omnigateway 0.2.2 → 0.4.0

package/bin/omni.js

@@ -102,9 +102,19 @@ function formatSpan(ms) {
 function formatUsd(value) {
   return `$${value.toFixed(value < 1 ? 4 : 2)}`;
 }
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes < 0)
+    return "\u2014";
+  if (bytes < 1024)
+    return `${Math.round(bytes)} B`;
+  const kb = bytes / 1024;
+  if (kb < 1024)
+    return `${kb.toFixed(1)} KB`;
+  return `${(kb / 1024).toFixed(1)} MB`;
+}
 
 // apps/cli/src/run.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 
 // packages/control/src/adminAuth.ts
@@ -161,9 +171,34 @@ function createAdminAuth(store, opts) {
     },
     logout(token) {
       sessions.delete(token);
+    },
+    invalidateSessions() {
+      sessions.clear();
     }
   };
 }
+// packages/control/src/bodies.ts
+async function readRequestBody(store, requestId) {
+  const read = await store.bodies.get(requestId);
+  if (read === null) {
+    return {
+      requestId,
+      detailState: "none",
+      truncated: false,
+      sizeBytes: 0,
+      at: null,
+      artifact: null
+    };
+  }
+  return {
+    requestId: read.row.requestId,
+    detailState: read.row.detailState,
+    truncated: read.row.truncated,
+    sizeBytes: read.row.sizeBytes,
+    at: read.row.at,
+    artifact: read.artifact
+  };
+}
 // packages/ir/src/betas.ts
 var CONTEXT_1M_BETA = "context-1m-2025-08-07";
 var CONTEXT_1M_TOKENS = 1e6;
@@ -362,6 +397,7 @@ function loadConfig(env) {
   const staticDir = env.OMNI_STATIC_DIR?.trim();
   const logFile = env.OMNI_LOG_FILE?.trim();
   const exposeClaudeCodeAliases = TRUTHY.has((env.OMNI_EXPOSE_CLAUDE_CODE_ALIASES ?? "").trim().toLowerCase());
+  const bodyLoggingAllowed = TRUTHY.has((env.OMNI_BODY_LOGGING_ALLOWED ?? "").trim().toLowerCase());
   const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
   const logLevel = parseLogLevel(rawLogLevel);
   return {
@@ -374,6 +410,7 @@ function loadConfig(env) {
     baseUrl,
     staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
     exposeClaudeCodeAliases,
+    bodyLoggingAllowed,
     logFile: logFile === undefined || logFile.length === 0 ? null : logFile
   };
 }
@@ -513,14 +550,16 @@ function billingBlock() {
   return `${BILLING_PREFIX} cc_version=${CLI_VERSION}.${BUILD_REVISION}; ` + `cc_entrypoint=cli; cch=${CCH_PLACEHOLDER};`;
 }
 var BANNED_SUBSTRINGS = [
-  "github.com/anomalyco/o\u200Dpencode",
-  "o\u200Dpencode.ai/docs",
-  "github.com/c\u200Dline/c\u200Dline",
-  "github.com/getc\u200Dursor/c\u200Dursor",
-  "c\u200Dontinue.dev"
+  "github.com/anomalyco/opencode",
+  "opencode.ai/docs",
+  "github.com/cline/cline",
+  "github.com/getcursor/cursor",
+  "continue.dev",
+  "hermes-agent.nousresearch.com"
 ];
+var IDENTITY_PREFIXES = ["You are OpenCode", "You are Hermes Agent"];
 var REWRITES = [
-  ["if O\u200DpenCode honestly", "if the assistant honestly"],
+  ["if OpenCode honestly", "if the assistant honestly"],
   [
     "Here is some useful information about the environment you are running in:",
     "Environment context you are running in:"
@@ -529,7 +568,7 @@ var REWRITES = [
 function applyAnthropicSystem(system) {
   const kept = [];
   for (const block of system) {
-    const text = block.text.split(/\n{2,}/).filter((p) => !BANNED_SUBSTRINGS.some((b) => p.includes(b))).filter((p) => !p.trimStart().startsWith("You are O\u200DpenCode")).filter((p) => !p.includes(BILLING_PREFIX)).filter((p) => p.trim() !== AGENT_PREAMBLE).join(`
+    const text = block.text.split(/\n{2,}/).filter((p) => !BANNED_SUBSTRINGS.some((b) => p.includes(b))).filter((p) => !IDENTITY_PREFIXES.some((i) => p.trimStart().startsWith(i))).filter((p) => !p.includes(BILLING_PREFIX)).filter((p) => p.trim() !== AGENT_PREAMBLE).join(`
 
 `);
     let rewritten = text;
@@ -17811,6 +17850,45 @@ function date4(params) {
 
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// packages/ratelimit/src/catalog.ts
+var WINDOWS = ["1m", "5h", "1w"];
+var WINDOW_MS = {
+  "1m": 60000,
+  "5h": 5 * 60 * 60 * 1000,
+  "1w": 7 * 24 * 60 * 60 * 1000
+};
+var countLimit = exports_external.number().int().positive().nullable();
+var spendLimit = exports_external.number().positive().nullable();
+var countWindows = exports_external.object({
+  "1m": countLimit.optional(),
+  "5h": countLimit.optional(),
+  "1w": countLimit.optional()
+}).strict();
+var spendWindows = exports_external.object({
+  "5h": spendLimit.optional(),
+  "1w": spendLimit.optional()
+}).strict();
+var limitConfigSchema = exports_external.object({
+  requests: countWindows.optional(),
+  tokens: countWindows.optional(),
+  spend: spendWindows.optional(),
+  concurrency: countLimit.optional()
+}).strict();
+function assertNoProto(value, path) {
+  if (typeof value !== "object" || value === null)
+    return;
+  for (const key of Object.getOwnPropertyNames(value)) {
+    if (key === "__proto__") {
+      throw new Error(`limits cannot name "__proto__"${path === "" ? "" : ` under ${path}`}`);
+    }
+    assertNoProto(value[key], path === "" ? key : `${path}.${key}`);
+  }
+}
+function parseLimitConfig(value) {
+  assertNoProto(value, "");
+  return limitConfigSchema.parse(value);
+}
+
 // packages/control/src/schemas.ts
 function parseOrThrow(schema, body2) {
   const result = schema.safeParse(body2);
@@ -17888,7 +17966,13 @@ var modelSchema = exports_external.object({
 var keyCreateSchema = exports_external.object({
   label: exports_external.string().min(1).default("api key"),
   modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable().default(null),
-  rateLimitPerMin: exports_external.number().int().positive().nullable().default(null)
+  limits: limitConfigSchema.default({}),
+  bodyLoggingOptOut: exports_external.boolean().default(false)
+}).strict();
+var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
+var retentionSchema = exports_external.object({
+  keepLatest: exports_external.number().int().min(1).max(100),
+  maxAgeDays: exports_external.number().int().min(1).max(3650)
 }).strict();
 var settingsSchema = exports_external.object({
   weights: exports_external.object({
@@ -17905,7 +17989,11 @@ var settingsSchema = exports_external.object({
   breakerCooldownMs: exports_external.number().int().positive(),
   logRetentionDays: exports_external.number().int().min(1),
   quotaPollIntervalMs: exports_external.number().int().min(0),
-  rtkEnabled: exports_external.boolean()
+  rtkEnabled: exports_external.boolean(),
+  bodyLoggingEnabled: exports_external.boolean(),
+  bodyLoggingCaptureStreamChunks: exports_external.boolean(),
+  snapshotKeepLatest: retentionSchema.shape.keepLatest.optional(),
+  snapshotMaxAgeDays: retentionSchema.shape.maxAgeDays.optional()
 });
 var credentialPatchSchema = exports_external.object({
   label: exports_external.string().min(1).optional(),
@@ -18128,7 +18216,11 @@ var DEFAULT_SETTINGS = {
   breakerCooldownMs: 30000,
   logRetentionDays: 30,
   quotaPollIntervalMs: 300000,
-  rtkEnabled: false
+  rtkEnabled: false,
+  bodyLoggingEnabled: false,
+  bodyLoggingCaptureStreamChunks: false,
+  snapshotKeepLatest: 5,
+  snapshotMaxAgeDays: 30
 };
 
 // packages/router/src/quota.ts
@@ -18267,6 +18359,10 @@ function rank(input) {
   return { candidates: scored, excluded };
 }
 
+// packages/store/src/bodies/artifact.ts
+import { mkdir, readdir, readFile, rmdir, unlink, writeFile } from "fs/promises";
+import { dirname, join, sep } from "path";
+
 // packages/store/src/encryption.ts
 var PREFIX = "enc:v1";
 var IV_BYTES = 12;
@@ -18306,6 +18402,362 @@ function unhex(s) {
     out[i] = Number.parseInt(s.slice(i * 2, i * 2 + 2), 16);
   return out;
 }
+
+// packages/store/src/bodies/bound.ts
+var MAX_STRING_BYTES = 64 * 1024;
+var MAX_ARRAY_ITEMS = 24;
+var MAX_DEPTH = 6;
+var MAX_OBJECT_KEYS = 80;
+var STRING_TRUNCATION_MARKER = "\u2026[truncated]";
+var DEPTH_MARKER = `[omitted: nesting past ${MAX_DEPTH} levels]`;
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+var CUT_BYTES = MAX_STRING_BYTES - encoder.encode(STRING_TRUNCATION_MARKER).length - 3;
+function truncateToBytes(value) {
+  const bytes = encoder.encode(value);
+  if (bytes.length <= MAX_STRING_BYTES)
+    return value;
+  return decoder.decode(bytes.subarray(0, CUT_BYTES)) + STRING_TRUNCATION_MARKER;
+}
+function boundValue(value) {
+  let truncated = false;
+  const walk = (input, depth) => {
+    if (typeof input === "string") {
+      const cut = truncateToBytes(input);
+      if (cut !== input)
+        truncated = true;
+      return cut;
+    }
+    if (Array.isArray(input)) {
+      if (depth > MAX_DEPTH) {
+        truncated = true;
+        return DEPTH_MARKER;
+      }
+      const kept = input.length > MAX_ARRAY_ITEMS ? input.slice(-MAX_ARRAY_ITEMS) : input;
+      if (kept.length !== input.length)
+        truncated = true;
+      return kept.map((item) => walk(item, depth + 1));
+    }
+    if (input !== null && typeof input === "object") {
+      if (depth > MAX_DEPTH) {
+        truncated = true;
+        return DEPTH_MARKER;
+      }
+      const entries = Object.entries(input);
+      const kept = entries.length > MAX_OBJECT_KEYS ? entries.slice(0, MAX_OBJECT_KEYS) : entries;
+      if (kept.length !== entries.length)
+        truncated = true;
+      return Object.fromEntries(kept.map(([k, v]) => [k, walk(v, depth + 1)]));
+    }
+    return input;
+  };
+  const bounded = walk(value, 1);
+  return { value: bounded, truncated };
+}
+
+// packages/store/src/bodies/mask.ts
+var ELIDED = "[redacted]";
+var BEARER = /\b(bearer)\s+[A-Za-z0-9._~+/=-]+/gi;
+var PREFIXED_KEY = /(?<![A-Za-z0-9_-])(?:sk|ak|pk)-[A-Za-z0-9_-]{8,}/g;
+var VENDOR_KEY = /(?<![A-Za-z0-9_-])(?:gh[posu]_|github_pat_|AIza|GOCSPX-)[A-Za-z0-9_-]{8,}/g;
+var VENDOR_PREFIX = /^(?:gh[posu]_|github_pat_|AIza|GOCSPX-)/;
+var XAI_KEY = /(?<![A-Za-z0-9_-])xai-[A-Za-z0-9_]{8,}/g;
+var OPAQUE = /[A-Za-z0-9_-]{41,}/g;
+var MASK_RULES = [
+  {
+    id: "bearer",
+    pattern: BEARER,
+    keep: (match) => match.length - match.replace(/^bearer\s+/i, "").length
+  },
+  { id: "prefixedKey", pattern: PREFIXED_KEY, keep: () => 3 },
+  {
+    id: "vendorKey",
+    pattern: VENDOR_KEY,
+    keep: (match) => VENDOR_PREFIX.exec(match)?.[0].length ?? 0
+  },
+  { id: "xaiKey", pattern: XAI_KEY, keep: () => "xai-".length },
+  { id: "opaque", pattern: OPAQUE, keep: () => 0 }
+];
+function maskString(value) {
+  return MASK_RULES.reduce((masked, rule) => masked.replace(rule.pattern, (match) => `${match.slice(0, rule.keep(match))}${ELIDED}`), value);
+}
+function maskSecrets(value) {
+  if (typeof value === "string")
+    return maskString(value);
+  if (Array.isArray(value))
+    return value.map(maskSecrets);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskSecrets(v)]));
+  }
+  return value;
+}
+
+// packages/store/src/bodies/artifact.ts
+var ARTIFACT_SCHEMA_VERSION = 1;
+var MAX_ARTIFACT_BYTES = 512 * 1024;
+var BODY_ROW_CAP = 1e5;
+var BODIES_DIRNAME = "request_bodies";
+var encoder2 = new TextEncoder;
+function bodiesDirFor(databasePath) {
+  return join(dirname(databasePath), BODIES_DIRNAME);
+}
+var SAFE_REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;
+function isSafeRequestId(id) {
+  return SAFE_REQUEST_ID.test(id);
+}
+function relPathFor(requestId, at) {
+  const date5 = new Date(at);
+  const yyyy = String(date5.getUTCFullYear()).padStart(4, "0");
+  const mm = String(date5.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date5.getUTCDate()).padStart(2, "0");
+  return `${yyyy}/${mm}/${dd}/${requestId}.json.enc`;
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function bodyPair(pair) {
+  const request2 = boundValue(maskSecrets(pair.request));
+  const response = boundValue(maskSecrets(pair.response));
+  return {
+    request: request2.value,
+    response: response.value,
+    truncated: pair.truncated === true || request2.truncated || response.truncated
+  };
+}
+function omission(serializedBytes) {
+  return {
+    omitted: true,
+    reason: `artifact exceeded ${MAX_ARTIFACT_BYTES} bytes after structural bounding`,
+    serializedBytes
+  };
+}
+function omitBodies(artifact, marker) {
+  return {
+    ...artifact,
+    client: { request: marker, response: marker, truncated: true },
+    attempts: artifact.attempts.map((attempt) => ({
+      attempt: attempt.attempt,
+      provider: attempt.provider,
+      request: marker,
+      response: marker,
+      streamChunks: null,
+      truncated: true
+    }))
+  };
+}
+function prepareArtifact(input) {
+  const client = bodyPair(input.client);
+  const attempts = input.attempts.map((attempt) => {
+    const pair = bodyPair(attempt);
+    const chunks = attempt.streamChunks === null ? null : boundValue(attempt.streamChunks.map(maskString));
+    return {
+      attempt: attempt.attempt,
+      provider: attempt.provider,
+      request: pair.request,
+      response: pair.response,
+      streamChunks: chunks === null ? null : chunks.value,
+      truncated: pair.truncated || (chunks?.truncated ?? false)
+    };
+  });
+  const error51 = boundValue(maskSecrets(input.error));
+  const bounded = {
+    schemaVersion: ARTIFACT_SCHEMA_VERSION,
+    requestId: input.requestId,
+    at: input.at,
+    client,
+    attempts,
+    error: error51.value
+  };
+  const json7 = JSON.stringify(bounded);
+  const size = encoder2.encode(json7).length;
+  if (size <= MAX_ARTIFACT_BYTES)
+    return { artifact: bounded, json: json7 };
+  const marker = omission(size);
+  const omitted = omitBodies(bounded, marker);
+  const omittedJson = JSON.stringify(omitted);
+  if (encoder2.encode(omittedJson).length <= MAX_ARTIFACT_BYTES) {
+    return { artifact: omitted, json: omittedJson };
+  }
+  const stripped = { ...omitted, error: marker };
+  return { artifact: stripped, json: JSON.stringify(stripped) };
+}
+async function sealArtifact(key, json7) {
+  const bytes = encoder2.encode(await encrypt(key, json7));
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
+async function readArtifact(key, dir, relPath, expectedSha256) {
+  let bytes;
+  try {
+    bytes = new Uint8Array(await readFile(join(dir, relPath)));
+  } catch {
+    return { ok: false, failure: "missing" };
+  }
+  try {
+    if (expectedSha256 !== null && await sha256Hex(bytes) !== expectedSha256) {
+      return { ok: false, failure: "corrupt" };
+    }
+    const parsed = JSON.parse(await decrypt(key, new TextDecoder().decode(bytes)));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { ok: false, failure: "corrupt" };
+    }
+    return { ok: true, artifact: parsed };
+  } catch {
+    return { ok: false, failure: "corrupt" };
+  }
+}
+async function writeArtifact(dir, relPath, bytes) {
+  const full = join(dir, relPath);
+  await mkdir(dirname(full), { recursive: true });
+  await writeFile(full, bytes);
+}
+async function deleteArtifact(dir, relPath) {
+  const full = join(dir, relPath);
+  try {
+    await unlink(full);
+  } catch {
+    return;
+  }
+  let parent = dirname(full);
+  while (parent.length > dir.length && parent.startsWith(dir + sep)) {
+    try {
+      await rmdir(parent);
+    } catch {
+      return;
+    }
+    parent = dirname(parent);
+  }
+}
+async function listArtifacts(dir) {
+  const out = [];
+  const walk = async (current, prefix) => {
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+      if (entry.isDirectory())
+        await walk(join(current, entry.name), rel);
+      else if (entry.isFile())
+        out.push(rel);
+    }
+  };
+  await walk(dir, "");
+  return out;
+}
+// packages/store/src/sqlite/bodies.ts
+function toDetailState(value) {
+  return value === "ready" || value === "missing" || value === "corrupt" ? value : "none";
+}
+var toRow = (r) => ({
+  requestId: r.request_id,
+  at: r.at,
+  relPath: r.rel_path,
+  sizeBytes: r.size_bytes,
+  sha256: r.sha256,
+  detailState: toDetailState(r.detail_state),
+  truncated: r.truncated === 1
+});
+function createBodyRepo(db, key, dir) {
+  const removeRows = async (rows) => {
+    for (const row of rows) {
+      if (row.relPath !== null)
+        await deleteArtifact(dir, row.relPath);
+    }
+    const remove = db.prepare("DELETE FROM request_bodies WHERE request_id = ?");
+    db.transaction(() => {
+      for (const row of rows)
+        remove.run(row.requestId);
+    })();
+    return rows.length;
+  };
+  const recordState = (requestId, state) => {
+    db.run("UPDATE request_bodies SET detail_state = ? WHERE request_id = ?", [state, requestId]);
+  };
+  return {
+    async put(artifact) {
+      if (!isSafeRequestId(artifact.requestId)) {
+        throw new Error("request id is not safe to use as an artifact path segment");
+      }
+      const prepared = prepareArtifact(artifact);
+      const sealed = await sealArtifact(key, prepared.json);
+      const relPath = relPathFor(artifact.requestId, artifact.at);
+      await writeArtifact(dir, relPath, sealed.bytes);
+      const truncated = prepared.artifact.client.truncated || prepared.artifact.attempts.some((attempt) => attempt.truncated);
+      const row = {
+        requestId: artifact.requestId,
+        at: artifact.at,
+        relPath,
+        sizeBytes: sealed.bytes.length,
+        sha256: sealed.sha256,
+        detailState: "ready",
+        truncated
+      };
+      db.run(`INSERT INTO request_bodies (request_id, at, rel_path, size_bytes, sha256, detail_state, truncated)
+         VALUES (?,?,?,?,?,?,?)
+         ON CONFLICT (request_id) DO UPDATE SET
+           at = excluded.at,
+           rel_path = excluded.rel_path,
+           size_bytes = excluded.size_bytes,
+           sha256 = excluded.sha256,
+           detail_state = excluded.detail_state,
+           truncated = excluded.truncated`, [
+        row.requestId,
+        row.at,
+        row.relPath,
+        row.sizeBytes,
+        row.sha256,
+        row.detailState,
+        row.truncated ? 1 : 0
+      ]);
+      return row;
+    },
+    async get(requestId) {
+      const found = db.query("SELECT * FROM request_bodies WHERE request_id = ?").get(requestId);
+      if (found === null)
+        return null;
+      const row = toRow(found);
+      if (row.relPath === null || row.detailState === "none")
+        return { row, artifact: null };
+      const read = await readArtifact(key, dir, row.relPath, row.sha256);
+      if (read.ok) {
+        if (row.detailState !== "ready")
+          recordState(requestId, "ready");
+        return { row: { ...row, detailState: "ready" }, artifact: read.artifact };
+      }
+      recordState(requestId, read.failure);
+      return { row: { ...row, detailState: read.failure }, artifact: null };
+    },
+    async prune(olderThan) {
+      const rows = db.query("SELECT * FROM request_bodies WHERE at < ?").all(olderThan).map(toRow);
+      return removeRows(rows);
+    },
+    async pruneToCap(cap = BODY_ROW_CAP) {
+      const total = db.query("SELECT COUNT(*) AS n FROM request_bodies").get()?.n ?? 0;
+      if (total <= cap)
+        return 0;
+      const rows = db.query("SELECT * FROM request_bodies ORDER BY at ASC, request_id ASC LIMIT ?").all(total - cap).map(toRow);
+      return removeRows(rows);
+    },
+    async sweepOrphans() {
+      const known = new Set(db.query("SELECT rel_path FROM request_bodies WHERE rel_path IS NOT NULL").all().map((r) => r.rel_path));
+      const claimed = db.query("SELECT COUNT(*) AS n FROM request_bodies WHERE rel_path = ?");
+      let removed = 0;
+      for (const rel of await listArtifacts(dir)) {
+        if (known.has(rel))
+          continue;
+        if ((claimed.get(rel)?.n ?? 0) > 0)
+          continue;
+        await deleteArtifact(dir, rel);
+        removed += 1;
+      }
+      return removed;
+    }
+  };
+}
 // packages/store/src/sqlite/config.ts
 var SETTINGS_KEY = "settings";
 var ADMIN_HASH_KEY = "adminPasswordHash";
@@ -18361,6 +18813,8 @@ function createConfigRepo(db, emit2 = () => {}) {
           ...DEFAULT_SETTINGS,
           ...stored,
           rtkEnabled: stored.rtkEnabled === true,
+          bodyLoggingEnabled: stored.bodyLoggingEnabled === true,
+          bodyLoggingCaptureStreamChunks: stored.bodyLoggingCaptureStreamChunks === true,
           weights: knownWeights(stored.weights)
         };
       } catch {
@@ -18391,6 +18845,29 @@ function createConfigRepo(db, emit2 = () => {}) {
   };
 }
 // packages/store/src/sqlite/credentials.ts
+function toHealth(r) {
+  return {
+    credentialId: r.credential_id,
+    model: r.model,
+    breakerState: r.breaker_state,
+    consecutiveFailures: r.consecutive_failures,
+    openedAt: r.opened_at,
+    rateLimitedUntil: r.rate_limited_until,
+    ewmaTtftMs: r.ewma_ttft_ms,
+    lastUsedAt: r.last_used_at
+  };
+}
+var UPSERT_HEALTH = `INSERT INTO credential_health
+   (credential_id, model, breaker_state, consecutive_failures, opened_at,
+    rate_limited_until, ewma_ttft_ms, last_used_at)
+ VALUES (?,?,?,?,?,?,?,?)
+ ON CONFLICT (credential_id, model) DO UPDATE SET
+   breaker_state = excluded.breaker_state,
+   consecutive_failures = excluded.consecutive_failures,
+   opened_at = excluded.opened_at,
+   rate_limited_until = excluded.rate_limited_until,
+   ewma_ttft_ms = excluded.ewma_ttft_ms,
+   last_used_at = excluded.last_used_at`;
 function createCredentialRepo(db, key, emit2 = () => {}) {
   const open = async (v) => v === null ? null : decrypt(key, v);
   const secretsFrom = async (row) => ({
@@ -18565,29 +19042,10 @@ function createCredentialRepo(db, key, emit2 = () => {}) {
       emit2({ type: "credentialsChanged" });
     },
     async listHealth() {
-      return db.query("SELECT * FROM credential_health").all().map((r) => ({
-        credentialId: r.credential_id,
-        model: r.model,
-        breakerState: r.breaker_state,
-        consecutiveFailures: r.consecutive_failures,
-        openedAt: r.opened_at,
-        rateLimitedUntil: r.rate_limited_until,
-        ewmaTtftMs: r.ewma_ttft_ms,
-        lastUsedAt: r.last_used_at
-      }));
+      return db.query("SELECT * FROM credential_health").all().map(toHealth);
     },
     async saveHealth(rows) {
-      const stmt = db.prepare(`INSERT INTO credential_health
-           (credential_id, model, breaker_state, consecutive_failures, opened_at,
-            rate_limited_until, ewma_ttft_ms, last_used_at)
-         VALUES (?,?,?,?,?,?,?,?)
-         ON CONFLICT (credential_id, model) DO UPDATE SET
-           breaker_state = excluded.breaker_state,
-           consecutive_failures = excluded.consecutive_failures,
-           opened_at = excluded.opened_at,
-           rate_limited_until = excluded.rate_limited_until,
-           ewma_ttft_ms = excluded.ewma_ttft_ms,
-           last_used_at = excluded.last_used_at`);
+      const stmt = db.prepare(UPSERT_HEALTH);
       db.transaction(() => {
         for (const r of rows) {
           stmt.run(r.credentialId, r.model, r.breakerState, r.consecutiveFailures, r.openedAt, r.rateLimitedUntil, r.ewmaTtftMs, r.lastUsedAt);
@@ -18595,6 +19053,18 @@ function createCredentialRepo(db, key, emit2 = () => {}) {
       })();
       emit2({ type: "healthSaved", rows });
     },
+    async updateHealth(credentialId, model, apply) {
+      const current = db.prepare("SELECT * FROM credential_health WHERE credential_id = ? AND model = ?");
+      const stmt = db.prepare(UPSERT_HEALTH);
+      const written = db.transaction(() => {
+        const row = current.get(credentialId, model);
+        const next = apply(row === null ? null : toHealth(row));
+        stmt.run(next.credentialId, next.model, next.breakerState, next.consecutiveFailures, next.openedAt, next.rateLimitedUntil, next.ewmaTtftMs, next.lastUsedAt);
+        return next;
+      })();
+      emit2({ type: "healthSaved", rows: [written] });
+      return written;
+    },
     async listQuota() {
       return db.query("SELECT * FROM quota_windows").all().map((r) => ({
         credentialId: r.credential_id,
@@ -18906,7 +19376,219 @@ CREATE INDEX quota_samples_observed ON quota_samples (observed_at);
 ALTER TABLE quota_windows ADD COLUMN window_ms INTEGER;
 `;
 
+// packages/store/src/sqlite/migrations/008_body_logging.sql
+var _008_body_logging_default = `-- Captured request and response bodies, and the api key opt-out that suppresses
+-- them.
+--
+-- The row holds a pointer, never a body. Bodies are the largest thing this
+-- gateway could ever store \u2014 a single conversation with a pasted file in it
+-- dwarfs the whole of \`request_logs\` \u2014 and SQLite would carry every one of them
+-- through the same page cache, the same WAL, and the same backup that the
+-- routing tables live in. A prompt corpus inlined here would make the operating
+-- database grow without bound, make every \`VACUUM\` copy it, and put plaintext
+-- rows one \`sqlite3\` invocation away. The artifact instead lives at
+-- \`<dirname(databasePath)>/request_bodies/YYYY/MM/DD/<request_id>.json.enc\`,
+-- encrypted under the same key as provider credentials, and this row records
+-- only where it is and whether it can still be trusted. OmniRoute reached the
+-- same layout the expensive way: its \`call_logs_v1_legacy\` table exists purely
+-- to drain inline blobs it had already shipped into file artifacts.
+--
+-- \`rel_path\` is relative so moving an installation does not invalidate every
+-- row, and nullable because a row can exist with no artifact behind it: capture
+-- may have been suppressed, or the file may have been swept.
+--
+-- \`sha256\` is taken over the bytes as stored \u2014 the ciphertext \u2014 not over the
+-- plaintext. Truncation or bit-rot on disk is then detectable by a reader that
+-- does not hold \`OMNI_ENCRYPTION_KEY\` at all, which is what makes \`corrupt\` a
+-- state the reader can report rather than an exception it has to raise.
+--
+-- \`detail_state\` is one of \`none\`, \`ready\`, \`missing\`, or \`corrupt\`. A file tree
+-- and a table it is not written to transactionally will drift \u2014 a crash between
+-- the two writes is enough \u2014 so the reader records what it observed and hands
+-- back the metadata. \`missing\` and \`corrupt\` are answers, not failures.
+--
+-- \`truncated\` is set when structural bounding altered anything, so a reader can
+-- say "this is not the whole payload" without diffing it against nothing.
+--
+-- No foreign key to \`request_logs\`. Expiry is performed explicitly, deleting the
+-- file and the row together, because \`ON DELETE CASCADE\` only fires while the
+-- \`foreign_keys\` pragma is on: a pragma silently off would turn expiry of a
+-- prompt corpus into indefinite retention of one, and that failure is invisible
+-- until someone goes looking.
+CREATE TABLE request_bodies (
+  request_id   TEXT PRIMARY KEY,
+  at           INTEGER NOT NULL,
+  rel_path     TEXT,
+  size_bytes   INTEGER NOT NULL DEFAULT 0,
+  sha256       TEXT,
+  detail_state TEXT NOT NULL DEFAULT 'none',
+  truncated    INTEGER NOT NULL DEFAULT 0
+);
+
+-- Descending, because every read of this table is time-ordered from the newest
+-- end: the retention sweep walks the oldest rows and the row cap walks them in
+-- the same direction, and the console only ever asks about recent requests.
+CREATE INDEX idx_request_bodies_at ON request_bodies (at DESC);
+
+-- Per-key suppression, checked before any capture work begins.
+--
+-- A shared installation can be serving one client whose payloads must not be
+-- retained while capturing everything else, and that client's operator cannot be
+-- asked to trust a global switch they do not control. Default 0 keeps every
+-- existing key on the installation-wide setting, which is itself off by default.
+ALTER TABLE api_keys ADD COLUMN body_logging_opt_out INTEGER NOT NULL DEFAULT 0;
+`;
+
+// packages/store/src/sqlite/migrations/009_key_limits.sql
+var _009_key_limits_default = `-- Per-key limits as a sparse \`(dimension, window)\` matrix, replacing the single
+-- requests-per-minute integer.
+--
+-- One JSON column rather than a column per pair, because the matrix is sparse
+-- and the pairs are not fixed: \`requests\` and \`tokens\` are meaningful at all
+-- three windows, \`spend\` only at the two long ones, and \`concurrency\` is a gauge
+-- with no window at all. Twelve mostly-null integer columns would encode the
+-- same thing while making every future pair a migration.
+--
+-- The JSON keys are a storage contract in the same class as \`RTK_FILTER_IDS\`:
+-- the dimension and window names are persisted in every row, so adding a name is
+-- free and renaming or removing one loses data. Unlike RTK ids, which are
+-- dropped silently on read, an unknown limit key is a parse failure \u2014 a limit
+-- the gateway cannot understand must never be read as "no limit", because that
+-- fails open on a control the operator explicitly set.
+--
+-- \`NOT NULL DEFAULT '{}'\` rather than nullable, so "unlimited" has exactly one
+-- spelling at the column level and every reader parses the same shape.
+ALTER TABLE api_keys ADD COLUMN limits TEXT NOT NULL DEFAULT '{}';
+
+-- The old ceiling was requests per minute and nothing else, so it lands whole in
+-- \`requests["1m"]\`. A NULL meant unlimited and stays unlimited as the default
+-- \`{}\`: an absent key and an explicit null both mean the same thing, and the
+-- empty object is the shape a newly minted key starts at.
+--
+-- Only a value the reader accepts is carried over. \`rate_limit_per_min\` was
+-- \`INTEGER\` with no \`CHECK\`, so a hand-edited install can hold \`0\`, \`-5\` or
+-- \`1.5\` in it, while the new schema is \`z.number().int().positive()\`. Backfilled
+-- unconditionally, each of those writes a matrix \`parseLimitConfig\` refuses \u2014
+-- which is \`limits: null\`, which is every request for that key answered
+-- \`INTERNAL\` at the auth chokepoint. An upgrade must not manufacture the
+-- unreadable row the design describes as arising only from meddling.
+--
+-- Anything else stays at the \`{}\` default, which is unlimited: a ceiling that
+-- was already nonsense bounded nothing before this migration either, so
+-- dropping it changes no behaviour and leaves the key serving.
+--
+-- \`typeof()\` rather than a range test alone. SQLite's INTEGER affinity is a
+-- preference, not a constraint: \`1.5\` stays REAL and \`'sixty'\` stays TEXT, and
+-- TEXT sorts above every number so a bare \`> 0\` would admit the string.
+UPDATE api_keys
+   SET limits = json_object('requests', json_object('1m', rate_limit_per_min))
+ WHERE typeof(rate_limit_per_min) = 'integer'
+   AND rate_limit_per_min > 0;
+
+ALTER TABLE api_keys DROP COLUMN rate_limit_per_min;
+
+-- Correctness-adjacent, not an optimisation, and it must not be dropped later as
+-- redundant with \`idx_request_logs_at\`.
+--
+-- \`request_logs\` leads its existing indexes with \`at\` and with \`credential_id\`;
+-- nothing leads with \`api_key_id\`. A sliding weekly sum for one key against
+-- \`idx_request_logs_at\` scans every row in the week for every key on the
+-- install, and that scan sits on the request hot path.
+--
+-- Composite order matters: \`(api_key_id, at DESC)\` lets the range scan start at
+-- the key. \`(at DESC, api_key_id)\` does not.
+CREATE INDEX idx_request_logs_key_at ON request_logs (api_key_id, at DESC);
+`;
+
+// packages/store/src/sqlite/migrations/010_usage_rollup.sql
+var _010_usage_rollup_default = `-- Per-key hourly counters, so a long sliding window is read rather than scanned.
+--
+-- \`sumSince\` is on the admission path of every request, and \`bun:sqlite\` is
+-- synchronous: a \`SELECT SUM\` over a week of one key's rows blocks the entire
+-- event loop for its duration \u2014 \`/health\`, \`/api/*\`, the quiesce latch, and
+-- every other key's traffic with it. Measured on one machine, one key, WAL:
+-- 149ms at 0.2M rows in the window, 2.1s at 2M, 10.8s at 8M. The cost is
+-- O(accumulated history) and has no ceiling, and the eager-refresh rule makes it
+-- worst exactly when a key is busiest \u2014 a key inside the last tenth of a long
+-- ceiling reads through on every admission. The same reads against this table
+-- are flat at ~0.017ms, because a week is 168 buckets however much traffic each
+-- one summarises.
+--
+-- This reverses the design's own rejection of a counter table, and the reason it
+-- can be reversed is that this table is *derived*. \`request_logs\` stays the
+-- source of truth; every figure here is reproducible from it by one grouped
+-- select. The original objection was that a counter table can disagree with the
+-- log and nobody can tell which is right \u2014 that objection is answered by there
+-- being a rebuild, a restore that runs it, and a \`doctor\` check that compares
+-- the two. It would not be answered by care.
+--
+-- \`hour\` is \`at / 3600000\`, floored, and every SQL side spells that
+-- \`CAST(at / 3600000 AS INTEGER)\`. The cast is not decoration: nothing validates
+-- \`at\`, and SQLite's \`/\` is integer division only when both operands are
+-- integers, so a fractional \`at\` would give this INTEGER column a REAL key that
+-- no later integer-hour write ever merges with. Truncation toward zero and
+-- JavaScript's \`Math.floor\` then agree on every epoch this side of 1970, which
+-- is every epoch a request log holds.
+--
+-- \`api_key_id\` is NOT NULL and anonymous rows are left out: a WITHOUT ROWID
+-- primary key cannot hold a NULL, and nothing reads this table except a per-key
+-- lookup that could never match one.
+CREATE TABLE usage_rollup (
+  api_key_id         TEXT NOT NULL,
+  hour               INTEGER NOT NULL,
+  requests           INTEGER NOT NULL DEFAULT 0,
+  input_tokens       INTEGER NOT NULL DEFAULT 0,
+  output_tokens      INTEGER NOT NULL DEFAULT 0,
+  cache_read_tokens  INTEGER NOT NULL DEFAULT 0,
+  cache_write_tokens INTEGER NOT NULL DEFAULT 0,
+  cost_usd           REAL NOT NULL DEFAULT 0,
+  PRIMARY KEY (api_key_id, hour)
+) WITHOUT ROWID;
+
+-- The backfill is this migration's \`after\` hook rather than an INSERT here, and
+-- it is the same \`rebuildRollup\` a restore runs. Seeding an existing install and
+-- repairing a suspect one are the same statement, so they are the same code and
+-- cannot drift into disagreeing about which rows count.
+`;
+
+// packages/store/src/sqlite/migrations/011_plugin_migrations.sql
+var _011_plugin_migrations_default = `-- The plugin migration ledger, kept deliberately apart from core's \`migrations\`.
+--
+-- Core's track is a single ascending integer owned by this repository. A plugin
+-- ships its own numbered migrations and knows nothing about ours, so the two
+-- cannot share a counter: if they did, installing a plugin would consume numbers
+-- that core's next migration then collides with, and the collision would surface
+-- as "migration already applied" on an upgrade rather than as anything legible.
+-- Core's next migration is 012 regardless of how many migrations any plugin
+-- ships, and a plugin's version 1 is its own version 1 forever.
+--
+-- The primary key is (plugin_id, version) rather than a surrogate id because
+-- that pair *is* the identity: applying the same version twice is the thing this
+-- table exists to prevent, and a uniqueness constraint states it once instead of
+-- leaving it to whichever code path happens to check first.
+--
+-- \`applied_at\` is milliseconds, matching every other timestamp in this schema.
+-- It is recorded for an operator reading the table during an incident, not read
+-- by the host: the host asks only whether a row exists.
+--
+-- Note what is *not* here: no row for the plugin's tables, and no cascade. A
+-- plugin's tables outlive its rows here on purpose \u2014 see \`PluginRepo.dropAll\`
+-- and \`orphanTables\`. Dropping a table because a plugin is currently absent
+-- destroys data irreversibly, and a restore is precisely the moment a plugin is
+-- most likely to be absent.
+CREATE TABLE plugin_migrations (
+  plugin_id TEXT NOT NULL,
+  version INTEGER NOT NULL,
+  applied_at INTEGER NOT NULL,
+  PRIMARY KEY (plugin_id, version)
+);
+`;
+
 // packages/store/src/sqlite/rollup.ts
+var HOUR_MS = 3600000;
+function hourOf(at) {
+  return Math.floor(at / HOUR_MS);
+}
 function startOfLocalDay(at) {
   const day = new Date(at);
   day.setHours(0, 0, 0, 0);
@@ -19015,6 +19697,88 @@ function backfillDaily(db) {
     upsert(db, group.key, group.counters);
   return groups.size;
 }
+var HOURLY_UPSERT = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  VALUES (?,?,?,?,?,?,?,?)
+  ON CONFLICT (api_key_id, hour)
+  DO UPDATE SET
+    requests           = requests + excluded.requests,
+    input_tokens       = input_tokens + excluded.input_tokens,
+    output_tokens      = output_tokens + excluded.output_tokens,
+    cache_read_tokens  = cache_read_tokens + excluded.cache_read_tokens,
+    cache_write_tokens = cache_write_tokens + excluded.cache_write_tokens,
+    cost_usd           = cost_usd + excluded.cost_usd`;
+function rollupHour(db, log) {
+  const apiKeyId = log.apiKeyId;
+  if (apiKeyId === null)
+    return;
+  db.run(HOURLY_UPSERT, [
+    apiKeyId,
+    hourOf(log.at),
+    1,
+    log.inputTokens,
+    log.outputTokens,
+    log.cacheReadTokens,
+    log.cacheWriteTokens,
+    log.costUsd
+  ]);
+}
+var REBUILD = `
+  INSERT INTO usage_rollup
+    (api_key_id, hour, requests, input_tokens, output_tokens,
+     cache_read_tokens, cache_write_tokens, cost_usd)
+  SELECT api_key_id,
+         CAST(at / 3600000 AS INTEGER),
+         COUNT(*),
+         COALESCE(SUM(input_tokens), 0),
+         COALESCE(SUM(output_tokens), 0),
+         COALESCE(SUM(cache_read_tokens), 0),
+         COALESCE(SUM(cache_write_tokens), 0),
+         COALESCE(SUM(cost_usd), 0)
+    FROM request_logs
+   WHERE state = 'done' AND api_key_id IS NOT NULL
+   GROUP BY api_key_id, CAST(at / 3600000 AS INTEGER)`;
+function rebuildRollup(db) {
+  db.run("DELETE FROM usage_rollup");
+  db.run(REBUILD);
+}
+function auditRollup(db) {
+  const row = db.query(`WITH truth AS (
+         SELECT api_key_id AS k,
+                CAST(at / 3600000 AS INTEGER) AS h,
+                COUNT(*) AS requests,
+                COALESCE(SUM(input_tokens), 0) AS input_tokens,
+                COALESCE(SUM(output_tokens), 0) AS output_tokens,
+                COALESCE(SUM(cache_read_tokens), 0) AS cache_read_tokens,
+                COALESCE(SUM(cache_write_tokens), 0) AS cache_write_tokens,
+                COALESCE(SUM(cost_usd), 0) AS cost_usd
+           FROM request_logs
+          WHERE state = 'done' AND api_key_id IS NOT NULL
+          GROUP BY k, h
+       )
+       SELECT (SELECT COUNT(*) FROM truth) AS buckets,
+              (SELECT COUNT(*)
+                 FROM truth
+                 LEFT JOIN usage_rollup r ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE r.api_key_id IS NULL
+                   OR r.requests <> truth.requests
+                   OR r.input_tokens <> truth.input_tokens
+                   OR r.output_tokens <> truth.output_tokens
+                   OR r.cache_read_tokens <> truth.cache_read_tokens
+                   OR r.cache_write_tokens <> truth.cache_write_tokens
+                   OR ABS(r.cost_usd - truth.cost_usd) > 1e-9 + ABS(truth.cost_usd) * 1e-9
+              ) AS mismatched,
+              (SELECT COUNT(*)
+                 FROM usage_rollup r
+                 LEFT JOIN truth ON r.api_key_id = truth.k AND r.hour = truth.h
+                WHERE truth.k IS NULL
+              ) AS orphans`).get();
+  const buckets = row?.buckets ?? 0;
+  const mismatched = (row?.mismatched ?? 0) + (row?.orphans ?? 0);
+  return { buckets, mismatched, ok: mismatched === 0 };
+}
 function backfillRtkUsage(db) {
   const groups = new Map;
   for (const row of db.query(`SELECT at, api_key_id, requested_model, resolved_provider, resolved_model, credential_id,
@@ -19051,7 +19815,11 @@ var MIGRATIONS = [
   { id: 4, sql: _004_request_state_default },
   { id: 5, sql: _005_rtk_metrics_default },
   { id: 6, sql: _006_rtk_usage_default, after: backfillRtkUsage },
-  { id: 7, sql: _007_quota_samples_default }
+  { id: 7, sql: _007_quota_samples_default },
+  { id: 8, sql: _008_body_logging_default },
+  { id: 9, sql: _009_key_limits_default },
+  { id: 10, sql: _010_usage_rollup_default, after: rebuildRollup },
+  { id: 11, sql: _011_plugin_migrations_default }
 ];
 function openDb(path) {
   const db = new Database(path, { create: true });
@@ -19082,44 +19850,290 @@ async function hashApiKey(raw) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
-var toKey = (r) => ({
+function parseLimits(id, raw, logger2) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parseLimitConfig(parsed);
+  } catch {
+    logger2.error("api key limits unreadable", { apiKeyId: id });
+    return null;
+  }
+}
+var toKey = (r, logger2) => ({
   id: r.id,
   label: r.label,
   prefix: r.prefix,
   hash: r.hash,
   modelAllowlist: r.model_allowlist === null ? null : JSON.parse(r.model_allowlist),
-  rateLimitPerMin: r.rate_limit_per_min,
+  limits: parseLimits(r.id, r.limits, logger2),
+  bodyLoggingOptOut: r.body_logging_opt_out === 1,
   createdAt: r.created_at,
   revokedAt: r.revoked_at
 });
-function createKeyRepo(db) {
+function createKeyRepo(db, logger2 = noopLogger) {
   return {
     async list() {
-      return db.query("SELECT * FROM api_keys ORDER BY created_at DESC").all().map(toKey);
+      return db.query("SELECT * FROM api_keys ORDER BY created_at DESC").all().map((row) => toKey(row, logger2));
     },
     async findByHash(hash3) {
       const row = db.query("SELECT * FROM api_keys WHERE hash = ?").get(hash3);
-      return row ? toKey(row) : null;
+      return row ? toKey(row, logger2) : null;
     },
     async create(input) {
       const now = Date.now();
-      db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, rate_limit_per_min, created_at, revoked_at)
-         VALUES (?,?,?,?,?,?,?,NULL)`, [
+      db.run(`INSERT INTO api_keys (id, label, prefix, hash, model_allowlist, limits,
+                               body_logging_opt_out, created_at, revoked_at)
+         VALUES (?,?,?,?,?,?,?,?,NULL)`, [
         input.id,
         input.label,
         input.prefix,
         input.hash,
         input.modelAllowlist === null ? null : JSON.stringify(input.modelAllowlist),
-        input.rateLimitPerMin,
+        JSON.stringify(parseLimitConfig(input.limits)),
+        input.bodyLoggingOptOut ? 1 : 0,
         now
       ]);
       return { ...input, createdAt: now, revokedAt: null };
     },
+    async setLimits(id, limits) {
+      db.run("UPDATE api_keys SET limits = ? WHERE id = ?", [
+        JSON.stringify(parseLimitConfig(limits)),
+        id
+      ]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
   };
 }
+// packages/store/src/sqlite/maintenance.ts
+import { Database as Database2 } from "bun:sqlite";
+var REQUIRED_TABLES = [
+  "api_keys",
+  "credential_health",
+  "credentials",
+  "migrations",
+  "quota_windows",
+  "request_logs",
+  "settings",
+  "virtual_models"
+];
+var UNREADABLE = "unreadable";
+function sqlLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function createMaintenanceRepo(db) {
+  return {
+    async stats() {
+      const pageSize = db.query("PRAGMA page_size").get();
+      const pageCount = db.query("PRAGMA page_count").get();
+      const freelist = db.query("PRAGMA freelist_count").get();
+      const version2 = db.query("SELECT MAX(id) AS version FROM migrations").get();
+      return {
+        pageSize: pageSize?.page_size ?? 0,
+        pageCount: pageCount?.page_count ?? 0,
+        freelistCount: freelist?.freelist_count ?? 0,
+        schemaVersion: version2?.version ?? 0
+      };
+    },
+    async vacuum() {
+      db.run("VACUUM");
+      db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+    },
+    async snapshotTo(path) {
+      db.run(`VACUUM INTO ${sqlLiteral(path)}`);
+    },
+    async inspect(path) {
+      let file2;
+      try {
+        file2 = new Database2(path, { readonly: true });
+      } catch {
+        return { ok: false, quickCheck: UNREADABLE, tables: [], counts: {} };
+      }
+      try {
+        const problems = file2.query("PRAGMA quick_check").all();
+        const quickCheck = problems[0]?.quick_check ?? UNREADABLE;
+        const tables = file2.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' " + "ORDER BY name").all().map((r) => r.name);
+        const present = new Set(tables);
+        const counts = {};
+        for (const table2 of REQUIRED_TABLES) {
+          if (!present.has(table2))
+            continue;
+          const n = file2.query(`SELECT COUNT(*) AS n FROM ${table2}`).get();
+          counts[table2] = n?.n ?? 0;
+        }
+        const complete = REQUIRED_TABLES.every((t) => present.has(t));
+        return { ok: quickCheck === "ok" && complete, quickCheck, tables, counts };
+      } catch {
+        return { ok: false, quickCheck: UNREADABLE, tables: [], counts: {} };
+      } finally {
+        file2.close();
+      }
+    }
+  };
+}
+// packages/store/src/sqlite/plugins.ts
+var PLUGIN_ID = /^[a-z][a-z0-9-]{0,31}$/;
+var TABLE_NAME = /^[a-z][a-z0-9_]{0,31}$/;
+var PLACEHOLDER = /\{\{([^{}]*)\}\}/g;
+var CORE_TABLES = [
+  "api_keys",
+  "credential_health",
+  "credentials",
+  "migrations",
+  "plugin_migrations",
+  "quota_samples",
+  "quota_windows",
+  "request_bodies",
+  "request_logs",
+  "settings",
+  "usage_daily",
+  "usage_rollup",
+  "virtual_models"
+];
+var CORE_TABLE_REFERENCE = new RegExp(`\\b(?:${CORE_TABLES.join("|")})\\b`);
+var PREFIX3 = "plugin_";
+function stripNoise(sql) {
+  let out = "";
+  let i = 0;
+  while (i < sql.length) {
+    const c = sql[i];
+    const next = sql[i + 1];
+    if (c === "'") {
+      i += 1;
+      while (i < sql.length) {
+        if (sql[i] === "'") {
+          if (sql[i + 1] === "'")
+            i += 2;
+          else
+            break;
+        } else
+          i += 1;
+      }
+      i += 1;
+      out += " ";
+    } else if (c === "-" && next === "-") {
+      while (i < sql.length && sql[i] !== `
+`)
+        i += 1;
+      out += " ";
+    } else if (c === "/" && next === "*") {
+      i += 2;
+      while (i < sql.length && !(sql[i] === "*" && sql[i + 1] === "/"))
+        i += 1;
+      i += 2;
+      out += " ";
+    } else {
+      out += c;
+      i += 1;
+    }
+  }
+  return out;
+}
+function tableFor(pluginId, name) {
+  return `"${PREFIX3}${pluginId}_${name}"`;
+}
+function prefixFor(pluginId) {
+  return `${PREFIX3}${pluginId}_`;
+}
+function assertPluginId(pluginId) {
+  if (!PLUGIN_ID.test(pluginId)) {
+    throw new Error(`plugin id ${JSON.stringify(pluginId)} is not a valid identifier`);
+  }
+}
+function prepare(pluginId, sql) {
+  assertPluginId(pluginId);
+  const expanded = sql.replace(PLACEHOLDER, (_match, name) => {
+    if (!TABLE_NAME.test(name)) {
+      throw new Error(`plugin table placeholder ${JSON.stringify(name)} must match ${TABLE_NAME.source}`);
+    }
+    return tableFor(pluginId, name);
+  });
+  const found = CORE_TABLE_REFERENCE.exec(stripNoise(expanded));
+  if (found !== null) {
+    throw new Error(`plugin sql may not reference the core table ${found[0]}`);
+  }
+  return expanded;
+}
+function toBinding(value, index) {
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" || value instanceof Uint8Array) {
+    return value;
+  }
+  throw new Error(`plugin sql parameter ${index} is not a bindable value`);
+}
+var toBindings = (params) => (params ?? []).map(toBinding);
+function createPluginRepo(db) {
+  const pluginTables = () => db.query("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all().map((r) => r.name).filter((name) => name.startsWith(PREFIX3) && name !== "plugin_migrations");
+  const tablesOf = (pluginId) => {
+    const prefix = prefixFor(pluginId);
+    return pluginTables().filter((name) => name.startsWith(prefix));
+  };
+  const appliedVersions = (pluginId) => new Set(db.query("SELECT version FROM plugin_migrations WHERE plugin_id = ?").all(pluginId).map((r) => r.version));
+  return {
+    migrate(pluginId, migrations) {
+      assertPluginId(pluginId);
+      const done = appliedVersions(pluginId);
+      const applied = [];
+      const ordered = [...migrations].sort((a, b) => a.version - b.version);
+      for (const migration of ordered) {
+        if (done.has(migration.version))
+          continue;
+        try {
+          if (!Number.isSafeInteger(migration.version) || migration.version < 1) {
+            throw new Error("migration version must be a positive integer");
+          }
+          const sql = prepare(pluginId, migration.sql);
+          db.transaction(() => {
+            db.run(sql);
+            db.run("INSERT INTO plugin_migrations (plugin_id, version, applied_at) VALUES (?,?,?)", [pluginId, migration.version, Date.now()]);
+          })();
+          applied.push(migration.version);
+        } catch (error51) {
+          return {
+            applied,
+            failed: {
+              version: migration.version,
+              reason: error51 instanceof Error ? error51.message : String(error51)
+            }
+          };
+        }
+      }
+      return { applied };
+    },
+    run(pluginId, sql, params) {
+      db.run(prepare(pluginId, sql), toBindings(params));
+    },
+    all(pluginId, sql, params) {
+      return db.prepare(prepare(pluginId, sql)).all(...toBindings(params));
+    },
+    get(pluginId, sql, params) {
+      const row = db.prepare(prepare(pluginId, sql)).get(...toBindings(params));
+      return row === null || row === undefined ? null : row;
+    },
+    transaction(pluginId, fn) {
+      assertPluginId(pluginId);
+      return db.transaction(fn)();
+    },
+    listTables(pluginId) {
+      assertPluginId(pluginId);
+      return tablesOf(pluginId);
+    },
+    dropAll(pluginId) {
+      assertPluginId(pluginId);
+      const tables = tablesOf(pluginId);
+      db.transaction(() => {
+        for (const table2 of tables)
+          db.run(`DROP TABLE IF EXISTS "${table2}"`);
+        db.run("DELETE FROM plugin_migrations WHERE plugin_id = ?", [pluginId]);
+      })();
+      return tables.length;
+    },
+    orphanTables(installedIds) {
+      const prefixes = installedIds.filter((id) => PLUGIN_ID.test(id)).map(prefixFor);
+      return pluginTables().filter((name) => !prefixes.some((p) => name.startsWith(p)));
+    }
+  };
+}
 // packages/rtk/src/catalog.ts
 var RTK_FILTER_IDS = [
   "git-diff",
@@ -19186,7 +20200,7 @@ var GROUP_COLUMN = {
     requestedModel: "requested_model",
     apiKey: "api_key_id",
     provider: "resolved_provider",
-    hour: "at / 3600000",
+    hour: "CAST(at / 3600000 AS INTEGER)",
     day: null
   },
   daily: {
@@ -19283,8 +20297,30 @@ function createUsageRepo(db) {
   const complete = db.transaction((log) => {
     db.run(COMPLETE, values(log, "done"));
     const stored = db.query("SELECT * FROM request_logs WHERE id = ?").get(log.id);
-    if (stored !== null)
-      rollupLog(db, toLog(stored));
+    if (stored !== null) {
+      const restored = toLog(stored);
+      rollupLog(db, restored);
+      rollupHour(db, restored);
+    }
+  });
+  const pruneLogs = db.transaction((olderThan) => {
+    db.run("DELETE FROM request_logs WHERE at < ?", [olderThan]);
+    const removed = db.query("SELECT changes() AS n").get()?.n ?? 0;
+    const boundary = hourOf(olderThan);
+    db.run("DELETE FROM usage_rollup WHERE hour <= ?", [boundary]);
+    db.run(`INSERT INTO usage_rollup
+         (api_key_id, hour, requests, input_tokens, output_tokens,
+          cache_read_tokens, cache_write_tokens, cost_usd)
+       SELECT api_key_id, ?, COUNT(*),
+              COALESCE(SUM(input_tokens), 0),
+              COALESCE(SUM(output_tokens), 0),
+              COALESCE(SUM(cache_read_tokens), 0),
+              COALESCE(SUM(cache_write_tokens), 0),
+              COALESCE(SUM(cost_usd), 0)
+         FROM request_logs
+        WHERE state = 'done' AND api_key_id IS NOT NULL AND at >= ? AND at < ?
+        GROUP BY api_key_id`, [boundary, boundary * HOUR_MS, (boundary + 1) * HOUR_MS]);
+    return removed;
   });
   return {
     async begin(log) {
@@ -19308,6 +20344,38 @@ function createUsageRepo(db) {
     async recent(limit) {
       return db.query("SELECT * FROM request_logs ORDER BY at DESC LIMIT ?").all(limit).map(toLog);
     },
+    async sumSince(apiKeyId, sinceMs) {
+      const boundary = hourOf(sinceMs);
+      const whole = db.query(`SELECT COALESCE(SUM(requests), 0) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM usage_rollup
+            WHERE api_key_id = ? AND hour > ?`).get(apiKeyId, boundary);
+      const edge = db.query(`SELECT COUNT(*) AS requests,
+                  COALESCE(SUM(input_tokens + output_tokens
+                               + cache_read_tokens + cache_write_tokens), 0) AS tokens,
+                  COALESCE(SUM(cost_usd), 0) AS cost_usd
+             FROM request_logs
+            WHERE api_key_id = ? AND state = 'done' AND at >= ? AND at < ?`).get(apiKeyId, sinceMs, (boundary + 1) * HOUR_MS);
+      return {
+        requests: (whole?.requests ?? 0) + (edge?.requests ?? 0),
+        tokens: (whole?.tokens ?? 0) + (edge?.tokens ?? 0),
+        costUsd: (whole?.cost_usd ?? 0) + (edge?.cost_usd ?? 0)
+      };
+    },
+    async rebuildRollup() {
+      rebuildRollup(db);
+    },
+    async auditRollup() {
+      return auditRollup(db);
+    },
+    async oldestSince(apiKeyId, sinceMs) {
+      const row = db.query(`SELECT MIN(at) AS at
+             FROM request_logs
+            WHERE api_key_id = ? AND state = 'done' AND at >= ?`).get(apiKeyId, sinceMs);
+      return row?.at ?? null;
+    },
     async aggregate(q) {
       const grain = q.grain ?? "raw";
       const daily = grain === "daily";
@@ -19348,8 +20416,7 @@ function createUsageRepo(db) {
       });
     },
     async prune(olderThan) {
-      db.run("DELETE FROM request_logs WHERE at < ?", [olderThan]);
-      return db.query("SELECT changes() AS n").get()?.n ?? 0;
+      return pruneLogs(olderThan);
     },
     async pruneDaily(olderThan) {
       db.run("DELETE FROM usage_daily WHERE day < ?", [olderThan]);
@@ -19361,8 +20428,6 @@ function createUsageRepo(db) {
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
   const logger2 = opts.logger ?? noopLogger;
-  const db = openDb(opts.path);
-  logger2.debug("store opened", { path: opts.path });
   const listeners = new Set;
   const emit2 = (change) => {
     for (const listener of listeners) {
@@ -19371,23 +20436,123 @@ async function createStore(opts) {
       } catch {}
     }
   };
+  const open = () => {
+    const db = openDb(opts.path);
+    logger2.debug("store opened", { path: opts.path });
+    return {
+      db,
+      credentials: createCredentialRepo(db, opts.encryptionKey, emit2),
+      config: createConfigRepo(db, emit2),
+      keys: createKeyRepo(db, logger2),
+      usage: createUsageRepo(db),
+      bodies: createBodyRepo(db, opts.encryptionKey, bodiesDirFor(opts.path)),
+      maintenance: createMaintenanceRepo(db),
+      plugins: createPluginRepo(db)
+    };
+  };
+  let handle = open();
+  let live = true;
+  const closeHandle = () => {
+    if (!live)
+      return;
+    handle.db.close();
+    live = false;
+  };
   return {
-    credentials: createCredentialRepo(db, opts.encryptionKey, emit2),
-    config: createConfigRepo(db, emit2),
-    keys: createKeyRepo(db),
-    usage: createUsageRepo(db),
-    routing: {
-      version: () => db.query("PRAGMA data_version").get()?.data_version ?? 0,
-      subscribe(listener) {
-        listeners.add(listener);
-        return () => listeners.delete(listener);
-      }
+    databasePath: opts.path,
+    credentials: {
+      list: () => handle.credentials.list(),
+      listRouting: () => handle.credentials.listRouting(),
+      get: (id) => handle.credentials.get(id),
+      create: (input) => handle.credentials.create(input),
+      update: (id, patch) => handle.credentials.update(id, patch),
+      updateSecrets: (id, secrets, expiresAt) => handle.credentials.updateSecrets(id, secrets, expiresAt),
+      remove: (id) => handle.credentials.remove(id),
+      listHealth: () => handle.credentials.listHealth(),
+      saveHealth: (rows) => handle.credentials.saveHealth(rows),
+      updateHealth: (id, model, apply) => handle.credentials.updateHealth(id, model, apply),
+      listQuota: () => handle.credentials.listQuota(),
+      saveQuota: (rows) => handle.credentials.saveQuota(rows),
+      listQuotaSamples: (q) => handle.credentials.listQuotaSamples(q),
+      pruneQuotaSamples: (olderThan) => handle.credentials.pruneQuotaSamples(olderThan)
     },
-    close: () => db.close()
-  };
-}
+    config: {
+      listModels: () => handle.config.listModels(),
+      putModel: (model) => handle.config.putModel(model),
+      removeModel: (id) => handle.config.removeModel(id),
+      getSettings: () => handle.config.getSettings(),
+      putSettings: (patch) => handle.config.putSettings(patch),
+      getAdminPasswordHash: () => handle.config.getAdminPasswordHash(),
+      setAdminPasswordHashIfAbsent: (hash3) => handle.config.setAdminPasswordHashIfAbsent(hash3),
+      setAdminPasswordHash: (hash3) => handle.config.setAdminPasswordHash(hash3)
+    },
+    keys: {
+      list: () => handle.keys.list(),
+      findByHash: (hash3) => handle.keys.findByHash(hash3),
+      create: (input) => handle.keys.create(input),
+      setLimits: (id, limits) => handle.keys.setLimits(id, limits),
+      revoke: (id) => handle.keys.revoke(id)
+    },
+    usage: {
+      begin: (log) => handle.usage.begin(log),
+      route: (id, target) => handle.usage.route(id, target),
+      append: (log) => handle.usage.append(log),
+      sweepPending: () => handle.usage.sweepPending(),
+      recent: (limit) => handle.usage.recent(limit),
+      aggregate: (q) => handle.usage.aggregate(q),
+      sumSince: (apiKeyId, sinceMs) => handle.usage.sumSince(apiKeyId, sinceMs),
+      oldestSince: (apiKeyId, sinceMs) => handle.usage.oldestSince(apiKeyId, sinceMs),
+      rebuildRollup: () => handle.usage.rebuildRollup(),
+      auditRollup: () => handle.usage.auditRollup(),
+      prune: (olderThan) => handle.usage.prune(olderThan),
+      pruneDaily: (olderThan) => handle.usage.pruneDaily(olderThan)
+    },
+    bodies: {
+      put: (artifact) => handle.bodies.put(artifact),
+      get: (requestId) => handle.bodies.get(requestId),
+      prune: (olderThan) => handle.bodies.prune(olderThan),
+      pruneToCap: (cap) => handle.bodies.pruneToCap(cap),
+      sweepOrphans: () => handle.bodies.sweepOrphans()
+    },
+    maintenance: {
+      stats: () => handle.maintenance.stats(),
+      vacuum: () => handle.maintenance.vacuum(),
+      snapshotTo: (path) => handle.maintenance.snapshotTo(path),
+      inspect: (path) => handle.maintenance.inspect(path)
+    },
+    plugins: {
+      migrate: (pluginId, migrations) => handle.plugins.migrate(pluginId, migrations),
+      run: (pluginId, sql, params) => handle.plugins.run(pluginId, sql, params),
+      all(pluginId, sql, params) {
+        return handle.plugins.all(pluginId, sql, params);
+      },
+      get(pluginId, sql, params) {
+        return handle.plugins.get(pluginId, sql, params);
+      },
+      transaction(pluginId, fn) {
+        return handle.plugins.transaction(pluginId, fn);
+      },
+      listTables: (pluginId) => handle.plugins.listTables(pluginId),
+      dropAll: (pluginId) => handle.plugins.dropAll(pluginId),
+      orphanTables: (installedIds) => handle.plugins.orphanTables(installedIds)
+    },
+    routing: {
+      version: () => handle.db.query("PRAGMA data_version").get()?.data_version ?? 0,
+      subscribe(listener) {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      }
+    },
+    async reopen() {
+      closeHandle();
+      handle = open();
+      live = true;
+    },
+    close: closeHandle
+  };
+}
 // packages/control/src/quota/burn.ts
-var HOUR_MS = 3600000;
+var HOUR_MS2 = 3600000;
 function windowStartOf(window) {
   if (window.resetsAt === null)
     return null;
@@ -19410,9 +20575,9 @@ function burnFor(window, input) {
   }
   const windowStartsAt = windowStartOf(window);
   const elapsedMs = windowStartsAt === null ? null : window.observedAt - windowStartsAt;
-  const elapsedHours = elapsedMs === null ? null : elapsedMs / HOUR_MS;
+  const elapsedHours = elapsedMs === null ? null : elapsedMs / HOUR_MS2;
   const ratePerHour = elapsedHours === null ? null : elapsedHours <= 0 || window.used === 0 ? 0 : window.used / elapsedHours;
-  const exhaustsAt = window.limit === null || ratePerHour === null || ratePerHour <= 0 ? null : window.observedAt + Math.max(0, window.limit - window.used) / ratePerHour * HOUR_MS;
+  const exhaustsAt = window.limit === null || ratePerHour === null || ratePerHour <= 0 ? null : window.observedAt + Math.max(0, window.limit - window.used) / ratePerHour * HOUR_MS2;
   return {
     credentialId: window.credentialId,
     windowType: window.windowType,
@@ -19592,6 +20757,243 @@ async function patchCredential(deps, id, input) {
 async function removeCredential(store, id) {
   await store.credentials.remove(id);
 }
+// packages/control/src/database.ts
+import { basename, dirname as dirname2, join as join2, resolve } from "path";
+var exclusive = null;
+async function withExclusive(label2, operation) {
+  if (exclusive !== null) {
+    throw new GatewayError("CONFLICT", `${exclusive} is already running on this database`);
+  }
+  exclusive = label2;
+  try {
+    return await operation();
+  } finally {
+    exclusive = null;
+  }
+}
+var SNAPSHOTS_DIRNAME = "snapshots";
+function snapshotsDir(deps) {
+  return join2(dirname2(deps.store.databasePath), SNAPSHOTS_DIRNAME);
+}
+function snapshotName(at, reason) {
+  const stamp = new Date(at).toISOString().replaceAll(":", "-").replaceAll(".", "-");
+  return `db_${stamp}_${reason}.sqlite`;
+}
+var SNAPSHOT_ID = /^db_(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z_([A-Za-z]+)\.sqlite$/;
+function parseSnapshotName(name) {
+  const match = SNAPSHOT_ID.exec(name);
+  if (match === null)
+    return null;
+  const [, date5, hh, mm, ss, ms, reason] = match;
+  const at = Date.parse(`${date5}T${hh}:${mm}:${ss}.${ms}Z`);
+  if (Number.isNaN(at) || reason === undefined)
+    return null;
+  return { at, reason };
+}
+function snapshotPath(deps, id) {
+  const dir = resolve(snapshotsDir(deps));
+  const path = resolve(dir, id);
+  if (parseSnapshotName(id) === null || dirname2(path) !== dir) {
+    throw new GatewayError("BAD_REQUEST", "invalid snapshot id");
+  }
+  const real = deps.fs.realpath(path);
+  if (real !== null && dirname2(real) !== (deps.fs.realpath(dir) ?? dir)) {
+    throw new GatewayError("BAD_REQUEST", "invalid snapshot id");
+  }
+  return path;
+}
+function listSnapshots(deps) {
+  const dir = snapshotsDir(deps);
+  const snapshots = [];
+  for (const name of deps.fs.readdir(dir)) {
+    const parsed = parseSnapshotName(name);
+    if (parsed === null)
+      continue;
+    snapshots.push({
+      id: name,
+      filename: name,
+      createdAt: parsed.at,
+      sizeBytes: deps.fs.stat(join2(dir, name))?.size ?? 0,
+      reason: parsed.reason
+    });
+  }
+  return snapshots.sort((a, b) => b.createdAt - a.createdAt);
+}
+var DAY_MS = 86400000;
+var SNAPSHOT_HEADROOM = 1.1;
+function retentionOf(settings) {
+  return { keepLatest: settings.snapshotKeepLatest, maxAgeDays: settings.snapshotMaxAgeDays };
+}
+function applyRetention(deps, policy, now) {
+  const dir = snapshotsDir(deps);
+  const cutoff = now - policy.maxAgeDays * DAY_MS;
+  const snapshots = listSnapshots(deps);
+  const undo = snapshots.find((snapshot) => snapshot.reason === "preRestore")?.id;
+  let removed = 0;
+  snapshots.forEach((snapshot, index) => {
+    if (index === 0)
+      return;
+    if (snapshot.id === undo)
+      return;
+    if (index < policy.keepLatest && snapshot.createdAt >= cutoff)
+      return;
+    deps.fs.unlink(join2(dir, snapshot.id));
+    removed++;
+  });
+  return removed;
+}
+var STAGING_MAX_AGE_MS = 60 * 60 * 1000;
+async function writeSnapshot(deps, input) {
+  const dir = snapshotsDir(deps);
+  const at = deps.now();
+  const filename = snapshotName(at, input.reason);
+  const path = join2(dir, filename);
+  deps.fs.mkdir(dir);
+  if (deps.fs.stat(path) !== null) {
+    throw new GatewayError("CONFLICT", "a snapshot for this instant already exists");
+  }
+  const free = deps.fs.freeBytes(dir);
+  const needed = Math.ceil((deps.fs.stat(deps.store.databasePath)?.size ?? 0) * SNAPSHOT_HEADROOM);
+  if (free !== null && free < needed) {
+    throw new GatewayError("CONFLICT", "not enough free disk space to write a snapshot");
+  }
+  try {
+    await deps.store.maintenance.snapshotTo(path);
+  } catch (error51) {
+    deps.fs.unlink(path);
+    throw error51;
+  }
+  const info = {
+    id: filename,
+    filename,
+    createdAt: at,
+    sizeBytes: deps.fs.stat(path)?.size ?? 0,
+    reason: input.reason
+  };
+  if (input.force !== true) {
+    applyRetention(deps, retentionOf(await deps.store.config.getSettings()), at);
+  }
+  return info;
+}
+async function createSnapshot(deps, input) {
+  return withExclusive("a snapshot", () => writeSnapshot(deps, input));
+}
+
+class SwapFailedError extends Error {
+  preRestoreSnapshotId;
+  cause;
+  reopened;
+  constructor(preRestoreSnapshotId, cause, reopened) {
+    super("the database swap failed and the database may be incomplete");
+    this.preRestoreSnapshotId = preRestoreSnapshotId;
+    this.cause = cause;
+    this.reopened = reopened;
+    this.name = "SwapFailedError";
+  }
+}
+var NAMED_TABLES = 5;
+function describeTables(tables) {
+  if (tables.length === 0)
+    return "it has no tables at all";
+  const named = tables.slice(0, NAMED_TABLES);
+  const rest = tables.length - named.length;
+  return `it has ${named.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
+}
+async function swapIn(deps, candidate) {
+  const inspection = await deps.store.maintenance.inspect(candidate.path);
+  if (!inspection.ok) {
+    throw new GatewayError("BAD_REQUEST", inspection.quickCheck === "ok" ? `that file is a database, but not one of ours: ${describeTables(inspection.tables)}` : `that file failed its integrity check: ${inspection.quickCheck}`);
+  }
+  const preRestoreSnapshot = await writeSnapshot(deps, { reason: "preRestore", force: true });
+  const adminHashBefore = await deps.store.config.getAdminPasswordHash();
+  const live = deps.store.databasePath;
+  const staged = `${live}.incoming`;
+  try {
+    if (candidate.consume)
+      deps.fs.rename(candidate.path, staged);
+    else
+      deps.fs.copyFile(candidate.path, staged);
+  } catch (error51) {
+    deps.fs.unlink(staged);
+    throw error51;
+  }
+  try {
+    deps.store.close();
+    deps.fs.unlink(`${live}-wal`);
+    deps.fs.unlink(`${live}-shm`);
+    deps.fs.rename(staged, live);
+    await deps.store.reopen();
+  } catch (error51) {
+    let reopened = true;
+    try {
+      await deps.store.reopen();
+    } catch {
+      reopened = false;
+    }
+    throw new SwapFailedError(preRestoreSnapshot.id, error51, reopened);
+  }
+  const adminHashAfter = await deps.store.config.getAdminPasswordHash();
+  try {
+    await deps.store.usage.rebuildRollup();
+  } catch (error51) {
+    (deps.logger ?? noopLogger).warn("usage rollup not rebuilt after the swap; run omni doctor", {
+      reason: error51 instanceof Error ? error51.message : "unknown"
+    });
+  }
+  try {
+    await deps.reapplyPluginSchema?.();
+  } catch (error51) {
+    (deps.logger ?? noopLogger).warn("plugin schema not reapplied after the swap; restart", {
+      reason: error51 instanceof Error ? error51.message : "unknown"
+    });
+  }
+  return {
+    ok: true,
+    counts: inspection.counts,
+    preRestoreSnapshot,
+    adminPasswordChanged: adminHashAfter !== adminHashBefore
+  };
+}
+async function restoreSnapshot(deps, id) {
+  const path = snapshotPath(deps, id);
+  if (deps.fs.stat(path) === null)
+    throw new GatewayError("BAD_REQUEST", "no such snapshot");
+  return withExclusive("a restore", () => swapIn(deps, { path, consume: false }));
+}
+var MAX_IMPORT_BYTES = 2 * 1024 * 1024 * 1024;
+async function vacuum(deps) {
+  return withExclusive("a vacuum", async () => {
+    const before = deps.fs.stat(deps.store.databasePath)?.size ?? 0;
+    const startedAt = deps.now();
+    await deps.store.maintenance.vacuum();
+    const after = deps.fs.stat(deps.store.databasePath)?.size ?? 0;
+    return {
+      reclaimedBytes: Math.max(0, before - after),
+      durationMs: Math.max(0, deps.now() - startedAt)
+    };
+  });
+}
+async function getDatabaseOverview(deps) {
+  const live = deps.store.databasePath;
+  const stats = await deps.store.maintenance.stats();
+  const settings = await deps.store.config.getSettings();
+  const snapshots = listSnapshots(deps);
+  return {
+    stats,
+    fileBytes: deps.fs.stat(live)?.size ?? 0,
+    walBytes: deps.fs.stat(`${live}-wal`)?.size ?? 0,
+    bodiesBytes: deps.fs.dirBytes(bodiesDirFor(live)),
+    logicalBytes: stats.pageSize * stats.pageCount,
+    freePageBytes: stats.pageSize * stats.freelistCount,
+    freeDiskBytes: deps.fs.freeBytes(dirname2(live)),
+    retention: retentionOf(settings),
+    snapshots: {
+      count: snapshots.length,
+      totalBytes: snapshots.reduce((sum, snapshot) => sum + snapshot.sizeBytes, 0),
+      latestAt: snapshots[0]?.createdAt ?? null
+    }
+  };
+}
 // packages/control/src/dryRun.ts
 async function dryRun(deps, modelId, input) {
   const need = parseOrThrow(dryRunSchema, input);
@@ -19636,17 +21038,67 @@ async function dryRun(deps, modelId, input) {
   };
 }
 // packages/control/src/keys.ts
-async function listKeys(store) {
+function configuredWindows(limits) {
+  const needed = new Set;
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window of WINDOWS) {
+      const limit = windows[window];
+      if (limit !== undefined && limit !== null)
+        needed.add(window);
+    }
+  }
+  return [...needed];
+}
+async function readLimitUsage(store, id, limits, now) {
+  if (limits === null)
+    return [];
+  const sums = new Map;
+  for (const window of configuredWindows(limits)) {
+    sums.set(window, await store.usage.sumSince(id, now - WINDOW_MS[window]));
+  }
+  const readings = [];
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    for (const window of WINDOWS) {
+      const limit = windows[window];
+      if (limit === undefined || limit === null)
+        continue;
+      const sum = sums.get(window);
+      const used = sum === undefined ? null : dimension === "requests" ? sum.requests : dimension === "tokens" ? sum.tokens : sum.costUsd;
+      readings.push({ dimension, window, limit, used });
+    }
+  }
+  if (limits.concurrency !== undefined && limits.concurrency !== null) {
+    readings.push({
+      dimension: "concurrency",
+      window: null,
+      limit: limits.concurrency,
+      used: null
+    });
+  }
+  return readings;
+}
+async function toSummary(store, key, now) {
+  return {
+    id: key.id,
+    label: key.label,
+    prefix: key.prefix,
+    modelAllowlist: key.modelAllowlist,
+    limits: key.limits,
+    limitUsage: await readLimitUsage(store, key.id, key.limits, now),
+    bodyLoggingOptOut: key.bodyLoggingOptOut,
+    createdAt: key.createdAt,
+    revokedAt: key.revokedAt
+  };
+}
+async function listKeys(store, now = Date.now()) {
   const keys = await store.keys.list();
-  return keys.map((k) => ({
-    id: k.id,
-    label: k.label,
-    prefix: k.prefix,
-    modelAllowlist: k.modelAllowlist,
-    rateLimitPerMin: k.rateLimitPerMin,
-    createdAt: k.createdAt,
-    revokedAt: k.revokedAt
-  }));
+  return Promise.all(keys.map((key) => toSummary(store, key, now)));
 }
 async function createKey(store, input) {
   const body2 = parseOrThrow(keyCreateSchema, input);
@@ -19657,10 +21109,19 @@ async function createKey(store, input) {
     prefix: raw.slice(0, 12),
     hash: await hashApiKey(raw),
     modelAllowlist: body2.modelAllowlist,
-    rateLimitPerMin: body2.rateLimitPerMin
+    limits: body2.limits,
+    bodyLoggingOptOut: body2.bodyLoggingOptOut
   });
   return { id: created.id, label: created.label, prefix: created.prefix, key: raw };
 }
+async function setKeyLimits(store, id, input, now = Date.now()) {
+  const body2 = parseOrThrow(keyLimitsSchema, input);
+  const key = (await store.keys.list()).find((entry) => entry.id === id);
+  if (key === undefined)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setLimits(id, body2.limits);
+  return toSummary(store, { ...key, limits: body2.limits }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -19779,8 +21240,754 @@ async function putModel(store, id, input) {
     throw stranded;
   await store.config.putModel(model);
 }
-async function removeModel(store, id) {
-  await store.config.removeModel(id);
+async function removeModel(store, id) {
+  await store.config.removeModel(id);
+}
+// packages/control/src/nodeFs.ts
+import {
+  copyFileSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statfsSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { join as join4 } from "path";
+
+// packages/control/src/plugins.ts
+import { Buffer as Buffer2 } from "buffer";
+import { basename as basename2, join as join3, resolve as resolve2, sep as sep2 } from "path";
+
+// packages/plugin-api/src/version.ts
+var PLUGIN_API_VERSION = 1;
+var DASHBOARD_SDK_VERSION = "0.1.0";
+// packages/plugin-api/src/manifest.ts
+var CAPABILITIES = [
+  "storage",
+  "files",
+  "net:outbound",
+  "events:request",
+  "events:limit"
+];
+var ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
+var idSchema = exports_external.string().regex(ID_PATTERN, "id must match /^[a-z][a-z0-9-]{0,31}$/");
+var entrySchema = exports_external.string().min(1).refine((p) => !p.startsWith("/") && !p.split("/").includes(".."), {
+  message: "entry must be a relative path with no '..' segment"
+});
+var originSchema = exports_external.string().refine((value) => {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url2.protocol !== "https:" && url2.protocol !== "http:")
+    return false;
+  if (url2.hostname === "")
+    return false;
+  if (url2.pathname !== "/" || url2.search !== "" || url2.hash !== "")
+    return false;
+  return value === url2.origin || value === `${url2.origin}/`;
+}, { message: "origin must be scheme://host with no path, query or fragment" });
+var navSchema = exports_external.object({
+  label: exports_external.string().min(1).max(32)
+}).strict();
+var manifestSchema = exports_external.object({
+  id: idSchema,
+  name: exports_external.string().min(1).max(64),
+  version: exports_external.string().min(1).max(32),
+  api: exports_external.number().int().nonnegative(),
+  sdk: exports_external.string().min(1).max(32).optional(),
+  server: entrySchema.optional(),
+  ui: entrySchema.optional(),
+  nav: navSchema.optional(),
+  capabilities: exports_external.array(exports_external.enum(CAPABILITIES)).default([]),
+  origins: exports_external.array(originSchema).min(1).optional(),
+  defaults: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
+}).strict().refine((m) => m.server !== undefined || m.ui !== undefined, {
+  message: "manifest must declare a server entry, a ui entry, or both"
+}).refine((m) => m.ui === undefined || m.sdk !== undefined, {
+  message: "a ui entry requires an sdk range"
+}).refine((m) => !m.capabilities.includes("net:outbound") || m.origins !== undefined, {
+  message: "net:outbound requires origins"
+}).refine((m) => m.capabilities.includes("net:outbound") || m.origins === undefined, {
+  message: "origins requires the net:outbound capability"
+});
+function safeParseManifest(input) {
+  const parsed = manifestSchema.safeParse(input);
+  if (parsed.success)
+    return { ok: true, manifest: parsed.data };
+  const first = parsed.error.issues[0];
+  const path = first?.path.join(".") ?? "";
+  const message = first?.message ?? "invalid manifest";
+  return { ok: false, reason: path === "" ? message : `${path}: ${message}` };
+}
+function isApiCompatible(manifest) {
+  return manifest.api === PLUGIN_API_VERSION;
+}
+
+// packages/control/src/plugins.ts
+var PLUGINS_DIRNAME = "plugins";
+function pluginsDir(root) {
+  return join3(root, PLUGINS_DIRNAME);
+}
+var MANIFEST_FILENAME = "omni-plugin.json";
+var MAX_PLUGIN_BYTES = 32 * 1024 * 1024;
+var ID_PATTERN2 = /^[a-z][a-z0-9-]{0,31}$/;
+var NPM_TARBALL_ROOT = "package";
+function readManifest(fs, home) {
+  const raw = fs.readText(join3(home, MANIFEST_FILENAME));
+  if (raw === null) {
+    return { check: "manifest", reason: `no ${MANIFEST_FILENAME}`, fatal: true };
+  }
+  let document;
+  try {
+    document = JSON.parse(raw);
+  } catch (error51) {
+    const detail = error51 instanceof Error ? error51.message : String(error51);
+    return {
+      check: "manifest",
+      reason: `${MANIFEST_FILENAME} is not valid JSON: ${detail}`,
+      fatal: true
+    };
+  }
+  const parsed = safeParseManifest(document);
+  if (!parsed.ok)
+    return { check: "manifest", reason: parsed.reason, fatal: true };
+  return parsed.manifest;
+}
+function checkEntry(fs, home, entry, label2, fatal) {
+  const target = resolve2(home, entry);
+  if (target !== home && !target.startsWith(`${home}${sep2}`)) {
+    return {
+      check: "entry",
+      reason: `${label2} entry resolves outside the plugin directory`,
+      fatal
+    };
+  }
+  if (!fs.isFile(target)) {
+    return { check: "entry", reason: `${label2} entry ${entry} does not exist`, fatal };
+  }
+  return null;
+}
+function verifyPlugin(deps, root, id) {
+  const home = join3(pluginsDir(root), id);
+  if (!ID_PATTERN2.test(id) || !deps.fs.isDirectory(home)) {
+    throw new GatewayError("BAD_REQUEST", `no plugin "${id}" installed under ${pluginsDir(root)}`);
+  }
+  return reportFor(deps, home, id);
+}
+function reportFor(deps, home, id) {
+  const problems = [];
+  const read = readManifest(deps.fs, home);
+  if (!("id" in read)) {
+    problems.push(read);
+    return { id, path: home, manifest: null, problems, loadable: false };
+  }
+  const manifest = read;
+  if (manifest.id !== id) {
+    problems.push({
+      check: "id",
+      reason: `manifest id ${manifest.id} does not match its directory ${id}`,
+      fatal: true
+    });
+  }
+  if (!isApiCompatible(manifest)) {
+    problems.push({
+      check: "api",
+      reason: `plugin api ${manifest.api} is not supported by this host (api ${PLUGIN_API_VERSION})`,
+      fatal: true
+    });
+  }
+  if (manifest.server !== undefined) {
+    const problem = checkEntry(deps.fs, home, manifest.server, "server", true);
+    if (problem !== null)
+      problems.push(problem);
+  }
+  if (manifest.ui !== undefined) {
+    const problem = checkEntry(deps.fs, home, manifest.ui, "ui", false);
+    if (problem !== null)
+      problems.push(problem);
+  }
+  const sdk = sdkProblem(deps, manifest);
+  if (sdk !== null)
+    problems.push(sdk);
+  return {
+    id,
+    path: home,
+    manifest,
+    problems,
+    loadable: !problems.some((problem) => problem.fatal)
+  };
+}
+function sdkProblem(deps, manifest) {
+  if (manifest.ui === undefined || manifest.sdk === undefined)
+    return null;
+  if (deps.sdkVersion === undefined)
+    return null;
+  if (Bun.semver.satisfies(deps.sdkVersion, manifest.sdk))
+    return null;
+  return {
+    check: "sdk",
+    reason: `requires dashboard sdk ${manifest.sdk}, host ships ${deps.sdkVersion}`,
+    fatal: false
+  };
+}
+function listPlugins(deps, root) {
+  const dir = pluginsDir(root);
+  const summaries = [];
+  for (const entry of [...deps.fs.readdir(dir)].sort()) {
+    const home = join3(dir, entry);
+    if (!deps.fs.isDirectory(home))
+      continue;
+    if (!ID_PATTERN2.test(entry)) {
+      summaries.push({
+        id: entry,
+        path: home,
+        manifest: null,
+        problems: [
+          {
+            check: "id",
+            reason: `directory name ${entry} is not a valid plugin id`,
+            fatal: true
+          }
+        ],
+        loadable: false,
+        name: null,
+        version: null,
+        api: null,
+        sdk: null,
+        capabilities: [],
+        origins: []
+      });
+      continue;
+    }
+    const report = reportFor(deps, home, entry);
+    const manifest = report.manifest;
+    summaries.push({
+      ...report,
+      name: manifest?.name ?? null,
+      version: manifest?.version ?? null,
+      api: manifest?.api ?? null,
+      sdk: manifest?.sdk ?? null,
+      capabilities: manifest?.capabilities ?? [],
+      origins: manifest?.origins ?? []
+    });
+  }
+  return summaries;
+}
+var BLOCK = 512;
+var decoder2 = new TextDecoder;
+function fieldText(header, offset, length) {
+  const slice = header.subarray(offset, offset + length);
+  const end = slice.indexOf(0);
+  return decoder2.decode(end === -1 ? slice : slice.subarray(0, end));
+}
+function fieldOctal(header, offset, length) {
+  const text = fieldText(header, offset, length).trim();
+  if (text.length === 0)
+    return 0;
+  const value = Number.parseInt(text, 8);
+  return Number.isSafeInteger(value) && value >= 0 ? value : -1;
+}
+function isSafeArchivePath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\x00"))
+    return false;
+  if (path.includes("\\"))
+    return false;
+  return !path.split("/").includes("..");
+}
+function readTar(bytes) {
+  const files = new Map;
+  let total = 0;
+  let longName = null;
+  let offset = 0;
+  while (offset + BLOCK <= bytes.length) {
+    const header = bytes.subarray(offset, offset + BLOCK);
+    if (header.every((byte) => byte === 0))
+      break;
+    const size = fieldOctal(header, 124, 12);
+    if (size < 0)
+      throw new GatewayError("BAD_REQUEST", "archive has an unreadable entry size");
+    const type = String.fromCharCode(header[156] ?? 0);
+    const name = fieldText(header, 0, 100);
+    const prefix = fieldText(header, 345, 155);
+    offset += BLOCK;
+    total += size;
+    if (total > MAX_PLUGIN_BYTES) {
+      throw new GatewayError("BAD_REQUEST", `archive unpacks to more than ${MAX_PLUGIN_BYTES} bytes`);
+    }
+    if (offset + size > bytes.length) {
+      throw new GatewayError("BAD_REQUEST", `archive is truncated: entry ${name || "(unnamed)"} declares ${size} bytes and the archive ends before them`);
+    }
+    const data = bytes.subarray(offset, offset + size);
+    offset += Math.ceil(size / BLOCK) * BLOCK;
+    if (type === "1" || type === "2") {
+      throw new GatewayError("BAD_REQUEST", `archive contains a link (${name}); plugin packages must be plain files`);
+    }
+    if (type === "L") {
+      longName = decoder2.decode(data).replace(/\0+$/, "");
+      continue;
+    }
+    if (type === "K" || type === "x" || type === "g")
+      continue;
+    if (type !== "0" && type !== "\x00") {
+      longName = null;
+      continue;
+    }
+    const path = longName ?? (prefix.length > 0 ? `${prefix}/${name}` : name);
+    longName = null;
+    if (!isSafeArchivePath(path)) {
+      throw new GatewayError("BAD_REQUEST", `archive contains an unsafe path: ${path}`);
+    }
+    files.set(path, new Uint8Array(data));
+  }
+  return files;
+}
+function gunzipIfNeeded(bytes) {
+  if (bytes[0] !== 31 || bytes[1] !== 139)
+    return bytes;
+  try {
+    return Bun.gunzipSync(new Uint8Array(bytes));
+  } catch (error51) {
+    const detail = error51 instanceof Error ? error51.message : String(error51);
+    throw new GatewayError("BAD_REQUEST", `could not decompress the archive: ${detail}`);
+  }
+}
+function stripRoot(files) {
+  const roots = new Set;
+  for (const path of files.keys()) {
+    const slash = path.indexOf("/");
+    if (slash <= 0)
+      return { files, claimedId: null };
+    roots.add(path.slice(0, slash));
+  }
+  const [only] = [...roots];
+  if (roots.size !== 1 || only === undefined)
+    return { files, claimedId: null };
+  const stripped = new Map;
+  for (const [path, bytes] of files)
+    stripped.set(path.slice(only.length + 1), bytes);
+  return { files: stripped, claimedId: only === NPM_TARBALL_ROOT ? null : only };
+}
+function readTree(fs, dir, prefix = "") {
+  const files = new Map;
+  let total = 0;
+  for (const entry of fs.readdir(dir)) {
+    const path = join3(dir, entry);
+    const relative = prefix.length === 0 ? entry : `${prefix}/${entry}`;
+    if (fs.isDirectory(path)) {
+      for (const [nested, bytes2] of readTree(fs, path, relative))
+        files.set(nested, bytes2);
+      continue;
+    }
+    const bytes = fs.readBytes(path);
+    if (bytes === null)
+      continue;
+    total += bytes.byteLength;
+    if (total > MAX_PLUGIN_BYTES) {
+      throw new GatewayError("BAD_REQUEST", `${dir} holds more than ${MAX_PLUGIN_BYTES} bytes`);
+    }
+    files.set(relative, bytes);
+  }
+  return files;
+}
+var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+var NPM_PACKUMENT_ACCEPT = "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*";
+var NPM_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+var EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)*$/;
+var SRI_ALGORITHMS = ["sha512", "sha384", "sha256"];
+function asRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  return value;
+}
+function asString(value) {
+  return typeof value === "string" ? value : null;
+}
+function parseNpmSpec(spec) {
+  const at = spec.lastIndexOf("@");
+  const name = at <= 0 ? spec : spec.slice(0, at);
+  const version2 = at <= 0 ? null : spec.slice(at + 1);
+  if (name.length > 214 || !NPM_NAME_PATTERN.test(name))
+    return null;
+  return { name, version: version2 };
+}
+function registryUrl(deps) {
+  const raw = deps.registry ?? DEFAULT_NPM_REGISTRY;
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new GatewayError("BAD_REQUEST", `registry ${raw} is not a URL`);
+  }
+  if (url2.protocol !== "https:") {
+    throw new GatewayError("BAD_REQUEST", `plugins may only be installed over https; ${raw} is not`);
+  }
+  return url2;
+}
+function packumentUrl(registry2, name) {
+  return `${registry2.href.replace(/\/+$/, "")}/${name.replace("/", "%2f")}`;
+}
+function resolveDist(document, spec) {
+  const root = asRecord(document);
+  if (root === null) {
+    throw new GatewayError("BAD_REQUEST", `the registry's answer for ${spec.name} is not a package`);
+  }
+  const versions2 = asRecord(root.versions);
+  if (versions2 === null) {
+    throw new GatewayError("BAD_REQUEST", `the registry lists no versions of ${spec.name}`);
+  }
+  let wanted = spec.version;
+  if (wanted === null) {
+    const tags = asRecord(root["dist-tags"]);
+    wanted = tags === null ? null : asString(tags.latest);
+    if (wanted === null) {
+      throw new GatewayError("BAD_REQUEST", `the registry names no dist-tags.latest for ${spec.name}; install ${spec.name}@<exact version>`);
+    }
+  }
+  const entry = asRecord(versions2[wanted]);
+  if (entry === null) {
+    throw new GatewayError("BAD_REQUEST", `the registry has no version ${wanted} of ${spec.name}`);
+  }
+  const dist = asRecord(entry.dist);
+  const tarball = dist === null ? null : asString(dist.tarball);
+  if (dist === null || tarball === null) {
+    throw new GatewayError("BAD_REQUEST", `the registry's entry for ${spec.name}@${wanted} names no tarball`);
+  }
+  return {
+    version: wanted,
+    dist: { tarball, integrity: asString(dist.integrity), shasum: asString(dist.shasum) }
+  };
+}
+function checkTarballUrl(tarball, registry2, what) {
+  let url2;
+  try {
+    url2 = new URL(tarball);
+  } catch {
+    throw new GatewayError("BAD_REQUEST", `the registry gave ${what} a tarball that is not a URL`);
+  }
+  if (url2.protocol !== "https:") {
+    throw new GatewayError("BAD_REQUEST", `plugins may only be installed over https; the registry points ${what} at ${tarball}`);
+  }
+  if (url2.host !== registry2.host) {
+    throw new GatewayError("BAD_REQUEST", `registry ${registry2.host} points ${what} at ${url2.host}; ` + "install that URL directly if it is the one you meant");
+  }
+}
+function digestsFor(dist, what) {
+  const digests = [];
+  if (dist.integrity !== null) {
+    for (const entry of dist.integrity.trim().split(/\s+/)) {
+      const dash = entry.indexOf("-");
+      const algorithm = dash === -1 ? "" : entry.slice(0, dash);
+      const value = dash === -1 ? "" : entry.slice(dash + 1);
+      if (value.length === 0)
+        continue;
+      const known = SRI_ALGORITHMS.find((candidate) => candidate === algorithm);
+      if (known === undefined)
+        continue;
+      digests.push({
+        algorithm: known,
+        expected: Buffer2.from(value, "base64").toString("hex"),
+        source: `${known} integrity`
+      });
+    }
+  }
+  if (digests.length === 0 && dist.shasum !== null && /^[0-9a-f]{40}$/i.test(dist.shasum)) {
+    digests.push({ algorithm: "sha1", expected: dist.shasum.toLowerCase(), source: "sha1 shasum" });
+  }
+  if (digests.length === 0) {
+    throw new GatewayError("BAD_REQUEST", `the registry advertises no usable integrity or shasum for ${what}; ` + "refusing to install bytes nothing vouches for");
+  }
+  return digests;
+}
+function verifyDigests(bytes, digests, what) {
+  for (const digest of digests) {
+    const actual = new Bun.CryptoHasher(digest.algorithm).update(bytes).digest("hex");
+    if (actual === digest.expected)
+      return;
+  }
+  const first = digests[0];
+  throw new GatewayError("BAD_REQUEST", `${what} does not match the ${first?.source ?? "digest"} the registry advertised; ` + "the download was corrupted or the registry served something else");
+}
+async function npmPayload(deps, spec) {
+  if (spec.version !== null && !EXACT_VERSION_PATTERN.test(spec.version)) {
+    throw new GatewayError("BAD_REQUEST", `${spec.name}@${spec.version} is not an exact version; this installer resolves no ranges ` + `or tags \u2014 install ${spec.name}@1.2.3, or ${spec.name} for the registry's latest`);
+  }
+  const fetchBytes = deps.fetchBytes;
+  if (fetchBytes === undefined) {
+    throw new GatewayError("BAD_REQUEST", "this caller cannot install from a registry");
+  }
+  const registry2 = registryUrl(deps);
+  const document = parseJson(await fetchBytes(packumentUrl(registry2, spec.name), NPM_PACKUMENT_ACCEPT), `the registry's answer for ${spec.name}`);
+  const { version: version2, dist } = resolveDist(document, spec);
+  const what = `${spec.name}@${version2}`;
+  checkTarballUrl(dist.tarball, registry2, what);
+  const digests = digestsFor(dist, what);
+  const bytes = await fetchBytes(dist.tarball);
+  verifyDigests(bytes, digests, what);
+  return stripRoot(readTar(gunzipIfNeeded(bytes)));
+}
+function parseJson(bytes, what) {
+  try {
+    return JSON.parse(decoder2.decode(bytes));
+  } catch (error51) {
+    const detail = error51 instanceof Error ? error51.message : String(error51);
+    throw new GatewayError("BAD_REQUEST", `${what} is not valid JSON: ${detail}`);
+  }
+}
+async function loadPayload(deps, spec) {
+  if (spec.startsWith("http://")) {
+    throw new GatewayError("BAD_REQUEST", "plugins may only be installed over https");
+  }
+  if (spec.startsWith("https://")) {
+    if (deps.fetchBytes === undefined) {
+      throw new GatewayError("BAD_REQUEST", "this caller cannot install from a URL");
+    }
+    return stripRoot(readTar(gunzipIfNeeded(await deps.fetchBytes(spec))));
+  }
+  const source = resolve2(spec);
+  if (deps.fs.isDirectory(source)) {
+    const files = readTree(deps.fs, source);
+    const claimed = basename2(source);
+    return { files, claimedId: ID_PATTERN2.test(claimed) ? claimed : null };
+  }
+  const bytes = deps.fs.readBytes(source);
+  if (bytes !== null)
+    return stripRoot(readTar(gunzipIfNeeded(bytes)));
+  const npm = parseNpmSpec(spec);
+  if (npm !== null)
+    return npmPayload(deps, npm);
+  throw new GatewayError("BAD_REQUEST", `no directory or archive at ${source}, and "${spec}" is not a package name`);
+}
+async function installPlugin(deps, root, spec) {
+  const payload = await loadPayload(deps, spec);
+  const raw = payload.files.get(MANIFEST_FILENAME);
+  if (raw === undefined) {
+    throw new GatewayError("BAD_REQUEST", `${spec} has no ${MANIFEST_FILENAME} at its root`);
+  }
+  let document;
+  try {
+    document = JSON.parse(decoder2.decode(raw));
+  } catch (error51) {
+    const detail = error51 instanceof Error ? error51.message : String(error51);
+    throw new GatewayError("BAD_REQUEST", `${MANIFEST_FILENAME} is not valid JSON: ${detail}`);
+  }
+  const parsed = safeParseManifest(document);
+  if (!parsed.ok)
+    throw new GatewayError("BAD_REQUEST", `invalid ${MANIFEST_FILENAME}: ${parsed.reason}`);
+  const manifest = parsed.manifest;
+  const targetId = payload.claimedId ?? manifest.id;
+  if (manifest.id !== targetId) {
+    throw new GatewayError("BAD_REQUEST", `manifest id ${manifest.id} does not match its directory ${targetId}; ` + "rename one of them so the gateway loads what you installed");
+  }
+  const dir = pluginsDir(root);
+  const target = join3(dir, targetId);
+  const replaced = deps.fs.isDirectory(target);
+  const staging = join3(dir, `.staging-${targetId}`);
+  deps.fs.rm(staging);
+  try {
+    for (const [path, bytes] of payload.files) {
+      const destination = join3(staging, path);
+      deps.fs.mkdir(join3(destination, ".."));
+      deps.fs.writeBytes(destination, bytes);
+    }
+    deps.fs.rm(target);
+    deps.fs.rename(staging, target);
+  } finally {
+    deps.fs.rm(staging);
+  }
+  return {
+    id: targetId,
+    name: manifest.name,
+    version: manifest.version,
+    path: target,
+    replaced,
+    restartRequired: true
+  };
+}
+function removePlugin(deps, root, id, options = {}) {
+  if (!ID_PATTERN2.test(id)) {
+    throw new GatewayError("BAD_REQUEST", `"${id}" is not a valid plugin id`);
+  }
+  const target = join3(pluginsDir(root), id);
+  const present = deps.fs.isDirectory(target);
+  const purge = options.purge === true;
+  if (purge && deps.store === undefined) {
+    throw new GatewayError("INTERNAL", "purging a plugin's data needs a database");
+  }
+  const tables = purge && deps.store !== undefined ? deps.store.plugins.listTables(id) : [];
+  if (!present && tables.length === 0) {
+    throw new GatewayError("BAD_REQUEST", `no plugin "${id}" installed under ${pluginsDir(root)}`);
+  }
+  if (present)
+    deps.fs.rm(target);
+  if (purge && deps.store !== undefined)
+    deps.store.plugins.dropAll(id);
+  return { id, removed: present, droppedTables: tables };
+}
+function orphanPluginTables(deps, root, store) {
+  const installed = listPlugins(deps, root).map((plugin) => plugin.id);
+  return store.plugins.orphanTables(installed);
+}
+
+// packages/control/src/nodeFs.ts
+function nodeDatabaseFs() {
+  const dirBytes = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    } catch {
+      return 0;
+    }
+    let total = 0;
+    for (const entry of entries) {
+      const path = join4(dir, entry.name);
+      if (entry.isDirectory()) {
+        total += dirBytes(path);
+        continue;
+      }
+      try {
+        total += statSync(path).size;
+      } catch {}
+    }
+    return total;
+  };
+  return {
+    readdir: (dir) => {
+      try {
+        return readdirSync(dir);
+      } catch {
+        return [];
+      }
+    },
+    stat: (path) => {
+      try {
+        const stat = statSync(path);
+        return { size: stat.size, mtimeMs: stat.mtimeMs };
+      } catch {
+        return null;
+      }
+    },
+    unlink: (path) => {
+      rmSync(path, { force: true });
+    },
+    rename: (from, to) => renameSync(from, to),
+    copyFile: (from, to) => copyFileSync(from, to),
+    mkdir: (dir) => {
+      mkdirSync(dir, { recursive: true });
+    },
+    realpath: (path) => {
+      try {
+        return realpathSync(path);
+      } catch {
+        return null;
+      }
+    },
+    freeBytes: (dir) => {
+      try {
+        const stat = statfsSync(dir);
+        return Number(stat.bavail) * Number(stat.bsize);
+      } catch {
+        return null;
+      }
+    },
+    dirBytes
+  };
+}
+function nodePluginFs() {
+  return {
+    readdir: (dir) => {
+      try {
+        return readdirSync(dir);
+      } catch {
+        return [];
+      }
+    },
+    readText: (path) => {
+      try {
+        return readFileSync(path, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    readBytes: (path) => {
+      try {
+        return new Uint8Array(readFileSync(path));
+      } catch {
+        return null;
+      }
+    },
+    writeBytes: (path, bytes) => {
+      writeFileSync(path, bytes);
+    },
+    isDirectory: (path) => {
+      try {
+        return statSync(path).isDirectory();
+      } catch {
+        return false;
+      }
+    },
+    isFile: (path) => {
+      try {
+        return statSync(path).isFile();
+      } catch {
+        return false;
+      }
+    },
+    mkdir: (dir) => {
+      mkdirSync(dir, { recursive: true });
+    },
+    rm: (path) => {
+      rmSync(path, { force: true, recursive: true });
+    },
+    rename: (from, to) => renameSync(from, to)
+  };
+}
+function nodeFetchBytes(options = {}) {
+  const impl = options.fetchImpl ?? fetch;
+  const maxBytes = options.maxBytes ?? MAX_PLUGIN_BYTES;
+  return async (url2, accept) => {
+    if (!url2.startsWith("https://")) {
+      throw new GatewayError("BAD_REQUEST", `plugins may only be fetched over https; ${url2} is not`);
+    }
+    const response = await impl(url2, {
+      headers: accept === undefined ? {} : { accept },
+      redirect: "follow"
+    });
+    if (!response.ok) {
+      throw new GatewayError("BAD_REQUEST", `${url2} answered ${response.status}`);
+    }
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+      return new Uint8Array(0);
+    const chunks = [];
+    let total = 0;
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (value === undefined)
+        continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new GatewayError("BAD_REQUEST", `${url2} sent more than ${maxBytes} bytes`);
+      }
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
+  };
 }
 // packages/control/src/oauth/pkce.ts
 function randomToken() {
@@ -20692,8 +22899,8 @@ function createRefresher(deps) {
   };
 }
 // packages/control/src/quota/history.ts
-var DAY_MS = 24 * 60 * 60 * 1000;
-var HOUR_MS2 = 3600000;
+var DAY_MS2 = 24 * 60 * 60 * 1000;
+var HOUR_MS3 = 3600000;
 async function gatewayRatesFor(store, windows) {
   const rates = [];
   for (const window of windows) {
@@ -20717,7 +22924,7 @@ async function gatewayRatesFor(store, windows) {
     rates.push({
       credentialId: window.credentialId,
       windowType: window.windowType,
-      gatewayRatePerHour: tokens2 / ((window.observedAt - since) / HOUR_MS2)
+      gatewayRatePerHour: tokens2 / ((window.observedAt - since) / HOUR_MS3)
     });
   }
   return rates;
@@ -20725,7 +22932,7 @@ async function gatewayRatesFor(store, windows) {
 async function quotaHistory(deps, input) {
   const now = deps.now();
   const settings = await deps.store.config.getSettings();
-  const oldest = now - settings.logRetentionDays * DAY_MS;
+  const oldest = now - settings.logRetentionDays * DAY_MS2;
   const since = Math.max(optionalNumber(input.since, oldest), oldest);
   const until = Math.min(optionalNumber(input.until, now), now);
   const raw = input.credentialId?.trim();
@@ -20748,9 +22955,13 @@ async function getSettings(store) {
   return store.config.getSettings();
 }
 async function putSettings(store, input) {
-  const settings = parseOrThrow(settingsSchema, input);
-  await store.config.putSettings(settings);
-  return settings;
+  const { snapshotKeepLatest, snapshotMaxAgeDays, ...rest } = parseOrThrow(settingsSchema, input);
+  const patch = {
+    ...rest,
+    ...snapshotKeepLatest === undefined ? {} : { snapshotKeepLatest },
+    ...snapshotMaxAgeDays === undefined ? {} : { snapshotMaxAgeDays }
+  };
+  return store.config.putSettings(patch);
 }
 // packages/control/src/setup.ts
 var KEY_PLACEHOLDER = "<your OmniGateway key>";
@@ -20863,7 +23074,7 @@ function opencodeConfig(described, input, mapping) {
   return { path: "opencode.json", contents };
 }
 // packages/control/src/tail.ts
-import { closeSync, fstatSync, openSync, readSync, statSync } from "fs";
+import { closeSync, fstatSync, openSync, readSync, statSync as statSync2 } from "fs";
 var CHUNK = 64 * 1024;
 var MAX_BYTES = 8 * 1024 * 1024;
 function tailFile(path, lines) {
@@ -20901,7 +23112,7 @@ function tailFile(path, lines) {
 }
 function fileExists(path) {
   try {
-    return statSync(path).isFile();
+    return statSync2(path).isFile();
   } catch {
     return false;
   }
@@ -20985,9 +23196,9 @@ function requirePositional(parsed, index, name) {
 }
 
 // apps/cli/src/context.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { homedir } from "os";
-import { isAbsolute, join, resolve } from "path";
+import { isAbsolute, join as join5, resolve as resolve3 } from "path";
 class CliError extends Error {
   exitCode;
   constructor(message, exitCode = 1) {
@@ -20996,21 +23207,21 @@ class CliError extends Error {
     this.exitCode = exitCode;
   }
 }
-var DEFAULT_ROOT = join(homedir(), ".config", "omnigateway");
+var DEFAULT_ROOT = join5(homedir(), ".config", "omnigateway");
 function looksLikeRoot(dir) {
-  return existsSync(join(dir, ".env")) || existsSync(join(dir, "omnigateway.db")) || existsSync(join(dir, "apps", "gateway", "src", "index.ts"));
+  return existsSync(join5(dir, ".env")) || existsSync(join5(dir, "omnigateway.db")) || existsSync(join5(dir, "apps", "gateway", "src", "index.ts"));
 }
 function resolveRoot(flags, env2, cwd) {
   const withEnvFile = (root, source) => {
-    const envFile = join(root, ".env");
+    const envFile = join5(root, ".env");
     return { root, source, envFile: existsSync(envFile) ? envFile : null };
   };
   if (flags.root !== undefined && flags.root.length > 0) {
-    return withEnvFile(resolve(cwd, flags.root), "flag");
+    return withEnvFile(resolve3(cwd, flags.root), "flag");
   }
   const fromEnv = env2.OMNI_ROOT;
   if (typeof fromEnv === "string" && fromEnv.length > 0) {
-    return withEnvFile(resolve(cwd, fromEnv), "env");
+    return withEnvFile(resolve3(cwd, fromEnv), "env");
   }
   if (looksLikeRoot(cwd))
     return withEnvFile(cwd, "cwd");
@@ -21041,7 +23252,7 @@ function createContext(parsed, options = {}) {
   const processEnv = options.env ?? process.env;
   const cwd = options.cwd ?? process.cwd();
   const root = resolveRoot({ root: stringFlag(parsed.values, "root") }, processEnv, cwd);
-  const fileEnv = root.envFile === null ? {} : parseEnvFile(readFileSync(root.envFile, "utf8"));
+  const fileEnv = root.envFile === null ? {} : parseEnvFile(readFileSync2(root.envFile, "utf8"));
   const env2 = { ...processEnv, ...fileEnv };
   const rawDbFlag = stringFlag(parsed.values, "db");
   const dbFlag = rawDbFlag === undefined || rawDbFlag.trim().length === 0 ? undefined : rawDbFlag;
@@ -21057,7 +23268,7 @@ function createContext(parsed, options = {}) {
     configError = error51 instanceof Error ? error51.message : "invalid configuration";
   }
   const configuredPath = dbFlag ?? config2?.databasePath ?? "omnigateway.db";
-  const databasePath = isAbsolute(configuredPath) ? configuredPath : resolve(root.root, configuredPath);
+  const databasePath = isAbsolute(configuredPath) ? configuredPath : resolve3(root.root, configuredPath);
   const warnings = suppressedDbPath === null ? [] : [
     `ignoring OMNI_DB_PATH=${suppressedDbPath} from the environment because --root was given; using ${databasePath}`
   ];
@@ -21099,6 +23310,143 @@ function createContext(parsed, options = {}) {
   };
 }
 
+// apps/cli/src/command.ts
+var PROVIDER_TONE = {
+  anthropic: "magenta",
+  openai: "green",
+  kimi: "blue",
+  kilo: "orange",
+  grok: "yellow",
+  custom: "cyan"
+};
+function provider(ctx, id) {
+  return paint(ctx, PROVIDER_TONE[id], id);
+}
+function state(ctx, ok, text) {
+  return paint(ctx, ok ? "green" : "red", text);
+}
+
+// apps/cli/src/commands/bodies.ts
+var ABSENCE = {
+  none: [
+    "not captured",
+    "Body capture was not running for this request. It needs OMNI_BODY_LOGGING_ALLOWED in the environment and bodyLoggingEnabled turned on, and the calling key must not have opted out."
+  ],
+  missing: [
+    "captured, then lost",
+    "This request was captured, but its artifact is no longer on disk. Retention or the row cap has since pruned it, or something removed the file underneath the gateway."
+  ],
+  corrupt: [
+    "captured, but unreadable",
+    "This request was captured and the artifact is still on disk, but it failed its checksum or would not decrypt. Changing OMNI_ENCRYPTION_KEY invalidates every artifact written under the old one."
+  ]
+};
+var encoder3 = new TextEncoder;
+function payloadBytes(value) {
+  if (value === null || value === undefined)
+    return 0;
+  return encoder3.encode(JSON.stringify(value)).length;
+}
+function frame(read) {
+  return fields([
+    ["STATE", read.detailState],
+    ["CAPTURED", formatTime(read.at)],
+    ["SIZE", `${formatBytes(read.sizeBytes)} on disk`],
+    ["TRUNCATED", read.truncated ? "yes" : "no"]
+  ]);
+}
+function pairs(ctx, artifact) {
+  const frames = artifact.attempts.some((attempt) => attempt.streamChunks !== null);
+  const label2 = (text, truncated) => truncated ? `${text} (truncated)` : text;
+  return table([
+    { header: "PAIR" },
+    { header: "PROVIDER" },
+    { header: "REQUEST", align: "right" },
+    { header: "RESPONSE", align: "right" },
+    ...frames ? [{ header: "FRAMES", align: "right" }] : [],
+    { header: "REQUEST IS" }
+  ], [
+    [
+      label2("CLIENT", artifact.client.truncated),
+      "",
+      formatBytes(payloadBytes(artifact.client.request)),
+      formatBytes(payloadBytes(artifact.client.response)),
+      ...frames ? ["\u2014"] : [],
+      "pre-RTK"
+    ],
+    ...artifact.attempts.map((attempt) => [
+      label2(`ATTEMPT ${attempt.attempt}`, attempt.truncated),
+      provider(ctx, attempt.provider),
+      formatBytes(payloadBytes(attempt.request)),
+      formatBytes(payloadBytes(attempt.response)),
+      ...frames ? [attempt.streamChunks === null ? "\u2014" : String(attempt.streamChunks.length)] : [],
+      "post-RTK"
+    ])
+  ]);
+}
+function block(ctx, heading, value) {
+  const body2 = value === null || value === undefined ? "(nothing recorded for this half \u2014 it never happened, or never completed)" : JSON.stringify(value, null, 2);
+  return `${paint(ctx, "dim", heading)}
+${body2}`;
+}
+function full(ctx, artifact) {
+  const sections = [
+    block(ctx, "CLIENT REQUEST (pre-RTK)", artifact.client.request),
+    block(ctx, "CLIENT RESPONSE", artifact.client.response)
+  ];
+  for (const attempt of artifact.attempts) {
+    const name = `ATTEMPT ${attempt.attempt} ${provider(ctx, attempt.provider)}`;
+    sections.push(block(ctx, `${name} REQUEST (post-RTK)`, attempt.request));
+    sections.push(block(ctx, `${name} RESPONSE`, attempt.response));
+    if (attempt.streamChunks !== null) {
+      sections.push(block(ctx, `${name} STREAM FRAMES (${attempt.streamChunks.length})`, attempt.streamChunks));
+    }
+  }
+  if (artifact.error !== null && artifact.error !== undefined) {
+    sections.push(block(ctx, "ERROR", artifact.error));
+  }
+  return sections.join(`
+
+`);
+}
+var bodies = {
+  usage: "bodies <request-id> [--full]",
+  summary: "Show captured bodies for one request; withheld unless --full",
+  options: { full: { type: "boolean" } },
+  async run(args, { ctx, writer }) {
+    const requestId = requirePositional(args, 0, "request id");
+    const read = await readRequestBody(await ctx.store(), requestId);
+    emit(ctx, writer, read, () => {
+      const artifact = read.artifact;
+      if (artifact === null) {
+        const [legend, message] = ABSENCE[read.detailState === "ready" ? "corrupt" : read.detailState];
+        return [frame(read), "", legend, message].join(`
+`);
+      }
+      const lines = [
+        frame(read),
+        "",
+        pairs(ctx, artifact),
+        "",
+        paint(ctx, "dim", "REQUEST and RESPONSE are the stored payload, after masking and bounding; neither is the size sent over the wire")
+      ];
+      if (artifact.attempts.length > 0) {
+        lines.push("", paint(ctx, "dim", "the client request is pre-RTK and every attempt request is post-RTK; they are not the same payload"));
+      }
+      if (artifact.error !== null && artifact.error !== undefined) {
+        lines.push("", "an error was recorded for this request");
+      }
+      if (boolFlag(args.values, "full")) {
+        lines.push("", full(ctx, artifact));
+      } else {
+        lines.push("", "bodies withheld; pass --full to print them, --json for the artifact");
+      }
+      return lines.join(`
+`);
+    });
+  }
+};
+
 // apps/cli/src/commands/connect.ts
 var DEVICE_TIMEOUT_MS = 600000;
 var connect = {
@@ -21146,21 +23494,21 @@ async function pollUntilAuthorized(flows, start, deps) {
 }
 
 // apps/cli/src/service.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 var UNIT_NAME2 = "omnigateway.service";
 function unitPath(scope) {
-  return scope === "system" ? join2("/etc/systemd/system", UNIT_NAME2) : join2(homedir2(), ".config", "systemd", "user", UNIT_NAME2);
+  return scope === "system" ? join6("/etc/systemd/system", UNIT_NAME2) : join6(homedir2(), ".config", "systemd", "user", UNIT_NAME2);
 }
 function systemctlArgs(scope, args) {
   return scope === "system" ? ["systemctl", ...args] : ["systemctl", "--user", ...args];
 }
 function pidFile(stateDir) {
-  return join2(stateDir, "gateway.pid");
+  return join6(stateDir, "gateway.pid");
 }
 function logFile(stateDir) {
-  return join2(stateDir, "gateway.log");
+  return join6(stateDir, "gateway.log");
 }
 function supervisedLogFile(deps) {
   const configured = deps.logFile?.trim();
@@ -21168,8 +23516,8 @@ function supervisedLogFile(deps) {
 }
 function defaultStateDir(env2) {
   const xdg = env2.XDG_STATE_HOME;
-  const base = typeof xdg === "string" && xdg.length > 0 ? xdg : join2(homedir2(), ".local", "state");
-  return join2(base, "omnigateway");
+  const base = typeof xdg === "string" && xdg.length > 0 ? xdg : join6(homedir2(), ".local", "state");
+  return join6(base, "omnigateway");
 }
 function unitFile(input) {
   return `[Unit]
@@ -21180,7 +23528,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 WorkingDirectory=${input.root}
-EnvironmentFile=${join2(input.root, ".env")}
+EnvironmentFile=${join6(input.root, ".env")}
 ExecStart=${input.bun} ${input.entrypoint}
 Restart=on-failure
 RestartSec=2
@@ -21196,7 +23544,7 @@ function readPid(stateDir) {
   const file2 = pidFile(stateDir);
   if (!existsSync2(file2))
     return null;
-  const pid = Number(readFileSync2(file2, "utf8").trim());
+  const pid = Number(readFileSync3(file2, "utf8").trim());
   return Number.isInteger(pid) && pid > 0 ? pid : null;
 }
 function livePid(deps) {
@@ -21205,20 +23553,20 @@ function livePid(deps) {
     return null;
   if (deps.alive(pid))
     return pid;
-  rmSync(pidFile(deps.stateDir), { force: true });
+  rmSync2(pidFile(deps.stateDir), { force: true });
   return null;
 }
 async function status(deps) {
   if (unitInstalled(deps)) {
     const active = await deps.run(systemctlArgs(deps.scope, ["is-active", UNIT_NAME2]));
-    const state = active.stdout.trim() || active.stderr.trim() || "unknown";
+    const state2 = active.stdout.trim() || active.stderr.trim() || "unknown";
     const shown = await deps.run(systemctlArgs(deps.scope, ["show", UNIT_NAME2, "--property=MainPID", "--value"]));
     const pid2 = Number(shown.stdout.trim());
     return {
       supervisor: "systemd",
-      running: state === "active",
+      running: state2 === "active",
       pid: Number.isInteger(pid2) && pid2 > 0 ? pid2 : null,
-      state,
+      state: state2,
       unitPath: deps.unitPath,
       logFile: null
     };
@@ -21253,16 +23601,16 @@ async function start(deps, input) {
       healthy: await waitForHealth(deps, input.baseUrl)
     };
   }
-  mkdirSync(deps.stateDir, { recursive: true });
+  mkdirSync2(deps.stateDir, { recursive: true });
   const file2 = supervisedLogFile(deps);
-  mkdirSync(dirname(file2), { recursive: true });
+  mkdirSync2(dirname3(file2), { recursive: true });
   const pid = deps.spawn({
     argv: input.argv,
     cwd: deps.root,
     env: { ...input.env, OMNI_LOG_FILE: file2 },
     logFile: file2
   });
-  writeFileSync(pidFile(deps.stateDir), `${pid}
+  writeFileSync2(pidFile(deps.stateDir), `${pid}
 `);
   return { supervisor: "pidfile", pid, healthy: await waitForHealth(deps, input.baseUrl) };
 }
@@ -21299,7 +23647,7 @@ async function stop(deps) {
     }
     await deps.sleep(STOP_INTERVAL_MS);
   }
-  rmSync(pidFile(deps.stateDir), { force: true });
+  rmSync2(pidFile(deps.stateDir), { force: true });
   return { supervisor: "pidfile", stopped: true };
 }
 async function install(deps, input) {
@@ -21307,8 +23655,8 @@ async function install(deps, input) {
   if (existsSync2(path) && !input.force) {
     throw new Error(`${path} already exists; pass --force to replace it`);
   }
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, unitFile({ root: deps.root, bun: input.bun, entrypoint: input.entrypoint }));
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, unitFile({ root: deps.root, bun: input.bun, entrypoint: input.entrypoint }));
   const reload = await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
   let enabled = false;
   if (input.enable) {
@@ -21322,7 +23670,7 @@ async function uninstall(deps) {
   if (!existsSync2(path))
     return { path, removed: false };
   await deps.run(systemctlArgs(deps.scope, ["disable", "--now", UNIT_NAME2]));
-  rmSync(path, { force: true });
+  rmSync2(path, { force: true });
   await deps.run(systemctlArgs(deps.scope, ["daemon-reload"]));
   return { path, removed: true };
 }
@@ -21417,22 +23765,6 @@ var console_ = {
   }
 };
 
-// apps/cli/src/command.ts
-var PROVIDER_TONE = {
-  anthropic: "magenta",
-  openai: "green",
-  kimi: "blue",
-  kilo: "orange",
-  grok: "yellow",
-  custom: "cyan"
-};
-function provider(ctx, id) {
-  return paint(ctx, PROVIDER_TONE[id], id);
-}
-function state(ctx, ok, text) {
-  return paint(ctx, ok ? "green" : "red", text);
-}
-
 // apps/cli/src/commands/credentials.ts
 function condition(credential) {
   if (!credential.enabled)
@@ -21658,6 +23990,9 @@ var credentialsHealth = {
 
 // apps/cli/src/commands/db.ts
 import { existsSync as existsSync3 } from "fs";
+async function database(env2) {
+  return { store: await env2.ctx.store(), fs: nodeDatabaseFs(), now: env2.ctx.now };
+}
 var dbMigrate = {
   usage: "db migrate",
   summary: "Create or upgrade the database schema",
@@ -21671,8 +24006,234 @@ var dbMigrate = {
     ]));
   }
 };
+var dbStats = {
+  usage: "db stats",
+  summary: "Show database size, free pages, and what snapshots are held",
+  async run(_args, env2) {
+    const { ctx, writer } = env2;
+    const overview = await getDatabaseOverview(await database(env2));
+    emit(ctx, writer, overview, () => fields([
+      ["database", ctx.databasePath],
+      ["size", formatBytes(overview.fileBytes)],
+      ["write-ahead log", formatBytes(overview.walBytes)],
+      ["captured bodies", `${formatBytes(overview.bodiesBytes)} (never snapshotted)`],
+      ["free pages", `${formatBytes(overview.freePageBytes)} \u2014 reclaimed by omni db vacuum`],
+      ["schema version", String(overview.stats.schemaVersion)],
+      [
+        "snapshots",
+        `${overview.snapshots.count} (${formatBytes(overview.snapshots.totalBytes)}), latest ${formatTime(overview.snapshots.latestAt)}`
+      ],
+      [
+        "retention",
+        `keep ${overview.retention.keepLatest}, up to ${overview.retention.maxAgeDays} days`
+      ],
+      [
+        "free disk",
+        overview.freeDiskBytes === null ? "unknown" : formatBytes(overview.freeDiskBytes)
+      ]
+    ]));
+  }
+};
+var dbSnapshots = {
+  usage: "db snapshots",
+  summary: "List the snapshots held for this installation",
+  async run(_args, env2) {
+    const { ctx, writer } = env2;
+    const deps = await database(env2);
+    const snapshots = listSnapshots(deps);
+    emit(ctx, writer, { snapshots }, () => {
+      if (snapshots.length === 0) {
+        return `no snapshots in ${snapshotsDir(deps)}; take one with omni db backup`;
+      }
+      return table([
+        { header: "ID" },
+        { header: "TAKEN" },
+        { header: "SIZE", align: "right" },
+        { header: "REASON" }
+      ], snapshots.map((snapshot) => [
+        snapshot.id,
+        formatTime(snapshot.createdAt),
+        formatBytes(snapshot.sizeBytes),
+        snapshot.reason
+      ]));
+    });
+  }
+};
+var dbBackup = {
+  usage: "db backup",
+  summary: "Take a snapshot of the database, pruning by the retention policy",
+  async run(_args, env2) {
+    const { ctx, writer } = env2;
+    const snapshot = await createSnapshot(await database(env2), { reason: "manual" });
+    emit(ctx, writer, snapshot, () => {
+      note(ctx, writer, "a snapshot carries encrypted credentials and key hashes; captured bodies are not in it");
+      return fields([
+        ["snapshot", snapshot.id],
+        ["size", formatBytes(snapshot.sizeBytes)],
+        ["taken", formatTime(snapshot.createdAt)]
+      ]);
+    });
+  }
+};
+var dbVacuum = {
+  usage: "db vacuum",
+  summary: "Rewrite the database, reclaiming the pages deletion left free",
+  async run(_args, env2) {
+    const { ctx, writer } = env2;
+    note(ctx, writer, "compacting; the gateway's writes will block until this finishes\u2026");
+    const result = await vacuum(await database(env2));
+    emit(ctx, writer, result, () => fields([
+      ["reclaimed", formatBytes(result.reclaimedBytes)],
+      ["took", `${result.durationMs} ms`]
+    ]));
+  }
+};
+var dbRestore = {
+  usage: "db restore <id>",
+  summary: "Replace the database with a snapshot, keeping a copy of what was there",
+  async run(args, env2) {
+    const { ctx, writer, prompt } = env2;
+    const id = requirePositional(args, 0, "snapshot id");
+    const running = await status(env2.service());
+    if (running.running) {
+      const who = running.pid === null ? running.supervisor : `${running.supervisor}, pid ${running.pid}`;
+      throw new CliError(`a gateway is running (${who}) against this installation; run omni stop first, ` + "or restore from the dashboard, which swaps the file behind its own quiesce latch");
+    }
+    if (!await prompt.confirm(`replace ${ctx.databasePath} with ${id}?`)) {
+      throw new CliError("cancelled");
+    }
+    const result = await restoreSnapshot(await database(env2), id);
+    emit(ctx, writer, result, () => fields([
+      ["restored", id],
+      ["undo", result.preRestoreSnapshot.id],
+      ...Object.entries(result.counts).map(([table2, count]) => [table2, String(count)])
+    ]));
+  }
+};
 
 // apps/cli/src/commands/keys.ts
+var WINDOWED = new Set(["requests", "tokens", "spend"]);
+var PROTO = "__proto__";
+function rejectProto(flag, name) {
+  if (name === PROTO)
+    throw new UsageError(`${flag} cannot name "${PROTO}"`);
+}
+function parseLimitFlags(entries, flag, into = {}) {
+  const limits = into;
+  for (const entry of entries) {
+    const equals = entry.indexOf("=");
+    if (equals <= 0) {
+      throw new UsageError(`${flag} must be dimension:window=value, got "${entry}"`);
+    }
+    const pair = entry.slice(0, equals);
+    const raw = entry.slice(equals + 1);
+    const value = Number(raw);
+    if (raw.trim().length === 0 || !Number.isFinite(value)) {
+      throw new UsageError(`${flag} ${pair} must be a number, got "${raw}"`);
+    }
+    const colon = pair.indexOf(":");
+    if (colon < 0) {
+      if (WINDOWED.has(pair)) {
+        throw new UsageError(`${flag} ${pair} needs a window, e.g. ${flag} ${pair}:1m=60`);
+      }
+      rejectProto(flag, pair);
+      limits[pair] = value;
+      continue;
+    }
+    const dimension = pair.slice(0, colon);
+    const window = pair.slice(colon + 1);
+    if (dimension.length === 0 || window.length === 0) {
+      throw new UsageError(`${flag} must be dimension:window=value, got "${entry}"`);
+    }
+    rejectProto(flag, dimension);
+    rejectProto(flag, window);
+    const existing = limits[dimension];
+    const windows = typeof existing === "object" ? existing : {};
+    windows[window] = value;
+    limits[dimension] = windows;
+  }
+  return limits;
+}
+function toLoose(limits) {
+  const loose = {};
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    const kept = {};
+    for (const [window, value] of Object.entries(windows)) {
+      if (value === null || value === undefined)
+        continue;
+      kept[window] = value;
+    }
+    if (Object.keys(kept).length > 0)
+      loose[dimension] = kept;
+  }
+  if (limits.concurrency !== undefined && limits.concurrency !== null) {
+    loose.concurrency = limits.concurrency;
+  }
+  return loose;
+}
+function applyUnsetFlags(limits, entries) {
+  for (const entry of entries) {
+    if (entry.includes("=")) {
+      throw new UsageError(`--unset names a limit to remove, not a value, got "${entry}"`);
+    }
+    const colon = entry.indexOf(":");
+    if (colon < 0) {
+      if (WINDOWED.has(entry)) {
+        throw new UsageError(`--unset ${entry} needs a window, e.g. --unset ${entry}:1m`);
+      }
+      rejectProto("--unset", entry);
+      if (limits[entry] === undefined)
+        throw new UsageError(`this key has no ${entry} limit`);
+      delete limits[entry];
+      continue;
+    }
+    const dimension = entry.slice(0, colon);
+    const window = entry.slice(colon + 1);
+    if (dimension.length === 0 || window.length === 0) {
+      throw new UsageError(`--unset must be dimension:window, got "${entry}"`);
+    }
+    rejectProto("--unset", dimension);
+    rejectProto("--unset", window);
+    const windows = limits[dimension];
+    if (typeof windows !== "object" || windows[window] === undefined) {
+      throw new UsageError(`this key has no ${entry} limit`);
+    }
+    delete windows[window];
+    if (Object.keys(windows).length === 0)
+      delete limits[dimension];
+  }
+}
+function limitRow(reading) {
+  const money = reading.dimension === "spend";
+  const amount = (value) => money ? formatUsd(value) : String(value);
+  return [
+    reading.dimension,
+    reading.window ?? "\u2014",
+    amount(reading.limit),
+    reading.used === null ? "\u2014" : amount(reading.used),
+    reading.used === null ? "\u2014" : `${Math.round(reading.used / reading.limit * 100)}%`
+  ];
+}
+function summarizeLimits(limits) {
+  const parts = [];
+  for (const dimension of ["requests", "tokens", "spend"]) {
+    const windows = limits[dimension];
+    if (windows === undefined)
+      continue;
+    for (const [window, value] of Object.entries(windows)) {
+      if (value === null || value === undefined)
+        continue;
+      parts.push(`${dimension}:${window}=${value}`);
+    }
+  }
+  if (limits.concurrency !== undefined && limits.concurrency !== null) {
+    parts.push(`concurrency=${limits.concurrency}`);
+  }
+  return parts.length === 0 ? "\u2014" : parts.join(" ");
+}
 var keysList = {
   usage: "keys list",
   summary: "List gateway API keys",
@@ -21686,7 +24247,8 @@ var keysList = {
         { header: "LABEL" },
         { header: "PREFIX" },
         { header: "MODELS" },
-        { header: "RATE/MIN", align: "right" },
+        { header: "LIMITS" },
+        { header: "BODY CAPTURE" },
         { header: "STATE" },
         { header: "CREATED" }
       ], keys.map((key) => [
@@ -21694,7 +24256,8 @@ var keysList = {
         key.label,
         key.prefix,
         key.modelAllowlist === null ? "all" : key.modelAllowlist.length === 0 ? "none" : key.modelAllowlist.join(","),
-        key.rateLimitPerMin === null ? "\u2014" : String(key.rateLimitPerMin),
+        key.limits === null ? paint(ctx, "red", "unreadable") : summarizeLimits(key.limits),
+        key.bodyLoggingOptOut ? "no bodies" : "\u2014",
         state(ctx, key.revokedAt === null, key.revokedAt === null ? "active" : "revoked"),
         formatTime(key.createdAt)
       ]));
@@ -21702,19 +24265,21 @@ var keysList = {
   }
 };
 var keysCreate = {
-  usage: "keys create [--label L] [--allow <model> ...] [--rate-limit N]",
+  usage: "keys create [--label L] [--allow <model> ...] [--limit <d>:<w>=N ...] [--no-bodies]",
   summary: "Mint a gateway API key, printed once",
   options: {
     label: { type: "string" },
     allow: { type: "string", multiple: true },
-    "rate-limit": { type: "string" }
+    limit: { type: "string", multiple: true },
+    "no-bodies": { type: "boolean" }
   },
   async run(args, { ctx, writer }) {
     const allow = listFlag(args.values, "allow");
     const created = await createKey(await ctx.store(), {
       ...stringFlag(args.values, "label") === undefined ? {} : { label: stringFlag(args.values, "label") },
       modelAllowlist: allow ?? null,
-      rateLimitPerMin: numberFlag(args.values, "rate-limit") ?? null
+      limits: parseLimitFlags(listFlag(args.values, "limit") ?? [], "--limit"),
+      bodyLoggingOptOut: boolFlag(args.values, "no-bodies")
     });
     emit(ctx, writer, created, () => {
       note(ctx, writer, paint(ctx, "yellow", "this key is shown once and stored only as a hash"));
@@ -21722,6 +24287,63 @@ var keysCreate = {
     });
   }
 };
+var keysLimits = {
+  usage: "keys limits <id> [--set <d>:<w>=N ...] [--unset <d>:<w> ...]",
+  summary: "Show or edit one key's limits, with what has been used against them",
+  options: {
+    set: { type: "string", multiple: true },
+    unset: { type: "string", multiple: true }
+  },
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "key id");
+    const sets = listFlag(args.values, "set") ?? [];
+    const unsets = listFlag(args.values, "unset") ?? [];
+    const store = await ctx.store();
+    const existing = (await listKeys(store)).find((entry) => entry.id === id);
+    if (existing === undefined)
+      throw new CliError(`no api key "${id}"`);
+    let key = existing;
+    if (sets.length > 0 || unsets.length > 0) {
+      if (existing.limits === null) {
+        if (unsets.length > 0) {
+          throw new CliError(`the stored limits for "${id}" cannot be read, so there is nothing to unset; ` + "replace them with --set instead");
+        }
+        note(ctx, writer, paint(ctx, "yellow", "the stored limits could not be read and are being replaced"));
+      }
+      const next = existing.limits === null ? {} : toLoose(existing.limits);
+      applyUnsetFlags(next, unsets);
+      parseLimitFlags(sets, "--set", next);
+      key = await setKeyLimits(store, id, { limits: next });
+    }
+    emit(ctx, writer, key, () => {
+      const head = fields([
+        ["id", key.id],
+        ["label", key.label],
+        ["prefix", `${key.prefix}\u2026`]
+      ]);
+      if (key.limits === null) {
+        return `${head}
+
+${paint(ctx, "red", "limits unreadable")}: this key is refused at /v1 until they are replaced with --set`;
+      }
+      if (key.limitUsage.length === 0) {
+        return `${head}
+
+no limits configured; this key is unlimited`;
+      }
+      return `${head}
+
+${table([
+        { header: "DIMENSION" },
+        { header: "WINDOW" },
+        { header: "LIMIT", align: "right" },
+        { header: "USED", align: "right" },
+        { header: "USE%", align: "right" }
+      ], key.limitUsage.map(limitRow))}
+${paint(ctx, "dim", "usage is counted from completed requests still inside each window")}`;
+    });
+  }
+};
 var keysRevoke = {
   usage: "keys revoke <id>",
   summary: "Revoke a gateway API key, keeping its usage history",
@@ -21985,6 +24607,168 @@ ${candidates}${excluded}`;
     });
   }
 };
+// packages/plugin-api/src/events.ts
+var WINDOW_MS2 = {
+  "1m": 60000,
+  "5h": 5 * 60 * 60 * 1000,
+  "1w": 7 * 24 * 60 * 60 * 1000
+};
+// apps/cli/src/commands/plugins.ts
+function pluginDeps() {
+  return { fs: nodePluginFs(), sdkVersion: DASHBOARD_SDK_VERSION };
+}
+function installDeps(ctx, args) {
+  const flag = stringFlag(args.values, "registry");
+  const raw = flag ?? ctx.env.OMNI_PLUGIN_REGISTRY;
+  const registry2 = raw === undefined || raw.trim().length === 0 ? undefined : raw.trim();
+  return {
+    ...pluginDeps(),
+    fetchBytes: nodeFetchBytes(),
+    ...registry2 === undefined ? {} : { registry: registry2 }
+  };
+}
+function pluginState(ctx, plugin) {
+  if (!plugin.loadable)
+    return state(ctx, false, "will not load");
+  if (plugin.problems.length > 0)
+    return paint(ctx, "yellow", "loads, with warnings");
+  return state(ctx, true, "ok");
+}
+var pluginList = {
+  usage: "plugin list",
+  summary: "List installed plugins and whether the gateway would load each one",
+  async run(_args, { ctx, writer }) {
+    const root = ctx.root.root;
+    const plugins = listPlugins(pluginDeps(), root);
+    emit(ctx, writer, { pluginsDir: pluginsDir(root), plugins }, () => {
+      if (plugins.length === 0) {
+        return `no plugins installed; unpack one into ${pluginsDir(root)} with: omni plugin install <path-or-package>`;
+      }
+      const rows = plugins.map((plugin) => [
+        plugin.id,
+        plugin.name ?? "\u2014",
+        plugin.version ?? "\u2014",
+        plugin.api === null ? "\u2014" : String(plugin.api),
+        plugin.sdk ?? "\u2014",
+        plugin.capabilities.length === 0 ? "\u2014" : plugin.capabilities.join(","),
+        pluginState(ctx, plugin)
+      ]);
+      const body2 = table([
+        { header: "ID" },
+        { header: "NAME" },
+        { header: "VERSION" },
+        { header: "API" },
+        { header: "SDK" },
+        { header: "CAPABILITIES" },
+        { header: "STATE" }
+      ], rows);
+      const notes = plugins.flatMap((plugin) => plugin.problems.map((problem) => `${plugin.id}: ${paint(ctx, problem.fatal ? "red" : "yellow", problem.reason)}`));
+      return notes.length === 0 ? body2 : `${body2}
+
+${notes.join(`
+`)}`;
+    });
+  }
+};
+var pluginVerify = {
+  usage: "plugin verify <id>",
+  summary: "Run every load-time check on one plugin without loading it",
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "plugin id");
+    const report = verifyPlugin(pluginDeps(), ctx.root.root, id);
+    emit(ctx, writer, report, () => {
+      const manifest = report.manifest;
+      const head = fields([
+        ["id", report.id],
+        ["path", report.path],
+        ["name", manifest?.name ?? "\u2014"],
+        ["version", manifest?.version ?? "\u2014"],
+        ["api", manifest === null ? "\u2014" : String(manifest.api)],
+        ["sdk", manifest?.sdk ?? "\u2014"],
+        ["server", manifest?.server ?? "\u2014"],
+        ["ui", manifest?.ui ?? "\u2014"],
+        [
+          "capabilities",
+          manifest === null || manifest.capabilities.length === 0 ? "\u2014" : manifest.capabilities.join(",")
+        ],
+        ["origins", manifest?.origins?.join(",") ?? "\u2014"]
+      ]);
+      if (report.problems.length === 0) {
+        return `${head}
+
+${state(ctx, true, "ok")}: this plugin would load`;
+      }
+      const lines = report.problems.map((problem) => `  ${paint(ctx, problem.fatal ? "red" : "yellow", problem.check)}  ${problem.reason}`);
+      const verdict = report.loadable ? paint(ctx, "yellow", "this plugin would load, with the warnings above") : state(ctx, false, "this plugin would be skipped at boot");
+      return `${head}
+
+${lines.join(`
+`)}
+
+${verdict}`;
+    });
+    if (!report.loadable)
+      throw new CliError(`plugin "${id}" would not load`);
+  }
+};
+var pluginInstall = {
+  usage: "plugin install <path|tarball|https url|package[@version]> [--registry <url>]",
+  summary: "Unpack a plugin into this installation, running nothing from it",
+  options: { registry: { type: "string" } },
+  async run(args, { ctx, writer }) {
+    const spec = requirePositional(args, 0, "plugin directory, tarball, url, or package name");
+    const result = await installPlugin(installDeps(ctx, args), ctx.root.root, spec);
+    emit(ctx, writer, result, () => {
+      note(ctx, writer, paint(ctx, "dim", "no code from the package was executed; verify it before restarting"));
+      const verb = result.replaced ? "replaced" : "installed";
+      return [
+        `${verb} ${result.name} ${result.version} at ${result.path}`,
+        paint(ctx, "yellow", "restart the gateway for this to take effect: omni restart")
+      ].join(`
+`);
+    });
+  }
+};
+var pluginRemove = {
+  usage: "plugin remove <id> [--purge]",
+  summary: "Remove a plugin, optionally dropping its stored data too",
+  options: { purge: { type: "boolean" } },
+  async run(args, { ctx, writer, prompt }) {
+    const id = requirePositional(args, 0, "plugin id");
+    const purge = boolFlag(args.values, "purge");
+    const question = purge ? `remove plugin "${id}" AND permanently drop its stored data?` : `remove plugin "${id}"? its stored data is kept`;
+    if (!await prompt.confirm(question))
+      throw new CliError("cancelled");
+    const deps = purge ? { fs: nodePluginFs(), store: await ctx.store() } : { fs: nodePluginFs() };
+    const result = removePlugin(deps, ctx.root.root, id, { purge });
+    emit(ctx, writer, result, () => {
+      const lines = [];
+      lines.push(result.removed ? `removed ${id}` : `no directory for ${id} to remove`);
+      if (purge) {
+        lines.push(result.droppedTables.length === 0 ? "no stored tables to drop" : `dropped ${result.droppedTables.length} table(s): ${result.droppedTables.join(", ")}`);
+      } else {
+        lines.push(paint(ctx, "dim", "stored tables and migration history kept; --purge drops them"));
+      }
+      lines.push(paint(ctx, "yellow", "restart the gateway for this to take effect: omni restart"));
+      return lines.join(`
+`);
+    });
+  }
+};
+function doctorPluginDeps() {
+  return pluginDeps();
+}
+function pluginDoctorLines(ctx, plugins) {
+  return plugins.map((plugin) => {
+    const version2 = plugin.version === null ? "" : ` ${plugin.version}`;
+    const api2 = plugin.api === null ? "api ?" : `api ${plugin.api}`;
+    const sdk = plugin.sdk === null ? "no ui" : `sdk ${plugin.sdk}`;
+    const reasons = plugin.problems.filter((problem) => problem.fatal).map((p) => p.reason);
+    const warnings = plugin.problems.length - reasons.length;
+    const verdict = reasons.length > 0 ? state(ctx, false, `will not load: ${reasons.join("; ")}`) : warnings > 0 ? paint(ctx, "yellow", `loads, ${warnings} warning(s); see omni plugin verify ${plugin.id}`) : state(ctx, true, "ok");
+    return `${plugin.id}${version2} (${api2}, ${sdk}) ${verdict}`;
+  });
+}
 
 // apps/cli/src/commands/quota.ts
 var WINDOW_ORDER = {
@@ -22089,7 +24873,7 @@ import { existsSync as existsSync5 } from "fs";
 
 // apps/cli/src/runtime.ts
 import { closeSync as closeSync2, existsSync as existsSync4, openSync as openSync2 } from "fs";
-import { join as join3 } from "path";
+import { join as join7 } from "path";
 var runCommand = async (argv) => {
   const proc = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe" });
   const [stdout, stderr, code] = await Promise.all([
@@ -22146,9 +24930,9 @@ function processAlive(pid) {
 }
 function gatewayEntrypoint(root, cliDir = import.meta.dir) {
   const candidates = [
-    join3(root, "apps", "gateway", "src", "index.ts"),
-    join3(cliDir, "..", "gateway.js"),
-    join3(cliDir, "gateway.js")
+    join7(root, "apps", "gateway", "src", "index.ts"),
+    join7(cliDir, "..", "gateway.js"),
+    join7(cliDir, "gateway.js")
   ];
   return candidates.find((path) => existsSync4(path)) ?? null;
 }
@@ -22275,6 +25059,25 @@ var serviceUninstall = {
     emit(ctx, writer, result, () => result.removed ? `removed ${result.path}` : `no unit at ${result.path}`);
   }
 };
+async function rollupState(ctx) {
+  if (ctx.configError !== null || !existsSync5(ctx.databasePath))
+    return null;
+  try {
+    const audit = await (await ctx.store()).usage.auditRollup();
+    return audit.ok ? `ok (${audit.buckets} hourly buckets)` : `${audit.mismatched} of ${audit.buckets} hourly buckets disagree with request_logs`;
+  } catch {
+    return null;
+  }
+}
+async function orphanTables(ctx) {
+  if (ctx.configError !== null || !existsSync5(ctx.databasePath))
+    return null;
+  try {
+    return orphanPluginTables(doctorPluginDeps(), ctx.root.root, await ctx.store());
+  } catch {
+    return null;
+  }
+}
 var doctor = {
   usage: "doctor",
   summary: "Check what this CLI resolved, and whether it can do anything with it",
@@ -22284,6 +25087,9 @@ var doctor = {
     const key = ctx.env.OMNI_ENCRYPTION_KEY;
     const unit = unitInstalled(deps);
     const status2 = await status(deps);
+    const usageRollup = await rollupState(ctx);
+    const plugins = listPlugins(doctorPluginDeps(), deps.root);
+    const orphans = await orphanTables(ctx);
     const checks3 = {
       root: deps.root,
       rootSource: ctx.root.source,
@@ -22293,10 +25099,14 @@ var doctor = {
       encryptionKey: typeof key === "string" ? `present (${key.length} chars)` : "missing",
       configError: ctx.configError,
       gatewayEntrypoint: gatewayEntrypoint(deps.root),
+      usageRollup,
       unitInstalled: unit,
       supervisor: status2.supervisor,
       running: status2.running,
       consoleSource: consoleSource(deps).source,
+      pluginsDir: pluginsDir(deps.root),
+      plugins,
+      orphanPluginTables: orphans,
       warnings: ctx.warnings
     };
     emit(ctx, writer, checks3, () => {
@@ -22311,9 +25121,18 @@ var doctor = {
         ["encryption key", checks3.encryptionKey],
         ["config", checks3.configError === null ? ok(true, "ok") : ok(false, checks3.configError)],
         ["entrypoint", checks3.gatewayEntrypoint ?? ok(false, "not found")],
+        [
+          "usage rollup",
+          checks3.usageRollup === null ? paint(ctx, "dim", "not checked") : ok(checks3.usageRollup.startsWith("ok"), checks3.usageRollup)
+        ],
         ["systemd unit", unit ? deps.scope : paint(ctx, "dim", "none")],
         ["gateway", ok(status2.running, status2.running ? "running" : "stopped")],
         ["console log", sourceHint(checks3.consoleSource)],
+        ...plugins.length === 0 ? [["plugins", paint(ctx, "dim", "none")]] : pluginDoctorLines(ctx, plugins).map((line, index) => [index === 0 ? "plugins" : "", line]),
+        [
+          "orphan plugin tables",
+          orphans === null ? paint(ctx, "dim", "not checked") : orphans.length === 0 ? ok(true, "none") : paint(ctx, "yellow", `${orphans.length}: ${orphans.join(", ")}`)
+        ],
         ...checks3.warnings.map((warning) => ["ignored", paint(ctx, "yellow", warning)])
       ]);
     });
@@ -22342,31 +25161,59 @@ var settingsGet = {
     emit(ctx, writer, { settings }, () => fields(flatten(settings)));
   }
 };
+function has(value, key) {
+  return Object.hasOwn(value, key);
+}
+function currentValue(settings, head, tail) {
+  if (!has(settings, head))
+    return;
+  const top = settings[head];
+  if (tail === undefined)
+    return top;
+  if (top === null || typeof top !== "object")
+    return;
+  if (!has(top, tail))
+    return;
+  return top[tail];
+}
+function asNumber(path, raw) {
+  const value = raw.trim().length === 0 ? Number.NaN : Number(raw);
+  if (!Number.isFinite(value))
+    throw new UsageError(`${path} must be a number, got "${raw}"`);
+  return value;
+}
+function asBoolean(path, raw) {
+  const value = raw.trim().toLowerCase();
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  throw new UsageError(`${path} must be true or false, got "${raw}"`);
+}
 var settingsSet = {
   usage: "settings set <path> <value>",
-  summary: "Change one setting, e.g. weights.cost 0.4",
+  summary: "Change one setting, e.g. weights.cost 0.4 or rtkEnabled true",
   async run(args, { ctx, writer }) {
     const path = requirePositional(args, 0, "setting path");
     const raw = requirePositional(args, 1, "value");
     const store = await ctx.store();
     const current = await getSettings(store);
-    const value = raw.trim().length === 0 ? Number.NaN : Number(raw);
-    if (!Number.isFinite(value))
-      throw new UsageError(`${path} must be a number, got "${raw}"`);
     const [head, tail] = path.split(".");
-    if (head === undefined || !(head in current))
+    if (head === undefined || !has(current, head))
       throw new UsageError(`no setting "${path}"`);
-    const next = tail === undefined ? { ...current, [head]: value } : { ...current, weights: { ...current.weights, [tail]: value } };
     if (tail !== undefined && head !== "weights") {
       throw new UsageError(`"${head}" has no sub-settings`);
     }
+    const existing = currentValue(current, head, tail);
+    const value = typeof existing === "boolean" ? asBoolean(path, raw) : asNumber(path, raw);
+    const next = tail === undefined ? { ...current, [head]: value } : { ...current, weights: { ...current.weights, [tail]: value } };
     const saved = await putSettings(store, next);
     emit(ctx, writer, { settings: saved }, () => `${path} = ${value}`);
   }
 };
 
 // apps/cli/src/commands/setup.ts
-import { join as join4 } from "path";
+import { join as join8 } from "path";
 var OPTIONS = {
   dir: { type: "string" },
   key: { type: "string" },
@@ -22398,7 +25245,7 @@ ${f.contents}`).join(`
   }
 }
 function at(dir, file2) {
-  return { path: join4(dir, file2.path), contents: file2.contents };
+  return { path: join8(dir, file2.path), contents: file2.contents };
 }
 async function promptMapping(models, prompt) {
   const choices = models.map(({ model }) => model.id).join(", ");
@@ -22432,11 +25279,11 @@ var setupClaude = {
   options: OPTIONS,
   async run(args, { ctx, writer, prompt, setupFs }) {
     const models = await described(ctx);
-    const dir = stringFlag(args.values, "dir") ?? join4(setupFs.homeDir, ".claude");
+    const dir = stringFlag(args.values, "dir") ?? join8(setupFs.homeDir, ".claude");
     const key = stringFlag(args.values, "key");
     const dryRun2 = boolFlag(args.values, "dry-run");
     const mapping = await promptMapping(models, prompt);
-    const path = join4(dir, "settings.json");
+    const path = join8(dir, "settings.json");
     const file2 = claudeSettings(models, {
       baseUrl: baseUrl(ctx),
       discoveryMirrors: ctx.config().exposeClaudeCodeAliases,
@@ -22665,6 +25512,7 @@ var COMMANDS = {
   restart,
   doctor,
   logs,
+  bodies,
   console: console_,
   usage,
   quota,
@@ -22688,13 +25536,23 @@ var COMMANDS = {
   "models catalog": modelsCatalog,
   "keys list": keysList,
   "keys create": keysCreate,
+  "keys limits": keysLimits,
   "keys revoke": keysRevoke,
+  "plugin list": pluginList,
+  "plugin verify": pluginVerify,
+  "plugin install": pluginInstall,
+  "plugin remove": pluginRemove,
   "settings get": settingsGet,
   "settings set": settingsSet,
   "setup claude": setupClaude,
   "setup opencode": setupOpencode,
   "admin set-password": adminSetPassword,
-  "db migrate": dbMigrate
+  "db migrate": dbMigrate,
+  "db stats": dbStats,
+  "db snapshots": dbSnapshots,
+  "db backup": dbBackup,
+  "db restore": dbRestore,
+  "db vacuum": dbVacuum
 };
 var VALUED_GLOBALS = new Set(["--root", "--db"]);
 function resolveCommand(argv) {
@@ -22733,12 +25591,13 @@ function resolveCommand(argv) {
 var GROUPS = [
   {
     title: "Gateway",
-    prefixes: ["status", "start", "stop", "restart", "doctor", "logs", "console"]
+    prefixes: ["status", "start", "stop", "restart", "doctor", "logs", "bodies", "console"]
   },
   { title: "Service", prefixes: ["service "] },
   { title: "Accounts", prefixes: ["connect", "credentials "] },
   { title: "Models", prefixes: ["models "] },
   { title: "Keys", prefixes: ["keys "] },
+  { title: "Plugins", prefixes: ["plugin "] },
   { title: "Configuration", prefixes: ["settings ", "admin ", "db "] },
   { title: "Reports", prefixes: ["usage", "quota"] }
 ];
@@ -22795,10 +25654,10 @@ async function readHidden() {
   stdin.setRawMode?.(true);
   stdin.resume();
   try {
-    const decoder = new TextDecoder;
+    const decoder3 = new TextDecoder;
     let line = "";
     for await (const chunk of stdin) {
-      const text = decoder.decode(chunk, { stream: true });
+      const text = decoder3.decode(chunk, { stream: true });
       for (const char of text) {
         if (char === "\r" || char === `
 `)
@@ -22819,10 +25678,10 @@ async function readHidden() {
   }
 }
 async function readLine() {
-  const decoder = new TextDecoder;
+  const decoder3 = new TextDecoder;
   let line = "";
   for await (const chunk of process.stdin) {
-    const text = decoder.decode(chunk, { stream: true });
+    const text = decoder3.decode(chunk, { stream: true });
     const newline = text.indexOf(`
 `);
     if (newline >= 0)
@@ -22862,10 +25721,10 @@ function createPrompt(ctx, writer) {
 }
 
 // apps/cli/src/setupFs.ts
-import { dirname as dirname2 } from "path";
+import { dirname as dirname4 } from "path";
 function atomicWriteFile(path, contents, ops) {
   const temporary = `${path}.${process.pid}.tmp`;
-  ops.mkdir(dirname2(path));
+  ops.mkdir(dirname4(path));
   try {
     ops.write(temporary, contents);
     ops.rename(temporary, path);
@@ -22918,12 +25777,12 @@ async function run(argv, writer, options = {}) {
     setupFs: options.setupFs ?? {
       homeDir: homedir3(),
       cwd: process.cwd(),
-      read: (path) => existsSync6(path) ? readFileSync3(path, "utf8") : null,
+      read: (path) => existsSync6(path) ? readFileSync4(path, "utf8") : null,
       write: (path, contents) => atomicWriteFile(path, contents, {
-        mkdir: (directory) => mkdirSync2(directory, { recursive: true }),
-        write: (temporary, data) => writeFileSync2(temporary, data),
-        rename: renameSync,
-        remove: (temporary) => rmSync2(temporary, { force: true })
+        mkdir: (directory) => mkdirSync3(directory, { recursive: true }),
+        write: (temporary, data) => writeFileSync3(temporary, data),
+        rename: renameSync2,
+        remove: (temporary) => rmSync3(temporary, { force: true })
       })
     },
     service: () => options.service?.({ root: ctx.root.root, env: ctx.env }) ?? createServiceDeps({ root: ctx.root.root, env: ctx.env, scope, now: ctx.now }),