts
+// packages/store/src/types.ts
 var WINDOW_DURATION_MS = {
   fiveHour: 5 * 60 * 60 * 1000,
   daily: 24 * 60 * 60 * 1000,
   weekly: 7 * 24 * 60 * 60 * 1000
 };
+function durationFor(windowType, windowMs) {
+  return windowMs !== null && windowMs > 0 ? windowMs : WINDOW_DURATION_MS[windowType];
+}
+var SAME_WINDOW_TOLERANCE_MS = 60000;
+function sameWindow(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return Math.abs(a - b) <= SAME_WINDOW_TOLERANCE_MS;
+}
+var READ_OVER_INPUT = 0.1;
+function cacheReadRate(prices) {
+  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+}
+var DEFAULT_SETTINGS = {
+  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
+  maxAttempts: 3,
+  requestDeadlineMs: 120000,
+  breakerThreshold: 3,
+  breakerCooldownMs: 30000,
+  logRetentionDays: 30,
+  quotaPollIntervalMs: 300000,
+  rtkEnabled: false
+};
+
+// packages/router/src/quota.ts
 var UNKNOWN_QUOTA = 0.5;
 var QUOTA_FLOOR = 0.1;
 function quotaStaleAfterMs(pollIntervalMs) {
@@ -22822,7 +23509,7 @@ function paceAdjusted(window2, now) {
   const headroom = Math.max(0, Math.min(1, 1 - window2.used / limit));
   if (window2.resetsAt === null)
     return headroom;
-  const duration3 = WINDOW_DURATION_MS[window2.windowType];
+  const duration3 = durationFor(window2.windowType, window2.windowMs);
   const remaining = Math.max(0.05, Math.min(1, (window2.resetsAt - now) / duration3));
   return Math.max(0, Math.min(1, headroom / remaining));
 }
@@ -22835,22 +23522,6 @@ function quotaHeadroom(credential, windows, now, pollIntervalMs) {
   return Math.min(...usable.map((w) => paceAdjusted(w, now)));
 }
 
-// packages/store/src/types.ts
-var READ_OVER_INPUT = 0.1;
-function cacheReadRate(prices) {
-  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
-}
-var DEFAULT_SETTINGS = {
-  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
-  maxAttempts: 3,
-  requestDeadlineMs: 120000,
-  breakerThreshold: 3,
-  breakerCooldownMs: 30000,
-  logRetentionDays: 30,
-  quotaPollIntervalMs: 300000,
-  rtkEnabled: false
-};
-
 // packages/router/src/score.ts
 var UNKNOWN = 0.5;
 function lowerIsBetter(value, min, max) {
@@ -22984,7 +23655,8 @@ var PREFIX_PROVIDER = [
   ["o3", "openai"],
   ["o4", "openai"],
   ["kimi-", "kimi"],
-  ["moonshot", "kimi"]
+  ["moonshot", "kimi"],
+  ["grok-", "grok"]
 ];
 function synthesize(provider, model) {
   const listed = catalogPricing(provider, model);
@@ -23075,49 +23747,6 @@ function rank(input) {
   return { candidates: scored, excluded };
 }
 
-// packages/control/src/dryRun.ts
-async function dryRun(deps, modelId, input) {
-  const need = parseOrThrow(dryRunSchema, input);
-  const now = deps.now();
-  const snapshot = await buildSnapshot(deps.store, now);
-  const model = snapshot.models.get(modelId);
-  if (model === undefined) {
-    throw new GatewayError("MODEL_UNAVAILABLE", `no virtual model "${modelId}"`);
-  }
-  const probe = {
-    model: modelId,
-    messages: [
-      {
-        role: "user",
-        content: need.images ? [{ type: "image", mediaType: "image/png", data: "" }] : [{ type: "text", text: "" }]
-      }
-    ],
-    stream: false,
-    ...need.tools ? {
-      tools: [
-        { provider: "custom", name: "probe", description: "", inputSchema: { type: "object" } }
-      ]
-    } : {},
-    ...need.reasoning ? { reasoning: { mode: "adaptive" } } : {}
-  };
-  const result = rank({ request: probe, model, snapshot, now, rand: 0, load: new Map });
-  return {
-    modelId: model.id,
-    strategy: model.strategy,
-    deterministic: model.strategy !== "weighted",
-    rankedAt: now,
-    candidates: result.candidates.map((candidate) => ({
-      credentialId: candidate.credential.id,
-      credentialLabel: candidate.credential.label,
-      provider: candidate.credential.provider,
-      model: candidate.target.model,
-      tier: candidate.target.tier,
-      score: candidate.score,
-      reasons: candidate.reasons
-    })),
-    excluded: result.excluded
-  };
-}
 // packages/store/src/encryption.ts
 var PREFIX = "enc:v1";
 var IV_BYTES = 12;
@@ -23454,20 +24083,36 @@ function createCredentialRepo(db, key, emit = () => {}) {
         used: r.used,
         limit: r.limit_value,
         resetsAt: r.resets_at,
-        observedAt: r.observed_at
+        observedAt: r.observed_at,
+        windowMs: r.window_ms
       }));
     },
     async saveQuota(rows) {
       const stmt = db.prepare(`INSERT INTO quota_windows
-           (credential_id, window_type, starts_at, used, limit_value, resets_at, observed_at)
-         VALUES (?,?,?,?,?,?,?)
+           (credential_id, window_type, starts_at, used, limit_value, resets_at, observed_at,
+            window_ms)
+         VALUES (?,?,?,?,?,?,?,?)
          ON CONFLICT (credential_id, window_type) DO UPDATE SET
            starts_at = excluded.starts_at,
            used = excluded.used,
            limit_value = excluded.limit_value,
            resets_at = excluded.resets_at,
-           observed_at = excluded.observed_at`);
+           observed_at = excluded.observed_at,
+           window_ms = excluded.window_ms`);
       const prune = db.prepare("DELETE FROM quota_windows WHERE credential_id = ? AND window_type NOT IN (SELECT value FROM json_each(?))");
+      const newestSample = db.prepare(`SELECT used, limit_value, resets_at, window_ms
+           FROM quota_samples
+          WHERE credential_id = ? AND window_type = ?
+          ORDER BY observed_at DESC
+          LIMIT 1`);
+      const appendSample = db.prepare(`INSERT INTO quota_samples
+           (credential_id, window_type, observed_at, used, limit_value, resets_at, window_ms)
+         VALUES (?,?,?,?,?,?,?)
+         ON CONFLICT (credential_id, window_type, observed_at) DO UPDATE SET
+           used = excluded.used,
+           limit_value = excluded.limit_value,
+           resets_at = excluded.resets_at,
+           window_ms = excluded.window_ms`);
       const kept = new Map;
       for (const r of rows) {
         const types2 = kept.get(r.credentialId);
@@ -23478,13 +24123,37 @@ function createCredentialRepo(db, key, emit = () => {}) {
       }
       db.transaction(() => {
         for (const r of rows) {
-          stmt.run(r.credentialId, r.windowType, r.startsAt, r.used, r.limit, r.resetsAt, r.observedAt);
+          stmt.run(r.credentialId, r.windowType, r.startsAt, r.used, r.limit, r.resetsAt, r.observedAt, r.windowMs);
+          const previous = newestSample.get(r.credentialId, r.windowType);
+          const unchanged = previous !== null && previous.used === r.used && previous.limit_value === r.limit && sameWindow(previous.resets_at, r.resetsAt) && previous.window_ms === r.windowMs;
+          if (unchanged)
+            continue;
+          appendSample.run(r.credentialId, r.windowType, r.observedAt, r.used, r.limit, r.resetsAt, r.windowMs);
         }
         for (const [credentialId, types2] of kept) {
           prune.run(credentialId, JSON.stringify(types2));
         }
       })();
       emit({ type: "quotaSaved", rows });
+    },
+    async listQuotaSamples(q) {
+      const sql = (extra) => `SELECT * FROM quota_samples
+          WHERE observed_at >= ? AND observed_at <= ?${extra}
+          ORDER BY credential_id, window_type, observed_at`;
+      const rows = q.credentialId === undefined ? db.query(sql("")).all(q.since, q.until) : db.query(sql(" AND credential_id = ?")).all(q.since, q.until, q.credentialId);
+      return rows.map((r) => ({
+        credentialId: r.credential_id,
+        windowType: r.window_type,
+        observedAt: r.observed_at,
+        used: r.used,
+        limit: r.limit_value,
+        resetsAt: r.resets_at,
+        windowMs: r.window_ms
+      }));
+    },
+    async pruneQuotaSamples(olderThan) {
+      db.run("DELETE FROM quota_samples WHERE observed_at < ?", [olderThan]);
+      return db.query("SELECT changes() AS n").get()?.n ?? 0;
     }
   };
 }
@@ -23672,6 +24341,51 @@ var _006_rtk_usage_default = `ALTER TABLE usage_daily ADD COLUMN rtk_saved_token
 ALTER TABLE usage_daily ADD COLUMN rtk_applied_requests INTEGER NOT NULL DEFAULT 0;
 `;
 
+// packages/store/src/sqlite/migrations/007_quota_samples.sql
+var _007_quota_samples_default = `-- Retained provider quota readings, and the duration a window really runs for.
+--
+-- \`quota_windows\` is keyed (credential_id, window_type) and overwritten in
+-- place, so every reading is lost the moment the next probe lands. That is
+-- enough to draw a bar and to price a route against, and not enough to answer
+-- "is this draining faster than usual". This table keeps the readings.
+--
+-- \`observed_at\` is part of the key rather than a plain column: a reading is
+-- identified by which window it describes and when it was taken, and two
+-- readings of the same window at the same instant are the same reading.
+-- WITHOUT ROWID for the same reason as \`usage_daily\` \u2014 the key is the whole
+-- row's identity, so a separate rowid buys nothing and costs a second b-tree.
+--
+-- There is no window-set replacement here as there is for \`quota_windows\`. A
+-- window the provider stopped reporting still happened, and its history stays
+-- readable until it ages out. Rows die two ways: the credential is deleted, or
+-- retention prunes them.
+--
+-- No backfill: there is no history to recover.
+CREATE TABLE quota_samples (
+  credential_id TEXT NOT NULL REFERENCES credentials (id) ON DELETE CASCADE,
+  window_type   TEXT NOT NULL,
+  observed_at   INTEGER NOT NULL,
+  used          INTEGER NOT NULL,
+  limit_value   INTEGER,
+  resets_at     INTEGER,
+  window_ms     INTEGER,
+  PRIMARY KEY (credential_id, window_type, observed_at)
+) WITHOUT ROWID;
+
+-- On \`observed_at\` alone, because pruning sweeps every credential at once and
+-- the primary key already serves a lookup that names one.
+CREATE INDEX quota_samples_observed ON quota_samples (observed_at);
+
+-- How long the window runs for, when the provider states it.
+--
+-- The three window names are buckets: Codex declares \`limit_window_seconds\` and
+-- the nearest of the three names is what gets stored, so a three-hour window is
+-- filed under \`fiveHour\`. Inferring its start from the nominal five hours would
+-- place it about two hours too early. Null means the provider said nothing,
+-- which is the normal state for Anthropic and Kimi.
+ALTER TABLE quota_windows ADD COLUMN window_ms INTEGER;
+`;
+
 // packages/store/src/sqlite/rollup.ts
 function startOfLocalDay(at) {
   const day = new Date(at);
@@ -23816,7 +24530,8 @@ var MIGRATIONS = [
   { id: 3, sql: _003_quota_snapshot_default },
   { id: 4, sql: _004_request_state_default },
   { id: 5, sql: _005_rtk_metrics_default },
-  { id: 6, sql: _006_rtk_usage_default, after: backfillRtkUsage }
+  { id: 6, sql: _006_rtk_usage_default, after: backfillRtkUsage },
+  { id: 7, sql: _007_quota_samples_default }
 ];
 function openDb(path) {
   const db = new Database(path, { create: true });
@@ -24151,6 +24866,214 @@ async function createStore(opts) {
     close: () => db.close()
   };
 }
+// packages/control/src/quota/burn.ts
+var HOUR_MS = 3600000;
+function windowStartOf(window2) {
+  if (window2.resetsAt === null)
+    return null;
+  return window2.resetsAt - durationFor(window2.windowType, window2.windowMs);
+}
+var suppressed = (window2) => ({
+  credentialId: window2.credentialId,
+  windowType: window2.windowType,
+  windowStartsAt: null,
+  ratePerHour: null,
+  exhaustsAt: null,
+  survives: null,
+  stale: true
+});
+function burnFor(window2, input) {
+  if (window2.observedAt <= 0)
+    return suppressed(window2);
+  if (input.now - window2.observedAt > quotaStaleAfterMs(input.pollIntervalMs)) {
+    return suppressed(window2);
+  }
+  const windowStartsAt = windowStartOf(window2);
+  const elapsedMs = windowStartsAt === null ? null : window2.observedAt - windowStartsAt;
+  const elapsedHours = elapsedMs === null ? null : elapsedMs / HOUR_MS;
+  const ratePerHour = elapsedHours === null ? null : elapsedHours <= 0 || window2.used === 0 ? 0 : window2.used / elapsedHours;
+  const exhaustsAt = window2.limit === null || ratePerHour === null || ratePerHour <= 0 ? null : window2.observedAt + Math.max(0, window2.limit - window2.used) / ratePerHour * HOUR_MS;
+  return {
+    credentialId: window2.credentialId,
+    windowType: window2.windowType,
+    windowStartsAt,
+    ratePerHour,
+    exhaustsAt,
+    survives: exhaustsAt === null || window2.resetsAt === null || exhaustsAt >= window2.resetsAt,
+    stale: false
+  };
+}
+function burnEstimates(windows, input) {
+  return windows.map((window2) => burnFor(window2, input));
+}
+
+// packages/control/src/credentials.ts
+function summarizeCredential(credential) {
+  return {
+    id: credential.id,
+    provider: credential.provider,
+    label: credential.label,
+    authType: credential.authType,
+    enabled: credential.enabled,
+    tier: credential.tier,
+    weight: credential.weight,
+    expiresAt: credential.expiresAt,
+    accountEmail: credential.accountEmail,
+    providerData: credential.providerData,
+    disabledReason: credential.disabledReason,
+    disabledAt: credential.disabledAt,
+    hasRefreshToken: credential.hasRefreshToken,
+    createdAt: credential.createdAt,
+    updatedAt: credential.updatedAt
+  };
+}
+async function listCredentials(store) {
+  return (await store.credentials.list()).map(summarizeCredential);
+}
+function requiredString(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new GatewayError("BAD_REQUEST", `${field}: must not be empty`);
+  }
+  return value.trim();
+}
+function customProviderData(input) {
+  const endpointId = requiredString(input.endpointId, "endpointId");
+  const endpointLabel = requiredString(input.endpointLabel, "endpointLabel");
+  const originInput = requiredString(input.origin, "origin");
+  if (input.protocol !== "chat_completions" && input.protocol !== "responses") {
+    throw new GatewayError("BAD_REQUEST", "protocol: unsupported protocol");
+  }
+  let url2;
+  try {
+    url2 = new URL(originInput);
+  } catch {
+    throw new GatewayError("BAD_REQUEST", "origin: must be a valid URL");
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:" || url2.hostname.length === 0 || url2.username.length > 0 || url2.password.length > 0 || url2.pathname !== "" && url2.pathname !== "/" || url2.search.length > 0 || url2.hash.length > 0) {
+    throw new GatewayError("BAD_REQUEST", "origin: must be an HTTP(S) server origin");
+  }
+  return { endpointId, endpointLabel, origin: url2.origin, protocol: input.protocol };
+}
+function sameCustomEndpoint(a, b) {
+  return a.endpointId === b.endpointId && a.endpointLabel === b.endpointLabel && a.origin === b.origin && a.protocol === b.protocol;
+}
+async function createApiKeyCredential(store, input, logger2 = noopLogger) {
+  const provider = parseOrThrow(providerIdSchema, input.provider);
+  const apiKey = requiredString(input.apiKey, "apiKey");
+  if (input.label !== undefined && typeof input.label !== "string") {
+    throw new GatewayError("BAD_REQUEST", "label: must be a string");
+  }
+  let providerData = {};
+  if (provider === "custom") {
+    const custom2 = customProviderData(input);
+    const existing = (await store.credentials.list()).filter((credential) => credential.provider === "custom" && credential.providerData.endpointId === custom2.endpointId);
+    if (existing.some((credential) => !sameCustomEndpoint(credential.providerData, custom2))) {
+      throw new GatewayError("CONFLICT", `endpointId: metadata conflicts with existing endpoint`);
+    }
+    providerData = custom2;
+  }
+  const label2 = input.label?.trim() || `${provider} api key`;
+  const created = await store.credentials.create({
+    id: crypto.randomUUID(),
+    provider,
+    label: label2,
+    authType: "apiKey",
+    enabled: true,
+    tier: 1,
+    weight: 1,
+    expiresAt: null,
+    accountEmail: null,
+    providerData,
+    disabledReason: null,
+    disabledAt: null,
+    accessToken: null,
+    refreshToken: null,
+    apiKey,
+    idToken: null
+  });
+  logger2.info("credential added", { credentialId: created.id, provider: created.provider });
+  return summarizeCredential(created);
+}
+async function credentialHealth(deps) {
+  const [health, quota, settings] = await Promise.all([
+    deps.store.credentials.listHealth(),
+    deps.store.credentials.listQuota(),
+    deps.store.config.getSettings()
+  ]);
+  const burn = burnEstimates(quota, {
+    now: deps.now(),
+    pollIntervalMs: settings.quotaPollIntervalMs
+  });
+  return { health, quota, burn };
+}
+async function patchCredential(deps, id, input) {
+  const patch = parseOrThrow(credentialPatchSchema, input);
+  const existing = await deps.store.credentials.get(id);
+  if (existing === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  await deps.store.credentials.update(id, {
+    ...patch.label === undefined ? {} : { label: patch.label },
+    ...patch.enabled === undefined ? {} : {
+      enabled: patch.enabled,
+      disabledReason: patch.enabled ? null : "manual",
+      disabledAt: patch.enabled ? null : deps.now()
+    },
+    ...patch.tier === undefined ? {} : { tier: patch.tier },
+    ...patch.weight === undefined ? {} : { weight: patch.weight }
+  });
+  if (patch.enabled !== undefined && patch.enabled !== existing.enabled) {
+    (deps.logger ?? noopLogger).info(patch.enabled ? "credential enabled" : "credential disabled", {
+      credentialId: id,
+      provider: existing.provider
+    });
+  }
+}
+async function removeCredential(store, id) {
+  await store.credentials.remove(id);
+}
+// packages/control/src/dryRun.ts
+async function dryRun(deps, modelId, input) {
+  const need = parseOrThrow(dryRunSchema, input);
+  const now = deps.now();
+  const snapshot = await buildSnapshot(deps.store, now);
+  const model = snapshot.models.get(modelId);
+  if (model === undefined) {
+    throw new GatewayError("MODEL_UNAVAILABLE", `no virtual model "${modelId}"`);
+  }
+  const probe = {
+    model: modelId,
+    messages: [
+      {
+        role: "user",
+        content: need.images ? [{ type: "image", mediaType: "image/png", data: "" }] : [{ type: "text", text: "" }]
+      }
+    ],
+    stream: false,
+    ...need.tools ? {
+      tools: [
+        { provider: "custom", name: "probe", description: "", inputSchema: { type: "object" } }
+      ]
+    } : {},
+    ...need.reasoning ? { reasoning: { mode: "adaptive" } } : {}
+  };
+  const result = rank({ request: probe, model, snapshot, now, rand: 0, load: new Map });
+  return {
+    modelId: model.id,
+    strategy: model.strategy,
+    deterministic: model.strategy !== "weighted",
+    rankedAt: now,
+    candidates: result.candidates.map((candidate) => ({
+      credentialId: candidate.credential.id,
+      credentialLabel: candidate.credential.label,
+      provider: candidate.credential.provider,
+      model: candidate.target.model,
+      tier: candidate.target.tier,
+      score: candidate.score,
+      reasons: candidate.reasons
+    })),
+    excluded: result.excluded
+  };
+}
 // packages/control/src/keys.ts
 async function listKeys(store) {
   const keys = await store.keys.list();
@@ -24238,16 +25161,55 @@ function modelDisplayName(model) {
 async function listModels(store) {
   return store.config.listModels();
 }
+var AUTH_LABEL = {
+  oauth: "OAuth",
+  apiKey: "API key"
+};
+function phrase(auths) {
+  return auths.map((auth) => AUTH_LABEL[auth]).join(" or ");
+}
+function heldAuths(credentials) {
+  const byProvider = new Map;
+  for (const credential of credentials) {
+    const ways = byProvider.get(credential.provider) ?? new Set;
+    ways.add(credential.authType);
+    byProvider.set(credential.provider, ways);
+  }
+  return byProvider;
+}
+function pairOf(target) {
+  return `${target.provider}\x00${target.model}`;
+}
+function unreachable(model, credentials, stored) {
+  const held = heldAuths(credentials);
+  const grandfathered = new Set((stored?.targets ?? []).map(pairOf));
+  for (const target of model.targets) {
+    if (grandfathered.has(pairOf(target)))
+      continue;
+    const have = held.get(target.provider);
+    if (have === undefined)
+      continue;
+    const reach = catalogModelAuths(target.provider, target.model);
+    if (reach.some((auth) => have.has(auth)))
+      continue;
+    return new GatewayError("BAD_REQUEST", `${target.provider} serves "${target.model}" to ${phrase(reach)} credentials only, ` + `and every ${target.provider} credential here is ${phrase([...have])} \u2014 ` + `connect the other kind, or pick a model this one can reach`);
+  }
+  return null;
+}
 async function putModel(store, id, input) {
   const model = parseOrThrow(modelSchema, input);
   if (model.id !== id) {
     throw new GatewayError("BAD_REQUEST", "model id in the path and body must match");
   }
-  const customEndpointIds = new Set((await store.credentials.list()).filter((credential) => credential.provider === "custom").map((credential) => credential.providerData.endpointId).filter((endpointId) => typeof endpointId === "string"));
+  const credentials = await store.credentials.list();
+  const customEndpointIds = new Set(credentials.filter((credential) => credential.provider === "custom").map((credential) => credential.providerData.endpointId).filter((endpointId) => typeof endpointId === "string"));
   const missing = model.targets.find((target) => target.provider === "custom" && (target.endpointId === undefined || !customEndpointIds.has(target.endpointId)));
   if (missing !== undefined) {
     throw new GatewayError("BAD_REQUEST", `custom endpoint "${missing.endpointId}" has no credential`);
   }
+  const stranded = unreachable(model, credentials, (await store.config.listModels()).find((existing) => existing.id === id));
+  if (stranded !== null)
+    throw stranded;
   await store.config.putModel(model);
 }
 async function removeModel(store, id) {
@@ -24265,17 +25227,127 @@ function randomState() {
   return randomToken();
 }
 
+// packages/control/src/oauth/usage.ts
+function usageReadable(status, provider) {
+  if (status === 429) {
+    throw new GatewayError("RATE_LIMIT", `${provider} usage endpoint is rate limited`);
+  }
+  return status >= 200 && status < 300;
+}
+function recordOf(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function numberOf(record2, keys) {
+  for (const key of keys) {
+    const value = record2[key];
+    if (typeof value === "number" && Number.isFinite(value))
+      return value;
+    if (typeof value === "string" && value.trim().length > 0) {
+      const parsed = Number(value);
+      if (Number.isFinite(parsed))
+        return parsed;
+    }
+  }
+  return null;
+}
+function nestedOf(record2, keys) {
+  for (const key of keys) {
+    const nested = recordOf(record2[key]);
+    if (nested !== null)
+      return nested;
+  }
+  return null;
+}
+function resetAtOf(record2, keys, now) {
+  for (const key of keys.absolute) {
+    const value = record2[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      return value < 1000000000000 ? Math.round(value * 1000) : Math.round(value);
+    }
+    if (typeof value === "string") {
+      const parsed = Date.parse(value);
+      if (!Number.isNaN(parsed))
+        return parsed;
+    }
+  }
+  for (const key of keys.relativeSeconds ?? []) {
+    const value = record2[key];
+    if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
+      return now + Math.round(value * 1000);
+    }
+  }
+  return null;
+}
+var USED_KEYS = ["used", "used_units", "usage", "consumed"];
+var LIMIT_KEYS = ["limit", "limit_units", "total", "quota", "allowed"];
+var PERCENT_KEYS = [
+  "utilization",
+  "used_percent",
+  "usedPercent",
+  "percent_used",
+  "percentUsed",
+  "percent"
+];
+var RESET_ABSOLUTE_KEYS = [
+  "resets_at",
+  "resetsAt",
+  "reset_at",
+  "resetAt",
+  "resetTime",
+  "reset_time",
+  "resets_at_epoch",
+  "reset"
+];
+var RESET_RELATIVE_KEYS = [
+  "resets_in_seconds",
+  "resetsInSeconds",
+  "reset_after_seconds",
+  "resetAfterSeconds",
+  "seconds_until_reset",
+  "resets_in"
+];
+function windowFrom(value, windowType, now, windowMs = null) {
+  const record2 = recordOf(value);
+  if (record2 === null)
+    return null;
+  const resetsAt = resetAtOf(record2, { absolute: RESET_ABSOLUTE_KEYS, relativeSeconds: RESET_RELATIVE_KEYS }, now);
+  const used = numberOf(record2, USED_KEYS);
+  const limit = numberOf(record2, LIMIT_KEYS);
+  if (used !== null) {
+    return { windowType, used: Math.max(0, used), limit, resetsAt, windowMs };
+  }
+  const remaining = numberOf(record2, ["remaining", "remaining_units", "left"]);
+  if (remaining !== null && limit !== null) {
+    return { windowType, used: Math.max(0, limit - remaining), limit, resetsAt, windowMs };
+  }
+  const percent = numberOf(record2, PERCENT_KEYS);
+  if (percent !== null) {
+    return {
+      windowType,
+      used: Math.max(0, Math.min(100, percent)),
+      limit: 100,
+      resetsAt,
+      windowMs
+    };
+  }
+  return null;
+}
+function reportFrom(windows) {
+  const kept = windows.filter((w) => w !== null);
+  return kept.length === 0 ? null : { windows: kept };
+}
+
 // packages/control/src/oauth/anthropic.ts
-var CLIENT_ID2 = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 var AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var TOKEN_URL2 = "https://api.anthropic.com/v1/oauth/token";
+var TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
 var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 var SCOPES = "org:create_api_key user:profile user:inference";
-var USAGE_URL2 = "https://api.anthropic.com/api/oauth/usage";
+var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 async function postToken(body2, deps) {
-  const { status, parsed } = await postJson(deps, "anthropic", TOKEN_URL2, PROFILES.anthropic, {
+  const { status, parsed } = await postJson(deps, "anthropic", TOKEN_URL, PROFILES.anthropic, {
     contentType: "application/json",
-    body: JSON.stringify({ ...body2, client_id: CLIENT_ID2 })
+    body: JSON.stringify({ ...body2, client_id: CLIENT_ID })
   });
   if (status < 200 || status >= 300) {
     throw new GatewayError(tokenErrorCode(status), tokenErrorMessage(status, parsed));
@@ -24288,7 +25360,7 @@ async function postToken(body2, deps) {
 function isTokenResponse(value) {
   return typeof value === "object" && value !== null;
 }
-function toResult2(token, fallbackRefresh, deps) {
+function toResult(token, fallbackRefresh, deps) {
   return {
     secrets: {
       accessToken: token.access_token ?? null,
@@ -24321,7 +25393,7 @@ var anthropicOAuth = {
     const redirectUri = REDIRECT_URI;
     const url2 = new URL(AUTHORIZE_URL);
     url2.searchParams.set("code", "true");
-    url2.searchParams.set("client_id", CLIENT_ID2);
+    url2.searchParams.set("client_id", CLIENT_ID);
     url2.searchParams.set("response_type", "code");
     url2.searchParams.set("redirect_uri", redirectUri);
     url2.searchParams.set("scope", SCOPES);
@@ -24342,16 +25414,16 @@ var anthropicOAuth = {
       code_verifier: pending.verifier,
       state: pending.state
     }, deps);
-    return toResult2(token, null, deps);
+    return toResult(token, null, deps);
   },
   async refresh(refreshToken, deps) {
     const token = await postToken({ grant_type: "refresh_token", refresh_token: refreshToken }, deps);
-    return toResult2(token, refreshToken, deps);
+    return toResult(token, refreshToken, deps);
   },
   async usage(secrets, deps) {
     if (secrets.accessToken === null)
       return null;
-    const { status, parsed } = await getJson(deps, "anthropic", USAGE_URL2, PROFILES.anthropic, {
+    const { status, parsed } = await getJson(deps, "anthropic", USAGE_URL, PROFILES.anthropic, {
       accessToken: secrets.accessToken,
       extraHeaders: [
         ["anthropic-beta", "oauth-2025-04-20"],
@@ -24364,13 +25436,474 @@ var anthropicOAuth = {
   }
 };
 
+// packages/control/src/oauth/grok.ts
+var CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
+var ISSUER = "https://auth.x.ai";
+var DISCOVERY_URL = `${ISSUER}/.well-known/openid-configuration`;
+var SCOPES2 = [
+  "openid",
+  "profile",
+  "email",
+  "offline_access",
+  "grok-cli:access",
+  "api:access",
+  "conversations:read",
+  "conversations:write",
+  "workspaces:read",
+  "workspaces:write"
+].join(" ");
+var TRUSTED_HOST = "x.ai";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function trustedEndpoint(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new GatewayError("UPSTREAM", `discovery document has no ${field}`);
+  }
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new GatewayError("UPSTREAM", `discovery document has an unusable ${field}`);
+  }
+  const host2 = url2.hostname;
+  if (url2.protocol !== "https:" || host2 !== TRUSTED_HOST && !host2.endsWith(`.${TRUSTED_HOST}`)) {
+    throw new GatewayError("UPSTREAM", `discovery document ${field} is not an ${TRUSTED_HOST} https url`);
+  }
+  return url2.toString();
+}
+async function discover(deps) {
+  const res = await deps.http({
+    provider: "grok",
+    url: DISCOVERY_URL,
+    method: "GET",
+    headers: orderHeaders(mergeHeaders(PROFILES.grok.headers, [["Accept", "application/json"]]), PROFILES.grok.order),
+    body: "",
+    signal: AbortSignal.timeout(15000)
+  });
+  const text = await res.text();
+  if (res.status < 200 || res.status >= 300) {
+    throw new GatewayError("UPSTREAM", `discovery endpoint returned http_${res.status}`);
+  }
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {}
+  if (!isRecord2(parsed)) {
+    throw new GatewayError("UPSTREAM", "discovery endpoint returned an unusable response");
+  }
+  return {
+    authorizeUrl: trustedEndpoint(parsed.authorization_endpoint, "authorization_endpoint"),
+    tokenUrl: trustedEndpoint(parsed.token_endpoint, "token_endpoint")
+  };
+}
+function parseTokenResponse(value) {
+  if (!isRecord2(value) || typeof value.access_token !== "string")
+    return null;
+  return {
+    accessToken: value.access_token,
+    refreshToken: typeof value.refresh_token === "string" ? value.refresh_token : null,
+    expiresIn: typeof value.expires_in === "number" ? value.expires_in : null,
+    idToken: typeof value.id_token === "string" ? value.id_token : null
+  };
+}
+function emailFromIdToken(idToken) {
+  const parts = typeof idToken === "string" ? idToken.split(".") : [];
+  const payload = parts[1];
+  if (parts.length !== 3 || payload === undefined || payload.length === 0)
+    return null;
+  try {
+    const json7 = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!isRecord2(json7))
+      return null;
+    return typeof json7.email === "string" && json7.email.trim().length > 0 ? json7.email : null;
+  } catch {
+    return null;
+  }
+}
+async function postToken2(tokenUrl, body2, deps) {
+  const { status, parsed } = await postJson(deps, "grok", tokenUrl, PROFILES.grok, {
+    contentType: "application/x-www-form-urlencoded",
+    body: new URLSearchParams(body2).toString()
+  });
+  if (status < 200 || status >= 300) {
+    throw new GatewayError(tokenErrorCode(status), tokenErrorMessage(status, parsed));
+  }
+  const token = parseTokenResponse(parsed);
+  if (token === null) {
+    throw new GatewayError("AUTH", "token endpoint returned no access_token");
+  }
+  return token;
+}
+function agentIdFrom(providerData) {
+  const stored = providerData.agentId;
+  return typeof stored === "string" && stored.trim().length > 0 ? stored : mintGrokDevice().agentId;
+}
+function toResult2(token, fallbackRefresh, agentId, deps) {
+  return {
+    secrets: {
+      accessToken: token.accessToken,
+      refreshToken: token.refreshToken ?? fallbackRefresh,
+      apiKey: null,
+      idToken: token.idToken
+    },
+    expiresAt: token.expiresIn === null ? null : deps.now() + token.expiresIn * 1000,
+    accountEmail: emailFromIdToken(token.idToken),
+    providerData: { agentId }
+  };
+}
+var grokOAuth = {
+  id: "grok",
+  kind: "pkce",
+  supportsManualPaste: true,
+  async start({ redirectUri }, deps) {
+    const { authorizeUrl } = await discover(deps);
+    const { verifier, challenge } = createPkce();
+    const state = randomState();
+    const url2 = new URL(authorizeUrl);
+    url2.searchParams.set("response_type", "code");
+    url2.searchParams.set("client_id", CLIENT_ID2);
+    url2.searchParams.set("redirect_uri", redirectUri);
+    url2.searchParams.set("scope", SCOPES2);
+    url2.searchParams.set("code_challenge", challenge);
+    url2.searchParams.set("code_challenge_method", "S256");
+    url2.searchParams.set("state", state);
+    url2.searchParams.set("nonce", randomState());
+    url2.searchParams.set("referrer", "grok-build");
+    return { authorizeUrl: url2.toString(), pending: { verifier, challenge, state, redirectUri } };
+  },
+  async exchange({ code, pending }, deps) {
+    const [rawCode, pastedState] = code.split("#");
+    if (pastedState !== undefined && pastedState !== pending.state) {
+      throw new GatewayError("AUTH", "authorization state mismatch");
+    }
+    const { tokenUrl } = await discover(deps);
+    const token = await postToken2(tokenUrl, {
+      grant_type: "authorization_code",
+      code: (rawCode ?? "").trim(),
+      redirect_uri: pending.redirectUri,
+      client_id: CLIENT_ID2,
+      code_verifier: pending.verifier
+    }, deps);
+    return toResult2(token, null, mintGrokDevice().agentId, deps);
+  },
+  async refresh(refreshToken, deps, providerData) {
+    const { tokenUrl } = await discover(deps);
+    const token = await postToken2(tokenUrl, { grant_type: "refresh_token", client_id: CLIENT_ID2, refresh_token: refreshToken }, deps);
+    return toResult2(token, refreshToken, agentIdFrom(providerData), deps);
+  }
+};
+
+// packages/control/src/oauth/kilo.ts
+var CODES_URL = "https://api.kilo.ai/api/device-auth/codes";
+var PROFILE_URL = "https://api.kilo.ai/api/profile";
+var FALLBACK_VERIFICATION_URL = "https://kilo.ai";
+var DEFAULT_EXPIRES_SECONDS = 300;
+var POLL_INTERVAL_SECONDS = 3;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null;
+}
+function recordFrom(value) {
+  return isRecord3(value) ? value : null;
+}
+function stringFrom(value, field) {
+  const candidate = value[field];
+  return typeof candidate === "string" && candidate.trim().length > 0 ? candidate : null;
+}
+function positiveNumberFrom(value, field) {
+  const candidate = value[field];
+  return typeof candidate === "number" && Number.isFinite(candidate) && candidate > 0 ? candidate : null;
+}
+function deviceCodeFrom(value) {
+  const record2 = recordFrom(value);
+  const code = record2 === null ? null : stringFrom(record2, "code");
+  if (record2 === null || code === null) {
+    throw new GatewayError("AUTH", "device code endpoint returned an unusable response");
+  }
+  return {
+    code,
+    verificationUrl: stringFrom(record2, "verificationUrl") ?? FALLBACK_VERIFICATION_URL,
+    expiresIn: positiveNumberFrom(record2, "expiresIn") ?? DEFAULT_EXPIRES_SECONDS
+  };
+}
+async function orgIdFor(accessToken, deps) {
+  try {
+    const { status, parsed } = await getJson(deps, "kilo", PROFILE_URL, PROFILES.kilo, {
+      accessToken
+    });
+    if (status < 200 || status >= 300)
+      return null;
+    const record2 = recordFrom(parsed);
+    const organizations = record2?.organizations;
+    if (!Array.isArray(organizations))
+      return null;
+    const first = recordFrom(organizations[0]);
+    return first === null ? null : stringFrom(first, "id");
+  } catch {
+    return null;
+  }
+}
+var kiloOAuth = {
+  id: "kilo",
+  kind: "device",
+  needsDeviceId: false,
+  supportsManualPaste: false,
+  start() {
+    return {
+      authorizeUrl: FALLBACK_VERIFICATION_URL,
+      pending: { verifier: "", challenge: "", state: "", redirectUri: "" }
+    };
+  },
+  async begin(_opts, deps) {
+    const { status, parsed } = await postJson(deps, "kilo", CODES_URL, PROFILES.kilo, {
+      contentType: "application/json",
+      body: ""
+    });
+    if (status === 429) {
+      throw new GatewayError("RATE_LIMIT", "kilo has too many pending device authorizations; wait for one to expire and retry");
+    }
+    if (status < 200 || status >= 300) {
+      throw new GatewayError(tokenErrorCode(status), `kilo refused a device code: http_${status}`);
+    }
+    const response = deviceCodeFrom(parsed);
+    return {
+      authorizeUrl: response.verificationUrl,
+      userCode: response.code,
+      pending: {
+        verifier: "",
+        challenge: "",
+        state: "",
+        redirectUri: "",
+        deviceCode: response.code,
+        interval: POLL_INTERVAL_SECONDS,
+        extra: { expiresAt: deps.now() + response.expiresIn * 1000 }
+      }
+    };
+  },
+  async exchange({ pending }, deps) {
+    const code = pending.deviceCode;
+    if (code === undefined) {
+      throw new Error("kilo exchange requires a pending flow produced by begin()");
+    }
+    const expiresAt = pending.extra === undefined ? null : positiveNumberFrom(pending.extra, "expiresAt");
+    if (expiresAt !== null && deps.now() >= expiresAt) {
+      throw new GatewayError("AUTH", "kilo device code expired; start the authorization again");
+    }
+    const { status, parsed } = await getJsonUnauthenticated(deps, "kilo", `${CODES_URL}/${encodeURIComponent(code)}`, PROFILES.kilo);
+    if (status === 202)
+      throw pendingError("http_202");
+    if (status === 403) {
+      throw new GatewayError("AUTH", "kilo authorization was denied");
+    }
+    if (status === 410) {
+      throw new GatewayError("AUTH", "kilo device code expired; start the authorization again");
+    }
+    if (status < 200 || status >= 300) {
+      throw new GatewayError(tokenErrorCode(status), `kilo refused the device code poll: http_${status}`);
+    }
+    const record2 = recordFrom(parsed);
+    if (record2 === null)
+      throw pendingError("http_200");
+    if (stringFrom(record2, "status") !== "approved")
+      throw pendingError("http_200");
+    const token = stringFrom(record2, "token");
+    if (token === null) {
+      throw new GatewayError("AUTH", "kilo approved the authorization without a token");
+    }
+    const orgId = await orgIdFor(token, deps);
+    return {
+      secrets: {
+        accessToken: token,
+        refreshToken: null,
+        apiKey: null,
+        idToken: null
+      },
+      expiresAt: null,
+      accountEmail: stringFrom(record2, "userEmail"),
+      providerData: orgId === null ? {} : { orgId }
+    };
+  },
+  async refresh() {
+    throw new GatewayError("AUTH", "kilo tokens cannot be refreshed; reconnect the kilo account to get a new one");
+  }
+};
+
+// packages/control/src/oauth/kimi.ts
+var CLIENT_ID3 = "17e5f671-d194-4dfb-9706-5516cb48c098";
+var DEVICE_CODE_URL = "https://auth.kimi.com/api/oauth/device_authorization";
+var TOKEN_URL2 = "https://auth.kimi.com/api/oauth/token";
+var USAGE_URL2 = "https://api.kimi.com/coding/v1/usages";
+var DEFAULT_INTERVAL_SECONDS = 5;
+var PENDING_ERRORS = new Set(["authorization_pending", "slow_down"]);
+function isRecord4(value) {
+  return typeof value === "object" && value !== null;
+}
+function recordFrom2(value) {
+  return isRecord4(value) ? value : null;
+}
+function stringFrom2(value, field) {
+  const candidate = value[field];
+  return typeof candidate === "string" && candidate.trim().length > 0 ? candidate : null;
+}
+function positiveNumberFrom2(value, field) {
+  const candidate = value[field];
+  return typeof candidate === "number" && Number.isFinite(candidate) && candidate > 0 ? candidate : null;
+}
+function tokenFrom(value) {
+  const record2 = recordFrom2(value);
+  if (record2 === null) {
+    throw new GatewayError("AUTH", "token endpoint returned no access_token");
+  }
+  const accessToken = stringFrom2(record2, "access_token");
+  if (accessToken === null) {
+    throw new GatewayError("AUTH", "token endpoint returned no access_token");
+  }
+  return {
+    accessToken,
+    refreshToken: stringFrom2(record2, "refresh_token"),
+    expiresIn: positiveNumberFrom2(record2, "expires_in"),
+    email: stringFrom2(record2, "email")
+  };
+}
+function deviceCodeFrom2(value) {
+  const record2 = recordFrom2(value);
+  if (record2 === null) {
+    throw new GatewayError("AUTH", "device code endpoint returned an unusable response");
+  }
+  const deviceCode = stringFrom2(record2, "device_code");
+  const userCode = stringFrom2(record2, "user_code");
+  if (deviceCode === null || userCode === null) {
+    throw new GatewayError("AUTH", "device code endpoint returned an unusable response");
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri: stringFrom2(record2, "verification_uri_complete") ?? stringFrom2(record2, "verification_uri") ?? "https://www.kimi.com/device",
+    interval: positiveNumberFrom2(record2, "interval") ?? DEFAULT_INTERVAL_SECONDS
+  };
+}
+async function post(url2, body2, device3, deps) {
+  const { status, parsed } = await postJson(deps, "kimi", url2, PROFILES.kimi, {
+    contentType: "application/x-www-form-urlencoded",
+    body: new URLSearchParams({ ...body2, client_id: CLIENT_ID3 }).toString(),
+    extraHeaders: kimiDeviceHeaders(device3)
+  });
+  if (status >= 200 && status < 300)
+    return parsed;
+  const record2 = recordFrom2(parsed);
+  const code = record2 === null ? `http_${status}` : stringFrom2(record2, "error") ?? `http_${status}`;
+  if (PENDING_ERRORS.has(code))
+    throw pendingError(code);
+  throw new GatewayError(tokenErrorCode(status), tokenErrorMessage(status, parsed));
+}
+function deviceFrom(source) {
+  if (typeof source?.deviceId === "string" && source.deviceId.length > 0) {
+    const fresh = mintKimiDevice();
+    const field = (key, fallback) => {
+      const value = source[key];
+      return typeof value === "string" && value.length > 0 ? value : fallback;
+    };
+    return {
+      deviceId: source.deviceId,
+      deviceName: field("deviceName", fresh.deviceName),
+      deviceModel: field("deviceModel", fresh.deviceModel),
+      osVersion: field("osVersion", fresh.osVersion)
+    };
+  }
+  return mintKimiDevice();
+}
+function deviceForBegin(deviceId) {
+  return { ...mintKimiDevice(), deviceId };
+}
+function toResult3(token, device3, fallbackRefresh, deps) {
+  return {
+    secrets: {
+      accessToken: token.accessToken,
+      refreshToken: token.refreshToken ?? fallbackRefresh,
+      apiKey: null,
+      idToken: null
+    },
+    expiresAt: token.expiresIn === null ? null : deps.now() + token.expiresIn * 1000,
+    accountEmail: token.email,
+    providerData: { ...device3 }
+  };
+}
+function parseKimiUsage(value, now) {
+  const root = recordOf(value);
+  if (root === null)
+    return null;
+  return reportFrom([windowFrom(root.usage ?? root.Usage, "weekly", now)]);
+}
+var kimiOAuth = {
+  id: "kimi",
+  kind: "device",
+  needsDeviceId: true,
+  supportsManualPaste: false,
+  start() {
+    const device3 = mintKimiDevice();
+    return {
+      authorizeUrl: "https://www.kimi.com/device",
+      pending: { verifier: "", challenge: "", state: "", redirectUri: "", extra: { ...device3 } }
+    };
+  },
+  async begin({ deviceId }, deps) {
+    if (deviceId.trim().length === 0) {
+      throw new GatewayError("INTERNAL", "kimi begin requires a non-blank deviceId");
+    }
+    const device3 = deviceForBegin(deviceId);
+    const response = deviceCodeFrom2(await post(DEVICE_CODE_URL, {}, device3, deps));
+    return {
+      authorizeUrl: response.verificationUri,
+      userCode: response.userCode,
+      pending: {
+        verifier: "",
+        challenge: "",
+        state: "",
+        redirectUri: "",
+        deviceCode: response.deviceCode,
+        interval: response.interval,
+        extra: { ...device3 }
+      }
+    };
+  },
+  async exchange({ pending }, deps) {
+    if (pending.deviceCode === undefined) {
+      throw new Error("kimi exchange requires a pending flow produced by begin()");
+    }
+    const device3 = deviceFrom(pending.extra);
+    const token = tokenFrom(await post(TOKEN_URL2, {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: pending.deviceCode,
+      device_id: device3.deviceId
+    }, device3, deps));
+    return toResult3(token, device3, null, deps);
+  },
+  async refresh(refreshToken, deps, providerData) {
+    const device3 = deviceFrom(providerData);
+    const token = tokenFrom(await post(TOKEN_URL2, { grant_type: "refresh_token", refresh_token: refreshToken, device_id: device3.deviceId }, device3, deps));
+    return toResult3(token, device3, refreshToken, deps);
+  },
+  async usage(secrets, deps, providerData) {
+    if (secrets.accessToken === null)
+      return null;
+    const device3 = deviceFrom(providerData);
+    const { status, parsed } = await getJson(deps, "kimi", USAGE_URL2, PROFILES.kimi, {
+      accessToken: secrets.accessToken,
+      extraHeaders: kimiDeviceHeaders(device3)
+    });
+    if (!usageReadable(status, "kimi"))
+      return null;
+    return parseKimiUsage(parsed, deps.now());
+  }
+};
+
 // packages/control/src/oauth/openai.ts
-var CLIENT_ID3 = "app_EMoamEEZ73f0CkXaXp7hrann";
+var CLIENT_ID4 = "app_EMoamEEZ73f0CkXaXp7hrann";
 var AUTHORIZE_URL2 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL3 = "https://auth.openai.com/oauth/token";
-var SCOPES2 = "openid profile email offline_access";
+var SCOPES3 = "openid profile email offline_access";
 var USAGE_URL3 = "https://chatgpt.com/backend-api/wham/usage";
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null;
 }
 function nonBlankStringOrNull(value) {
@@ -24386,20 +25919,20 @@ function decodeClaims(idToken) {
     return { email: null, accountId: null };
   }
   try {
-    const json5 = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!isRecord3(json5))
+    const json7 = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!isRecord5(json7))
       return { email: null, accountId: null };
-    const auth = json5["https://api.openai.com/auth"];
+    const auth = json7["https://api.openai.com/auth"];
     return {
-      email: typeof json5.email === "string" ? json5.email : null,
-      accountId: isRecord3(auth) ? nonBlankStringOrNull(auth.chatgpt_account_id) : null
+      email: typeof json7.email === "string" ? json7.email : null,
+      accountId: isRecord5(auth) ? nonBlankStringOrNull(auth.chatgpt_account_id) : null
     };
   } catch {
     return { email: null, accountId: null };
   }
 }
-function parseTokenResponse(value) {
-  if (!isRecord3(value) || typeof value.access_token !== "string")
+function parseTokenResponse2(value) {
+  if (!isRecord5(value) || typeof value.access_token !== "string")
     return null;
   return {
     accessToken: value.access_token,
@@ -24408,21 +25941,21 @@ function parseTokenResponse(value) {
     idToken: typeof value.id_token === "string" ? value.id_token : null
   };
 }
-async function postToken2(body2, deps) {
+async function postToken3(body2, deps) {
   const { status, parsed } = await postJson(deps, "openai", TOKEN_URL3, PROFILES.openai, {
     contentType: "application/x-www-form-urlencoded",
-    body: new URLSearchParams({ ...body2, client_id: CLIENT_ID3 }).toString()
+    body: new URLSearchParams({ ...body2, client_id: CLIENT_ID4 }).toString()
   });
   if (status < 200 || status >= 300) {
     throw new GatewayError(tokenErrorCode(status), tokenErrorMessage(status, parsed));
   }
-  const token = parseTokenResponse(parsed);
+  const token = parseTokenResponse2(parsed);
   if (token === null) {
     throw new GatewayError("AUTH", "token endpoint returned no access_token");
   }
   return token;
 }
-function toResult3(token, fallbackRefresh, deps, fallbackAccountId = null) {
+function toResult4(token, fallbackRefresh, deps, fallbackAccountId = null) {
   const claims = decodeClaims(token.idToken);
   return {
     secrets: {
@@ -24436,17 +25969,21 @@ function toResult3(token, fallbackRefresh, deps, fallbackAccountId = null) {
     providerData: { accountId: claims.accountId ?? fallbackAccountId }
   };
 }
-function windowTypeOf(value, fallback) {
+function windowSecondsOf(value) {
   const record2 = recordOf(value);
   if (record2 === null)
-    return fallback;
+    return null;
   const seconds = numberOf(record2, [
     "limit_window_seconds",
     "limitWindowSeconds",
     "window_seconds",
     "windowSeconds"
   ]);
-  if (seconds === null || seconds <= 0)
+  return seconds === null || seconds <= 0 ? null : seconds;
+}
+function windowTypeOf(value, fallback) {
+  const seconds = windowSecondsOf(value);
+  if (seconds === null)
     return fallback;
   if (seconds <= 6 * 60 * 60)
     return "fiveHour";
@@ -24454,6 +25991,10 @@ function windowTypeOf(value, fallback) {
     return "daily";
   return "weekly";
 }
+function windowMsOf(value) {
+  const seconds = windowSecondsOf(value);
+  return seconds === null ? null : seconds * 1000;
+}
 function parseOpenAIUsage(value, now) {
   const root = recordOf(value);
   if (root === null)
@@ -24462,8 +26003,8 @@ function parseOpenAIUsage(value, now) {
   const primary = rateLimit.primary_window ?? rateLimit.primaryWindow;
   const secondary = rateLimit.secondary_window ?? rateLimit.secondaryWindow;
   return reportFrom([
-    windowFrom(primary, windowTypeOf(primary, "fiveHour"), now),
-    windowFrom(secondary, windowTypeOf(secondary, "weekly"), now)
+    windowFrom(primary, windowTypeOf(primary, "fiveHour"), now, windowMsOf(primary)),
+    windowFrom(secondary, windowTypeOf(secondary, "weekly"), now, windowMsOf(secondary))
   ]);
 }
 var openaiOAuth = {
@@ -24474,10 +26015,10 @@ var openaiOAuth = {
     const { verifier, challenge } = createPkce();
     const state = randomState();
     const url2 = new URL(AUTHORIZE_URL2);
-    url2.searchParams.set("client_id", CLIENT_ID3);
+    url2.searchParams.set("client_id", CLIENT_ID4);
     url2.searchParams.set("response_type", "code");
     url2.searchParams.set("redirect_uri", redirectUri);
-    url2.searchParams.set("scope", SCOPES2);
+    url2.searchParams.set("scope", SCOPES3);
     url2.searchParams.set("code_challenge", challenge);
     url2.searchParams.set("code_challenge_method", "S256");
     url2.searchParams.set("id_token_add_organizations", "true");
@@ -24492,17 +26033,17 @@ var openaiOAuth = {
     if (pastedState !== undefined && pastedState !== pending.state) {
       throw new GatewayError("AUTH", "authorization state mismatch");
     }
-    const token = await postToken2({
+    const token = await postToken3({
       grant_type: "authorization_code",
       code: (rawCode ?? "").trim(),
       redirect_uri: pending.redirectUri,
       code_verifier: pending.verifier
     }, deps);
-    return toResult3(token, null, deps);
+    return toResult4(token, null, deps);
   },
   async refresh(refreshToken, deps, providerData) {
-    const token = await postToken2({ grant_type: "refresh_token", refresh_token: refreshToken, scope: SCOPES2 }, deps);
-    return toResult3(token, refreshToken, deps, accountIdFromProviderData(providerData));
+    const token = await postToken3({ grant_type: "refresh_token", refresh_token: refreshToken, scope: SCOPES3 }, deps);
+    return toResult4(token, refreshToken, deps, accountIdFromProviderData(providerData));
   },
   async usage(secrets, deps, providerData) {
     if (secrets.accessToken === null)
@@ -24522,7 +26063,9 @@ var openaiOAuth = {
 var OAUTH_PROVIDERS = {
   anthropic: anthropicOAuth,
   openai: openaiOAuth,
-  kimi: kimiOAuth
+  kimi: kimiOAuth,
+  kilo: kiloOAuth,
+  grok: grokOAuth
 };
 // packages/control/src/oauth/lead.ts
 var DISPATCH_REFRESH_LEAD_MS = 120000;
@@ -24584,7 +26127,57 @@ function createRefresher(deps) {
     return promise2;
   };
 }
-// packages/control/src/quota.ts
+// packages/control/src/quota/history.ts
+var DAY_MS = 24 * 60 * 60 * 1000;
+var HOUR_MS2 = 3600000;
+async function gatewayRatesFor(store, windows) {
+  const rates = [];
+  for (const window2 of windows) {
+    const since = windowStartOf(window2);
+    if (since === null || window2.observedAt <= since) {
+      rates.push({
+        credentialId: window2.credentialId,
+        windowType: window2.windowType,
+        gatewayRatePerHour: null
+      });
+      continue;
+    }
+    const rows = await store.usage.aggregate({
+      grain: "raw",
+      groupBy: "credential",
+      since,
+      until: window2.observedAt
+    });
+    const row = rows.find((r) => r.key === window2.credentialId);
+    const tokens2 = row === undefined ? 0 : row.inputTokens + row.outputTokens + row.cacheReadTokens + row.cacheWriteTokens;
+    rates.push({
+      credentialId: window2.credentialId,
+      windowType: window2.windowType,
+      gatewayRatePerHour: tokens2 / ((window2.observedAt - since) / HOUR_MS2)
+    });
+  }
+  return rates;
+}
+async function quotaHistory(deps, input) {
+  const now = deps.now();
+  const settings = await deps.store.config.getSettings();
+  const oldest = now - settings.logRetentionDays * DAY_MS;
+  const since = Math.max(optionalNumber(input.since, oldest), oldest);
+  const until = Math.min(optionalNumber(input.until, now), now);
+  const raw = input.credentialId?.trim();
+  const credentialId = raw === undefined || raw.length === 0 ? undefined : raw;
+  const [samples, quota] = await Promise.all([
+    deps.store.credentials.listQuotaSamples({
+      since,
+      until,
+      ...credentialId === undefined ? {} : { credentialId }
+    }),
+    deps.store.credentials.listQuota()
+  ]);
+  const scoped = credentialId === undefined ? quota : quota.filter((w) => w.credentialId === credentialId);
+  return { samples, gatewayRates: await gatewayRatesFor(deps.store, scoped) };
+}
+// packages/control/src/quota/poll.ts
 var CONCURRENCY = 4;
 var RATE_LIMIT_COOLDOWN_MS = 180000;
 var cooldowns = new Map;
@@ -24607,7 +26200,8 @@ async function probe(deps, credential) {
     used: w.used,
     limit: w.limit,
     resetsAt: w.resetsAt,
-    observedAt
+    observedAt,
+    windowMs: w.windowMs
   }));
   await deps.store.credentials.saveQuota(rows);
   (deps.logger ?? noopLogger).debug("quota snapshot written", {
@@ -24818,20 +26412,16 @@ async function queryUsage(deps, input) {
   const grain = parseOrThrow(grainSchema, input.grain ?? "raw");
   const groupBy = requireDimension(grain, parseOrThrow(dimensionSchema, input.groupBy ?? "model"));
   const splitBy = input.splitBy === undefined ? undefined : requireDimension(grain, parseOrThrow(dimensionSchema, input.splitBy));
-  const since = input.since === undefined ? 0 : Number(input.since);
-  const until = input.until === undefined ? deps.now() : Number(input.until);
   return deps.store.usage.aggregate({
     grain,
     groupBy,
     ...splitBy === undefined ? {} : { splitBy },
-    since: Number.isFinite(since) ? since : 0,
-    until: Number.isFinite(until) ? until : deps.now()
+    since: optionalNumber(input.since, 0),
+    until: optionalNumber(input.until, deps.now())
   });
 }
 function logLimit(requested) {
-  const value = requested === undefined ? DEFAULT_LOG_LIMIT : Number(requested);
-  if (!Number.isFinite(value))
-    return DEFAULT_LOG_LIMIT;
+  const value = optionalNumber(requested, DEFAULT_LOG_LIMIT);
   return Math.floor(Math.min(Math.max(1, value), MAX_LOG_LIMIT));
 }
 async function recentLogs(store, requested) {
@@ -32237,7 +33827,7 @@ var emptySchema = {
 
 // node_modules/.bun/elysia@1.4.29+5b33ebcc42722450/node_modules/elysia/dist/error.mjs
 var env2 = typeof Bun < "u" ? Bun.env : typeof process < "u" ? process?.env : undefined;
-var ERROR_CODE2 = Symbol("ElysiaErrorCode");
+var ERROR_CODE3 = Symbol("ElysiaErrorCode");
 var isProduction = (env2?.NODE_ENV ?? env2?.ENV) === "production";
 var emptyHttpStatus = {
   101: undefined,
@@ -36793,7 +38383,7 @@ c.defs=definitions
       schema: app.router.history,
       definitions: app.definitions.type,
       tee,
-      ERROR_CODE: ERROR_CODE2,
+      ERROR_CODE: ERROR_CODE3,
       parseCookie: hasCookie ? parseCookie : undefined,
       signCookie: hasCookie ? signCookie : undefined,
       Cookie: hasCookie ? Cookie : undefined,
@@ -37066,7 +38656,7 @@ return mapResponse(${saveResponse}error,set${adapter.mapResponseContext})}`;
   return Function("inject", `"use strict";
 ` + fnLiteral)({
     mapResponse: app["~adapter"].handler.mapResponse,
-    ERROR_CODE: ERROR_CODE2,
+    ERROR_CODE: ERROR_CODE3,
     ElysiaCustomStatusResponse,
     ValidationError,
     TransformDecodeError,
@@ -38521,12 +40111,12 @@ var _Elysia = class _Elysia2 {
   error(name, error51) {
     switch (typeof name) {
       case "string":
-        return error51.prototype[ERROR_CODE2] = name, this.definitions.error[name] = error51, this;
+        return error51.prototype[ERROR_CODE3] = name, this.definitions.error[name] = error51, this;
       case "function":
         return this.definitions.error = name(this.definitions.error), this;
     }
     for (const [code, error210] of Object.entries(name))
-      error210.prototype[ERROR_CODE2] = code, this.definitions.error[code] = error210;
+      error210.prototype[ERROR_CODE3] = code, this.definitions.error[code] = error210;
     return this;
   }
   onError(options, handler) {
@@ -39340,7 +40930,7 @@ function parseOrThrow2(schema, body2) {
   const path = issue2?.path.join(".") ?? "(root)";
   throw new GatewayError("BAD_REQUEST", `${path}: ${issue2?.message ?? "invalid request"}`);
 }
-function isRecord4(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null;
 }
 function extraFields(body2, known) {
@@ -39399,7 +40989,7 @@ async function readJson(request2) {
 }
 async function readJsonRecord(request2) {
   const body2 = await readJson(request2);
-  return isRecord4(body2) ? body2 : null;
+  return isRecord6(body2) ? body2 : null;
 }
 function apiErrorResponse(error51) {
   const gatewayError = error51 instanceof GatewayError ? error51 : new GatewayError("INTERNAL", "internal error");
@@ -39476,7 +41066,14 @@ function adminRoutes(deps) {
     };
   }).get("/api/credentials/health", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
-    return credentialHealth(deps.store);
+    return credentialHealth(deps);
+  }).get("/api/credentials/quota/history", async ({ request: request2, query }) => {
+    await requireAdmin(request2, deps.admin);
+    return quotaHistory(deps, {
+      since: query.since,
+      until: query.until,
+      credentialId: query.credentialId
+    });
   }).patch("/api/credentials/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await patchCredential(deps, params.id, await readJson(request2));
@@ -41517,7 +43114,8 @@ async function attempt(opts) {
       providerData: credential.providerData
     },
     http,
-    signal
+    signal,
+    ...opts.requestId === undefined ? {} : { requestId: opts.requestId }
   });
 }
 
@@ -41551,6 +43149,8 @@ var WRITE_OVER_INPUT = {
   anthropic: { fiveMinute: 1.25, oneHour: 2 },
   openai: { fiveMinute: 0, oneHour: 0 },
   kimi: { fiveMinute: 0, oneHour: 0 },
+  kilo: { fiveMinute: 0, oneHour: 0 },
+  grok: { fiveMinute: 0, oneHour: 0 },
   custom: { fiveMinute: 0, oneHour: 0 }
 };
 function splitWrites(usage) {
@@ -42009,7 +43609,7 @@ var frame = (event, data) => ({
 });
 async function* anthropicStream(events, requestId) {
   let model = "";
-  const suppressed = new Set;
+  const suppressed2 = new Set;
   const outIndex = new Map;
   let nextOutIndex = 0;
   for await (const event of events) {
@@ -42038,7 +43638,7 @@ async function* anthropicStream(events, requestId) {
       case "blockStart": {
         const b = event.block;
         if (b.type === "thinking" && b.signed !== true) {
-          suppressed.add(event.index);
+          suppressed2.add(event.index);
           break;
         }
         const content_block = b.type === "text" ? { type: "text", text: "" } : b.type === "thinking" ? { type: "thinking", thinking: "" } : b.type === "anthropicNative" ? { ...b.data, type: b.blockType } : { type: "tool_use", id: b.id, name: b.name, input: {} };
@@ -42052,7 +43652,7 @@ async function* anthropicStream(events, requestId) {
         break;
       }
       case "blockDelta": {
-        if (suppressed.has(event.index))
+        if (suppressed2.has(event.index))
           break;
         const d = event.delta;
         const delta2 = d.type === "text" ? { type: "text_delta", text: d.text } : d.type === "thinking" ? { type: "thinking_delta", thinking: d.text } : d.type === "thinkingSignature" ? { type: "signature_delta", signature: d.signature } : d.type === "anthropicNative" ? { type: d.deltaType, ...d.data } : { type: "input_json_delta", partial_json: d.partial };
@@ -42064,7 +43664,7 @@ async function* anthropicStream(events, requestId) {
         break;
       }
       case "blockEnd":
-        if (suppressed.has(event.index))
+        if (suppressed2.has(event.index))
           break;
         yield frame("content_block_stop", {
           type: "content_block_stop",
@@ -42141,7 +43741,7 @@ function usageBody(usage) {
     prompt_tokens_details: { cached_tokens: usage.cacheReadTokens }
   };
 }
-var FINISH2 = {
+var FINISH3 = {
   endTurn: "stop",
   maxTokens: "length",
   stopSequence: "stop",
@@ -42240,7 +43840,7 @@ async function* openaiStream(events, requestId, created) {
         break;
       case "end":
         completed = true;
-        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH2[event.stopReason] }, usageBody(event.usage)));
+        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH3[event.stopReason] }, usageBody(event.usage)));
         break;
       case "error": {
         const e = ERROR_TYPE3[event.code];
@@ -42274,7 +43874,7 @@ function openaiResponse(collected, requestId, created) {
           content: toolCalls.length > 0 && text.length === 0 ? null : text,
           ...toolCalls.length > 0 ? { tool_calls: toolCalls } : {}
         },
-        finish_reason: FINISH2[collected.stopReason]
+        finish_reason: FINISH3[collected.stopReason]
       }
     ],
     usage: usageBody(collected.usage)
@@ -42802,10 +44402,10 @@ function toIrToolChoice(c) {
 }
 var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 function readEffort(body2) {
-  if (!isRecord4(body2))
+  if (!isRecord6(body2))
     return;
   const outputConfig = body2.output_config;
-  if (!isRecord4(outputConfig))
+  if (!isRecord6(outputConfig))
     return;
   const effort = outputConfig.effort;
   return EFFORTS.find((level) => level === effort);
@@ -43461,18 +45061,24 @@ function createApp(deps) {
 
 // apps/gateway/src/maintenance.ts
 var SWEEP_INTERVAL_MS = 60 * 60 * 1000;
-var DAY_MS = 24 * 60 * 60 * 1000;
+var DAY_MS2 = 24 * 60 * 60 * 1000;
 var ROLLUP_RETENTION_DAYS = 400;
 async function pruneLogs(store, now) {
   const settings = await store.config.getSettings();
-  const raw = await store.usage.prune(now - settings.logRetentionDays * DAY_MS);
-  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS);
-  return { raw, daily };
+  const rawHorizon = now - settings.logRetentionDays * DAY_MS2;
+  const raw = await store.usage.prune(rawHorizon);
+  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS2);
+  const quotaSamples = await store.credentials.pruneQuotaSamples(rawHorizon);
+  return { raw, daily, quotaSamples };
 }
 function startMaintenance(deps) {
   const logger2 = deps.logger ?? noopLogger;
   const timer = setInterval(() => {
-    pruneLogs(deps.store, deps.now()).then(({ raw, daily }) => logger2.debug("request logs pruned", { rawCount: raw, dailyCount: daily })).catch((error51) => {
+    pruneLogs(deps.store, deps.now()).then(({ raw, daily, quotaSamples }) => logger2.debug("request logs pruned", {
+      rawCount: raw,
+      dailyCount: daily,
+      quotaSampleCount: quotaSamples
+    })).catch((error51) => {
       logger2.error("log pruning failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
       });