omnigateway 0.1.0 → 0.1.2

package/README.md

@@ -77,7 +77,7 @@ Then set up and start:
 ```bash
 omni db migrate            # create the database
 omni admin set-password    # prompts; the console signs in with this
-omni start                 # serves the API and the console on 127.0.0.1:8787
+omni start                 # serves the API and the console on 127.0.0.1:9000
 ```
 
 Connect an account. The CLI prints a URL to open, and waits:
@@ -103,14 +103,14 @@ omni keys create --label laptop
 Now use it:
 
 ```bash
-curl http://127.0.0.1:8787/v1/chat/completions \
+curl http://127.0.0.1:9000/v1/chat/completions \
   -H 'content-type: application/json' \
   -H 'authorization: Bearer <gateway-key>' \
   -d '{"model": "fast", "messages": [{"role": "user", "content": "Hello"}]}'
 ```
 
 Everything above is also available in the browser at
-`http://127.0.0.1:8787`, which walks the same steps.
+`http://127.0.0.1:9000`, which walks the same steps.
 
 ## Using it from a client
 
@@ -132,7 +132,7 @@ Ask for one of your virtual models by name. A bare provider model
 (`claude-sonnet-5`, `gpt-5`) also works if an account can serve it.
 
 Most tools that accept a custom base URL work unchanged: set it to
-`http://127.0.0.1:8787` and use a gateway key where the provider key goes.
+`http://127.0.0.1:9000` and use a gateway key where the provider key goes.
 
 ## The CLI
 
@@ -186,7 +186,7 @@ Configuration is environment variables, read from the installation's `.env`:
 | --- | --- | --- | --- |
 | `OMNI_ENCRYPTION_KEY` | Yes | — | Encrypts provider credentials at rest; 16 characters minimum |
 | `OMNI_HOST` | No | `127.0.0.1` | Listener host |
-| `OMNI_PORT` | No | `8787` | Listener port |
+| `OMNI_PORT` | No | `9000` | Listener port |
 | `OMNI_DB_PATH` | No | `./omnigateway.db` | SQLite database path |
 | `OMNI_BASE_URL` | No | derived from host and port | Public origin for OAuth callbacks; set this behind a reverse proxy |
 | `OMNI_STATIC_DIR` | No | the console shipped with the server | Serve a different console build |
@@ -203,13 +203,13 @@ client-identity overrides.
 ```bash
 docker build -t omnigateway .
 docker run --rm \
-  -p 8787:8787 \
+  -p 9000:9000 \
   -e OMNI_ENCRYPTION_KEY="$(openssl rand -base64 32)" \
   -v omnigateway-data:/data \
   omnigateway
 ```
 
-The container listens on `0.0.0.0:8787` and keeps its database at
+The container listens on `0.0.0.0:9000` and keeps its database at
 `/data/omnigateway.db`. Note that **the image builds the gateway only**: it
 serves the APIs and returns 404 for the console. Use the CLI or the control API
 against it, or install the npm package if you want the console.
@@ -258,7 +258,7 @@ cd omnigateway
 bun install
 cp .env.example .env          # then set OMNI_ENCRYPTION_KEY
 bun run build:dashboard       # the gateway serves this build
-bun run dev                   # gateway on 8787, with file watching
+bun run dev                   # gateway on 9000, with file watching
 ```
 
 Releases are published to npm from a `v*` tag, with provenance attesting which

package/bin/omni.js

@@ -159,7 +159,7 @@ function loadConfig(env) {
     throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
   }
   const host = optionalText(env.OMNI_HOST, "127.0.0.1");
-  const rawPort = env.OMNI_PORT ?? "8787";
+  const rawPort = env.OMNI_PORT ?? "9000";
   const port = Number(rawPort);
   if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
@@ -16415,25 +16415,104 @@ function requireDimension(grain, dimension) {
 }
 
 // packages/control/src/credentials.ts
+function summarizeCredential(credential) {
+  return {
+    id: credential.id,
+    provider: credential.provider,
+    label: credential.label,
+    authType: credential.authType,
+    enabled: credential.enabled,
+    tier: credential.tier,
+    weight: credential.weight,
+    expiresAt: credential.expiresAt,
+    accountEmail: credential.accountEmail,
+    providerData: credential.providerData,
+    disabledReason: credential.disabledReason,
+    disabledAt: credential.disabledAt,
+    hasRefreshToken: credential.hasRefreshToken,
+    createdAt: credential.createdAt,
+    updatedAt: credential.updatedAt
+  };
+}
 async function listCredentials(store) {
-  const credentials = await store.credentials.list();
-  return credentials.map((c) => ({
-    id: c.id,
-    provider: c.provider,
-    label: c.label,
-    authType: c.authType,
-    enabled: c.enabled,
-    tier: c.tier,
-    weight: c.weight,
-    expiresAt: c.expiresAt,
-    accountEmail: c.accountEmail,
-    providerData: c.providerData,
-    disabledReason: c.disabledReason,
-    disabledAt: c.disabledAt,
-    hasRefreshToken: c.hasRefreshToken,
-    createdAt: c.createdAt,
-    updatedAt: c.updatedAt
-  }));
+  return (await store.credentials.list()).map(summarizeCredential);
+}
+async function getCredential(store, id) {
+  const credential = await store.credentials.get(id);
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  return summarizeCredential(credential);
+}
+async function createApiKeyCredential(store, input) {
+  const provider = parseOrThrow(providerIdSchema, input.provider);
+  if (typeof input.apiKey !== "string" || input.apiKey.trim().length === 0) {
+    throw new GatewayError("BAD_REQUEST", "apiKey: must not be empty");
+  }
+  if (input.label !== undefined && typeof input.label !== "string") {
+    throw new GatewayError("BAD_REQUEST", "label: must be a string");
+  }
+  const label = input.label?.trim() || `${provider} api key`;
+  const created = await store.credentials.create({
+    id: crypto.randomUUID(),
+    provider,
+    label,
+    authType: "apiKey",
+    enabled: true,
+    tier: 1,
+    weight: 1,
+    expiresAt: null,
+    accountEmail: null,
+    providerData: {},
+    disabledReason: null,
+    disabledAt: null,
+    accessToken: null,
+    refreshToken: null,
+    apiKey: input.apiKey,
+    idToken: null
+  });
+  return summarizeCredential(created);
+}
+async function refreshCredential(deps, id) {
+  const credential = await deps.store.credentials.get(id);
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  if (credential.authType !== "oauth") {
+    throw new GatewayError("BAD_REQUEST", `credential "${id}" is an api key and has nothing to refresh`);
+  }
+  await deps.refresh(credential);
+  return getCredential(deps.store, id);
+}
+async function credentialHealth(store) {
+  const [health, quota] = await Promise.all([
+    store.credentials.listHealth(),
+    store.credentials.listQuota()
+  ]);
+  return { health, quota };
+}
+async function credentialStatus(store, options) {
+  const [credentials, quota, adminConfigured] = await Promise.all([
+    listCredentials(store),
+    store.credentials.listQuota(),
+    createAdminAuth(store, { now: options.now, sessionTtlMs: 0 }).isConfigured()
+  ]);
+  const byCredential = new Map;
+  for (const row of quota) {
+    const rows = byCredential.get(row.credentialId);
+    if (rows === undefined)
+      byCredential.set(row.credentialId, [row]);
+    else
+      rows.push(row);
+  }
+  return {
+    adminConfigured,
+    credentials: credentials.map(({ id, provider, label, enabled }) => ({
+      id,
+      provider,
+      label,
+      enabled,
+      quota: byCredential.get(id) ?? []
+    }))
+  };
 }
 async function patchCredential(deps, id, input) {
   const patch = parseOrThrow(credentialPatchSchema, input);
@@ -16461,7 +16540,7 @@ function healthKey(credentialId, model) {
 }
 async function buildSnapshot(store, now) {
   const [credentials, healthRows, quotaRows, models, settings] = await Promise.all([
-    store.credentials.list(),
+    store.credentials.listRouting(),
     store.credentials.listHealth(),
     store.credentials.listQuota(),
     store.config.listModels(),
@@ -16775,7 +16854,7 @@ var DEFAULT_SETTINGS = {
 // packages/store/src/sqlite/config.ts
 var SETTINGS_KEY = "settings";
 var ADMIN_HASH_KEY = "adminPasswordHash";
-function createConfigRepo(db) {
+function createConfigRepo(db, emit2 = () => {}) {
   const readRaw = (key) => db.query("SELECT value FROM settings WHERE key = ?").get(key)?.value ?? null;
   const writeRaw = (key, value) => {
     db.run("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value", [key, value]);
@@ -16795,9 +16874,11 @@ function createConfigRepo(db) {
            targets = excluded.targets,
            strategy = excluded.strategy,
            is_alias = excluded.is_alias`, [model.id, JSON.stringify(model.targets), model.strategy, model.isAlias ? 1 : 0]);
+      emit2({ type: "modelsChanged" });
     },
     async removeModel(id) {
       db.run("DELETE FROM virtual_models WHERE id = ?", [id]);
+      emit2({ type: "modelsChanged" });
     },
     async getSettings() {
       const raw = readRaw(SETTINGS_KEY);
@@ -16818,6 +16899,7 @@ function createConfigRepo(db) {
         weights: { ...current.weights, ...patch.weights }
       };
       writeRaw(SETTINGS_KEY, JSON.stringify(next));
+      emit2({ type: "settingsChanged" });
       return next;
     },
     async getAdminPasswordHash() {
@@ -16833,8 +16915,40 @@ function createConfigRepo(db) {
   };
 }
 // packages/store/src/sqlite/credentials.ts
-function createCredentialRepo(db, key) {
-  const view = (row) => ({
+function createCredentialRepo(db, key, emit2 = () => {}) {
+  const open = async (v) => v === null ? null : decrypt(key, v);
+  const secretsFrom = async (row) => ({
+    accessToken: await open(row.access_token),
+    refreshToken: await open(row.refresh_token),
+    apiKey: await open(row.api_key),
+    idToken: await open(row.id_token)
+  });
+  const requiredRow = (row, id) => {
+    if (row === null)
+      throw new Error(`credential ${id} no longer exists`);
+    return row;
+  };
+  const currentSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT access_token, refresh_token, api_key, id_token FROM credentials WHERE id = ?").get(id), id);
+    return secretsFrom(row);
+  };
+  const currentInferenceSecrets = async (id, authType) => {
+    if (authType === "oauth") {
+      const row2 = requiredRow(db.query("SELECT access_token FROM credentials WHERE id = ?").get(id), id);
+      return { accessToken: await open(row2.access_token), apiKey: null };
+    }
+    const row = requiredRow(db.query("SELECT api_key FROM credentials WHERE id = ?").get(id), id);
+    return { accessToken: null, apiKey: await open(row.api_key) };
+  };
+  const currentRefreshSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT refresh_token FROM credentials WHERE id = ?").get(id), id);
+    return { refreshToken: await open(row.refresh_token) };
+  };
+  const currentUsageSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT access_token FROM credentials WHERE id = ?").get(id), id);
+    return { accessToken: await open(row.access_token) };
+  };
+  const view = (row, loadCurrentSecrets = false) => ({
     id: row.id,
     provider: row.provider,
     label: row.label,
@@ -16850,18 +16964,31 @@ function createCredentialRepo(db, key) {
     hasRefreshToken: row.refresh_token !== null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
-    secrets: async () => ({
-      accessToken: await open(row.access_token),
-      refreshToken: await open(row.refresh_token),
-      apiKey: await open(row.api_key),
-      idToken: await open(row.id_token)
-    })
+    secrets: () => loadCurrentSecrets ? currentSecrets(row.id) : secretsFrom(row),
+    openForInference: async () => {
+      if (loadCurrentSecrets)
+        return currentInferenceSecrets(row.id, row.auth_type);
+      if (row.auth_type === "oauth") {
+        return { accessToken: await open(row.access_token), apiKey: null };
+      }
+      return { accessToken: null, apiKey: await open(row.api_key) };
+    },
+    openForRefresh: async () => loadCurrentSecrets ? currentRefreshSecrets(row.id) : { refreshToken: await open(row.refresh_token) },
+    openForUsage: async () => loadCurrentSecrets ? currentUsageSecrets(row.id) : { accessToken: await open(row.access_token) }
   });
-  const open = async (v) => v === null ? null : decrypt(key, v);
   const seal = async (v) => v === null || v === undefined ? null : encrypt(key, v);
   return {
     async list() {
-      return db.query("SELECT * FROM credentials ORDER BY tier, label").all().map(view);
+      return db.query("SELECT * FROM credentials ORDER BY tier, label").all().map((row) => view(row));
+    },
+    async listRouting() {
+      return db.query(`SELECT id, provider, label, auth_type, enabled, tier, weight, expires_at,
+                  account_email, provider_data, disabled_reason, disabled_at,
+                  NULL AS access_token,
+                  CASE WHEN refresh_token IS NULL THEN NULL ELSE 'present' END AS refresh_token,
+                  NULL AS api_key, NULL AS id_token, created_at, updated_at
+             FROM credentials
+            ORDER BY tier, label`).all().map((row) => view(row, true));
     },
     async get(id) {
       const row = db.query("SELECT * FROM credentials WHERE id = ?").get(id);
@@ -16894,6 +17021,7 @@ function createCredentialRepo(db, key) {
         now
       ]);
       const { accessToken, refreshToken, apiKey, idToken, ...meta3 } = input;
+      emit2({ type: "credentialsChanged" });
       return {
         ...meta3,
         hasRefreshToken: refreshToken != null,
@@ -16930,6 +17058,7 @@ function createCredentialRepo(db, key) {
         return;
       put("updated_at", Date.now());
       db.run(`UPDATE credentials SET ${sets.join(", ")} WHERE id = ?`, [...vals, id]);
+      emit2({ type: "credentialsChanged" });
     },
     async updateSecrets(id, secrets, expiresAt) {
       const sets = [];
@@ -16953,9 +17082,11 @@ function createCredentialRepo(db, key) {
       sets.push("expires_at = ?", "updated_at = ?");
       vals.push(expiresAt, Date.now());
       db.run(`UPDATE credentials SET ${sets.join(", ")} WHERE id = ?`, [...vals, id]);
+      emit2({ type: "credentialsChanged" });
     },
     async remove(id) {
       db.run("DELETE FROM credentials WHERE id = ?", [id]);
+      emit2({ type: "credentialsChanged" });
     },
     async listHealth() {
       return db.query("SELECT * FROM credential_health").all().map((r) => ({
@@ -16986,6 +17117,7 @@ function createCredentialRepo(db, key) {
           stmt.run(r.credentialId, r.model, r.breakerState, r.consecutiveFailures, r.openedAt, r.rateLimitedUntil, r.ewmaTtftMs, r.lastUsedAt);
         }
       })();
+      emit2({ type: "healthSaved", rows });
     },
     async listQuota() {
       return db.query("SELECT * FROM quota_windows").all().map((r) => ({
@@ -17008,11 +17140,24 @@ function createCredentialRepo(db, key) {
            limit_value = excluded.limit_value,
            resets_at = excluded.resets_at,
            observed_at = excluded.observed_at`);
+      const prune = db.prepare("DELETE FROM quota_windows WHERE credential_id = ? AND window_type NOT IN (SELECT value FROM json_each(?))");
+      const kept = new Map;
+      for (const r of rows) {
+        const types2 = kept.get(r.credentialId);
+        if (types2 === undefined)
+          kept.set(r.credentialId, [r.windowType]);
+        else
+          types2.push(r.windowType);
+      }
       db.transaction(() => {
         for (const r of rows) {
           stmt.run(r.credentialId, r.windowType, r.startsAt, r.used, r.limit, r.resetsAt, r.observedAt);
         }
+        for (const [credentialId, types2] of kept) {
+          prune.run(credentialId, JSON.stringify(types2));
+        }
       })();
+      emit2({ type: "quotaSaved", rows });
     }
   };
 }
@@ -17485,11 +17630,26 @@ function createUsageRepo(db) {
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
   const db = openDb(opts.path);
+  const listeners = new Set;
+  const emit2 = (change) => {
+    for (const listener of listeners) {
+      try {
+        listener(change);
+      } catch {}
+    }
+  };
   return {
-    credentials: createCredentialRepo(db, opts.encryptionKey),
-    config: createConfigRepo(db),
+    credentials: createCredentialRepo(db, opts.encryptionKey, emit2),
+    config: createConfigRepo(db, emit2),
     keys: createKeyRepo(db),
     usage: createUsageRepo(db),
+    routing: {
+      version: () => db.query("PRAGMA data_version").get()?.data_version ?? 0,
+      subscribe(listener) {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      }
+    },
     close: () => db.close()
   };
 }
@@ -17725,14 +17885,34 @@ function toResult3(token, fallbackRefresh, deps, fallbackAccountId = null) {
     providerData: { accountId: claims.accountId ?? fallbackAccountId }
   };
 }
+function windowTypeOf(value, fallback) {
+  const record2 = recordOf(value);
+  if (record2 === null)
+    return fallback;
+  const seconds = numberOf(record2, [
+    "limit_window_seconds",
+    "limitWindowSeconds",
+    "window_seconds",
+    "windowSeconds"
+  ]);
+  if (seconds === null || seconds <= 0)
+    return fallback;
+  if (seconds <= 6 * 60 * 60)
+    return "fiveHour";
+  if (seconds <= 36 * 60 * 60)
+    return "daily";
+  return "weekly";
+}
 function parseOpenAIUsage(value, now) {
   const root = recordOf(value);
   if (root === null)
     return null;
   const rateLimit = nestedOf(root, ["rate_limit", "rateLimit"]) ?? root;
+  const primary = rateLimit.primary_window ?? rateLimit.primaryWindow;
+  const secondary = rateLimit.secondary_window ?? rateLimit.secondaryWindow;
   return reportFrom([
-    windowFrom(rateLimit.primary_window ?? rateLimit.primaryWindow, "fiveHour", now),
-    windowFrom(rateLimit.secondary_window ?? rateLimit.secondaryWindow, "weekly", now)
+    windowFrom(primary, windowTypeOf(primary, "fiveHour"), now),
+    windowFrom(secondary, windowTypeOf(secondary, "weekly"), now)
   ]);
 }
 var openaiOAuth = {
@@ -17797,7 +17977,7 @@ var OAUTH_PROVIDERS = {
 function createRefresher(deps) {
   const inFlight = new Map;
   async function run(credential) {
-    const secrets = await credential.secrets();
+    const secrets = await credential.openForRefresh();
     if (secrets.refreshToken === null) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
@@ -18134,10 +18314,7 @@ var credentialsList = {
   }
 };
 async function findCredential(ctx, id) {
-  const credential = await (await ctx.store()).credentials.get(id) ?? null;
-  if (credential === null)
-    throw new CliError(`no credential "${id}"`);
-  return credential;
+  return getCredential(await ctx.store(), id);
 }
 var credentialsShow = {
   usage: "credentials show <id>",
@@ -18236,12 +18413,7 @@ var credentialsRefresh = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "credential id");
     const store = await ctx.store();
-    const credential = await store.credentials.get(id);
-    if (credential === null)
-      throw new CliError(`no credential "${id}"`);
-    if (credential.authType !== "oauth") {
-      throw new CliError(`credential "${id}" is an api key and has nothing to refresh`);
-    }
+    const credential = await findCredential(ctx, id);
     const refresh = createRefresher({
       store,
       providers: OAUTH_PROVIDERS,
@@ -18249,9 +18421,8 @@ var credentialsRefresh = {
       now: ctx.now
     });
     note(ctx, writer, `refreshing ${credential.provider} credential ${id}\u2026`);
-    await refresh(credential);
-    const updated = await store.credentials.get(id);
-    emit(ctx, writer, { id, expiresAt: updated?.expiresAt ?? null }, () => `${id} refreshed; expires ${formatTime(updated?.expiresAt ?? null)}`);
+    const updated = await refreshCredential({ store, refresh }, id);
+    emit(ctx, writer, { id, expiresAt: updated.expiresAt }, () => `${id} refreshed; expires ${formatTime(updated.expiresAt)}`);
   }
 };
 var credentialsAddKey = {
@@ -18266,27 +18437,12 @@ var credentialsAddKey = {
     const key = await prompt.secret(`${providerId} API key: `);
     if (key.length === 0)
       throw new CliError("no API key given");
-    const store = await ctx.store();
-    const id = crypto.randomUUID();
-    await store.credentials.create({
-      id,
+    const created = await createApiKeyCredential(await ctx.store(), {
       provider: providerId,
-      label: stringFlag(args.values, "label") ?? `${providerId} api key`,
-      authType: "apiKey",
-      enabled: true,
-      tier: 1,
-      weight: 1,
-      expiresAt: null,
-      accountEmail: null,
-      providerData: {},
-      disabledReason: null,
-      disabledAt: null,
-      accessToken: null,
-      refreshToken: null,
       apiKey: key,
-      idToken: null
+      label: stringFlag(args.values, "label")
     });
-    emit(ctx, writer, { id, provider: providerId }, () => `stored ${providerId} api key as ${id}`);
+    emit(ctx, writer, { id: created.id, provider: created.provider }, () => `stored ${created.provider} api key as ${created.id}`);
   }
 };
 var credentialsHealth = {
@@ -18295,8 +18451,8 @@ var credentialsHealth = {
   options: { all: { type: "boolean" } },
   async run(args, { ctx, writer }) {
     const store = await ctx.store();
-    const [rows, credentials] = await Promise.all([
-      store.credentials.listHealth(),
+    const [{ health: rows }, credentials] = await Promise.all([
+      credentialHealth(store),
       listCredentials(store)
     ]);
     const labels = new Map(credentials.map((c) => [c.id, c.label]));
@@ -19098,24 +19254,29 @@ var settingsSet = {
 };
 
 // apps/cli/src/commands/status.ts
-function tightest(windows) {
-  let worst = null;
-  for (const window of windows) {
-    if (window.limit === null || window.limit <= 0)
-      continue;
-    if (worst === null || window.used / window.limit > worst.used / (worst.limit ?? 1)) {
-      worst = window;
-    }
-  }
-  return worst;
+var WINDOW_ORDER = {
+  fiveHour: 0,
+  daily: 1,
+  weekly: 2
+};
+var WINDOW_LABEL = {
+  fiveHour: "5h",
+  daily: "24h",
+  weekly: "7d"
+};
+function reportedWindows(windows) {
+  return windows.filter((window) => window.limit !== null && window.limit > 0).sort((a, b) => WINDOW_ORDER[a.windowType] - WINDOW_ORDER[b.windowType]);
 }
-function quotaCell(ctx, windows, headroom, now) {
-  const window = tightest(windows);
-  if (window === null || window.limit === null)
+function quotaCell(ctx, windows, now) {
+  const reported = reportedWindows(windows);
+  if (reported.length === 0)
     return paint(ctx, "dim", "unknown");
-  const used = Math.round(window.used / window.limit * 100);
-  const age = formatAge(window.observedAt, now);
-  return `${state(ctx, headroom >= 0.5, `${used}% used`)} ${paint(ctx, "dim", `(${window.windowType}, ${age} ago)`)}`;
+  const parts = reported.map((window) => {
+    const used = Math.round(window.used / window.limit * 100);
+    return state(ctx, used < 90, `${WINDOW_LABEL[window.windowType]} ${used}%`);
+  });
+  const observedAt = Math.min(...reported.map((window) => window.observedAt));
+  return `${parts.join(" \xB7 ")} ${paint(ctx, "dim", `(${formatAge(observedAt, now)} ago)`)}`;
 }
 var status2 = {
   usage: "status",
@@ -19130,31 +19291,11 @@ var status2 = {
     } catch (error51) {
       storeError = error51 instanceof Error ? error51.message : "could not open the database";
     }
-    const credentials = store === null ? [] : await store.credentials.list();
-    const quotaRows = store === null ? [] : await store.credentials.listQuota();
-    const settings = store === null ? null : await store.config.getSettings();
-    const configured = store === null ? false : await createAdminAuth(store, {
-      now: ctx.now,
-      sessionTtlMs: 0
-    }).isConfigured();
-    const byCredential = new Map;
-    for (const row of quotaRows) {
-      const list = byCredential.get(row.credentialId);
-      if (list === undefined)
-        byCredential.set(row.credentialId, [row]);
-      else
-        list.push(row);
-    }
+    const persistent = store === null ? { adminConfigured: false, credentials: [] } : await credentialStatus(store, { now: ctx.now });
+    const { adminConfigured: configured, credentials } = persistent;
     const data = {
       process: process3,
-      adminConfigured: configured,
-      credentials: credentials.map((credential) => ({
-        id: credential.id,
-        provider: credential.provider,
-        label: credential.label,
-        enabled: credential.enabled,
-        quota: byCredential.get(credential.id) ?? []
-      })),
+      ...persistent,
       storeError
     };
     emit(ctx, writer, data, () => {
@@ -19176,16 +19317,12 @@ ${state(ctx, false, storeError)}`;
 
 no credentials; add one with: omni connect <provider>`;
       }
-      const rows = credentials.map((credential) => {
-        const windows = byCredential.get(credential.id) ?? [];
-        const headroom = quotaHeadroom(credential, windows, ctx.now(), settings?.quotaPollIntervalMs ?? 0);
-        return [
-          credential.label,
-          provider(ctx, credential.provider),
-          state(ctx, credential.enabled, credential.enabled ? "enabled" : "disabled"),
-          quotaCell(ctx, windows, headroom, ctx.now())
-        ];
-      });
+      const rows = credentials.map((credential) => [
+        credential.label,
+        provider(ctx, credential.provider),
+        state(ctx, credential.enabled, credential.enabled ? "enabled" : "disabled"),
+        quotaCell(ctx, credential.quota, ctx.now())
+      ]);
       return `${header}
 
 ${table([{ header: "ACCOUNT" }, { header: "PROVIDER" }, { header: "STATE" }, { header: "QUOTA" }], rows)}`;