omnigateway 0.4.13 → 0.5.0

package/gateway.js

@@ -2763,8 +2763,8 @@ function checkBytes(buffer, headers, options) {
   return true;
 }
 function hasUnknownFileSize(tokenizer) {
-  const fileSize = tokenizer.fileInfo.size;
-  return !Number.isFinite(fileSize) || fileSize === Number.MAX_SAFE_INTEGER;
+  const fileSize2 = tokenizer.fileInfo.size;
+  return !Number.isFinite(fileSize2) || fileSize2 === Number.MAX_SAFE_INTEGER;
 }
 function hasExceededUnknownSizeScanBudget(tokenizer, startOffset, maximumBytes) {
   return hasUnknownFileSize(tokenizer) && tokenizer.position - startOffset > maximumBytes;
@@ -2822,8 +2822,8 @@ function mergeByteChunks(chunks, totalLength) {
   return merged;
 }
 function getMaximumZipBufferedReadLength(tokenizer) {
-  const fileSize = tokenizer.fileInfo.size;
-  const remainingBytes = Number.isFinite(fileSize) ? Math.max(0, fileSize - tokenizer.position) : Number.MAX_SAFE_INTEGER;
+  const fileSize2 = tokenizer.fileInfo.size;
+  const remainingBytes = Number.isFinite(fileSize2) ? Math.max(0, fileSize2 - tokenizer.position) : Number.MAX_SAFE_INTEGER;
   return Math.min(remainingBytes, maximumZipBufferedReadSizeInBytes);
 }
 function isRecoverableZipError(error51) {
@@ -3561,11 +3561,11 @@ function normalizeMpegOffsetTolerance(mpegOffsetTolerance) {
   }
   return Math.max(0, Math.min(maximumMpegOffsetTolerance, Math.trunc(mpegOffsetTolerance)));
 }
-function getKnownFileSizeOrMaximum(fileSize) {
-  if (!Number.isFinite(fileSize)) {
+function getKnownFileSizeOrMaximum(fileSize2) {
+  if (!Number.isFinite(fileSize2)) {
     return Number.MAX_SAFE_INTEGER;
   }
-  return Math.max(0, fileSize);
+  return Math.max(0, fileSize2);
 }
 function importAtRuntime(specifier) {
   return import(specifier);
@@ -4804,8 +4804,8 @@ class FileTypeParser {
   };
   detectImprecise = async (tokenizer) => {
     this.buffer = new Uint8Array(reasonableDetectionSizeInBytes);
-    const fileSize = getKnownFileSizeOrMaximum(tokenizer.fileInfo.size);
-    await tokenizer.peekBuffer(this.buffer, { length: Math.min(8, fileSize), mayBeLess: true });
+    const fileSize2 = getKnownFileSizeOrMaximum(tokenizer.fileInfo.size);
+    await tokenizer.peekBuffer(this.buffer, { length: Math.min(8, fileSize2), mayBeLess: true });
     if (this.check([0, 0, 1, 186]) || this.check([0, 0, 1, 179])) {
       return {
         ext: "mpg",
@@ -4830,7 +4830,7 @@ class FileTypeParser {
         mime: "image/x-icon"
       };
     }
-    await tokenizer.peekBuffer(this.buffer, { length: Math.min(2 + this.options.mpegOffsetTolerance, fileSize), mayBeLess: true });
+    await tokenizer.peekBuffer(this.buffer, { length: Math.min(2 + this.options.mpegOffsetTolerance, fileSize2), mayBeLess: true });
     if (this.buffer.length >= 2 + this.options.mpegOffsetTolerance) {
       for (let depth = 0;depth <= this.options.mpegOffsetTolerance; ++depth) {
         const type = this.scanMpeg(depth);
@@ -5760,7 +5760,6 @@ function loadConfig(env) {
   const baseUrl = optionalText(env.OMNI_BASE_URL, derivedBaseUrl).replace(/\/+$/, "") || derivedBaseUrl;
   const staticDir = env.OMNI_STATIC_DIR?.trim();
   const logFile = env.OMNI_LOG_FILE?.trim();
-  const exposeClaudeCodeAliases = TRUTHY.has((env.OMNI_EXPOSE_CLAUDE_CODE_ALIASES ?? "").trim().toLowerCase());
   const bodyLoggingAllowed = TRUTHY.has((env.OMNI_BODY_LOGGING_ALLOWED ?? "").trim().toLowerCase());
   const rawLogLevel = env.OMNI_LOG_LEVEL?.trim();
   const logLevel = parseLogLevel(rawLogLevel);
@@ -5773,7 +5772,6 @@ function loadConfig(env) {
     encryptionKey,
     baseUrl,
     staticDir: staticDir === undefined || staticDir.length === 0 ? null : staticDir,
-    exposeClaudeCodeAliases,
     bodyLoggingAllowed,
     logFile: logFile === undefined || logFile.length === 0 ? null : logFile
   };
@@ -23973,6 +23971,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
     }),
     contextWindow: exports_external.number().int().positive().optional(),
     maxOutputTokens: exports_external.number().int().positive().optional(),
+    credentialId: exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id").optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
@@ -23994,6 +23993,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
     }),
     contextWindow: exports_external.number().int().positive().optional(),
     maxOutputTokens: exports_external.number().int().positive().optional(),
+    credentialId: exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id").optional(),
     capabilities: exports_external.object({
       tools: exports_external.boolean(),
       images: exports_external.boolean(),
@@ -24002,9 +24002,7 @@ var targetSchema = exports_external.discriminatedUnion("provider", [
   }).strict()
 ]);
 var modelSchema = exports_external.object({
-  id: exports_external.string().min(1).refine((value) => !value.toLowerCase().startsWith("claude/"), {
-    message: 'model id must not start with "claude/": that prefix is reserved for discovery mirrors'
-  }),
+  id: exports_external.string().min(1),
   strategy: exports_external.enum(["score", "priority", "roundRobin", "weighted"]),
   isAlias: exports_external.boolean(),
   targets: exports_external.array(targetSchema).min(1, "a virtual model needs at least one target")
@@ -24016,6 +24014,9 @@ var keyCreateSchema = exports_external.object({
   bodyLoggingOptOut: exports_external.boolean().default(false)
 }).strict();
 var keyLimitsSchema = exports_external.object({ limits: limitConfigSchema }).strict();
+var keyModelsSchema = exports_external.object({
+  modelAllowlist: exports_external.array(exports_external.string().min(1)).nullable()
+}).strict();
 var retentionSchema = exports_external.object({
   keepLatest: exports_external.number().int().min(1).max(100),
   maxAgeDays: exports_external.number().int().min(1).max(3650)
@@ -24113,13 +24114,65 @@ async function readSource(deps, source, lines) {
   ]);
   return result.code === 0 ? result.stdout : "";
 }
+function parseConsoleLines(text, query) {
+  const lines = consoleLimit(query.lines);
+  return text.split(`
+`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, query)).slice(-lines);
+}
 async function readConsole(deps, source, query) {
   const limited = { ...query, lines: consoleLimit(query.lines) };
   const text = await readSource(deps, source, scanWidth(limited));
-  const lines = text.split(`
-`).filter((raw) => raw.trim().length > 0).map(parseLine).filter((line) => keep(line, limited)).slice(-limited.lines);
+  const lines = parseConsoleLines(text, limited);
   return source.kind === "file" ? { source: "file", path: source.path, lines } : { source: source.kind, lines };
 }
+// packages/store/src/types.ts
+var WINDOW_DURATION_MS = {
+  fiveHour: 5 * 60 * 60 * 1000,
+  daily: 24 * 60 * 60 * 1000,
+  weekly: 7 * 24 * 60 * 60 * 1000
+};
+function durationFor(windowType, windowMs) {
+  return windowMs !== null && windowMs > 0 ? windowMs : WINDOW_DURATION_MS[windowType];
+}
+var SAME_WINDOW_TOLERANCE_MS = 60000;
+function sameWindow(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return Math.abs(a - b) <= SAME_WINDOW_TOLERANCE_MS;
+}
+var READ_OVER_INPUT = 0.1;
+function cacheReadRate(prices) {
+  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
+}
+function servesTarget(target, account) {
+  if (account.provider !== target.provider)
+    return false;
+  if (target.provider === "custom" && account.providerData.endpointId !== target.endpointId) {
+    return false;
+  }
+  return target.credentialId === undefined || account.id === target.credentialId;
+}
+function resolvePin(target, accounts) {
+  if (target.credentialId === undefined)
+    return;
+  return accounts.find((account) => servesTarget(target, account));
+}
+var DEFAULT_SETTINGS = {
+  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
+  maxAttempts: 3,
+  requestDeadlineMs: 120000,
+  breakerThreshold: 3,
+  breakerCooldownMs: 30000,
+  logRetentionDays: 30,
+  quotaPollIntervalMs: 300000,
+  rtkEnabled: false,
+  autoCacheEnabled: true,
+  bodyLoggingEnabled: false,
+  bodyLoggingCaptureStreamChunks: false,
+  snapshotKeepLatest: 5,
+  snapshotMaxAgeDays: 30
+};
+
 // packages/router/src/snapshot.ts
 var HEALTH_KEY_SEP = "::";
 function healthKey(credentialId, model) {
@@ -24179,12 +24232,11 @@ function eligible(input) {
   const excluded = [];
   for (const target of model.targets) {
     const missing = needNative && !ANTHROPIC_NATIVE_TOOLS[target.provider] ? "anthropicTools" : ["tools", "images", "reasoning"].find((cap) => need[cap] && !target.capabilities[cap]);
+    let pinSeen = false;
     for (const credential of snapshot.credentials) {
-      if (credential.provider !== target.provider)
+      if (!servesTarget(target, credential))
         continue;
-      if (target.provider === "custom" && credential.providerData.endpointId !== target.endpointId) {
-        continue;
-      }
+      pinSeen = target.credentialId !== undefined;
       const drop = (reason) => {
         excluded.push({ credentialId: credential.id, model: target.model, reason });
       };
@@ -24221,45 +24273,17 @@ function eligible(input) {
       }
       pairs.push({ credential, target });
     }
+    if (target.credentialId !== undefined && !pinSeen) {
+      excluded.push({
+        credentialId: target.credentialId,
+        model: target.model,
+        reason: "pin:missing"
+      });
+    }
   }
   return { pairs, excluded };
 }
 
-// packages/store/src/types.ts
-var WINDOW_DURATION_MS = {
-  fiveHour: 5 * 60 * 60 * 1000,
-  daily: 24 * 60 * 60 * 1000,
-  weekly: 7 * 24 * 60 * 60 * 1000
-};
-function durationFor(windowType, windowMs) {
-  return windowMs !== null && windowMs > 0 ? windowMs : WINDOW_DURATION_MS[windowType];
-}
-var SAME_WINDOW_TOLERANCE_MS = 60000;
-function sameWindow(a, b) {
-  if (a === null || b === null)
-    return a === b;
-  return Math.abs(a - b) <= SAME_WINDOW_TOLERANCE_MS;
-}
-var READ_OVER_INPUT = 0.1;
-function cacheReadRate(prices) {
-  return prices.cacheRead ?? prices.input * READ_OVER_INPUT;
-}
-var DEFAULT_SETTINGS = {
-  weights: { tier: 10, health: 3, quota: 2, load: 2, cost: 1, latency: 1 },
-  maxAttempts: 3,
-  requestDeadlineMs: 120000,
-  breakerThreshold: 3,
-  breakerCooldownMs: 30000,
-  logRetentionDays: 30,
-  quotaPollIntervalMs: 300000,
-  rtkEnabled: false,
-  autoCacheEnabled: true,
-  bodyLoggingEnabled: false,
-  bodyLoggingCaptureStreamChunks: false,
-  snapshotKeepLatest: 5,
-  snapshotMaxAgeDays: 30
-};
-
 // packages/router/src/quota.ts
 var UNKNOWN_QUOTA = 0.5;
 var QUOTA_FLOOR = 0.1;
@@ -26055,6 +26079,12 @@ function createKeyRepo(db, logger2 = noopLogger) {
         id
       ]);
     },
+    async setModelAllowlist(id, modelAllowlist) {
+      db.run("UPDATE api_keys SET model_allowlist = ? WHERE id = ?", [
+        modelAllowlist === null ? null : JSON.stringify(modelAllowlist),
+        id
+      ]);
+    },
     async revoke(id) {
       db.run("UPDATE api_keys SET revoked_at = ? WHERE id = ?", [Date.now(), id]);
     }
@@ -26683,6 +26713,7 @@ async function createStore(opts) {
       findByHash: (hash3) => handle.keys.findByHash(hash3),
       create: (input) => handle.keys.create(input),
       setLimits: (id, limits) => handle.keys.setLimits(id, limits),
+      setModelAllowlist: (id, modelAllowlist) => handle.keys.setModelAllowlist(id, modelAllowlist),
       revoke: (id) => handle.keys.revoke(id)
     },
     usage: {
@@ -27352,6 +27383,14 @@ async function setKeyLimits(store, id, input, now = Date.now()) {
   await store.keys.setLimits(id, body2.limits);
   return toSummary(store, { ...key, limits: body2.limits }, now);
 }
+async function setKeyModels(store, id, input, now = Date.now()) {
+  const body2 = parseOrThrow(keyModelsSchema, input);
+  const key = (await store.keys.list()).find((entry) => entry.id === id);
+  if (key === undefined)
+    throw new GatewayError("BAD_REQUEST", "no such api key");
+  await store.keys.setModelAllowlist(id, body2.modelAllowlist);
+  return toSummary(store, { ...key, modelAllowlist: body2.modelAllowlist }, now);
+}
 async function revokeKey(store, id) {
   await store.keys.revoke(id);
 }
@@ -27412,8 +27451,8 @@ function narrower(a, b) {
     ...output.length === 0 ? {} : { maxOutputTokens: Math.min(...output) }
   };
 }
-function targetLimits(target, auths) {
-  const ways = auths.size === 0 ? ["apiKey"] : [...auths];
+function targetLimits(target, auths, pinned) {
+  const ways = pinned !== undefined ? [pinned.authType] : auths.size === 0 ? ["apiKey"] : [...auths];
   let listed = {};
   for (const auth of ways) {
     const entry = catalogLimits(target.provider, target.model, auth);
@@ -27433,20 +27472,22 @@ function targetLimits(target, auths) {
 }
 function servingAuths(credentials) {
   const byProvider = new Map;
+  const routable = [];
   for (const credential of credentials) {
     if (!credential.enabled)
       continue;
     const ways = byProvider.get(credential.provider) ?? new Set;
     ways.add(credential.authType);
     byProvider.set(credential.provider, ways);
+    routable.push(credential);
   }
-  return byProvider;
+  return { byProvider, routable };
 }
 function resolveModelLimits(model, credentials) {
-  const auths = servingAuths(credentials);
+  const { byProvider, routable } = servingAuths(credentials);
   let limits = {};
   for (const target of model.targets) {
-    limits = narrower(limits, targetLimits(target, auths.get(target.provider) ?? new Set));
+    limits = narrower(limits, targetLimits(target, byProvider.get(target.provider) ?? new Set, resolvePin(target, routable)));
   }
   return limits;
 }
@@ -27484,15 +27525,18 @@ function unreachable(model, credentials, stored) {
   const held = heldAuths(credentials);
   const grandfathered = new Set((stored?.targets ?? []).map(pairOf));
   for (const target of model.targets) {
-    if (grandfathered.has(pairOf(target)))
+    const pinned = resolvePin(target, credentials);
+    if (pinned === undefined && grandfathered.has(pairOf(target)))
       continue;
-    const have = held.get(target.provider);
+    const have = pinned === undefined ? held.get(target.provider) : new Set([pinned.authType]);
     if (have === undefined)
       continue;
     const reach = catalogModelAuths(target.provider, target.model);
     if (reach.some((auth) => have.has(auth)))
       continue;
-    return new GatewayError("BAD_REQUEST", `${target.provider} serves "${target.model}" to ${phrase(reach)} credentials only, ` + `and every ${target.provider} credential here is ${phrase([...have])} \u2014 ` + `connect the other kind, or pick a model this one can reach`);
+    const holds = pinned === undefined ? `every ${target.provider} credential here is ${phrase([...have])}` : `this target is pinned to "${pinned.label}", which is ${phrase([...have])}`;
+    const fix = pinned === undefined ? "connect the other kind, or pick a model this one can reach" : "pin it to the other kind, or pick a model this account can reach";
+    return new GatewayError("BAD_REQUEST", `${target.provider} serves "${target.model}" to ${phrase(reach)} credentials only, ` + `and ${holds} \u2014 ${fix}`);
   }
   return null;
 }
@@ -27532,14 +27576,15 @@ import { join as join3 } from "path";
 
 // packages/plugin-api/src/version.ts
 var PLUGIN_API_VERSION = 1;
-var DASHBOARD_SDK_VERSION = "0.1.1";
+var DASHBOARD_SDK_VERSION = "0.1.2";
 // packages/plugin-api/src/manifest.ts
 var CAPABILITIES = [
   "storage",
   "files",
   "net:outbound",
   "events:request",
-  "events:limit"
+  "events:limit",
+  "channels"
 ];
 var ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
 var idSchema = exports_external.string().regex(ID_PATTERN, "id must match /^[a-z][a-z0-9-]{0,31}$/");
@@ -28713,9 +28758,11 @@ var KEY_PLACEHOLDER = "<your OmniGateway key>";
 async function describeModelsForSetup(store) {
   const models = await listModels(store);
   const credentials = (await listCredentials(store)).map((credential) => ({
+    id: credential.id,
     provider: credential.provider,
     authType: credential.authType,
-    enabled: credential.enabled
+    enabled: credential.enabled,
+    providerData: credential.providerData
   }));
   return models.map((model) => ({
     model,
@@ -28751,8 +28798,7 @@ function claudeSettings(described, input, mapping, existing) {
   const visibleId = (slot, id) => {
     if (!ids.has(id))
       throw new Error(`${slot} names unknown virtual model "${id}"`);
-    const useMirror = input.discoveryMirrors === true && !/^(?:claude|anthropic)/i.test(id);
-    return useMirror ? `claude/${id}` : id;
+    return id;
   };
   const settings = settingsObject(existing);
   const currentEnv = settings.env;
@@ -28861,6 +28907,43 @@ function tailFile(path, lines) {
     closeSync(fd);
   }
 }
+function fileSize(path) {
+  try {
+    const stat = statSync2(path);
+    return stat.isFile() ? stat.size : null;
+  } catch {
+    return null;
+  }
+}
+function readFrom(path, offset) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fstatSync(fd).size;
+    const shrank = size < offset;
+    const from = shrank ? 0 : offset;
+    const available = size - from;
+    if (available <= 0)
+      return { text: "", offset: size, gap: shrank };
+    const span = Math.min(available, MAX_BYTES);
+    const start = from + (available - span);
+    const buffer = Buffer.allocUnsafe(span);
+    const read = readSync(fd, buffer, 0, span, start);
+    return {
+      text: buffer.subarray(0, read).toString("utf8"),
+      offset: start + read,
+      gap: shrank || span < available
+    };
+  } catch {
+    return null;
+  } finally {
+    closeSync(fd);
+  }
+}
 // packages/control/src/usage.ts
 var MAX_LOG_LIMIT = 500;
 var DEFAULT_LOG_LIMIT = 100;
@@ -44472,6 +44555,7 @@ function createQuiesceLatch() {
 // apps/gateway/src/routes/admin.ts
 function adminRoutes(deps) {
   const logger2 = deps.logger ?? noopLogger;
+  const changed = (topic) => deps.broadcaster?.invalidate(topic);
   return new Elysia().onError(apiErrorHandler).get("/api/status", async ({ request: request2 }) => {
     const token = readCookie(request2, ADMIN_COOKIE);
     return {
@@ -44531,9 +44615,9 @@ function adminRoutes(deps) {
     const body2 = await readJsonRecord(request2);
     if (body2 === null)
       throw new GatewayError("BAD_REQUEST", "credential body is required");
-    return {
-      credential: await createApiKeyCredential(deps.store, { provider: body2.provider, apiKey: body2.apiKey, ...body2 }, logger2)
-    };
+    const credential = await createApiKeyCredential(deps.store, { provider: body2.provider, apiKey: body2.apiKey, ...body2 }, logger2);
+    changed("res:credentials");
+    return { credential };
   }).get("/api/credentials/health", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     return credentialHealth(deps);
@@ -44547,10 +44631,12 @@ function adminRoutes(deps) {
   }).patch("/api/credentials/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await patchCredential(deps, params.id, await readJson(request2));
+    changed("res:credentials");
     return { ok: true };
   }).delete("/api/credentials/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await removeCredential(deps.store, params.id);
+    changed("res:credentials");
     return { ok: true };
   }).get("/api/models", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
@@ -44558,10 +44644,12 @@ function adminRoutes(deps) {
   }).put("/api/models/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await putModel(deps.store, params.id, await readJson(request2));
+    changed("res:models");
     return { ok: true };
   }).delete("/api/models/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await removeModel(deps.store, params.id);
+    changed("res:models");
     return { ok: true };
   }).get("/api/agent-setup", async ({ request: request2, query }) => {
     await requireAdmin(request2, deps.admin);
@@ -44573,10 +44661,7 @@ function adminRoutes(deps) {
     try {
       return {
         client,
-        files: await setupFiles(deps.store, client, {
-          baseUrl: deps.baseUrl,
-          discoveryMirrors: deps.discoveryMirrors === true
-        }, {
+        files: await setupFiles(deps.store, client, { baseUrl: deps.baseUrl }, {
           defaultModel,
           ...query.fableModel ? { fableModel: query.fableModel } : {},
           ...query.opusModel ? { opusModel: query.opusModel } : {},
@@ -44592,13 +44677,23 @@ function adminRoutes(deps) {
     return { keys: await listKeys(deps.store) };
   }).post("/api/keys", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
-    return createKey(deps.store, await readJson(request2));
+    const created = await createKey(deps.store, await readJson(request2));
+    changed("res:keys");
+    return created;
   }).put("/api/keys/:id/limits", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
-    return setKeyLimits(deps.store, params.id, await readJson(request2));
+    const key = await setKeyLimits(deps.store, params.id, await readJson(request2));
+    changed("res:keys");
+    return key;
+  }).put("/api/keys/:id/models", async ({ request: request2, params }) => {
+    await requireAdmin(request2, deps.admin);
+    const key = await setKeyModels(deps.store, params.id, await readJson(request2));
+    changed("res:keys");
+    return key;
   }).delete("/api/keys/:id", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
     await revokeKey(deps.store, params.id);
+    changed("res:keys");
     return { ok: true };
   }).get("/api/settings", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
@@ -44609,6 +44704,7 @@ function adminRoutes(deps) {
   }).put("/api/settings", async ({ request: request2 }) => {
     await requireAdmin(request2, deps.admin);
     await putSettings(deps.store, await readJson(request2));
+    changed("res:settings");
     return { ok: true };
   }).post("/api/models/:id/dry-run", async ({ request: request2, params }) => {
     await requireAdmin(request2, deps.admin);
@@ -44693,6 +44789,7 @@ async function swap(deps, logger2, label2, operation) {
         reason: label2
       });
     }
+    deps.broadcaster?.invalidateAll();
     return result;
   } catch (error51) {
     if (error51 instanceof SwapFailedError) {
@@ -46857,24 +46954,44 @@ function report(logger2, what, requestId, error51) {
     reason: describeError(error51, "unknown")
   });
 }
-async function beginLog(store, log, keyId, logger2 = noopLogger) {
+async function beginLog(store, log, keyId, logger2 = noopLogger, broadcast) {
+  let began = false;
   try {
     await store.usage.begin({ ...log, state: "pending", apiKeyId: keyId });
+    began = true;
   } catch (error51) {
     report(logger2, "failed to record request start", log.id, error51);
   }
+  if (began && broadcast !== undefined) {
+    try {
+      broadcast.invalidate("res:logs");
+    } catch (error51) {
+      report(logger2, "failed to publish a resource invalidation", log.id, error51);
+    }
+  }
 }
-async function routeLog(store, requestId, target, logger2 = noopLogger) {
+async function routeLog(store, requestId, target, logger2 = noopLogger, broadcast) {
+  let routed = false;
   try {
     await store.usage.route(requestId, target);
+    routed = true;
   } catch (error51) {
     report(logger2, "failed to record request route", requestId, error51);
   }
+  if (routed && broadcast !== undefined) {
+    try {
+      broadcast.invalidate("res:logs");
+    } catch (error51) {
+      report(logger2, "failed to publish a resource invalidation", requestId, error51);
+    }
+  }
 }
-async function finishLog(store, log, keyId, logger2 = noopLogger, bodies, debit, emit) {
+async function finishLog(store, log, keyId, logger2 = noopLogger, bodies, debit, emit, broadcast) {
+  let appended = true;
   try {
     await store.usage.append({ ...log, apiKeyId: keyId });
   } catch (error51) {
+    appended = false;
     report(logger2, "failed to persist request log", log.id, error51);
   }
   if (keyId !== null && debit !== undefined) {
@@ -46905,6 +47022,14 @@ async function finishLog(store, log, keyId, logger2 = noopLogger, bodies, debit,
       report(logger2, "failed to emit plugin event", log.id, error51);
     }
   }
+  if (appended && broadcast !== undefined) {
+    try {
+      broadcast.invalidate("res:usage");
+      broadcast.invalidate("res:logs");
+    } catch (error51) {
+      report(logger2, "failed to publish a resource invalidation", log.id, error51);
+    }
+  }
   if (bodies === undefined)
     return;
   try {
@@ -47631,7 +47756,6 @@ function mcpServerNames(body2) {
 }
 
 // apps/gateway/src/ingress/model.ts
-var DISCOVERY_PREFIX = "claude/";
 var ONE_M_SUFFIX2 = "[1m]";
 function normalizeClientModel(raw, betas2 = []) {
   let model = raw.trim();
@@ -47643,11 +47767,6 @@ function normalizeClientModel(raw, betas2 = []) {
       wantsOneM = true;
     }
   }
-  if (model.toLowerCase().startsWith(DISCOVERY_PREFIX)) {
-    const stripped = model.slice(DISCOVERY_PREFIX.length);
-    if (stripped.length > 0)
-      model = stripped;
-  }
   const merged = [...betas2];
   if (wantsOneM && !merged.includes(CONTEXT_1M_BETA))
     merged.push(CONTEXT_1M_BETA);
@@ -48294,29 +48413,8 @@ function describeModel(model, credentials) {
     ...limits.maxOutputTokens === undefined ? {} : { max_tokens: limits.maxOutputTokens }
   };
 }
-var ALREADY_CLAUDE = /^(?:claude|anthropic)/i;
-var MIRROR_PREFIX = "claude/";
-function discoveryMirrors(data) {
-  const taken = new Set(data.map((entry) => entry.id));
-  const mirrors = [];
-  for (const entry of data) {
-    if (ALREADY_CLAUDE.test(entry.id))
-      continue;
-    const id = `${MIRROR_PREFIX}${entry.id}`;
-    if (taken.has(id))
-      continue;
-    mirrors.push({
-      ...entry,
-      id,
-      root: entry.id,
-      display_name: `${entry.display_name} (OmniGateway)`
-    });
-  }
-  return mirrors;
-}
-function modelListBody(models, credentials, options = {}) {
-  const described = models.map((model) => describeModel(model, credentials));
-  const data = options.discoveryMirrors === true ? [...described, ...discoveryMirrors(described)] : described;
+function modelListBody(models, credentials) {
+  const data = models.map((model) => describeModel(model, credentials));
   return {
     object: "list",
     data,
@@ -48516,7 +48614,7 @@ async function handle(deps, rateLimiter, surface, request2) {
       ...captured === null ? {} : { http: captured.wrap(deps.http) },
       async onRoute(target) {
         if (began) {
-          await routeLog(deps.store, requestId, target, deps.logger);
+          await routeLog(deps.store, requestId, target, deps.logger, deps.broadcaster);
           return;
         }
         began = true;
@@ -48528,7 +48626,7 @@ async function handle(deps, rateLimiter, surface, request2) {
           resolvedModel: target.model,
           credentialId: target.credentialId
         });
-        await beginLog(deps.store, log2, keyId, deps.logger);
+        await beginLog(deps.store, log2, keyId, deps.logger, deps.broadcaster);
       }
     }, request2.signal, requestId);
     outcome = dispatched;
@@ -48551,7 +48649,7 @@ async function handle(deps, rateLimiter, surface, request2) {
         reportRejection(deps.logger, requestId, completed, gatewayError, surface);
       }
       logged = true;
-      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit, deps.emit);
+      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit, deps.emit, deps.broadcaster);
     };
     if (chatRequest.stream) {
       const frames = surface === "anthropic" ? anthropicStream(dispatched.events, requestId) : openaiStream(dispatched.events, requestId, Math.floor(deps.now() / 1000));
@@ -48592,7 +48690,7 @@ async function handle(deps, rateLimiter, surface, request2) {
     if (collector !== null && !logged)
       collector.client.response = rejection;
     if (!logged)
-      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit, deps.emit);
+      await finishLog(deps.store, completed, keyId, deps.logger, writeBodies, debit, deps.emit, deps.broadcaster);
     if (!cancelled)
       reportRejection(deps.logger, requestId, completed, gatewayError, surface);
     return jsonResponse(rejection, HTTP_STATUS[gatewayError.code], {
@@ -48626,9 +48724,7 @@ function proxyRoutes(deps) {
       const snapshot = await dispatchDeps.snapshots.get(deps.now());
       const models = [...snapshot.models.values()];
       const visibleModels = key.modelAllowlist === null ? models : models.filter((model) => key.modelAllowlist?.includes(model.id));
-      return Response.json(modelListBody(visibleModels, snapshot.credentials, {
-        discoveryMirrors: deps.discoveryMirrors === true
-      }));
+      return Response.json(modelListBody(visibleModels, snapshot.credentials));
     } catch (error51) {
       const gatewayError = asGatewayError(error51);
       logger2.error("model listing failed", {
@@ -48668,6 +48764,684 @@ function proxyRoutes(deps) {
   });
 }
 
+// apps/gateway/src/stream/broadcaster.ts
+var INVALIDATION_FLOORS = {
+  "res:usage": 1000,
+  "res:logs": 1000,
+  "res:quota": 5000,
+  "res:credentials": 5000
+};
+var DEFAULT_FLOOR_MS = 1000;
+var GLOBAL_INVALIDATE = "res:*";
+function createBroadcaster(deps) {
+  const streams = new Set;
+  return {
+    invalidate(topic, keys) {
+      deps.coalescer.emit(topic, keys === undefined ? undefined : { keys });
+    },
+    invalidateAll() {
+      deps.registry.publish(GLOBAL_INVALIDATE, {
+        type: "event",
+        topic: GLOBAL_INVALIDATE
+      });
+    },
+    declareStream(topic) {
+      streams.add(topic);
+    },
+    declared(topic) {
+      return streams.has(topic);
+    },
+    stream(topic, payload) {
+      const seq = deps.ring.push(topic, payload);
+      deps.registry.publish(topic, { type: "event", topic, seq, payload });
+    },
+    resetStream(topic) {
+      deps.ring.reset(topic);
+    },
+    stop() {
+      deps.coalescer.stop();
+    }
+  };
+}
+
+// apps/gateway/src/stream/protocol.ts
+function topicClass(topic) {
+  if (topic.startsWith("res:") && topic.length > 4)
+    return "res";
+  if (topic.startsWith("stream:") && topic.length > 7)
+    return "stream";
+  if (topic.startsWith("plugin:")) {
+    const rest = topic.slice(7);
+    const colon = rest.indexOf(":");
+    return colon > 0 && colon < rest.length - 1 ? "plugin" : null;
+  }
+  return null;
+}
+var MAX_TOPIC = 128;
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseClientFrame(raw) {
+  if (!isRecord7(raw))
+    return null;
+  const { id, type, topic } = raw;
+  if (id !== undefined && typeof id !== "string")
+    return null;
+  if (typeof topic !== "string" || topic.length === 0 || topic.length > MAX_TOPIC)
+    return null;
+  if (topicClass(topic) === null)
+    return null;
+  const head = id === undefined ? { topic } : { id, topic };
+  if (type === "unsubscribe")
+    return { ...head, type: "unsubscribe" };
+  if (type === "send") {
+    return "payload" in raw ? { ...head, type: "send", payload: raw.payload } : { ...head, type: "send" };
+  }
+  if (type === "subscribe") {
+    const { sinceSeq } = raw;
+    if (sinceSeq === undefined)
+      return { ...head, type: "subscribe" };
+    if (typeof sinceSeq !== "number" || !Number.isInteger(sinceSeq) || sinceSeq < 0)
+      return null;
+    return { ...head, type: "subscribe", sinceSeq };
+  }
+  return null;
+}
+
+// apps/gateway/src/routes/stream.ts
+function authorised(channels, principal, topic) {
+  const kind = topicClass(topic);
+  if (kind === null)
+    return false;
+  if (kind === "plugin") {
+    if (!channels.opened(topic))
+      return false;
+    if (principal.kind === "admin")
+      return true;
+    return topic.startsWith(`plugin:${principal.pluginId}:`);
+  }
+  return principal.kind === "admin";
+}
+function streamRoutes(deps) {
+  const logger2 = deps.logger ?? noopLogger;
+  const nextId = deps.connectionId ?? (() => `ws_${crypto.randomUUID()}`);
+  const resolved = new WeakMap;
+  const ids = new WeakMap;
+  const send = (ws, frame2) => {
+    ws.send(JSON.stringify(frame2));
+  };
+  return new Elysia().onError(apiErrorHandler).ws("/api/stream", {
+    beforeHandle: async ({ request: request2 }) => {
+      if (resolved.has(request2))
+        return;
+      const bearer = request2.headers.get("authorization");
+      const cookie = readCookie(request2, ADMIN_COOKIE);
+      if (bearer !== null && cookie !== null) {
+        throw new GatewayError("AUTH", "present one credential, not two");
+      }
+      await requireAdmin(request2, deps.admin);
+      if (cookie === null)
+        throw new GatewayError("AUTH", "admin session required");
+      resolved.set(request2, {
+        principal: { kind: "admin" },
+        revalidate: () => deps.admin.verify(cookie)
+      });
+    },
+    open(ws) {
+      const credential = resolved.get(ws.data.request);
+      if (credential === undefined) {
+        ws.close(1011, "unauthenticated");
+        return;
+      }
+      const id = nextId();
+      ids.set(ws.raw, id);
+      deps.registry.add(id, ws.raw, credential);
+      deps.registry.subscribe(id, GLOBAL_INVALIDATE);
+    },
+    message(ws, raw) {
+      const id = ids.get(ws.raw);
+      if (id === undefined)
+        return;
+      const frame2 = parseClientFrame(raw);
+      if (frame2 === null) {
+        send(ws, { type: "error", message: "malformed frame" });
+        return;
+      }
+      const principal = deps.registry.principal(id);
+      if (principal === null)
+        return;
+      const head = frame2.id === undefined ? {} : { id: frame2.id };
+      if (!authorised(deps.channels, principal, frame2.topic)) {
+        send(ws, { ...head, type: "error", topic: frame2.topic, message: "not permitted" });
+        return;
+      }
+      if (frame2.type === "unsubscribe") {
+        deps.registry.unsubscribe(id, frame2.topic);
+        send(ws, { ...head, type: "ack", topic: frame2.topic });
+        return;
+      }
+      if (frame2.type === "send") {
+        if (topicClass(frame2.topic) !== "plugin") {
+          send(ws, { ...head, type: "error", topic: frame2.topic, message: "topic is read-only" });
+          return;
+        }
+        if (!deps.channels.deliver(frame2.topic, id, frame2.payload)) {
+          send(ws, {
+            ...head,
+            type: "error",
+            topic: frame2.topic,
+            message: "subscribe before sending"
+          });
+          return;
+        }
+        send(ws, { ...head, type: "ack", topic: frame2.topic });
+        return;
+      }
+      if (topicClass(frame2.topic) === "stream" && !deps.broadcaster.declared(frame2.topic)) {
+        send(ws, { ...head, type: "error", topic: frame2.topic, message: "no source" });
+        return;
+      }
+      deps.registry.subscribe(id, frame2.topic);
+      send(ws, { ...head, type: "ack", topic: frame2.topic });
+      if (frame2.sinceSeq !== undefined) {
+        const slice = deps.ring.since(frame2.topic, frame2.sinceSeq);
+        if (slice.kind === "gap") {
+          send(ws, { type: "gap", topic: frame2.topic, seq: slice.seq });
+        } else {
+          for (const item of slice.frames) {
+            send(ws, { type: "event", topic: frame2.topic, seq: item.seq, payload: item.payload });
+          }
+        }
+      }
+    },
+    pong(ws) {
+      const id = ids.get(ws.raw);
+      if (id !== undefined)
+        deps.registry.pong(id);
+    },
+    drain(ws) {
+      const id = ids.get(ws.raw);
+      if (id !== undefined)
+        deps.registry.drain(id);
+    },
+    close(ws) {
+      const id = ids.get(ws.raw);
+      if (id === undefined)
+        return;
+      deps.channels.closed(id, deps.registry.topics(id));
+      deps.registry.remove(id);
+      ids.delete(ws.raw);
+      logger2.debug("stream closed");
+    }
+  }).get("/api/stream", ({ set: set2 }) => {
+    set2.status = 426;
+    return { error: { code: "BAD_REQUEST", message: "websocket upgrade required" } };
+  });
+}
+
+// apps/gateway/src/stream/channels.ts
+var NAME_PATTERN = /^[a-z0-9][a-z0-9:._-]{0,63}$/;
+var defaultScheduler = (run) => {
+  const timer = setTimeout(run, 0);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+};
+function createChannelRegistry(deps) {
+  const logger2 = deps.logger ?? noopLogger;
+  const scheduler = deps.scheduler ?? defaultScheduler;
+  const channels = new Map;
+  let handlerErrors = 0;
+  let live = true;
+  let cancelReport;
+  const errorsSinceReport = new Map;
+  const report2 = () => {
+    cancelReport = undefined;
+    if (!live)
+      return;
+    for (const [pluginId, count] of errorsSinceReport) {
+      logger2.warn("plugin channel handler failed", { plugin: pluginId, count });
+    }
+    errorsSinceReport.clear();
+  };
+  const countFailure = (pluginId) => {
+    handlerErrors++;
+    errorsSinceReport.set(pluginId, (errorsSinceReport.get(pluginId) ?? 0) + 1);
+    if (cancelReport !== undefined || !live)
+      return;
+    cancelReport = scheduler(report2);
+  };
+  const holds = (connectionId, topic) => deps.sockets.has(connectionId, topic);
+  const openChannel = (pluginId, name) => {
+    if (!NAME_PATTERN.test(name)) {
+      throw new Error(`channel name must match ${String(NAME_PATTERN)}, got ${name}`);
+    }
+    const topic = `plugin:${pluginId}:${name}`;
+    const existing = channels.get(topic);
+    if (existing !== undefined)
+      return existing.facade;
+    const channel = {
+      pluginId,
+      topic,
+      onMessage: [],
+      onClose: [],
+      facade: { onMessage: () => {}, send: () => {}, onClose: () => {} }
+    };
+    channel.facade = {
+      onMessage(handler) {
+        channel.onMessage.push(handler);
+      },
+      onClose(handler) {
+        channel.onClose.push(handler);
+      },
+      send(connectionId, payload) {
+        if (!live)
+          return;
+        if (!holds(connectionId, topic))
+          return;
+        deps.sockets.sendTo(connectionId, { type: "event", topic, payload });
+      }
+    };
+    channels.set(topic, channel);
+    return channel.facade;
+  };
+  return {
+    for(pluginId) {
+      return { open: (name) => openChannel(pluginId, name) };
+    },
+    opened(topic) {
+      return channels.has(topic);
+    },
+    deliver(topic, connectionId, payload) {
+      if (!live)
+        return false;
+      const channel = channels.get(topic);
+      if (channel === undefined)
+        return false;
+      if (!holds(connectionId, topic))
+        return false;
+      for (const handler of channel.onMessage) {
+        try {
+          handler({ connectionId, payload });
+        } catch {
+          countFailure(channel.pluginId);
+        }
+      }
+      return true;
+    },
+    closed(connectionId, topics) {
+      if (!live)
+        return;
+      for (const topic of topics) {
+        const channel = channels.get(topic);
+        if (channel === undefined)
+          continue;
+        for (const handler of channel.onClose) {
+          try {
+            handler(connectionId);
+          } catch {
+            countFailure(channel.pluginId);
+          }
+        }
+      }
+    },
+    stats() {
+      return { channels: channels.size, handlerErrors };
+    },
+    stop() {
+      live = false;
+      channels.clear();
+      cancelReport?.();
+      cancelReport = undefined;
+      errorsSinceReport.clear();
+    }
+  };
+}
+
+// apps/gateway/src/stream/coalescer.ts
+var defaultSchedule = (run, ms) => {
+  const timer = setTimeout(run, ms);
+  return () => clearTimeout(timer);
+};
+function createCoalescer(deps) {
+  const now = deps.now ?? Date.now;
+  const schedule = deps.schedule ?? defaultSchedule;
+  const lastSent = new Map;
+  const pending = new Map;
+  const floorFor = (topic) => deps.floors[topic] ?? deps.defaultFloorMs;
+  const send = (topic, payload) => {
+    lastSent.set(topic, now());
+    deps.sink(topic, payload);
+  };
+  const fire = (topic) => {
+    const item = pending.get(topic);
+    if (item === undefined)
+      return;
+    pending.delete(topic);
+    send(topic, item.payload);
+  };
+  return {
+    emit(topic, payload) {
+      const floor = floorFor(topic);
+      const previous = lastSent.get(topic);
+      const elapsed = previous === undefined ? Number.POSITIVE_INFINITY : now() - previous;
+      const waiting = pending.get(topic);
+      if (waiting !== undefined) {
+        waiting.payload = payload;
+        return;
+      }
+      if (elapsed >= floor) {
+        send(topic, payload);
+        return;
+      }
+      const cancel = schedule(() => fire(topic), floor - elapsed);
+      pending.set(topic, { payload, cancel });
+    },
+    flush() {
+      for (const [topic, item] of [...pending]) {
+        item.cancel();
+        pending.delete(topic);
+        send(topic, item.payload);
+      }
+    },
+    stop() {
+      for (const item of pending.values())
+        item.cancel();
+      pending.clear();
+      lastSent.clear();
+    }
+  };
+}
+
+// apps/gateway/src/stream/registry.ts
+var DEFAULT_QUEUE_CAPACITY = 1000;
+var MAX_TOPICS_PER_CONNECTION = 256;
+var HIGH_WATER_BYTES = 512 * 1024;
+var HEARTBEAT_MS = 20000;
+var PONG_DEADLINE_MS = 60000;
+var CHECK_STALE_MS = 60000;
+var CLOSE_UNAUTHENTICATED = 4401;
+function createSocketRegistry(deps = {}) {
+  const logger2 = deps.logger ?? noopLogger;
+  const onDetach = deps.onDetach;
+  const now = deps.now ?? Date.now;
+  const schedule = deps.schedule ?? ((run, ms) => {
+    const timer = setTimeout(run, ms);
+    timer.unref?.();
+    return () => clearTimeout(timer);
+  });
+  const capacity = deps.queueCapacity ?? DEFAULT_QUEUE_CAPACITY;
+  const heartbeatMs = deps.heartbeatMs ?? HEARTBEAT_MS;
+  const pongDeadlineMs = deps.pongDeadlineMs ?? PONG_DEADLINE_MS;
+  const checkStaleMs = deps.checkStaleMs ?? CHECK_STALE_MS;
+  const connections = new Map;
+  const index = new Map;
+  let dropped = 0;
+  let live = true;
+  let cancelTick;
+  let droppedSinceReport = 0;
+  const flush = (connection) => {
+    while (connection.queue.length > 0) {
+      if ((connection.socket.getBufferedAmount?.() ?? 0) >= HIGH_WATER_BYTES)
+        return;
+      const frame2 = connection.queue[0];
+      if (frame2 === undefined)
+        break;
+      let status2;
+      try {
+        status2 = connection.socket.send(JSON.stringify(frame2));
+      } catch {
+        return;
+      }
+      if (status2 === 0)
+        return;
+      connection.queue.shift();
+    }
+  };
+  const deliver = (connection, frame2) => {
+    if (connection.queue.length >= capacity) {
+      connection.queue.shift();
+      dropped++;
+      droppedSinceReport++;
+    }
+    connection.queue.push(frame2);
+    flush(connection);
+  };
+  const detach = (connection) => {
+    for (const topic of connection.topics) {
+      const subscribers = index.get(topic);
+      if (subscribers === undefined)
+        continue;
+      subscribers.delete(connection.id);
+      if (subscribers.size === 0)
+        index.delete(topic);
+    }
+    connections.delete(connection.id);
+  };
+  const closeOne = (connection, code, reason) => {
+    onDetach?.(connection.id, [...connection.topics]);
+    detach(connection);
+    try {
+      connection.socket.close(code, reason);
+    } catch {}
+  };
+  const tick = () => {
+    cancelTick = undefined;
+    if (!live)
+      return;
+    const at = now();
+    for (const connection of [...connections.values()]) {
+      if (at - connection.lastPongAt > pongDeadlineMs) {
+        closeOne(connection, 1001, "pong deadline");
+        continue;
+      }
+      try {
+        connection.socket.ping?.();
+      } catch {
+        closeOne(connection, 1001, "ping failed");
+        continue;
+      }
+      if (connection.checking) {
+        if (at - connection.checkingSince < checkStaleMs)
+          continue;
+        connection.generation += 1;
+        connection.checking = false;
+      }
+      connection.checking = true;
+      connection.checkingSince = at;
+      const generation = connection.generation;
+      connection.credential.revalidate().then((valid) => {
+        if (connection.generation !== generation)
+          return;
+        connection.checking = false;
+        if (!valid && connections.has(connection.id)) {
+          closeOne(connection, CLOSE_UNAUTHENTICATED, "session expired");
+        }
+      }).catch(() => {
+        if (connection.generation !== generation)
+          return;
+        connection.checking = false;
+      });
+    }
+    if (droppedSinceReport > 0) {
+      logger2.warn("stream queue overflowed", { count: droppedSinceReport });
+      droppedSinceReport = 0;
+    }
+    arm();
+  };
+  const arm = () => {
+    if (!live || cancelTick !== undefined)
+      return;
+    cancelTick = schedule(tick, heartbeatMs);
+  };
+  arm();
+  return {
+    add(id, socket, credential) {
+      if (!live) {
+        socket.close(1001, "shutting down");
+        return;
+      }
+      connections.set(id, {
+        id,
+        socket,
+        credential,
+        topics: new Set,
+        queue: [],
+        lastPongAt: now(),
+        checking: false,
+        checkingSince: 0,
+        generation: 0
+      });
+    },
+    remove(id) {
+      const connection = connections.get(id);
+      if (connection !== undefined)
+        detach(connection);
+    },
+    subscribe(id, topic) {
+      const connection = connections.get(id);
+      if (connection === undefined)
+        return;
+      if (connection.topics.size >= MAX_TOPICS_PER_CONNECTION && !connection.topics.has(topic)) {
+        return;
+      }
+      connection.topics.add(topic);
+      const subscribers = index.get(topic) ?? new Set;
+      subscribers.add(id);
+      index.set(topic, subscribers);
+    },
+    unsubscribe(id, topic) {
+      const connection = connections.get(id);
+      if (connection === undefined)
+        return;
+      connection.topics.delete(topic);
+      const subscribers = index.get(topic);
+      if (subscribers === undefined)
+        return;
+      subscribers.delete(id);
+      if (subscribers.size === 0)
+        index.delete(topic);
+    },
+    topics(id) {
+      return [...connections.get(id)?.topics ?? []];
+    },
+    has(id, topic) {
+      return connections.get(id)?.topics.has(topic) ?? false;
+    },
+    principal(id) {
+      return connections.get(id)?.credential.principal ?? null;
+    },
+    pong(id) {
+      const connection = connections.get(id);
+      if (connection !== undefined)
+        connection.lastPongAt = now();
+    },
+    drain(id) {
+      const connection = connections.get(id);
+      if (connection !== undefined)
+        flush(connection);
+    },
+    publish(topic, frame2) {
+      const subscribers = index.get(topic);
+      if (subscribers === undefined)
+        return;
+      for (const id of subscribers) {
+        const connection = connections.get(id);
+        if (connection !== undefined)
+          deliver(connection, frame2);
+      }
+    },
+    sendTo(id, frame2) {
+      const connection = connections.get(id);
+      if (connection !== undefined)
+        deliver(connection, frame2);
+    },
+    closeAll(code, reason) {
+      for (const connection of [...connections.values()])
+        closeOne(connection, code, reason);
+      index.clear();
+    },
+    stats() {
+      let queued = 0;
+      for (const connection of connections.values())
+        queued += connection.queue.length;
+      return { connections: connections.size, dropped, queued };
+    },
+    stop() {
+      live = false;
+      cancelTick?.();
+      cancelTick = undefined;
+    }
+  };
+}
+
+// apps/gateway/src/stream/ring.ts
+function sizeOf(payload) {
+  try {
+    return JSON.stringify(payload)?.length ?? 0;
+  } catch {
+    return 0;
+  }
+}
+function createRing(limits) {
+  const topics = new Map;
+  const stateFor = (topic) => {
+    const existing = topics.get(topic);
+    if (existing !== undefined)
+      return existing;
+    const created = { entries: [], bytes: 0, seq: 0 };
+    topics.set(topic, created);
+    return created;
+  };
+  return {
+    push(topic, payload) {
+      const state = stateFor(topic);
+      state.seq += 1;
+      const bytes = sizeOf(payload);
+      state.entries.push({ seq: state.seq, payload, bytes });
+      state.bytes += bytes;
+      while (state.entries.length > limits.frames || state.bytes > limits.bytes && state.entries.length > 1) {
+        const evicted = state.entries.shift();
+        if (evicted === undefined)
+          break;
+        state.bytes -= evicted.bytes;
+      }
+      return state.seq;
+    },
+    since(topic, sinceSeq) {
+      const state = topics.get(topic);
+      if (state === undefined) {
+        return sinceSeq === 0 ? { kind: "frames", frames: [] } : { kind: "gap", seq: 0 };
+      }
+      if (sinceSeq > state.seq)
+        return { kind: "gap", seq: state.seq };
+      if (sinceSeq === state.seq)
+        return { kind: "frames", frames: [] };
+      const oldest = state.entries[0];
+      if (oldest === undefined)
+        return { kind: "gap", seq: state.seq };
+      if (oldest.seq > sinceSeq + 1)
+        return { kind: "gap", seq: state.seq };
+      return {
+        kind: "frames",
+        frames: state.entries.filter((entry) => entry.seq > sinceSeq).map(({ seq, payload }) => ({ seq, payload }))
+      };
+    },
+    head(topic) {
+      return topics.get(topic)?.seq ?? 0;
+    },
+    reset(topic) {
+      const state = topics.get(topic);
+      if (state === undefined)
+        return;
+      state.entries = [];
+      state.bytes = 0;
+    },
+    drop(topic) {
+      topics.delete(topic);
+    }
+  };
+}
+
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
 var QUIESCE_MESSAGE = "the gateway is briefly quiesced for database maintenance";
@@ -48717,6 +49491,29 @@ function createApp(deps) {
     } catch {}
   }
   const latch = deps.latch ?? createQuiesceLatch();
+  let channelsRef;
+  const registry2 = deps.registry ?? createSocketRegistry({
+    logger: logger2,
+    now,
+    onDetach: (id, topics) => channelsRef?.closed(id, topics)
+  });
+  const channels = deps.channels ?? createChannelRegistry({ sockets: registry2, logger: logger2 });
+  channelsRef = channels;
+  const ring = deps.ring ?? createRing({ frames: 500, bytes: 2 * 1024 * 1024 });
+  const broadcaster = deps.broadcaster ?? createBroadcaster({
+    registry: registry2,
+    ring,
+    coalescer: createCoalescer({
+      floors: INVALIDATION_FLOORS,
+      defaultFloorMs: DEFAULT_FLOOR_MS,
+      now,
+      sink: (topic, payload) => registry2.publish(topic, {
+        type: "event",
+        topic,
+        ...payload === undefined ? {} : { payload }
+      })
+    })
+  });
   const admitted = new WeakMap;
   return new Elysia().onRequest(({ request: request2 }) => {
     const path = new URL(request2.url).pathname;
@@ -48741,18 +49538,18 @@ function createApp(deps) {
     rateLimiter,
     logger: logger2,
     ...deps.loadRegistry === undefined ? {} : { loadRegistry: deps.loadRegistry },
-    discoveryMirrors: deps.discoveryMirrors === true,
     bodyLoggingAllowed: deps.bodyLoggingAllowed === true,
-    ...deps.emit === undefined ? {} : { emit: deps.emit }
+    ...deps.emit === undefined ? {} : { emit: deps.emit },
+    broadcaster
   })).use(adminRoutes({
     store: deps.store,
     admin,
     baseUrl: deps.baseUrl,
-    discoveryMirrors: deps.discoveryMirrors === true,
     bodyLoggingAllowed: deps.bodyLoggingAllowed === true,
     now,
     sessionTtlMs: ADMIN_SESSION_TTL_MS,
     logger: logger2,
+    broadcaster,
     ...deps.console === undefined ? {} : { console: deps.console }
   })).use(databaseRoutes({
     store: deps.store,
@@ -48760,6 +49557,7 @@ function createApp(deps) {
     admin,
     latch,
     snapshots,
+    broadcaster,
     fs: deps.databaseFs ?? nodeDatabaseFs(),
     now,
     logger: logger2,
@@ -48779,6 +49577,13 @@ function createApp(deps) {
     admin,
     plugins: deps.pluginUi ?? [],
     logger: logger2
+  })).use(streamRoutes({
+    admin,
+    registry: registry2,
+    broadcaster,
+    ring,
+    channels,
+    logger: logger2
   })).get("/*", ({ path, request: request2, set: set2 }) => {
     const rawPath = new URL(request2.url).pathname;
     const error51 = () => {
@@ -48935,6 +49740,7 @@ async function sweep(deps) {
   const logger2 = deps.logger ?? noopLogger;
   const credentials = await deps.store.credentials.list();
   let refreshed = 0;
+  let touched = 0;
   for (const credential of due(credentials, deps.now())) {
     if (!credential.hasRefreshToken) {
       if (credential.expiresAt !== null && credential.expiresAt <= deps.now()) {
@@ -48943,14 +49749,18 @@ async function sweep(deps) {
           disabledReason: "expiredNoRefresh",
           disabledAt: deps.now()
         });
+        touched += 1;
       }
       continue;
     }
     try {
       await deps.refresh(credential);
       refreshed += 1;
+      touched += 1;
     } catch (error51) {
       const code = error51 instanceof GatewayError ? error51.code : "INTERNAL";
+      if (code === "AUTH")
+        touched += 1;
       logger2.warn("scheduled token refresh failed", {
         provider: credential.provider,
         credentialId: credential.id,
@@ -48959,6 +49769,8 @@ async function sweep(deps) {
       });
     }
   }
+  if (touched > 0)
+    deps.broadcaster?.invalidate("res:credentials");
   return refreshed;
 }
 function startRefreshScheduler(deps) {
@@ -48982,14 +49794,14 @@ function startRefreshScheduler(deps) {
 
 // apps/gateway/src/plugins/events.ts
 var DEFAULT_CAPACITY = 1000;
-var defaultScheduler = (run) => {
+var defaultScheduler2 = (run) => {
   const timer = setTimeout(run, 0);
   return () => clearTimeout(timer);
 };
 function createPluginEventBus(opts) {
   const logger2 = opts.logger ?? noopLogger;
   const capacity = opts.capacity ?? DEFAULT_CAPACITY;
-  const scheduler = opts.scheduler ?? defaultScheduler;
+  const scheduler = opts.scheduler ?? defaultScheduler2;
   const requestHandlers = [];
   const limitHandlers = [];
   const queue = [];
@@ -49197,6 +50009,7 @@ function buildContext(deps) {
       const events = createPluginEvents(manifest, deps.events);
       return events === undefined ? {} : { events };
     })(),
+    ...declared.includes("channels") ? { channels: deps.channels.for(manifest.id) } : {},
     config: manifest.defaults ?? {}
   };
 }
@@ -49277,6 +50090,7 @@ async function loadPlugins(deps) {
           home,
           store: deps.store,
           events: deps.events,
+          channels: deps.channels,
           logger: logger2,
           now
         });
@@ -49325,6 +50139,7 @@ async function startQuotaPoller(deps) {
       });
     }).finally(() => {
       running = false;
+      deps.broadcaster?.invalidate("res:quota");
     });
   };
   pass();
@@ -49333,6 +50148,169 @@ async function startQuotaPoller(deps) {
   return () => clearInterval(timer);
 }
 
+// apps/gateway/src/stream/console.ts
+import { watch } from "fs";
+var CONSOLE_TOPIC = "stream:console";
+var CONSOLE_FLOOR_MS = 250;
+var JOURNAL_POLL_MS = 1000;
+var REWATCH_ATTEMPTS = 5;
+var defaultSchedule2 = (run, ms) => {
+  const timer = setTimeout(run, ms);
+  return () => clearTimeout(timer);
+};
+function startConsoleStream(deps) {
+  const logger2 = deps.logger ?? noopLogger;
+  const { source } = deps.console;
+  if (source.kind === "none")
+    return () => {};
+  if (source.kind === "journal")
+    return startJournalPoll(deps, source, logger2);
+  return startFileWatch(deps, source, logger2);
+}
+function startFileWatch(deps, source, logger2) {
+  const { broadcaster } = deps;
+  const read = deps.read ?? readFrom;
+  const size = deps.size ?? fileSize;
+  const floorMs = deps.floorMs ?? CONSOLE_FLOOR_MS;
+  let offset = size(source.path) ?? 0;
+  let stopped = false;
+  let watcher = null;
+  let rotated = false;
+  let rewatchAttempts = 0;
+  let cancelRewatch = null;
+  const rewatchSchedule = deps.schedule ?? defaultSchedule2;
+  const pump = () => {
+    const delta2 = read(source.path, offset);
+    if (delta2 === null) {
+      rotate();
+      return;
+    }
+    offset = delta2.offset;
+    const lines = parseConsoleLines(delta2.text, { lines: MAX_CONSOLE_LINES });
+    if (lines.length > 0)
+      broadcaster.stream(CONSOLE_TOPIC, { lines });
+    if (delta2.gap || rotated) {
+      rotated = false;
+      broadcaster.resetStream(CONSOLE_TOPIC);
+    }
+  };
+  const coalescer = createCoalescer({
+    floors: { [CONSOLE_TOPIC]: floorMs },
+    defaultFloorMs: floorMs,
+    ...deps.now === undefined ? {} : { now: deps.now },
+    ...deps.schedule === undefined ? {} : { schedule: deps.schedule },
+    sink: () => pump()
+  });
+  function rotate() {
+    if (stopped)
+      return;
+    offset = 0;
+    rotated = true;
+    watcher?.close();
+    watcher = startWatcher(deps, source.path, onWatchEvent, logger2);
+    if (watcher === null) {
+      if (rewatchAttempts >= REWATCH_ATTEMPTS) {
+        logger2.warn("console stream ended", { path: source.path });
+        return;
+      }
+      rewatchAttempts += 1;
+      cancelRewatch?.();
+      cancelRewatch = rewatchSchedule(() => rotate(), floorMs);
+      return;
+    }
+    rewatchAttempts = 0;
+    coalescer.emit(CONSOLE_TOPIC);
+  }
+  function onWatchEvent(event) {
+    if (event === "rename") {
+      rotate();
+      return;
+    }
+    coalescer.emit(CONSOLE_TOPIC);
+  }
+  watcher = startWatcher(deps, source.path, onWatchEvent, logger2);
+  if (watcher === null) {
+    coalescer.stop();
+    return () => {};
+  }
+  broadcaster.declareStream(CONSOLE_TOPIC);
+  logger2.info("console stream watching", { path: source.path });
+  return () => {
+    stopped = true;
+    cancelRewatch?.();
+    watcher?.close();
+    coalescer.stop();
+  };
+}
+function startWatcher(deps, path, onChange, logger2) {
+  const create2 = deps.watch ?? ((target, changed) => {
+    const watcher = watch(target, (event) => changed(event));
+    watcher.on("error", (error51) => {
+      logger2.error("console watch failed", { reason: describeError(error51, "unknown") });
+    });
+    return watcher;
+  });
+  try {
+    return create2(path, onChange);
+  } catch (error51) {
+    logger2.warn("console stream unavailable", {
+      path,
+      reason: describeError(error51, "unknown")
+    });
+    return null;
+  }
+}
+function startJournalPoll(deps, source, logger2) {
+  const { broadcaster } = deps;
+  const now = deps.now ?? Date.now;
+  const schedule = deps.schedule ?? defaultSchedule2;
+  const pollMs = deps.pollMs ?? JOURNAL_POLL_MS;
+  let cursor = now();
+  let stopped = false;
+  let cancel = null;
+  let publishedAtCursor = new Set;
+  const arm = () => {
+    if (stopped)
+      return;
+    cancel = schedule(() => void tick(), pollMs);
+  };
+  const tick = async () => {
+    try {
+      const read = await readConsole(deps.console.deps, source, {
+        lines: MAX_CONSOLE_LINES,
+        since: cursor - 1
+      });
+      const fresh = read.lines.filter((line) => line.at !== cursor || !publishedAtCursor.has(line.raw));
+      if (fresh.length > 0) {
+        let newest = cursor;
+        for (const line of fresh) {
+          if (line.at !== null && line.at > newest)
+            newest = line.at;
+        }
+        if (newest > cursor) {
+          cursor = newest;
+          publishedAtCursor = new Set;
+        }
+        for (const line of fresh) {
+          if (line.at === cursor)
+            publishedAtCursor.add(line.raw);
+        }
+        broadcaster.stream(CONSOLE_TOPIC, { lines: fresh });
+      }
+    } catch (error51) {
+      logger2.error("console poll failed", { reason: describeError(error51, "unknown") });
+    } finally {
+      arm();
+    }
+  };
+  broadcaster.declareStream(CONSOLE_TOPIC);
+  arm();
+  return () => {
+    stopped = true;
+    cancel?.();
+  };
+}
+
 // apps/gateway/src/index.ts
 function stdoutLogger(level) {
   return createLogger({
@@ -49411,10 +50389,19 @@ async function main() {
   const installRoot = process.env.OMNI_ROOT ?? dirname5(config2.databasePath);
   const pluginRoot = resolve6(installRoot, "plugins");
   const pluginEvents = createPluginEventBus({ logger: logger2 });
+  let pluginChannelsRef;
+  const streamRegistry = createSocketRegistry({
+    logger: logger2,
+    now,
+    onDetach: (id, topics) => pluginChannelsRef?.closed(id, topics)
+  });
+  const pluginChannels = createChannelRegistry({ sockets: streamRegistry, logger: logger2 });
+  pluginChannelsRef = pluginChannels;
   const loadedPlugins = await loadPlugins({
     root: pluginRoot,
     store,
     events: pluginEvents,
+    channels: pluginChannels,
     sdkVersion: DASHBOARD_SDK_VERSION,
     logger: logger2,
     now
@@ -49423,6 +50410,21 @@ async function main() {
     logger2.warn("plugin unavailable", { plugin: failure.id, reason: failure.reason });
   }
   logger2.info("plugins resolved", { count: loadedPlugins.plugins.length, path: pluginRoot });
+  const streamRing = createRing({ frames: 500, bytes: 2 * 1024 * 1024 });
+  const broadcaster = createBroadcaster({
+    registry: streamRegistry,
+    ring: streamRing,
+    coalescer: createCoalescer({
+      floors: INVALIDATION_FLOORS,
+      defaultFloorMs: DEFAULT_FLOOR_MS,
+      now,
+      sink: (topic, payload) => streamRegistry.publish(topic, {
+        type: "event",
+        topic,
+        ...payload === undefined ? {} : { payload }
+      })
+    })
+  });
   const app = createApp({
     store,
     baseUrl: config2.baseUrl,
@@ -49432,7 +50434,10 @@ async function main() {
     staticDir,
     logger: logger2,
     console: console2,
-    discoveryMirrors: config2.exposeClaudeCodeAliases,
+    registry: streamRegistry,
+    broadcaster,
+    ring: streamRing,
+    channels: pluginChannels,
     bodyLoggingAllowed: config2.bodyLoggingAllowed,
     plugins: loadedPlugins.plugins.map((plugin) => ({ id: plugin.id, routes: plugin.routes })),
     pluginUi: loadedPlugins.plugins,
@@ -49455,20 +50460,34 @@ async function main() {
     }
   });
   const stopMaintenance = startMaintenance({ store, now, logger: logger2 });
-  const stopRefreshScheduler = startRefreshScheduler({ store, refresh, now, logger: logger2 });
+  const stopRefreshScheduler = startRefreshScheduler({ store, refresh, now, logger: logger2, broadcaster });
   const stopQuotaPoller = await startQuotaPoller({
     store,
     providers: OAUTH_PROVIDERS,
     http,
     refresh,
     now,
-    logger: logger2
+    logger: logger2,
+    broadcaster
   });
+  const stopConsoleStream = startConsoleStream({ console: console2, broadcaster, logger: logger2, now });
   app.listen({ port: config2.port, hostname: config2.host, idleTimeout: 255 });
   logger2.info("omnigateway listening", { host: config2.host, port: config2.port });
   shutdown = createShutdown({
     logger: logger2,
-    stopLoops: [stopMaintenance, stopRefreshScheduler, stopQuotaPoller, () => pluginEvents.stop()],
+    stopLoops: [
+      stopMaintenance,
+      stopRefreshScheduler,
+      stopQuotaPoller,
+      stopConsoleStream,
+      () => pluginEvents.stop(),
+      () => {
+        streamRegistry.closeAll(1001, "restart");
+        streamRegistry.stop();
+        broadcaster.stop();
+        pluginChannels.stop();
+      }
+    ],
     stopServer: async () => {
       await app.stop();
     },