omnigateway 0.2.2 → 0.3.0

package/gateway.js

@@ -5234,8 +5234,8 @@ var require_dist = __commonJS(function(exports) {
 });
 
 // apps/gateway/src/index.ts
-import { existsSync } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync2 } from "fs";
+import { resolve as resolve3 } from "path";
 
 // packages/control/src/adminAuth.ts
 import { hash, verify } from "@node-rs/argon2";
@@ -5292,9 +5292,34 @@ function createAdminAuth(store, opts) {
     },
     logout(token) {
       sessions.delete(token);
+    },
+    invalidateSessions() {
+      sessions.clear();
     }
   };
 }
+// packages/control/src/bodies.ts
+async function readRequestBody(store, requestId) {
+  const read = await store.bodies.get(requestId);
+  if (read === null) {
+    return {
+      requestId,
+      detailState: "none",
+      truncated: false,
+      sizeBytes: 0,
+      at: null,
+      artifact: null
+    };
+  }
+  return {
+    requestId: read.row.requestId,
+    detailState: read.row.detailState,
+    truncated: read.row.truncated,
+    sizeBytes: read.row.sizeBytes,
+    at: read.row.at,
+    artifact: read.artifact
+  };
+}
 // packages/ir/src/betas.ts
 var CONTEXT_1M_BETA = "context-1m-2025-08-07";
 var CONTEXT_1M_TOKENS = 1e6;
@@ -5378,6 +5403,7 @@ var FIELD_ORDER = [
   "requestedModel",
   "credentialId",
   "apiKeyId",
+  "snapshotId",
   "attempt",
   "attempts",
   "code",
@@ -5395,9 +5421,11 @@ var FIELD_ORDER = [
   "rawCount",
   "dailyCount",
   "quotaSampleCount",
+  "sizeBytes",
   "host",
   "port",
   "path",
+  "supervisor",
   "reason"
 ];
 var REASON_MAX = 200;
@@ -5713,6 +5741,7 @@ function loadConfig(env) {
   const staticDir = env.OMNI_STATIC_DIR?.trim();
   const logFile = env.OMNI_LOG_FILE?.trim();
   const exposeClaudeCodeAliases = TRUTHY.has((env.OMNI_EXPOSE_CLAUDE_CODE_ALIASES ?? "").trim().toLowerCase());
+  const bodyLoggingAllowed = TRUTHY.has((env.OMNI_BODY_LOGGING_ALLOWED ?? "").trim().toLowerCase());
   const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
   const logLevel = parseLogLevel(rawLogLevel);
   return {
@@ -5725,6 +5754,7 @@ function loadConfig(env) {
     baseUrl,
     staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
     exposeClaudeCodeAliases,
+    bodyLoggingAllowed,
     logFile: logFile === undefined || logFile.length === 0 ? null : logFile
   };
 }
@@ -5864,14 +5894,16 @@ function billingBlock() {
   return `${BILLING_PREFIX} cc_version=${CLI_VERSION}.${BUILD_REVISION}; ` + `cc_entrypoint=cli; cch=${CCH_PLACEHOLDER};`;
 }
 var BANNED_SUBSTRINGS = [
-  "github.com/anomalyco/o\u200Dpencode",
-  "o\u200Dpencode.ai/docs",
-  "github.com/c\u200Dline/c\u200Dline",
-  "github.com/getc\u200Dursor/c\u200Dursor",
-  "c\u200Dontinue.dev"
+  "github.com/anomalyco/opencode",
+  "opencode.ai/docs",
+  "github.com/cline/cline",
+  "github.com/getcursor/cursor",
+  "continue.dev",
+  "hermes-agent.nousresearch.com"
 ];
+var IDENTITY_PREFIXES = ["You are OpenCode", "You are Hermes Agent"];
 var REWRITES = [
-  ["if O\u200DpenCode honestly", "if the assistant honestly"],
+  ["if OpenCode honestly", "if the assistant honestly"],
   [
     "Here is some useful information about the environment you are running in:",
     "Environment context you are running in:"
@@ -5880,7 +5912,7 @@ var REWRITES = [
 function applyAnthropicSystem(system) {
   const kept = [];
   for (const block of system) {
-    const text = block.text.split(/\n{2,}/).filter((p) => !BANNED_SUBSTRINGS.some((b) => p.includes(b))).filter((p) => !p.trimStart().startsWith("You are O\u200DpenCode")).filter((p) => !p.includes(BILLING_PREFIX)).filter((p) => p.trim() !== AGENT_PREAMBLE).join(`
+    const text = block.text.split(/\n{2,}/).filter((p) => !BANNED_SUBSTRINGS.some((b) => p.includes(b))).filter((p) => !IDENTITY_PREFIXES.some((i) => p.trimStart().startsWith(i))).filter((p) => !p.includes(BILLING_PREFIX)).filter((p) => p.trim() !== AGENT_PREAMBLE).join(`
 
 `);
     let rewritten = text;
@@ -23187,6 +23219,45 @@ function date4(params) {
 
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// packages/ratelimit/src/catalog.ts
+var WINDOWS = ["1m", "5h", "1w"];
+var WINDOW_MS = {
+  "1m": 60000,
+  "5h": 5 * 60 * 60 * 1000,
+  "1w": 7 * 24 * 60 * 60 * 1000
+};
+var countLimit = exports_external.number().int().positive().nullable();
+var spendLimit = exports_external.number().positive().nullable();
+var countWindows = exports_external.object({
+  "1m": countLimit.optional(),
+  "5h": countLimit.optional(),
+  "1w": countLimit.optional()
+}).strict();
+var spendWindows = exports_external.object({
+  "5h": spendLimit.optional(),
+  "1w": spendLimit.optional()
+}).strict();
+var limitConfigSchema = exports_external.object({
+  requests: countWindows.optional(),
+  tokens: countWindows.optional(),
+  spend: spendWindows.optional(),
+  concurrency: countLimit.optional()
+}).strict();
+function assertNoProto(value, path) {
+  if (typeof value !== "object" || value === null)
+    return;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    if (key === "__proto__") {
+      throw new Error(`limits cannot name "__proto__"${path === "" ? "" : ` under ${path}`}`);
+    }
+    assertNoProto(value[key], path === "" ? key : `${path}.${key}`);
+  }
+}
+function parseLimitConfig(value) {
+  assertNoProto(value, "");
+  return limitConfigSchema.parse(value);
+}
+
 // packages/control/src/schemas.ts
 function parseOrThrow(schema, body2) {
   const result = schema.safeParse(body2);
@@ -23264,7 +23335,13 @@ var modelSchema = exports_external.object({
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable().default(null),
-  rateLimitPerMin: exports_external.number().int().positive().nullable().default(null)
+  limits: limitConfigSchema.default({}),
+  bodyLoggingOptOut: exports_external.boolean().default(false)
+}).strict();
+var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
+var retentionSchema = exports_external.object({
+  keepLatest: exports_external.number().int().min(1).max(100),
+  maxAgeDays: exports_external.number().int().min(1).max(3650)
 }).strict();
 var settingsSchema = exports_external.object({
   weights: exports_external.object({
@@ -23281,7 +23358,11 @@ var settingsSchema = exports_external.object({
   breakerCooldownMs: exports_external.number().int().positive(),
   logRetentionDays: exports_external.number().int().min(1),
   quotaPollIntervalMs: exports_external.number().int().min(0),
-  rtkEnabled: exports_external.boolean()
+  rtkEnabled: exports_external.boolean(),
+  bodyLoggingEnabled: exports_external.boolean(),
+  bodyLoggingCaptureStreamChunks: exports_external.boolean(),
+  snapshotKeepLatest: retentionSchema.shape.keepLatest.optional(),
+  snapshotMaxAgeDays: retentionSchema.shape.maxAgeDays.optional()
 });
 var credentialPatchSchema = exports_external.object({
   label: exports_external.string().min(1).optional(),
@@ -23493,7 +23574,11 @@ var DEFAULT_SETTINGS = {
   breakerCooldownMs: 30000,
   logRetentionDays: 30,
   quotaPollIntervalMs: 300000,
-  rtkEnabled: false
+  rtkEnabled: false,
+  bodyLoggingEnabled: false,
+  bodyLoggingCaptureStreamChunks: false,
+  snapshotKeepLatest: 5,
+  snapshotMaxAgeDays: 30
 };
 
 // packages/router/src/quota.ts
@@ -23747,6 +23832,10 @@ function rank(input) {
   return { candidates: scored, excluded };
 }
 
+// packages/store/src/bodies/artifact.ts
+import { mkdir, readdir, readFile, rmdir, unlink, writeFile } from "fs/promises";
+import { dirname, join, sep } from "path";
+
 // packages/store/src/encryption.ts
 var PREFIX = "enc:v1";
 var IV_BYTES = 12;
@@ -23786,6 +23875,362 @@ function unhex(s) {
     out[i] = Number.parseInt(s.slice(i * 2, i * 2 + 2), 16);
   return out;
 }
+
+// packages/store/src/bodies/bound.ts
+var MAX_STRING_BYTES = 64 * 1024;
+var MAX_ARRAY_ITEMS = 24;
+var MAX_DEPTH = 6;
+var MAX_OBJECT_KEYS = 80;
+var STRING_TRUNCATION_MARKER = "\u2026[truncated]";
+var DEPTH_MARKER = `[omitted: nesting past ${MAX_DEPTH} levels]`;
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+var CUT_BYTES = MAX_STRING_BYTES - encoder.encode(STRING_TRUNCATION_MARKER).length - 3;
+function truncateToBytes(value) {
+  const bytes = encoder.encode(value);
+  if (bytes.length <= MAX_STRING_BYTES)
+    return value;
+  return decoder.decode(bytes.subarray(0, CUT_BYTES)) + STRING_TRUNCATION_MARKER;
+}
+function boundValue(value) {
+  let truncated = false;
+  const walk = (input, depth) => {
+    if (typeof input === "string") {
+      const cut = truncateToBytes(input);
+      if (cut !== input)
+        truncated = true;
+      return cut;
+    }
+    if (Array.isArray(input)) {
+      if (depth > MAX_DEPTH) {
+        truncated = true;
+        return DEPTH_MARKER;
+      }
+      const kept = input.length > MAX_ARRAY_ITEMS ? input.slice(-MAX_ARRAY_ITEMS) : input;
+      if (kept.length !== input.length)
+        truncated = true;
+      return kept.map((item) => walk(item, depth + 1));
+    }
+    if (input !== null && typeof input === "object") {
+      if (depth > MAX_DEPTH) {
+        truncated = true;
+        return DEPTH_MARKER;
+      }
+      const entries = Object.entries(input);
+      const kept = entries.length > MAX_OBJECT_KEYS ? entries.slice(0, MAX_OBJECT_KEYS) : entries;
+      if (kept.length !== entries.length)
+        truncated = true;
+      return Object.fromEntries(kept.map(([k, v]) => [k, walk(v, depth + 1)]));
+    }
+    return input;
+  };
+  const bounded = walk(value, 1);
+  return { value: bounded, truncated };
+}
+
+// packages/store/src/bodies/mask.ts
+var ELIDED = "[redacted]";
+var BEARER = /\b(bearer)\s+[A-Za-z0-9._~+/=-]+/gi;
+var PREFIXED_KEY = /(?<![A-Za-z0-9_-])(?:sk|ak|pk)-[A-Za-z0-9_-]{8,}/g;
+var VENDOR_KEY = /(?<![A-Za-z0-9_-])(?:gh[posu]_|github_pat_|AIza|GOCSPX-)[A-Za-z0-9_-]{8,}/g;
+var VENDOR_PREFIX = /^(?:gh[posu]_|github_pat_|AIza|GOCSPX-)/;
+var XAI_KEY = /(?<![A-Za-z0-9_-])xai-[A-Za-z0-9_]{8,}/g;
+var OPAQUE = /[A-Za-z0-9_-]{41,}/g;
+var MASK_RULES = [
+  {
+    id: "bearer",
+    pattern: BEARER,
+    keep: (match) => match.length - match.replace(/^bearer\s+/i, "").length
+  },
+  { id: "prefixedKey", pattern: PREFIXED_KEY, keep: () => 3 },
+  {
+    id: "vendorKey",
+    pattern: VENDOR_KEY,
+    keep: (match) => VENDOR_PREFIX.exec(match)?.[0].length ?? 0
+  },
+  { id: "xaiKey", pattern: XAI_KEY, keep: () => "xai-".length },
+  { id: "opaque", pattern: OPAQUE, keep: () => 0 }
+];
+function maskString(value) {
+  return MASK_RULES.reduce((masked, rule) => masked.replace(rule.pattern, (match) => `${match.slice(0, rule.keep(match))}${ELIDED}`), value);
+}
+function maskSecrets(value) {
+  if (typeof value === "string")
+    return maskString(value);
+  if (Array.isArray(value))
+    return value.map(maskSecrets);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskSecrets(v)]));
+  }
+  return value;
+}
+
+// packages/store/src/bodies/artifact.ts
+var ARTIFACT_SCHEMA_VERSION = 1;
+var MAX_ARTIFACT_BYTES = 512 * 1024;
+var BODY_ROW_CAP = 1e5;
+var BODIES_DIRNAME = "request_bodies";
+var encoder2 = new TextEncoder;
+function bodiesDirFor(databasePath) {
+  return join(dirname(databasePath), BODIES_DIRNAME);
+}
+var SAFE_REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;
+function isSafeRequestId(id) {
+  return SAFE_REQUEST_ID.test(id);
+}
+function relPathFor(requestId, at) {
+  const date5 = new Date(at);
+  const yyyy = String(date5.getUTCFullYear()).padStart(4, "0");
+  const mm = String(date5.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date5.getUTCDate()).padStart(2, "0");
+  return `${yyyy}/${mm}/${dd}/${requestId}.json.enc`;
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function bodyPair(pair) {
+  const request2 = boundValue(maskSecrets(pair.request));
+  const response = boundValue(maskSecrets(pair.response));
+  return {
+    request: request2.value,
+    response: response.value,
+    truncated: pair.truncated === true || request2.truncated || response.truncated
+  };
+}
+function omission(serializedBytes) {
+  return {
+    omitted: true,
+    reason: `artifact exceeded ${MAX_ARTIFACT_BYTES} bytes after structural bounding`,
+    serializedBytes
+  };
+}
+function omitBodies(artifact, marker) {
+  return {
+    ...artifact,
+    client: { request: marker, response: marker, truncated: true },
+    attempts: artifact.attempts.map((attempt) => ({
+      attempt: attempt.attempt,
+      provider: attempt.provider,
+      request: marker,
+      response: marker,
+      streamChunks: null,
+      truncated: true
+    }))
+  };
+}
+function prepareArtifact(input) {
+  const client = bodyPair(input.client);
+  const attempts = input.attempts.map((attempt) => {
+    const pair = bodyPair(attempt);
+    const chunks = attempt.streamChunks === null ? null : boundValue(attempt.streamChunks.map(maskString));
+    return {
+      attempt: attempt.attempt,
+      provider: attempt.provider,
+      request: pair.request,
+      response: pair.response,
+      streamChunks: chunks === null ? null : chunks.value,
+      truncated: pair.truncated || (chunks?.truncated ?? false)
+    };
+  });
+  const error51 = boundValue(maskSecrets(input.error));
+  const bounded = {
+    schemaVersion: ARTIFACT_SCHEMA_VERSION,
+    requestId: input.requestId,
+    at: input.at,
+    client,
+    attempts,
+    error: error51.value
+  };
+  const json7 = JSON.stringify(bounded);
+  const size = encoder2.encode(json7).length;
+  if (size <= MAX_ARTIFACT_BYTES)
+    return { artifact: bounded, json: json7 };
+  const marker = omission(size);
+  const omitted = omitBodies(bounded, marker);
+  const omittedJson = JSON.stringify(omitted);
+  if (encoder2.encode(omittedJson).length <= MAX_ARTIFACT_BYTES) {
+    return { artifact: omitted, json: omittedJson };
+  }
+  const stripped = { ...omitted, error: marker };
+  return { artifact: stripped, json: JSON.stringify(stripped) };
+}
+async function sealArtifact(key, json7) {
+  const bytes = encoder2.encode(await encrypt(key, json7));
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
+async function readArtifact(key, dir, relPath, expectedSha256) {
+  let bytes;
+  try {
+    bytes = new Uint8Array(await readFile(join(dir, relPath)));
+  } catch {
+    return { ok: false, failure: "missing" };
+  }
+  try {
+    if (expectedSha256 !== null && await sha256Hex(bytes) !== expectedSha256) {
+      return { ok: false, failure: "corrupt" };
+    }
+    const parsed = JSON.parse(await decrypt(key, new TextDecoder().decode(bytes)));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { ok: false, failure: "corrupt" };
+    }
+    return { ok: true, artifact: parsed };
+  } catch {
+    return { ok: false, failure: "corrupt" };
+  }
+}
+async function writeArtifact(dir, relPath, bytes) {
+  const full = join(dir, relPath);
+  await mkdir(dirname(full), { recursive: true });
+  await writeFile(full, bytes);
+}
+async function deleteArtifact(dir, relPath) {
+  const full = join(dir, relPath);
+  try {
+    await unlink(full);
+  } catch {
+    return;
+  }
+  let parent = dirname(full);
+  while (parent.length > dir.length && parent.startsWith(dir + sep)) {
+    try {
+      await rmdir(parent);
+    } catch {
+      return;
+    }
+    parent = dirname(parent);
+  }
+}
+async function listArtifacts(dir) {
+  const out = [];
+  const walk = async (current, prefix) => {
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+      if (entry.isDirectory())
+        await walk(join(current, entry.name), rel);
+      else if (entry.isFile())
+        out.push(rel);
+    }
+  };
+  await walk(dir, "");
+  return out;
+}
+// packages/store/src/sqlite/bodies.ts
+function toDetailState(value) {
+  return value === "ready" || value === "missing" || value === "corrupt" ? value : "none";
+}
+var toRow = (r) => ({
+  requestId: r.request_id,
+  at: r.at,
+  relPath: r.rel_path,
+  sizeBytes: r.size_bytes,
+  sha256: r.sha256,
+  detailState: toDetailState(r.detail_state),
+  truncated: r.truncated === 1
+});
+function createBodyRepo(db, key, dir) {
+  const removeRows = async (rows) => {
+    for (const row of rows) {
+      if (row.relPath !== null)
+        await deleteArtifact(dir, row.relPath);
+    }
+    const remove = db.prepare("DELETE FROM request_bodies WHERE request_id = ?");
+    db.transaction(() => {
+      for (const row of rows)
+        remove.run(row.requestId);
+    })();
+    return rows.length;
+  };
+  const recordState = (requestId, state) => {
+    db.run("UPDATE request_bodies SET detail_state = ? WHERE request_id = ?", [state, requestId]);
+  };
+  return {
+    async put(artifact) {
+      if (!isSafeRequestId(artifact.requestId)) {
+        throw new Error("request id is not safe to use as an artifact path segment");
+      }
+      const prepared = prepareArtifact(artifact);
+      const sealed = await sealArtifact(key, prepared.json);
+      const relPath = relPathFor(artifact.requestId, artifact.at);
+      await writeArtifact(dir, relPath, sealed.bytes);
+      const truncated = prepared.artifact.client.truncated || prepared.artifact.attempts.some((attempt) => attempt.truncated);
+      const row = {
+        requestId: artifact.requestId,
+        at: artifact.at,
+        relPath,
+        sizeBytes: sealed.bytes.length,
+        sha256: sealed.sha256,
+        detailState: "ready",
+        truncated
+      };
+      db.run(`INSERT INTO request_bodies (request_id, at, rel_path, size_bytes, sha256, detail_state, truncated)
+         VALUES (?,?,?,?,?,?,?)
+         ON CONFLICT (request_id) DO UPDATE SET
+           at = excluded.at,
+           rel_path = excluded.rel_path,
+           size_bytes = excluded.size_bytes,
+           sha256 = excluded.sha256,
+           detail_state = excluded.detail_state,
+           truncated = excluded.truncated`, [
+        row.requestId,
+        row.at,
+        row.relPath,
+        row.sizeBytes,
+        row.sha256,
+        row.detailState,
+        row.truncated ? 1 : 0
+      ]);
+      return row;
+    },
+    async get(requestId) {
+      const found = db.query("SELECT * FROM request_bodies WHERE request_id = ?").get(requestId);
+      if (found === null)
+        return null;
+      const row = toRow(found);
+      if (row.relPath === null || row.detailState === "none")
+        return { row, artifact: null };
+      const read = await readArtifact(key, dir, row.relPath, row.sha256);
+      if (read.ok) {
+        if (row.detailState !== "ready")
+          recordState(requestId, "ready");
+        return { row: { ...row, detailState: "ready" }, artifact: read.artifact };
+      }
+      recordState(requestId, read.failure);
+      return { row: { ...row, detailState: read.failure }, artifact: null };
+    },
+    async prune(olderThan) {
+      const rows = db.query("SELECT * FROM request_bodies WHERE at < ?").all(olderThan).map(toRow);
+      return removeRows(rows);
+    },
+    async pruneToCap(cap = BODY_ROW_CAP) {
+      const total = db.query("SELECT COUNT(*) AS n FROM request_bodies").get()?.n ?? 0;
+      if (total <= cap)
+        return 0;
+      const rows = db.query("SELECT * FROM request_bodies ORDER BY at ASC, request_id ASC LIMIT ?").all(total - cap).map(toRow);
+      return removeRows(rows);
+    },
+    async sweepOrphans() {
+      const known = new Set(db.query("SELECT rel_path FROM request_bodies WHERE rel_path IS NOT NULL").all().map((r) => r.rel_path));
+      const claimed = db.query("SELECT COUNT(*) AS n FROM request_bodies WHERE rel_path = ?");
+      let removed = 0;
+      for (const rel of await listArtifacts(dir)) {
+        if (known.has(rel))
+          continue;
+        if ((claimed.get(rel)?.n ?? 0) > 0)
+          continue;
+        await deleteArtifact(dir, rel);
+        removed += 1;
+      }
+      return removed;
+    }
+  };
+}
 // packages/store/src/sqlite/config.ts
 var SETTINGS_KEY = "settings";
 var ADMIN_HASH_KEY = "adminPasswordHash";
@@ -23841,6 +24286,8 @@ function createConfigRepo(db, emit = () => {}) {
           ...DEFAULT_SETTINGS,
           ...stored,
           rtkEnabled: stored.rtkEnabled === true,
+          bodyLoggingEnabled: stored.bodyLoggingEnabled === true,
+          bodyLoggingCaptureStreamChunks: stored.bodyLoggingCaptureStreamChunks === true,
           weights: knownWeights(stored.weights)
         };
       } catch {
@@ -23871,6 +24318,29 @@ function createConfigRepo(db, emit = () => {}) {
   };
 }
 // packages/store/src/sqlite/credentials.ts
+function toHealth(r) {
+  return {
+    credentialId: r.credential_id,
+    model: r.model,
+    breakerState: r.breaker_state,
+    consecutiveFailures: r.consecutive_failures,
+    openedAt: r.opened_at,
+    rateLimitedUntil: r.rate_limited_until,
+    ewmaTtftMs: r.ewma_ttft_ms,
+    lastUsedAt: r.last_used_at
+  };
+}
+var UPSERT_HEALTH = `INSERT INTO credential_health
+   (credential_id, model, breaker_state, consecutive_failures, opened_at,
+    rate_limited_until, ewma_ttft_ms, last_used_at)
+ VALUES (?,?,?,?,?,?,?,?)
+ ON CONFLICT (credential_id, model) DO UPDATE SET
+   breaker_state = excluded.breaker_state,
+   consecutive_failures = excluded.consecutive_failures,
+   opened_at = excluded.opened_at,
+   rate_limited_until = excluded.rate_limited_until,
+   ewma_ttft_ms = excluded.ewma_ttft_ms,
+   last_used_at = excluded.last_used_at`;
 function createCredentialRepo(db, key, emit = () => {}) {
   const open = async (v) => v === null ? null : decrypt(key, v);
   const secretsFrom = async (row) => ({
@@ -24045,29 +24515,10 @@ function createCredentialRepo(db, key, emit = () => {}) {
       emit({ type: "credentialsChanged" });
     },
     async listHealth() {
-      return db.query("SELECT * FROM credential_health").all().map((r) => ({
-        credentialId: r.credential_id,
-        model: r.model,
-        breakerState: r.breaker_state,
-        consecutiveFailures: r.consecutive_failures,
-        openedAt: r.opened_at,
-        rateLimitedUntil: r.rate_limited_until,
-        ewmaTtftMs: r.ewma_ttft_ms,
-        lastUsedAt: r.last_used_at
-      }));
+      return db.query("SELECT * FROM credential_health").all().map(toHealth);
     },
     async saveHealth(rows) {
-      const stmt = db.prepare(`INSERT INTO credential_health
-           (credential_id, model, breaker_state, consecutive_failures, opened_at,
-            rate_limited_until, ewma_ttft_ms, last_used_at)
-         VALUES (?,?,?,?,?,?,?,?)
-         ON CONFLICT (credential_id, model) DO UPDATE SET
-           breaker_state = excluded.breaker_state,
-           consecutive_failures = excluded.consecutive_failures,
-           opened_at = excluded.opened_at,
-           rate_limited_until = excluded.rate_limited_until,
-           ewma_ttft_ms = excluded.ewma_ttft_ms,
-           last_used_at = excluded.last_used_at`);
+      const stmt = db.prepare(UPSERT_HEALTH);
       db.transaction(() => {
         for (const r of rows) {
           stmt.run(r.credentialId, r.model, r.breakerState, r.consecutiveFailures, r.openedAt, r.rateLimitedUntil, r.ewmaTtftMs, r.lastUsedAt);
@@ -24075,6 +24526,18 @@ function createCredentialRepo(db, key, emit = () => {}) {
       })();
       emit({ type: "healthSaved", rows });
     },
+    async updateHealth(credentialId, model, apply) {
+      const current = db.prepare("SELECT * FROM credential_health WHERE credential_id = ? AND model = ?");
+      const stmt = db.prepare(UPSERT_HEALTH);
+      const written = db.transaction(() => {
+        const row = current.get(credentialId, model);
+        const next = apply(row === null ? null : toHealth(row));
+        stmt.run(next.credentialId, next.model, next.breakerState, next.consecutiveFailures, next.openedAt, next.rateLimitedUntil, next.ewmaTtftMs, next.lastUsedAt);
+        return next;
+      })();
+      emit({ type: "healthSaved", rows: [written] });
+      return written;
+    },
     async listQuota() {
       return db.query("SELECT * FROM quota_windows").all().map((r) => ({
         credentialId: r.credential_id,
@@ -24386,7 +24849,186 @@ CREATE INDEX quota_samples_observed ON quota_samples (observed_at);
 ALTER TABLE quota_windows ADD COLUMN window_ms INTEGER;
 `;
 
+// packages/store/src/sqlite/migrations/008_body_logging.sql
+var _008_body_logging_default = `-- Captured request and response bodies, and the api key opt-out that suppresses
+-- them.
+--
+-- The row holds a pointer, never a body. Bodies are the largest thing this
+-- gateway could ever store \u2014 a single conversation with a pasted file in it
+-- dwarfs the whole of \`request_logs\` \u2014 and SQLite would carry every one of them
+-- through the same page cache, the same WAL, and the same backup that the
+-- routing tables live in. A prompt corpus inlined here would make the operating
+-- database grow without bound, make every \`VACUUM\` copy it, and put plaintext
+-- rows one \`sqlite3\` invocation away. The artifact instead lives at
+-- \`<dirname(databasePath)>/request_bodies/YYYY/MM/DD/<request_id>.json.enc\`,
+-- encrypted under the same key as provider credentials, and this row records
+-- only where it is and whether it can still be trusted. OmniRoute reached the
+-- same layout the expensive way: its \`call_logs_v1_legacy\` table exists purely
+-- to drain inline blobs it had already shipped into file artifacts.
+--
+-- \`rel_path\` is relative so moving an installation does not invalidate every
+-- row, and nullable because a row can exist with no artifact behind it: capture
+-- may have been suppressed, or the file may have been swept.
+--
+-- \`sha256\` is taken over the bytes as stored \u2014 the ciphertext \u2014 not over the
+-- plaintext. Truncation or bit-rot on disk is then detectable by a reader that
+-- does not hold \`OMNI_ENCRYPTION_KEY\` at all, which is what makes \`corrupt\` a
+-- state the reader can report rather than an exception it has to raise.
+--
+-- \`detail_state\` is one of \`none\`, \`ready\`, \`missing\`, or \`corrupt\`. A file tree
+-- and a table it is not written to transactionally will drift \u2014 a crash between
+-- the two writes is enough \u2014 so the reader records what it observed and hands
+-- back the metadata. \`missing\` and \`corrupt\` are answers, not failures.
+--
+-- \`truncated\` is set when structural bounding altered anything, so a reader can
+-- say "this is not the whole payload" without diffing it against nothing.
+--
+-- No foreign key to \`request_logs\`. Expiry is performed explicitly, deleting the
+-- file and the row together, because \`ON DELETE CASCADE\` only fires while the
+-- \`foreign_keys\` pragma is on: a pragma silently off would turn expiry of a
+-- prompt corpus into indefinite retention of one, and that failure is invisible
+-- until someone goes looking.
+CREATE TABLE request_bodies (
+  request_id   TEXT PRIMARY KEY,
+  at           INTEGER NOT NULL,
+  rel_path     TEXT,
+  size_bytes   INTEGER NOT NULL DEFAULT 0,
+  sha256       TEXT,
+  detail_state TEXT NOT NULL DEFAULT 'none',
+  truncated    INTEGER NOT NULL DEFAULT 0
+);
+
+-- Descending, because every read of this table is time-ordered from the newest
+-- end: the retention sweep walks the oldest rows and the row cap walks them in
+-- the same direction, and the console only ever asks about recent requests.
+CREATE INDEX idx_request_bodies_at ON request_bodies (at DESC);
+
+-- Per-key suppression, checked before any capture work begins.
+--
+-- A shared installation can be serving one client whose payloads must not be
+-- retained while capturing everything else, and that client's operator cannot be
+-- asked to trust a global switch they do not control. Default 0 keeps every
+-- existing key on the installation-wide setting, which is itself off by default.
+ALTER TABLE api_keys ADD COLUMN body_logging_opt_out INTEGER NOT NULL DEFAULT 0;
+`;
+
+// packages/store/src/sqlite/migrations/009_key_limits.sql
+var _009_key_limits_default = `-- Per-key limits as a sparse \`(dimension, window)\` matrix, replacing the single
+-- requests-per-minute integer.
+--
+-- One JSON column rather than a column per pair, because the matrix is sparse
+-- and the pairs are not fixed: \`requests\` and \`tokens\` are meaningful at all
+-- three windows, \`spend\` only at the two long ones, and \`concurrency\` is a gauge
+-- with no window at all. Twelve mostly-null integer columns would encode the
+-- same thing while making every future pair a migration.
+--
+-- The JSON keys are a storage contract in the same class as \`RTK_FILTER_IDS\`:
+-- the dimension and window names are persisted in every row, so adding a name is
+-- free and renaming or removing one loses data. Unlike RTK ids, which are
+-- dropped silently on read, an unknown limit key is a parse failure \u2014 a limit
+-- the gateway cannot understand must never be read as "no limit", because that
+-- fails open on a control the operator explicitly set.
+--
+-- \`NOT NULL DEFAULT '{}'\` rather than nullable, so "unlimited" has exactly one
+-- spelling at the column level and every reader parses the same shape.
+ALTER TABLE api_keys ADD COLUMN limits TEXT NOT NULL DEFAULT '{}';
+
+-- The old ceiling was requests per minute and nothing else, so it lands whole in
+-- \`requests["1m"]\`. A NULL meant unlimited and stays unlimited as the default
+-- \`{}\`: an absent key and an explicit null both mean the same thing, and the
+-- empty object is the shape a newly minted key starts at.
+--
+-- Only a value the reader accepts is carried over. \`rate_limit_per_min\` was
+-- \`INTEGER\` with no \`CHECK\`, so a hand-edited install can hold \`0\`, \`-5\` or
+-- \`1.5\` in it, while the new schema is \`z.number().int().positive()\`. Backfilled
+-- unconditionally, each of those writes a matrix \`parseLimitConfig\` refuses \u2014
+-- which is \`limits: null\`, which is every request for that key answered
+-- \`INTERNAL\` at the auth chokepoint. An upgrade must not manufacture the
+-- unreadable row the design describes as arising only from meddling.
+--
+-- Anything else stays at the \`{}\` default, which is unlimited: a ceiling that
+-- was already nonsense bounded nothing before this migration either, so
+-- dropping it changes no behaviour and leaves the key serving.
+--
+-- \`typeof()\` rather than a range test alone. SQLite's INTEGER affinity is a
+-- preference, not a constraint: \`1.5\` stays REAL and \`'sixty'\` stays TEXT, and
+-- TEXT sorts above every number so a bare \`> 0\` would admit the string.
+UPDATE api_keys
+   SET limits = json_object('requests', json_object('1m', rate_limit_per_min))
+ WHERE typeof(rate_limit_per_min) = 'integer'
+   AND rate_limit_per_min > 0;
+
+ALTER TABLE api_keys DROP COLUMN rate_limit_per_min;
+
+-- Correctness-adjacent, not an optimisation, and it must not be dropped later as
+-- redundant with \`idx_request_logs_at\`.
+--
+-- \`request_logs\` leads its existing indexes with \`at\` and with \`credential_id\`;
+-- nothing leads with \`api_key_id\`. A sliding weekly sum for one key against
+-- \`idx_request_logs_at\` scans every row in the week for every key on the
+-- install, and that scan sits on the request hot path.
+--
+-- Composite order matters: \`(api_key_id, at DESC)\` lets the range scan start at
+-- the key. \`(at DESC, api_key_id)\` does not.
+CREATE INDEX idx_request_logs_key_at ON request_logs (api_key_id, at DESC);
+`;
+
+// packages/store/src/sqlite/migrations/010_usage_rollup.sql
+var _010_usage_rollup_default = `-- Per-key hourly counters, so a long sliding window is read rather than scanned.
+--
+-- \`sumSince\` is on the admission path of every request, and \`bun:sqlite\` is
+-- synchronous: a \`SELECT SUM\` over a week of one key's rows blocks the entire
+-- event loop for its duration \u2014 \`/health\`, \`/api/*\`, the quiesce latch, and
+-- every other key's traffic with it. Measured on one machine, one key, WAL:
+-- 149ms at 0.2M rows in the window, 2.1s at 2M, 10.8s at 8M. The cost is
+-- O(accumulated history) and has no ceiling, and the eager-refresh rule makes it
+-- worst exactly when a key is busiest \u2014 a key inside the last tenth of a long
+-- ceiling reads through on every admission. The same reads against this table
+-- are flat at ~0.017ms, because a week is 168 buckets however much traffic each
+-- one summarises.
+--
+-- This reverses the design's own rejection of a counter table, and the reason it
+-- can be reversed is that this table is *derived*. \`request_logs\` stays the
+-- source of truth; every figure here is reproducible from it by one grouped
+-- select. The original objection was that a counter table can disagree with the
+-- log and nobody can tell which is right \u2014 that objection is answered by there
+-- being a rebuild, a restore that runs it, and a \`doctor\` check that compares
+-- the two. It would not be answered by care.
+--
+-- \`hour\` is \`at / 3600000\`, floored, and every SQL side spells that
+-- \`CAST(at / 3600000 AS INTEGER)\`. The cast is not decoration: nothing validates
+-- \`at\`, and SQLite's \`/\` is integer division only when both operands are
+-- integers, so a fractional \`at\` would give this INTEGER column a REAL key that
+-- no later integer-hour write ever merges with. Truncation toward zero and
+-- JavaScript's \`Math.floor\` then agree on every epoch this side of 1970, which
+-- is every epoch a request log holds.
+--
+-- \`api_key_id\` is NOT NULL and anonymous rows are left out: a WITHOUT ROWID
+-- primary key cannot hold a NULL, and nothing reads this table except a per-key
+-- lookup that could never match one.
+CREATE TABLE usage_rollup (
+  api_key_id         TEXT NOT NULL,
+  hour               INTEGER NOT NULL,
+  requests           INTEGER NOT NULL DEFAULT 0,
+  input_tokens       INTEGER NOT NULL DEFAULT 0,
+  output_tokens      INTEGER NOT NULL DEFAULT 0,
+  cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+  cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+  cost_usd           REAL NOT NULL DEFAULT 0,
+  PRIMARY KEY (api_key_id, hour)
+) WITHOUT ROWID;
+
+-- The backfill is this migration's \`after\` hook rather than an INSERT here, and
+-- it is the same \`rebuildRollup\` a restore runs. Seeding an existing install and
+-- repairing a suspect one are the same statement, so they are the same code and
+-- cannot drift into disagreeing about which rows count.
+`;
+
 // packages/store/src/sqlite/rollup.ts
+var HOUR_MS = 3600000;
+function hourOf(at) {
+  return Math.floor(at / HOUR_MS);
+}
 function startOfLocalDay(at) {
   const day = new Date(at);
   day.setHours(0, 0, 0, 0);
@@ -24495,6 +25137,88 @@ function backfillDaily(db) {
     upsert(db, group.key, group.counters);
   return groups.size;
 }
+var HOURLY_UPSERT = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  VALUES (?,?,?,?,?,?,?,?)
+  ON CONFLICT (api_key_id, hour)
+  DO UPDATE SET
+    requests           = requests + excluded.requests,
+    input_tokens       = input_tokens + excluded.input_tokens,
+    output_tokens      = output_tokens + excluded.output_tokens,
+    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
+    cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens,
+    cost_usd           = cost_usd + excluded.cost_usd`;
+function rollupHour(db, log) {
+  const apiKeyId = log.apiKeyId;
+  if (apiKeyId === null)
+    return;
+  db.run(HOURLY_UPSERT, [
+    apiKeyId,
+    hourOf(log.at),
+    1,
+    log.inputTokens,
+    log.outputTokens,
+    log.cacheReadTokens,
+    log.cacheWriteTokens,
+    log.costUsd
+  ]);
+}
+var REBUILD = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  SELECT api_key_id,
+         CAST(at / 3600000 AS INTEGER),
+         COUNT(*),
+         COALESCE(SUM(input_tokens), 0),
+         COALESCE(SUM(output_tokens), 0),
+         COALESCE(SUM(cache_read_tokens), 0),
+         COALESCE(SUM(cache_write_tokens), 0),
+         COALESCE(SUM(cost_usd), 0)
+    FROM request_logs
+   WHERE state = 'done' AND api_key_id IS NOT NULL
+   GROUP BY api_key_id, CAST(at / 3600000 AS INTEGER)`;
+function rebuildRollup(db) {
+  db.run("DELETE FROM usage_rollup");
+  db.run(REBUILD);
+}
+function auditRollup(db) {
+  const row = db.query(`WITH truth AS (
+         SELECT api_key_id AS k,
+                CAST(at / 3600000 AS INTEGER) AS h,
+                COUNT(*) AS requests,
+                COALESCE(SUM(input_tokens), 0) AS input_tokens,
+                COALESCE(SUM(output_tokens), 0) AS output_tokens,
+                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+                COALESCE(SUM(cost_usd), 0) AS cost_usd
+           FROM request_logs
+          WHERE state = 'done' AND api_key_id IS NOT NULL
+          GROUP BY k, h
+       )
+       SELECT (SELECT COUNT(*) FROM truth) AS buckets,
+              (SELECT COUNT(*)
+                 FROM truth
+                 LEFT JOIN usage_rollup r ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE r.api_key_id IS NULL
+                   OR r.requests <> truth.requests
+                   OR r.input_tokens <> truth.input_tokens
+                   OR r.output_tokens <> truth.output_tokens
+                   OR r.cache_read_tokens <> truth.cache_read_tokens
+                   OR r.cache_write_tokens <> truth.cache_write_tokens
+                   OR ABS(r.cost_usd - truth.cost_usd) > 1e-9 + ABS(truth.cost_usd) * 1e-9
+              ) AS mismatched,
+              (SELECT COUNT(*)
+                 FROM usage_rollup r
+                 LEFT JOIN truth ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE truth.k IS NULL
+              ) AS orphans`).get();
+  const buckets = row?.buckets ?? 0;
+  const mismatched = (row?.mismatched ?? 0) + (row?.orphans ?? 0);
+  return { buckets, mismatched, ok: mismatched === 0 };
+}
 function backfillRtkUsage(db) {
   const groups = new Map;
   for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
@@ -24531,7 +25255,10 @@ var MIGRATIONS = [
   { id: 4, sql: _004_request_state_default },
   { id: 5, sql: _005_rtk_metrics_default },
   { id: 6, sql: _006_rtk_usage_default, after: backfillRtkUsage },
-  { id: 7, sql: _007_quota_samples_default }
+  { id: 7, sql: _007_quota_samples_default },
+  { id: 8, sql: _008_body_logging_default },
+  { id: 9, sql: _009_key_limits_default },
+  { id: 10, sql: _010_usage_rollup_default, after: rebuildRollup }
 ];
 function openDb(path) {
   const db = new Database(path, { create: true });
@@ -24562,44 +25289,128 @@ async function hashApiKey(raw) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
-var toKey = (r) => ({
+function parseLimits(id, raw, logger2) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parseLimitConfig(parsed);
+  } catch {
+    logger2.error("api key limits unreadable", { apiKeyId: id });
+    return null;
+  }
+}
+var toKey = (r, logger2) => ({
   id: r.id,
   label: r.label,
   prefix: r.prefix,
   hash: r.hash,
   modelAllowlist: r.model_allowlist === null ? null : JSON.parse(r.model_allowlist),
-  rateLimitPerMin: r.rate_limit_per_min,
+  limits: parseLimits(r.id, r.limits, logger2),
+  bodyLoggingOptOut: r.body_logging_opt_out === 1,
   createdAt: r.created_at,
   revokedAt: r.revoked_at
 });
-function createKeyRepo(db) {
+function createKeyRepo(db, logger2 = noopLogger) {
   return {
     async list() {
-      return db.query("SELECT * FROM api_keys ORDER BY created_at DESC").all().map(toKey);
+      return db.query("SELECT * FROM api_keys ORDER BY created_at DESC").all().map((row) => toKey(row, logger2));
     },
     async findByHash(hash3) {
       const row = db.query("SELECT * FROM api_keys WHERE hash = ?").get(hash3);
-      return row ? toKey(row) : null;
+      return row ? toKey(row, logger2) : null;
     },
     async create(input) {
       const now = Date.now();
-      db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, rate_limit_per_min, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,NULL)`, [
+      db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
+                               body_logging_opt_out, created_at, revoked_at)
+         VALUES (?,?,?,?,?,?,?,?,NULL)`, [
         input.id,
         input.label,
         input.prefix,
         input.hash,
         input.modelAllowlist === null ? null : JSON.stringify(input.modelAllowlist),
-        input.rateLimitPerMin,
+        JSON.stringify(parseLimitConfig(input.limits)),
+        input.bodyLoggingOptOut ? 1 : 0,
         now
       ]);
       return { ...input, createdAt: now, revokedAt: null };
     },
+    async setLimits(id, limits) {
+      db.run("UPDATE api_keys SET limits = ? WHERE id = ?", [
+        JSON.stringify(parseLimitConfig(limits)),
+        id
+      ]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
   };
 }
+// packages/store/src/sqlite/maintenance.ts
+import { Database as Database2 } from "bun:sqlite";
+var REQUIRED_TABLES = [
+  "api_keys",
+  "credential_health",
+  "credentials",
+  "migrations",
+  "quota_windows",
+  "request_logs",
+  "settings",
+  "virtual_models"
+];
+var UNREADABLE = "unreadable";
+function sqlLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function createMaintenanceRepo(db) {
+  return {
+    async stats() {
+      const pageSize = db.query("PRAGMA page_size").get();
+      const pageCount = db.query("PRAGMA page_count").get();
+      const freelist = db.query("PRAGMA freelist_count").get();
+      const version2 = db.query("SELECT MAX(id) AS version FROM migrations").get();
+      return {
+        pageSize: pageSize?.page_size ?? 0,
+        pageCount: pageCount?.page_count ?? 0,
+        freelistCount: freelist?.freelist_count ?? 0,
+        schemaVersion: version2?.version ?? 0
+      };
+    },
+    async vacuum() {
+      db.run("VACUUM");
+      db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+    },
+    async snapshotTo(path) {
+      db.run(`VACUUM INTO ${sqlLiteral(path)}`);
+    },
+    async inspect(path) {
+      let file2;
+      try {
+        file2 = new Database2(path, { readonly: true });
+      } catch {
+        return { ok: false, quickCheck: UNREADABLE, tables: [], counts: {} };
+      }
+      try {
+        const problems = file2.query("PRAGMA quick_check").all();
+        const quickCheck = problems[0]?.quick_check ?? UNREADABLE;
+        const tables = file2.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' " + "ORDER BY name").all().map((r) => r.name);
+        const present = new Set(tables);
+        const counts = {};
+        for (const table of REQUIRED_TABLES) {
+          if (!present.has(table))
+            continue;
+          const n = file2.query(`SELECT COUNT(*) AS n FROM ${table}`).get();
+          counts[table] = n?.n ?? 0;
+        }
+        const complete = REQUIRED_TABLES.every((t) => present.has(t));
+        return { ok: quickCheck === "ok" && complete, quickCheck, tables, counts };
+      } catch {
+        return { ok: false, quickCheck: UNREADABLE, tables: [], counts: {} };
+      } finally {
+        file2.close();
+      }
+    }
+  };
+}
 // packages/rtk/src/catalog.ts
 var RTK_FILTER_IDS = [
   "git-diff",
@@ -24666,7 +25477,7 @@ var GROUP_COLUMN = {
     requestedModel: "requested_model",
     apiKey: "api_key_id",
     provider: "resolved_provider",
-    hour: "at / 3600000",
+    hour: "CAST(at / 3600000 AS INTEGER)",
     day: null
   },
   daily: {
@@ -24763,8 +25574,30 @@ function createUsageRepo(db) {
   const complete = db.transaction((log) => {
     db.run(COMPLETE, values(log, "done"));
     const stored = db.query("SELECT * FROM request_logs WHERE id = ?").get(log.id);
-    if (stored !== null)
-      rollupLog(db, toLog(stored));
+    if (stored !== null) {
+      const restored = toLog(stored);
+      rollupLog(db, restored);
+      rollupHour(db, restored);
+    }
+  });
+  const pruneLogs = db.transaction((olderThan) => {
+    db.run("DELETE FROM request_logs WHERE at < ?", [olderThan]);
+    const removed = db.query("SELECT changes() AS n").get()?.n ?? 0;
+    const boundary = hourOf(olderThan);
+    db.run("DELETE FROM usage_rollup WHERE hour <= ?", [boundary]);
+    db.run(`INSERT INTO usage_rollup
+         (api_key_id, hour, requests, input_tokens, output_tokens,
+          cache_read_tokens, cache_write_tokens, cost_usd)
+       SELECT api_key_id, ?, COUNT(*),
+              COALESCE(SUM(input_tokens), 0),
+              COALESCE(SUM(output_tokens), 0),
+              COALESCE(SUM(cache_read_tokens), 0),
+              COALESCE(SUM(cache_write_tokens), 0),
+              COALESCE(SUM(cost_usd), 0)
+         FROM request_logs
+        WHERE state = 'done' AND api_key_id IS NOT NULL AND at >= ? AND at < ?
+        GROUP BY api_key_id`, [boundary, boundary * HOUR_MS, (boundary + 1) * HOUR_MS]);
+    return removed;
   });
   return {
     async begin(log) {
@@ -24788,6 +25621,38 @@ function createUsageRepo(db) {
     async recent(limit) {
       return db.query("SELECT * FROM request_logs ORDER BY at DESC LIMIT ?").all(limit).map(toLog);
     },
+    async sumSince(apiKeyId, sinceMs) {
+      const boundary = hourOf(sinceMs);
+      const whole = db.query(`SELECT COALESCE(SUM(requests), 0) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM usage_rollup
+            WHERE api_key_id = ? AND hour > ?`).get(apiKeyId, boundary);
+      const edge = db.query(`SELECT COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = ? AND state = 'done' AND at >= ? AND at < ?`).get(apiKeyId, sinceMs, (boundary + 1) * HOUR_MS);
+      return {
+        requests: (whole?.requests ?? 0) + (edge?.requests ?? 0),
+        tokens: (whole?.tokens ?? 0) + (edge?.tokens ?? 0),
+        costUsd: (whole?.cost_usd ?? 0) + (edge?.cost_usd ?? 0)
+      };
+    },
+    async rebuildRollup() {
+      rebuildRollup(db);
+    },
+    async auditRollup() {
+      return auditRollup(db);
+    },
+    async oldestSince(apiKeyId, sinceMs) {
+      const row = db.query(`SELECT MIN(at) AS at
+             FROM request_logs
+            WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs);
+      return row?.at ?? null;
+    },
     async aggregate(q) {
       const grain = q.grain ?? "raw";
       const daily = grain === "daily";
@@ -24828,8 +25693,7 @@ function createUsageRepo(db) {
       });
     },
     async prune(olderThan) {
-      db.run("DELETE FROM request_logs WHERE at < ?", [olderThan]);
-      return db.query("SELECT changes() AS n").get()?.n ?? 0;
+      return pruneLogs(olderThan);
     },
     async pruneDaily(olderThan) {
       db.run("DELETE FROM usage_daily WHERE day < ?", [olderThan]);
@@ -24841,8 +25705,6 @@ function createUsageRepo(db) {
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
   const logger2 = opts.logger ?? noopLogger;
-  const db = openDb(opts.path);
-  logger2.debug("store opened", { path: opts.path });
   const listeners = new Set;
   const emit = (change) => {
     for (const listener of listeners) {
@@ -24851,23 +25713,106 @@ async function createStore(opts) {
       } catch {}
     }
   };
+  const open = () => {
+    const db = openDb(opts.path);
+    logger2.debug("store opened", { path: opts.path });
+    return {
+      db,
+      credentials: createCredentialRepo(db, opts.encryptionKey, emit),
+      config: createConfigRepo(db, emit),
+      keys: createKeyRepo(db, logger2),
+      usage: createUsageRepo(db),
+      bodies: createBodyRepo(db, opts.encryptionKey, bodiesDirFor(opts.path)),
+      maintenance: createMaintenanceRepo(db)
+    };
+  };
+  let handle = open();
+  let live = true;
+  const closeHandle = () => {
+    if (!live)
+      return;
+    handle.db.close();
+    live = false;
+  };
   return {
-    credentials: createCredentialRepo(db, opts.encryptionKey, emit),
-    config: createConfigRepo(db, emit),
-    keys: createKeyRepo(db),
-    usage: createUsageRepo(db),
+    databasePath: opts.path,
+    credentials: {
+      list: () => handle.credentials.list(),
+      listRouting: () => handle.credentials.listRouting(),
+      get: (id) => handle.credentials.get(id),
+      create: (input) => handle.credentials.create(input),
+      update: (id, patch) => handle.credentials.update(id, patch),
+      updateSecrets: (id, secrets, expiresAt) => handle.credentials.updateSecrets(id, secrets, expiresAt),
+      remove: (id) => handle.credentials.remove(id),
+      listHealth: () => handle.credentials.listHealth(),
+      saveHealth: (rows) => handle.credentials.saveHealth(rows),
+      updateHealth: (id, model, apply) => handle.credentials.updateHealth(id, model, apply),
+      listQuota: () => handle.credentials.listQuota(),
+      saveQuota: (rows) => handle.credentials.saveQuota(rows),
+      listQuotaSamples: (q) => handle.credentials.listQuotaSamples(q),
+      pruneQuotaSamples: (olderThan) => handle.credentials.pruneQuotaSamples(olderThan)
+    },
+    config: {
+      listModels: () => handle.config.listModels(),
+      putModel: (model) => handle.config.putModel(model),
+      removeModel: (id) => handle.config.removeModel(id),
+      getSettings: () => handle.config.getSettings(),
+      putSettings: (patch) => handle.config.putSettings(patch),
+      getAdminPasswordHash: () => handle.config.getAdminPasswordHash(),
+      setAdminPasswordHashIfAbsent: (hash3) => handle.config.setAdminPasswordHashIfAbsent(hash3),
+      setAdminPasswordHash: (hash3) => handle.config.setAdminPasswordHash(hash3)
+    },
+    keys: {
+      list: () => handle.keys.list(),
+      findByHash: (hash3) => handle.keys.findByHash(hash3),
+      create: (input) => handle.keys.create(input),
+      setLimits: (id, limits) => handle.keys.setLimits(id, limits),
+      revoke: (id) => handle.keys.revoke(id)
+    },
+    usage: {
+      begin: (log) => handle.usage.begin(log),
+      route: (id, target) => handle.usage.route(id, target),
+      append: (log) => handle.usage.append(log),
+      sweepPending: () => handle.usage.sweepPending(),
+      recent: (limit) => handle.usage.recent(limit),
+      aggregate: (q) => handle.usage.aggregate(q),
+      sumSince: (apiKeyId, sinceMs) => handle.usage.sumSince(apiKeyId, sinceMs),
+      oldestSince: (apiKeyId, sinceMs) => handle.usage.oldestSince(apiKeyId, sinceMs),
+      rebuildRollup: () => handle.usage.rebuildRollup(),
+      auditRollup: () => handle.usage.auditRollup(),
+      prune: (olderThan) => handle.usage.prune(olderThan),
+      pruneDaily: (olderThan) => handle.usage.pruneDaily(olderThan)
+    },
+    bodies: {
+      put: (artifact) => handle.bodies.put(artifact),
+      get: (requestId) => handle.bodies.get(requestId),
+      prune: (olderThan) => handle.bodies.prune(olderThan),
+      pruneToCap: (cap) => handle.bodies.pruneToCap(cap),
+      sweepOrphans: () => handle.bodies.sweepOrphans()
+    },
+    maintenance: {
+      stats: () => handle.maintenance.stats(),
+      vacuum: () => handle.maintenance.vacuum(),
+      snapshotTo: (path) => handle.maintenance.snapshotTo(path),
+      inspect: (path) => handle.maintenance.inspect(path)
+    },
     routing: {
-      version: () => db.query("PRAGMA data_version").get()?.data_version ?? 0,
+      version: () => handle.db.query("PRAGMA data_version").get()?.data_version ?? 0,
       subscribe(listener) {
         listeners.add(listener);
         return () => listeners.delete(listener);
       }
     },
-    close: () => db.close()
+    async reopen() {
+      closeHandle();
+      handle = open();
+      live = true;
+    },
+    close: closeHandle
   };
 }
 // packages/control/src/quota/burn.ts
-var HOUR_MS = 3600000;
+var HOUR_MS2 = 3600000;
 function windowStartOf(window2) {
   if (window2.resetsAt === null)
     return null;
@@ -24890,9 +25835,9 @@ function burnFor(window2, input) {
   }
   const windowStartsAt = windowStartOf(window2);
   const elapsedMs = windowStartsAt === null ? null : window2.observedAt - windowStartsAt;
-  const elapsedHours = elapsedMs === null ? null : elapsedMs / HOUR_MS;
+  const elapsedHours = elapsedMs === null ? null : elapsedMs / HOUR_MS2;
   const ratePerHour = elapsedHours === null ? null : elapsedHours <= 0 || window2.used === 0 ? 0 : window2.used / elapsedHours;
-  const exhaustsAt = window2.limit === null || ratePerHour === null || ratePerHour <= 0 ? null : window2.observedAt + Math.max(0, window2.limit - window2.used) / ratePerHour * HOUR_MS;
+  const exhaustsAt = window2.limit === null || ratePerHour === null || ratePerHour <= 0 ? null : window2.observedAt + Math.max(0, window2.limit - window2.used) / ratePerHour * HOUR_MS2;
   return {
     credentialId: window2.credentialId,
     windowType: window2.windowType,
@@ -25031,6 +25976,313 @@ async function patchCredential(deps, id, input) {
 async function removeCredential(store, id) {
   await store.credentials.remove(id);
 }
+// packages/control/src/database.ts
+import { basename, dirname as dirname2, join as join2, resolve } from "path";
+var exclusive = null;
+async function withExclusive(label2, operation) {
+  if (exclusive !== null) {
+    throw new GatewayError("CONFLICT", `${exclusive} is already running on this database`);
+  }
+  exclusive = label2;
+  try {
+    return await operation();
+  } finally {
+    exclusive = null;
+  }
+}
+async function withExclusiveOrSkip(label2, operation) {
+  if (exclusive !== null)
+    return null;
+  exclusive = label2;
+  try {
+    return await operation();
+  } finally {
+    exclusive = null;
+  }
+}
+var SNAPSHOTS_DIRNAME = "snapshots";
+function snapshotsDir(deps) {
+  return join2(dirname2(deps.store.databasePath), SNAPSHOTS_DIRNAME);
+}
+function snapshotName(at, reason) {
+  const stamp = new Date(at).toISOString().replaceAll(":", "-").replaceAll(".", "-");
+  return `db_${stamp}_${reason}.sqlite`;
+}
+var SNAPSHOT_ID = /^db_(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z_([A-Za-z]+)\.sqlite$/;
+function parseSnapshotName(name) {
+  const match = SNAPSHOT_ID.exec(name);
+  if (match === null)
+    return null;
+  const [, date5, hh, mm, ss, ms, reason] = match;
+  const at = Date.parse(`${date5}T${hh}:${mm}:${ss}.${ms}Z`);
+  if (Number.isNaN(at) || reason === undefined)
+    return null;
+  return { at, reason };
+}
+function snapshotPath(deps, id) {
+  const dir = resolve(snapshotsDir(deps));
+  const path = resolve(dir, id);
+  if (parseSnapshotName(id) === null || dirname2(path) !== dir) {
+    throw new GatewayError("BAD_REQUEST", "invalid snapshot id");
+  }
+  const real = deps.fs.realpath(path);
+  if (real !== null && dirname2(real) !== (deps.fs.realpath(dir) ?? dir)) {
+    throw new GatewayError("BAD_REQUEST", "invalid snapshot id");
+  }
+  return path;
+}
+function resolveSnapshotForDownload(deps, id) {
+  const path = snapshotPath(deps, id);
+  const stat = deps.fs.stat(path);
+  if (stat === null)
+    throw new GatewayError("BAD_REQUEST", "no such snapshot");
+  return { path, filename: id, sizeBytes: stat.size };
+}
+function deleteSnapshot(deps, id) {
+  const path = snapshotPath(deps, id);
+  if (deps.fs.stat(path) === null)
+    throw new GatewayError("BAD_REQUEST", "no such snapshot");
+  deps.fs.unlink(path);
+}
+function listSnapshots(deps) {
+  const dir = snapshotsDir(deps);
+  const snapshots = [];
+  for (const name of deps.fs.readdir(dir)) {
+    const parsed = parseSnapshotName(name);
+    if (parsed === null)
+      continue;
+    snapshots.push({
+      id: name,
+      filename: name,
+      createdAt: parsed.at,
+      sizeBytes: deps.fs.stat(join2(dir, name))?.size ?? 0,
+      reason: parsed.reason
+    });
+  }
+  return snapshots.sort((a, b) => b.createdAt - a.createdAt);
+}
+var DAY_MS = 86400000;
+var SNAPSHOT_HEADROOM = 1.1;
+function retentionOf(settings) {
+  return { keepLatest: settings.snapshotKeepLatest, maxAgeDays: settings.snapshotMaxAgeDays };
+}
+function applyRetention(deps, policy, now) {
+  const dir = snapshotsDir(deps);
+  const cutoff = now - policy.maxAgeDays * DAY_MS;
+  const snapshots = listSnapshots(deps);
+  const undo = snapshots.find((snapshot) => snapshot.reason === "preRestore")?.id;
+  let removed = 0;
+  snapshots.forEach((snapshot, index) => {
+    if (index === 0)
+      return;
+    if (snapshot.id === undo)
+      return;
+    if (index < policy.keepLatest && snapshot.createdAt >= cutoff)
+      return;
+    deps.fs.unlink(join2(dir, snapshot.id));
+    removed++;
+  });
+  return removed;
+}
+async function pruneSnapshots(deps) {
+  const removed = await withExclusiveOrSkip("a snapshot sweep", async () => applyRetention(deps, retentionOf(await deps.store.config.getSettings()), deps.now()));
+  return removed ?? 0;
+}
+var IMPORT_STAGING_PREFIX = "omni-import-";
+var IMPORT_STAGING_SUFFIX = ".sqlite.part";
+var INCOMING_SUFFIX = ".incoming";
+var STAGING_MAX_AGE_MS = 60 * 60 * 1000;
+function stagedImportPath(deps, token) {
+  return join2(dirname2(deps.store.databasePath), `${IMPORT_STAGING_PREFIX}${token}${IMPORT_STAGING_SUFFIX}`);
+}
+function sweepStaging(deps) {
+  const live = deps.store.databasePath;
+  const dir = dirname2(live);
+  const incoming = `${basename(live)}${INCOMING_SUFFIX}`;
+  const staleBefore = deps.now() - STAGING_MAX_AGE_MS;
+  let removed = 0;
+  for (const entry of deps.fs.readdir(dir)) {
+    const staged = entry === incoming || entry.startsWith(IMPORT_STAGING_PREFIX) && entry.endsWith(IMPORT_STAGING_SUFFIX);
+    if (!staged)
+      continue;
+    const path = join2(dir, entry);
+    const stat = deps.fs.stat(path);
+    if (stat === null || stat.mtimeMs >= staleBefore)
+      continue;
+    deps.fs.unlink(path);
+    removed++;
+  }
+  return removed;
+}
+async function writeSnapshot(deps, input) {
+  const dir = snapshotsDir(deps);
+  const at = deps.now();
+  const filename = snapshotName(at, input.reason);
+  const path = join2(dir, filename);
+  deps.fs.mkdir(dir);
+  if (deps.fs.stat(path) !== null) {
+    throw new GatewayError("CONFLICT", "a snapshot for this instant already exists");
+  }
+  const free = deps.fs.freeBytes(dir);
+  const needed = Math.ceil((deps.fs.stat(deps.store.databasePath)?.size ?? 0) * SNAPSHOT_HEADROOM);
+  if (free !== null && free < needed) {
+    throw new GatewayError("CONFLICT", "not enough free disk space to write a snapshot");
+  }
+  try {
+    await deps.store.maintenance.snapshotTo(path);
+  } catch (error51) {
+    deps.fs.unlink(path);
+    throw error51;
+  }
+  const info = {
+    id: filename,
+    filename,
+    createdAt: at,
+    sizeBytes: deps.fs.stat(path)?.size ?? 0,
+    reason: input.reason
+  };
+  if (input.force !== true) {
+    applyRetention(deps, retentionOf(await deps.store.config.getSettings()), at);
+  }
+  return info;
+}
+async function createSnapshot(deps, input) {
+  return withExclusive("a snapshot", () => writeSnapshot(deps, input));
+}
+
+class SwapFailedError extends Error {
+  preRestoreSnapshotId;
+  cause;
+  reopened;
+  constructor(preRestoreSnapshotId, cause, reopened) {
+    super("the database swap failed and the database may be incomplete");
+    this.preRestoreSnapshotId = preRestoreSnapshotId;
+    this.cause = cause;
+    this.reopened = reopened;
+    this.name = "SwapFailedError";
+  }
+}
+var NAMED_TABLES = 5;
+function describeTables(tables) {
+  if (tables.length === 0)
+    return "it has no tables at all";
+  const named = tables.slice(0, NAMED_TABLES);
+  const rest = tables.length - named.length;
+  return `it has ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
+}
+async function swapIn(deps, candidate) {
+  const inspection = await deps.store.maintenance.inspect(candidate.path);
+  if (!inspection.ok) {
+    throw new GatewayError("BAD_REQUEST", inspection.quickCheck === "ok" ? `that file is a database, but not one of ours: ${describeTables(inspection.tables)}` : `that file failed its integrity check: ${inspection.quickCheck}`);
+  }
+  const preRestoreSnapshot = await writeSnapshot(deps, { reason: "preRestore", force: true });
+  const adminHashBefore = await deps.store.config.getAdminPasswordHash();
+  const live = deps.store.databasePath;
+  const staged = `${live}.incoming`;
+  try {
+    if (candidate.consume)
+      deps.fs.rename(candidate.path, staged);
+    else
+      deps.fs.copyFile(candidate.path, staged);
+  } catch (error51) {
+    deps.fs.unlink(staged);
+    throw error51;
+  }
+  try {
+    deps.store.close();
+    deps.fs.unlink(`${live}-wal`);
+    deps.fs.unlink(`${live}-shm`);
+    deps.fs.rename(staged, live);
+    await deps.store.reopen();
+  } catch (error51) {
+    let reopened = true;
+    try {
+      await deps.store.reopen();
+    } catch {
+      reopened = false;
+    }
+    throw new SwapFailedError(preRestoreSnapshot.id, error51, reopened);
+  }
+  const adminHashAfter = await deps.store.config.getAdminPasswordHash();
+  try {
+    await deps.store.usage.rebuildRollup();
+  } catch (error51) {
+    (deps.logger ?? noopLogger).warn("usage rollup not rebuilt after the swap; run omni doctor", {
+      reason: error51 instanceof Error ? error51.message : "unknown"
+    });
+  }
+  return {
+    ok: true,
+    counts: inspection.counts,
+    preRestoreSnapshot,
+    adminPasswordChanged: adminHashAfter !== adminHashBefore
+  };
+}
+async function restoreSnapshot(deps, id) {
+  const path = snapshotPath(deps, id);
+  if (deps.fs.stat(path) === null)
+    throw new GatewayError("BAD_REQUEST", "no such snapshot");
+  return withExclusive("a restore", () => swapIn(deps, { path, consume: false }));
+}
+var MAX_IMPORT_BYTES = 2 * 1024 * 1024 * 1024;
+async function importSnapshot(deps, input) {
+  return withExclusive("an import", async () => {
+    const stat = deps.fs.stat(input.path);
+    if (stat === null)
+      throw new GatewayError("BAD_REQUEST", "the uploaded file is not there");
+    if (stat.size > MAX_IMPORT_BYTES) {
+      deps.fs.unlink(input.path);
+      throw new GatewayError("BAD_REQUEST", `a database import may not exceed ${MAX_IMPORT_BYTES} bytes`);
+    }
+    try {
+      return await swapIn(deps, { path: input.path, consume: true });
+    } catch (error51) {
+      deps.fs.unlink(input.path);
+      throw error51;
+    }
+  });
+}
+async function vacuum(deps) {
+  return withExclusive("a vacuum", async () => {
+    const before = deps.fs.stat(deps.store.databasePath)?.size ?? 0;
+    const startedAt = deps.now();
+    await deps.store.maintenance.vacuum();
+    const after = deps.fs.stat(deps.store.databasePath)?.size ?? 0;
+    return {
+      reclaimedBytes: Math.max(0, before - after),
+      durationMs: Math.max(0, deps.now() - startedAt)
+    };
+  });
+}
+async function getDatabaseOverview(deps) {
+  const live = deps.store.databasePath;
+  const stats = await deps.store.maintenance.stats();
+  const settings = await deps.store.config.getSettings();
+  const snapshots = listSnapshots(deps);
+  return {
+    stats,
+    fileBytes: deps.fs.stat(live)?.size ?? 0,
+    walBytes: deps.fs.stat(`${live}-wal`)?.size ?? 0,
+    bodiesBytes: deps.fs.dirBytes(bodiesDirFor(live)),
+    logicalBytes: stats.pageSize * stats.pageCount,
+    freePageBytes: stats.pageSize * stats.freelistCount,
+    freeDiskBytes: deps.fs.freeBytes(dirname2(live)),
+    retention: retentionOf(settings),
+    snapshots: {
+      count: snapshots.length,
+      totalBytes: snapshots.reduce((sum, snapshot) => sum + snapshot.sizeBytes, 0),
+      latestAt: snapshots[0]?.createdAt ?? null
+    }
+  };
+}
+async function putRetention(deps, input) {
+  const policy = parseOrThrow(retentionSchema, input);
+  await deps.store.config.putSettings({
+    snapshotKeepLatest: policy.keepLatest,
+    snapshotMaxAgeDays: policy.maxAgeDays
+  });
+  return policy;
+}
 // packages/control/src/dryRun.ts
 async function dryRun(deps, modelId, input) {
   const need = parseOrThrow(dryRunSchema, input);
@@ -25075,17 +26327,67 @@ async function dryRun(deps, modelId, input) {
   };
 }
 // packages/control/src/keys.ts
-async function listKeys(store) {
+function configuredWindows(limits) {
+  const needed = new Set;
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window2 of WINDOWS) {
+      const limit = windows[window2];
+      if (limit !== undefined && limit !== null)
+        needed.add(window2);
+    }
+  }
+  return [...needed];
+}
+async function readLimitUsage(store, id, limits, now) {
+  if (limits === null)
+    return [];
+  const sums = new Map;
+  for (const window2 of configuredWindows(limits)) {
+    sums.set(window2, await store.usage.sumSince(id, now - WINDOW_MS[window2]));
+  }
+  const readings = [];
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window2 of WINDOWS) {
+      const limit = windows[window2];
+      if (limit === undefined || limit === null)
+        continue;
+      const sum = sums.get(window2);
+      const used = sum === undefined ? null : dimension === "requests" ? sum.requests : dimension === "tokens" ? sum.tokens : sum.costUsd;
+      readings.push({ dimension, window: window2, limit, used });
+    }
+  }
+  if (limits.concurrency !== undefined && limits.concurrency !== null) {
+    readings.push({
+      dimension: "concurrency",
+      window: null,
+      limit: limits.concurrency,
+      used: null
+    });
+  }
+  return readings;
+}
+async function toSummary(store, key, now) {
+  return {
+    id: key.id,
+    label: key.label,
+    prefix: key.prefix,
+    modelAllowlist: key.modelAllowlist,
+    limits: key.limits,
+    limitUsage: await readLimitUsage(store, key.id, key.limits, now),
+    bodyLoggingOptOut: key.bodyLoggingOptOut,
+    createdAt: key.createdAt,
+    revokedAt: key.revokedAt
+  };
+}
+async function listKeys(store, now = Date.now()) {
   const keys = await store.keys.list();
-  return keys.map((k) => ({
-    id: k.id,
-    label: k.label,
-    prefix: k.prefix,
-    modelAllowlist: k.modelAllowlist,
-    rateLimitPerMin: k.rateLimitPerMin,
-    createdAt: k.createdAt,
-    revokedAt: k.revokedAt
-  }));
+  return Promise.all(keys.map((key) => toSummary(store, key, now)));
 }
 async function createKey(store, input) {
   const body2 = parseOrThrow(keyCreateSchema, input);
@@ -25096,13 +26398,75 @@ async function createKey(store, input) {
     prefix: raw.slice(0, 12),
     hash: await hashApiKey(raw),
     modelAllowlist: body2.modelAllowlist,
-    rateLimitPerMin: body2.rateLimitPerMin
+    limits: body2.limits,
+    bodyLoggingOptOut: body2.bodyLoggingOptOut
   });
   return { id: created.id, label: created.label, prefix: created.prefix, key: raw };
 }
+async function setKeyLimits(store, id, input, now = Date.now()) {
+  const body2 = parseOrThrow(keyLimitsSchema, input);
+  const key = (await store.keys.list()).find((entry) => entry.id === id);
+  if (key === undefined)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setLimits(id, body2.limits);
+  return toSummary(store, { ...key, limits: body2.limits }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
+// packages/control/src/lifecycle.ts
+var DOCKERENV_PATH = "/.dockerenv";
+function describeLifecycle(env2, fileExists) {
+  if (env2.JOURNAL_STREAM !== undefined) {
+    return { supervisor: "systemd", canRestart: true, canShutdown: true };
+  }
+  if (fileExists(DOCKERENV_PATH)) {
+    return {
+      supervisor: "container",
+      canRestart: true,
+      canShutdown: true,
+      note: "restart exits the container and relies on its restart policy, which cannot be read from inside it"
+    };
+  }
+  return {
+    supervisor: "none",
+    canRestart: false,
+    canShutdown: true,
+    note: "no supervisor is watching this process, so nothing would start it again"
+  };
+}
+function systemdScope(env2) {
+  return env2.MANAGERPID === undefined ? "system" : "user";
+}
+function commandFailure(action, result) {
+  const detail = result.stderr.split(`
+`)[0]?.trim().slice(0, 200) ?? "";
+  const suffix = detail.length > 0 ? `: ${detail}` : "";
+  return new GatewayError("INTERNAL", `${action} failed with exit ${result.code}${suffix}`);
+}
+async function requestRestart(deps) {
+  const capability = describeLifecycle(deps.env, deps.fileExists);
+  if (!capability.canRestart) {
+    throw new GatewayError("CONFLICT", capability.note ?? "this installation has no supervisor that would restart the gateway");
+  }
+  if (capability.supervisor === "container") {
+    deps.stop(0);
+    return;
+  }
+  const scope = systemdScope(deps.env);
+  const result = await deps.run([
+    "systemctl",
+    ...scope === "user" ? ["--user"] : [],
+    "--no-block",
+    "restart",
+    UNIT_NAME
+  ]);
+  if (result.code !== 0)
+    throw commandFailure("systemctl restart", result);
+}
+async function requestShutdown(deps) {
+  deps.stop(0);
+}
 // packages/control/src/modelLimits.ts
 function narrower(a, b) {
   const context = [a.contextWindow, b.contextWindow].filter((n) => n !== undefined);
@@ -25215,6 +26579,81 @@ async function putModel(store, id, input) {
 async function removeModel(store, id) {
   await store.config.removeModel(id);
 }
+// packages/control/src/nodeFs.ts
+import {
+  copyFileSync,
+  mkdirSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statfsSync,
+  statSync
+} from "fs";
+import { join as join3 } from "path";
+function nodeDatabaseFs() {
+  const dirBytes = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    } catch {
+      return 0;
+    }
+    let total = 0;
+    for (const entry of entries) {
+      const path = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        total += dirBytes(path);
+        continue;
+      }
+      try {
+        total += statSync(path).size;
+      } catch {}
+    }
+    return total;
+  };
+  return {
+    readdir: (dir) => {
+      try {
+        return readdirSync(dir);
+      } catch {
+        return [];
+      }
+    },
+    stat: (path) => {
+      try {
+        const stat = statSync(path);
+        return { size: stat.size, mtimeMs: stat.mtimeMs };
+      } catch {
+        return null;
+      }
+    },
+    unlink: (path) => {
+      rmSync(path, { force: true });
+    },
+    rename: (from, to) => renameSync(from, to),
+    copyFile: (from, to) => copyFileSync(from, to),
+    mkdir: (dir) => {
+      mkdirSync(dir, { recursive: true });
+    },
+    realpath: (path) => {
+      try {
+        return realpathSync(path);
+      } catch {
+        return null;
+      }
+    },
+    freeBytes: (dir) => {
+      try {
+        const stat = statfsSync(dir);
+        return Number(stat.bavail) * Number(stat.bsize);
+      } catch {
+        return null;
+      }
+    },
+    dirBytes
+  };
+}
 // packages/control/src/oauth/pkce.ts
 function randomToken() {
   return Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64url");
@@ -26128,8 +27567,8 @@ function createRefresher(deps) {
   };
 }
 // packages/control/src/quota/history.ts
-var DAY_MS = 24 * 60 * 60 * 1000;
-var HOUR_MS2 = 3600000;
+var DAY_MS2 = 24 * 60 * 60 * 1000;
+var HOUR_MS3 = 3600000;
 async function gatewayRatesFor(store, windows) {
   const rates = [];
   for (const window2 of windows) {
@@ -26153,7 +27592,7 @@ async function gatewayRatesFor(store, windows) {
     rates.push({
       credentialId: window2.credentialId,
       windowType: window2.windowType,
-      gatewayRatePerHour: tokens2 / ((window2.observedAt - since) / HOUR_MS2)
+      gatewayRatePerHour: tokens2 / ((window2.observedAt - since) / HOUR_MS3)
     });
   }
   return rates;
@@ -26161,7 +27600,7 @@ async function gatewayRatesFor(store, windows) {
 async function quotaHistory(deps, input) {
   const now = deps.now();
   const settings = await deps.store.config.getSettings();
-  const oldest = now - settings.logRetentionDays * DAY_MS;
+  const oldest = now - settings.logRetentionDays * DAY_MS2;
   const since = Math.max(optionalNumber(input.since, oldest), oldest);
   const until = Math.min(optionalNumber(input.until, now), now);
   const raw = input.credentialId?.trim();
@@ -26248,9 +27687,13 @@ async function getSettings(store) {
   return store.config.getSettings();
 }
 async function putSettings(store, input) {
-  const settings = parseOrThrow(settingsSchema, input);
-  await store.config.putSettings(settings);
-  return settings;
+  const { snapshotKeepLatest, snapshotMaxAgeDays, ...rest } = parseOrThrow(settingsSchema, input);
+  const patch = {
+    ...rest,
+    ...snapshotKeepLatest === undefined ? {} : { snapshotKeepLatest },
+    ...snapshotMaxAgeDays === undefined ? {} : { snapshotMaxAgeDays }
+  };
+  return store.config.putSettings(patch);
 }
 // packages/control/src/setup.ts
 var KEY_PLACEHOLDER = "<your OmniGateway key>";
@@ -26369,7 +27812,7 @@ async function setupFiles(store, client, input, mapping) {
   return client === "opencode" ? [opencodeConfig(described, input, mapping)] : [claudeSettings(described, input, mapping)];
 }
 // packages/control/src/tail.ts
-import { closeSync, fstatSync, openSync, readSync, statSync } from "fs";
+import { closeSync, fstatSync, openSync, readSync, statSync as statSync2 } from "fs";
 var CHUNK = 64 * 1024;
 var MAX_BYTES = 8 * 1024 * 1024;
 function tailFile(path, lines) {
@@ -26428,8 +27871,8 @@ async function recentLogs(store, requested) {
   return store.usage.recent(logLimit(requested));
 }
 // apps/gateway/src/app.ts
-import { realpathSync } from "fs";
-import { resolve, sep } from "path";
+import { existsSync, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve2, sep as sep2 } from "path";
 
 // node_modules/.bun/memoirist@0.4.0/node_modules/memoirist/dist/bun/index.js
 var Y = (v, b) => {
@@ -33631,11 +35074,11 @@ function removeTrailingEquals(digest) {
     trimmedDigest = trimmedDigest.slice(0, -1);
   return trimmedDigest;
 }
-var encoder = new TextEncoder;
+var encoder3 = new TextEncoder;
 var signCookie = async (val, secret) => {
   if (typeof val == "object" ? val = JSON.stringify(val) : typeof val != "string" && (val = val + ""), secret == null)
     throw new TypeError("Secret key must be provided");
-  const secretKey = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]), hmacBuffer = await crypto.subtle.sign("HMAC", secretKey, encoder.encode(val));
+  const secretKey = await crypto.subtle.importKey("raw", encoder3.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]), hmacBuffer = await crypto.subtle.sign("HMAC", secretKey, encoder3.encode(val));
   return val + "." + removeTrailingEquals(Buffer.from(hmacBuffer).toString("base64"));
 };
 var constantTimeEqual = typeof crypto?.timingSafeEqual == "function" ? (a, b) => {
@@ -34658,8 +36101,8 @@ var separateFunction = (code) => {
   }
   const start = code.indexOf("(");
   if (start !== -1) {
-    const sep = code.indexOf(`
-`, 2), parameter = code.slice(0, sep), end = parameter.lastIndexOf(")") + 1, body2 = code.slice(sep + 1);
+    const sep2 = code.indexOf(`
+`, 2), parameter = code.slice(0, sep2), end = parameter.lastIndexOf(")") + 1, body2 = code.slice(sep2 + 1);
     return [
       parameter.slice(start, end),
       "{" + body2,
@@ -35270,13 +36713,13 @@ async function* streamResponse(response) {
   const body2 = response.body;
   if (!body2)
     return;
-  const reader = body2.getReader(), decoder = new TextDecoder;
+  const reader = body2.getReader(), decoder2 = new TextDecoder;
   try {
     for (;; ) {
       const { done, value } = await reader.read();
       if (done)
         break;
-      typeof value == "string" ? yield value : yield decoder.decode(value);
+      typeof value == "string" ? yield value : yield decoder2.decode(value);
     }
   } finally {
     reader.releaseLock();
@@ -35334,7 +36777,7 @@ async function tee(source, branches = 2) {
       else {
         if (done)
           return;
-        await new Promise((resolve) => waiting.push({ resolve }));
+        await new Promise((resolve2) => waiting.push({ resolve: resolve2 }));
       }
   }
   return Array.from({ length: branches }, makeIterator);
@@ -36198,14 +37641,14 @@ function parseQuery(input) {
 // node_modules/.bun/elysia@1.4.29+5b33ebcc42722450/node_modules/elysia/dist/trace.mjs
 var ELYSIA_TRACE = Symbol("ElysiaTrace");
 var createProcess = () => {
-  const { promise: promise2, resolve } = Promise.withResolvers(), { promise: end, resolve: resolveEnd } = Promise.withResolvers(), { promise: error51, resolve: resolveError } = Promise.withResolvers(), callbacks = [], callbacksEnd = [];
+  const { promise: promise2, resolve: resolve2 } = Promise.withResolvers(), { promise: end, resolve: resolveEnd } = Promise.withResolvers(), { promise: error51, resolve: resolveError } = Promise.withResolvers(), callbacks = [], callbacksEnd = [];
   return [
     (callback) => (callback && callbacks.push(callback), promise2),
     (process3) => {
       const processes = [], resolvers = [];
       let groupError = null;
       for (let i = 0;i < (process3.total ?? 0); i++) {
-        const { promise: promise22, resolve: resolve2 } = Promise.withResolvers(), { promise: end2, resolve: resolveEnd2 } = Promise.withResolvers(), { promise: error210, resolve: resolveError2 } = Promise.withResolvers(), callbacks2 = [], callbacksEnd2 = [];
+        const { promise: promise22, resolve: resolve22 } = Promise.withResolvers(), { promise: end2, resolve: resolveEnd2 } = Promise.withResolvers(), { promise: error210, resolve: resolveError2 } = Promise.withResolvers(), callbacks2 = [], callbacksEnd2 = [];
         processes.push((callback) => (callback && callbacks2.push(callback), promise22)), resolvers.push((process22) => {
           const result2 = {
             ...process22,
@@ -36216,7 +37659,7 @@ var createProcess = () => {
               return callback && callbacksEnd2.push(callback), end2;
             }
           };
-          resolve2(result2);
+          resolve22(result2);
           for (let i2 = 0;i2 < callbacks2.length; i2++)
             callbacks2[i2](result2);
           return (error310 = null) => {
@@ -36247,7 +37690,7 @@ var createProcess = () => {
           return callback && callbacksEnd.push(callback), end;
         }
       };
-      resolve(result);
+      resolve2(result);
       for (let i = 0;i < callbacks.length; i++)
         callbacks[i](result);
       return {
@@ -40074,11 +41517,11 @@ var _Elysia = class _Elysia2 {
   onTransform(options, handler) {
     return handler ? this.on(options, "transform", handler) : this.on("transform", options);
   }
-  resolve(optionsOrResolve, resolve) {
-    resolve || (resolve = optionsOrResolve, optionsOrResolve = { as: "local" });
+  resolve(optionsOrResolve, resolve2) {
+    resolve2 || (resolve2 = optionsOrResolve, optionsOrResolve = { as: "local" });
     const hook = {
       subType: "resolve",
-      fn: resolve
+      fn: resolve2
     };
     return this.onBeforeHandle(optionsOrResolve, hook);
   }
@@ -40806,39 +42249,411 @@ var _Elysia = class _Elysia2 {
   }
 };
 var Elysia = _Elysia;
+// packages/ratelimit/src/window.ts
+class SlidingWindow {
+  windowMs;
+  stamps = [];
+  constructor(windowMs) {
+    this.windowMs = windowMs;
+  }
+  count(now) {
+    const cutoff = now - this.windowMs;
+    let aged = 0;
+    for (const stamp of this.stamps) {
+      if (stamp > cutoff)
+        break;
+      aged++;
+    }
+    if (aged > 0)
+      this.stamps = this.stamps.slice(aged);
+    return this.stamps.length;
+  }
+  record(now) {
+    this.stamps.push(now);
+  }
+  forget(at) {
+    for (let index = this.stamps.length - 1;index >= 0; index--) {
+      const stamp = this.stamps[index];
+      if (stamp === undefined || stamp < at)
+        return;
+      if (stamp === at) {
+        this.stamps.splice(index, 1);
+        return;
+      }
+    }
+  }
+  resetAt(now) {
+    const oldest = this.stamps[0];
+    return oldest === undefined ? now : oldest + this.windowMs;
+  }
+  get empty() {
+    return this.stamps.length === 0;
+  }
+}
+
+// packages/ratelimit/src/index.ts
+var WINDOWED = ["requests", "tokens", "spend"];
+function lastToClear(violations) {
+  let chosen = null;
+  for (const candidate of violations) {
+    if (chosen === null || candidate.resetAt > chosen.resetAt) {
+      chosen = candidate;
+      continue;
+    }
+    if (candidate.resetAt === chosen.resetAt && candidate.used / candidate.limit > chosen.used / chosen.limit) {
+      chosen = candidate;
+    }
+  }
+  return chosen;
+}
+function evaluate(config2, counters, now) {
+  const violations = [];
+  const headroom = {};
+  for (const dimension of WINDOWED) {
+    const limits = config2[dimension];
+    if (limits === undefined)
+      continue;
+    const observed = counters[dimension] ?? {};
+    let nearest = null;
+    for (const window2 of WINDOWS) {
+      const limit = limits[window2];
+      if (limit === undefined || limit === null)
+        continue;
+      const counter = observed[window2];
+      const used = counter?.used ?? 0;
+      const resetAt = counter?.resetAt ?? now + WINDOW_MS[window2];
+      if (used >= limit)
+        violations.push({ dimension, window: window2, limit, used, resetAt });
+      const entry = {
+        window: window2,
+        limit,
+        used,
+        remaining: Math.max(0, limit - used),
+        resetAt
+      };
+      if (nearest === null || used / limit > nearest.used / nearest.limit)
+        nearest = entry;
+    }
+    if (nearest !== null)
+      headroom[dimension] = nearest;
+  }
+  const concurrency = config2.concurrency;
+  if (concurrency !== undefined && concurrency !== null) {
+    const used = counters.concurrency ?? 0;
+    if (used >= concurrency) {
+      violations.push({
+        dimension: "concurrency",
+        window: null,
+        limit: concurrency,
+        used,
+        resetAt: now
+      });
+    }
+  }
+  const violation = lastToClear(violations);
+  return { allowed: violation === null, violation, headroom };
+}
+function retryAfterMs(violation, now) {
+  return violation === null ? 0 : Math.max(0, violation.resetAt - now);
+}
 
 // apps/gateway/src/auth/rateLimit.ts
-var WINDOW_MS = 60000;
+var LONG_WINDOWS = ["5h", "1w"];
+var CACHE_TTL_MS = 30000;
+var EAGER_FRACTION = 0.9;
+var MAX_DEBITS = 1e4;
+
+class RateLimitExceeded extends GatewayError {
+  headroom;
+  constructor(retryAfterMs2, headroom) {
+    super("RATE_LIMIT", "API key rate limit exceeded", { retryAfterMs: retryAfterMs2 });
+    this.headroom = headroom;
+  }
+}
+function configured(limit) {
+  return limit !== undefined && limit !== null;
+}
+function anyRequestLimit(limits) {
+  for (const window2 of ["1m", "5h", "1w"]) {
+    if (configured(limits.requests?.[window2]))
+      return true;
+  }
+  return false;
+}
+function anyLimit(limits) {
+  if (configured(limits.concurrency) || anyRequestLimit(limits))
+    return true;
+  for (const window2 of ["1m", "5h", "1w"]) {
+    if (configured(limits.tokens?.[window2]))
+      return true;
+  }
+  return configured(limits.spend?.["5h"]) || configured(limits.spend?.["1w"]);
+}
+function anyLongLimit(limits) {
+  for (const window2 of LONG_WINDOWS) {
+    if (configured(limits.requests?.[window2]))
+      return true;
+    if (configured(limits.tokens?.[window2]))
+      return true;
+    if (configured(limits.spend?.[window2]))
+      return true;
+  }
+  return false;
+}
+function sinceRead(debits, readAt) {
+  let requests = 0;
+  let tokens2 = 0;
+  let costUsd = 0;
+  for (const debit of debits) {
+    if (debit.at < readAt)
+      continue;
+    requests += debit.requests;
+    tokens2 += debit.tokens;
+    costUsd += debit.costUsd;
+  }
+  return { requests, tokens: tokens2, costUsd };
+}
+var LONGEST_WINDOW_MS = Math.max(...LONG_WINDOWS.map((window2) => WINDOW_MS[window2]));
+function trimDebits(debits, now) {
+  const live = debits.filter((debit) => debit.at >= now - LONGEST_WINDOW_MS);
+  if (live.length <= MAX_DEBITS)
+    return live;
+  const folded = { at: 0, requests: 0, tokens: 0, costUsd: 0 };
+  const cut = live.length - MAX_DEBITS + 1;
+  for (const debit of live.slice(0, cut)) {
+    folded.at = Math.max(folded.at, debit.at);
+    folded.requests += debit.requests;
+    folded.tokens += debit.tokens;
+    folded.costUsd += debit.costUsd;
+  }
+  return [folded, ...live.slice(cut)];
+}
 
 class ApiKeyRateLimiter {
+  keys = new Map;
+  store;
   now;
-  windows = new Map;
-  constructor(now) {
-    this.now = now;
+  logger;
+  constructor(deps) {
+    this.store = deps.store;
+    this.now = deps.now;
+    this.logger = deps.logger ?? noopLogger;
+  }
+  async admit(keyId, limits, requestId) {
+    if (!anyLimit(limits))
+      return { release: () => {}, headroom: {} };
+    const now = this.now();
+    this.cleanup(now);
+    const state = this.state(keyId, limits);
+    const claim = this.claim(state, now, true);
+    let admitted = false;
+    try {
+      const counters = await this.counters(state, keyId, limits, claim, now, requestId);
+      const decision = evaluate(limits, counters, now);
+      await this.refuse(keyId, decision, now, requestId);
+      admitted = true;
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        state.inFlight = Math.max(0, state.inFlight - 1);
+      };
+      return { release, headroom: decision.headroom };
+    } finally {
+      state.deciding--;
+      if (!admitted)
+        this.rollback(state, claim);
+    }
   }
-  consume(keyId, limit) {
-    if (limit === null)
+  async consume(keyId, limits, requestId) {
+    const requests = limits.requests;
+    if (requests === undefined || !anyRequestLimit(limits))
       return;
     const now = this.now();
     this.cleanup(now);
-    const startedAt = Math.floor(now / WINDOW_MS) * WINDOW_MS;
-    const current = this.windows.get(keyId);
-    const window2 = current === undefined || current.startedAt !== startedAt ? { startedAt, count: 0 } : current;
-    if (window2.count >= limit) {
-      throw new GatewayError("RATE_LIMIT", "API key rate limit exceeded", {
-        retryAfterMs: startedAt + WINDOW_MS - now
+    const state = this.state(keyId, limits);
+    const claim = this.claim(state, now, false);
+    let consumed = false;
+    try {
+      const counters = await this.counters(state, keyId, { requests }, claim, now, requestId);
+      await this.refuse(keyId, evaluate({ requests }, counters, now), now, requestId);
+      consumed = true;
+    } finally {
+      state.deciding--;
+      if (!consumed)
+        this.rollback(state, claim);
+    }
+  }
+  claim(state, now, gauge) {
+    const before = {
+      requests: { used: state.ring.count(now), resetAt: state.ring.resetAt(now) },
+      concurrency: state.inFlight
+    };
+    state.ring.record(now);
+    if (gauge)
+      state.inFlight++;
+    state.deciding++;
+    return { at: now, gauge, before };
+  }
+  rollback(state, claim) {
+    state.ring.forget(claim.at);
+    if (claim.gauge)
+      state.inFlight = Math.max(0, state.inFlight - 1);
+  }
+  debit(keyId, usage) {
+    const state = this.keys.get(keyId);
+    if (state === undefined)
+      return;
+    if (!anyLongLimit(state.limits))
+      return;
+    state.debits.push({
+      at: this.now(),
+      requests: 1,
+      tokens: usage.tokens,
+      costUsd: usage.costUsd
+    });
+    this.markEager(state);
+  }
+  inFlight(keyId) {
+    return this.keys.get(keyId)?.inFlight ?? 0;
+  }
+  pendingDebits(keyId) {
+    return this.keys.get(keyId)?.debits.length ?? 0;
+  }
+  async refuse(keyId, decision, now, requestId) {
+    const violation = decision.violation;
+    if (violation === null)
+      return;
+    const window2 = violation.window;
+    const exact = await this.exactReset(keyId, window2, now, requestId);
+    const resolved = exact === null ? violation : { ...violation, resetAt: exact };
+    const headroom = exact === null || window2 === null ? decision.headroom : withReset(decision.headroom, window2, exact);
+    throw new RateLimitExceeded(retryAfterMs(resolved, now), headroom);
+  }
+  async exactReset(keyId, window2, now, requestId) {
+    if (window2 === null || window2 === "1m")
+      return null;
+    const length = WINDOW_MS[window2];
+    try {
+      const oldest = await this.store.usage.oldestSince(keyId, now - length);
+      if (oldest === null)
+        return null;
+      return oldest + length;
+    } catch (error51) {
+      this.logger.warn("rate limit reset unavailable", {
+        ...requestId === undefined ? {} : { requestId },
+        apiKeyId: keyId,
+        reason: error51 instanceof Error ? error51.message : "unknown"
+      });
+      return null;
+    }
+  }
+  state(keyId, limits) {
+    const existing = this.keys.get(keyId);
+    if (existing !== undefined) {
+      existing.limits = limits;
+      return existing;
+    }
+    const created = {
+      ring: new SlidingWindow(WINDOW_MS["1m"]),
+      inFlight: 0,
+      deciding: 0,
+      debits: [],
+      counts: null,
+      stale: false,
+      limits
+    };
+    this.keys.set(keyId, created);
+    return created;
+  }
+  async counters(state, keyId, limits, claim, now, requestId) {
+    const requests = { "1m": claim.before.requests };
+    const snapshot = { requests, concurrency: claim.before.concurrency };
+    if (!anyLongLimit(limits))
+      return snapshot;
+    const counts = await this.longCounts(state, keyId, now, requestId);
+    if (counts === null)
+      return snapshot;
+    const tokens2 = {};
+    const spend = {};
+    const delta2 = sinceRead(state.debits, counts.readAt);
+    for (const window2 of LONG_WINDOWS) {
+      const sums = counts.sums[window2];
+      const resetAt = now + WINDOW_MS[window2];
+      requests[window2] = { used: sums.requests + delta2.requests, resetAt };
+      tokens2[window2] = { used: sums.tokens + delta2.tokens, resetAt };
+      spend[window2] = { used: sums.costUsd + delta2.costUsd, resetAt };
+    }
+    snapshot.tokens = tokens2;
+    snapshot.spend = spend;
+    return snapshot;
+  }
+  async longCounts(state, keyId, now, requestId) {
+    const cached2 = state.counts;
+    if (cached2 !== null && !state.stale && now - cached2.readAt < CACHE_TTL_MS)
+      return cached2;
+    const readAt = now;
+    try {
+      const [fiveHour, oneWeek] = await Promise.all([
+        this.store.usage.sumSince(keyId, readAt - WINDOW_MS["5h"]),
+        this.store.usage.sumSince(keyId, readAt - WINDOW_MS["1w"])
+      ]);
+      const newer = state.counts;
+      if (newer !== null && newer.readAt > readAt)
+        return newer;
+      state.counts = { readAt, sums: { "5h": fiveHour, "1w": oneWeek } };
+      state.stale = false;
+      state.debits = state.debits.filter((debit) => debit.at >= readAt);
+      return state.counts;
+    } catch (error51) {
+      this.logger.warn("rate limit counters unavailable", {
+        ...requestId === undefined ? {} : { requestId },
+        apiKeyId: keyId,
+        reason: error51 instanceof Error ? error51.message : "unknown"
       });
+      state.debits = trimDebits(state.debits, now);
+      return null;
+    }
+  }
+  markEager(state) {
+    const counts = state.counts;
+    if (counts === null || state.stale)
+      return;
+    const delta2 = sinceRead(state.debits, counts.readAt);
+    for (const window2 of LONG_WINDOWS) {
+      const sums = counts.sums[window2];
+      if (near(state.limits.requests?.[window2], sums.requests + delta2.requests) || near(state.limits.tokens?.[window2], sums.tokens + delta2.tokens) || near(state.limits.spend?.[window2], sums.costUsd + delta2.costUsd)) {
+        state.stale = true;
+        return;
+      }
     }
-    window2.count++;
-    this.windows.set(keyId, window2);
   }
   cleanup(now) {
-    for (const [keyId, window2] of this.windows) {
-      if (window2.startedAt + WINDOW_MS <= now)
-        this.windows.delete(keyId);
+    for (const [keyId, state] of this.keys) {
+      state.ring.count(now);
+      if (state.deciding > 0 || !state.ring.empty || state.inFlight > 0)
+        continue;
+      if (state.debits.length > 0)
+        continue;
+      if (state.counts !== null && now - state.counts.readAt < CACHE_TTL_MS)
+        continue;
+      this.keys.delete(keyId);
     }
   }
 }
+function near(limit, used) {
+  return configured(limit) && used >= limit * EAGER_FRACTION;
+}
+function withReset(headroom, window2, resetAt) {
+  const corrected = { ...headroom };
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const entry = corrected[dimension];
+    if (entry !== undefined && entry.window === window2)
+      corrected[dimension] = { ...entry, resetAt };
+  }
+  return corrected;
+}
 
 // apps/gateway/src/dispatch/snapshotCache.ts
 function createRoutingSnapshotCache(store, logger2 = noopLogger) {
@@ -40896,7 +42711,415 @@ function createRoutingSnapshotCache(store, logger2 = noopLogger) {
     });
     return inFlight;
   };
-  return { get, close: unsubscribe };
+  return {
+    get,
+    invalidate() {
+      generation++;
+      snapshot = null;
+      stale = true;
+      version2 = store.routing.version();
+    },
+    close: unsubscribe
+  };
+}
+
+// apps/gateway/src/egress/anthropic.ts
+var STOP_REASON2 = {
+  endTurn: "end_turn",
+  maxTokens: "max_tokens",
+  stopSequence: "stop_sequence",
+  toolUse: "tool_use",
+  contentFilter: "refusal",
+  pauseTurn: "pause_turn"
+};
+var ERROR_TYPE2 = {
+  AUTH: "authentication_error",
+  RATE_LIMIT: "rate_limit_error",
+  QUOTA_EXHAUSTED: "rate_limit_error",
+  OVERLOADED: "overloaded_error",
+  BAD_REQUEST: "invalid_request_error",
+  CONFLICT: "invalid_request_error",
+  CONTENT_FILTER: "invalid_request_error",
+  CAPABILITY_MISMATCH: "invalid_request_error",
+  MODEL_UNAVAILABLE: "not_found_error",
+  UPSTREAM: "api_error",
+  TIMEOUT: "api_error",
+  NETWORK: "api_error",
+  NO_CANDIDATES: "overloaded_error",
+  ALL_CANDIDATES_FAILED: "api_error",
+  INTERNAL: "api_error"
+};
+var frame = (event, data) => ({
+  event,
+  data: JSON.stringify(data)
+});
+async function* anthropicStream(events, requestId) {
+  let model = "";
+  const suppressed2 = new Set;
+  const outIndex = new Map;
+  let nextOutIndex = 0;
+  for await (const event of events) {
+    switch (event.type) {
+      case "start":
+        model = event.model;
+        yield frame("message_start", {
+          type: "message_start",
+          message: {
+            id: requestId,
+            type: "message",
+            role: "assistant",
+            model,
+            content: [],
+            stop_reason: null,
+            stop_sequence: null,
+            usage: {
+              input_tokens: 0,
+              output_tokens: 0,
+              cache_read_input_tokens: 0,
+              cache_creation_input_tokens: 0
+            }
+          }
+        });
+        break;
+      case "blockStart": {
+        const b = event.block;
+        if (b.type === "thinking" && b.signed !== true) {
+          suppressed2.add(event.index);
+          break;
+        }
+        const content_block = b.type === "text" ? { type: "text", text: "" } : b.type === "thinking" ? { type: "thinking", thinking: "" } : b.type === "anthropicNative" ? { ...b.data, type: b.blockType } : { type: "tool_use", id: b.id, name: b.name, input: {} };
+        const index = nextOutIndex++;
+        outIndex.set(event.index, index);
+        yield frame("content_block_start", {
+          type: "content_block_start",
+          index,
+          content_block
+        });
+        break;
+      }
+      case "blockDelta": {
+        if (suppressed2.has(event.index))
+          break;
+        const d = event.delta;
+        const delta2 = d.type === "text" ? { type: "text_delta", text: d.text } : d.type === "thinking" ? { type: "thinking_delta", thinking: d.text } : d.type === "thinkingSignature" ? { type: "signature_delta", signature: d.signature } : d.type === "anthropicNative" ? { type: d.deltaType, ...d.data } : { type: "input_json_delta", partial_json: d.partial };
+        yield frame("content_block_delta", {
+          type: "content_block_delta",
+          index: outIndex.get(event.index) ?? event.index,
+          delta: delta2
+        });
+        break;
+      }
+      case "blockEnd":
+        if (suppressed2.has(event.index))
+          break;
+        yield frame("content_block_stop", {
+          type: "content_block_stop",
+          index: outIndex.get(event.index) ?? event.index
+        });
+        break;
+      case "end":
+        yield frame("message_delta", {
+          type: "message_delta",
+          delta: { stop_reason: STOP_REASON2[event.stopReason], stop_sequence: null },
+          usage: {
+            input_tokens: event.usage.inputTokens,
+            output_tokens: event.usage.outputTokens,
+            cache_read_input_tokens: event.usage.cacheReadTokens,
+            cache_creation_input_tokens: event.usage.cacheWriteTokens
+          }
+        });
+        yield frame("message_stop", { type: "message_stop" });
+        break;
+      case "error":
+        yield frame("error", {
+          type: "error",
+          error: { type: ERROR_TYPE2[event.code], message: event.message }
+        });
+        break;
+    }
+  }
+}
+function anthropicResponse(collected, requestId) {
+  return {
+    id: requestId,
+    type: "message",
+    role: "assistant",
+    model: collected.model,
+    content: collected.content.filter((b) => b.type !== "thinking" || b.signature !== undefined && b.signature !== "").map((b) => {
+      switch (b.type) {
+        case "text":
+          return {
+            type: "text",
+            text: b.text,
+            ...b.citations === undefined ? {} : { citations: b.citations }
+          };
+        case "thinking":
+          return { type: "thinking", thinking: b.text, signature: b.signature };
+        case "toolUse":
+          return { type: "tool_use", id: b.id, name: b.name, input: b.input };
+        case "anthropicNative":
+          return { ...b.data, type: b.blockType };
+        default:
+          return { type: "text", text: "" };
+      }
+    }),
+    stop_reason: STOP_REASON2[collected.stopReason],
+    stop_sequence: null,
+    usage: {
+      input_tokens: collected.usage.inputTokens,
+      output_tokens: collected.usage.outputTokens,
+      cache_read_input_tokens: collected.usage.cacheReadTokens,
+      cache_creation_input_tokens: collected.usage.cacheWriteTokens
+    }
+  };
+}
+function anthropicErrorBody(code, message) {
+  return { type: "error", error: { type: ERROR_TYPE2[code], message } };
+}
+var REPORTED_LIMIT_DIMENSIONS = ["requests", "tokens"];
+function rfc3339(at) {
+  return `${new Date(Math.ceil(at / 1000) * 1000).toISOString().slice(0, 19)}Z`;
+}
+function anthropicRateLimitHeaders(headroom) {
+  const headers = {};
+  for (const dimension of REPORTED_LIMIT_DIMENSIONS) {
+    const entry = headroom[dimension];
+    if (entry === undefined)
+      continue;
+    headers[`anthropic-ratelimit-${dimension}-limit`] = String(entry.limit);
+    headers[`anthropic-ratelimit-${dimension}-remaining`] = String(entry.remaining);
+    headers[`anthropic-ratelimit-${dimension}-reset`] = rfc3339(entry.resetAt);
+  }
+  return headers;
+}
+
+// apps/gateway/src/egress/openai.ts
+function usageBody(usage) {
+  const prompt = promptTokens(usage);
+  return {
+    prompt_tokens: prompt,
+    completion_tokens: usage.outputTokens,
+    total_tokens: prompt + usage.outputTokens,
+    prompt_tokens_details: { cached_tokens: usage.cacheReadTokens }
+  };
+}
+var FINISH3 = {
+  endTurn: "stop",
+  maxTokens: "length",
+  stopSequence: "stop",
+  toolUse: "tool_calls",
+  contentFilter: "content_filter",
+  pauseTurn: "stop"
+};
+var ERROR_TYPE3 = {
+  AUTH: { type: "invalid_request_error", code: "invalid_api_key" },
+  RATE_LIMIT: { type: "rate_limit_error", code: "rate_limit_exceeded" },
+  QUOTA_EXHAUSTED: { type: "insufficient_quota", code: "insufficient_quota" },
+  OVERLOADED: { type: "server_error", code: "server_error" },
+  BAD_REQUEST: { type: "invalid_request_error", code: "invalid_request" },
+  CONFLICT: { type: "invalid_request_error", code: "conflict" },
+  CONTENT_FILTER: { type: "invalid_request_error", code: "content_policy_violation" },
+  CAPABILITY_MISMATCH: { type: "invalid_request_error", code: "invalid_request" },
+  MODEL_UNAVAILABLE: { type: "invalid_request_error", code: "model_not_found" },
+  UPSTREAM: { type: "server_error", code: "server_error" },
+  TIMEOUT: { type: "server_error", code: "timeout" },
+  NETWORK: { type: "server_error", code: "server_error" },
+  NO_CANDIDATES: { type: "server_error", code: "service_unavailable" },
+  ALL_CANDIDATES_FAILED: { type: "server_error", code: "server_error" },
+  INTERNAL: { type: "server_error", code: "server_error" }
+};
+var chunk = (id, created, model, choice, usage) => ({
+  id,
+  object: "chat.completion.chunk",
+  created,
+  model,
+  choices: [choice],
+  ...usage === undefined ? {} : { usage }
+});
+async function* openaiStream(events, requestId, created) {
+  let model = "";
+  let roleSent = false;
+  let completed = false;
+  const toolIndex = new Map;
+  const emit = (data) => ({ event: "message", data: JSON.stringify(data) });
+  for await (const event of events) {
+    switch (event.type) {
+      case "start":
+        model = event.model;
+        break;
+      case "blockStart": {
+        if (event.block.type === "text") {
+          if (!roleSent) {
+            roleSent = true;
+            yield emit(chunk(requestId, created, model, {
+              index: 0,
+              delta: { role: "assistant", content: "" },
+              finish_reason: null
+            }));
+          }
+        } else if (event.block.type === "toolUse") {
+          const index = toolIndex.size;
+          toolIndex.set(event.index, index);
+          const firstRole = roleSent ? {} : { role: "assistant" };
+          roleSent = true;
+          yield emit(chunk(requestId, created, model, {
+            index: 0,
+            delta: {
+              ...firstRole,
+              tool_calls: [
+                {
+                  index,
+                  id: event.block.id,
+                  type: "function",
+                  function: { name: event.block.name, arguments: "" }
+                }
+              ]
+            },
+            finish_reason: null
+          }));
+        }
+        break;
+      }
+      case "blockDelta": {
+        const d = event.delta;
+        if (d.type === "text") {
+          yield emit(chunk(requestId, created, model, {
+            index: 0,
+            delta: { content: d.text },
+            finish_reason: null
+          }));
+        } else if (d.type === "toolJson") {
+          const index = toolIndex.get(event.index) ?? 0;
+          yield emit(chunk(requestId, created, model, {
+            index: 0,
+            delta: { tool_calls: [{ index, function: { arguments: d.partial } }] },
+            finish_reason: null
+          }));
+        }
+        break;
+      }
+      case "blockEnd":
+        break;
+      case "end":
+        completed = true;
+        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH3[event.stopReason] }, usageBody(event.usage)));
+        break;
+      case "error": {
+        const e = ERROR_TYPE3[event.code];
+        yield emit({ error: { message: event.message, type: e.type, code: e.code } });
+        break;
+      }
+    }
+  }
+  if (completed)
+    yield { event: "message", data: "[DONE]" };
+}
+function openaiResponse(collected, requestId, created) {
+  const text = collected.content.flatMap((b) => b.type === "text" ? [b.text] : []).join("");
+  const toolCalls = collected.content.flatMap((b) => b.type === "toolUse" ? [
+    {
+      id: b.id,
+      type: "function",
+      function: { name: b.name, arguments: JSON.stringify(b.input) }
+    }
+  ] : []);
+  return {
+    id: requestId,
+    object: "chat.completion",
+    created,
+    model: collected.model,
+    choices: [
+      {
+        index: 0,
+        message: {
+          role: "assistant",
+          content: toolCalls.length > 0 && text.length === 0 ? null : text,
+          ...toolCalls.length > 0 ? { tool_calls: toolCalls } : {}
+        },
+        finish_reason: FINISH3[collected.stopReason]
+      }
+    ],
+    usage: usageBody(collected.usage)
+  };
+}
+function openaiErrorBody(code, message) {
+  const e = ERROR_TYPE3[code];
+  return { error: { message, type: e.type, code: e.code } };
+}
+function duration3(ms) {
+  const total = Math.max(0, Math.ceil(ms / 1000));
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor(total % 3600 / 60);
+  const seconds = total % 60;
+  if (hours > 0)
+    return `${hours}h${minutes}m${seconds}s`;
+  if (minutes > 0)
+    return `${minutes}m${seconds}s`;
+  return `${seconds}s`;
+}
+function openaiRateLimitHeaders(headroom, now) {
+  const headers = {};
+  for (const dimension of REPORTED_LIMIT_DIMENSIONS) {
+    const entry = headroom[dimension];
+    if (entry === undefined)
+      continue;
+    headers[`x-ratelimit-limit-${dimension}`] = String(entry.limit);
+    headers[`x-ratelimit-remaining-${dimension}`] = String(entry.remaining);
+    headers[`x-ratelimit-reset-${dimension}`] = duration3(entry.resetAt - now);
+  }
+  return headers;
+}
+
+// apps/gateway/src/quiesce.ts
+function createQuiesceLatch() {
+  let admitting = true;
+  let inFlight = 0;
+  let onIdle = null;
+  const settle = () => {
+    if (inFlight > 0 || onIdle === null)
+      return;
+    const resolve2 = onIdle;
+    onIdle = null;
+    resolve2();
+  };
+  return {
+    enter() {
+      if (!admitting)
+        return null;
+      inFlight++;
+      let released = false;
+      return () => {
+        if (released)
+          return;
+        released = true;
+        inFlight--;
+        settle();
+      };
+    },
+    isClosed: () => !admitting,
+    open() {
+      admitting = true;
+    },
+    async close(deadlineMs) {
+      admitting = false;
+      if (inFlight === 0)
+        return { drained: true, inFlight: 0 };
+      let timer;
+      const idle = new Promise((resolve2) => {
+        onIdle = resolve2;
+      });
+      const deadline = new Promise((resolve2) => {
+        timer = setTimeout(resolve2, deadlineMs);
+      });
+      try {
+        await Promise.race([idle, deadline]);
+      } finally {
+        clearTimeout(timer);
+        onIdle = null;
+      }
+      return { drained: inFlight === 0, inFlight };
+    }
+  };
 }
 
 // apps/gateway/src/ingress/schemas.ts
@@ -40948,6 +43171,48 @@ function parseDataUrl(url2) {
   }
   return { mediaType: match[1], data: match[2] };
 }
+var BASE64_MAGIC = [
+  ["iVBORw0KGgo", "image/png"],
+  ["/9j/", "image/jpeg"],
+  ["R0lGOD", "image/gif"],
+  ["UklGR", "image/webp"]
+];
+function readSidecarImage(raw, declaredMediaType) {
+  if (!raw.startsWith("data:") && /^[a-z][a-z0-9+.-]*:/i.test(raw)) {
+    return { ok: false, reason: "remote", detail: "the gateway does not fetch remote images" };
+  }
+  const dataUrl = raw.startsWith("data:") ? /^data:([^;,]+);base64,(.*)$/s.exec(raw) : null;
+  if (raw.startsWith("data:") && dataUrl === null) {
+    return {
+      ok: false,
+      reason: "unrecognized",
+      detail: "data URL must carry base64 content"
+    };
+  }
+  const resolved = dataUrl === null ? { mediaType: BASE64_MAGIC.find(([prefix]) => raw.startsWith(prefix))?.[1], data: raw } : { mediaType: dataUrl[1], data: dataUrl[2] };
+  const mediaType = resolved.mediaType ?? declaredMediaType;
+  if (mediaType === undefined) {
+    return {
+      ok: false,
+      reason: "unrecognized",
+      detail: "unrecognized image data; expected PNG, JPEG, GIF or WebP"
+    };
+  }
+  if (!mediaType.startsWith("image/")) {
+    return { ok: false, reason: "not-an-image", detail: `${mediaType} is not an image` };
+  }
+  return { ok: true, mediaType, data: resolved.data };
+}
+function requireSidecarImage(raw, field) {
+  const result = readSidecarImage(raw, undefined);
+  if (!result.ok)
+    throw new GatewayError("BAD_REQUEST", `${field}: ${result.detail}`);
+  return { mediaType: result.mediaType, data: result.data };
+}
+function optionalSidecarImage(raw, declaredMediaType) {
+  const result = readSidecarImage(raw, declaredMediaType);
+  return result.ok ? { mediaType: result.mediaType, data: result.data } : null;
+}
 
 // apps/gateway/src/routes/http.ts
 function readCookie(request2, name) {
@@ -41123,13 +43388,19 @@ function adminRoutes(deps) {
   }).post("/api/keys", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     return createKey(deps.store, await readJson(request2));
+  }).put("/api/keys/:id/limits", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    return setKeyLimits(deps.store, params.id, await readJson(request2));
   }).delete("/api/keys/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await revokeKey(deps.store, params.id);
     return { ok: true };
   }).get("/api/settings", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
-    return { settings: await getSettings(deps.store) };
+    return {
+      settings: await getSettings(deps.store),
+      bodyLoggingAllowed: deps.bodyLoggingAllowed === true
+    };
   }).put("/api/settings", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     await putSettings(deps.store, await readJson(request2));
@@ -41151,6 +43422,9 @@ function adminRoutes(deps) {
   }).get("/api/logs", async ({ request: request2, query }) => {
     await requireAdmin(request2, deps.admin);
     return { logs: await recentLogs(deps.store, query.limit) };
+  }).get("/api/requests/:id/body", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    return readRequestBody(deps.store, params.id);
   }).get("/api/console", async ({ request: request2, query }) => {
     await requireAdmin(request2, deps.admin);
     if (deps.console === undefined)
@@ -41186,8 +43460,165 @@ function connectRoutes(deps) {
   });
 }
 
+// apps/gateway/src/routes/database.ts
+import { dirname as dirname3 } from "path";
+var QUIESCE_DEADLINE_MS = 1e4;
+async function swap(deps, logger2, label2, operation) {
+  const startedAt = deps.now();
+  const closedHere = !deps.latch.isClosed();
+  const quiesce = await deps.latch.close(deps.quiesceDeadlineMs ?? QUIESCE_DEADLINE_MS);
+  if (!quiesce.drained) {
+    logger2.warn("client requests still in flight at the quiesce deadline", {
+      reason: label2,
+      count: quiesce.inFlight
+    });
+  }
+  try {
+    const result = await operation();
+    deps.snapshots?.invalidate();
+    deps.latch.open();
+    logger2.warn("database replaced", {
+      snapshotId: result.preRestoreSnapshot.id,
+      durationMs: deps.now() - startedAt,
+      reason: label2
+    });
+    if (result.adminPasswordChanged) {
+      deps.admin.invalidateSessions();
+      logger2.warn("admin sessions ended: the restored database carries a different password", {
+        reason: label2
+      });
+    }
+    return result;
+  } catch (error51) {
+    if (error51 instanceof SwapFailedError) {
+      logger2.error(error51.reopened ? "database swap failed; client requests stay refused" : "database swap failed and the database could not be reopened; restart this process", { snapshotId: error51.preRestoreSnapshotId, reason: label2 });
+      throw new GatewayError("INTERNAL", error51.message);
+    }
+    if (closedHere)
+      deps.latch.open();
+    throw error51;
+  }
+}
+async function stageUpload(deps, database, request2) {
+  const cap = deps.maxImportBytes ?? MAX_IMPORT_BYTES;
+  const path = stagedImportPath(database, crypto.randomUUID());
+  const body2 = request2.body;
+  if (body2 === null)
+    throw new GatewayError("BAD_REQUEST", "a database import needs a body");
+  const dir = dirname3(deps.store.databasePath);
+  const free = deps.fs.freeBytes(dir);
+  const reserve = Math.ceil((deps.fs.stat(deps.store.databasePath)?.size ?? 0) * SNAPSHOT_HEADROOM);
+  const budget = free === null ? cap : Math.max(0, free - reserve);
+  const diskBound = budget < cap;
+  const limit = diskBound ? budget : cap;
+  const refuse = () => diskBound ? new GatewayError("CONFLICT", "not enough free disk space to stage a database import") : new GatewayError("BAD_REQUEST", `a database import may not exceed ${cap} bytes`);
+  const declared = Number(request2.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > limit)
+    throw refuse();
+  const sink = Bun.file(path).writer();
+  const reader = body2.getReader();
+  let written = 0;
+  try {
+    while (true) {
+      const chunk2 = await reader.read();
+      if (chunk2.done === true)
+        break;
+      written += chunk2.value.byteLength;
+      if (written > limit) {
+        await reader.cancel();
+        throw refuse();
+      }
+      sink.write(chunk2.value);
+    }
+    await sink.flush();
+    return path;
+  } catch (error51) {
+    deps.fs.unlink(path);
+    throw error51;
+  } finally {
+    await sink.end();
+  }
+}
+function databaseRoutes(deps) {
+  const logger2 = deps.logger ?? noopLogger;
+  const database = { store: deps.store, fs: deps.fs, now: deps.now, logger: logger2 };
+  return new Elysia().onError(apiErrorHandler).get("/api/database", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    return getDatabaseOverview(database);
+  }).post("/api/database/vacuum", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const result = await vacuum(database);
+    logger2.info("database vacuumed", {
+      sizeBytes: result.reclaimedBytes,
+      durationMs: result.durationMs
+    });
+    return { ok: true, ...result };
+  }).get("/api/database/snapshots", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    return { snapshots: listSnapshots(database) };
+  }).post("/api/database/snapshots", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const snapshot = await createSnapshot(database, { reason: "manual" });
+    logger2.info("database snapshot created", {
+      snapshotId: snapshot.id,
+      sizeBytes: snapshot.sizeBytes
+    });
+    return snapshot;
+  }).get("/api/database/snapshots/:id/download", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    const snapshot = resolveSnapshotForDownload(database, params.id);
+    logger2.info("database snapshot downloaded", {
+      snapshotId: snapshot.filename,
+      sizeBytes: snapshot.sizeBytes
+    });
+    return new Response(Bun.file(snapshot.path), {
+      headers: {
+        "content-type": "application/octet-stream",
+        "content-length": String(snapshot.sizeBytes),
+        "content-disposition": `attachment; filename="${snapshot.filename}"`,
+        "cache-control": "no-store"
+      }
+    });
+  }).delete("/api/database/snapshots/:id", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    deleteSnapshot(database, params.id);
+    logger2.info("database snapshot deleted", { snapshotId: params.id });
+    return { ok: true };
+  }).post("/api/database/snapshots/:id/restore", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    return swap(deps, logger2, "restore", () => restoreSnapshot(database, params.id));
+  }).post("/api/database/import", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const path = await stageUpload(deps, database, request2);
+    try {
+      return await swap(deps, logger2, "import", () => importSnapshot(database, { path }));
+    } catch (error51) {
+      deps.fs.unlink(path);
+      throw error51;
+    }
+  }).put("/api/database/retention", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    return putRetention(database, await readJson(request2));
+  }).get("/api/lifecycle", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    return describeLifecycle(deps.lifecycle.env, deps.lifecycle.fileExists);
+  }).post("/api/lifecycle/restart", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const capability = describeLifecycle(deps.lifecycle.env, deps.lifecycle.fileExists);
+    logger2.warn("restart requested", { supervisor: capability.supervisor });
+    await requestRestart(deps.lifecycle);
+    return { ok: true };
+  }).post("/api/lifecycle/shutdown", async ({ request: request2 }) => {
+    await requireAdmin(request2, deps.admin);
+    const capability = describeLifecycle(deps.lifecycle.env, deps.lifecycle.fileExists);
+    logger2.warn("shutdown requested", { supervisor: capability.supervisor, reason: "api" });
+    await requestShutdown(deps.lifecycle);
+    return { ok: true };
+  });
+}
+
 // apps/gateway/src/auth/apiKey.ts
-async function authenticateApiKey(store, header) {
+async function authenticateApiKey(store, header, logger2 = noopLogger) {
   const raw = extractToken(header);
   if (raw === null)
     throw new GatewayError("AUTH", "missing or malformed Authorization header");
@@ -41195,7 +43626,12 @@ async function authenticateApiKey(store, header) {
   if (key === null || key.revokedAt !== null) {
     throw new GatewayError("AUTH", "invalid API key");
   }
-  return key;
+  const limits = key.limits;
+  if (limits === null) {
+    logger2.error("api key refused: limits unreadable", { apiKeyId: key.id });
+    throw new GatewayError("INTERNAL", "api key configuration is unusable");
+  }
+  return { ...key, limits };
 }
 function apiKeyHeader(headers) {
   const authorization = headers.get("authorization");
@@ -41221,6 +43657,139 @@ function extractToken(header) {
   return match === null ? value : match[1].trim();
 }
 
+// apps/gateway/src/bodyCapture.ts
+var MAX_CAPTURED_BODY_BYTES = MAX_ARTIFACT_BYTES;
+function asBody(text) {
+  if (text.length === 0)
+    return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function framesOf(text) {
+  return text.replaceAll(`\r
+`, `
+`).split(`
+
+`).filter((frame2) => frame2.length > 0);
+}
+function createFrameSink() {
+  const frames = [];
+  let bytes = 0;
+  const sink = {
+    frames,
+    truncated: false,
+    write(frame2) {
+      frames.push(frame2);
+      bytes += frame2.length;
+      while (bytes > MAX_CAPTURED_BODY_BYTES && frames.length > 1) {
+        bytes -= (frames.shift() ?? "").length;
+        sink.truncated = true;
+      }
+    }
+  };
+  return sink;
+}
+function createBodyCollector(options) {
+  const attempts = [];
+  const drains = [];
+  const client = { request: null, response: null, truncated: false };
+  const drain = async (stream2, entry) => {
+    const reader = stream2.getReader();
+    const decoder2 = new TextDecoder;
+    let bytes = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done === true)
+          break;
+        if (value === undefined)
+          continue;
+        entry.responded = true;
+        if (bytes >= MAX_CAPTURED_BODY_BYTES) {
+          entry.truncated = true;
+          continue;
+        }
+        bytes += value.byteLength;
+        entry.responseText += decoder2.decode(value, { stream: true });
+        if (bytes > MAX_CAPTURED_BODY_BYTES)
+          entry.truncated = true;
+      }
+      entry.responseText += decoder2.decode();
+    } catch {
+      entry.truncated = true;
+    } finally {
+      reader.releaseLock();
+    }
+    if (options.captureStreamChunks)
+      entry.frames = framesOf(entry.responseText);
+  };
+  const captureResponse = (res, entry) => {
+    let forAdapter;
+    return {
+      status: res.status,
+      headers: res.headers,
+      get body() {
+        if (forAdapter !== undefined)
+          return forAdapter;
+        const source = res.body;
+        if (source === null) {
+          forAdapter = null;
+          return null;
+        }
+        const [adapterBranch, captureBranch] = source.tee();
+        drains.push(drain(captureBranch, entry));
+        forAdapter = adapterBranch;
+        return forAdapter;
+      },
+      text: async () => {
+        const text = await res.text();
+        entry.responded = true;
+        entry.responseText = text.slice(0, MAX_CAPTURED_BODY_BYTES);
+        if (entry.responseText.length < text.length)
+          entry.truncated = true;
+        if (options.captureStreamChunks)
+          entry.frames = framesOf(entry.responseText);
+        return text;
+      }
+    };
+  };
+  return {
+    client,
+    wrap(http) {
+      return async (req) => {
+        const entry = {
+          attempt: attempts.length + 1,
+          provider: req.provider,
+          request: req.body.length > MAX_CAPTURED_BODY_BYTES ? req.body.slice(0, MAX_CAPTURED_BODY_BYTES) : asBody(req.body),
+          responseText: "",
+          responded: false,
+          frames: null,
+          truncated: req.body.length > MAX_CAPTURED_BODY_BYTES
+        };
+        attempts.push(entry);
+        const res = await http(req);
+        return captureResponse(res, entry);
+      };
+    },
+    attempts() {
+      return attempts.map((entry) => ({
+        attempt: entry.attempt,
+        provider: entry.provider,
+        request: entry.request,
+        response: entry.responded ? asBody(entry.responseText) : null,
+        streamChunks: entry.frames,
+        truncated: entry.truncated
+      }));
+    },
+    async settle() {
+      await Promise.all(drains);
+    }
+  };
+}
+
 // packages/rtk/src/command.ts
 var UNSUPPORTED_OUTPUT = new Set(["--json", "--sarif"]);
 function tokenize(command) {
@@ -43057,6 +45626,26 @@ function newPendingRequestLog(input) {
     status: 0
   };
 }
+function reasonField(error51, logger2) {
+  return error51.provider === undefined || logger2.enabled("debug") ? { reason: error51.message } : {};
+}
+function reportRejection(logger2, requestId, log, error51, surface) {
+  const fields = {
+    requestId,
+    ...surface === undefined ? {} : { surface },
+    status: log.status,
+    provider: log.resolvedProvider ?? undefined,
+    model: log.resolvedModel ?? undefined,
+    credentialId: log.credentialId ?? undefined,
+    code: error51.code,
+    attempts: log.attempts,
+    ...reasonField(error51, logger2)
+  };
+  if (error51.code === "INTERNAL")
+    logger2.error("request rejected", fields);
+  else
+    logger2.warn("request rejected", fields);
+}
 function report(logger2, what, requestId, error51) {
   logger2.warn(what, {
     requestId,
@@ -43077,12 +45666,25 @@ async function routeLog(store, requestId, target, logger2 = noopLogger) {
     report(logger2, "failed to record request route", requestId, error51);
   }
 }
-async function finishLog(store, log, keyId, logger2 = noopLogger) {
+async function finishLog(store, log, keyId, logger2 = noopLogger, bodies, debit) {
   try {
     await store.usage.append({ ...log, apiKeyId: keyId });
   } catch (error51) {
     report(logger2, "failed to persist request log", log.id, error51);
   }
+  if (keyId !== null && debit !== undefined) {
+    debit(keyId, {
+      tokens: log.inputTokens + log.outputTokens + log.cacheReadTokens + log.cacheWriteTokens,
+      costUsd: log.costUsd
+    });
+  }
+  if (bodies === undefined)
+    return;
+  try {
+    await bodies(log);
+  } catch (error51) {
+    report(logger2, "failed to persist request bodies", log.id, error51);
+  }
 }
 
 // apps/gateway/src/dispatch/attempt.ts
@@ -43131,7 +45733,11 @@ var NETWORK_HINTS = [
 ];
 function classify(error51) {
   if (error51 instanceof GatewayError) {
-    return error51.retryAfterMs === undefined ? { code: error51.code } : { code: error51.code, retryAfterMs: error51.retryAfterMs };
+    return {
+      code: error51.code,
+      ...error51.retryAfterMs === undefined ? {} : { retryAfterMs: error51.retryAfterMs },
+      ...error51.provider === undefined ? {} : { provider: error51.provider }
+    };
   }
   if (error51 instanceof DOMException && error51.name === "AbortError") {
     return { code: "TIMEOUT" };
@@ -43183,10 +45789,20 @@ async function dispatch(request2, deps, signal, requestId) {
     status: 0
   });
   let dispatchRequest = request2;
-  const fail = (code, message) => {
-    log.errorCode = code;
-    log.status = HTTP_STATUS[code];
+  const reject = (error51) => {
+    reportRejection(logger2, requestId, log, error51);
+  };
+  const isClientAbort = (error51) => signal.aborted && error51 === signal.reason;
+  const rewrap = (classified, message) => new GatewayError(classified.code, message, {
+    ...classified.retryAfterMs === undefined ? {} : { retryAfterMs: classified.retryAfterMs },
+    ...classified.provider === undefined ? {} : { provider: classified.provider }
+  });
+  const fail = (code, message, cancelled = false) => {
+    log.errorCode = cancelled ? "interrupted" : code;
+    log.status = cancelled ? 499 : HTTP_STATUS[code];
     log.durationMs = deps.now() - startedAt;
+    if (!cancelled)
+      reject(new GatewayError(code, message));
     return {
       events: async function* () {
         yield { type: "error", code, message, retryable: RETRYABLE[code] };
@@ -43230,8 +45846,10 @@ async function dispatch(request2, deps, signal, requestId) {
     checkCancellation();
     model = resolveModel(dispatchRequest.model, snapshot);
   } catch (error51) {
-    const { code } = classify(error51);
     clearDeadline();
+    if (isClientAbort(error51))
+      return fail("TIMEOUT", "client disconnected", true);
+    const { code } = classify(error51);
     return fail(code, error51 instanceof Error ? error51.message : "unresolvable model");
   }
   const { candidates, excluded } = rank({
@@ -43275,10 +45893,11 @@ async function dispatch(request2, deps, signal, requestId) {
     eager.release();
   else
     signal.addEventListener("abort", releaseOnAbort, { once: true });
-  const persistHealth = async (next) => {
-    await deps.store.credentials.saveHealth([next]);
+  const persistHealth = async (candidate, transition) => {
+    const credentialId = candidate.credential.id;
+    const { model: model2 } = candidate.target;
+    await deps.store.credentials.updateHealth(credentialId, model2, (current) => transition(current ?? blankHealth(credentialId, model2)));
   };
-  const healthFor = (candidate) => snapshot.health.get(healthKey(candidate.credential.id, candidate.target.model)) ?? blankHealth(candidate.credential.id, candidate.target.model);
   async function* run() {
     try {
       let lastError = null;
@@ -43377,16 +45996,28 @@ async function dispatch(request2, deps, signal, requestId) {
                       throw new GatewayError(event.code, event.message);
                     }
                     committed = true;
-                    yield event;
-                    await persistHealth(recordFailure(healthFor(candidate), {
-                      settings: snapshot.settings,
-                      now: deps.now(),
-                      code: event.code,
-                      jitter: deps.rand()
-                    }));
                     log.status = HTTP_STATUS[event.code];
                     log.errorCode = event.code;
                     log.durationMs = deps.now() - startedAt;
+                    reject(new GatewayError(event.code, event.message, {
+                      provider: candidate.target.provider
+                    }));
+                    yield event;
+                    try {
+                      await persistHealth(candidate, (current) => recordFailure(current, {
+                        settings: snapshot.settings,
+                        now: deps.now(),
+                        code: event.code,
+                        jitter: deps.rand()
+                      }));
+                    } catch (healthError) {
+                      logger2.error("failed to persist credential health", {
+                        requestId,
+                        provider: candidate.target.provider,
+                        credentialId: candidate.credential.id,
+                        reason: healthError instanceof Error ? healthError.message : "unknown"
+                      });
+                    }
                     return;
                   }
                   if (!committed && event.type !== "end") {
@@ -43405,7 +46036,7 @@ async function dispatch(request2, deps, signal, requestId) {
                 if (!terminal) {
                   throw new GatewayError("UPSTREAM", "upstream stream ended without a terminal event");
                 }
-                await persistHealth(recordSuccess(healthFor(candidate), {
+                await persistHealth(candidate, (current) => recordSuccess(current, {
                   settings: snapshot.settings,
                   now: deps.now(),
                   ttftMs: log.ttftMs
@@ -43418,9 +46049,9 @@ async function dispatch(request2, deps, signal, requestId) {
                 if (signal.aborted)
                   throw signal.reason;
                 const classifiedError = deadlineAt !== null && dispatchSignal.aborted ? { code: "TIMEOUT" } : classify(error51);
-                const { code: code2, retryAfterMs } = classifiedError;
-                const message = error51 instanceof Error ? error51.message : "attempt failed";
-                lastError = retryAfterMs === undefined ? new GatewayError(code2, message) : new GatewayError(code2, message, { retryAfterMs });
+                const { code: code2 } = classifiedError;
+                const message2 = error51 instanceof Error ? error51.message : "attempt failed";
+                lastError = rewrap(classifiedError, message2);
                 if (code2 === "AUTH" && !committed && !authRefreshRetried && !preemptiveRefreshRequired && candidate.credential.authType === "oauth" && candidate.credential.hasRefreshToken) {
                   authRefreshRetried = true;
                   logger2.warn("attempt authentication failed; refreshing credential", {
@@ -43439,13 +46070,20 @@ async function dispatch(request2, deps, signal, requestId) {
                       throw signal.reason;
                     const classified = deadlineAt !== null && dispatchSignal.aborted ? { code: "TIMEOUT" } : classify(refreshError);
                     const refreshMessage = refreshError instanceof Error ? refreshError.message : "credential refresh failed";
-                    lastError = classified.retryAfterMs === undefined ? new GatewayError(classified.code, refreshMessage) : new GatewayError(classified.code, refreshMessage, {
-                      retryAfterMs: classified.retryAfterMs
+                    lastError = rewrap(classified, refreshMessage);
+                    logger2.warn("credential refresh failed", {
+                      requestId,
+                      provider: candidate.target.provider,
+                      model: candidate.target.model,
+                      credentialId: candidate.credential.id,
+                      attempt: i + 1,
+                      code: classified.code,
+                      ...reasonField(lastError, logger2)
                     });
                   }
                 }
                 const failure = lastError;
-                await persistHealth(recordFailure(healthFor(candidate), {
+                await persistHealth(candidate, (current) => recordFailure(current, {
                   settings: snapshot.settings,
                   now: deps.now(),
                   code: failure.code,
@@ -43468,6 +46106,7 @@ async function dispatch(request2, deps, signal, requestId) {
                   log.status = HTTP_STATUS[failure.code];
                   log.errorCode = failure.code;
                   log.durationMs = deps.now() - startedAt;
+                  reject(failure);
                   yield {
                     type: "error",
                     code: failure.code,
@@ -43489,10 +46128,12 @@ async function dispatch(request2, deps, signal, requestId) {
       log.status = HTTP_STATUS[code];
       log.errorCode = code;
       log.durationMs = deps.now() - startedAt;
+      const message = lastError?.message ?? "all candidates failed";
+      reject(lastError?.provider === undefined ? new GatewayError(code, message) : new GatewayError(code, message, { provider: lastError.provider }));
       yield {
         type: "error",
         code,
-        message: lastError?.message ?? "all candidates failed",
+        message,
         retryable: false
       };
     } finally {
@@ -43535,12 +46176,12 @@ async function dispatch(request2, deps, signal, requestId) {
 function waitForCancellation(promise2, signal) {
   if (signal.aborted)
     return Promise.reject(signal.reason);
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const abort = () => reject(signal.reason);
     signal.addEventListener("abort", abort, { once: true });
     promise2.then((value) => {
       signal.removeEventListener("abort", abort);
-      resolve(value);
+      resolve2(value);
     }, (error51) => {
       signal.removeEventListener("abort", abort);
       reject(error51);
@@ -43577,314 +46218,6 @@ function createLoadRegistry(logger2 = noopLogger) {
   };
 }
 
-// apps/gateway/src/egress/anthropic.ts
-var STOP_REASON2 = {
-  endTurn: "end_turn",
-  maxTokens: "max_tokens",
-  stopSequence: "stop_sequence",
-  toolUse: "tool_use",
-  contentFilter: "refusal",
-  pauseTurn: "pause_turn"
-};
-var ERROR_TYPE2 = {
-  AUTH: "authentication_error",
-  RATE_LIMIT: "rate_limit_error",
-  QUOTA_EXHAUSTED: "rate_limit_error",
-  OVERLOADED: "overloaded_error",
-  BAD_REQUEST: "invalid_request_error",
-  CONFLICT: "invalid_request_error",
-  CONTENT_FILTER: "invalid_request_error",
-  CAPABILITY_MISMATCH: "invalid_request_error",
-  MODEL_UNAVAILABLE: "not_found_error",
-  UPSTREAM: "api_error",
-  TIMEOUT: "api_error",
-  NETWORK: "api_error",
-  NO_CANDIDATES: "overloaded_error",
-  ALL_CANDIDATES_FAILED: "api_error",
-  INTERNAL: "api_error"
-};
-var frame = (event, data) => ({
-  event,
-  data: JSON.stringify(data)
-});
-async function* anthropicStream(events, requestId) {
-  let model = "";
-  const suppressed2 = new Set;
-  const outIndex = new Map;
-  let nextOutIndex = 0;
-  for await (const event of events) {
-    switch (event.type) {
-      case "start":
-        model = event.model;
-        yield frame("message_start", {
-          type: "message_start",
-          message: {
-            id: requestId,
-            type: "message",
-            role: "assistant",
-            model,
-            content: [],
-            stop_reason: null,
-            stop_sequence: null,
-            usage: {
-              input_tokens: 0,
-              output_tokens: 0,
-              cache_read_input_tokens: 0,
-              cache_creation_input_tokens: 0
-            }
-          }
-        });
-        break;
-      case "blockStart": {
-        const b = event.block;
-        if (b.type === "thinking" && b.signed !== true) {
-          suppressed2.add(event.index);
-          break;
-        }
-        const content_block = b.type === "text" ? { type: "text", text: "" } : b.type === "thinking" ? { type: "thinking", thinking: "" } : b.type === "anthropicNative" ? { ...b.data, type: b.blockType } : { type: "tool_use", id: b.id, name: b.name, input: {} };
-        const index = nextOutIndex++;
-        outIndex.set(event.index, index);
-        yield frame("content_block_start", {
-          type: "content_block_start",
-          index,
-          content_block
-        });
-        break;
-      }
-      case "blockDelta": {
-        if (suppressed2.has(event.index))
-          break;
-        const d = event.delta;
-        const delta2 = d.type === "text" ? { type: "text_delta", text: d.text } : d.type === "thinking" ? { type: "thinking_delta", thinking: d.text } : d.type === "thinkingSignature" ? { type: "signature_delta", signature: d.signature } : d.type === "anthropicNative" ? { type: d.deltaType, ...d.data } : { type: "input_json_delta", partial_json: d.partial };
-        yield frame("content_block_delta", {
-          type: "content_block_delta",
-          index: outIndex.get(event.index) ?? event.index,
-          delta: delta2
-        });
-        break;
-      }
-      case "blockEnd":
-        if (suppressed2.has(event.index))
-          break;
-        yield frame("content_block_stop", {
-          type: "content_block_stop",
-          index: outIndex.get(event.index) ?? event.index
-        });
-        break;
-      case "end":
-        yield frame("message_delta", {
-          type: "message_delta",
-          delta: { stop_reason: STOP_REASON2[event.stopReason], stop_sequence: null },
-          usage: {
-            input_tokens: event.usage.inputTokens,
-            output_tokens: event.usage.outputTokens,
-            cache_read_input_tokens: event.usage.cacheReadTokens,
-            cache_creation_input_tokens: event.usage.cacheWriteTokens
-          }
-        });
-        yield frame("message_stop", { type: "message_stop" });
-        break;
-      case "error":
-        yield frame("error", {
-          type: "error",
-          error: { type: ERROR_TYPE2[event.code], message: event.message }
-        });
-        break;
-    }
-  }
-}
-function anthropicResponse(collected, requestId) {
-  return {
-    id: requestId,
-    type: "message",
-    role: "assistant",
-    model: collected.model,
-    content: collected.content.filter((b) => b.type !== "thinking" || b.signature !== undefined && b.signature !== "").map((b) => {
-      switch (b.type) {
-        case "text":
-          return {
-            type: "text",
-            text: b.text,
-            ...b.citations === undefined ? {} : { citations: b.citations }
-          };
-        case "thinking":
-          return { type: "thinking", thinking: b.text, signature: b.signature };
-        case "toolUse":
-          return { type: "tool_use", id: b.id, name: b.name, input: b.input };
-        case "anthropicNative":
-          return { ...b.data, type: b.blockType };
-        default:
-          return { type: "text", text: "" };
-      }
-    }),
-    stop_reason: STOP_REASON2[collected.stopReason],
-    stop_sequence: null,
-    usage: {
-      input_tokens: collected.usage.inputTokens,
-      output_tokens: collected.usage.outputTokens,
-      cache_read_input_tokens: collected.usage.cacheReadTokens,
-      cache_creation_input_tokens: collected.usage.cacheWriteTokens
-    }
-  };
-}
-function anthropicErrorBody(code, message) {
-  return { type: "error", error: { type: ERROR_TYPE2[code], message } };
-}
-
-// apps/gateway/src/egress/openai.ts
-function usageBody(usage) {
-  const prompt = promptTokens(usage);
-  return {
-    prompt_tokens: prompt,
-    completion_tokens: usage.outputTokens,
-    total_tokens: prompt + usage.outputTokens,
-    prompt_tokens_details: { cached_tokens: usage.cacheReadTokens }
-  };
-}
-var FINISH3 = {
-  endTurn: "stop",
-  maxTokens: "length",
-  stopSequence: "stop",
-  toolUse: "tool_calls",
-  contentFilter: "content_filter",
-  pauseTurn: "stop"
-};
-var ERROR_TYPE3 = {
-  AUTH: { type: "invalid_request_error", code: "invalid_api_key" },
-  RATE_LIMIT: { type: "rate_limit_error", code: "rate_limit_exceeded" },
-  QUOTA_EXHAUSTED: { type: "insufficient_quota", code: "insufficient_quota" },
-  OVERLOADED: { type: "server_error", code: "server_error" },
-  BAD_REQUEST: { type: "invalid_request_error", code: "invalid_request" },
-  CONFLICT: { type: "invalid_request_error", code: "conflict" },
-  CONTENT_FILTER: { type: "invalid_request_error", code: "content_policy_violation" },
-  CAPABILITY_MISMATCH: { type: "invalid_request_error", code: "invalid_request" },
-  MODEL_UNAVAILABLE: { type: "invalid_request_error", code: "model_not_found" },
-  UPSTREAM: { type: "server_error", code: "server_error" },
-  TIMEOUT: { type: "server_error", code: "timeout" },
-  NETWORK: { type: "server_error", code: "server_error" },
-  NO_CANDIDATES: { type: "server_error", code: "service_unavailable" },
-  ALL_CANDIDATES_FAILED: { type: "server_error", code: "server_error" },
-  INTERNAL: { type: "server_error", code: "server_error" }
-};
-var chunk = (id, created, model, choice, usage) => ({
-  id,
-  object: "chat.completion.chunk",
-  created,
-  model,
-  choices: [choice],
-  ...usage === undefined ? {} : { usage }
-});
-async function* openaiStream(events, requestId, created) {
-  let model = "";
-  let roleSent = false;
-  let completed = false;
-  const toolIndex = new Map;
-  const emit = (data) => ({ event: "message", data: JSON.stringify(data) });
-  for await (const event of events) {
-    switch (event.type) {
-      case "start":
-        model = event.model;
-        break;
-      case "blockStart": {
-        if (event.block.type === "text") {
-          if (!roleSent) {
-            roleSent = true;
-            yield emit(chunk(requestId, created, model, {
-              index: 0,
-              delta: { role: "assistant", content: "" },
-              finish_reason: null
-            }));
-          }
-        } else if (event.block.type === "toolUse") {
-          const index = toolIndex.size;
-          toolIndex.set(event.index, index);
-          const firstRole = roleSent ? {} : { role: "assistant" };
-          roleSent = true;
-          yield emit(chunk(requestId, created, model, {
-            index: 0,
-            delta: {
-              ...firstRole,
-              tool_calls: [
-                {
-                  index,
-                  id: event.block.id,
-                  type: "function",
-                  function: { name: event.block.name, arguments: "" }
-                }
-              ]
-            },
-            finish_reason: null
-          }));
-        }
-        break;
-      }
-      case "blockDelta": {
-        const d = event.delta;
-        if (d.type === "text") {
-          yield emit(chunk(requestId, created, model, {
-            index: 0,
-            delta: { content: d.text },
-            finish_reason: null
-          }));
-        } else if (d.type === "toolJson") {
-          const index = toolIndex.get(event.index) ?? 0;
-          yield emit(chunk(requestId, created, model, {
-            index: 0,
-            delta: { tool_calls: [{ index, function: { arguments: d.partial } }] },
-            finish_reason: null
-          }));
-        }
-        break;
-      }
-      case "blockEnd":
-        break;
-      case "end":
-        completed = true;
-        yield emit(chunk(requestId, created, model, { index: 0, delta: {}, finish_reason: FINISH3[event.stopReason] }, usageBody(event.usage)));
-        break;
-      case "error": {
-        const e = ERROR_TYPE3[event.code];
-        yield emit({ error: { message: event.message, type: e.type, code: e.code } });
-        break;
-      }
-    }
-  }
-  if (completed)
-    yield { event: "message", data: "[DONE]" };
-}
-function openaiResponse(collected, requestId, created) {
-  const text = collected.content.flatMap((b) => b.type === "text" ? [b.text] : []).join("");
-  const toolCalls = collected.content.flatMap((b) => b.type === "toolUse" ? [
-    {
-      id: b.id,
-      type: "function",
-      function: { name: b.name, arguments: JSON.stringify(b.input) }
-    }
-  ] : []);
-  return {
-    id: requestId,
-    object: "chat.completion",
-    created,
-    model: collected.model,
-    choices: [
-      {
-        index: 0,
-        message: {
-          role: "assistant",
-          content: toolCalls.length > 0 && text.length === 0 ? null : text,
-          ...toolCalls.length > 0 ? { tool_calls: toolCalls } : {}
-        },
-        finish_reason: FINISH3[collected.stopReason]
-      }
-    ],
-    usage: usageBody(collected.usage)
-  };
-}
-function openaiErrorBody(code, message) {
-  const e = ERROR_TYPE3[code];
-  return { error: { message, type: e.type, code: e.code } };
-}
-
 // apps/gateway/src/ingress/anthropicTools.ts
 var TOOL_FIELDS = {
   cache_control: cacheControlSchema.nullable(),
@@ -44503,13 +46836,38 @@ var toolCall = exports_external.object({
   type: exports_external.literal("function"),
   function: exports_external.object({ name: exports_external.string(), arguments: exports_external.string() })
 });
+var attachment = exports_external.object({
+  url: exports_external.string(),
+  contentType: exports_external.string().optional(),
+  mediaType: exports_external.string().optional()
+});
 var message2 = exports_external.object({
   role: exports_external.enum(["system", "developer", "user", "assistant", "tool"]),
   content: exports_external.union([exports_external.string(), exports_external.array(part), exports_external.null()]).optional(),
   tool_calls: exports_external.array(toolCall).optional(),
   tool_call_id: exports_external.string().optional(),
-  cache_control: exports_external.unknown().optional()
+  cache_control: exports_external.unknown().optional(),
+  images: exports_external.array(exports_external.string()).optional(),
+  attachments: exports_external.array(attachment).optional(),
+  experimental_attachments: exports_external.array(attachment).optional()
 });
+function hasOllamaImages(m) {
+  return (m.images ?? []).length > 0;
+}
+function sidecarImages(m) {
+  const blocks2 = [];
+  for (const [index, raw] of (m.images ?? []).entries()) {
+    blocks2.push({ type: "image", ...requireSidecarImage(raw, `messages: images[${index}]`) });
+  }
+  for (const list of [m.attachments, m.experimental_attachments]) {
+    for (const a of list ?? []) {
+      const image = optionalSidecarImage(a.url, a.mediaType ?? a.contentType);
+      if (image !== null)
+        blocks2.push({ type: "image", ...image });
+    }
+  }
+  return blocks2;
+}
 var schema2 = exports_external.object({
   model: exports_external.string().min(1),
   messages: exports_external.array(message2).min(1),
@@ -44589,6 +46947,9 @@ function parseOpenAIRequest(body2) {
   const system = [];
   const messages = [];
   for (const m of parsed.messages) {
+    if (m.role !== "user" && m.role !== "assistant" && hasOllamaImages(m)) {
+      throw new GatewayError("BAD_REQUEST", `messages: a ${m.role} message cannot carry images; attach them to a user message`);
+    }
     if (m.role === "system" || m.role === "developer") {
       const blocks2 = contentBlocks(m.content);
       applyMessageCacheControl(blocks2, m.cache_control);
@@ -44614,6 +46975,7 @@ function parseOpenAIRequest(body2) {
       continue;
     }
     const content = contentBlocks(m.content);
+    content.push(...sidecarImages(m));
     for (const call of m.tool_calls ?? []) {
       content.push({
         type: "toolUse",
@@ -44716,8 +47078,8 @@ var KEEPALIVE_MS = 1e4;
 var KEEPALIVE = Symbol("keepalive");
 function withKeepalive(pending, ms) {
   let timer;
-  const tick = new Promise((resolve) => {
-    timer = setTimeout(() => resolve(KEEPALIVE), ms);
+  const tick = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2(KEEPALIVE), ms);
   });
   return Promise.race([pending, tick]).finally(() => clearTimeout(timer));
 }
@@ -44727,24 +47089,47 @@ var SSE_HEADERS = {
   connection: "keep-alive",
   "x-accel-buffering": "no"
 };
-function errorResponse(surface, code, message3) {
-  const body2 = surface === "anthropic" ? anthropicErrorBody(code, message3) : openaiErrorBody(code, message3);
+function errorBody(surface, code, message3) {
+  return surface === "anthropic" ? anthropicErrorBody(code, message3) : openaiErrorBody(code, message3);
+}
+function rateLimitHeaders(surface, headroom, now) {
+  return surface === "anthropic" ? anthropicRateLimitHeaders(headroom) : openaiRateLimitHeaders(headroom, now);
+}
+function afterThisRequest(headroom) {
+  const requests = headroom.requests;
+  if (requests === undefined)
+    return headroom;
+  return {
+    ...headroom,
+    requests: { ...requests, remaining: Math.max(0, requests.remaining - 1) }
+  };
+}
+function retryAfterHeaders(error51) {
+  const ms = error51.retryAfterMs;
+  if (ms === undefined || HTTP_STATUS[error51.code] !== 429)
+    return {};
+  return { "retry-after": String(Math.max(0, Math.ceil(ms / 1000))) };
+}
+function jsonResponse(body2, status2, headers = {}) {
   return new Response(JSON.stringify(body2), {
-    status: HTTP_STATUS[code],
-    headers: { "content-type": "application/json" }
+    status: status2,
+    headers: { "content-type": "application/json", ...headers }
   });
 }
+function errorResponse(surface, code, message3, headers = {}) {
+  return jsonResponse(errorBody(surface, code, message3), HTTP_STATUS[code], headers);
+}
 function asGatewayError(error51) {
   if (error51 instanceof GatewayError)
     return error51;
   return new GatewayError("INTERNAL", error51 instanceof Error ? error51.message : "internal error");
 }
-function sseResponse(frames, onDone, keepaliveMs, source) {
-  const encoder2 = new TextEncoder;
+function sseResponse(frames, onDone, keepaliveMs, source, limitHeaders, onFrame) {
+  const encoder4 = new TextEncoder;
   let done = null;
-  const runOnce = (cancelled = false) => {
+  const runOnce = (cancelled = false, failure) => {
     if (done === null)
-      done = onDone(cancelled);
+      done = onDone(cancelled, failure);
     return done;
   };
   let inflight = null;
@@ -44754,7 +47139,7 @@ function sseResponse(frames, onDone, keepaliveMs, source) {
         inflight ??= frames.next();
         const next = await withKeepalive(inflight, keepaliveMs);
         if (next === KEEPALIVE) {
-          controller.enqueue(encoder2.encode(`: keepalive
+          controller.enqueue(encoder4.encode(`: keepalive
 
 `));
           return;
@@ -44766,13 +47151,15 @@ function sseResponse(frames, onDone, keepaliveMs, source) {
           return;
         }
         const { event, data } = next.value;
-        controller.enqueue(encoder2.encode(`event: ${event}
+        onFrame?.(`event: ${event}
+data: ${data}`);
+        controller.enqueue(encoder4.encode(`event: ${event}
 data: ${data}
 
 `));
       } catch (error51) {
         controller.error(error51);
-        await runOnce();
+        await runOnce(false, error51);
       }
     },
     async cancel() {
@@ -44781,17 +47168,41 @@ data: ${data}
       await runOnce(true);
     }
   });
-  return new Response(stream2, { headers: SSE_HEADERS });
+  return new Response(stream2, { headers: { ...SSE_HEADERS, ...limitHeaders } });
+}
+async function bodyCollectorFor(deps, key) {
+  if (deps.bodyLoggingAllowed !== true)
+    return null;
+  if (key.bodyLoggingOptOut)
+    return null;
+  const { settings } = await deps.snapshots.get(deps.now());
+  if (!settings.bodyLoggingEnabled)
+    return null;
+  return createBodyCollector({
+    captureStreamChunks: settings.bodyLoggingCaptureStreamChunks
+  });
 }
 async function handle(deps, rateLimiter, surface, request2) {
   const requestId = deps.requestId();
   const startedAt = deps.now();
   let keyId = null;
   let requestedModel = "";
+  let outcome = null;
+  let collector = null;
+  let writeBodies;
+  let frameSink = null;
+  let logged = false;
+  let release = null;
+  let streaming = false;
+  let headroom = {};
+  const limitHeaders = () => rateLimitHeaders(surface, release === null ? headroom : afterThisRequest(headroom), startedAt);
+  const debit = (id, usage) => {
+    rateLimiter.debit(id, usage);
+  };
   try {
     let key;
     try {
-      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+      key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), deps.logger);
     } catch (error51) {
       if (error51 instanceof GatewayError && error51.code === "AUTH") {
         deps.logger.warn("authentication rejected", {
@@ -44804,8 +47215,12 @@ async function handle(deps, rateLimiter, surface, request2) {
     }
     keyId = key.id;
     try {
-      rateLimiter.consume(key.id, key.rateLimitPerMin);
+      const admitted = await rateLimiter.admit(key.id, key.limits, requestId);
+      release = admitted.release;
+      headroom = admitted.headroom;
     } catch (error51) {
+      if (error51 instanceof RateLimitExceeded)
+        headroom = error51.headroom;
       if (error51 instanceof GatewayError && error51.code === "RATE_LIMIT") {
         deps.logger.warn("rate limit rejected", {
           requestId,
@@ -44817,15 +47232,35 @@ async function handle(deps, rateLimiter, surface, request2) {
       }
       throw error51;
     }
+    const captured = await bodyCollectorFor(deps, key);
+    collector = captured;
+    if (captured !== null) {
+      writeBodies = async (completed) => {
+        await captured.settle();
+        if (frameSink?.truncated === true)
+          captured.client.truncated = true;
+        await deps.store.bodies.put({
+          schemaVersion: ARTIFACT_SCHEMA_VERSION,
+          requestId,
+          at: startedAt,
+          client: captured.client,
+          attempts: captured.attempts(),
+          error: completed.errorCode === null ? null : { code: completed.errorCode, status: completed.status }
+        });
+      };
+    }
     const body2 = await request2.json();
+    if (captured !== null)
+      captured.client.request = body2;
     const chatRequest = surface === "anthropic" ? parseAnthropicRequest(body2, request2.headers) : parseOpenAIRequest(body2);
     if (key.modelAllowlist !== null && !key.modelAllowlist.includes(chatRequest.model)) {
       throw new GatewayError("AUTH", `model "${chatRequest.model}" is not allowed for this API key`);
     }
     requestedModel = chatRequest.model;
     let began = false;
-    const outcome = await dispatch(chatRequest, {
+    const dispatched = await dispatch(chatRequest, {
       ...deps,
+      ...captured === null ? {} : { http: captured.wrap(deps.http) },
       async onRoute(target) {
         if (began) {
           await routeLog(deps.store, requestId, target, deps.logger);
@@ -44843,55 +47278,82 @@ async function handle(deps, rateLimiter, surface, request2) {
         await beginLog(deps.store, log2, keyId, deps.logger);
       }
     }, request2.signal, requestId);
-    const log = async (cancelled = false) => {
-      const completed = outcome.log();
+    outcome = dispatched;
+    const log = async (cancelled = false, failure2) => {
+      const completed = dispatched.log();
       const wasCancelled = cancelled || request2.signal.aborted;
+      if (captured !== null && wasCancelled)
+        captured.client.truncated = true;
       if (wasCancelled && completed.status === 0) {
         completed.status = 499;
         completed.errorCode = "interrupted";
         completed.durationMs = deps.now() - startedAt;
+      } else if (!wasCancelled && failure2 !== undefined) {
+        const gatewayError = asGatewayError(failure2);
+        if (completed.status === 0) {
+          completed.status = HTTP_STATUS[gatewayError.code];
+          completed.errorCode = gatewayError.code;
+          completed.durationMs = deps.now() - startedAt;
+        }
+        reportRejection(deps.logger, requestId, completed, gatewayError, surface);
       }
-      await finishLog(deps.store, completed, keyId, deps.logger);
+      logged = true;
+      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit);
     };
     if (chatRequest.stream) {
-      const frames = surface === "anthropic" ? anthropicStream(outcome.events, requestId) : openaiStream(outcome.events, requestId, Math.floor(deps.now() / 1000));
-      return sseResponse(frames, log, deps.keepaliveMs, outcome.events);
+      const frames = surface === "anthropic" ? anthropicStream(dispatched.events, requestId) : openaiStream(dispatched.events, requestId, Math.floor(deps.now() / 1000));
+      let onFrame;
+      if (captured !== null) {
+        const sink = createFrameSink();
+        frameSink = sink;
+        captured.client.response = sink.frames;
+        onFrame = sink.write;
+      }
+      const finish = async (cancelled = false, failure2) => {
+        release?.();
+        await log(cancelled, failure2);
+      };
+      const response = sseResponse(frames, finish, deps.keepaliveMs, dispatched.events, limitHeaders(), onFrame);
+      streaming = true;
+      return response;
     }
     const events = [];
-    for await (const event of outcome.events)
+    for await (const event of dispatched.events)
       events.push(event);
-    await log();
     const failure = events.find((e) => e.type === "error");
-    if (failure !== undefined)
-      return errorResponse(surface, failure.code, failure.message);
-    const collected = collect(events);
-    const responseBody = surface === "anthropic" ? anthropicResponse(collected, requestId) : openaiResponse(collected, requestId, Math.floor(deps.now() / 1000));
-    return new Response(JSON.stringify(responseBody), {
-      status: 200,
-      headers: { "content-type": "application/json" }
-    });
+    const responseBody = failure !== undefined ? errorBody(surface, failure.code, failure.message) : surface === "anthropic" ? anthropicResponse(collect(events), requestId) : openaiResponse(collect(events), requestId, Math.floor(deps.now() / 1000));
+    if (captured !== null)
+      captured.client.response = responseBody;
+    await log();
+    return jsonResponse(responseBody, failure === undefined ? 200 : HTTP_STATUS[failure.code], limitHeaders());
   } catch (error51) {
     const gatewayError = asGatewayError(error51);
-    const completed = newCompletedRequestLog(requestId, startedAt, {
-      requestedModel,
-      status: HTTP_STATUS[gatewayError.code],
-      errorCode: gatewayError.code,
-      durationMs: deps.now() - startedAt
+    const cancelled = request2.signal.aborted && error51 === request2.signal.reason;
+    const completed = outcome?.log() ?? newCompletedRequestLog(requestId, startedAt, { requestedModel, status: 0 });
+    completed.status = cancelled ? 499 : HTTP_STATUS[gatewayError.code];
+    completed.errorCode = cancelled ? "interrupted" : gatewayError.code;
+    completed.durationMs = deps.now() - startedAt;
+    const rejection = errorBody(surface, gatewayError.code, gatewayError.message);
+    if (collector !== null && cancelled)
+      collector.client.truncated = true;
+    if (collector !== null && !logged)
+      collector.client.response = rejection;
+    if (!logged)
+      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit);
+    if (!cancelled)
+      reportRejection(deps.logger, requestId, completed, gatewayError, surface);
+    return jsonResponse(rejection, HTTP_STATUS[gatewayError.code], {
+      ...limitHeaders(),
+      ...retryAfterHeaders(gatewayError)
     });
-    await finishLog(deps.store, completed, keyId, deps.logger);
-    deps.logger.warn("request rejected", {
-      requestId,
-      surface,
-      status: completed.status,
-      code: gatewayError.code,
-      reason: gatewayError.message
-    });
-    return errorResponse(surface, gatewayError.code, gatewayError.message);
+  } finally {
+    if (!streaming)
+      release?.();
   }
 }
 function proxyRoutes(deps) {
-  const rateLimiter = deps.rateLimiter ?? new ApiKeyRateLimiter(deps.now);
   const logger2 = deps.logger ?? noopLogger;
+  const rateLimiter = deps.rateLimiter ?? new ApiKeyRateLimiter({ store: deps.store, now: deps.now, logger: logger2 });
   const dispatchDeps = {
     ...deps,
     logger: logger2,
@@ -44907,7 +47369,7 @@ function proxyRoutes(deps) {
     return handle(dispatchDeps, rateLimiter, "openai", request2);
   }).get("/v1/models", async ({ request: request2 }) => {
     try {
-      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
+      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), logger2);
       const snapshot = await dispatchDeps.snapshots.get(deps.now());
       const models = [...snapshot.models.values()];
       const visibleModels = key.modelAllowlist === null ? models : models.filter((model) => key.modelAllowlist?.includes(model.id));
@@ -44925,8 +47387,8 @@ function proxyRoutes(deps) {
     }
   }).post("/v1/messages/count_tokens", async ({ request: request2 }) => {
     try {
-      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers));
-      rateLimiter.consume(key.id, key.rateLimitPerMin);
+      const key = await authenticateApiKey(deps.store, apiKeyHeader(request2.headers), logger2);
+      await rateLimiter.consume(key.id, key.limits, deps.requestId());
       const body2 = await request2.json();
       const chatRequest = parseAnthropicRequest(body2, request2.headers);
       if (key.modelAllowlist !== null && !key.modelAllowlist.includes(chatRequest.model)) {
@@ -44940,7 +47402,7 @@ function proxyRoutes(deps) {
         code: gatewayError.code,
         reason: gatewayError.message
       });
-      return errorResponse("anthropic", gatewayError.code, gatewayError.message);
+      return errorResponse("anthropic", gatewayError.code, gatewayError.message, retryAfterHeaders(gatewayError));
     }
   }).onError(({ error: error51 }) => {
     const gatewayError = asGatewayError(error51);
@@ -44955,6 +47417,28 @@ function proxyRoutes(deps) {
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+var QUIESCE_MESSAGE = "the gateway is briefly quiesced for database maintenance";
+function quiesceResponse(path) {
+  const body2 = path === "/v1/chat/completions" ? openaiErrorBody("OVERLOADED", QUIESCE_MESSAGE) : anthropicErrorBody("OVERLOADED", QUIESCE_MESSAGE);
+  return new Response(JSON.stringify(body2), {
+    status: HTTP_STATUS.OVERLOADED,
+    headers: { "content-type": "application/json", "retry-after": "5" }
+  });
+}
+function isClientTraffic(path) {
+  return path === "/v1" || path.startsWith("/v1/");
+}
+function absentLifecycle() {
+  const refuse = () => {
+    throw new GatewayError("INTERNAL", "this process has no lifecycle control installed");
+  };
+  return {
+    env: process.env,
+    fileExists: (path) => existsSync(path),
+    run: async () => refuse(),
+    stop: refuse
+  };
+}
 function createApp(deps) {
   const now = deps.now ?? (() => Date.now());
   const logger2 = deps.logger ?? noopLogger;
@@ -44962,7 +47446,7 @@ function createApp(deps) {
   const http = deps.http ?? nodeHttpClient({ logger: logger2, now });
   const adapters = deps.adapters ?? ADAPTERS;
   const requestId = deps.requestId ?? (() => `req_${crypto.randomUUID()}`);
-  const rateLimiter = new ApiKeyRateLimiter(now);
+  const rateLimiter = deps.rateLimiter ?? new ApiKeyRateLimiter({ store: deps.store, now, logger: logger2 });
   const snapshots = createRoutingSnapshotCache(deps.store, logger2);
   const admin = createAdminAuth(deps.store, { now, sessionTtlMs: ADMIN_SESSION_TTL_MS });
   const refresh = deps.refresh ?? createRefresher({
@@ -44972,14 +47456,27 @@ function createApp(deps) {
     now,
     logger: logger2
   });
-  const staticDir = deps.staticDir ? resolve(deps.staticDir) : undefined;
+  const staticDir = deps.staticDir ? resolve2(deps.staticDir) : undefined;
   let staticRoot;
   if (staticDir) {
     try {
-      staticRoot = realpathSync(staticDir);
+      staticRoot = realpathSync2(staticDir);
     } catch {}
   }
-  return new Elysia().get("/health", () => ({ ok: true })).use(proxyRoutes({
+  const latch = deps.latch ?? createQuiesceLatch();
+  const admitted = new WeakMap;
+  return new Elysia().onRequest(({ request: request2 }) => {
+    const path = new URL(request2.url).pathname;
+    if (!isClientTraffic(path))
+      return;
+    const release = latch.enter();
+    if (release === null)
+      return quiesceResponse(path);
+    admitted.set(request2, release);
+  }).onAfterResponse(({ request: request2 }) => {
+    admitted.get(request2)?.();
+    admitted.delete(request2);
+  }).get("/health", () => ({ ok: true })).use(proxyRoutes({
     store: deps.store,
     snapshots,
     adapters,
@@ -44991,16 +47488,27 @@ function createApp(deps) {
     rateLimiter,
     logger: logger2,
     ...deps.loadRegistry === undefined ? {} : { loadRegistry: deps.loadRegistry },
-    discoveryMirrors: deps.discoveryMirrors === true
+    discoveryMirrors: deps.discoveryMirrors === true,
+    bodyLoggingAllowed: deps.bodyLoggingAllowed === true
   })).use(adminRoutes({
     store: deps.store,
     admin,
     baseUrl: deps.baseUrl,
     discoveryMirrors: deps.discoveryMirrors === true,
+    bodyLoggingAllowed: deps.bodyLoggingAllowed === true,
     now,
     sessionTtlMs: ADMIN_SESSION_TTL_MS,
     logger: logger2,
     ...deps.console === undefined ? {} : { console: deps.console }
+  })).use(databaseRoutes({
+    store: deps.store,
+    admin,
+    latch,
+    snapshots,
+    fs: deps.databaseFs ?? nodeDatabaseFs(),
+    now,
+    logger: logger2,
+    lifecycle: deps.lifecycle ?? absentLifecycle()
   })).use(connectRoutes({
     store: deps.store,
     admin,
@@ -45026,14 +47534,14 @@ function createApp(deps) {
     if (protectedPrefix)
       return error51();
     const requestedPath = decodedPath === "/" ? "/index.html" : decodedPath;
-    const filePath = resolve(staticRoot, `.${requestedPath}`);
-    if (filePath !== staticRoot && !filePath.startsWith(`${staticRoot}${sep}`))
+    const filePath = resolve2(staticRoot, `.${requestedPath}`);
+    if (filePath !== staticRoot && !filePath.startsWith(`${staticRoot}${sep2}`))
       return error51();
     let resolvedFilePath;
     try {
-      resolvedFilePath = realpathSync(filePath);
+      resolvedFilePath = realpathSync2(filePath);
     } catch {}
-    if (resolvedFilePath && resolvedFilePath !== staticRoot && !resolvedFilePath.startsWith(`${staticRoot}${sep}`)) {
+    if (resolvedFilePath && resolvedFilePath !== staticRoot && !resolvedFilePath.startsWith(`${staticRoot}${sep2}`)) {
       return error51();
     }
     const file3 = resolvedFilePath ? Bun.file(resolvedFilePath) : undefined;
@@ -45049,7 +47557,7 @@ function createApp(deps) {
     const isNavigation = request2.headers.get("accept")?.includes("text/html") ?? false;
     if (decodedPath.startsWith("/assets/") || !isNavigation)
       return error51();
-    const indexPath = resolve(staticRoot, "index.html");
+    const indexPath = resolve2(staticRoot, "index.html");
     const index = Bun.file(indexPath);
     if (index.size === 0)
       return error51();
@@ -45059,25 +47567,92 @@ function createApp(deps) {
   });
 }
 
+// apps/gateway/src/lifecycle.ts
+var STOP_DEADLINE_MS = 5000;
+function createShutdown(deps) {
+  let shuttingDown = false;
+  const exitAfterClosingStore = (code) => {
+    try {
+      deps.closeStore();
+    } finally {
+      deps.exit(code);
+    }
+  };
+  return (reason, mode = "graceful") => {
+    if (mode === "force" || shuttingDown) {
+      exitAfterClosingStore(1);
+      return;
+    }
+    deps.logger.info("shutdown requested", { reason });
+    shuttingDown = true;
+    for (const stop of deps.stopLoops)
+      stop();
+    let timer;
+    const abandoned = new Promise((resolve3) => {
+      timer = setTimeout(() => resolve3("timeout"), deps.stopDeadlineMs ?? STOP_DEADLINE_MS);
+      timer.unref?.();
+    });
+    Promise.race([deps.stopServer(), abandoned]).then((outcome) => {
+      clearTimeout(timer);
+      if (outcome === "timeout") {
+        deps.logger.warn("shutdown timed out waiting for connections to drain", { reason });
+      }
+      exitAfterClosingStore(0);
+    }, (error51) => {
+      clearTimeout(timer);
+      deps.logger.error("shutdown failed", {
+        reason: error51 instanceof Error ? error51.message : "unknown"
+      });
+      exitAfterClosingStore(1);
+    });
+  };
+}
+var RESPONSE_FLUSH_MS = 100;
+function createDeferredStop(shutdown, delayMs = RESPONSE_FLUSH_MS) {
+  return (exitCode) => {
+    const timer = setTimeout(() => {
+      shutdown("api", exitCode === 0 ? "graceful" : "force");
+    }, delayMs);
+    timer.unref?.();
+  };
+}
+
 // apps/gateway/src/maintenance.ts
 var SWEEP_INTERVAL_MS = 60 * 60 * 1000;
-var DAY_MS2 = 24 * 60 * 60 * 1000;
+var DAY_MS3 = 24 * 60 * 60 * 1000;
 var ROLLUP_RETENTION_DAYS = 400;
 async function pruneLogs(store, now) {
   const settings = await store.config.getSettings();
-  const rawHorizon = now - settings.logRetentionDays * DAY_MS2;
+  const rawHorizon = now - settings.logRetentionDays * DAY_MS3;
   const raw = await store.usage.prune(rawHorizon);
-  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS2);
+  const daily = await store.usage.pruneDaily(now - ROLLUP_RETENTION_DAYS * DAY_MS3);
   const quotaSamples = await store.credentials.pruneQuotaSamples(rawHorizon);
-  return { raw, daily, quotaSamples };
+  const bodies = await store.bodies.prune(rawHorizon);
+  const bodiesOverCap = await store.bodies.pruneToCap();
+  const bodyOrphans = await store.bodies.sweepOrphans();
+  return { raw, daily, quotaSamples, bodies, bodiesOverCap, bodyOrphans };
+}
+async function pruneFiles(deps) {
+  return { snapshots: await pruneSnapshots(deps), staging: sweepStaging(deps) };
 }
 function startMaintenance(deps) {
   const logger2 = deps.logger ?? noopLogger;
+  const files = {
+    store: deps.store,
+    fs: deps.fs ?? nodeDatabaseFs(),
+    now: deps.now
+  };
   const timer = setInterval(() => {
-    pruneLogs(deps.store, deps.now()).then(({ raw, daily, quotaSamples }) => logger2.debug("request logs pruned", {
+    pruneFiles(files).then(({ snapshots, staging }) => logger2.debug("snapshots and staging files swept", { count: snapshots + staging })).catch((error51) => {
+      logger2.error("snapshot sweeping failed", {
+        reason: error51 instanceof Error ? error51.message : "unknown"
+      });
+    });
+    pruneLogs(deps.store, deps.now()).then(({ raw, daily, quotaSamples, bodies, bodiesOverCap, bodyOrphans }) => logger2.debug("request logs pruned", {
       rawCount: raw,
       dailyCount: daily,
-      quotaSampleCount: quotaSamples
+      quotaSampleCount: quotaSamples,
+      count: bodies + bodiesOverCap + bodyOrphans
     })).catch((error51) => {
       logger2.error("log pruning failed", {
         reason: error51 instanceof Error ? error51.message : "unknown"
@@ -45179,6 +47754,17 @@ function stdoutLogger(level) {
   });
 }
 var logger2 = stdoutLogger("info");
+var commandRunner = async (argv) => {
+  const [cmd, ...args] = argv;
+  if (cmd === undefined)
+    return { code: 1, stdout: "", stderr: "empty argv" };
+  const proc = Bun.spawn([cmd, ...args], { stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  return { code: await proc.exited, stdout, stderr };
+};
 function consoleSource(logFile) {
   const source = resolveConsoleSource({
     logFile,
@@ -45189,17 +47775,7 @@ function consoleSource(logFile) {
     source,
     deps: {
       readFile: (path, lines) => tailFile(path, lines),
-      run: async (argv) => {
-        const [cmd, ...args] = argv;
-        if (cmd === undefined)
-          return { code: 1, stdout: "", stderr: "empty argv" };
-        const proc = Bun.spawn([cmd, ...args], { stdout: "pipe", stderr: "pipe" });
-        const [stdout, stderr] = await Promise.all([
-          new Response(proc.stdout).text(),
-          new Response(proc.stderr).text()
-        ]);
-        return { code: await proc.exited, stdout, stderr };
-      }
+      run: commandRunner
     }
   };
 }
@@ -45214,10 +47790,10 @@ async function main() {
     if (config2.staticDir !== null)
       return config2.staticDir;
     const candidates = [
-      resolve2(import.meta.dir, "./public"),
-      resolve2(import.meta.dir, "../../dashboard/dist")
+      resolve3(import.meta.dir, "./public"),
+      resolve3(import.meta.dir, "../../dashboard/dist")
     ];
-    return candidates.find((path) => existsSync(path)) ?? candidates[1];
+    return candidates.find((path) => existsSync2(path)) ?? candidates[1];
   }
   const encryptionKey = await deriveKey(config2.encryptionKey);
   const store = await createStore({
@@ -45234,9 +47810,13 @@ async function main() {
   const http = nodeHttpClient({ logger: logger2, now });
   const refresh = createRefresher({ store, providers: OAUTH_PROVIDERS, http, now, logger: logger2 });
   const staticDir = dashboardDir();
-  logger2.info(existsSync(staticDir) ? "dashboard directory resolved" : "dashboard directory absent", {
+  logger2.info(existsSync2(staticDir) ? "dashboard directory resolved" : "dashboard directory absent", {
     path: staticDir
   });
+  let shutdown = (reason) => {
+    logger2.error("shutdown requested before the gateway was serving", { reason });
+    process.exit(1);
+  };
   const app = createApp({
     store,
     baseUrl: config2.baseUrl,
@@ -45246,7 +47826,14 @@ async function main() {
     staticDir,
     logger: logger2,
     console: console2,
-    discoveryMirrors: config2.exposeClaudeCodeAliases
+    discoveryMirrors: config2.exposeClaudeCodeAliases,
+    bodyLoggingAllowed: config2.bodyLoggingAllowed,
+    lifecycle: {
+      env: process.env,
+      fileExists: (path) => existsSync2(path),
+      run: commandRunner,
+      stop: createDeferredStop((reason, mode) => shutdown(reason, mode))
+    }
   });
   const stopMaintenance = startMaintenance({ store, now, logger: logger2 });
   const stopRefreshScheduler = startRefreshScheduler({ store, refresh, now, logger: logger2 });
@@ -45260,30 +47847,17 @@ async function main() {
   });
   app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
   logger2.info("omnigateway listening", { host: config2.host, port: config2.port });
-  let shuttingDown = false;
-  function exitAfterClosingStore(code) {
-    try {
-      store.close();
-    } finally {
-      process.exit(code);
-    }
-  }
+  shutdown = createShutdown({
+    logger: logger2,
+    stopLoops: [stopMaintenance, stopRefreshScheduler, stopQuotaPoller],
+    stopServer: async () => {
+      await app.stop();
+    },
+    closeStore: () => store.close(),
+    exit: (code) => process.exit(code)
+  });
   for (const signal of ["SIGINT", "SIGTERM"]) {
-    process.on(signal, () => {
-      if (shuttingDown)
-        exitAfterClosingStore(1);
-      logger2.info("shutdown requested", { reason: signal });
-      shuttingDown = true;
-      stopMaintenance();
-      stopRefreshScheduler();
-      stopQuotaPoller();
-      app.stop().then(() => exitAfterClosingStore(0), (error51) => {
-        logger2.error("shutdown failed", {
-          reason: error51 instanceof Error ? error51.message : "unknown"
-        });
-        return exitAfterClosingStore(1);
-      });
-    });
+    process.on(signal, () => shutdown(signal));
   }
 }
 try {