@omnicross/daemon 0.1.0 → 0.1.3

package/dist/index.d.cts

@@ -1,12 +1,20 @@
+import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow, OutboundKeyPolicy } from '@omnicross/core';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { OutboundKeyDb, OutboundApiServer } from '@omnicross/core/outbound-api';
+import { AccountProbeConfig, OutboundKeyDb, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { ProviderProxy } from '@omnicross/core/provider-proxy';
+import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
-import { OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, Logger, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow } from '@omnicross/core';
+import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity } from '@omnicross/contracts/account-tokens-types';
+import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { SubscriptionAccountHealth } from '@omnicross/core/pipeline/SubscriptionAccountHealth';
+import { fetchUpstream } from '@omnicross/core/pipeline/upstreamFetch';
+import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
-import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, SubscriptionAccountSanitized } from '@omnicross/contracts/account-tokens-types';
+import { PricingEntry, PricingEntryInput, PricingResolution } from '@omnicross/contracts/pricing-types';
+import { WebhookConfig, WebhookEvent } from '@omnicross/contracts/webhook-types';
 
 /**
  * SecretBox.ts — a 32-byte master key wrapped with the tri-state secret rules
@@ -374,6 +382,12 @@ interface DaemonConfig {
     server?: OutboundApiServerConfig;
     /** Optional admin-dashboard config (RT3). */
     admin?: DaemonAdminConfig;
+    /**
+     * Optional logging config (configurable-logging). Absent ⇒ the zero-regression
+     * default (console + all levels + text). `file` is a PLAIN value — NOT a secret,
+     * so it is never walked by `decryptConfigSecrets`/`encryptConfigSecrets`.
+     */
+    logging?: LoggingConfig;
 }
 /** Apply defaults to a (possibly absent) admin block: enabled, port 8766,
  *  loopback, no token. NOTE: an EXPLICIT `port: 0` is honored as "bind an
@@ -391,6 +405,96 @@ declare function loadConfig(path: string): DaemonConfig;
  *  `enc:` untouched) before serializing. */
 declare function saveConfig(path: string, cfg: DaemonConfig): void;
 
+/**
+ * external-cli-credentials — read-only access to the external CLI native
+ * credential stores (external-cli-sync).
+ *
+ * The daemon never WRITES these files (they belong to the CLIs); it only reads
+ * them back to (a) recover from the rotating-refresh-token race — when e.g.
+ * Claude Code refreshes `~/.claude/.credentials.json` it rotates OUR stored
+ * refresh token out from under us, and the external file then holds the only
+ * live credential — and (b) detect divergence for the account-list warning.
+ *
+ * File shapes (mirrors the shapes the CLIs themselves write):
+ *   claude `~/.claude/.credentials.json`
+ *     → `{ claudeAiOauth: { accessToken, refreshToken?, expiresAt(number ms),
+ *          scopes? } }`
+ *   codex `~/.codex/auth.json`
+ *     → `{ tokens: { id_token?, access_token, refresh_token? } }` — no explicit
+ *       expiry; the access token's JWT `exp` claim is the only expiry signal.
+ *
+ * Gemini is deliberately excluded: the gemini CLI's oauth store is not a
+ * supported import source (parity with the host app's external-sync scope).
+ *
+ * @module @omnicross/daemon/ports/external-cli-credentials
+ */
+/** The two external CLI providers with a readable native store. */
+type ExternalCliProvider = 'claude' | 'codex';
+/**
+ * External credentials parsed OUT of a native store file. Field axes match the
+ * internal `*TokenConfig` shapes: `expiresAt` is an ISO STRING here (converted
+ * from the native ms number / codex JWT `exp`).
+ */
+interface ExternalCliCredentials {
+    accessToken?: string;
+    refreshToken?: string;
+    /** ISO string. */
+    expiresAt?: string;
+    /** codex only. */
+    idToken?: string;
+    /** claude only. */
+    scopes?: string[];
+}
+/** Reader port — injectable so tests never touch the real home directory. */
+type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentials | null;
+
+/**
+ * external-cli-store — WRITE side of the external CLI native credential stores
+ * (external-cli-sync, import + write-back).
+ *
+ * Counterpart of `external-cli-credentials` (the read side). The daemon only
+ * ever writes a file it MANAGES: an explicit "import existing CLI login" puts
+ * an `.omnicross-managed` marker (recording the owning account id) next to the
+ * native store, and every subsequent successful refresh of THAT account writes
+ * the rotated credential back into the file. Without the write-back, the
+ * daemon's refresh would rotate the single-use refresh token and silently log
+ * the user's bare CLI out — the write-back keeps both sides on the same live
+ * credential.
+ *
+ * Safety properties:
+ *  - NEVER writes without a matching marker (an unmanaged / foreign-account
+ *    file is untouched);
+ *  - read-then-merge: unrelated top-level keys in the native file (e.g.
+ *    claude `email`, codex `OPENAI_API_KEY`) are preserved;
+ *  - one-time `.omnicross-backup` of the original file before the FIRST
+ *    overwrite (restorable by hand if the user wants the daemon out);
+ *  - atomic write (temp file → rename) so a crash never leaves a torn file.
+ *
+ * The envelope shapes mirror what the CLIs themselves write — the round-trip
+ * test parses a written file back through `external-cli-credentials` to keep
+ * the two sides from drifting.
+ *
+ * @module @omnicross/daemon/ports/external-cli-store
+ */
+
+/** Token blocks the write-back accepts (the two external-store providers). */
+type ExternalWritableTokens = ClaudeTokenConfig | CodexTokenConfig;
+/**
+ * Injectable port over the external store writes (tests use an in-memory fake;
+ * the store wires `realExternalCliStore`).
+ */
+interface ExternalCliStorePort {
+    /** The owning account id recorded by the marker, or undefined when unmanaged. */
+    readMarkerAccountId(provider: ExternalCliProvider): string | undefined;
+    /** Record (or move) ownership of the provider's native store to an account. */
+    writeMarker(provider: ExternalCliProvider, accountId: string): void;
+    /**
+     * Write the refreshed tokens back into the native store — ONLY when the
+     * marker names `accountId`. Returns true when a write happened.
+     */
+    writeBack(provider: ExternalCliProvider, accountId: string, tokens: ExternalWritableTokens): boolean;
+}
+
 /**
  * JsonSubscriptionCredentialStore — the daemon's file-backed
  * `SubscriptionCredentialStore` port impl (design D1).
@@ -452,15 +556,43 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     private readonly tokensPath;
     private readonly box;
     private readonly fetchImpl;
+    /** Injectable external CLI native-store reader (external-cli-sync). */
+    private readonly externalCliReader;
+    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
+    private readonly externalCliStore;
     /**
      * @param tokensPath  on-disk `tokens.json` location.
      * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
-     * @param fetchImpl   injectable HTTP port for the OAuth refresh round-trips
-     *                    (oauth design D4). Defaults to the global `fetch` so boot
-     *                    is unchanged; tests inject a mock fetch. NOT used by any
-     *                    read/write path — only by `refresh*Token`.
+     * @param fetchImpl   OPTIONAL injectable HTTP port for the OAuth refresh
+     *                    round-trips (oauth design D4). A TEST-injected transport is
+     *                    used verbatim. When ABSENT (production), each refresh uses a
+     *                    proxy-aware {@link fetchUpstream} that threads the
+     *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
+     *                    per-account/per-provider proxy is honored on refresh exactly
+     *                    as on relay — refresh egresses from the SAME proxy IP as the
+     *                    account's traffic. NOT used by any read/write path.
+     */
+    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike | undefined, 
+    /** Injectable external CLI native-store reader (external-cli-sync). */
+    externalCliReader?: ExternalCliReader, 
+    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
+    externalCliStore?: ExternalCliStorePort);
+    /**
+     * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
+     * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
+     * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
+     * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+     */
+    buildRefreshFetch(providerId: string, accountId?: string): FetchLike;
+    /**
+     * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+     * SINGLE-USE: two concurrent refreshes of one account each spend the same
+     * token and the loser bricks a healthy account. Every refresh entry point
+     * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
+     * through `coalesce`, so overlapping callers share ONE upstream round-trip.
      */
-    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike);
+    private readonly inFlightRefreshes;
+    private coalesce;
     /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
      *  file is absent/corrupt). This is the hot read — the codex / gemini auth
      *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
@@ -471,6 +603,14 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     getValidClaudeAccessToken(): Promise<string | null>;
     /** Current OpenCodeGo static API key, or `null` when none is stored. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
+    /**
+     * DAEMON-ONLY per-account proxy lookup by id (upstream-proxy). Returns the
+     * DECRYPTED `ProxyConfig` for the account (`readConfig` decrypts on read), or
+     * `undefined` for an unknown provider/account or no per-account proxy. Feeds the
+     * winning per-account layer of the upstream-proxy resolver. Synchronous like the
+     * other hot reads. Never returns token material.
+     */
+    getAccountProxy(providerId: string, accountId: string): ProxyConfig | undefined;
     /**
      * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
      * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
@@ -478,6 +618,17 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * Used by the admin accounts GET (secret-IN-never-OUT).
      */
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
+    /**
+     * List-time credential-conflict warnings (external-cli-sync). Computed, not
+     * persisted: (a) `duplicate-token` when two accounts of one provider share a
+     * credential, (b) `external-divergent` when the external CLI native store has
+     * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
+     * a failed refresh (`external-not-rotated`) takes precedence — it is the most
+     * actionable state.
+     */
+    private attachSyncWarnings;
+    /** Read the external CLI store, never letting an fs/parse error escape. */
+    private safeReadExternal;
     /**
      * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
      * the block has no refresh_token (setup-token / manual) — no upstream call, the
@@ -501,6 +652,115 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * destroy the ability to refresh again). HONEST `false` when no refresh_token.
      */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Refresh a SPECIFIC account by id (background scheduler sweep,
+     * external-cli-sync). Unlike the active-account refreshers it does NOT
+     * attempt the external-import fallback — the external CLI file's lineage can
+     * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
+     * failure flags ONLY that account `expired`.
+     */
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini', id: string): Promise<boolean>;
+    /**
+     * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
+     * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
+     * (refresh is 401-driven, like `getValidClaudeAccessToken`); codex/gemini refresh
+     * a near-expiry token via `refreshAccountById` (like `resolveAccessToken`);
+     * opencodego returns the account's static key. `null` when unknown/expired/
+     * tokenless.
+     */
+    getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+    /**
+     * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
+     * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
+     * → `false` (no refresh affordance).
+     */
+    refreshAccountToken(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
+    /**
+     * Best-effort record of a selection time onto the account's `lastUsedAt` by id
+     * (design D4). Entry-metadata only (the token mirror is untouched); a no-op for
+     * an unknown id. The selector throttles the call frequency, so this stays cheap.
+     */
+    touchAccountLastUsed(providerId: SubscriptionProviderId, accountId: string, iso: string): Promise<void>;
+    /**
+     * Best-effort write-through of a per-account client `identity`
+     * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
+     * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
+     * an unknown id. Called by the identity store's persistence port on a first-seen
+     * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+     * store's port wrapper swallows a rejection so the relay hot path is unaffected.
+     */
+    setAccountIdentity(providerId: SubscriptionProviderId, accountId: string, identity: AccountClientIdentity): Promise<void>;
+    /**
+     * DAEMON-ONLY set-priority (subscription-account-scheduling, admin write, NOT on
+     * the port). Set one account's scheduling `priority` by id. Secret-free
+     * (entry-metadata only; the mirror invariant is untouched). Rejects an unknown id.
+     */
+    setAccountPriority(providerId: SubscriptionProviderId, accountId: string, priority: number): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
+     * the port). Passing `undefined` clears the override. Write-only password: when
+     * the incoming structured proxy omits the password but the account already had
+     * one, the current (decrypted) password is preserved — editing host/port never
+     * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
+     */
+    setAccountProxy(providerId: SubscriptionProviderId, accountId: string, proxy: ProxyConfig | undefined): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * DAEMON-ONLY set/clear per-account `supportedModels` (subscription-account-
+     * model-map, admin write, NOT on the port). Passing `undefined` clears it.
+     * Secret-free (model ids only; the mirror invariant is untouched). Rejects an
+     * unknown id.
+     */
+    setAccountSupportedModels(providerId: SubscriptionProviderId, accountId: string, supportedModels: string[] | Record<string, string> | undefined): Promise<{
+        ok: boolean;
+    }>;
+    /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
+    private refreshUpstream;
+    /**
+     * External-import fallback for a FAILED active-account refresh
+     * (external-cli-sync). Reads the CLI native store; imports when the external
+     * lineage ROTATED (different refresh token) or its access token is still
+     * valid. When the imported access token is already expired it refreshes once
+     * with the rotated refresh token. A `not-rotated` outcome persists the
+     * `external-not-rotated` warning on the (about-to-be-expired) account so the
+     * UI can tell "genuine revocation" apart from a plain refresh failure.
+     */
+    private tryExternalImport;
+    /**
+     * Marker-gated external write-back (external-cli-sync). After a successful
+     * refresh of the account that OWNS the provider's native CLI store (imported
+     * via `importExternalCliAccount`), push the rotated credential back into the
+     * file — otherwise the daemon's refresh invalidates the single-use refresh
+     * token and silently logs the bare CLI out. NON-FATAL: the internal store is
+     * already persisted; a failed external write only leaves the file stale,
+     * which the `external-divergent` warning surfaces.
+     */
+    private resyncExternal;
+    /** Read the marker's owning account id, never letting an fs error escape. */
+    private safeReadMarker;
+    /**
+     * DAEMON-ONLY (admin import button): which providers have a usable external
+     * CLI credential on THIS machine. Pure detection — reads the native files,
+     * never mutates anything, never returns a token.
+     */
+    listExternalCliAvailability(): Promise<Record<ExternalCliProvider, boolean>>;
+    /**
+     * DAEMON-ONLY (admin import button): import the external CLI's current login
+     * as a NEW account (+ activate), and take MANAGED ownership of the native
+     * store (marker) so subsequent refreshes write back — keeping the bare CLI
+     * and the daemon on the same live credential instead of silently killing one
+     * side's single-use refresh token.
+     */
+    importExternalCliAccount(provider: ExternalCliProvider, label?: string): Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        reason: 'no-credential';
+    }>;
     /**
      * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
      * single-slot file, `readConfig` synthesizes a NON-deterministic account id
@@ -555,6 +815,14 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     removeAccount(providerId: SubscriptionProviderId, id: string): Promise<{
         removed: boolean;
     }>;
+    /**
+     * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
+     * rejects an unknown id. Label-only — no token material is read or written
+     * (the secret-free invariant holds).
+     */
+    renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
+        ok: boolean;
+    }>;
     /**
      * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
      * block from `tokens.json` and re-persist (the strategies already tolerate an
@@ -614,7 +882,40 @@ interface SubscriptionTokenWriter {
     removeAccount(providerId: SubscriptionProviderId, id: string): Promise<{
         removed: boolean;
     }>;
+    /** Rename one account's label (label-only; rejects an unknown id). */
+    renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
+        ok: boolean;
+    }>;
+    /** Set one account's scheduling priority (secret-free; rejects an unknown id).
+     *  subscription-account-scheduling — lets an operator order a pool. */
+    setAccountPriority(providerId: SubscriptionProviderId, id: string, priority: number): Promise<{
+        ok: boolean;
+    }>;
+    /** Set (or CLEAR, with `undefined`) one account's per-account proxy override
+     *  (upstream-proxy). The `proxy.password` is a secret (encrypted at rest, masked
+     *  in the sanitized view). Rejects an unknown id. */
+    setAccountProxy(providerId: SubscriptionProviderId, id: string, proxy: ProxyConfig | undefined): Promise<{
+        ok: boolean;
+    }>;
+    /** Set (or CLEAR, with `undefined`) one account's `supportedModels`
+     *  (subscription-account-model-map). Secret-free (model ids only). Rejects an
+     *  unknown id. An array = allow-list (skip-only); an object = allow-list keys +
+     *  logical→actual remap values. */
+    setAccountSupportedModels(providerId: SubscriptionProviderId, id: string, supportedModels: string[] | Record<string, string> | undefined): Promise<{
+        ok: boolean;
+    }>;
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
+    refreshClaudeToken(): Promise<boolean>;
+    refreshCodexToken(): Promise<boolean>;
+    refreshGeminiToken(): Promise<boolean>;
+    listExternalCliAvailability(): Promise<Record<'claude' | 'codex', boolean>>;
+    importExternalCliAccount(providerId: 'claude' | 'codex', label?: string): Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        reason: 'no-credential';
+    }>;
 }
 
 /**
@@ -778,6 +1079,239 @@ declare class CodexOAuthSessionStore {
     private sweep;
 }
 
+/**
+ * ProbeStrategy — the per-provider two-tier probe plan
+ * (subscription-account-probe #8, design D1).
+ *
+ * A `ProbePlan` says HOW to probe one provider's account, cheapest signal first:
+ *  - `{ kind: 'local' }` — no upstream call. The scheduler's free local tier reads
+ *    the account's token via the credential store; a missing/expired-unrefreshable
+ *    token is a dead account (recorded as a synthesized 401). A provider is
+ *    local-only until a cheap authed GET endpoint is VERIFIED (the omnicross
+ *    `// UNVERIFIED` convention) — Phase 1 ships codex/gemini/opencodego local-only
+ *    (LEAD OQ1: never GUESS a billable/wrong endpoint).
+ *  - `{ kind: 'upstream'; url; buildInit(token) }` — a minimal AUTHED GET the
+ *    scheduler issues through #3's proxy-aware `fetchUpstream`. Phase 1 wires ONLY
+ *    claude → `GET https://api.anthropic.com/v1/models` (a verified free list;
+ *    NEVER a billable completion). The scheduler adds the timeout `signal` +
+ *    `{ providerId, accountId }` ctx; `buildInit` supplies method + auth header.
+ *
+ * NEVER put a body / max_tokens here — a probe must cost nothing (design D1).
+ *
+ * @module @omnicross/daemon/probe/ProbeStrategy
+ */
+
+/** How to probe one provider's account (design D1). */
+type ProbePlan = {
+    kind: 'local';
+} | {
+    kind: 'upstream';
+    /** The cheap, free, authed GET endpoint. */
+    url: string;
+    /** Build the minimal request init (method + Authorization only — no body). */
+    buildInit(token: string): RequestInit;
+};
+
+/**
+ * AccountHealthProbeScheduler — the scheduled ACTIVE account-health probe
+ * (subscription-account-probe #8, design D1–D6).
+ *
+ * #2's health machine is PASSIVE — an account is only found dead when a REAL
+ * request hits it and fails. This scheduler is the active complement: on a plain
+ * `unref()`ed interval (omnicross has no cron dep) it runs a CHEAP per-account
+ * probe and feeds the outcome into #2's EXISTING shared tracker
+ * (`recordUpstreamOutcome`) — inventing no new marking path. Modeled EXACTLY on
+ * `AccountHealthSweeper`: `start()` arms the timer, `dispose()` clears it, a
+ * single-sweep re-entrancy guard prevents overlap.
+ *
+ * TWO-TIER, cheapest-first (design D1):
+ *  1. FREE local — read the account's token via the credential store; no usable
+ *     token ⇒ dead ⇒ a synthesized `401` outcome, NO upstream call.
+ *  2. Minimal AUTHED upstream GET (only providers with a VERIFIED cheap endpoint)
+ *     via #3's proxy-aware `fetchUpstream` with a short timeout.
+ *
+ * SAFE tracker mapping (LEAD constraint, mirrors #2's bare-429 discipline):
+ * **401/403 → mark; 2xx → clear transient; 429 / 5xx / thrown/timeout → NEVER a
+ * mark** (a probe rate-limit or upstream blip must not blacklist a healthy
+ * account). So only 401/403/2xx are forwarded to the tracker; the rest are
+ * history-only. NEVER a billable probe — the upstream tier is a free authed GET.
+ *
+ * NEVER-STRAND: marking flows through #2, whose ≥2-account gate (in the strategy's
+ * schedulable derivation) keeps a marked SOLE account schedulable — so a probe can
+ * never strand a single-account user. `onlyMultiAccount` (default) additionally
+ * skips single-account providers entirely.
+ *
+ * ZERO REGRESSION: default `enabled:false` ⇒ `start()` never arms + `sweep()`
+ * early-returns ⇒ no probes, no `/health` boolean, byte-identical.
+ *
+ * @module @omnicross/daemon/AccountHealthProbeScheduler
+ */
+
+/** One rolling probe result (design D4; in-memory, cleared on restart). */
+interface ProbeRecord {
+    /** Epoch ms of the probe. */
+    ts: number;
+    /** Whether the probe observed a HEALTHY signal (2xx upstream / token-present local). */
+    ok: boolean;
+    /** The HTTP status (`null` = thrown/timeout); absent for a token-present local record. */
+    status?: number | null;
+    /** Upstream round-trip latency (ms); absent for a local-tier record. */
+    latencyMs?: number;
+    /** Which tier produced this record. */
+    tier: 'local' | 'upstream';
+}
+/** Per-account probe history for the authed admin surface (names account ids). */
+interface AccountProbeHistorySnapshot {
+    providerId: string;
+    accountId: string;
+    records: ProbeRecord[];
+}
+/**
+ * The read surface the AUTHED admin route consumes (subscription-account-probe,
+ * design D5). Structurally satisfied by {@link AccountHealthProbeScheduler}; typed
+ * narrow so the admin layer carries no scheduler coupling.
+ */
+interface AccountProbeHistoryReader {
+    getAllHistory(): AccountProbeHistorySnapshot[];
+}
+/** The narrow credential-store surface the scheduler reads (#1 seams). */
+interface ProbeCredentialStore {
+    getFullConfig(): Promise<AccountTokensConfig>;
+    getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+}
+/** Proxy-aware upstream fetch signature (#3 `fetchUpstream`). */
+type ProbeFetch = typeof fetchUpstream;
+/** Injectable test seams (all default to production behavior). */
+interface ProbeSchedulerOptions {
+    /** Injectable clock (ms). Default `Date.now`. */
+    now?: () => number;
+    /** Injectable proxy-aware fetch (#3). Default `fetchUpstream`. */
+    fetchImpl?: ProbeFetch;
+    /** Injectable inter-probe delay (stagger). Default a real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable per-provider probe-plan resolver. Default {@link probePlanFor}. */
+    planFor?: (providerId: string) => ProbePlan;
+}
+declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
+    private readonly store;
+    private readonly health;
+    private readonly logger;
+    private config;
+    private timer;
+    private sweeping;
+    private readonly history;
+    private readonly now;
+    private readonly fetchImpl;
+    private readonly sleep;
+    private readonly planFor;
+    constructor(store: ProbeCredentialStore, health: SubscriptionAccountHealth, logger: Logger, config: AccountProbeConfig, opts?: ProbeSchedulerOptions);
+    /** Whether probing is enabled by the current config. */
+    get enabled(): boolean;
+    /**
+     * Re-apply config to the live instance (the async `start.ts` loads the persisted
+     * `accountProbe` segment after `buildDaemon`). Call BEFORE `start()`.
+     */
+    configure(config: AccountProbeConfig): void;
+    /** Arm the probe interval. No-op when disabled (zero regression). Idempotent. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: probe every ELIGIBLE account SEQUENTIALLY with a `staggerMs` gap.
+     * Disabled ⇒ no-op. `onlyMultiAccount` skips single-account providers. Exposed
+     * for tests; never throws.
+     */
+    sweep(): Promise<void>;
+    /**
+     * Probe ONE account (design D1). Local tier first (dead token → synthesized 401,
+     * no upstream); else the upstream tier when a verified endpoint exists. Records
+     * the rolling history entry either way; returns whether the tracker was MARKED.
+     */
+    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<{
+        ok: boolean;
+        marked: boolean;
+    }>;
+    /** Per-account rolling history for the authed admin surface (design D5). */
+    getAllHistory(): AccountProbeHistorySnapshot[];
+    /**
+     * The coarse, account-ANONYMOUS `/health` signal (design D5): `true` when no
+     * probed account is currently unhealthy (per #2's tracker). No ids, no counts —
+     * safe for the unauthenticated `/health`. Vacuously `true` when nothing probed.
+     */
+    probedAccountsHealthy(now?: number): boolean;
+    /**
+     * Feed ONLY the account/auth-decisive statuses to #2 (LEAD constraint):
+     * 401/403 → mark; 2xx → clear transient; 429 / 5xx / other 4xx / null →
+     * NOT forwarded (never a mark). Returns whether a NEGATIVE mark was applied.
+     */
+    private applyOutcome;
+    /** Append a record, capping the ring at `historySize` (drop oldest). */
+    private record;
+    /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
+    private readBounded;
+    private key;
+    private parseKey;
+}
+
+/**
+ * auditReader — read + filter the date-rotated audit store (request-audit-log,
+ * design D4/D6). Backs the AUTHED admin query only (the records carry IP/UA +
+ * possibly bodies). Reads the relevant `audit-*.jsonl` files, parses defensively
+ * (a torn final line never poisons a query), filters by key id + time window, and
+ * returns NEWEST-FIRST up to a bounded limit.
+ *
+ * @module @omnicross/daemon/audit/auditReader
+ */
+
+/** Filters for an audit query (all optional). */
+interface AuditQuery {
+    /** Restrict to one outbound key id. */
+    keyId?: string;
+    /** Inclusive lower bound (epoch ms). */
+    from?: number;
+    /** Inclusive upper bound (epoch ms). */
+    to?: number;
+    /** Max rows (default 200, capped 2000). */
+    limit?: number;
+}
+
+/**
+ * auditQueryApi — the AUTHED `GET /admin/api/audit?keyId=&from=&to=&limit=`
+ * handler (request-audit-log, design D6).
+ *
+ * Audit records carry client IP / user-agent (PII) and, when body capture is on,
+ * redacted bodies — so unlike the coarse `/health` boolean they are served ONLY
+ * behind the admin auth gate. This lives in its OWN helper module (the
+ * #4/#8/#10 helper-module convention) so `adminApi.ts` — at its line cap — is not
+ * touched: `AdminServer.dispatch` routes the path here directly, AFTER its auth
+ * gate. NEVER unauthenticated, NEVER surfaced on `/health`.
+ *
+ * SECRET-FREE by construction: it returns exactly the stored records, which never
+ * hold key material / tokens / Authorization (headers are never captured).
+ *
+ * @module @omnicross/daemon/admin/auditQueryApi
+ */
+
+/** The read surface the AdminServer consumes (bootstrap binds it to the store). */
+type AuditQueryReader = (query: AuditQuery) => AuditRecord[];
+
+/**
+ * billingStatusApi — the AUTHED `GET /admin/api/billing-status` handler
+ * (billing-event-stream, design D5/P2).
+ *
+ * Returns the SECRET-FREE aggregate delivery status of the durable billing ledger
+ * (total / delivered / pending counts) so the admin UI can show a delivery
+ * indicator. Lives in its OWN helper module (the #4/#8/#10/#13 convention) so
+ * `adminApi.ts` — at its line cap — is not touched: `AdminServer.dispatch` routes
+ * the path here directly, AFTER its auth gate. Carries no secret and no event
+ * payload — only counts.
+ *
+ * @module @omnicross/daemon/admin/billingStatusApi
+ */
+
+/** The read surface the AdminServer consumes (bootstrap binds it to the ledger dir). */
+type BillingStatusReader = () => BillingDeliveryStatus;
+
 /**
  * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
  *
@@ -919,13 +1453,129 @@ declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
 
 declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
     private readonly configPath;
-    constructor(configPath: string);
+    private readonly box;
+    /**
+     * @param configPath the daemon config.json whose `server` field is backed.
+     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
+     *                    `server.proxy.*` passwords are encrypted-on-`set` /
+     *                    decrypted-on-`get` (the settings-store path is otherwise not
+     *                    secret-aware — every OTHER server field is non-secret). Null
+     *                    ⇒ passthrough (legacy/pure tests unchanged).
+     */
+    constructor(configPath: string, box?: SecretBox | null);
     get<T = unknown>(key: string): Promise<T | undefined>;
     set<T = unknown>(key: string, value: T): Promise<void>;
+    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
+    private encryptSecrets;
+    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
+    private decryptSecrets;
     /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
     private readFile;
 }
 
+/**
+ * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
+ *
+ * Durable storage for the model pricing table, backed by a pretty-printed json
+ * file (a sibling of `config.json`, `pricing.json` by convention) holding a
+ * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
+ * every mutation rewrites the full array (the table is at most a few thousand
+ * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
+ * seeding — the first pricing-source refresh (or a manual upsert) populates it.
+ *
+ * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
+ * frozen; the admin DELETE route calls the concrete class and then invalidates
+ * the engine cache).
+ *
+ * @module @omnicross/daemon/ports/JsonPricingStore
+ */
+
+declare class JsonPricingStore implements PricingStore {
+    private readonly pricingPath;
+    constructor(pricingPath: string);
+    getAll(): Promise<PricingEntry[]>;
+    /**
+     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
+     * user provenance (source 'user', userEdited, editedAt now) so the row is
+     * protected from auto-overwrite during source refreshes; a non-user upsert
+     * stamps source 'litellm' and clears nothing it should not (a plain source
+     * upsert through this method overwrites the row wholesale).
+     */
+    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
+    /**
+     * Apply a batch fetched from a pricing source. Rows whose local copy is
+     * user-edited are NOT applied — they come back as `{ current, incoming }`
+     * conflicts; everything else is upserted (source 'litellm'). ONE file write
+     * for the whole batch.
+     */
+    bulkApplyFromSource(entries: PricingEntryInput[]): Promise<{
+        applied: PricingEntry[];
+        conflicts: Array<{
+            current: PricingEntry;
+            incoming: PricingEntryInput;
+        }>;
+    }>;
+    /**
+     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
+     * the incoming values (clearing the user-edited mark), 'skip' counts only.
+     */
+    applyResolutions(resolutions: Array<{
+        incoming: PricingEntryInput;
+        action: 'overwrite' | 'skip';
+    }>): Promise<PricingResolution>;
+    /**
+     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
+     * was actually removed. The admin DELETE handler calls this then invalidates
+     * the engine cache.
+     */
+    delete(providerId: string, modelId: string): Promise<boolean>;
+    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
+    private applyUpsert;
+    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
+    private readRows;
+    private writeRows;
+}
+
+/**
+ * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
+ * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
+ *
+ * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
+ * same `@omnicross/cli-launcher` builders (which register one route on the
+ * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
+ * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
+ * NEW terminal window running the CLI with that env injected. The route token —
+ * NOT an upstream credential — is the only secret in the env; it is removed when
+ * the session is stopped (`onSessionEnd`).
+ *
+ * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
+ * never a provider key. On win32 the token rides the spawned process environment
+ * (inherited by the terminal), never the command line / a file on disk.
+ *
+ * @module @omnicross/daemon/admin/cliLaunch
+ */
+
+/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
+type PathProbe = (candidate: string) => string | null;
+/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalOpener = (input: {
+    cli: string;
+    command: string;
+    extraArgs: string[];
+    env: Record<string, string>;
+    cwd?: string;
+    platform: NodeJS.Platform;
+}) => void;
+/**
+ * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
+ * default execs the install command with a bounded timeout). Returns the host's
+ * honest install outcome — `error` carries stderr/the failure reason.
+ */
+type CommandRunner = (command: string) => Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+
 /**
  * migration.ts — the export gather + import apply logic for the passphrase pack
  * (app-parity child 6, design D2/D3/D5).
@@ -1012,6 +1662,18 @@ interface AdminApiDeps {
     readonly llmConfig: ConfigFileProviderConfigSource;
     /** Named outbound-key store. */
     readonly keyDb: OutboundKeyDb;
+    /**
+     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
+     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
+     * surface returns 501 (feature not available in this build).
+     */
+    readonly voucherDb?: VoucherDb;
+    /**
+     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
+     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
+     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
+     */
+    readonly keySpendReader?: KeySpendReader;
     /** Outbound server settings store (server config persistence). */
     readonly settingsStore: JsonApiServerSettingsStore;
     /** The running outbound server (status + live applyConfig). */
@@ -1072,6 +1734,32 @@ interface AdminApiDeps {
      * Wired from the concrete `credentialStore` in `bootstrap.ts`.
      */
     readonly migrationCredentialStore: MigrationCredentialStore;
+    /**
+     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
+     * usage-event store. Aggregates only; carries no key material.
+     */
+    readonly usageRecorder: UsageRecorder;
+    /** Pricing engine (upsert / source refresh / conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /**
+     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
+     * `PricingStore` port is frozen; delete is a daemon-local extra).
+     */
+    readonly pricingStore: JsonPricingStore;
+    /**
+     * External-terminal opener for the Code CLI launch route (dashboard parity).
+     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
+     * no terminal window is actually spawned.
+     */
+    readonly cliTerminalOpener?: TerminalOpener;
+    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
+    readonly cliPathProbe?: PathProbe;
+    /**
+     * Injectable shell runner for the Code CLI install route. Optional — defaults
+     * to the real `exec`-based runner; tests inject a stub so no package manager
+     * actually runs.
+     */
+    readonly cliCommandRunner?: CommandRunner;
 }
 /**
  * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
@@ -1098,8 +1786,9 @@ declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerRespo
  *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
  *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
  *
- * Routing: `GET /` (and `GET /admin`) → `DASHBOARD_HTML`; `* /admin/api/*` → the
- * management API (`handleAdminApi`); everything else → `404`.
+ * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
+ * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
+ * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
  *
  * @module @omnicross/daemon/admin/AdminServer
  */
@@ -1108,6 +1797,40 @@ declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerRespo
 interface AdminServerDeps extends AdminApiDeps {
     /** Read the resolved admin config (enabled/port/networkBinding/token). */
     getAdminConfig: () => ResolvedAdminConfig;
+    /**
+     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
+     * shared closure over live handles (bootstrap wires the SAME builder into the
+     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
+     */
+    getHealthReport: () => HealthReport;
+    /**
+     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
+     * lines (bind/refuse/error) route through it so they honor the configured
+     * level / format / file sink.
+     */
+    logger: Logger;
+    /**
+     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
+     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
+     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
+     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
+     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
+     */
+    probeHistoryReader?: AccountProbeHistoryReader;
+    /**
+     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
+     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
+     * returns filtered records. Absent ⇒ the route serves an empty list. The
+     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
+     * unauthenticated, NEVER on `/health`.
+     */
+    auditReader?: AuditQueryReader;
+    /**
+     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
+     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
+     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
+     */
+    billingStatusReader?: BillingStatusReader;
 }
 /** A live status snapshot for the admin listener. */
 interface AdminServerStatus {
@@ -1122,6 +1845,8 @@ declare class AdminServer {
     private server;
     private boundPort;
     private boundAddr;
+    /** Control Panel dist dir (resolved once at first request; null = no UI). */
+    private uiDist;
     constructor(deps: AdminServerDeps);
     /**
      * Start the admin listener honoring the resolved admin config. Returns the
@@ -1142,24 +1867,6 @@ declare class AdminServer {
     getStatus(): AdminServerStatus;
 }
 
-/**
- * ConsoleLogger — the daemon's file-less default `Logger` port impl (design D5).
- *
- * A thin `console.*` wrapper. The serving core depends on the `Logger` port
- * (never a host class), so this trivial implementation is the only logger the
- * standalone daemon needs. `error` uses the WIDEST `(message, error?, meta?)`
- * signature so every core call site stays assignable.
- *
- * @module @omnicross/daemon/ports/ConsoleLogger
- */
-
-declare class ConsoleLogger implements Logger {
-    info(message: string, meta?: Record<string, unknown> | Error | object): void;
-    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
-    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
-    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
-}
-
 /**
  * JsonOutboundKeyDb — the daemon's file-backed `OutboundKeyDb` port impl
  * (design D3).
@@ -1189,6 +1896,9 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
+    outboundApiKeysSetMaxConcurrency(id: string, maxConcurrency: number | null): Promise<boolean>;
+    outboundApiKeysSetPolicy(id: string, policy: OutboundKeyPolicy): Promise<boolean>;
+    outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
     /** Apply `fn` to the row with `id`, persisting when it returns true. */
     private mutateRow;
     /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
@@ -1196,17 +1906,428 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     private writeRows;
 }
 
+/**
+ * AccountHealthSweeper — proactive account-health recovery tick
+ * (subscription-account-health, design D6).
+ *
+ * The health tracker (`@omnicross/core` `SubscriptionAccountHealth`) already
+ * self-heals LAZILY: an elapsed cooldown restores an account on the next
+ * `isSchedulable` read, so CORRECTNESS never depends on this sweeper. What the
+ * tick adds is PROACTIVITY for IDLE accounts (no traffic to trigger a lazy read):
+ *   - it fires the tracker's recovery SIGNAL (the seam #5 webhooks + #8
+ *     health-cron consume — this child only emits it), and
+ *   - it optionally nudges a fresh token for a recovered OAuth account so it
+ *     resumes instantly instead of paying refresh latency on its first request.
+ *
+ * Modeled EXACTLY on `TokenRefreshScheduler`: `start()` arms an `unref()`ed 60s
+ * timer, `dispose()` clears it, and a single-sweep re-entrancy guard means a
+ * long sweep never overlaps the next tick.
+ *
+ * @module @omnicross/daemon/AccountHealthSweeper
+ */
+
+declare class AccountHealthSweeper {
+    private readonly store;
+    private readonly health;
+    private readonly logger;
+    private readonly intervalMs;
+    private readonly leadMs;
+    private timer;
+    private sweeping;
+    constructor(store: JsonSubscriptionCredentialStore, health: SubscriptionAccountHealth, logger: Logger, intervalMs?: number, leadMs?: number);
+    /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: surface accounts that just recovered (emits the recovery signal
+     * through the tracker's hook) and nudge a fresh token for any recovered OAuth
+     * account whose token is near expiry. Exposed for tests. Never throws.
+     */
+    sweep(now?: number): Promise<void>;
+    /** Expiring within the lead window, refreshable, and not already dead. */
+    private needsRefresh;
+    /** Refresh one recovered account by id; failures are logged, never thrown. */
+    private refreshOne;
+}
+
+/**
+ * AuditPruneSweeper — the TTL prune for the audit store (request-audit-log,
+ * design D4). Deletes whole `audit-YYYY-MM-DD.jsonl` files whose date is older
+ * than `retentionDays` — a cheap file UNLINK, never a line-level rewrite of a
+ * live file (which jsonl makes awkward). So the store never grows unbounded and
+ * TTL is O(files).
+ *
+ * Modeled on the #8 `AccountHealthProbeScheduler` / `AccountHealthSweeper`:
+ * `start()` arms an `unref()`ed interval, `dispose()` clears it, a single-sweep
+ * re-entrancy guard prevents overlap. A prune ALSO runs once at boot (`start`
+ * fires an immediate sweep). Disabled/zero-retention config ⇒ armed-off ⇒ no-op
+ * (byte-identical zero regression). Never throws.
+ *
+ * @module @omnicross/daemon/audit/AuditPruneSweeper
+ */
+
+declare class AuditPruneSweeper {
+    private readonly auditDir;
+    private readonly logger;
+    private config;
+    private readonly intervalMs;
+    /** Injectable clock (ms) for deterministic tests. */
+    private readonly now;
+    private timer;
+    private sweeping;
+    constructor(auditDir: string, logger: Logger, config: AuditConfig, intervalMs?: number, 
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number);
+    /** Whether pruning is active (audit enabled). */
+    get enabled(): boolean;
+    /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+    configure(config: AuditConfig): void;
+    /**
+     * Arm the prune interval AND run one prune immediately (boot cleanup). No-op
+     * when audit is disabled (zero regression). Idempotent.
+     */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One prune: unlink every audit date file strictly OLDER than the retention
+     * cutoff (`now - retentionDays` days, at local-midnight granularity). Exposed
+     * for tests; never throws. Returns the number of files removed.
+     */
+    sweep(): Promise<number>;
+}
+
+/**
+ * AuditWriter — the daemon's file-backed audit sink (request-audit-log, design
+ * D4/D5). Registered as `@omnicross/core`'s audit sink when audit is enabled; its
+ * {@link record} is what `recordAudit` hands each assembled record to.
+ *
+ * FIRE-AND-FORGET (hard constraint): {@link record} DEFERS the fs append off the
+ * caller's stack (an injectable `defer`, default a zero-delay timer — the
+ * `UsageRecorder` precedent) and returns immediately, so the relay response path
+ * never waits on disk I/O. A write error is swallowed + logged (a failing audit
+ * store must never affect a relay). Each record is appended as ONE JSON line to
+ * `audit/audit-YYYY-MM-DD.jsonl` (the record's LOCAL date), matching the
+ * `usage-events.jsonl` pattern — no new dependency, TTL is a whole-file unlink.
+ *
+ * @module @omnicross/daemon/audit/AuditWriter
+ */
+
+declare class AuditWriter {
+    private readonly auditDir;
+    private readonly logger;
+    /** Deferral used by `record()` to schedule the append off the caller's path. */
+    private readonly defer;
+    private dirEnsured;
+    constructor(auditDir: string, logger: Logger, 
+    /** Deferral used by `record()` to schedule the append off the caller's path. */
+    defer?: (fn: () => void) => void);
+    /**
+     * Enqueue one record for append. Returns IMMEDIATELY (fire-and-forget); the fs
+     * write happens on the deferred tick. A failure is logged, never thrown.
+     */
+    record(record: AuditRecord): void;
+    /**
+     * Append synchronously — the awaitable form tests use to assert the line landed.
+     * Ensures the `audit/` directory exists on first write (lazy, like the usage
+     * store's lazy file creation).
+     */
+    appendNow(record: AuditRecord): void;
+}
+
+/**
+ * BillingPublisher — the daemon's durable-first billing sink (billing-event-stream,
+ * design D2/D4). Registered as `@omnicross/core`'s billing sink when billing is
+ * enabled; its {@link record} is what `publishBillingEvent` hands each assembled
+ * event.
+ *
+ * DURABLE-FIRST (THE key decision, design D2): {@link record}
+ *  1. APPENDS the event as one JSON line to `billing/billing-YYYY-MM-DD.jsonl` —
+ *     SYNCHRONOUSLY, BEFORE any delivery attempt. This is the DURABLE source of
+ *     truth: once appended, the event is NEVER lost, even if the process crashes
+ *     or every delivery attempt fails. A billing ledger is a financial record.
+ *  2. then, only when an `endpoint` is configured, schedules a best-effort POST
+ *     OFF the caller's stack (an injectable `defer`, default a zero-delay timer)
+ *     so {@link record} RETURNS IMMEDIATELY — a slow/failing endpoint never blocks
+ *     the caller (which is already off the relay response path). Ledger-only mode
+ *     (no `endpoint`) simply appends — an external tailer consumes the jsonl.
+ *  3. on a POST ack, appends a delivery marker (`delivered-YYYY-MM-DD.jsonl`); on
+ *     failure the event stays UNdelivered in the ledger for the retry sweep +
+ *     external reconciliation. A delivery failure NEVER drops the event.
+ *
+ * At-least-once: the consumer dedupes on the event `id` (the request id). The
+ * built-in POST optionally signs the body with `X-Omnicross-Billing-Signature:
+ * sha256=<hmac hex>` (node `crypto`, no new dep). The signing `secret` is used
+ * ONLY to sign — it NEVER appears in the payload or a log line. Egress is #3's
+ * proxy-aware `fetchUpstream` (global proxy).
+ *
+ * @module @omnicross/daemon/billing/BillingPublisher
+ */
+
+/** The minimal `fetch` shape the publisher POSTs through (proxy-aware by default). */
+type BillingFetch = (url: string, init: RequestInit) => Promise<Response>;
+/** Constructor knobs (all optional; test seams for fetch/defer/clock). */
+interface BillingPublisherOptions {
+    /** Egress fn; defaults to #3's proxy-aware `fetchUpstream` (global proxy only). */
+    fetchImpl?: BillingFetch;
+    /** Deferral used by `record()` to schedule the POST off the caller's path. */
+    defer?: (fn: () => void) => void;
+    timeoutMs?: number;
+    /** Clock seam for delivery-marker timestamps (tests fix it). */
+    now?: () => number;
+}
+declare class BillingPublisher {
+    private readonly billingDir;
+    private readonly logger;
+    private config;
+    private dirEnsured;
+    private readonly fetchImpl;
+    private readonly defer;
+    private readonly timeoutMs;
+    private readonly now;
+    constructor(billingDir: string, logger: Logger, opts?: BillingPublisherOptions);
+    /** Install/replace the live billing config (endpoint + secret + retry bound). */
+    setConfig(config: BillingConfig | undefined): void;
+    /**
+     * Record one billing event. DURABLE-FIRST: append synchronously (the event is
+     * now on disk, never lost), THEN schedule a best-effort POST off the caller's
+     * stack (non-blocking; ledger-only when no endpoint). Returns IMMEDIATELY and
+     * NEVER throws — a failing append/POST is logged, never propagated.
+     */
+    record(event: BillingEvent): void;
+    /**
+     * Append the event as one JSON line to `billing-YYYY-MM-DD.jsonl` (the event's
+     * LOCAL date). Synchronous — the awaitable form tests use to assert the ledger
+     * line landed BEFORE any delivery. Ensures the `billing/` directory on first write.
+     */
+    appendNow(event: BillingEvent): void;
+    /**
+     * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
+     * event JSON to the configured endpoint (optionally HMAC-signed); on a 2xx ack
+     * appends a delivery marker and returns `true`. Any non-2xx / thrown / timed-out
+     * attempt returns `false` — the event stays UNdelivered in the ledger (never
+     * lost). NEVER rejects. A no-op `false` when no endpoint is configured.
+     */
+    deliverNow(event: BillingEvent): Promise<boolean>;
+    /**
+     * Append a delivery marker `{ id, deliveredAt }` to `delivered-YYYY-MM-DD.jsonl`
+     * (keyed by the EVENT's date so the reader finds both together). Idempotent at
+     * the reconciliation layer — the reader unions marker ids into a delivered set,
+     * so a duplicate marker is harmless. A marker-write failure is logged, never thrown.
+     */
+    markDelivered(event: BillingEvent): void;
+    private ensureDir;
+}
+
+/**
+ * BillingRetrySweeper — the bounded retry + reconciliation sweep for the billing
+ * ledger (billing-event-stream, design D5). Periodically re-POSTs UNdelivered
+ * ledger events (via the publisher's built-in delivery) with a bounded age:
+ *  - an undelivered event WITHIN `maxRetryAgeMs` of its timestamp is re-POSTed
+ *    (the request id makes the re-POST safe — the consumer dedupes);
+ *  - an undelivered event PAST `maxRetryAgeMs` is LEFT in the ledger for external
+ *    reconciliation — it is NEVER deleted (a delivery failure must never drop a
+ *    billing record; the ledger is a financial record, so there is NO prune here,
+ *    unlike the #13 audit TTL);
+ *  - a DELIVERED event (has a marker) is never re-sent (delivery-marking prevents
+ *    double delivery).
+ *
+ * Modeled on the #8/#13 sweepers: `start()` arms an `unref()`ed interval, a
+ * single-sweep re-entrancy guard prevents overlap, `dispose()` clears it. A sweep
+ * ALSO runs once at boot (`start` fires an immediate sweep). Disabled/ledger-only
+ * (no endpoint) ⇒ armed-off ⇒ no-op. Never throws.
+ *
+ * @module @omnicross/daemon/billing/BillingRetrySweeper
+ */
+
+declare class BillingRetrySweeper {
+    private readonly billingDir;
+    private readonly publisher;
+    private readonly logger;
+    private config;
+    private readonly intervalMs;
+    /** Injectable clock (ms) for deterministic tests. */
+    private readonly now;
+    private timer;
+    private sweeping;
+    constructor(billingDir: string, publisher: BillingPublisher, logger: Logger, config: BillingConfig, intervalMs?: number, 
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number);
+    /** Whether retrying is active: billing enabled AND an endpoint is configured. */
+    get enabled(): boolean;
+    /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+    configure(config: BillingConfig): void;
+    /**
+     * Arm the retry interval AND run one sweep immediately (boot catch-up for events
+     * that failed to deliver while the daemon was down). No-op when disabled or in
+     * ledger-only mode (no endpoint to POST to). Idempotent.
+     */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: re-POST every UNdelivered ledger event still within
+     * `maxRetryAgeMs`; leave over-age undelivered events for reconciliation (NEVER
+     * deleted). Exposed for tests; never throws. Returns the number of events a
+     * re-POST was attempted for.
+     */
+    sweep(): Promise<number>;
+}
+
+/**
+ * TokenRefreshScheduler — proactive background OAuth token refresh
+ * (external-cli-sync).
+ *
+ * The auth strategies already refresh LAZILY (lead-window check before each
+ * request + 401 retry), but a daemon that sits idle past a token's lifetime
+ * pays the refresh latency — or a dead rotated token — on the first request.
+ * This scheduler sweeps every account of every OAuth provider on an interval
+ * and refreshes any token entering the expiry lead window.
+ *
+ * Safety properties:
+ *  - the store coalesces in-flight refreshes per account, so a sweep can never
+ *    double-spend a single-use refresh token against a concurrent lazy refresh;
+ *  - accounts already flagged `expired` are skipped (a dead refresh token is
+ *    not retried every tick — recovery is the external-import fallback or a
+ *    re-login);
+ *  - the ACTIVE account routes through the provider's active refresher (which
+ *    carries the external CLI import fallback); non-active accounts refresh
+ *    by id;
+ *  - one sweep runs at a time (a long sweep never overlaps the next tick).
+ *
+ * Modeled on `ApiKeyPoolService`'s interval lifecycle: `start()` arms an
+ * `unref()`ed timer, `dispose()` clears it.
+ *
+ * @module @omnicross/daemon/TokenRefreshScheduler
+ */
+
+declare class TokenRefreshScheduler {
+    private readonly store;
+    private readonly logger;
+    private readonly intervalMs;
+    private readonly leadMs;
+    private timer;
+    private sweeping;
+    constructor(store: JsonSubscriptionCredentialStore, logger: Logger, intervalMs?: number, leadMs?: number);
+    /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /** One sweep over every account of every OAuth provider. Exposed for tests. */
+    sweep(now?: number): Promise<void>;
+    /** Expiring within the lead window, refreshable, and not already dead. */
+    private needsRefresh;
+    /** Refresh one account; failures are logged, never thrown (the store has
+     *  already flagged the account `expired`). */
+    private refreshOne;
+    private refreshActive;
+}
+
+/**
+ * WebhookDispatcher — the daemon-side fire-and-forget webhook sender
+ * (webhook-notifications, design D4/D5/D6).
+ *
+ * Registered as the core emit sink at bootstrap. {@link emit} pushes the event
+ * onto a bounded in-memory queue and RETURNS IMMEDIATELY — it never awaits a
+ * send and never throws, so a slow/failing/throwing destination can NEVER block
+ * or delay a relay request (the HARD contract). An async drain loop then:
+ *  - matches each event to every enabled destination whose `events` filter
+ *    allows it (absent/empty ⇒ all kinds),
+ *  - sends to the matching destinations CONCURRENTLY,
+ *  - retries a failed send with bounded exponential backoff up to
+ *    `maxAttempts`, then LOGS (via the injected #10 logger) and DROPS it.
+ * The queue is bounded (drop-OLDEST + a one-shot warn) so a runaway source can't
+ * OOM the process.
+ *
+ * Egress is #3's proxy-aware `fetchUpstream` with NO ctx → the GLOBAL proxy only
+ * (webhooks aren't per-account). Signing uses node `crypto` (no new deps):
+ * `custom` → optional `X-Omnicross-Signature: sha256=<hex hmac of body>`;
+ * `feishu` → Feishu's `timestamp` + `sign` (HMAC-SHA256 base64 of
+ * `timestamp\nsecret`) envelope. The destination `secret` is used ONLY to sign;
+ * it is NEVER placed in a payload or a log line.
+ *
+ * @module @omnicross/daemon/webhook/WebhookDispatcher
+ */
+
+/** The minimal `fetch` shape the dispatcher POSTs through (proxy-aware by default). */
+type WebhookFetch = (url: string, init: RequestInit) => Promise<Response>;
+/** Outcome of a single delivery attempt (used by the admin test path). */
+interface WebhookDeliveryResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+/** Constructor knobs (all optional; test seams for fetch/logger/sleep/clock). */
+interface WebhookDispatcherOptions {
+    /** Egress fn; defaults to #3's proxy-aware `fetchUpstream` (global proxy only). */
+    fetchImpl?: WebhookFetch;
+    /** Injected #10 logger for drop/debug lines (never logs a secret). */
+    logger?: Logger;
+    maxAttempts?: number;
+    queueMax?: number;
+    timeoutMs?: number;
+    baseBackoffMs?: number;
+    /** Backoff sleep seam (tests inject an instant/fake sleep). */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock seam for the `test` event `at` + Feishu `timestamp` (tests fix it). */
+    now?: () => number;
+}
+declare class WebhookDispatcher {
+    private config;
+    private readonly queue;
+    private draining;
+    private warnedFull;
+    private readonly fetchImpl;
+    private readonly logger;
+    private readonly maxAttempts;
+    private readonly queueMax;
+    private readonly timeoutMs;
+    private readonly baseBackoffMs;
+    private readonly sleep;
+    private readonly now;
+    constructor(opts?: WebhookDispatcherOptions);
+    /** Install/replace the live webhook config (destinations + master switch). */
+    setConfig(config: WebhookConfig | undefined): void;
+    /**
+     * Enqueue an event and return IMMEDIATELY (fire-and-forget). NEVER awaits a
+     * send, NEVER throws — the drain loop does all sending on a side channel. A
+     * full queue drops the OLDEST event (with a one-shot warn) so a runaway source
+     * can't OOM the process.
+     */
+    emit(event: WebhookEvent): void;
+    /** Drain the queue, sending each event to its matching destinations concurrently. */
+    private drain;
+    /** The enabled destinations whose event filter admits this kind (empty ⇒ all). */
+    private matchingDestinations;
+    /** Send with bounded exponential backoff; log-and-drop after `maxAttempts`. */
+    private sendWithRetry;
+    /** One POST attempt. Returns an outcome; a thrown error becomes `{ ok:false }`. */
+    private sendOnce;
+    /**
+     * ADMIN test path (design D8): deliver a `test` event to ONE destination and
+     * AWAIT the single-attempt result. This is the ONLY awaited send — it runs on
+     * the admin request path (an operator clicking "Test"), NEVER on a relay path,
+     * so awaiting it is safe. Finds the destination regardless of its `enabled`
+     * flag or the master switch (an explicit operator action).
+     */
+    deliverTest(destinationId: string): Promise<WebhookDeliveryResult>;
+}
+
 /**
  * bootstrap.ts — `buildDaemon` wires `@omnicross/core`'s `ProviderProxy` +
  * `OutboundApiServer` STANDALONE (design D6).
  *
  * A DB-backed embedder wires the same `@omnicross/core` surface differently;
- * this standalone wiring makes three SUBSTITUTIONS (file-backed ports replace
- * DB-backed ones) and three SUBTRACTIONS:
+ * this standalone wiring makes SUBSTITUTIONS (file-backed ports replace
+ * DB-backed ones) and SUBTRACTIONS:
  *  - no `CompletionService` (the BYO proxy path doesn't need it),
- *  - no `apiKeyPool` / `usageRecorder` (optional `ProviderProxyDeps`),
  *  - no `anthropicIngressHandlerFactory` (→ `/v1/messages` returns 502 by core's
  *    existing contract — no daemon code needed).
+ * (`apiKeyPool` and `usageRecorder` are NO LONGER subtracted: the pool is wired
+ * for multi-key load balancing, and the usage recorder is wired over the
+ * file-backed pricing/usage stores so every served request is cost-stamped and
+ * persisted to `usage-events.jsonl`.)
  *
  * `getProviderProxy` / `getOutboundApiServer` are module singletons, so the boot
  * smoke test calls `__resetProviderProxyForTests` / `__resetOutboundApiServerForTests`
@@ -1239,10 +2360,26 @@ interface DaemonPaths {
      * hit a real token endpoint. Absent → the global `fetch`.
      */
     oauthExchangeFetch?: FetchLike;
+    /**
+     * TEST SEAM (optional): override the Code CLI external-terminal opener so tests
+     * never spawn a window. Absent → the real `defaultTerminalOpener`.
+     */
+    cliTerminalOpener?: TerminalOpener;
+    /**
+     * TEST SEAM (optional): override the Code CLI PATH probe so tests can fake an
+     * installed CLI. Absent → the real PATH scan.
+     */
+    cliPathProbe?: PathProbe;
+    /**
+     * TEST SEAM (optional): override the Code CLI install command runner so tests
+     * never invoke a real package manager. Absent → the real `exec`-based runner.
+     */
+    cliCommandRunner?: CommandRunner;
 }
 /** The constructed daemon handles the CLI commands operate on. */
 interface Daemon {
-    readonly logger: ConsoleLogger;
+    /** The injected `Logger` port (a `ConfigurableLogger` built from `config.logging`). */
+    readonly logger: Logger;
     readonly llmConfig: ConfigFileProviderConfigSource;
     readonly keyDb: JsonOutboundKeyDb;
     readonly settingsStore: JsonApiServerSettingsStore;
@@ -1264,8 +2401,69 @@ interface Daemon {
     /** Subscription account service (token-free `listAll`) — now exposed for the
      *  admin dashboard's read-only accounts panel (RT3). */
     readonly subscriptionAccounts: SubscriptionAccountService;
+    /** File-backed pricing table (`pricing.json`; concrete for the admin DELETE). */
+    readonly pricingStore: JsonPricingStore;
+    /** Pricing engine (cost calc + source refresh + conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /** Usage recorder over `usage-events.jsonl` — also the admin stats query facade. */
+    readonly usageRecorder: UsageRecorder;
     /** The localhost admin/dashboard HTTP listener (RT3). Started by `start.ts`. */
     readonly adminServer: AdminServer;
+    /**
+     * Proactive background OAuth refresh sweep (external-cli-sync). NOT started
+     * here — `start.ts` arms it for the resident daemon; the short-lived `launch`
+     * boot leaves it off (the lazy strategy refresh covers a single session) but
+     * still disposes it in cleanup.
+     */
+    readonly tokenRefreshScheduler: TokenRefreshScheduler;
+    /**
+     * Proactive account-health recovery sweep (subscription-account-health, D6).
+     * NOT started here — `start.ts` arms it for the resident daemon; disposed in
+     * cleanup. Correctness never depends on it (health self-heals lazily on read).
+     */
+    readonly accountHealthSweeper: AccountHealthSweeper;
+    /**
+     * Scheduled ACTIVE account-health probe (subscription-account-probe #8).
+     * Constructed armed-off with default config (`enabled:false`); `start.ts`
+     * `configure(...)`s it from the persisted `accountProbe` segment and starts it
+     * ONLY when enabled. Disposed in cleanup.
+     */
+    readonly accountHealthProbeScheduler: AccountHealthProbeScheduler;
+    /**
+     * Fire-and-forget webhook sender (webhook-notifications). Wired into the core
+     * emit sink + the #2 health signals by `start.ts`/admin PUT via
+     * `applyWebhookConfig`. INERT until a config enables it (zero regression).
+     */
+    readonly webhookDispatcher: WebhookDispatcher;
+    /**
+     * File-backed audit sink (request-audit-log) — appends each captured record to
+     * `audit/audit-YYYY-MM-DD.jsonl` fire-and-forget. Registered as the core sink
+     * (via the audit runtime slot) by `start.ts`/admin PUT ONLY when the `audit`
+     * segment is enabled. INERT until then (no sink ⇒ capture hook is a no-op).
+     */
+    readonly auditWriter: AuditWriter;
+    /**
+     * TTL prune for the audit store (request-audit-log) — unlinks date files past
+     * `retentionDays`. Armed-off; `start.ts` configures from the persisted `audit`
+     * segment + starts it (running one prune at boot) ONLY when enabled. Disposed
+     * in cleanup.
+     */
+    readonly auditPruneSweeper: AuditPruneSweeper;
+    /**
+     * Durable-first billing publisher (billing-event-stream) — appends each event
+     * to `billing/billing-YYYY-MM-DD.jsonl` FIRST, then best-effort POSTs it.
+     * Registered as the core billing sink (via the billing runtime slot) by
+     * `start.ts`/admin PUT ONLY when the `billing` segment is enabled. INERT until
+     * then (no sink ⇒ `publishBillingEvent` is a no-op).
+     */
+    readonly billingPublisher: BillingPublisher;
+    /**
+     * Bounded retry + reconciliation sweep for the billing ledger
+     * (billing-event-stream) — re-POSTs undelivered events within `maxRetryAgeMs`,
+     * NEVER deletes. Armed-off; `start.ts` configures from the persisted `billing`
+     * segment + starts it ONLY when enabled with an endpoint. Disposed in cleanup.
+     */
+    readonly billingRetrySweeper: BillingRetrySweeper;
 }
 /**
  * Construct the standalone daemon from a loaded config + on-disk paths. Does NOT
@@ -1292,22 +2490,135 @@ declare function buildDaemon(config: DaemonConfig, paths: DaemonPaths): Daemon;
 declare function resetDaemonSingletonsForTests(): void;
 
 /**
- * html.ts — the embedded vanilla-JS admin dashboard (RT3, design D7).
- *
- * A SINGLE `text/html` template literal served by `AdminServer` on `GET /`. No
- * framework, no bundler, no new dependency — vanilla `fetch` + DOM. Panels:
- * providers (table + add/edit form), keys (table + create modal showing the
- * one-time plaintext with a copy button + a "shown once" warning, never
- * persisted), server config, read-only accounts status, and a playground
- * (endpoint select + key + request textarea + Send + response area).
+ * health.ts — the pure `/health` report builder (daemon-health-endpoint, D2).
+ *
+ * `buildHealthReport(deps)` returns a COARSE, SECRET-FREE {@link HealthReport}
+ * from cheap SYNCHRONOUS probes. It NEVER hits an upstream, NEVER blocks, and
+ * NEVER embeds a token/email/config-value/record-count — the body is served
+ * UNAUTHENTICATED (before the admin auth gate, and optionally before the outbound
+ * key-auth), so it must expose nothing sensitive.
+ *
+ * Each check is a caller-supplied boolean thunk; a thunk that THROWS collapses to
+ * `false` (a health probe must never crash the process). Status math:
+ *  - CRITICAL (`config`, `credentialStore`): a false critical → `error`.
+ *  - READINESS (`outboundServer`): the serving-path signal — false → `degraded`.
+ *  - INFORMATIONAL (`adminServer`): reported in `checks` but does NOT affect
+ *    `status` — a disabled/loopback dashboard must not fail the TRAFFIC-port
+ *    probe (the whole point of the outbound secondary mount).
+ * `error` and `degraded` both map to HTTP 503 (see `healthHttpStatus`), so a
+ * probe treats "not fully ready" as not-ready.
+ *
+ * @module @omnicross/daemon/admin/health
+ */
+
+/** The coarse dependency probes + process-stat seams the builder reads. */
+interface HealthReportDeps {
+    /** The daemon package version (non-secret; also on the identity header). */
+    version: string;
+    /** CRITICAL: the bootstrap config is present/loaded. */
+    configPresent: () => boolean;
+    /** CRITICAL: the credential store is constructed + its file readable (no decrypt). */
+    credentialStoreReadable: () => boolean;
+    /** Non-critical: the outbound `/v1/*` serving listener is running. */
+    outboundServerRunning: () => boolean;
+    /** Non-critical: the admin listener is running. */
+    adminServerRunning: () => boolean;
+    /**
+     * OPTIONAL coarse account-probe signal (subscription-account-probe #8, design
+     * D5). Returns `true` when no PROBED account is currently unhealthy, `false`
+     * when one is, or `undefined` when probing is DISABLED (→ the check is OMITTED,
+     * keeping the `/health` body byte-identical when the feature is off).
+     * INFORMATIONAL: it never affects `status` (a marked account is an operational
+     * signal, not a daemon-readiness failure). Account-anonymous — no ids/counts.
+     */
+    subscriptionAccountsHealthy?: () => boolean | undefined;
+    /** TEST SEAM: process memory snapshot (defaults to `process.memoryUsage`). */
+    memoryUsage?: () => NodeJS.MemoryUsage;
+    /** TEST SEAM: process uptime seconds (defaults to `process.uptime`). */
+    uptimeSeconds?: () => number;
+    /** TEST SEAM: wall clock ms (defaults to `Date.now`). */
+    now?: () => number;
+}
+/** Build the coarse, secret-free health report (design D2). */
+declare function buildHealthReport(deps: HealthReportDeps): HealthReport;
+
+/**
+ * ConfigurableLogger — a `Logger` port impl with level / format / file sink
+ * (configurable-logging, design D3). Supersedes `ConsoleLogger` as the injected
+ * daemon logger.
+ *
+ *  - LEVEL: numeric severity `error(0) < warn(1) < info(2) < debug(3)`; a message
+ *    whose level is BELOW the configured threshold (higher ordinal) is dropped.
+ *    Default threshold = `debug` (prints everything).
+ *  - FORMAT: `text` (the legacy `console.*(message, meta)` shape) | `json` (one
+ *    structured line `{ ts, level, msg, ...meta }`). Default `text`.
+ *  - SINK: always the console; PLUS an optional append-only file stream when
+ *    `file` is set (lazy-open; a write/open error is swallowed → the daemon never
+ *    crashes on a logging failure, it just falls back to the console).
+ *
+ * ZERO-REGRESSION DEFAULT: `new ConfigurableLogger()` (no config) = console +
+ * all levels + text = behaviorally byte-identical to the legacy `ConsoleLogger`
+ * (same `console` method per level, same `(message[, meta])` / error arg shape).
+ *
+ * CAUTION (per the #3 host:port-only-logging precedent): the JSON serializer
+ * reduces an `Error` to `{ message, stack }` and spreads a plain `meta` object,
+ * but it is NOT a secret redactor — call sites remain responsible for not passing
+ * secret-bearing objects.
+ *
+ * @module @omnicross/daemon/ports/ConfigurableLogger
+ */
+
+declare class ConfigurableLogger implements Logger {
+    private readonly threshold;
+    private readonly format;
+    private readonly filePath;
+    private fileStream;
+    private fileDisabled;
+    constructor(cfg?: LoggingConfig);
+    info(message: string, meta?: Record<string, unknown> | Error | object): void;
+    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
+    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
+    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
+    /**
+     * Flush + close the file sink (tests / graceful shutdown). Resolves once the
+     * append stream has finished flushing to disk. No-op when no file sink is open.
+     */
+    close(): Promise<void>;
+    private emit;
+    /**
+     * Console sink. In `text` format this reproduces the legacy `ConsoleLogger`
+     * EXACTLY (same method + arg shape) so the unconfigured default is a byte-for-
+     * byte drop-in; in `json` format it prints the structured line.
+     */
+    private writeConsole;
+    /** Append one line to the file sink; a failure disables the sink (swallowed). */
+    private writeFile;
+    /** Lazily open the append-only file stream; disable the sink on any error. */
+    private getFileStream;
+    private consoleFn;
+    /** `{ ts, level, msg, ...meta }` (+ `error` when present) as a single line. */
+    private jsonLine;
+    /** Human-readable file line: `ISO [level] message {metaJson}`. */
+    private textLine;
+}
+
+/**
+ * ConsoleLogger — the daemon's file-less default `Logger` port impl (design D5).
  *
- * SECURITY: the create-key plaintext is held only in a local variable inside the
- * modal flow and cleared on dismiss — never written to a field, list, or storage.
+ * A thin `console.*` wrapper. The serving core depends on the `Logger` port
+ * (never a host class), so this trivial implementation is the only logger the
+ * standalone daemon needs. `error` uses the WIDEST `(message, error?, meta?)`
+ * signature so every core call site stays assignable.
  *
- * @module @omnicross/daemon/admin/html
+ * @module @omnicross/daemon/ports/ConsoleLogger
  */
-/** The full dashboard document (style + body + the vanilla client script). */
-declare const DASHBOARD_HTML: string;
+
+declare class ConsoleLogger implements Logger {
+    info(message: string, meta?: Record<string, unknown> | Error | object): void;
+    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
+    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
+    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
+}
 
 /**
  * ccr-import.ts — translate a `claude-code-router` (CCR) `config.json` into an
@@ -1372,4 +2683,4 @@ declare function mapCcrToOmnicross(ccr: CcrConfig): {
     notes: string[];
 };
 
-export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConsoleLogger, DASHBOARD_HTML, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };
+export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConfigurableLogger, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, type HealthReportDeps, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, buildHealthReport, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };