omnigateway 0.1.5 → 0.1.7

package/bin/omni.js

@@ -147,35 +147,6 @@ function createAdminAuth(store, opts) {
     }
   };
 }
-// packages/control/src/config.ts
-var MIN_KEY_LENGTH = 16;
-var DECIMAL_INTEGER = /^\d+$/;
-function optionalText(value, fallback) {
-  return value?.trim() || fallback;
-}
-function loadConfig(env) {
-  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
-  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
-    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
-  }
-  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
-  const rawPort = env.OMNI_PORT ?? "9000";
-  const port = Number(rawPort);
-  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
-  }
-  const derivedBaseUrl = `http://${host}:${port}`;
-  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
-  const staticDir = env.OMNI_STATIC_DIR?.trim();
-  return {
-    port,
-    host,
-    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
-    encryptionKey,
-    baseUrl,
-    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir
-  };
-}
 // packages/ir/src/capabilities.ts
 var PROVIDER_CAPABILITIES = {
   anthropic: { tools: true, images: true, reasoning: true },
@@ -215,6 +186,86 @@ class GatewayError extends Error {
     this.retryAfterMs = opts?.retryAfterMs;
   }
 }
+// packages/ir/src/logger.ts
+var LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+var ANSI2 = /\u001B\[[0-9;]*m/g;
+var HEAD = /^(\S+) (DEBUG|INFO|WARN|ERROR) {1,2}(.*)$/;
+var FIELDS = / {2}(?=[a-zA-Z]+=)/;
+function parseLine(raw) {
+  const absent = { raw, at: null, level: null, msg: null };
+  const match = HEAD.exec(raw.replace(ANSI2, ""));
+  if (match === null)
+    return absent;
+  const [, instant, label, tail] = match;
+  if (instant === undefined || label === undefined || tail === undefined)
+    return absent;
+  const at = Date.parse(instant);
+  if (Number.isNaN(at))
+    return absent;
+  const msg = tail.split(FIELDS, 1)[0] ?? tail;
+  return { raw, at, level: label.toLowerCase(), msg };
+}
+var noopLogger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  enabled: () => false
+};
+function parseLogLevel(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === undefined || normalized.length === 0)
+    return null;
+  return Object.hasOwn(LEVELS, normalized) ? normalized : null;
+}
+// packages/ir/src/request.ts
+function cacheControlOf(block) {
+  return block.type === "thinking" ? undefined : block.cacheControl;
+}
+// packages/ir/src/stream.ts
+function usageFromPromptTotal(promptTokens, outputTokens, cacheReadTokens, cacheWriteTokens = 0) {
+  return {
+    inputTokens: Math.max(0, promptTokens - cacheReadTokens - cacheWriteTokens),
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens
+  };
+}
+// packages/control/src/config.ts
+var MIN_KEY_LENGTH = 16;
+var DECIMAL_INTEGER = /^\d+$/;
+function optionalText(value, fallback) {
+  return value?.trim() || fallback;
+}
+function loadConfig(env) {
+  const encryptionKey = env.OMNI_ENCRYPTION_KEY;
+  if (typeof encryptionKey !== "string" || encryptionKey.length < MIN_KEY_LENGTH) {
+    throw new Error(`OMNI_ENCRYPTION_KEY must be set to at least ${MIN_KEY_LENGTH} characters. ` + "Generate one with: openssl rand -base64 32");
+  }
+  const host = optionalText(env.OMNI_HOST, "127.0.0.1");
+  const rawPort = env.OMNI_PORT ?? "9000";
+  const port = Number(rawPort);
+  if (!DECIMAL_INTEGER.test(rawPort) || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`OMNI_PORT must be an integer between 1 and 65535, got "${rawPort}"`);
+  }
+  const derivedBaseUrl = `http://${host}:${port}`;
+  const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
+  const staticDir = env.OMNI_STATIC_DIR?.trim();
+  const logFile = env.OMNI_LOG_FILE?.trim();
+  const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
+  const logLevel = parseLogLevel(rawLogLevel);
+  return {
+    logLevel: logLevel ?? "info",
+    logLevelFallbackFrom: logLevel === null && rawLogLevel ? rawLogLevel : null,
+    port,
+    host,
+    databasePath: optionalText(env.OMNI_DB_PATH, "./omnigateway.db"),
+    encryptionKey,
+    baseUrl,
+    staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
+    logFile: logFile === undefined || logFile.length === 0 ? null : logFile
+  };
+}
 // packages/providers/src/body.ts
 var BODY_ORDER = {
   anthropic: [
@@ -301,8 +352,13 @@ function applyAnthropicSystem(system) {
     let rewritten = text;
     for (const [from, to] of REWRITES)
       rewritten = rewritten.replaceAll(from, to);
-    if (rewritten.trim().length > 0)
-      kept.push({ type: "text", text: rewritten });
+    if (rewritten.trim().length > 0) {
+      kept.push({
+        type: "text",
+        text: rewritten,
+        ...block.cache_control === undefined ? {} : { cache_control: block.cache_control }
+      });
+    }
   }
   return [{ type: "text", text: billingBlock() }, { type: "text", text: AGENT_PREAMBLE }, ...kept];
 }
@@ -606,6 +662,8 @@ async function* decodeAnthropic(messages) {
   let inputTokens = 0;
   let cacheReadTokens = 0;
   let cacheWriteTokens = 0;
+  let cacheWrite5mTokens;
+  let cacheWrite1hTokens;
   let outputTokens = 0;
   let stopReason = "endTurn";
   let terminal = false;
@@ -619,6 +677,8 @@ async function* decodeAnthropic(messages) {
         inputTokens = m.usage?.input_tokens ?? 0;
         cacheReadTokens = m.usage?.cache_read_input_tokens ?? 0;
         cacheWriteTokens = m.usage?.cache_creation_input_tokens ?? 0;
+        cacheWrite5mTokens = m.usage?.cache_creation?.ephemeral_5m_input_tokens;
+        cacheWrite1hTokens = m.usage?.cache_creation?.ephemeral_1h_input_tokens;
         yield { type: "start", id: String(m.id ?? ""), model: String(m.model ?? "") };
         break;
       }
@@ -628,7 +688,7 @@ async function* decodeAnthropic(messages) {
         if (cb.type === "text")
           yield { type: "blockStart", index, block: { type: "text" } };
         else if (cb.type === "thinking")
-          yield { type: "blockStart", index, block: { type: "thinking" } };
+          yield { type: "blockStart", index, block: { type: "thinking", signed: true } };
         else if (cb.type === "tool_use")
           yield {
             type: "blockStart",
@@ -648,7 +708,7 @@ async function* decodeAnthropic(messages) {
             index,
             delta: { type: "thinking", text: delta.thinking ?? "" }
           };
-        else if (delta.type === "signature_delta")
+        else if (delta.type === "signature_delta" && (delta.signature ?? "") !== "")
           yield {
             type: "blockDelta",
             index,
@@ -678,7 +738,14 @@ async function* decodeAnthropic(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens }
+          usage: {
+            inputTokens,
+            outputTokens,
+            cacheReadTokens,
+            cacheWriteTokens,
+            ...cacheWrite5mTokens === undefined ? {} : { cacheWrite5mTokens },
+            ...cacheWrite1hTokens === undefined ? {} : { cacheWrite1hTokens }
+          }
         };
         break;
       case "error": {
@@ -708,25 +775,36 @@ async function* decodeAnthropic(messages) {
 
 // packages/providers/src/anthropic/wire.ts
 var OAUTH_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+function wireCacheControl(c) {
+  if (c === undefined)
+    return {};
+  return { cache_control: { type: c.type, ...c.ttl === undefined ? {} : { ttl: c.ttl } } };
+}
+function isReplayableThinking(b) {
+  return b.type !== "thinking" || b.signature !== undefined && b.signature !== "";
+}
 function encodeBlock(b) {
+  const cache = wireCacheControl(cacheControlOf(b));
   switch (b.type) {
     case "text":
-      return { type: "text", text: b.text };
+      return { type: "text", text: b.text, ...cache };
     case "image":
       return {
         type: "image",
-        source: { type: "base64", media_type: b.mediaType, data: b.data }
+        source: { type: "base64", media_type: b.mediaType, data: b.data },
+        ...cache
       };
     case "thinking":
       return { type: "thinking", thinking: b.text, signature: b.signature };
     case "toolUse":
-      return { type: "tool_use", id: b.id, name: b.name, input: b.input };
+      return { type: "tool_use", id: b.id, name: b.name, input: b.input, ...cache };
     case "toolResult":
       return {
         type: "tool_result",
         tool_use_id: b.toolUseId,
         content: b.content,
-        is_error: b.isError
+        is_error: b.isError,
+        ...cache
       };
   }
 }
@@ -734,6 +812,16 @@ function encodeSystemTurn(content) {
   return content.flatMap((b) => b.type === "text" ? [b.text] : []).join(`
 `);
 }
+function systemCacheControl(req) {
+  const cacheable = req.messages.flatMap((message) => message.content.flatMap((block) => block.type === "thinking" ? [] : [{ role: message.role, block }]));
+  const markedSystemBlocks = cacheable.filter(({ role, block }) => role === "system" && cacheControlOf(block) !== undefined);
+  const final = markedSystemBlocks.at(-1);
+  const promoted = final !== undefined && final.block.type === "text" && cacheable.at(-1) === final ? cacheControlOf(final.block) : undefined;
+  return {
+    ...promoted === undefined ? {} : { promoted },
+    lost: markedSystemBlocks.length > (promoted === undefined ? 0 : 1)
+  };
+}
 function encodeToolChoice(c) {
   switch (c.type) {
     case "auto":
@@ -748,16 +836,39 @@ function encodeToolChoice(c) {
 }
 function toWire(req, model, opts) {
   const degradations = [];
-  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text }] : []);
+  const note2 = (d) => {
+    if (!degradations.includes(d))
+      degradations.push(d);
+  };
+  let system = req.system?.flatMap((b) => b.type === "text" ? [{ type: "text", text: b.text, ...wireCacheControl(b.cacheControl) }] : []);
   if (opts.oauth && system?.[0]?.text !== OAUTH_IDENTITY) {
     system = [{ type: "text", text: OAUTH_IDENTITY }, ...system ?? []];
-    degradations.push("anthropic:oauth-system-prefix");
+    note2("anthropic:oauth-system-prefix");
   }
+  const systemCache = systemCacheControl(req);
+  if (systemCache.lost)
+    note2("anthropic:system-turn-cache-control-dropped");
   const body = {
     model,
-    messages: req.messages.map((m) => m.role === "system" ? { role: m.role, content: encodeSystemTurn(m.content) } : { role: m.role, content: m.content.map(encodeBlock) }),
+    messages: req.messages.flatMap((m) => {
+      if (m.role !== "system") {
+        const replayable = m.content.filter(isReplayableThinking);
+        if (replayable.length !== m.content.length)
+          note2("anthropic:unsigned-thinking-dropped");
+        if (replayable.length === 0)
+          return [];
+        return [{ role: m.role, content: replayable.map(encodeBlock) }];
+      }
+      return [{ role: m.role, content: encodeSystemTurn(m.content) }];
+    }),
     max_tokens: req.maxTokens ?? 4096,
-    stream: req.stream
+    stream: req.stream,
+    ...systemCache.promoted === undefined ? {} : {
+      cache_control: {
+        type: systemCache.promoted.type,
+        ...systemCache.promoted.ttl === undefined ? {} : { ttl: systemCache.promoted.ttl }
+      }
+    }
   };
   if (system !== undefined && system.length > 0)
     body.system = system;
@@ -769,7 +880,8 @@ function toWire(req, model, opts) {
     body.tools = req.tools.map((t) => ({
       name: t.name,
       ...t.description === undefined ? {} : { description: t.description },
-      input_schema: t.inputSchema
+      input_schema: t.inputSchema,
+      ...wireCacheControl(t.cacheControl)
     }));
   }
   if (req.toolChoice !== undefined)
@@ -809,12 +921,13 @@ var anthropicAdapter = {
     const { body, degradations } = toWire(req.request, req.model, { oauth });
     const withSystem = {
       ...body,
-      system: applyAnthropicSystem(body.system ?? [])
+      system: applyAnthropicSystem(body.system ?? []),
+      stream: true
     };
     const protocol = [
       ["Content-Type", "application/json"],
       ["anthropic-version", API_VERSION],
-      ["Accept", req.request.stream ? "text/event-stream" : "application/json"]
+      ["Accept", "text/event-stream"]
     ];
     const betas = new Set(req.request.betas ?? []);
     if (oauth) {
@@ -833,6 +946,7 @@ var anthropicAdapter = {
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const bodyString = signAnthropicBody(JSON.stringify(orderFields(withSystem, BODY_ORDER.anthropic)));
     const res = await req.http({
+      provider: "anthropic",
       url: BASE_URL,
       method: "POST",
       headers,
@@ -853,22 +967,26 @@ var ANTHROPIC_MODELS = {
     {
       id: "claude-fable-5",
       label: "Claude Fable 5",
-      pricing: { input: 10, output: 50, cacheRead: 1 }
+      pricing: { input: 10, output: 50, cacheRead: 1, cacheWrite5m: 12.5, cacheWrite1h: 20 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-opus-5",
       label: "Claude Opus 5",
-      pricing: { input: 5, output: 25, cacheRead: 0.5 }
+      pricing: { input: 5, output: 25, cacheRead: 0.5, cacheWrite5m: 6.25, cacheWrite1h: 10 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-sonnet-5",
       label: "Claude Sonnet 5",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 3.75, cacheWrite1h: 6 },
+      limits: { contextWindow: 1e6, maxOutputTokens: 128000 }
     },
     {
       id: "claude-haiku-4-5",
       label: "Claude Haiku 4.5",
-      pricing: { input: 1, output: 5, cacheRead: 0.1 }
+      pricing: { input: 1, output: 5, cacheRead: 0.1, cacheWrite5m: 1.25, cacheWrite1h: 2 },
+      limits: { contextWindow: 200000, maxOutputTokens: 64000 }
     }
   ]
 };
@@ -880,22 +998,26 @@ var KIMI_MODELS = {
     {
       id: "k3-256k",
       label: "Kimi K3 \u2014 256K",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "k3",
       label: "Kimi K3 \u2014 up to 1M",
-      pricing: { input: 3, output: 15, cacheRead: 0.3 }
+      pricing: { input: 3, output: 15, cacheRead: 0.3, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 1048576, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding",
       label: "Kimi K2.7 Code",
-      pricing: { input: 0.95, output: 4, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     },
     {
       id: "kimi-for-coding-highspeed",
       label: "Kimi K2.7 Code \u2014 High Speed",
-      pricing: { input: 0.95, output: 8, cacheRead: 0.19 }
+      pricing: { input: 0.95, output: 8, cacheRead: 0.19, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 262144, maxOutputTokens: 131072 }
     }
   ]
 };
@@ -907,22 +1029,30 @@ var OPENAI_MODELS = {
     {
       id: "gpt-5.6",
       label: "GPT-5.6 \u2014 routes to Sol",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-sol",
       label: "GPT-5.6 Sol \u2014 deepest reasoning",
-      pricing: { input: 5, output: 30, cacheRead: 0.5 }
+      pricing: { input: 5, output: 30, cacheRead: 0.5, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-terra",
       label: "GPT-5.6 Terra \u2014 balanced",
-      pricing: { input: 2, output: 12, cacheRead: 0.2 }
+      pricing: { input: 2, output: 12, cacheRead: 0.2, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     },
     {
       id: "gpt-5.6-luna",
       label: "GPT-5.6 Luna \u2014 fastest",
-      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02 }
+      pricing: { input: 0.2, output: 1.2, cacheRead: 0.02, cacheWrite5m: 0, cacheWrite1h: 0 },
+      limits: { contextWindow: 922000, maxOutputTokens: 128000 },
+      oauthLimits: { contextWindow: 272000, maxOutputTokens: 128000 }
     }
   ]
 };
@@ -934,15 +1064,38 @@ var PROVIDER_MODEL_CATALOG = {
   kimi: KIMI_MODELS
 };
 function catalogPricing(provider, model) {
-  return PROVIDER_MODEL_CATALOG[provider].models.find((entry) => entry.id === model)?.pricing ?? null;
+  return PROVIDER_MODEL_CATALOG[provider]?.models.find((entry) => entry.id === model)?.pricing ?? null;
+}
+function catalogLimits(provider, model, auth = "apiKey") {
+  const entry = PROVIDER_MODEL_CATALOG[provider]?.models.find((choice) => choice.id === model);
+  if (entry === undefined)
+    return null;
+  return (auth === "oauth" ? entry.oauthLimits : undefined) ?? entry.limits;
 }
 // packages/providers/src/http-client.ts
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { Readable } from "stream";
-function nodeHttpClient() {
+function nodeHttpClient(options = {}) {
+  const logger2 = options.logger ?? noopLogger;
+  const now = options.now ?? (() => Date.now());
   return (req) => new Promise((resolve, reject) => {
     const url = new URL(req.url);
+    const startedAt = now();
+    let traced = false;
+    const trace = (status, failed = false) => {
+      if (traced || !logger2.enabled("debug"))
+        return;
+      traced = true;
+      logger2.debug("upstream http", {
+        provider: req.provider,
+        status,
+        host: url.host,
+        path: url.pathname,
+        durationMs: now() - startedAt,
+        reason: failed ? "transport error" : undefined
+      });
+    };
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
     const bodyBytes = Buffer.from(req.body, "utf8");
     const headers = {};
@@ -970,6 +1123,7 @@ function nodeHttpClient() {
         else if (typeof v === "string")
           responseHeaders.set(k, v);
       }
+      trace(incoming.statusCode);
       resolve({
         status: incoming.statusCode ?? 0,
         headers: responseHeaders,
@@ -985,17 +1139,17 @@ function nodeHttpClient() {
       });
     });
     const onAbort = () => outgoing.destroy(new Error("aborted"));
-    if (req.signal.aborted) {
-      outgoing.destroy(new Error("aborted"));
-      reject(new Error("aborted"));
-      return;
-    }
-    req.signal.addEventListener("abort", onAbort, { once: true });
     outgoing.on("error", (err) => {
       req.signal.removeEventListener("abort", onAbort);
+      trace(undefined, true);
       reject(err);
     });
     outgoing.on("close", () => req.signal.removeEventListener("abort", onAbort));
+    if (req.signal.aborted) {
+      outgoing.destroy(new Error("aborted"));
+      return;
+    }
+    req.signal.addEventListener("abort", onAbort, { once: true });
     if (bodyBytes.byteLength > 0)
       outgoing.write(bodyBytes);
     outgoing.end();
@@ -1064,12 +1218,8 @@ async function* decodeChat(messages) {
       yield { type: "start", id: String(d.id ?? ""), model: String(d.model ?? "") };
     }
     if (d.usage) {
-      usage = {
-        inputTokens: d.usage.prompt_tokens ?? 0,
-        outputTokens: d.usage.completion_tokens ?? 0,
-        cacheReadTokens: d.usage.prompt_cache_hit_tokens ?? 0,
-        cacheWriteTokens: 0
-      };
+      const details = d.usage.prompt_tokens_details;
+      usage = usageFromPromptTotal(d.usage.prompt_tokens ?? 0, d.usage.completion_tokens ?? 0, details?.cached_tokens ?? d.usage.prompt_cache_hit_tokens ?? 0, details?.cache_creation_tokens ?? details?.cache_write_tokens ?? 0);
     }
     const choice = d.choices?.[0];
     if (!choice)
@@ -1195,7 +1345,12 @@ function toChatWire(req, model) {
 `) });
     }
   }
-  const body = { model, messages, stream: req.stream };
+  const body = {
+    model,
+    messages,
+    stream: req.stream,
+    stream_options: { include_usage: true }
+  };
   if (req.maxTokens !== undefined)
     body.max_tokens = req.maxTokens;
   if (req.temperature !== undefined)
@@ -1236,6 +1391,7 @@ var kimiAdapter = {
     const profile = PROFILES.kimi;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "kimi",
       url: BASE_URL2,
       method: "POST",
       headers,
@@ -1366,12 +1522,7 @@ async function* decodeResponses(messages) {
         yield {
           type: "end",
           stopReason,
-          usage: {
-            inputTokens: r.usage?.input_tokens ?? 0,
-            outputTokens: r.usage?.output_tokens ?? 0,
-            cacheReadTokens: r.usage?.input_tokens_details?.cached_tokens ?? 0,
-            cacheWriteTokens: 0
-          }
+          usage: usageFromPromptTotal(r.usage?.input_tokens ?? 0, r.usage?.output_tokens ?? 0, r.usage?.input_tokens_details?.cached_tokens ?? r.usage?.prompt_tokens_details?.cached_tokens ?? 0)
         };
         break;
       }
@@ -1544,6 +1695,7 @@ var openaiAdapter = {
     const profile = PROFILES.openai;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const res = await req.http({
+      provider: "openai",
       url: oauth ? OAUTH_URL : API_URL,
       method: "POST",
       headers,
@@ -1558,13 +1710,14 @@ var openaiAdapter = {
   }
 };
 // packages/control/src/oauth/types.ts
-async function postJson(deps, url, profile2, opts) {
+async function postJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Content-Type", opts.contentType],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "POST",
     headers,
@@ -1578,13 +1731,14 @@ async function postJson(deps, url, profile2, opts) {
   } catch {}
   return { status: res.status, parsed };
 }
-async function getJson(deps, url, profile2, opts) {
+async function getJson(deps, provider, url, profile2, opts) {
   const headers = orderHeaders(mergeHeaders(profile2.headers, [
     ["Authorization", `Bearer ${opts.accessToken}`],
     ["Accept", "application/json"],
     ...opts.extraHeaders ?? []
   ]), profile2.order);
   const res = await deps.http({
+    provider,
     url,
     method: "GET",
     headers,
@@ -1778,7 +1932,7 @@ function deviceCodeFrom(value) {
   };
 }
 async function post(url, body2, device, deps) {
-  const { status, parsed } = await postJson(deps, url, PROFILES.kimi, {
+  const { status, parsed } = await postJson(deps, "kimi", url, PROFILES.kimi, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID }).toString(),
     extraHeaders: kimiDeviceHeaders(device)
@@ -1881,7 +2035,7 @@ var kimiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const device = deviceFrom(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL, PROFILES.kimi, {
+    const { status, parsed } = await getJson(deps, "kimi", USAGE_URL, PROFILES.kimi, {
       accessToken: secrets.accessToken,
       extraHeaders: kimiDeviceHeaders(device)
     });
@@ -1950,6 +2104,7 @@ function deviceIdFrom(start) {
   return deviceId;
 }
 function createConnectFlows(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const flows = createPendingFlows({ now: deps.now, ttlMs: FLOW_TTL_MS });
   const pollsInFlight = new Map;
   const callbackUri = (provider) => provider === "openai" ? "http://localhost:1455/auth/callback" : "";
@@ -1994,6 +2149,10 @@ function createConnectFlows(deps) {
       disabledAt: null,
       ...result.secrets
     });
+    logger2.info("oauth connect completed", {
+      provider: flow.provider,
+      credentialId: id
+    });
     return { id };
   }
   async function pollOutcome(flowId, poll) {
@@ -2066,6 +2225,62 @@ function createConnectFlows(deps) {
     }
   };
 }
+// packages/control/src/console.ts
+var UNIT_NAME = "omnigateway.service";
+var MAX_CONSOLE_LINES = 500;
+var DEFAULT_CONSOLE_LINES = 200;
+function resolveConsoleSource(input) {
+  const path = input.logFile?.trim();
+  if (path !== undefined && path.length > 0)
+    return { kind: "file", path };
+  if (input.unitInstalled)
+    return { kind: "journal", unit: UNIT_NAME, scope: input.scope };
+  return { kind: "none" };
+}
+function consoleLimit(requested) {
+  const value = requested === undefined ? DEFAULT_CONSOLE_LINES : Number(requested);
+  if (!Number.isFinite(value))
+    return DEFAULT_CONSOLE_LINES;
+  return Math.floor(Math.min(Math.max(1, value), MAX_CONSOLE_LINES));
+}
+function keep(line, query) {
+  if (query.since !== undefined && (line.at === null || line.at <= query.since))
+    return false;
+  if (query.level === undefined || line.level === null)
+    return true;
+  return LEVELS[line.level] >= LEVELS[query.level];
+}
+var SCAN_FACTOR = 20;
+var SCAN_LIMIT = 5000;
+function scanWidth(query) {
+  const filtered = query.level !== undefined || query.since !== undefined;
+  return filtered ? Math.min(query.lines * SCAN_FACTOR, SCAN_LIMIT) : query.lines;
+}
+async function readSource(deps, source, lines) {
+  if (source.kind === "none")
+    return "";
+  if (source.kind === "file")
+    return deps.readFile(source.path, lines) ?? "";
+  const scope = source.scope === "system" ? [] : ["--user"];
+  const result = await deps.run([
+    "journalctl",
+    ...scope,
+    "-u",
+    source.unit,
+    "-n",
+    String(lines),
+    "--no-pager",
+    "--output=cat"
+  ]);
+  return result.code === 0 ? result.stdout : "";
+}
+async function readConsole(deps, source, query) {
+  const limited = { ...query, lines: consoleLimit(query.lines) };
+  const text = await readSource(deps, source, scanWidth(limited));
+  const lines = text.split(`
+`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
+  return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
+}
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -16369,28 +16584,18 @@ var modelSchema = exports_external.object({
     costPerMTok: exports_external.object({
       input: exports_external.number().min(0),
       output: exports_external.number().min(0),
-      cacheRead: exports_external.number().min(0)
-    }),
-    capabilities: exports_external.object({
-      tools: exports_external.boolean(),
-      images: exports_external.boolean(),
-      reasoning: exports_external.boolean()
-    })
-  }).or(exports_external.object({
-    provider: providerIdSchema,
-    model: exports_external.string().min(1),
-    tier: exports_external.number().int().min(1),
-    weight: exports_external.number().positive(),
-    costPerMTok: exports_external.object({
-      input: exports_external.number().min(0),
-      output: exports_external.number().min(0)
+      cacheRead: exports_external.number().min(0).optional(),
+      cacheWrite5m: exports_external.number().min(0).optional(),
+      cacheWrite1h: exports_external.number().min(0).optional()
     }),
+    contextWindow: exports_external.number().int().positive().optional(),
+    maxOutputTokens: exports_external.number().int().positive().optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
       reasoning: exports_external.boolean()
     })
-  }))).min(1, "a virtual model needs at least one target")
+  })).min(1, "a virtual model needs at least one target")
 });
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
@@ -16468,7 +16673,7 @@ async function getCredential(store, id) {
     throw new GatewayError("BAD_REQUEST", "no such credential");
   return summarizeCredential(credential);
 }
-async function createApiKeyCredential(store, input) {
+async function createApiKeyCredential(store, input, logger2 = noopLogger) {
   const provider = parseOrThrow(providerIdSchema, input.provider);
   if (typeof input.apiKey !== "string" || input.apiKey.trim().length === 0) {
     throw new GatewayError("BAD_REQUEST", "apiKey: must not be empty");
@@ -16495,6 +16700,7 @@ async function createApiKeyCredential(store, input) {
     apiKey: input.apiKey,
     idToken: null
   });
+  logger2.info("credential added", { credentialId: created.id, provider: created.provider });
   return summarizeCredential(created);
 }
 async function refreshCredential(deps, id) {
@@ -16554,6 +16760,12 @@ async function patchCredential(deps, id, input) {
     ...patch.tier === undefined ? {} : { tier: patch.tier },
     ...patch.weight === undefined ? {} : { weight: patch.weight }
   });
+  if (patch.enabled !== undefined && patch.enabled !== existing.enabled) {
+    (deps.logger ?? noopLogger).info(patch.enabled ? "credential enabled" : "credential disabled", {
+      credentialId: id,
+      provider: existing.provider
+    });
+  }
 }
 async function removeCredential(store, id) {
   await store.credentials.remove(id);
@@ -17718,7 +17930,9 @@ function createUsageRepo(db) {
 
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
+  const logger2 = opts.logger ?? noopLogger;
   const db = openDb(opts.path);
+  logger2.debug("store opened", { path: opts.path });
   const listeners = new Set;
   const emit2 = (change) => {
     for (const listener of listeners) {
@@ -17811,7 +18025,7 @@ var REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
 var SCOPES = "org:create_api_key user:profile user:inference";
 var USAGE_URL2 = "https://api.anthropic.com/api/oauth/usage";
 async function postToken(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL2, PROFILES.anthropic, {
+  const { status, parsed } = await postJson(deps, "anthropic", TOKEN_URL2, PROFILES.anthropic, {
     contentType: "application/json",
     body: JSON.stringify({ ...body2, client_id: CLIENT_ID2 })
   });
@@ -17889,7 +18103,7 @@ var anthropicOAuth = {
   async usage(secrets, deps) {
     if (secrets.accessToken === null)
       return null;
-    const { status, parsed } = await getJson(deps, USAGE_URL2, PROFILES.anthropic, {
+    const { status, parsed } = await getJson(deps, "anthropic", USAGE_URL2, PROFILES.anthropic, {
       accessToken: secrets.accessToken,
       extraHeaders: [
         ["anthropic-beta", "oauth-2025-04-20"],
@@ -17947,7 +18161,7 @@ function parseTokenResponse(value) {
   };
 }
 async function postToken2(body2, deps) {
-  const { status, parsed } = await postJson(deps, TOKEN_URL3, PROFILES.openai, {
+  const { status, parsed } = await postJson(deps, "openai", TOKEN_URL3, PROFILES.openai, {
     contentType: "application/x-www-form-urlencoded",
     body: new URLSearchParams({ ...body2, client_id: CLIENT_ID3 }).toString()
   });
@@ -18046,7 +18260,7 @@ var openaiOAuth = {
     if (secrets.accessToken === null)
       return null;
     const accountId = accountIdFromProviderData(providerData);
-    const { status, parsed } = await getJson(deps, USAGE_URL3, PROFILES.openai, {
+    const { status, parsed } = await getJson(deps, "openai", USAGE_URL3, PROFILES.openai, {
       accessToken: secrets.accessToken,
       ...accountId === null ? {} : { extraHeaders: [["chatgpt-account-id", accountId]] }
     });
@@ -18064,6 +18278,7 @@ var OAUTH_PROVIDERS = {
 };
 // packages/control/src/oauth/refresh.ts
 function createRefresher(deps) {
+  const logger2 = deps.logger ?? noopLogger;
   const inFlight = new Map;
   async function run(credential) {
     const secrets = await credential.openForRefresh();
@@ -18071,11 +18286,20 @@ function createRefresher(deps) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
     const provider = deps.providers[credential.provider];
+    logger2.debug("refreshing credential", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     let result;
     try {
       result = await provider.refresh(secrets.refreshToken, { http: deps.http, now: deps.now }, credential.providerData);
     } catch (error51) {
       if (error51 instanceof GatewayError && error51.code === "AUTH") {
+        logger2.warn("credential disabled: refresh token rejected", {
+          provider: credential.provider,
+          credentialId: credential.id,
+          code: "AUTH"
+        });
         await deps.store.credentials.update(credential.id, {
           enabled: false,
           disabledReason: "tokenRejected",
@@ -18089,6 +18313,10 @@ function createRefresher(deps) {
       accountEmail: result.accountEmail ?? credential.accountEmail,
       providerData: { ...credential.providerData, ...result.providerData }
     });
+    logger2.debug("credential refreshed", {
+      provider: credential.provider,
+      credentialId: credential.id
+    });
     return result.secrets;
   }
   return function refresh(credential) {
@@ -18113,6 +18341,50 @@ async function putSettings(store, input) {
   await store.config.putSettings(settings);
   return settings;
 }
+// packages/control/src/tail.ts
+import { closeSync, fstatSync, openSync, readSync, statSync } from "fs";
+var CHUNK = 64 * 1024;
+var MAX_BYTES = 8 * 1024 * 1024;
+function tailFile(path, lines) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0)
+      return "";
+    const budget = Math.min(size, MAX_BYTES);
+    let read = 0;
+    let newlines = 0;
+    const chunks = [];
+    while (read < budget && newlines <= lines) {
+      const span = Math.min(CHUNK, budget - read);
+      const buffer = Buffer.allocUnsafe(span);
+      const position = size - read - span;
+      readSync(fd, buffer, 0, span, position);
+      chunks.unshift(buffer);
+      read += span;
+      for (const byte of buffer)
+        if (byte === 10)
+          newlines++;
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
+function fileExists(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
 // packages/control/src/usage.ts
 var MAX_LOG_LIMIT = 500;
 var DEFAULT_LOG_LIMIT = 100;
@@ -18347,6 +18619,278 @@ async function pollUntilAuthorized(flows, start, deps) {
   }
 }
 
+// apps/cli/src/service.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
+var UNIT_NAME2 = "omnigateway.service";
+function unitPath(scope) {
+  return scope === "system" ? join2("/etc/systemd/system", UNIT_NAME2) : join2(homedir2(), ".config", "systemd", "user", UNIT_NAME2);
+}
+function systemctlArgs(scope, args) {
+  return scope === "system" ? ["systemctl", ...args] : ["systemctl", "--user", ...args];
+}
+function pidFile(stateDir) {
+  return join2(stateDir, "gateway.pid");
+}
+function logFile(stateDir) {
+  return join2(stateDir, "gateway.log");
+}
+function supervisedLogFile(deps) {
+  const configured = deps.logFile?.trim();
+  return configured !== undefined && configured.length > 0 ? configured : logFile(deps.stateDir);
+}
+function defaultStateDir(env2) {
+  const xdg = env2.XDG_STATE_HOME;
+  const base = typeof xdg === "string" && xdg.length > 0 ? xdg : join2(homedir2(), ".local", "state");
+  return join2(base, "omnigateway");
+}
+function unitFile(input) {
+  return `[Unit]
+Description=${input.description ?? "OmniGateway"}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${input.root}
+EnvironmentFile=${join2(input.root, ".env")}
+ExecStart=${input.bun} ${input.entrypoint}
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=default.target
+`;
+}
+function unitInstalled(deps) {
+  return existsSync2(deps.unitPath);
+}
+function readPid(stateDir) {
+  const file2 = pidFile(stateDir);
+  if (!existsSync2(file2))
+    return null;
+  const pid = Number(readFileSync2(file2, "utf8").trim());
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+function livePid(deps) {
+  const pid = readPid(deps.stateDir);
+  if (pid === null)
+    return null;
+  if (deps.alive(pid))
+    return pid;
+  rmSync(pidFile(deps.stateDir), { force: true });
+  return null;
+}
+async function status(deps) {
+  if (unitInstalled(deps)) {
+    const active = await deps.run(systemctlArgs(deps.scope, ["is-active", UNIT_NAME2]));
+    const state = active.stdout.trim() || active.stderr.trim() || "unknown";
+    const shown = await deps.run(systemctlArgs(deps.scope, ["show", UNIT_NAME2, "--property=MainPID", "--value"]));
+    const pid2 = Number(shown.stdout.trim());
+    return {
+      supervisor: "systemd",
+      running: state === "active",
+      pid: Number.isInteger(pid2) && pid2 > 0 ? pid2 : null,
+      state,
+      unitPath: deps.unitPath,
+      logFile: null
+    };
+  }
+  const pid = livePid(deps);
+  return {
+    supervisor: pid === null ? "none" : "pidfile",
+    running: pid !== null,
+    pid,
+    state: null,
+    unitPath: null,
+    logFile: supervisedLogFile(deps)
+  };
+}
+async function start(deps, input) {
+  if (unitInstalled(deps)) {
+    const result = await deps.run(systemctlArgs(deps.scope, ["start", UNIT_NAME2]));
+    if (result.code !== 0) {
+      throw new Error(result.stderr.trim() || `systemctl start exited ${result.code}`);
+    }
+    return {
+      supervisor: "systemd",
+      pid: null,
+      healthy: await waitForHealth(deps, input.baseUrl)
+    };
+  }
+  const running = livePid(deps);
+  if (running !== null) {
+    return {
+      supervisor: "pidfile",
+      pid: running,
+      healthy: await waitForHealth(deps, input.baseUrl)
+    };
+  }
+  mkdirSync(deps.stateDir, { recursive: true });
+  const file2 = supervisedLogFile(deps);
+  mkdirSync(dirname(file2), { recursive: true });
+  const pid = deps.spawn({
+    argv: input.argv,
+    cwd: deps.root,
+    env: { ...input.env, OMNI_LOG_FILE: file2 },
+    logFile: file2
+  });
+  writeFileSync(pidFile(deps.stateDir), `${pid}
+`);
+  return { supervisor: "pidfile", pid, healthy: await waitForHealth(deps, input.baseUrl) };
+}
+var HEALTH_TIMEOUT_MS = 1e4;
+var HEALTH_INTERVAL_MS = 200;
+async function waitForHealth(deps, baseUrl) {
+  const attempts = Math.ceil(HEALTH_TIMEOUT_MS / HEALTH_INTERVAL_MS);
+  for (let attempt = 0;attempt < attempts; attempt++) {
+    if (await deps.probe(baseUrl))
+      return true;
+    await deps.sleep(HEALTH_INTERVAL_MS);
+  }
+  return false;
+}
+var STOP_GRACE_MS = 5000;
+var STOP_INTERVAL_MS = 100;
+async function stop(deps) {
+  if (unitInstalled(deps)) {
+    const result = await deps.run(systemctlArgs(deps.scope, ["stop", UNIT_NAME2]));
+    if (result.code !== 0) {
+      throw new Error(result.stderr.trim() || `systemctl stop exited ${result.code}`);
+    }
+    return { supervisor: "systemd", stopped: true };
+  }
+  const pid = livePid(deps);
+  if (pid === null)
+    return { supervisor: "none", stopped: false };
+  deps.kill(pid, "SIGTERM");
+  const attempts = Math.ceil(STOP_GRACE_MS / STOP_INTERVAL_MS);
+  for (let attempt = 0;deps.alive(pid); attempt++) {
+    if (attempt >= attempts) {
+      deps.kill(pid, "SIGKILL");
+      break;
+    }
+    await deps.sleep(STOP_INTERVAL_MS);
+  }
+  rmSync(pidFile(deps.stateDir), { force: true });
+  return { supervisor: "pidfile", stopped: true };
+}
+async function install(deps, input) {
+  const path = deps.unitPath;
+  if (existsSync2(path) && !input.force) {
+    throw new Error(`${path} already exists; pass --force to replace it`);
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, unitFile({ root: deps.root, bun: input.bun, entrypoint: input.entrypoint }));
+  const reload = await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
+  let enabled = false;
+  if (input.enable) {
+    const result = await deps.run(systemctlArgs(deps.scope, ["enable", UNIT_NAME2]));
+    enabled = result.code === 0;
+  }
+  return { path, reloaded: reload.code === 0, enabled };
+}
+async function uninstall(deps) {
+  const path = deps.unitPath;
+  if (!existsSync2(path))
+    return { path, removed: false };
+  await deps.run(systemctlArgs(deps.scope, ["disable", "--now", UNIT_NAME2]));
+  rmSync(path, { force: true });
+  await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
+  return { path, removed: true };
+}
+function consoleSource(deps) {
+  const configured = deps.logFile?.trim();
+  const chosen = configured !== undefined && configured.length > 0 && fileExists(configured) ? configured : unitInstalled(deps) ? undefined : fileExists(supervisedLogFile(deps)) ? supervisedLogFile(deps) : undefined;
+  return {
+    source: resolveConsoleSource({
+      ...chosen === undefined ? {} : { logFile: chosen },
+      unitInstalled: unitInstalled(deps),
+      scope: deps.scope
+    }),
+    deps: {
+      readFile: (path, lines) => tailFile(path, lines),
+      run: deps.run
+    }
+  };
+}
+async function serviceLogs(deps, lines) {
+  const { source, deps: readDeps } = consoleSource(deps);
+  const read = await readConsole(readDeps, source, { lines });
+  return read.lines.map((line) => line.raw).join(`
+`);
+}
+
+// apps/cli/src/commands/console.ts
+var FOLLOW_INTERVAL_MS = 2000;
+var LEVEL_TONE = {
+  debug: "dim",
+  warn: "yellow",
+  error: "red"
+};
+function render(ctx, lines) {
+  return lines.map((line) => {
+    const tone = line.level === null ? undefined : LEVEL_TONE[line.level];
+    return tone === undefined ? line.raw : paint(ctx, tone, line.raw);
+  }).join(`
+`);
+}
+function sourceHint(source) {
+  if (source.kind === "file")
+    return `${source.path} (named by OMNI_LOG_FILE)`;
+  if (source.kind === "journal")
+    return `systemd journal for ${source.unit}`;
+  return "not captured \u2014 run under systemd, or start it with `omni start`";
+}
+function empty(source) {
+  if (source.kind !== "none")
+    return `no output yet in ${sourceHint(source)}`;
+  return [
+    "this gateway's output is not being captured, so there is nothing to show.",
+    "run it in the foreground and its output goes to your terminal instead.",
+    "to capture it: `omni service install`, or `omni start`, which redirects",
+    "output to a file and points OMNI_LOG_FILE at it."
+  ].join(`
+`);
+}
+var console_ = {
+  usage: "console [-n N] [--follow] [--level debug|info|warn|error]",
+  summary: "Show the gateway process's own output",
+  options: {
+    number: { type: "string", short: "n" },
+    follow: { type: "boolean" },
+    level: { type: "string" },
+    system: { type: "boolean" }
+  },
+  async run(args, { ctx, writer, service }) {
+    const lines = numberFlag(args.values, "number") ?? 50;
+    const rawLevel = stringFlag(args.values, "level");
+    const level = parseLogLevel(rawLevel);
+    if (rawLevel !== undefined && level === null) {
+      throw new UsageError(`unknown level "${rawLevel}"; use debug, info, warn or error`);
+    }
+    const { source, deps } = consoleSource(service());
+    const query = { lines, ...level === null ? {} : { level } };
+    const first = await readConsole(deps, source, query);
+    emit(ctx, writer, first, () => first.lines.length === 0 ? empty(source) : render(ctx, first.lines));
+    if (!ctx.json && first.lines.length > 0) {
+      note(ctx, writer, paint(ctx, "dim", `reading ${sourceHint(source)}`));
+    }
+    if (boolFlag(args.values, "follow") !== true || ctx.json)
+      return;
+    let seen = first.lines.at(-1)?.at ?? 0;
+    for (;; ) {
+      await Bun.sleep(FOLLOW_INTERVAL_MS);
+      const next = await readConsole(deps, source, { ...query, since: seen });
+      if (next.lines.length === 0)
+        continue;
+      seen = next.lines.at(-1)?.at ?? seen;
+      writer.out(render(ctx, next.lines));
+    }
+  }
+};
+
 // apps/cli/src/command.ts
 var PROVIDER_TONE = {
   anthropic: "magenta",
@@ -18387,7 +18931,7 @@ var credentialsList = {
         { header: "STATE" },
         { header: "EXPIRES" }
       ], credentials.map((c) => {
-        const status = condition(c);
+        const status2 = condition(c);
         return [
           c.id,
           provider(ctx, c.provider),
@@ -18395,7 +18939,7 @@ var credentialsList = {
           c.authType,
           String(c.tier),
           String(c.weight),
-          state(ctx, status.ok, status.text),
+          state(ctx, status2.ok, status2.text),
           formatTime(c.expiresAt)
         ];
       }));
@@ -18411,7 +18955,7 @@ var credentialsShow = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "credential id");
     const credential = await findCredential(ctx, id);
-    const status = condition(credential);
+    const status2 = condition(credential);
     const data = {
       id: credential.id,
       provider: credential.provider,
@@ -18434,7 +18978,7 @@ var credentialsShow = {
       ["provider", provider(ctx, credential.provider)],
       ["label", credential.label],
       ["auth", credential.authType],
-      ["state", state(ctx, status.ok, status.text)],
+      ["state", state(ctx, status2.ok, status2.text)],
       ["tier", String(credential.tier)],
       ["weight", String(credential.weight)],
       ["account", credential.accountEmail ?? "\u2014"],
@@ -18569,12 +19113,12 @@ var credentialsHealth = {
 };
 
 // apps/cli/src/commands/db.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 var dbMigrate = {
   usage: "db migrate",
   summary: "Create or upgrade the database schema",
   async run(_args, { ctx, writer }) {
-    const existed = existsSync2(ctx.databasePath);
+    const existed = existsSync3(ctx.databasePath);
     const store = await ctx.store();
     await store.config.getSettings();
     emit(ctx, writer, { path: ctx.databasePath, created: !existed }, () => fields([
@@ -18696,6 +19240,11 @@ var modelsShow = {
         { header: "WEIGHT", align: "right" },
         { header: "IN $/MTOK", align: "right" },
         { header: "OUT $/MTOK", align: "right" },
+        { header: "CACHE R", align: "right" },
+        { header: "CACHE W 5M", align: "right" },
+        { header: "CACHE W 1H", align: "right" },
+        { header: "CONTEXT", align: "right" },
+        { header: "MAX OUT", align: "right" },
         { header: "CAPABILITIES" }
       ], model.targets.map((target) => [
         provider(ctx, target.provider),
@@ -18704,12 +19253,23 @@ var modelsShow = {
         String(target.weight),
         target.costPerMTok.input.toFixed(2),
         target.costPerMTok.output.toFixed(2),
+        price(target.costPerMTok.cacheRead),
+        price(target.costPerMTok.cacheWrite5m),
+        price(target.costPerMTok.cacheWrite1h),
+        tokens(target.contextWindow),
+        tokens(target.maxOutputTokens),
         capabilityList(target)
       ]))
     ].join(`
 `));
   }
 };
+function price(value) {
+  return value === undefined ? "\u2014" : value.toFixed(2);
+}
+function tokens(value) {
+  return value === undefined ? "\u2014" : value.toLocaleString("en-US");
+}
 function capabilityList(target) {
   const on = Object.entries(target.capabilities).filter(([, enabled]) => enabled).map(([name]) => name);
   return on.length === 0 ? "\u2014" : on.join(",");
@@ -18741,7 +19301,7 @@ function isCatalogProvider(value) {
   return value in PROVIDER_MODEL_CATALOG;
 }
 function catalogRows() {
-  return Object.entries(PROVIDER_MODEL_CATALOG).flatMap(([id, entry]) => entry.models.map((model) => ({ provider: id, id: model.id, label: model.label })));
+  return Object.entries(PROVIDER_MODEL_CATALOG).flatMap(([id, entry]) => entry.models.map((model) => ({ ...model, provider: id })));
 }
 var modelsCatalog = {
   usage: "models catalog [--provider P]",
@@ -18755,15 +19315,29 @@ var modelsCatalog = {
       { header: "MODEL" },
       { header: "LABEL" },
       { header: "IN $/MTOK", align: "right" },
-      { header: "OUT $/MTOK", align: "right" }
+      { header: "OUT $/MTOK", align: "right" },
+      { header: "CACHE R", align: "right" },
+      { header: "CACHE W 5M", align: "right" },
+      { header: "CACHE W 1H", align: "right" },
+      { header: "CONTEXT", align: "right" },
+      { header: "CONTEXT OAUTH", align: "right" },
+      { header: "MAX OUT", align: "right" }
     ], entries.map((entry) => {
-      const price = catalogPricing(entry.provider, entry.id);
+      const listed = catalogPricing(entry.provider, entry.id);
+      const limits = catalogLimits(entry.provider, entry.id);
+      const oauth = catalogLimits(entry.provider, entry.id, "oauth");
       return [
         provider(ctx, entry.provider),
         entry.id,
         entry.label,
-        price === null ? "\u2014" : price.input.toFixed(2),
-        price === null ? "\u2014" : price.output.toFixed(2)
+        price(listed?.input),
+        price(listed?.output),
+        price(listed?.cacheRead),
+        price(listed?.cacheWrite5m),
+        price(listed?.cacheWrite1h),
+        tokens(limits?.contextWindow),
+        oauth?.contextWindow === limits?.contextWindow ? "\u2014" : tokens(oauth?.contextWindow),
+        tokens(limits?.maxOutputTokens)
       ];
     })));
   }
@@ -18872,207 +19446,8 @@ ${candidates}${excluded}`;
 import { existsSync as existsSync5 } from "fs";
 
 // apps/cli/src/runtime.ts
-import { closeSync, existsSync as existsSync4, openSync } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync4, openSync as openSync2 } from "fs";
 import { join as join3 } from "path";
-
-// apps/cli/src/service.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
-var UNIT_NAME = "omnigateway.service";
-function unitPath(scope) {
-  return scope === "system" ? join2("/etc/systemd/system", UNIT_NAME) : join2(homedir2(), ".config", "systemd", "user", UNIT_NAME);
-}
-function systemctlArgs(scope, args) {
-  return scope === "system" ? ["systemctl", ...args] : ["systemctl", "--user", ...args];
-}
-function pidFile(stateDir) {
-  return join2(stateDir, "gateway.pid");
-}
-function logFile(stateDir) {
-  return join2(stateDir, "gateway.log");
-}
-function defaultStateDir(env2) {
-  const xdg = env2.XDG_STATE_HOME;
-  const base = typeof xdg === "string" && xdg.length > 0 ? xdg : join2(homedir2(), ".local", "state");
-  return join2(base, "omnigateway");
-}
-function unitFile(input) {
-  return `[Unit]
-Description=${input.description ?? "OmniGateway"}
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-WorkingDirectory=${input.root}
-EnvironmentFile=${join2(input.root, ".env")}
-ExecStart=${input.bun} ${input.entrypoint}
-Restart=on-failure
-RestartSec=2
-
-[Install]
-WantedBy=default.target
-`;
-}
-function unitInstalled(deps) {
-  return existsSync3(deps.unitPath);
-}
-function readPid(stateDir) {
-  const file2 = pidFile(stateDir);
-  if (!existsSync3(file2))
-    return null;
-  const pid = Number(readFileSync2(file2, "utf8").trim());
-  return Number.isInteger(pid) && pid > 0 ? pid : null;
-}
-function livePid(deps) {
-  const pid = readPid(deps.stateDir);
-  if (pid === null)
-    return null;
-  if (deps.alive(pid))
-    return pid;
-  rmSync(pidFile(deps.stateDir), { force: true });
-  return null;
-}
-async function status(deps) {
-  if (unitInstalled(deps)) {
-    const active = await deps.run(systemctlArgs(deps.scope, ["is-active", UNIT_NAME]));
-    const state2 = active.stdout.trim() || active.stderr.trim() || "unknown";
-    const shown = await deps.run(systemctlArgs(deps.scope, ["show", UNIT_NAME, "--property=MainPID", "--value"]));
-    const pid2 = Number(shown.stdout.trim());
-    return {
-      supervisor: "systemd",
-      running: state2 === "active",
-      pid: Number.isInteger(pid2) && pid2 > 0 ? pid2 : null,
-      state: state2,
-      unitPath: deps.unitPath,
-      logFile: null
-    };
-  }
-  const pid = livePid(deps);
-  return {
-    supervisor: pid === null ? "none" : "pidfile",
-    running: pid !== null,
-    pid,
-    state: null,
-    unitPath: null,
-    logFile: logFile(deps.stateDir)
-  };
-}
-async function start(deps, input) {
-  if (unitInstalled(deps)) {
-    const result = await deps.run(systemctlArgs(deps.scope, ["start", UNIT_NAME]));
-    if (result.code !== 0) {
-      throw new Error(result.stderr.trim() || `systemctl start exited ${result.code}`);
-    }
-    return {
-      supervisor: "systemd",
-      pid: null,
-      healthy: await waitForHealth(deps, input.baseUrl)
-    };
-  }
-  const running = livePid(deps);
-  if (running !== null) {
-    return {
-      supervisor: "pidfile",
-      pid: running,
-      healthy: await waitForHealth(deps, input.baseUrl)
-    };
-  }
-  mkdirSync(deps.stateDir, { recursive: true });
-  const pid = deps.spawn({
-    argv: input.argv,
-    cwd: deps.root,
-    env: input.env,
-    logFile: logFile(deps.stateDir)
-  });
-  writeFileSync(pidFile(deps.stateDir), `${pid}
-`);
-  return { supervisor: "pidfile", pid, healthy: await waitForHealth(deps, input.baseUrl) };
-}
-var HEALTH_TIMEOUT_MS = 1e4;
-var HEALTH_INTERVAL_MS = 200;
-async function waitForHealth(deps, baseUrl) {
-  const attempts = Math.ceil(HEALTH_TIMEOUT_MS / HEALTH_INTERVAL_MS);
-  for (let attempt = 0;attempt < attempts; attempt++) {
-    if (await deps.probe(baseUrl))
-      return true;
-    await deps.sleep(HEALTH_INTERVAL_MS);
-  }
-  return false;
-}
-var STOP_GRACE_MS = 5000;
-var STOP_INTERVAL_MS = 100;
-async function stop(deps) {
-  if (unitInstalled(deps)) {
-    const result = await deps.run(systemctlArgs(deps.scope, ["stop", UNIT_NAME]));
-    if (result.code !== 0) {
-      throw new Error(result.stderr.trim() || `systemctl stop exited ${result.code}`);
-    }
-    return { supervisor: "systemd", stopped: true };
-  }
-  const pid = livePid(deps);
-  if (pid === null)
-    return { supervisor: "none", stopped: false };
-  deps.kill(pid, "SIGTERM");
-  const attempts = Math.ceil(STOP_GRACE_MS / STOP_INTERVAL_MS);
-  for (let attempt = 0;deps.alive(pid); attempt++) {
-    if (attempt >= attempts) {
-      deps.kill(pid, "SIGKILL");
-      break;
-    }
-    await deps.sleep(STOP_INTERVAL_MS);
-  }
-  rmSync(pidFile(deps.stateDir), { force: true });
-  return { supervisor: "pidfile", stopped: true };
-}
-async function install(deps, input) {
-  const path = deps.unitPath;
-  if (existsSync3(path) && !input.force) {
-    throw new Error(`${path} already exists; pass --force to replace it`);
-  }
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, unitFile({ root: deps.root, bun: input.bun, entrypoint: input.entrypoint }));
-  const reload = await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
-  let enabled = false;
-  if (input.enable) {
-    const result = await deps.run(systemctlArgs(deps.scope, ["enable", UNIT_NAME]));
-    enabled = result.code === 0;
-  }
-  return { path, reloaded: reload.code === 0, enabled };
-}
-async function uninstall(deps) {
-  const path = deps.unitPath;
-  if (!existsSync3(path))
-    return { path, removed: false };
-  await deps.run(systemctlArgs(deps.scope, ["disable", "--now", UNIT_NAME]));
-  rmSync(path, { force: true });
-  await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
-  return { path, removed: true };
-}
-async function serviceLogs(deps, lines) {
-  if (unitInstalled(deps)) {
-    const args = deps.scope === "system" ? [] : ["--user"];
-    const result = await deps.run([
-      "journalctl",
-      ...args,
-      "-u",
-      UNIT_NAME,
-      "-n",
-      String(lines),
-      "--no-pager"
-    ]);
-    return result.stdout.trimEnd();
-  }
-  const file2 = logFile(deps.stateDir);
-  if (!existsSync3(file2))
-    return "";
-  return readFileSync2(file2, "utf8").split(`
-`).slice(-lines).join(`
-`).trimEnd();
-}
-
-// apps/cli/src/runtime.ts
 var runCommand = async (argv) => {
   const proc = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, code] = await Promise.all([
@@ -19083,7 +19458,7 @@ var runCommand = async (argv) => {
   return { code, stdout, stderr };
 };
 var spawnDetached = ({ argv, cwd, env: env2, logFile: logFile2 }) => {
-  const fd = openSync(logFile2, "a");
+  const fd = openSync2(logFile2, "a");
   try {
     const proc = Bun.spawn([...argv], {
       cwd,
@@ -19095,7 +19470,7 @@ var spawnDetached = ({ argv, cwd, env: env2, logFile: logFile2 }) => {
     proc.unref();
     return proc.pid;
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 };
 async function runForeground(input) {
@@ -19136,11 +19511,13 @@ function gatewayEntrypoint(root, cliDir = import.meta.dir) {
   return candidates.find((path) => existsSync4(path)) ?? null;
 }
 function createServiceDeps(input) {
+  const logFile2 = input.env.OMNI_LOG_FILE?.trim();
   return {
     root: input.root,
     stateDir: defaultStateDir(input.env),
     scope: input.scope,
     unitPath: unitPath(input.scope),
+    ...logFile2 === undefined || logFile2.length === 0 ? {} : { logFile: logFile2 },
     run: runCommand,
     spawn: spawnDetached,
     probe: probeHealth,
@@ -19183,7 +19560,7 @@ var start2 = {
     emit(ctx, writer, result, () => {
       const how = result.supervisor === "systemd" ? "systemd" : `pid ${result.pid}`;
       if (!result.healthy) {
-        const where = result.supervisor === "systemd" ? "journalctl -u omnigateway.service" : logFile(deps.stateDir);
+        const where = result.supervisor === "systemd" ? "journalctl -u omnigateway.service" : supervisedLogFile(deps);
         return `${state(ctx, false, "started but /health never answered")} (${how}); see ${where}`;
       }
       return `${state(ctx, true, "running")} (${how}) at ${baseUrl}`;
@@ -19276,7 +19653,8 @@ var doctor = {
       gatewayEntrypoint: gatewayEntrypoint(deps.root),
       unitInstalled: unit,
       supervisor: status2.supervisor,
-      running: status2.running
+      running: status2.running,
+      consoleSource: consoleSource(deps).source
     };
     emit(ctx, writer, checks3, () => {
       const ok = (value, text) => state(ctx, value, text);
@@ -19291,7 +19669,8 @@ var doctor = {
         ["config", checks3.configError === null ? ok(true, "ok") : ok(false, checks3.configError)],
         ["entrypoint", checks3.gatewayEntrypoint ?? ok(false, "not found")],
         ["systemd unit", unit ? deps.scope : paint(ctx, "dim", "none")],
-        ["gateway", ok(status2.running, status2.running ? "running" : "stopped")]
+        ["gateway", ok(status2.running, status2.running ? "running" : "stopped")],
+        ["console log", sourceHint(checks3.consoleSource)]
       ]);
     });
   }
@@ -19495,11 +19874,12 @@ var usage = {
 };
 var logs = {
   usage: "logs [-n N] [--follow] [--service]",
-  summary: "Show recent requests, or the gateway process's own output",
+  summary: "Show recent requests (--service is an alias for `omni console`)",
   options: {
     number: { type: "string", short: "n" },
     follow: { type: "boolean" },
-    service: { type: "boolean" }
+    service: { type: "boolean" },
+    system: { type: "boolean" }
   },
   async run(args, { ctx, writer, service }) {
     const limit = numberFlag(args.values, "number") ?? 20;
@@ -19509,7 +19889,7 @@ var logs = {
       return;
     }
     const store = await ctx.store();
-    const render = (rows) => table([
+    const render2 = (rows) => table([
       { header: "AT" },
       { header: "MODEL" },
       { header: "RESOLVED" },
@@ -19527,7 +19907,7 @@ var logs = {
       String(row.durationMs)
     ]));
     const first = await recentLogs(store, limit);
-    emit(ctx, writer, { logs: first }, () => first.length === 0 ? "no requests logged yet" : render(first));
+    emit(ctx, writer, { logs: first }, () => first.length === 0 ? "no requests logged yet" : render2(first));
     if (args.values.follow !== true || ctx.json)
       return;
     let seen = first[0]?.at ?? 0;
@@ -19537,7 +19917,7 @@ var logs = {
       if (next.length === 0)
         continue;
       seen = next[0]?.at ?? seen;
-      writer.out(render(next.reverse()));
+      writer.out(render2(next.reverse()));
     }
   }
 };
@@ -19550,6 +19930,7 @@ var COMMANDS = {
   restart,
   doctor,
   logs,
+  console: console_,
   usage,
   connect,
   "service install": serviceInstall,
@@ -19612,7 +19993,10 @@ function resolveCommand(argv) {
 
 // apps/cli/src/help.ts
 var GROUPS = [
-  { title: "Gateway", prefixes: ["status", "start", "stop", "restart", "doctor", "logs"] },
+  {
+    title: "Gateway",
+    prefixes: ["status", "start", "stop", "restart", "doctor", "logs", "console"]
+  },
   { title: "Service", prefixes: ["service "] },
   { title: "Accounts", prefixes: ["connect", "credentials "] },
   { title: "Models", prefixes: ["models "] },