@omnicross/daemon 0.1.2 → 0.1.4

package/dist/cli.js

@@ -270,6 +270,70 @@ var SecretBox = class {
 };
 
 // src/secrets/secretFields.ts
+function urlHasInlineCredential(url) {
+  try {
+    const u = new URL(url);
+    return u.username.length > 0 || u.password.length > 0;
+  } catch {
+    return false;
+  }
+}
+function transformProxyConfig(cfg, fn) {
+  if ("url" in cfg) {
+    if (isEnvelope(cfg.url) || urlHasInlineCredential(cfg.url)) {
+      return { url: fn(cfg.url) };
+    }
+    return cfg;
+  }
+  if (typeof cfg.password === "string" && cfg.password.length > 0) {
+    return { ...cfg, password: fn(cfg.password) };
+  }
+  return cfg;
+}
+function transformOutboundProxy(proxy, fn) {
+  const next = {};
+  if (proxy.global) next.global = transformProxyConfig(proxy.global, fn);
+  if (proxy.byProvider) {
+    const byProvider = {};
+    for (const [key, value] of Object.entries(proxy.byProvider)) {
+      byProvider[key] = transformProxyConfig(value, fn);
+    }
+    next.byProvider = byProvider;
+  }
+  return next;
+}
+function encryptProxySegment(proxy, box) {
+  return transformOutboundProxy(proxy, (v) => box.encryptMaybe(v));
+}
+function decryptProxySegment(proxy, box) {
+  return transformOutboundProxy(proxy, (v) => box.decryptMaybe(v));
+}
+function transformWebhookSegment(webhook, fn) {
+  return {
+    ...webhook,
+    destinations: webhook.destinations.map(
+      (d) => typeof d.secret === "string" && d.secret.length > 0 ? { ...d, secret: fn(d.secret) } : d
+    )
+  };
+}
+function encryptWebhookSegment(webhook, box) {
+  return transformWebhookSegment(webhook, (v) => box.encryptMaybe(v));
+}
+function decryptWebhookSegment(webhook, box) {
+  return transformWebhookSegment(webhook, (v) => box.decryptMaybe(v));
+}
+function transformBillingSegment(billing, fn) {
+  if (typeof billing.secret === "string" && billing.secret.length > 0) {
+    return { ...billing, secret: fn(billing.secret) };
+  }
+  return billing;
+}
+function encryptBillingSegment(billing, box) {
+  return transformBillingSegment(billing, (v) => box.encryptMaybe(v));
+}
+function decryptBillingSegment(billing, box) {
+  return transformBillingSegment(billing, (v) => box.decryptMaybe(v));
+}
 function transformProvider(provider, fn) {
   const next = { ...provider, apiKey: fn(provider.apiKey) };
   if (provider.apiKeys) {
@@ -293,6 +357,17 @@ function transformConfigSecrets(cfg, fn) {
   if (cfg.admin && typeof cfg.admin.token === "string" && cfg.admin.token.length > 0) {
     next.admin = { ...cfg.admin, token: fn(cfg.admin.token) };
   }
+  const proxy = cfg.server?.proxy;
+  const webhook = cfg.server?.webhook;
+  const billing = cfg.server?.billing;
+  if (cfg.server && (proxy?.global || proxy?.byProvider || webhook || billing?.secret)) {
+    next.server = { ...cfg.server };
+    if (proxy && (proxy.global || proxy.byProvider)) {
+      next.server.proxy = transformOutboundProxy(proxy, fn);
+    }
+    if (webhook) next.server.webhook = transformWebhookSegment(webhook, fn);
+    if (billing?.secret) next.server.billing = transformBillingSegment(billing, fn);
+  }
   return next;
 }
 function encryptConfigSecrets(cfg, box) {
@@ -330,7 +405,7 @@ function transformTokens(tokens, fn) {
     if (Array.isArray(accounts)) {
       bag[accountsKey] = accounts.map((entry) => {
         if (entry && typeof entry === "object" && "tokens" in entry && entry.tokens && typeof entry.tokens === "object") {
-          return {
+          const nextEntry = {
             ...entry,
             tokens: transformTokenBlock(
               entry.tokens,
@@ -338,6 +413,11 @@ function transformTokens(tokens, fn) {
               fn
             )
           };
+          const proxy = entry.proxy;
+          if (proxy && typeof proxy === "object") {
+            nextEntry.proxy = transformProxyConfig(proxy, fn);
+          }
+          return nextEntry;
         }
         return entry;
       });
@@ -372,6 +452,17 @@ function resolveAdminConfig(admin) {
     token: typeof admin?.token === "string" && admin.token.length > 0 ? admin.token : void 0
   };
 }
+function validateLogging(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const l = raw;
+  const out = {};
+  if (l["level"] === "error" || l["level"] === "warn" || l["level"] === "info" || l["level"] === "debug") {
+    out.level = l["level"];
+  }
+  if (l["format"] === "text" || l["format"] === "json") out.format = l["format"];
+  if (typeof l["file"] === "string" && l["file"].length > 0) out.file = l["file"];
+  return out.level !== void 0 || out.format !== void 0 || out.file !== void 0 ? out : void 0;
+}
 var VALID_FORMATS = ["openai", "anthropic", "gemini"];
 function validateApiKeys(raw) {
   if (!Array.isArray(raw)) return void 0;
@@ -546,7 +637,8 @@ function validateConfig(raw) {
   const providers = providersRaw.map((p, i) => validateProvider(p, i));
   const server = obj["server"];
   const admin = validateAdmin(obj["admin"]);
-  return { providers, server, admin };
+  const logging = validateLogging(obj["logging"]);
+  return { providers, server, admin, logging };
 }
 var secretBox = null;
 function setSecretBox(box) {
@@ -578,6 +670,9 @@ import { dirname as dirname2, join as join2 } from "path";
 function defaultKeysPath(configPath) {
   return join2(dirname2(configPath), "keys.json");
 }
+function defaultVouchersPath(configPath) {
+  return join2(dirname2(configPath), "vouchers.json");
+}
 function defaultTokensPath(configPath) {
   return join2(dirname2(configPath), "tokens.json");
 }
@@ -587,6 +682,12 @@ function defaultPricingPath(configPath) {
 function defaultUsageEventsPath(configPath) {
   return join2(dirname2(configPath), "usage-events.jsonl");
 }
+function defaultAuditDir(configPath) {
+  return join2(dirname2(configPath), "audit");
+}
+function defaultBillingDir(configPath) {
+  return join2(dirname2(configPath), "billing");
+}
 function resolveSecretBox(masterKeyFilePath) {
   return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
 }
@@ -686,6 +787,45 @@ var JsonOutboundKeyDb = class {
       return true;
     });
   }
+  async outboundApiKeysSetMaxConcurrency(id, maxConcurrency) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      if (maxConcurrency === null) delete row.maxConcurrency;
+      else row.maxConcurrency = maxConcurrency;
+      return true;
+    });
+  }
+  async outboundApiKeysSetPolicy(id, policy) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      applyPolicyField(row, "expiresAt", policy.expiresAt);
+      applyPolicyField(row, "activationDays", policy.activationDays);
+      applyPolicyField(row, "dailyCostLimitUsd", policy.dailyCostLimitUsd);
+      applyPolicyField(row, "totalCostLimitUsd", policy.totalCostLimitUsd);
+      applyPolicyField(row, "weeklyCostLimitUsd", policy.weeklyCostLimitUsd);
+      applyPolicyField(row, "rateLimitMaxRequests", policy.rateLimitMaxRequests);
+      applyPolicyField(row, "rateLimitWindowMs", policy.rateLimitWindowMs);
+      if (policy.activationMode === null) delete row.activationMode;
+      else if (policy.activationMode !== void 0) row.activationMode = policy.activationMode;
+      if (policy.enableModelRestriction === null) delete row.enableModelRestriction;
+      else if (policy.enableModelRestriction !== void 0) {
+        row.enableModelRestriction = policy.enableModelRestriction;
+      }
+      if (policy.restrictionMode === null) delete row.restrictionMode;
+      else if (policy.restrictionMode !== void 0) row.restrictionMode = policy.restrictionMode;
+      if (policy.restrictedModels === null) delete row.restrictedModels;
+      else if (policy.restrictedModels !== void 0) row.restrictedModels = policy.restrictedModels;
+      return true;
+    });
+  }
+  async outboundApiKeysMarkActivated(id, activatedAt) {
+    return this.mutateRow(id, (row) => {
+      if (row.revokedAt !== null) return false;
+      if (row.activatedAt != null) return false;
+      row.activatedAt = activatedAt;
+      return true;
+    });
+  }
   /** Apply `fn` to the row with `id`, persisting when it returns true. */
   mutateRow(id, fn) {
     const rows = this.readRows();
@@ -709,6 +849,11 @@ var JsonOutboundKeyDb = class {
     writeFileSync3(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
+function applyPolicyField(row, field, value) {
+  if (value === void 0) return;
+  if (value === null) delete row[field];
+  else row[field] = value;
+}
 
 // src/commands/keys.ts
 async function runKeys(argv) {
@@ -765,8 +910,8 @@ async function keysRevoke(db, id) {
 
 // src/commands/launch.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
-import { delimiter as delimiter2, join as join5 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { delimiter as delimiter2, join as join10 } from "path";
 import { parseArgs as parseArgs3 } from "util";
 import {
   buildChatCliLaunchConfig as buildChatCliLaunchConfig2,
@@ -776,18 +921,26 @@ import {
 } from "@omnicross/cli-launcher";
 
 // src/bootstrap.ts
+import { accessSync, constants as fsConstants, existsSync as existsSync14 } from "fs";
+import { DEFAULT_AUDIT_CONFIG } from "@omnicross/contracts/audit-types";
+import { DEFAULT_BILLING_CONFIG } from "@omnicross/contracts/billing-types";
 import { getGeminiCodeAssistProjectResolver } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
 import { ApiKeyPoolService } from "@omnicross/core/completion/ApiKeyPoolService";
 import {
   __resetOutboundApiServerForTests,
+  DEFAULT_ACCOUNT_PROBE,
   getOutboundApiServer
 } from "@omnicross/core/outbound-api";
 import { setSubscriptionRegistryForOutbound } from "@omnicross/core/outbound-api/subscriptionRegistryPort";
+import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import { fetchUpstream as fetchUpstream6, setUpstreamProxyResolver } from "@omnicross/core/pipeline/upstreamFetch";
+import { __resetSharedIdentityStoreForTests } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
 import { setGeminiCodeAssistResolver } from "@omnicross/core/ports/gemini-code-assist-resolver";
 import {
   __resetProviderProxyForTests,
   getProviderProxy
 } from "@omnicross/core/provider-proxy";
+import { KeySpendTracker } from "@omnicross/core/outbound-api";
 import { PricingEngine, UsageRecorder } from "@omnicross/core/usage";
 import {
   setSubscriptionAccountService,
@@ -807,6 +960,7 @@ var CodexOAuthSessionStore = class {
   ttlMs;
   sessions = /* @__PURE__ */ new Map();
   activeSessionId = null;
+  aborters = /* @__PURE__ */ new Map();
   /** Whether a codex sign-in is currently in flight (port 1455 held). */
   isBusy() {
     this.sweep();
@@ -818,13 +972,22 @@ var CodexOAuthSessionStore = class {
     const sessionId = crypto.randomBytes(24).toString("base64url");
     this.sessions.set(sessionId, { status: "pending", createdAt: Date.now() });
     this.activeSessionId = sessionId;
-    return sessionId;
+    const controller = new AbortController();
+    this.aborters.set(sessionId, controller);
+    return { sessionId, signal: controller.signal };
   }
   /** Settle a flow (done/error) + free the active slot. */
   settle(sessionId, status, error) {
     const prior = this.sessions.get(sessionId);
     this.sessions.set(sessionId, { status, error, createdAt: prior?.createdAt ?? Date.now() });
     if (this.activeSessionId === sessionId) this.activeSessionId = null;
+    this.aborters.delete(sessionId);
+  }
+  cancel(sessionId) {
+    if (!this.sessions.has(sessionId)) return false;
+    this.aborters.get(sessionId)?.abort();
+    this.settle(sessionId, "error", "login: cancelled");
+    return true;
   }
   /** Read a flow's status (token-free), or null when unknown/expired. */
   get(sessionId) {
@@ -853,13 +1016,13 @@ function handleCodexOAuthStart(deps) {
     );
   }
   const { authUrl, codeVerifier, state } = codexOAuth.generateAuthParams();
-  const sessionId = deps.codexSessions.begin();
-  void runCodexLoopback(sessionId, codeVerifier, state, deps);
+  const { sessionId, signal } = deps.codexSessions.begin();
+  void runCodexLoopback(sessionId, codeVerifier, state, signal, deps);
   return { status: 200, body: { authUrl, sessionId } };
 }
-async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
+async function runCodexLoopback(sessionId, codeVerifier, state, signal, deps) {
   try {
-    const code = await deps.codexAwaitLoopback(state);
+    const code = await deps.codexAwaitLoopback(state, void 0, signal);
     const result = await codexOAuth.exchangeCodeForTokens(
       { authorizationCode: code, codeVerifier, state },
       deps.oauthExchangeFetch
@@ -881,6 +1044,10 @@ async function runCodexLoopback(sessionId, codeVerifier, state, deps) {
     deps.codexSessions.settle(sessionId, "error", reason);
   }
 }
+function handleCodexOAuthCancel(sessionId, deps) {
+  if (!deps.codexSessions.cancel(sessionId)) return err(404, "unknown or expired codex sign-in session");
+  return { status: 200, body: { ok: true } };
+}
 function handleCodexOAuthStatus(sessionId, deps) {
   const s = deps.codexSessions.get(sessionId);
   if (!s) return err(404, "unknown or expired codex sign-in session");
@@ -890,15 +1057,139 @@ function handleCodexOAuthStatus(sessionId, deps) {
 // src/admin/AdminServer.ts
 import { timingSafeEqual } from "crypto";
 import http2 from "http";
+import {
+  healthHttpStatus
+} from "@omnicross/contracts/health-logging-types";
+
+// src/admin/accountProbesApi.ts
+function handleAccountProbes(res, reader) {
+  const accounts = reader ? reader.getAllHistory() : [];
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ accounts }));
+}
+
+// src/admin/auditQueryApi.ts
+function intParam(value) {
+  if (value === null || value.trim() === "") return void 0;
+  const n = Number(value);
+  return Number.isFinite(n) ? Math.trunc(n) : void 0;
+}
+function handleAuditQuery(req, res, reader) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const query = {};
+  const keyId = url.searchParams.get("keyId");
+  if (keyId && keyId.trim()) query.keyId = keyId.trim();
+  const from = intParam(url.searchParams.get("from"));
+  if (from !== void 0) query.from = from;
+  const to = intParam(url.searchParams.get("to"));
+  if (to !== void 0) query.to = to;
+  const limit = intParam(url.searchParams.get("limit"));
+  if (limit !== void 0) query.limit = limit;
+  const records = reader ? reader(query) : [];
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ records }));
+}
+
+// src/admin/billingStatusApi.ts
+function handleBillingStatus(res, reader) {
+  const status = reader ? reader() : { total: 0, delivered: 0, pending: 0 };
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ status }));
+}
+
+// src/webhook/webhookRuntime.ts
+import { setWebhookSink } from "@omnicross/core/pipeline/webhookEmit";
+var dispatcher = null;
+var health = null;
+var unsubscribers = [];
+var wired = false;
+function setWebhookRuntime(d, h) {
+  dispatcher = d;
+  health = h;
+}
+function applyWebhookConfig(config) {
+  if (!dispatcher) return;
+  dispatcher.setConfig(config);
+  const shouldWire = config?.enabled === true && (config?.destinations.length ?? 0) > 0;
+  if (shouldWire && !wired) {
+    const active = dispatcher;
+    setWebhookSink((event) => active.emit(event));
+    if (health) {
+      unsubscribers.push(
+        health.onRecovered(
+          (e) => active.emit({ kind: "account.recovery", at: e.at, providerId: e.providerId, accountId: e.accountId })
+        )
+      );
+      unsubscribers.push(
+        health.onAnomaly(
+          (e) => active.emit({
+            kind: "account.anomaly",
+            at: e.at,
+            providerId: e.providerId,
+            accountId: e.accountId,
+            state: e.state
+          })
+        )
+      );
+    }
+    wired = true;
+  } else if (!shouldWire && wired) {
+    teardown();
+  }
+}
+async function deliverWebhookTest(destinationId) {
+  if (!dispatcher) return { ok: false, error: "webhook dispatcher not wired" };
+  return dispatcher.deliverTest(destinationId);
+}
+function teardown() {
+  setWebhookSink(null);
+  for (const unsub of unsubscribers) unsub();
+  unsubscribers = [];
+  wired = false;
+}
+
+// src/admin/webhookTestApi.ts
+function readJsonBody(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      try {
+        const raw = Buffer.concat(chunks).toString("utf8");
+        const parsed = raw ? JSON.parse(raw) : {};
+        resolve(parsed && typeof parsed === "object" ? parsed : {});
+      } catch {
+        resolve({});
+      }
+    });
+    req.on("error", () => resolve({}));
+  });
+}
+async function handleWebhookTest(req, res) {
+  const body = await readJsonBody(req);
+  const destinationId = body["destinationId"];
+  if (typeof destinationId !== "string" || !destinationId.trim()) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "bad_request", message: "destinationId is required" } }));
+    return;
+  }
+  const result = await deliverWebhookTest(destinationId.trim());
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ result }));
+}
 
 // src/admin/adminApi.ts
 import http from "http";
 import {
   createNamedKey as createNamedKey2,
-  loadServerConfig,
+  isKindMappedEndpoint,
+  loadServerConfig as loadServerConfig2,
   mergeServerConfig,
-  saveServerConfig
+  normalizeProxyConfig,
+  saveServerConfig,
+  validateServerModelConfig
 } from "@omnicross/core/outbound-api";
+import { fetchUpstream } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/pool/resolveEnvKey.ts
 function resolveEnvKey(rawKey) {
@@ -993,6 +1284,163 @@ function listMappablePresets() {
   return { mappable, excluded };
 }
 
+// src/proxy/sanitizeProxy.ts
+function sanitizeProxyConfig(cfg) {
+  if ("url" in cfg) {
+    let endpoint;
+    let username;
+    let hasPassword = false;
+    try {
+      const u = new URL(cfg.url);
+      endpoint = u.port ? `${u.hostname}:${u.port}` : u.hostname;
+      username = u.username ? decodeURIComponent(u.username) : void 0;
+      hasPassword = u.password.length > 0;
+    } catch {
+    }
+    return { kind: "url", endpoint, username, hasPassword };
+  }
+  return {
+    kind: cfg.type,
+    endpoint: `${cfg.host}:${cfg.port}`,
+    username: cfg.username,
+    hasPassword: typeof cfg.password === "string" && cfg.password.length > 0
+  };
+}
+function redactProxyConfig(cfg) {
+  if ("url" in cfg) {
+    try {
+      const u = new URL(cfg.url);
+      if (u.password) u.password = "";
+      return { url: u.toString() };
+    } catch {
+      return cfg;
+    }
+  }
+  const { password: _password, ...rest } = cfg;
+  return rest;
+}
+function redactOutboundProxy(proxy) {
+  const out = {};
+  if (proxy.global) out.global = redactProxyConfig(proxy.global);
+  if (proxy.byProvider) {
+    const byProvider = {};
+    for (const [key, value] of Object.entries(proxy.byProvider)) {
+      byProvider[key] = redactProxyConfig(value);
+    }
+    out.byProvider = byProvider;
+  }
+  return out;
+}
+function preserveProxyConfigSecret(incoming, current) {
+  if (!current) return incoming;
+  if ("url" in incoming) {
+    if ("url" in current) {
+      try {
+        const inU = new URL(incoming.url);
+        const curU = new URL(current.url);
+        if (!inU.password && curU.password) {
+          inU.password = curU.password;
+          return { url: inU.toString() };
+        }
+      } catch {
+      }
+    }
+    return incoming;
+  }
+  if ("url" in current) return incoming;
+  const blank = incoming.password === void 0 || incoming.password === "";
+  if (blank && typeof current.password === "string" && current.password.length > 0) {
+    return { ...incoming, password: current.password };
+  }
+  return incoming;
+}
+function preserveOutboundProxySecrets(incoming, current) {
+  const out = {};
+  if (incoming.global) out.global = preserveProxyConfigSecret(incoming.global, current?.global);
+  if (incoming.byProvider) {
+    const byProvider = {};
+    for (const [key, value] of Object.entries(incoming.byProvider)) {
+      byProvider[key] = preserveProxyConfigSecret(value, current?.byProvider?.[key]);
+    }
+    out.byProvider = byProvider;
+  }
+  return out;
+}
+
+// src/proxy/upstreamProxyResolver.ts
+import {
+  bumpUpstreamProxyGeneration
+} from "@omnicross/core/pipeline/upstreamFetch";
+var serverProxy;
+function setServerProxyConfig(proxy) {
+  serverProxy = proxy;
+  bumpUpstreamProxyGeneration();
+}
+function getServerProxyConfig() {
+  return serverProxy;
+}
+var envProxyLoggedFor;
+function maskProxyUrl(url) {
+  return url.replace(/\/\/[^/@]*@/, "//***@");
+}
+function hostFromCtx(ctx) {
+  if (!ctx.url) return void 0;
+  try {
+    return new URL(ctx.url).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.startsWith("127.") || host.endsWith(".localhost");
+}
+function noProxyMatches(noProxy, host) {
+  if (!noProxy) return false;
+  for (const raw of noProxy.split(",")) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === "*") return true;
+    const bare = entry.startsWith(".") ? entry.slice(1) : entry;
+    if (host === bare || host.endsWith(`.${bare}`)) return true;
+  }
+  return false;
+}
+function resolveEnvProxy(ctx, env = process.env) {
+  const raw = env.HTTPS_PROXY ?? env.https_proxy ?? env.ALL_PROXY ?? env.all_proxy ?? env.HTTP_PROXY ?? env.http_proxy;
+  if (!raw || !raw.trim()) return void 0;
+  const host = hostFromCtx(ctx);
+  if (host && (isLoopbackHost(host) || noProxyMatches(env.NO_PROXY ?? env.no_proxy, host))) {
+    return void 0;
+  }
+  const url = raw.trim();
+  if (envProxyLoggedFor !== url) {
+    envProxyLoggedFor = url;
+    console.info(`[upstream-proxy] routing upstream egress through the environment proxy: ${maskProxyUrl(url)}`);
+  }
+  return { url };
+}
+function createUpstreamProxyResolver(src = {}) {
+  const readServer = src.getServerProxy ?? getServerProxyConfig;
+  return (ctx) => {
+    const host = hostFromCtx(ctx);
+    if (host) {
+      if (isLoopbackHost(host)) return void 0;
+      const env = src.env ?? process.env;
+      if (noProxyMatches(env.NO_PROXY ?? env.no_proxy, host)) return void 0;
+    }
+    if (src.getAccountProxy && ctx.providerId && ctx.accountId) {
+      const account = src.getAccountProxy(ctx.providerId, ctx.accountId);
+      if (account) return account;
+    }
+    const server = readServer();
+    if (ctx.providerId && server?.byProvider?.[ctx.providerId]) {
+      return server.byProvider[ctx.providerId];
+    }
+    if (server?.global) return server.global;
+    return resolveEnvProxy(ctx, src.env);
+  };
+}
+
 // src/admin/accountsOAuth.ts
 import { claudeOAuth, geminiOAuth } from "@omnicross/subscriptions";
 
@@ -1115,6 +1563,24 @@ function validateTokenBody(providerId, body) {
       return null;
   }
 }
+function validateSupportedModelsBody(raw) {
+  if (raw === null || raw === void 0) return { ok: true, value: void 0 };
+  if (Array.isArray(raw)) {
+    if (raw.length === 0) return { ok: false };
+    if (!raw.every((x) => typeof x === "string" && x.trim().length > 0)) return { ok: false };
+    return { ok: true, value: raw };
+  }
+  if (typeof raw === "object") {
+    const entries = Object.entries(raw);
+    if (entries.length === 0) return { ok: false };
+    const valid = entries.every(
+      ([k, v]) => k.trim().length > 0 && typeof v === "string" && v.trim().length > 0
+    );
+    if (!valid) return { ok: false };
+    return { ok: true, value: Object.fromEntries(entries) };
+  }
+  return { ok: false };
+}
 async function statusEntryFor(reader, providerId) {
   const all = await reader.listAll();
   return all.find((a) => a.providerId === providerId) ?? null;
@@ -1396,6 +1862,434 @@ async function handleCliLaunch(cli, body, ctx) {
   return { status: 200, body: { sessionId: id, providerId: target.providerId, model: target.model } };
 }
 
+// src/admin/auditConfigBody.ts
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validateAuditSegment(patch) {
+  const errors = [];
+  const audit = patch.audit;
+  if (audit === void 0) return errors;
+  if (!isPlainObject(audit)) {
+    errors.push("audit must be an object");
+    return errors;
+  }
+  for (const flag of ["enabled", "captureBodies", "trustForwardedFor"]) {
+    if (audit[flag] !== void 0 && typeof audit[flag] !== "boolean") {
+      errors.push(`audit.${flag} must be a boolean`);
+    }
+  }
+  const maxBodyBytes = audit["maxBodyBytes"];
+  if (maxBodyBytes !== void 0 && (typeof maxBodyBytes !== "number" || !Number.isFinite(maxBodyBytes) || maxBodyBytes < 0)) {
+    errors.push("audit.maxBodyBytes must be a non-negative number");
+  }
+  const retentionDays = audit["retentionDays"];
+  if (retentionDays !== void 0 && (typeof retentionDays !== "number" || !Number.isFinite(retentionDays) || retentionDays < 0)) {
+    errors.push("audit.retentionDays must be a non-negative number");
+  }
+  return errors;
+}
+
+// src/admin/billingConfigBody.ts
+var BILLING_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validateBillingSegment(patch) {
+  const errors = [];
+  const billing = patch.billing;
+  if (billing === void 0) return errors;
+  if (!isPlainObject2(billing)) {
+    errors.push("billing must be an object");
+    return errors;
+  }
+  if (billing["enabled"] !== void 0 && typeof billing["enabled"] !== "boolean") {
+    errors.push("billing.enabled must be a boolean");
+  }
+  if (billing["endpoint"] !== void 0 && typeof billing["endpoint"] !== "string") {
+    errors.push("billing.endpoint must be a string");
+  }
+  if (billing["secret"] !== void 0 && typeof billing["secret"] !== "string") {
+    errors.push("billing.secret must be a string");
+  }
+  const maxRetryAgeMs = billing["maxRetryAgeMs"];
+  if (maxRetryAgeMs !== void 0 && (typeof maxRetryAgeMs !== "number" || !Number.isFinite(maxRetryAgeMs) || maxRetryAgeMs < 0)) {
+    errors.push("billing.maxRetryAgeMs must be a non-negative number");
+  }
+  return errors;
+}
+function redactBillingConfig(billing) {
+  if (typeof billing.secret === "string" && billing.secret.length > 0) {
+    return { ...billing, secret: BILLING_SECRET_MASK };
+  }
+  return billing;
+}
+function preserveBillingSecret(incoming, current) {
+  const isMaskedOrBlank = incoming.secret === void 0 || incoming.secret === "" || incoming.secret === BILLING_SECRET_MASK;
+  if (isMaskedOrBlank) {
+    if (current?.secret) return { ...incoming, secret: current.secret };
+    const { secret: _secret, ...rest } = incoming;
+    return rest;
+  }
+  return incoming;
+}
+
+// src/admin/dashboard.ts
+function startOfLocalDayMs(ts) {
+  const d = new Date(ts);
+  return new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime();
+}
+function accountProviderId(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  const e = entry;
+  if (typeof e["providerId"] === "string" && e["providerId"]) return e["providerId"];
+  if (typeof e["provider"] === "string" && e["provider"]) return e["provider"];
+  return null;
+}
+async function handleDashboard(deps) {
+  const now = Date.now();
+  const today = await deps.usageRecorder.getTotals({ startTs: startOfLocalDayMs(now), endTs: now });
+  const total = await deps.usageRecorder.getTotals({ startTs: 0, endTs: now });
+  const providerList = loadConfig(deps.configPath).providers;
+  const providers = {
+    total: providerList.length,
+    enabled: providerList.filter((p) => p.enabled !== false).length
+  };
+  const keys = await deps.keyDb.outboundApiKeysList();
+  const outboundKeys = {
+    total: keys.length,
+    active: keys.filter((k) => k.enabled && k.revokedAt === null).length
+  };
+  const accountsList = await deps.subscriptionAccounts.listAll();
+  const byProvider = {};
+  for (const entry of accountsList) {
+    const providerId = accountProviderId(entry);
+    if (providerId) byProvider[providerId] = (byProvider[providerId] ?? 0) + 1;
+  }
+  const accounts = { total: accountsList.length, byProvider };
+  const status = deps.outboundApiServer.getStatus();
+  const server = {
+    running: status.running,
+    port: status.port,
+    uptimeMs: Math.round(process.uptime() * 1e3)
+  };
+  const summary = { today, total, providers, outboundKeys, accounts, server, generatedAt: now };
+  return { status: 200, body: summary };
+}
+
+// src/admin/keyPolicyBody.ts
+function parseKeyPolicyBody(body) {
+  const policy = {};
+  if ("activationMode" in body) {
+    const m = body["activationMode"];
+    if (m === null) policy.activationMode = null;
+    else if (m === "fixed" || m === "activation") policy.activationMode = m;
+    else return { ok: false, message: "activationMode must be 'fixed', 'activation', or null" };
+  }
+  const numericFields = [
+    { key: "expiresAt", min: 0 },
+    { key: "activationDays", min: 1, integer: true },
+    { key: "dailyCostLimitUsd", min: 0 },
+    { key: "totalCostLimitUsd", min: 0 },
+    { key: "weeklyCostLimitUsd", min: 0 },
+    { key: "rateLimitMaxRequests", min: 0, integer: true },
+    { key: "rateLimitWindowMs", min: 1 }
+  ];
+  for (const { key, min, integer } of numericFields) {
+    if (!(key in body)) continue;
+    const v = body[key];
+    if (v === null) {
+      policy[key] = null;
+      continue;
+    }
+    if (typeof v !== "number" || !Number.isFinite(v) || v < min || integer && !Number.isInteger(v)) {
+      return {
+        ok: false,
+        message: `${key} must be ${integer ? "an integer" : "a number"} >= ${min} or null`
+      };
+    }
+    policy[key] = v;
+  }
+  if ("enableModelRestriction" in body) {
+    const v = body["enableModelRestriction"];
+    if (v === null) policy.enableModelRestriction = null;
+    else if (typeof v === "boolean") policy.enableModelRestriction = v;
+    else return { ok: false, message: "enableModelRestriction must be a boolean or null" };
+  }
+  if ("restrictionMode" in body) {
+    const v = body["restrictionMode"];
+    if (v === null) policy.restrictionMode = null;
+    else if (v === "blacklist" || v === "allowlist") policy.restrictionMode = v;
+    else return { ok: false, message: "restrictionMode must be 'blacklist', 'allowlist', or null" };
+  }
+  if ("restrictedModels" in body) {
+    const v = body["restrictedModels"];
+    if (v === null) {
+      policy.restrictedModels = null;
+    } else if (Array.isArray(v) && v.every((e) => typeof e === "string")) {
+      policy.restrictedModels = v.map((e) => e.trim()).filter((e) => e !== "");
+    } else {
+      return { ok: false, message: "restrictedModels must be an array of strings or null" };
+    }
+  }
+  return { ok: true, policy };
+}
+
+// src/admin/voucherAdmin.ts
+import {
+  generateVoucherCode,
+  hashVoucherCode,
+  loadServerConfig,
+  newVoucherId,
+  toVoucherInfo,
+  voucherCodePrefix
+} from "@omnicross/core/outbound-api";
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeErr(res, status, message) {
+  writeJson(res, status, { error: { type: "voucher_error", message } });
+}
+function readJsonBody2(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if (!raw.trim()) return resolve({});
+      try {
+        const parsed = JSON.parse(raw);
+        resolve(parsed && typeof parsed === "object" ? parsed : {});
+      } catch {
+        reject(new Error("invalid-json"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function optPositive(value, integer) {
+  if (value === void 0 || value === null) return { ok: true, value: void 0 };
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return { ok: false };
+  if (integer && !Number.isInteger(value)) return { ok: false };
+  return { ok: true, value };
+}
+function parseVoucherCreateBody(body) {
+  const type = body["type"];
+  if (type !== "credit" && type !== "renewal") {
+    return { ok: false, message: "type must be 'credit' or 'renewal'" };
+  }
+  const maxTotal = optPositive(body["maxTotalCostLimitUsd"], false);
+  if (!maxTotal.ok) return { ok: false, message: "maxTotalCostLimitUsd must be a positive number" };
+  const maxDays = optPositive(body["maxExpiryDays"], true);
+  if (!maxDays.ok) return { ok: false, message: "maxExpiryDays must be a positive integer" };
+  const input = { type };
+  if (maxTotal.value !== void 0) input.maxTotalCostLimitUsd = maxTotal.value;
+  if (maxDays.value !== void 0) input.maxExpiryDays = maxDays.value;
+  if (type === "credit") {
+    const credit = optPositive(body["creditUsd"], false);
+    if (!credit.ok || credit.value === void 0) {
+      return { ok: false, message: "creditUsd must be a positive number for a credit card" };
+    }
+    input.creditUsd = credit.value;
+  } else {
+    const days = optPositive(body["renewalDays"], true);
+    if (!days.ok || days.value === void 0) {
+      return { ok: false, message: "renewalDays must be a positive integer for a renewal card" };
+    }
+    input.renewalDays = days.value;
+  }
+  return { ok: true, input };
+}
+async function voucherEnabled(deps) {
+  const config = await loadServerConfig(deps.settingsStore);
+  return config.voucher?.enabled === true;
+}
+async function handleVoucher(req, res, method, rest, deps) {
+  const voucherDb = deps.voucherDb;
+  if (!voucherDb) return writeErr(res, 501, "Voucher feature is not available");
+  if (method === "GET" && rest.length === 0) {
+    const rows = await voucherDb.voucherList();
+    return writeJson(res, 200, { vouchers: rows.map(toVoucherInfo) });
+  }
+  if (method === "POST" && rest.length === 0) {
+    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    let body;
+    try {
+      body = await readJsonBody2(req);
+    } catch {
+      return writeErr(res, 400, "Invalid JSON in request body");
+    }
+    const parsed = parseVoucherCreateBody(body);
+    if (!parsed.ok) return writeErr(res, 400, parsed.message);
+    const code = generateVoucherCode();
+    const created = await voucherDb.voucherCreate({
+      id: newVoucherId(),
+      codeHash: hashVoucherCode(code),
+      codePrefix: voucherCodePrefix(code),
+      ...parsed.input
+    });
+    return writeJson(res, 201, {
+      id: created.id,
+      codePrefix: created.codePrefix,
+      type: created.type,
+      createdAt: created.createdAt,
+      // `plaintextOnce` is the ONLY place the full code crosses the wire (D3).
+      plaintextOnce: code
+    });
+  }
+  const id = rest[0];
+  if (method === "POST" && id && rest[1] === "revoke") {
+    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    const ok = await voucherDb.voucherRevokeCas(id, Date.now());
+    return writeJson(res, ok ? 200 : 409, { ok });
+  }
+  return writeErr(res, 405, `method ${method} not allowed on voucher`);
+}
+
+// src/admin/webhookConfigBody.ts
+import {
+  WEBHOOK_DESTINATION_TYPES,
+  WEBHOOK_EVENT_KINDS
+} from "@omnicross/contracts/webhook-types";
+var WEBHOOK_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
+var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validateWebhookSegment(patch) {
+  const errors = [];
+  const webhook = patch.webhook;
+  if (webhook === void 0) return errors;
+  if (!isPlainObject3(webhook)) {
+    errors.push("webhook must be an object");
+    return errors;
+  }
+  if (typeof webhook["enabled"] !== "boolean") {
+    errors.push("webhook.enabled must be a boolean");
+  }
+  const destinations = webhook["destinations"];
+  if (destinations !== void 0 && !Array.isArray(destinations)) {
+    errors.push("webhook.destinations must be an array");
+    return errors;
+  }
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const [i, raw] of (Array.isArray(destinations) ? destinations : []).entries()) {
+    if (!isPlainObject3(raw)) {
+      errors.push(`webhook.destinations[${i}] must be an object`);
+      continue;
+    }
+    const id = raw["id"];
+    if (typeof id !== "string" || !id.trim()) {
+      errors.push(`webhook.destinations[${i}].id must be a non-empty string`);
+    } else if (seenIds.has(id.trim())) {
+      errors.push(`webhook.destinations[${i}].id '${id.trim()}' is duplicated`);
+    } else {
+      seenIds.add(id.trim());
+    }
+    if (typeof raw["type"] !== "string" || !WEBHOOK_DESTINATION_TYPES.includes(raw["type"])) {
+      errors.push(`webhook.destinations[${i}].type must be one of ${WEBHOOK_DESTINATION_TYPES.join(", ")}`);
+    }
+    if (typeof raw["url"] !== "string" || !raw["url"].trim()) {
+      errors.push(`webhook.destinations[${i}].url must be a non-empty string`);
+    }
+    if (raw["secret"] !== void 0 && typeof raw["secret"] !== "string") {
+      errors.push(`webhook.destinations[${i}].secret must be a string`);
+    }
+    if (raw["enabled"] !== void 0 && typeof raw["enabled"] !== "boolean") {
+      errors.push(`webhook.destinations[${i}].enabled must be a boolean`);
+    }
+    const events = raw["events"];
+    if (events !== void 0) {
+      if (!Array.isArray(events)) {
+        errors.push(`webhook.destinations[${i}].events must be an array`);
+      } else {
+        for (const e of events) {
+          if (typeof e !== "string" || !WEBHOOK_EVENT_KINDS.includes(e)) {
+            errors.push(`webhook.destinations[${i}].events contains an unknown kind '${String(e)}'`);
+          }
+        }
+      }
+    }
+  }
+  return errors;
+}
+function redactWebhookConfig(webhook) {
+  return {
+    ...webhook,
+    destinations: webhook.destinations.map(
+      (d) => typeof d.secret === "string" && d.secret.length > 0 ? { ...d, secret: WEBHOOK_SECRET_MASK } : d
+    )
+  };
+}
+function preserveWebhookSecrets(incoming, current) {
+  const currentById = /* @__PURE__ */ new Map();
+  for (const d of current?.destinations ?? []) currentById.set(d.id, d);
+  return {
+    ...incoming,
+    destinations: incoming.destinations.map((d) => {
+      const isMaskedOrBlank = d.secret === void 0 || d.secret === "" || d.secret === WEBHOOK_SECRET_MASK;
+      if (isMaskedOrBlank) {
+        const prev = currentById.get(d.id);
+        if (prev?.secret) return { ...d, secret: prev.secret };
+        const { secret: _secret, ...rest } = d;
+        return rest;
+      }
+      return d;
+    })
+  };
+}
+
+// src/audit/auditRuntime.ts
+import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+var writer = null;
+var sweeper = null;
+function setAuditRuntime(w, s) {
+  writer = w;
+  sweeper = s;
+}
+function applyAuditConfig(config) {
+  const enabled = config?.enabled === true && writer !== null;
+  if (enabled && config) {
+    setAuditCaptureConfig(config);
+    const activeWriter = writer;
+    setAuditSink((record) => activeWriter.record(record));
+    if (sweeper) {
+      sweeper.configure(config);
+      sweeper.start();
+    }
+  } else {
+    setAuditCaptureConfig(null);
+    setAuditSink(null);
+    if (sweeper) {
+      if (config) sweeper.configure(config);
+      sweeper.dispose();
+    }
+  }
+}
+
+// src/billing/billingRuntime.ts
+import { setBillingCaptureConfig, setBillingSink } from "@omnicross/core/pipeline/billingEmit";
+var publisher = null;
+var sweeper2 = null;
+function setBillingRuntime(p, s) {
+  publisher = p;
+  sweeper2 = s;
+}
+function applyBillingConfig(config) {
+  const enabled = config?.enabled === true && publisher !== null;
+  if (enabled && config) {
+    const activePublisher = publisher;
+    activePublisher.setConfig(config);
+    setBillingCaptureConfig(config);
+    setBillingSink((event) => activePublisher.record(event));
+    if (sweeper2) {
+      sweeper2.configure(config);
+      sweeper2.start();
+    }
+  } else {
+    setBillingCaptureConfig(null);
+    setBillingSink(null);
+    if (sweeper2) {
+      if (config) sweeper2.configure(config);
+      sweeper2.dispose();
+    }
+  }
+}
+
 // src/ports/account-multi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 var PROVIDER_KEYS = {
@@ -1507,6 +2401,9 @@ function getAccountById(config, p, id) {
   const account = getAccounts(config, p).find((a) => a.id === id);
   return account ? { id: account.id, tokens: account.tokens } : void 0;
 }
+function getAccountProxy(config, p, id) {
+  return getAccounts(config, p).find((a) => a.id === id)?.proxy;
+}
 function getActiveAccount(config, p) {
   const active = getAccounts(config, p).find((a) => a.id === getActiveId(config, p));
   return active ? { id: active.id, tokens: active.tokens } : void 0;
@@ -1547,7 +2444,17 @@ function sanitizeAccounts(config, p) {
       isSetupToken: t.isSetupToken,
       hasAccessToken: !!(t.accessToken || t.apiKey),
       isActive: a.id === activeId,
-      syncWarning: t.syncWarning
+      // Scheduling metadata (subscription-account-scheduling): editable priority
+      // (default 50 shown when unset) + display-only lastUsedAt. Secret-free.
+      priority: a.priority,
+      lastUsedAt: a.lastUsedAt,
+      syncWarning: t.syncWarning,
+      // Per-account proxy (upstream-proxy): masked view — password → hasPassword,
+      // userinfo stripped. The plaintext password is NEVER projected.
+      proxy: a.proxy ? sanitizeProxyConfig(a.proxy) : void 0,
+      // Per-account model support / remap (subscription-account-model-map): model
+      // ids are not token material → carried through verbatim for the editor.
+      supportedModels: a.supportedModels
     };
   });
 }
@@ -1561,8 +2468,79 @@ function renameAccount(config, p, id, label) {
   );
   return { ok: true };
 }
-function clearProvider(config, p) {
-  setBlock(config, p, void 0);
+function setAccountPriority(config, p, id, priority) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => a.id === id ? { ...a, priority } : a)
+  );
+  return { ok: true };
+}
+function setAccountProxy(config, p, id, proxy) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => {
+      if (a.id !== id) return a;
+      if (!proxy) {
+        const { proxy: _drop, ...rest } = a;
+        return rest;
+      }
+      return { ...a, proxy };
+    })
+  );
+  return { ok: true };
+}
+function setAccountSupportedModels(config, p, id, supportedModels) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => {
+      if (a.id !== id) return a;
+      if (supportedModels === void 0) {
+        const { supportedModels: _drop, ...rest } = a;
+        return rest;
+      }
+      return { ...a, supportedModels };
+    })
+  );
+  return { ok: true };
+}
+function setAccountLastUsed(config, p, id, iso) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => a.id === id ? { ...a, lastUsedAt: iso } : a)
+  );
+  return { ok: true };
+}
+function setAccountIdentity(config, p, id, identity) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((a) => a.id === id)) return { ok: false };
+  setAccounts(
+    config,
+    p,
+    accounts.map((a) => {
+      if (a.id !== id) return a;
+      if (identity === void 0) {
+        const { identity: _drop, ...rest } = a;
+        return rest;
+      }
+      return { ...a, identity };
+    })
+  );
+  return { ok: true };
+}
+function clearProvider(config, p) {
+  setBlock(config, p, void 0);
   setAccounts(config, p, void 0);
   setActiveId(config, p, void 0);
 }
@@ -1826,6 +2804,12 @@ function parseRange(query) {
   return { startTs, endTs };
 }
 var isRange = (v) => v.startTs !== void 0 && !("status" in v);
+var BUCKET_SPAN_MS = {
+  hour: 36e5,
+  day: 864e5,
+  month: 28 * 864e5
+};
+var MAX_TIMESERIES_BUCKETS = 2e3;
 async function handleUsageGet(view, query, deps) {
   const range = parseRange(query);
   if (!isRange(range)) return range;
@@ -1834,6 +2818,24 @@ async function handleUsageGet(view, query, deps) {
       return { status: 200, body: await deps.usageRecorder.getTotals(range) };
     case "by-model":
       return { status: 200, body: await deps.usageRecorder.getByModel(range) };
+    case "timeseries": {
+      const bucket = query.get("bucket");
+      if (bucket !== "hour" && bucket !== "day" && bucket !== "month") {
+        return err4(400, "bucket must be one of 'hour', 'day', 'month'");
+      }
+      const now = Date.now();
+      const clamped = { startTs: range.startTs, endTs: Math.min(range.endTs, now) };
+      if (clamped.startTs < clamped.endTs) {
+        const projected = Math.ceil((clamped.endTs - clamped.startTs) / BUCKET_SPAN_MS[bucket]) + 1;
+        if (projected > MAX_TIMESERIES_BUCKETS) {
+          return err4(
+            400,
+            `requested range projects ~${projected} '${bucket}' buckets (max ${MAX_TIMESERIES_BUCKETS}); narrow the range or use a coarser bucket`
+          );
+        }
+      }
+      return { status: 200, body: await deps.usageRecorder.getTimeSeries(clamped, bucket) };
+    }
     case "by-api-key": {
       const rows = await deps.usageRecorder.getByApiKey(range);
       const labels = poolKeyLabels(loadConfig(deps.configPath));
@@ -1979,7 +2981,7 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
-async function readJsonBody(req) {
+async function readJsonBody3(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -1989,12 +2991,12 @@ async function readJsonBody(req) {
     return {};
   }
 }
-function writeJson(res, status, body) {
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson(res, status, { error: { type: "admin_api_error", message } });
+  writeJson2(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -2010,7 +3012,23 @@ function toKeyInfo(row) {
     enabled: row.enabled,
     createdAt: row.createdAt,
     lastUsedAt: row.lastUsedAt,
-    revoked: row.revokedAt !== null
+    revoked: row.revokedAt !== null,
+    maxConcurrency: row.maxConcurrency,
+    // Key-policy envelope (outbound-key-policy) — all secret-free scalar fields;
+    // the UI reads them to render + pre-fill the policy editor.
+    expiresAt: row.expiresAt,
+    activationMode: row.activationMode,
+    activationDays: row.activationDays,
+    activatedAt: row.activatedAt,
+    dailyCostLimitUsd: row.dailyCostLimitUsd,
+    totalCostLimitUsd: row.totalCostLimitUsd,
+    weeklyCostLimitUsd: row.weeklyCostLimitUsd,
+    rateLimitMaxRequests: row.rateLimitMaxRequests,
+    rateLimitWindowMs: row.rateLimitWindowMs,
+    // Per-key model restriction (#6) — secret-free scalars the UI pre-fills.
+    enableModelRestriction: row.enableModelRestriction,
+    restrictionMode: row.restrictionMode,
+    restrictedModels: row.restrictedModels
   };
 }
 function toProviderView(row) {
@@ -2072,6 +3090,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return handlePresets(res, method);
       case "keys":
         return await handleKeys(req, res, method, rest, deps);
+      case "voucher":
+        return await handleVoucher(req, res, method, rest, deps);
       case "server":
         return await handleServer(req, res, method, deps);
       case "accounts":
@@ -2088,6 +3108,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleMigrationImport(req, res, method, deps);
       case "usage":
         return await handleUsage(req, res, method, rest, deps);
+      case "dashboard":
+        return await handleDashboardRoute(res, method, deps);
       case "pricing":
         return await handlePricing(req, res, method, rest, deps);
       default:
@@ -2103,17 +3125,22 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson(res, result.status, result.body);
+  writeJson2(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
   return writeResult(res, await handleUsageGet(rest[0], requestQuery(req), deps));
 }
+async function handleDashboardRoute(res, method, deps) {
+  if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
+  const result = await handleDashboard(deps);
+  return writeJson2(res, result.status, result.body);
+}
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody3(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
@@ -2124,7 +3151,7 @@ async function handlePricing(req, res, method, rest, deps) {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody3(req), deps));
   }
   return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
@@ -2138,15 +3165,15 @@ function migrationDeps(deps) {
 }
 async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson(res, result.status, result.body);
+  return writeJson2(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson(res, result.status, result.body);
+  return writeJson2(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -2177,13 +3204,13 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson2(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson2(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const provider = parseProviderInput(body, void 0);
     if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
@@ -2191,25 +3218,25 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson(res, 201, { provider: toProviderView(provider) });
+    return writeJson2(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson(res, 200, { provider: toProviderView(updated) });
+    return writeJson2(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson(res, 200, { ok: true });
+    return writeJson2(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -2218,7 +3245,7 @@ function persistProviders(cfg, deps) {
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
     return writeJsonError(res, 400, "reorder requires { order: string[] }");
@@ -2242,14 +3269,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson2(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai") {
-    return writeJson(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson2(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -2257,7 +3284,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await fetch(url, { method: "GET", headers });
+    const response = await fetchUpstream(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -2266,32 +3293,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson(res, 200, {
+      return writeJson2(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson(res, 200, { models });
+    return writeJson2(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson2(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson2(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson2(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   const url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -2312,11 +3339,11 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(payload)
-    });
+    const response = await fetchUpstream(
+      url,
+      { method: "POST", headers, body: JSON.stringify(payload) },
+      { providerId: "byo" }
+    );
     const latencyMs = Date.now() - startedAt;
     const text = await response.text().catch(() => "");
     if (!response.ok) {
@@ -2326,9 +3353,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson2(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson(res, 200, {
+    return writeJson2(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -2336,7 +3363,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson2(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -2358,9 +3385,9 @@ function toPoolKeyView(row, cooldown, deps) {
   return entries.map((e) => {
     const auto = deps.autoDisableStore.get(e.id);
     const cd = cooldown[e.id];
-    const health = {};
-    if (cd) health.cooldown = cd;
-    if (auto) health.autoDisabled = { status: auto.status, at: auto.at, reason: auto.reason };
+    const health2 = {};
+    if (cd) health2.cooldown = cd;
+    if (auto) health2.autoDisabled = { status: auto.status, at: auto.at, reason: auto.reason };
     return {
       id: e.id,
       label: e.label && e.label.length > 0 ? e.label : e.id,
@@ -2368,7 +3395,7 @@ function toPoolKeyView(row, cooldown, deps) {
       enabled: e.enabled !== false && !deps.autoDisableStore.isDisabled(e.id),
       weight: typeof e.weight === "number" && Number.isFinite(e.weight) ? e.weight : 1,
       apiKeyMasked: maskProviderApiKey(e.apiKey),
-      ...Object.keys(health).length > 0 ? { health } : {}
+      ...Object.keys(health2).length > 0 ? { health: health2 } : {}
     };
   });
 }
@@ -2377,7 +3404,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -2396,7 +3423,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const parsed = parsePoolKeyInput(body);
   if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -2408,7 +3435,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson2(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -2418,7 +3445,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -2428,7 +3455,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -2442,7 +3469,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -2452,11 +3479,11 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -2627,18 +3654,31 @@ function handlePresets(res, method) {
     baseUrl: p.baseUrl,
     models: p.models
   }));
-  return writeJson(res, 200, { presets, excluded });
+  return writeJson2(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
-    return writeJson(res, 200, { keys: rows.map(toKeyInfo) });
+    const reader = deps.keySpendReader;
+    if (!reader) return writeJson2(res, 200, { keys: rows.map(toKeyInfo) });
+    const now = Date.now();
+    const keys = await Promise.all(
+      rows.map(async (row) => {
+        const info = toKeyInfo(row);
+        if (row.revokedAt === null) {
+          const s = await reader.getSpend(row.id, now);
+          info.spend = { dailyUsd: s.dailyUsd, weeklyUsd: s.weeklyUsd, totalUsd: s.totalUsd };
+        }
+        return info;
+      })
+    );
+    return writeJson2(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await createNamedKey2(deps.keyDb, name);
-    return writeJson(res, 201, {
+    return writeJson2(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -2650,46 +3690,185 @@ async function handleKeys(req, res, method, rest, deps) {
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson(res, ok ? 200 : 404, { ok });
+    return writeJson2(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const enabled = body["enabled"] === true;
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson2(res, ok ? 200 : 404, { ok, enabled });
+  }
+  if (method === "POST" && id && action === "max-concurrency") {
+    const body = await readJsonBody3(req);
+    const raw = body["maxConcurrency"];
+    let value;
+    if (raw === null) {
+      value = null;
+    } else if (typeof raw === "number" && Number.isInteger(raw) && raw >= 1 && raw <= 1e3) {
+      value = raw;
+    } else {
+      return writeJsonError(
+        res,
+        400,
+        "maxConcurrency must be an integer 1..1000 or null"
+      );
+    }
+    const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
+    return writeJson2(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+  }
+  if (method === "POST" && id && action === "policy") {
+    const body = await readJsonBody3(req);
+    const parsed = parseKeyPolicyBody(body);
+    if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
+    const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
+    return writeJson2(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
+function validateQueueSegments(patch) {
+  const errors = [];
+  const checkNum = (label, value, min, max) => {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < min || value > max) {
+      errors.push(`${label} must be a number ${min}..${max}`);
+    }
+  };
+  const isPlainObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  const umq = patch.userMessageQueue;
+  if (umq !== void 0) {
+    if (!isPlainObject4(umq)) {
+      errors.push("userMessageQueue must be an object");
+    } else {
+      if (typeof umq.enabled !== "boolean") {
+        errors.push("userMessageQueue.enabled must be a boolean");
+      }
+      checkNum("userMessageQueue.delayMs", umq.delayMs, 0, 1e4);
+      checkNum("userMessageQueue.waitTimeoutMs", umq.waitTimeoutMs, 1e3, 3e5);
+    }
+  }
+  const cq = patch.concurrencyQueue;
+  if (cq !== void 0) {
+    if (!isPlainObject4(cq)) {
+      errors.push("concurrencyQueue must be an object");
+    } else {
+      checkNum("concurrencyQueue.maxQueueSizeFactor", cq.maxQueueSizeFactor, 1, 10);
+      checkNum("concurrencyQueue.minQueueSize", cq.minQueueSize, 1, 100);
+      checkNum("concurrencyQueue.waitTimeoutMs", cq.waitTimeoutMs, 1e3, 3e5);
+    }
+  }
+  const ah = patch.accountHealth;
+  if (ah !== void 0) {
+    if (!isPlainObject4(ah)) {
+      errors.push("accountHealth must be an object");
+    } else {
+      if (typeof ah.overloadCooldownEnabled !== "boolean") {
+        errors.push("accountHealth.overloadCooldownEnabled must be a boolean");
+      }
+      checkNum("accountHealth.overloadCooldownMs", ah.overloadCooldownMs, 6e4, 36e5);
+    }
+  }
+  return errors;
+}
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
-    const config = await loadServerConfig(deps.settingsStore);
-    return writeJson(res, 200, { server: config });
+    const config = await loadServerConfig2(deps.settingsStore);
+    let server = config;
+    if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
+    if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
+    if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
+    return writeJson2(res, 200, { server });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody(req);
-    const current = await loadServerConfig(deps.settingsStore);
-    const merged = mergeServerConfig(current, patch);
+    const patch = await readJsonBody3(req);
+    const queueErrors = validateQueueSegments(patch);
+    if (queueErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
+    }
+    const webhookErrors = validateWebhookSegment(patch);
+    if (webhookErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
+    }
+    const auditErrors = validateAuditSegment(patch);
+    if (auditErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid audit config: ${auditErrors.join("; ")}`);
+    }
+    const billingErrors = validateBillingSegment(patch);
+    if (billingErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
+    }
+    const current = await loadServerConfig2(deps.settingsStore);
+    let effectivePatch = patch;
+    if (patch.proxy) {
+      effectivePatch = { ...effectivePatch, proxy: preserveOutboundProxySecrets(patch.proxy, current.proxy) };
+    }
+    if (patch.webhook) {
+      effectivePatch = { ...effectivePatch, webhook: preserveWebhookSecrets(patch.webhook, current.webhook) };
+    }
+    if (patch.billing) {
+      effectivePatch = { ...effectivePatch, billing: preserveBillingSecret(patch.billing, current.billing) };
+    }
+    const merged = mergeServerConfig(current, effectivePatch);
     await saveServerConfig(deps.settingsStore, merged);
-    await deps.outboundApiServer.applyConfig({
-      enabled: merged.enabled,
-      networkBinding: merged.networkBinding,
-      endpoints: merged.endpoints,
-      port: merged.port
-    });
-    return writeJson(res, 200, { server: merged });
+    setServerProxyConfig(merged.proxy);
+    applyWebhookConfig(merged.webhook);
+    applyAuditConfig(merged.audit);
+    applyBillingConfig(merged.billing);
+    if (merged.enabled) {
+      const missing = validateServerModelConfig(merged);
+      if (missing.length > 0) {
+        if (deps.outboundApiServer.getStatus().running) {
+          await deps.outboundApiServer.stop();
+        }
+        return writeJson2(res, 200, {
+          server: merged,
+          error: { code: "incomplete-model-config", missing }
+        });
+      }
+    }
+    try {
+      await deps.outboundApiServer.applyConfig({
+        enabled: merged.enabled,
+        networkBinding: merged.networkBinding,
+        endpoints: merged.endpoints,
+        port: merged.port,
+        userMessageQueue: merged.userMessageQueue,
+        concurrencyQueue: merged.concurrencyQueue,
+        // voucher-redemption #9: hot-apply the voucher flag so enabling the product
+        // takes effect without a restart.
+        voucher: merged.voucher
+      });
+    } catch (err5) {
+      const missing = incompleteConfigMissing(err5);
+      if (missing) {
+        return writeJson2(res, 200, {
+          server: merged,
+          error: { code: "incomplete-model-config", missing }
+        });
+      }
+      throw err5;
+    }
+    return writeJson2(res, 200, { server: merged });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
+function incompleteConfigMissing(err5) {
+  if (typeof err5 !== "object" || err5 === null) return null;
+  const missing = err5.missing;
+  return Array.isArray(missing) ? missing : null;
+}
 async function handleAccounts(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson2(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
+  }
+  if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
+    const result = handleCodexOAuthCancel(rest[2], deps);
+    return writeJson2(res, result.status, result.body);
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -2698,15 +3877,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson(res, result.status, result.body);
+      return writeJson2(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody(req);
+      const body2 = await readJsonBody3(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson(res, result.status, result.body);
+      return writeJson2(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody(req);
+      const body2 = await readJsonBody3(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
         return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
@@ -2714,79 +3893,113 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson2(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
         return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody(req);
+      const body2 = await readJsonBody3(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson(res, 200, { ok: true, account: status2 ?? void 0 });
+      return writeJson2(res, 200, { ok: true, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest[1] === "refresh") {
       if (providerId === "opencodego") {
         return writeJsonError(res, 400, "opencodego credentials are not refreshable");
       }
-      const writer = deps.subscriptionTokenWriter;
-      const ok = providerId === "claude" ? await writer.refreshClaudeToken() : providerId === "codex" ? await writer.refreshCodexToken() : await writer.refreshGeminiToken();
+      const writer2 = deps.subscriptionTokenWriter;
+      const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson2(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody(req);
+      const body2 = await readJsonBody3(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson(res, 200, { ok: true });
+      return writeJson2(res, 200, { ok: true });
+    }
+    if (method === "POST" && rest[2] === "priority") {
+      const accountId = rest[1];
+      const body2 = await readJsonBody3(req);
+      const raw = body2["priority"];
+      const priority = typeof raw === "number" ? raw : Number(raw);
+      if (!Number.isFinite(priority)) {
+        return writeJsonError(res, 400, "priority must be a finite number");
+      }
+      const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
+      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJson2(res, 200, { ok: true });
+    }
+    if (method === "POST" && rest[2] === "proxy") {
+      const accountId = rest[1];
+      const body2 = await readJsonBody3(req);
+      const rawProxy = body2["proxy"];
+      let proxy;
+      if (rawProxy !== null && rawProxy !== void 0) {
+        proxy = normalizeProxyConfig(rawProxy);
+        if (!proxy) return writeJsonError(res, 400, "invalid proxy config");
+      }
+      const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
+      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJson2(res, 200, { ok: true });
+    }
+    if (method === "POST" && rest[2] === "supported-models") {
+      const accountId = rest[1];
+      const body2 = await readJsonBody3(req);
+      const parsed = validateSupportedModelsBody(body2["supportedModels"]);
+      if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
+      const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
+      if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
+      return writeJson2(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody(req);
+      const body2 = await readJsonBody3(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson(res, 200, { ok: true });
+      return writeJson2(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length >= 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson(res, 200, { ok: true });
+      return writeJson2(res, 200, { ok: true });
     }
     if (method === "DELETE") {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
-      return writeJson(res, 200, { ok: true });
+      return writeJson2(res, 200, { ok: true });
     }
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
       return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson(res, 200, status ? { account: status } : { ok: true });
+    return writeJson2(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -2794,14 +4007,14 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody(req);
+    const body = await readJsonBody3(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
@@ -2809,20 +4022,28 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson(res, result.status, result.body);
+    return writeJson2(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
-  const serverConfig = await loadServerConfig(deps.settingsStore);
-  const endpoints = serverConfig.endpoints.map((e) => ({
-    endpoint: e.endpoint,
-    model: e.defaultModel,
-    useSubscription: e.useSubscription
-  }));
-  return writeJson(res, 200, { ...status, endpoints });
+  const serverConfig = await loadServerConfig2(deps.settingsStore);
+  const endpoints = serverConfig.endpoints.map((e) => {
+    if (isKindMappedEndpoint(e.endpoint)) {
+      return { endpoint: e.endpoint, kinds: e.modelMap ?? {}, useSubscription: e.useSubscription };
+    }
+    if (e.endpoint === "chat") {
+      return { endpoint: e.endpoint, models: e.models ?? [], useSubscription: e.useSubscription };
+    }
+    return { endpoint: e.endpoint, model: e.defaultModel ?? "", useSubscription: e.useSubscription };
+  });
+  if (status.running) {
+    const queueStatus = deps.outboundApiServer.getQueueStatus();
+    return writeJson2(res, 200, { ...status, endpoints, queueStatus });
+  }
+  return writeJson2(res, 200, { ...status, endpoints });
 }
 function resolvePlaygroundPath(endpoint, body) {
   switch (endpoint) {
@@ -2842,7 +4063,7 @@ function resolvePlaygroundPath(endpoint, body) {
 }
 async function handlePlayground(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody(req);
+  const body = await readJsonBody3(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
@@ -2987,10 +4208,12 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
   return true;
 }
 
+// src/admin/version.ts
+var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
 var LAN_ADDR = "0.0.0.0";
-var DAEMON_VERSION = true ? "0.1.2" : "0.0.0-dev";
 var AdminServer = class {
   constructor(deps) {
     this.deps = deps;
@@ -3011,7 +4234,7 @@ var AdminServer = class {
     const cfg = this.deps.getAdminConfig();
     if (!cfg.enabled) return 0;
     if (cfg.networkBinding && !cfg.token) {
-      console.error(
+      this.deps.logger.error(
         "[AdminServer] REFUSING to bind: admin.networkBinding (LAN/0.0.0.0) requires a non-empty admin.token. Set admin.token in config.json or disable networkBinding. Dashboard stays DOWN (fail closed)."
       );
       return 0;
@@ -3020,7 +4243,7 @@ var AdminServer = class {
     const actualPort = await this.listen(bindAddr, cfg.port);
     this.boundAddr = bindAddr;
     this.boundPort = actualPort;
-    console.info(`[AdminServer] Dashboard listening on ${bindAddr}:${actualPort}`);
+    this.deps.logger.info(`[AdminServer] Dashboard listening on ${bindAddr}:${actualPort}`);
     return actualPort;
   }
   /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
@@ -3042,7 +4265,7 @@ var AdminServer = class {
         const addr = server.address();
         if (addr && typeof addr === "object") {
           server.removeListener("error", onError);
-          server.on("error", (e) => console.error("[AdminServer] server error", e));
+          server.on("error", (e) => this.deps.logger.error("[AdminServer] server error", e));
           this.server = server;
           resolve(addr.port);
         } else {
@@ -3055,7 +4278,7 @@ var AdminServer = class {
   onRequest(req, res) {
     void this.dispatch(req, res).catch((err5) => {
       const message = err5 instanceof Error ? err5.message : String(err5);
-      console.error("[AdminServer] unhandled error:", message);
+      this.deps.logger.error("[AdminServer] unhandled error:", message);
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: { type: "admin_error", message } }));
@@ -3066,18 +4289,42 @@ var AdminServer = class {
     const cfg = this.deps.getAdminConfig();
     res.setHeader("x-omnicross-daemon", DAEMON_VERSION);
     res.setHeader("x-omnicross-pid", String(process.pid));
+    const url = req.url ?? "/";
+    const path2 = url.split("?")[0];
+    const healthPath = path2.replace(/\/+$/, "") || "/";
+    if ((req.method === "GET" || req.method === "HEAD") && (healthPath === "/health" || healthPath === "/healthz")) {
+      const report = this.deps.getHealthReport();
+      const code = healthHttpStatus(report.status);
+      res.writeHead(code, { "Content-Type": "application/json" });
+      res.end(req.method === "HEAD" ? void 0 : JSON.stringify(report));
+      return;
+    }
     if (cfg.token && !this.isAuthorized(req, cfg.token)) {
       res.writeHead(401, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "unauthorized", message: "admin token required" } }));
       return;
     }
-    const url = req.url ?? "/";
-    const path2 = url.split("?")[0];
     if ((req.method === "GET" || req.method === "HEAD") && (path2 === "/" || path2 === "/admin")) {
       res.writeHead(302, { Location: "/ui/" });
       res.end();
       return;
     }
+    if (path2 === "/admin/api/account-probes" && (req.method === "GET" || req.method === "HEAD")) {
+      handleAccountProbes(res, this.deps.probeHistoryReader);
+      return;
+    }
+    if (path2 === "/admin/api/audit" && (req.method === "GET" || req.method === "HEAD")) {
+      handleAuditQuery(req, res, this.deps.auditReader);
+      return;
+    }
+    if (path2 === "/admin/api/billing-status" && (req.method === "GET" || req.method === "HEAD")) {
+      handleBillingStatus(res, this.deps.billingStatusReader);
+      return;
+    }
+    if (path2 === "/admin/api/webhook-test" && req.method === "POST") {
+      await handleWebhookTest(req, res);
+      return;
+    }
     if (path2.startsWith("/admin/api/")) {
       await handleAdminApi(req, res, path2, this.deps);
       return;
@@ -3121,6 +4368,51 @@ function constantTimeEquals(a, b) {
   return timingSafeEqual(bufA, bufB);
 }
 
+// src/admin/health.ts
+var CRITICAL_CHECKS = ["config", "credentialStore"];
+var READINESS_CHECKS = ["outboundServer"];
+function safeBool(fn) {
+  try {
+    return fn() === true;
+  } catch {
+    return false;
+  }
+}
+function toMb(bytes) {
+  return Math.round(bytes / (1024 * 1024) * 10) / 10;
+}
+function buildHealthReport(deps) {
+  const checks = {
+    config: safeBool(deps.configPresent),
+    credentialStore: safeBool(deps.credentialStoreReadable),
+    outboundServer: safeBool(deps.outboundServerRunning),
+    adminServer: safeBool(deps.adminServerRunning)
+  };
+  if (deps.subscriptionAccountsHealthy) {
+    let probeHealthy;
+    try {
+      probeHealthy = deps.subscriptionAccountsHealthy();
+    } catch {
+      probeHealthy = false;
+    }
+    if (probeHealthy !== void 0) checks.subscriptionAccountsHealthy = probeHealthy;
+  }
+  const criticalOk = CRITICAL_CHECKS.every((k) => checks[k]);
+  const readinessOk = READINESS_CHECKS.every((k) => checks[k]);
+  const status = !criticalOk ? "error" : readinessOk ? "ok" : "degraded";
+  const mem = (deps.memoryUsage ?? process.memoryUsage)();
+  const uptime = (deps.uptimeSeconds ?? process.uptime)();
+  const nowMs = (deps.now ?? Date.now)();
+  return {
+    status,
+    version: deps.version,
+    uptimeSeconds: Math.floor(uptime),
+    timestamp: new Date(nowMs).toISOString(),
+    memory: { rssMb: toMb(mem.rss), heapUsedMb: toMb(mem.heapUsed) },
+    checks
+  };
+}
+
 // src/admin/oauthSessions.ts
 import crypto2 from "crypto";
 var DEFAULT_OAUTH_SESSION_TTL_MS = 10 * 60 * 1e3;
@@ -3172,7 +4464,7 @@ var DEFAULT_TIMEOUT_MS = 5 * 6e4;
 function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
-function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
+function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
@@ -3206,6 +4498,12 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS) {
       res.end(pageHtml("Login complete."));
       finish(server, () => resolve(code));
     });
+    const abort = () => finish(server, () => reject(new Error("login: cancelled")));
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+    signal?.addEventListener("abort", abort, { once: true });
     server.on("error", (err5) => {
       if (settled) return;
       settled = true;
@@ -3452,46 +4750,199 @@ function toLLMProvider(row) {
   };
 }
 
-// src/ports/ConsoleLogger.ts
-var ConsoleLogger = class {
+// src/ports/ConfigurableLogger.ts
+import { createWriteStream } from "fs";
+var LEVEL_ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
+var RESERVED_JSON_KEYS = /* @__PURE__ */ new Set(["ts", "level", "msg", "error"]);
+var ConfigurableLogger = class {
+  threshold;
+  format;
+  filePath;
+  fileStream = null;
+  fileDisabled = false;
+  constructor(cfg) {
+    this.threshold = LEVEL_ORDER[cfg?.level ?? "debug"];
+    this.format = cfg?.format ?? "text";
+    this.filePath = cfg?.file && cfg.file.length > 0 ? cfg.file : void 0;
+  }
   info(message, meta) {
-    if (meta === void 0) console.info(message);
-    else console.info(message, meta);
+    this.emit("info", message, void 0, meta);
   }
   warn(message, meta) {
-    if (meta === void 0) console.warn(message);
-    else console.warn(message, meta);
+    this.emit("warn", message, void 0, meta);
   }
   error(message, error, meta) {
-    if (error === void 0 && meta === void 0) console.error(message);
-    else if (meta === void 0) console.error(message, error);
-    else console.error(message, error, meta);
+    this.emit("error", message, error, meta);
   }
   debug(message, meta) {
-    if (meta === void 0) console.debug(message);
-    else console.debug(message, meta);
+    this.emit("debug", message, void 0, meta);
+  }
+  /**
+   * Flush + close the file sink (tests / graceful shutdown). Resolves once the
+   * append stream has finished flushing to disk. No-op when no file sink is open.
+   */
+  close() {
+    const stream = this.fileStream;
+    this.fileStream = null;
+    if (!stream) return Promise.resolve();
+    return new Promise((resolve) => stream.end(() => resolve()));
+  }
+  emit(level, message, error, meta) {
+    if (LEVEL_ORDER[level] > this.threshold) return;
+    this.writeConsole(level, message, error, meta);
+    if (this.filePath) this.writeFile(level, message, error, meta);
+  }
+  /**
+   * Console sink. In `text` format this reproduces the legacy `ConsoleLogger`
+   * EXACTLY (same method + arg shape) so the unconfigured default is a byte-for-
+   * byte drop-in; in `json` format it prints the structured line.
+   */
+  writeConsole(level, message, error, meta) {
+    if (this.format === "json") {
+      this.consoleFn(level)(this.jsonLine(level, message, error, meta));
+      return;
+    }
+    if (level === "error") {
+      if (error === void 0 && meta === void 0) console.error(message);
+      else if (meta === void 0) console.error(message, error);
+      else console.error(message, error, meta);
+      return;
+    }
+    const fn = this.consoleFn(level);
+    if (meta === void 0) fn(message);
+    else fn(message, meta);
+  }
+  /** Append one line to the file sink; a failure disables the sink (swallowed). */
+  writeFile(level, message, error, meta) {
+    const stream = this.getFileStream();
+    if (!stream) return;
+    try {
+      const line = this.format === "json" ? this.jsonLine(level, message, error, meta) : this.textLine(level, message, error, meta);
+      stream.write(line + "\n");
+    } catch {
+    }
+  }
+  /** Lazily open the append-only file stream; disable the sink on any error. */
+  getFileStream() {
+    if (this.fileDisabled || !this.filePath) return null;
+    if (this.fileStream) return this.fileStream;
+    try {
+      const stream = createWriteStream(this.filePath, { flags: "a" });
+      stream.on("error", () => {
+        this.fileDisabled = true;
+        this.fileStream = null;
+      });
+      this.fileStream = stream;
+      return stream;
+    } catch {
+      this.fileDisabled = true;
+      return null;
+    }
+  }
+  consoleFn(level) {
+    switch (level) {
+      case "error":
+        return console.error;
+      case "warn":
+        return console.warn;
+      case "info":
+        return console.info;
+      case "debug":
+        return console.debug;
+    }
+  }
+  /** `{ ts, level, msg, ...meta }` (+ `error` when present) as a single line. */
+  jsonLine(level, message, error, meta) {
+    const obj = {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      msg: message
+    };
+    if (error !== void 0) obj["error"] = reduceError(error);
+    if (meta !== void 0) {
+      if (meta instanceof Error) obj["meta"] = reduceError(meta);
+      else if (meta && typeof meta === "object") {
+        for (const [k, v] of Object.entries(meta)) {
+          if (!RESERVED_JSON_KEYS.has(k)) obj[k] = v;
+        }
+      } else obj["meta"] = meta;
+    }
+    try {
+      return JSON.stringify(obj);
+    } catch {
+      return JSON.stringify({ ts: obj["ts"], level, msg: message });
+    }
+  }
+  /** Human-readable file line: `ISO [level] message {metaJson}`. */
+  textLine(level, message, error, meta) {
+    const parts = [`${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}`];
+    if (error !== void 0) parts.push(safeStringify(reduceError(error)));
+    if (meta !== void 0) parts.push(safeStringify(meta instanceof Error ? reduceError(meta) : meta));
+    return parts.join(" ");
   }
 };
+function reduceError(error) {
+  if (error instanceof Error) {
+    return error.stack ? { message: error.message, stack: error.stack } : { message: error.message };
+  }
+  return { value: String(error) };
+}
+function safeStringify(value) {
+  try {
+    return typeof value === "string" ? value : JSON.stringify(value);
+  } catch {
+    return "[unserializable]";
+  }
+}
 
 // src/ports/JsonApiServerSettingsStore.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { OUTBOUND_API_SERVER_CONFIG_KEY } from "@omnicross/core/outbound-api";
 var JsonApiServerSettingsStore = class {
-  constructor(configPath) {
+  /**
+   * @param configPath the daemon config.json whose `server` field is backed.
+   * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
+   *                    `server.proxy.*` passwords are encrypted-on-`set` /
+   *                    decrypted-on-`get` (the settings-store path is otherwise not
+   *                    secret-aware — every OTHER server field is non-secret). Null
+   *                    ⇒ passthrough (legacy/pure tests unchanged).
+   */
+  constructor(configPath, box = null) {
     this.configPath = configPath;
+    this.box = box;
   }
   configPath;
+  box;
   async get(key) {
     if (key !== OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
     const file = this.readFile();
-    return file.server ?? void 0;
+    if (file.server === void 0) return void 0;
+    return this.decryptSecrets(file.server);
   }
   async set(key, value) {
     if (key !== OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
-    file.server = value;
+    file.server = this.encryptSecrets(value);
     writeFileSync4(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   }
+  /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
+  encryptSecrets(config) {
+    if (!this.box) return config;
+    let out = config;
+    if (out?.proxy) out = { ...out, proxy: encryptProxySegment(out.proxy, this.box) };
+    if (out?.webhook) out = { ...out, webhook: encryptWebhookSegment(out.webhook, this.box) };
+    if (out?.billing) out = { ...out, billing: encryptBillingSegment(out.billing, this.box) };
+    return out;
+  }
+  /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
+  decryptSecrets(config) {
+    if (!this.box) return config;
+    let out = config;
+    if (out?.proxy) out = { ...out, proxy: decryptProxySegment(out.proxy, this.box) };
+    if (out?.webhook) out = { ...out, webhook: decryptWebhookSegment(out.webhook, this.box) };
+    if (out?.billing) out = { ...out, billing: decryptBillingSegment(out.billing, this.box) };
+    return out;
+  }
   /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
   readFile() {
     try {
@@ -3610,6 +5061,57 @@ var JsonlUsageEventStore = class {
     }
     return Array.from(groups.values());
   }
+  /**
+   * ONE pass over a single key's events (`ts < endTs`) summing its `costUsd` into
+   * `totalUsd` / `dailyUsd` (`ts >= dayStartTs`) / `weeklyUsd` (`ts >= weekStartTs`).
+   * Used to lazily seed the outbound key-policy spend tracker (once per key). A
+   * key with no attributed events yields all zeros.
+   */
+  async getSpendByKey(query) {
+    let totalUsd = 0;
+    let dailyUsd = 0;
+    let weeklyUsd = 0;
+    for (const row of this.readRows({ startTs: 0, endTs: query.endTs })) {
+      if (row.apiKeyId !== query.apiKeyId) continue;
+      totalUsd += row.costUsd;
+      if (row.ts >= query.dayStartTs) dailyUsd += row.costUsd;
+      if (row.ts >= query.weekStartTs) weeklyUsd += row.costUsd;
+    }
+    return { totalUsd, dailyUsd, weeklyUsd };
+  }
+  /**
+   * Time-series aggregation over LOCAL-time bucket boundaries. Every bucket in
+   * `[floor(startTs), endTs)` is present (empty ones zero-filled), ascending by
+   * `bucketStartTs`; an empty range (`startTs >= endTs`) returns `[]`. Reuses
+   * `readRows` so malformed lines are skipped and only in-range rows contribute.
+   */
+  async getTimeSeries(range, bucket) {
+    if (range.startTs >= range.endTs) return [];
+    const buckets = /* @__PURE__ */ new Map();
+    for (let b = floorToBucket(range.startTs, bucket); b < range.endTs; b = nextBoundary(b, bucket)) {
+      buckets.set(b, {
+        bucketStartTs: b,
+        label: bucketLabel(b, bucket),
+        requests: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+        costUsd: 0
+      });
+    }
+    for (const row of this.readRows(range)) {
+      const g = buckets.get(floorToBucket(row.ts, bucket));
+      if (!g) continue;
+      g.requests += 1;
+      g.inputTokens += row.inputTokens;
+      g.outputTokens += row.outputTokens;
+      g.cacheReadTokens += row.cacheReadTokens;
+      g.cacheCreationTokens += row.cacheCreationTokens;
+      g.costUsd += row.costUsd;
+    }
+    return Array.from(buckets.values());
+  }
   async getMessagesForSession(sessionId) {
     return this.readAllRows().filter((r) => r.sessionId === sessionId).sort((a, b) => a.ts - b.ts).map((r) => ({
       id: r.id,
@@ -3678,6 +5180,43 @@ var JsonlUsageEventStore = class {
     return rows;
   }
 };
+function floorToBucket(ts, bucket) {
+  const d = new Date(ts);
+  switch (bucket) {
+    case "hour":
+      return new Date(d.getFullYear(), d.getMonth(), d.getDate(), d.getHours()).getTime();
+    case "day":
+      return new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime();
+    case "month":
+      return new Date(d.getFullYear(), d.getMonth(), 1).getTime();
+  }
+}
+function nextBoundary(ts, bucket) {
+  const d = new Date(ts);
+  switch (bucket) {
+    case "hour":
+      return new Date(d.getFullYear(), d.getMonth(), d.getDate(), d.getHours() + 1).getTime();
+    case "day":
+      return new Date(d.getFullYear(), d.getMonth(), d.getDate() + 1).getTime();
+    case "month":
+      return new Date(d.getFullYear(), d.getMonth() + 1, 1).getTime();
+  }
+}
+var pad2 = (n) => String(n).padStart(2, "0");
+function bucketLabel(bucketStartTs, bucket) {
+  const d = new Date(bucketStartTs);
+  const y = d.getFullYear();
+  const mo = pad2(d.getMonth() + 1);
+  const day = pad2(d.getDate());
+  switch (bucket) {
+    case "hour":
+      return `${mo}-${day} ${pad2(d.getHours())}:00`;
+    case "day":
+      return `${y}-${mo}-${day}`;
+    case "month":
+      return `${y}-${mo}`;
+  }
+}
 var NUMERIC_FIELDS = [
   "ts",
   "inputTokens",
@@ -3832,48 +5371,143 @@ var JsonPricingStore = class {
   }
 };
 
-// src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4 } from "path";
-import {
-  claudeOAuth as claudeOAuth2,
-  codexOAuth as codexOAuth2,
-  geminiOAuth as geminiOAuth2
-} from "@omnicross/subscriptions";
-
-// src/ports/account-sync.ts
-var IMPORT_EXPIRY_MARGIN_MS = 6e4;
-function viewOf(tokens) {
-  return tokens;
-}
-function decideExternalImport(captured, external, now = Date.now()) {
-  if (!external?.accessToken) return "no-credential";
-  const capturedRt = viewOf(captured).refreshToken;
-  const hasNewRefresh = Boolean(external.refreshToken && external.refreshToken !== capturedRt);
-  const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > now + IMPORT_EXPIRY_MARGIN_MS : true;
-  return hasNewRefresh || accessStillValid ? "import" : "not-rotated";
-}
-function buildImportedTokens(captured, external) {
-  const imported = {
-    ...captured,
-    accessToken: external.accessToken,
-    status: "authorized",
-    errorMessage: void 0,
-    syncWarning: void 0,
-    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (external.refreshToken) imported.refreshToken = external.refreshToken;
-  if (external.expiresAt) imported.expiresAt = external.expiresAt;
-  else delete imported.expiresAt;
-  if (external.idToken) imported.idToken = external.idToken;
-  if (external.scopes) imported.scopes = external.scopes;
-  return imported;
-}
-function buildTokensFromExternal(provider, external) {
-  const base = {
-    authMethod: "oauth",
-    status: "authorized",
-    accessToken: external.accessToken,
+// src/ports/JsonVoucherDb.ts
+import { existsSync as existsSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+var JsonVoucherDb = class {
+  constructor(vouchersPath) {
+    this.vouchersPath = vouchersPath;
+  }
+  vouchersPath;
+  async voucherCreate(input) {
+    const rows = this.readRows();
+    const row = {
+      id: input.id,
+      codeHash: input.codeHash,
+      codePrefix: input.codePrefix,
+      type: input.type,
+      status: "unredeemed",
+      createdAt: input.createdAt ?? Date.now()
+    };
+    if (input.creditUsd != null) row.creditUsd = input.creditUsd;
+    if (input.renewalDays != null) row.renewalDays = input.renewalDays;
+    if (input.maxTotalCostLimitUsd != null) row.maxTotalCostLimitUsd = input.maxTotalCostLimitUsd;
+    if (input.maxExpiryDays != null) row.maxExpiryDays = input.maxExpiryDays;
+    rows.push(row);
+    this.writeRows(rows);
+    return row;
+  }
+  async voucherGetByHash(codeHash) {
+    const rows = this.readRows();
+    return rows.find((r) => r.codeHash === codeHash) ?? null;
+  }
+  async voucherRedeemCas(id, keyId, granted, now) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row || row.status !== "unredeemed") return false;
+    row.status = "redeemed";
+    row.redeemedAt = now;
+    row.redeemedByKeyId = keyId;
+    row.grantApplied = false;
+    if (granted.totalCostLimitUsd != null) row.grantedTotalCostLimitUsd = granted.totalCostLimitUsd;
+    if (granted.expiresAt != null) row.grantedExpiresAt = granted.expiresAt;
+    this.writeRows(rows);
+    return true;
+  }
+  async voucherMarkGrantApplied(id) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row || row.status !== "redeemed") return false;
+    if (row.grantApplied === true) return true;
+    row.grantApplied = true;
+    this.writeRows(rows);
+    return true;
+  }
+  async voucherRevertRedeem(id, keyId) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row || row.status !== "redeemed" || row.grantApplied === true) return false;
+    if (row.redeemedByKeyId !== keyId) return false;
+    row.status = "unredeemed";
+    delete row.redeemedAt;
+    delete row.redeemedByKeyId;
+    delete row.grantApplied;
+    delete row.grantedTotalCostLimitUsd;
+    delete row.grantedExpiresAt;
+    this.writeRows(rows);
+    return true;
+  }
+  async voucherRevokeCas(id, now) {
+    const rows = this.readRows();
+    const row = rows.find((r) => r.id === id);
+    if (!row || row.status !== "unredeemed") return false;
+    row.status = "revoked";
+    row.revokedAt = now;
+    this.writeRows(rows);
+    return true;
+  }
+  async voucherList() {
+    return this.readRows();
+  }
+  /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
+  readRows() {
+    if (!existsSync7(this.vouchersPath)) return [];
+    try {
+      const parsed = JSON.parse(readFileSync8(this.vouchersPath, "utf8"));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  writeRows(rows) {
+    writeFileSync6(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+  }
+};
+
+// src/ports/JsonSubscriptionCredentialStore.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname4 } from "path";
+import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import { fetchUpstream as fetchUpstream2 } from "@omnicross/core/pipeline/upstreamFetch";
+import { getSharedIdentityStore } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
+import {
+  claudeOAuth as claudeOAuth2,
+  codexOAuth as codexOAuth2,
+  geminiOAuth as geminiOAuth2
+} from "@omnicross/subscriptions";
+
+// src/ports/account-sync.ts
+var IMPORT_EXPIRY_MARGIN_MS = 6e4;
+function viewOf(tokens) {
+  return tokens;
+}
+function decideExternalImport(captured, external, now = Date.now()) {
+  if (!external?.accessToken) return "no-credential";
+  const capturedRt = viewOf(captured).refreshToken;
+  const hasNewRefresh = Boolean(external.refreshToken && external.refreshToken !== capturedRt);
+  const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > now + IMPORT_EXPIRY_MARGIN_MS : true;
+  return hasNewRefresh || accessStillValid ? "import" : "not-rotated";
+}
+function buildImportedTokens(captured, external) {
+  const imported = {
+    ...captured,
+    accessToken: external.accessToken,
+    status: "authorized",
+    errorMessage: void 0,
+    syncWarning: void 0,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (external.refreshToken) imported.refreshToken = external.refreshToken;
+  if (external.expiresAt) imported.expiresAt = external.expiresAt;
+  else delete imported.expiresAt;
+  if (external.idToken) imported.idToken = external.idToken;
+  if (external.scopes) imported.scopes = external.scopes;
+  return imported;
+}
+function buildTokensFromExternal(provider, external) {
+  const base = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: external.accessToken,
     lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   if (provider === "claude") {
@@ -3915,7 +5549,7 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join4 } from "path";
 function externalStorePath(provider, home = homedir2()) {
@@ -3968,10 +5602,10 @@ function parseCodexTokensEnvelope(raw) {
 }
 function readExternalCliCredentials(provider, home = homedir2()) {
   const path2 = externalStorePath(provider, home);
-  if (!existsSync7(path2)) return null;
+  if (!existsSync8(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse(readFileSync8(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync9(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -3980,7 +5614,7 @@ function readExternalCliCredentials(provider, home = homedir2()) {
 }
 
 // src/ports/external-cli-store.ts
-import { copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync9, renameSync, writeFileSync as writeFileSync6 } from "fs";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync10, renameSync, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname3 } from "path";
 function markerPath(provider, home) {
@@ -4008,9 +5642,9 @@ function buildCodexTokensEnvelope(tokens) {
   return envelope;
 }
 function readExistingObject(path2) {
-  if (!existsSync8(path2)) return {};
+  if (!existsSync9(path2)) return {};
   try {
-    const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync10(path2, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -4019,16 +5653,16 @@ function readExistingObject(path2) {
 function writeAtomic(path2, content) {
   mkdirSync2(dirname3(path2), { recursive: true });
   const temp = `${path2}.omnicross-tmp`;
-  writeFileSync6(temp, content, "utf8");
+  writeFileSync7(temp, content, "utf8");
   renameSync(temp, path2);
 }
 function createExternalCliStore(home = homedir3()) {
   return {
     readMarkerAccountId(provider) {
       const path2 = markerPath(provider, home);
-      if (!existsSync8(path2)) return void 0;
+      if (!existsSync9(path2)) return void 0;
       try {
-        const parsed = JSON.parse(readFileSync9(path2, "utf8"));
+        const parsed = JSON.parse(readFileSync10(path2, "utf8"));
         return typeof parsed.accountId === "string" && parsed.accountId ? parsed.accountId : void 0;
       } catch {
         return void 0;
@@ -4046,7 +5680,7 @@ function createExternalCliStore(home = homedir3()) {
       const envelope = provider === "claude" ? buildClaudeOAuthEnvelope(tokens) : buildCodexTokensEnvelope(tokens);
       if (!envelope) return false;
       const storePath = externalStorePath(provider, home);
-      if (existsSync8(storePath) && !existsSync8(backupPath(provider, home))) {
+      if (existsSync9(storePath) && !existsSync9(backupPath(provider, home))) {
         copyFileSync(storePath, backupPath(provider, home));
       }
       const existing = readExistingObject(storePath);
@@ -4058,16 +5692,21 @@ function createExternalCliStore(home = homedir3()) {
 }
 
 // src/ports/JsonSubscriptionCredentialStore.ts
+var ACCOUNT_REFRESH_LEAD_MS = 5 * 6e4;
 var JsonSubscriptionCredentialStore = class {
   /**
    * @param tokensPath  on-disk `tokens.json` location.
    * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
-   * @param fetchImpl   injectable HTTP port for the OAuth refresh round-trips
-   *                    (oauth design D4). Defaults to the global `fetch` so boot
-   *                    is unchanged; tests inject a mock fetch. NOT used by any
-   *                    read/write path — only by `refresh*Token`.
+   * @param fetchImpl   OPTIONAL injectable HTTP port for the OAuth refresh
+   *                    round-trips (oauth design D4). A TEST-injected transport is
+   *                    used verbatim. When ABSENT (production), each refresh uses a
+   *                    proxy-aware {@link fetchUpstream} that threads the
+   *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
+   *                    per-account/per-provider proxy is honored on refresh exactly
+   *                    as on relay — refresh egresses from the SAME proxy IP as the
+   *                    account's traffic. NOT used by any read/write path.
    */
-  constructor(tokensPath, box, fetchImpl = (url, init) => fetch(url, init), externalCliReader = readExternalCliCredentials, externalCliStore = createExternalCliStore()) {
+  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials, externalCliStore = createExternalCliStore()) {
     this.tokensPath = tokensPath;
     this.box = box;
     this.fetchImpl = fetchImpl;
@@ -4079,6 +5718,15 @@ var JsonSubscriptionCredentialStore = class {
   fetchImpl;
   externalCliReader;
   externalCliStore;
+  /**
+   * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
+   * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
+   * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
+   * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+   */
+  buildRefreshFetch(providerId, accountId) {
+    return this.fetchImpl ?? ((url, init) => fetchUpstream2(url, init, { providerId, accountId }));
+  }
   /**
    * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
    * SINGLE-USE: two concurrent refreshes of one account each spend the same
@@ -4110,6 +5758,19 @@ var JsonSubscriptionCredentialStore = class {
   async getValidOpenCodeGoApiKey() {
     return this.readConfig().opencodego?.apiKey ?? null;
   }
+  /**
+   * DAEMON-ONLY per-account proxy lookup by id (upstream-proxy). Returns the
+   * DECRYPTED `ProxyConfig` for the account (`readConfig` decrypts on read), or
+   * `undefined` for an unknown provider/account or no per-account proxy. Feeds the
+   * winning per-account layer of the upstream-proxy resolver. Synchronous like the
+   * other hot reads. Never returns token material.
+   */
+  getAccountProxy(providerId, accountId) {
+    if (providerId !== "claude" && providerId !== "codex" && providerId !== "gemini" && providerId !== "opencodego") {
+      return void 0;
+    }
+    return getAccountProxy(this.readConfig(), providerId, accountId);
+  }
   /**
    * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
    * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
@@ -4118,10 +5779,25 @@ var JsonSubscriptionCredentialStore = class {
    */
   async listSanitizedAccounts() {
     const config = this.readConfig();
+    const health2 = getSharedAccountHealth();
+    const identityStore = getSharedIdentityStore();
+    const fingerprintOn = identityStore.isEnabled();
+    const now = Date.now();
     const out = {};
     for (const provider of ["claude", "codex", "gemini", "opencodego"]) {
       const sanitized = sanitizeAccounts(config, provider);
-      if (sanitized.length > 0) out[provider] = this.attachSyncWarnings(config, provider, sanitized);
+      if (sanitized.length === 0) continue;
+      for (const account of sanitized) {
+        const status = health2.getStatus(provider, account.id, now);
+        account.health = status.state;
+        account.cooldownUntil = status.cooldownUntil !== void 0 ? new Date(status.cooldownUntil).toISOString() : void 0;
+        if (fingerprintOn && provider === "claude") {
+          account.identityCaptured = identityStore.hasIdentity(provider, account.id);
+          const capturedAt = identityStore.capturedAt(provider, account.id);
+          account.identityCapturedAt = capturedAt !== void 0 ? new Date(capturedAt).toISOString() : void 0;
+        }
+      }
+      out[provider] = this.attachSyncWarnings(config, provider, sanitized);
     }
     return out;
   }
@@ -4172,8 +5848,9 @@ var JsonSubscriptionCredentialStore = class {
       if (!active || !claude?.refreshToken) return false;
       const capturedId = active.id;
       this.materializeMigration(config);
+      const refreshFetch = this.buildRefreshFetch("claude", capturedId);
       try {
-        const result = await claudeOAuth2.refreshAccessToken(claude.refreshToken, this.fetchImpl);
+        const result = await claudeOAuth2.refreshAccessToken(claude.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...claude,
@@ -4190,7 +5867,7 @@ var JsonSubscriptionCredentialStore = class {
         return true;
       } catch (error) {
         if (await this.tryExternalImport("claude", capturedId, claude, async (rt) => {
-          const r = await claudeOAuth2.refreshAccessToken(rt, this.fetchImpl);
+          const r = await claudeOAuth2.refreshAccessToken(rt, refreshFetch);
           return {
             accessToken: r.accessToken,
             refreshToken: r.refreshToken,
@@ -4217,8 +5894,9 @@ var JsonSubscriptionCredentialStore = class {
       if (!active || !codex?.refreshToken) return false;
       const capturedId = active.id;
       this.materializeMigration(config);
+      const refreshFetch = this.buildRefreshFetch("codex", capturedId);
       try {
-        const result = await codexOAuth2.refreshAccessToken(codex.refreshToken, this.fetchImpl);
+        const result = await codexOAuth2.refreshAccessToken(codex.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...codex,
@@ -4236,7 +5914,7 @@ var JsonSubscriptionCredentialStore = class {
         return true;
       } catch (error) {
         if (await this.tryExternalImport("codex", capturedId, codex, async (rt) => {
-          const r = await codexOAuth2.refreshAccessToken(rt, this.fetchImpl);
+          const r = await codexOAuth2.refreshAccessToken(rt, refreshFetch);
           return {
             accessToken: r.accessToken,
             refreshToken: r.refreshToken,
@@ -4266,8 +5944,9 @@ var JsonSubscriptionCredentialStore = class {
       if (!active || !gemini?.refreshToken) return false;
       const capturedId = active.id;
       this.materializeMigration(config);
+      const refreshFetch = this.buildRefreshFetch("gemini", capturedId);
       try {
-        const result = await geminiOAuth2.refreshAccessToken(gemini.refreshToken, this.fetchImpl);
+        const result = await geminiOAuth2.refreshAccessToken(gemini.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...gemini,
@@ -4301,7 +5980,7 @@ var JsonSubscriptionCredentialStore = class {
       if (!account || !captured?.refreshToken) return false;
       this.materializeMigration(config);
       try {
-        const refreshed = await this.refreshUpstream(provider, captured.refreshToken);
+        const refreshed = await this.refreshUpstream(provider, captured.refreshToken, id);
         const next = {
           ...captured,
           accessToken: refreshed.accessToken,
@@ -4323,10 +6002,114 @@ var JsonSubscriptionCredentialStore = class {
       }
     });
   }
+  // ── By-id account-pool surface (subscription-account-scheduling, design D6) ──
+  /**
+   * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
+   * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
+   * (refresh is 401-driven, like `getValidClaudeAccessToken`); codex/gemini refresh
+   * a near-expiry token via `refreshAccountById` (like `resolveAccessToken`);
+   * opencodego returns the account's static key. `null` when unknown/expired/
+   * tokenless.
+   */
+  async getAccessTokenForAccount(providerId, accountId) {
+    const account = getAccountById(this.readConfig(), providerId, accountId);
+    if (!account) return null;
+    if (providerId === "opencodego") {
+      return account.tokens.apiKey ?? null;
+    }
+    const oauth = account.tokens;
+    if (!oauth.accessToken) return null;
+    if (providerId === "codex" || providerId === "gemini") {
+      const expiresAtMs = oauth.expiresAt ? Date.parse(oauth.expiresAt) : 0;
+      const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - ACCOUNT_REFRESH_LEAD_MS;
+      if (expiringSoon && oauth.refreshToken) {
+        const ok = await this.refreshAccountById(providerId, accountId);
+        if (!ok) return null;
+        const fresh = getAccountById(this.readConfig(), providerId, accountId);
+        return fresh?.tokens?.accessToken ?? null;
+      }
+    }
+    if (oauth.status === "expired") return null;
+    return oauth.accessToken;
+  }
+  /**
+   * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
+   * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
+   * → `false` (no refresh affordance).
+   */
+  async refreshAccountToken(providerId, accountId) {
+    if (providerId === "opencodego") return false;
+    return this.refreshAccountById(providerId, accountId);
+  }
+  /**
+   * Best-effort record of a selection time onto the account's `lastUsedAt` by id
+   * (design D4). Entry-metadata only (the token mirror is untouched); a no-op for
+   * an unknown id. The selector throttles the call frequency, so this stays cheap.
+   */
+  async touchAccountLastUsed(providerId, accountId, iso) {
+    const config = this.readConfig();
+    const result = setAccountLastUsed(config, providerId, accountId, iso);
+    if (!result.ok) return;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * Best-effort write-through of a per-account client `identity`
+   * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
+   * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
+   * an unknown id. Called by the identity store's persistence port on a first-seen
+   * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+   * store's port wrapper swallows a rejection so the relay hot path is unaffected.
+   */
+  async setAccountIdentity(providerId, accountId, identity) {
+    const config = this.readConfig();
+    const result = setAccountIdentity(config, providerId, accountId, identity);
+    if (!result.ok) return;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * DAEMON-ONLY set-priority (subscription-account-scheduling, admin write, NOT on
+   * the port). Set one account's scheduling `priority` by id. Secret-free
+   * (entry-metadata only; the mirror invariant is untouched). Rejects an unknown id.
+   */
+  async setAccountPriority(providerId, accountId, priority) {
+    const config = this.readConfig();
+    const result = setAccountPriority(config, providerId, accountId, priority);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
+   * the port). Passing `undefined` clears the override. Write-only password: when
+   * the incoming structured proxy omits the password but the account already had
+   * one, the current (decrypted) password is preserved — editing host/port never
+   * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
+   */
+  async setAccountProxy(providerId, accountId, proxy) {
+    const config = this.readConfig();
+    const merged = proxy ? preserveProxyConfigSecret(proxy, getAccountProxy(config, providerId, accountId)) : void 0;
+    const result = setAccountProxy(config, providerId, accountId, merged);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY set/clear per-account `supportedModels` (subscription-account-
+   * model-map, admin write, NOT on the port). Passing `undefined` clears it.
+   * Secret-free (model ids only; the mirror invariant is untouched). Rejects an
+   * unknown id.
+   */
+  async setAccountSupportedModels(providerId, accountId, supportedModels) {
+    const config = this.readConfig();
+    const result = setAccountSupportedModels(config, providerId, accountId, supportedModels);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
   /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
-  async refreshUpstream(provider, refreshToken) {
+  async refreshUpstream(provider, refreshToken, accountId) {
     const flow = provider === "claude" ? claudeOAuth2 : provider === "codex" ? codexOAuth2 : geminiOAuth2;
-    const r = await flow.refreshAccessToken(refreshToken, this.fetchImpl);
+    const r = await flow.refreshAccessToken(refreshToken, this.buildRefreshFetch(provider, accountId));
     return {
       accessToken: r.accessToken,
       refreshToken: r.refreshToken,
@@ -4464,119 +6247,907 @@ var JsonSubscriptionCredentialStore = class {
     });
   }
   /**
-   * DAEMON-ONLY WRITE (design D1, NOT on the port). Read-merge the given
-   * provider's token block into the current `AccountTokensConfig`, stamp a fresh
-   * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
-   * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
-   * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
-   * so a first-ever write still produces a valid config. No cache → the next read
-   * sees this write.
+   * DAEMON-ONLY WRITE (design D1, NOT on the port). Read-merge the given
+   * provider's token block into the current `AccountTokensConfig`, stamp a fresh
+   * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
+   * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
+   * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
+   * so a first-ever write still produces a valid config. No cache → the next read
+   * sees this write.
+   */
+  async writeProviderTokens(providerId, config) {
+    const current = this.readConfig();
+    writeActiveTokens(current, providerId, config);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /**
+   * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
+   * (optional label) and set it active, then re-derive the mirror — used by
+   * `omnicross login <provider> --label` to add an account instead of overwriting.
+   */
+  async appendProviderAccount(providerId, config, label) {
+    const current = this.readConfig();
+    const result = addAccount(current, providerId, config, label);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY active switch (design D5, NOT on the port). Switch the active
+   * account for a provider; rejects an unknown id. Re-derives the mirror.
+   */
+  async setActiveAccount(providerId, id) {
+    const current = this.readConfig();
+    const result = setActiveAccount(current, providerId, id);
+    if (!result.ok) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY per-account remove (design D5, NOT on the port). Remove one
+   * account; promote the most-recent remaining on active-removal (or clear the
+   * mirror when none remain). Re-derives the mirror.
+   */
+  async removeAccount(providerId, id) {
+    const current = this.readConfig();
+    const result = removeAccount(current, providerId, id);
+    if (!result.removed) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
+   * rejects an unknown id. Label-only — no token material is read or written
+   * (the secret-free invariant holds).
+   */
+  async renameAccount(providerId, id, label) {
+    const current = this.readConfig();
+    const result = renameAccount(current, providerId, id, label);
+    if (!result.ok) return result;
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
+  }
+  /**
+   * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
+   * block from `tokens.json` and re-persist (the strategies already tolerate an
+   * absent block). Stamps a fresh `updatedAt`. A no-op-shaped write when the
+   * provider was already absent (still re-stamps + persists).
+   */
+  async clearProvider(providerId) {
+    const current = this.readConfig();
+    clearProvider(current, providerId);
+    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+  /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
+   *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
+   *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
+   *  write — incl. child 4's future refresh writes — lands encrypted. */
+  persist(config) {
+    mkdirSync3(dirname4(this.tokensPath), { recursive: true });
+    const encrypted = encryptTokens(config, this.box);
+    writeFileSync8(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  }
+  /**
+   * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
+   * the token-material fields so every getter returns plaintext (the
+   * subscription bearer path is byte-identical).
+   *
+   * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
+   * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
+   * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
+   * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
+   * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
+   * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
+   * `config.ts loadConfig`, which decrypts outside its parse try.
+   */
+  readConfig() {
+    if (!existsSync10(this.tokensPath)) return { updatedAt: "" };
+    let parsed;
+    try {
+      const raw = JSON.parse(readFileSync11(this.tokensPath, "utf8"));
+      parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    } catch {
+      parsed = null;
+    }
+    if (!parsed) return { updatedAt: "" };
+    const decrypted = decryptTokens(parsed, this.box);
+    return migrateLazily(decrypted);
+  }
+};
+
+// src/AccountHealthProbeScheduler.ts
+import { fetchUpstream as fetchUpstream3 } from "@omnicross/core/pipeline/upstreamFetch";
+
+// src/probe/ProbeStrategy.ts
+var PROVIDER_PROBE_PLANS = {
+  claude: {
+    kind: "upstream",
+    // VERIFIED free authed list endpoint (no tokens billed). The anthropic OAuth
+    // bearer is accepted here exactly as on the relay path.
+    url: "https://api.anthropic.com/v1/models",
+    buildInit: (token) => ({
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "anthropic-version": "2023-06-01"
+      }
+    })
+  },
+  // UNVERIFIED cheap authed GET — Phase 1 local-only (LEAD OQ1: do not guess a
+  // billable/wrong endpoint). Upgrade to `{ kind:'upstream' }` once verified.
+  codex: { kind: "local" },
+  gemini: { kind: "local" },
+  opencodego: { kind: "local" }
+};
+function probePlanFor(providerId) {
+  return PROVIDER_PROBE_PLANS[providerId] ?? { kind: "local" };
+}
+
+// src/AccountHealthProbeScheduler.ts
+var KEY_SEP = "\0";
+var MAX_BODY_SNIFF = 2048;
+var PROBE_PROVIDERS = [
+  "claude",
+  "codex",
+  "gemini",
+  "opencodego"
+];
+var AccountHealthProbeScheduler = class {
+  constructor(store, health2, logger, config, opts = {}) {
+    this.store = store;
+    this.health = health2;
+    this.logger = logger;
+    this.config = config;
+    this.now = opts.now ?? Date.now;
+    this.fetchImpl = opts.fetchImpl ?? fetchUpstream3;
+    this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    this.planFor = opts.planFor ?? probePlanFor;
+  }
+  store;
+  health;
+  logger;
+  config;
+  timer = null;
+  sweeping = false;
+  history = /* @__PURE__ */ new Map();
+  now;
+  fetchImpl;
+  sleep;
+  planFor;
+  /** Whether probing is enabled by the current config. */
+  get enabled() {
+    return this.config.enabled;
+  }
+  /**
+   * Re-apply config to the live instance (the async `start.ts` loads the persisted
+   * `accountProbe` segment after `buildDaemon`). Call BEFORE `start()`.
+   */
+  configure(config) {
+    this.config = config;
+  }
+  /** Arm the probe interval. No-op when disabled (zero regression). Idempotent. */
+  start() {
+    if (this.timer || !this.config.enabled) return;
+    this.timer = setInterval(() => void this.sweep(), this.config.intervalMs);
+    this.timer.unref?.();
+  }
+  /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+  dispose() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  /**
+   * One sweep: probe every ELIGIBLE account SEQUENTIALLY with a `staggerMs` gap.
+   * Disabled ⇒ no-op. `onlyMultiAccount` skips single-account providers. Exposed
+   * for tests; never throws.
+   */
+  async sweep() {
+    if (!this.config.enabled || this.sweeping) return;
+    this.sweeping = true;
+    try {
+      const config = await this.store.getFullConfig();
+      let probed = 0;
+      let marked = 0;
+      for (const providerId of PROBE_PROVIDERS) {
+        const accounts = listAccounts(config, providerId);
+        if (this.config.onlyMultiAccount && accounts.length < 2) continue;
+        for (const account of accounts) {
+          if (probed > 0 && this.config.staggerMs > 0) await this.sleep(this.config.staggerMs);
+          const outcome = await this.probeAccount(providerId, account.id);
+          probed += 1;
+          if (outcome.marked) marked += 1;
+        }
+      }
+      this.logger.debug("account-probe sweep complete", { probed, marked });
+    } catch (error) {
+      this.logger.warn("account-probe sweep failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.sweeping = false;
+    }
+  }
+  /**
+   * Probe ONE account (design D1). Local tier first (dead token → synthesized 401,
+   * no upstream); else the upstream tier when a verified endpoint exists. Records
+   * the rolling history entry either way; returns whether the tracker was MARKED.
+   */
+  async probeAccount(providerId, accountId) {
+    const now = this.now();
+    let token = null;
+    let readThrew = false;
+    try {
+      token = await this.store.getAccessTokenForAccount(providerId, accountId);
+    } catch {
+      readThrew = true;
+    }
+    if (readThrew) {
+      this.record(providerId, accountId, { ts: now, ok: false, status: null, tier: "local" });
+      return { ok: false, marked: false };
+    }
+    if (!token) {
+      this.health.recordUpstreamOutcome(providerId, accountId, { status: 401, now });
+      this.record(providerId, accountId, { ts: now, ok: false, status: 401, tier: "local" });
+      return { ok: false, marked: true };
+    }
+    const plan = this.planFor(providerId);
+    if (plan.kind === "local") {
+      this.record(providerId, accountId, { ts: now, ok: true, tier: "local" });
+      return { ok: true, marked: false };
+    }
+    const start = this.now();
+    let status = null;
+    let bodyText;
+    try {
+      const res = await this.fetchImpl(
+        plan.url,
+        { ...plan.buildInit(token), signal: AbortSignal.timeout(this.config.timeoutMs) },
+        { providerId, accountId }
+      );
+      status = res.status;
+      if (status === 403) bodyText = await this.readBounded(res);
+    } catch {
+      status = null;
+    }
+    const latencyMs = this.now() - start;
+    const marked = this.applyOutcome(providerId, accountId, status, bodyText, now);
+    this.record(providerId, accountId, {
+      ts: now,
+      ok: status !== null && status >= 200 && status < 300,
+      status,
+      latencyMs,
+      tier: "upstream"
+    });
+    return { ok: status !== null && status < 400, marked };
+  }
+  /** Per-account rolling history for the authed admin surface (design D5). */
+  getAllHistory() {
+    const out = [];
+    for (const [key, records] of this.history) {
+      const [providerId, accountId] = this.parseKey(key);
+      out.push({ providerId, accountId, records: records.slice() });
+    }
+    return out;
+  }
+  /**
+   * The coarse, account-ANONYMOUS `/health` signal (design D5): `true` when no
+   * probed account is currently unhealthy (per #2's tracker). No ids, no counts —
+   * safe for the unauthenticated `/health`. Vacuously `true` when nothing probed.
+   */
+  probedAccountsHealthy(now = this.now()) {
+    for (const key of this.history.keys()) {
+      const [providerId, accountId] = this.parseKey(key);
+      if (!this.health.isSchedulable(providerId, accountId, now)) return false;
+    }
+    return true;
+  }
+  /**
+   * Feed ONLY the account/auth-decisive statuses to #2 (LEAD constraint):
+   * 401/403 → mark; 2xx → clear transient; 429 / 5xx / other 4xx / null →
+   * NOT forwarded (never a mark). Returns whether a NEGATIVE mark was applied.
+   */
+  applyOutcome(providerId, accountId, status, bodyText, now) {
+    if (status === null) return false;
+    if (status === 401 || status === 403) {
+      this.health.recordUpstreamOutcome(providerId, accountId, { status, bodyText, now });
+      return true;
+    }
+    if (status >= 200 && status < 300) {
+      this.health.clearTransientMark(providerId, accountId);
+      return false;
+    }
+    return false;
+  }
+  /** Append a record, capping the ring at `historySize` (drop oldest). */
+  record(providerId, accountId, rec) {
+    const key = this.key(providerId, accountId);
+    const list = this.history.get(key) ?? [];
+    list.push(rec);
+    const overflow = list.length - this.config.historySize;
+    if (overflow > 0) list.splice(0, overflow);
+    this.history.set(key, list);
+  }
+  /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
+  async readBounded(res) {
+    try {
+      return (await res.text()).slice(0, MAX_BODY_SNIFF);
+    } catch {
+      return "";
+    }
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+};
+
+// src/AccountHealthSweeper.ts
+var REFRESH_LEAD_MS = 5 * 6e4;
+var SWEEP_INTERVAL_MS = 6e4;
+var OAUTH_PROVIDERS = ["claude", "codex", "gemini"];
+function isOAuthProvider(providerId) {
+  return OAUTH_PROVIDERS.includes(providerId);
+}
+var AccountHealthSweeper = class {
+  constructor(store, health2, logger, intervalMs = SWEEP_INTERVAL_MS, leadMs = REFRESH_LEAD_MS) {
+    this.store = store;
+    this.health = health2;
+    this.logger = logger;
+    this.intervalMs = intervalMs;
+    this.leadMs = leadMs;
+  }
+  store;
+  health;
+  logger;
+  intervalMs;
+  leadMs;
+  timer = null;
+  sweeping = false;
+  /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+  start() {
+    if (this.timer) return;
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+  dispose() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  /**
+   * One sweep: surface accounts that just recovered (emits the recovery signal
+   * through the tracker's hook) and nudge a fresh token for any recovered OAuth
+   * account whose token is near expiry. Exposed for tests. Never throws.
+   */
+  async sweep(now = Date.now()) {
+    if (this.sweeping) return;
+    this.sweeping = true;
+    try {
+      const recovered = this.health.sweepRecoveries(now);
+      if (recovered.length === 0) return;
+      const config = await this.store.getFullConfig();
+      for (const event of recovered) {
+        if (!isOAuthProvider(event.providerId)) continue;
+        const account = getAccountById(config, event.providerId, event.accountId);
+        if (!account || !this.needsRefresh(account.tokens, now)) continue;
+        await this.refreshOne(event.providerId, event.accountId);
+      }
+    } catch (error) {
+      this.logger.warn("account-health sweep failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.sweeping = false;
+    }
+  }
+  /** Expiring within the lead window, refreshable, and not already dead. */
+  needsRefresh(tokens, now) {
+    const t = tokens;
+    if (!t.refreshToken || t.status === "expired" || t.status === "error") return false;
+    if (!t.expiresAt) return false;
+    const expiresAt = Date.parse(t.expiresAt);
+    return Number.isFinite(expiresAt) && now >= expiresAt - this.leadMs;
+  }
+  /** Refresh one recovered account by id; failures are logged, never thrown. */
+  async refreshOne(provider, id) {
+    try {
+      const ok = await this.store.refreshAccountById(provider, id);
+      if (ok) this.logger.info("account-health recovery refresh succeeded", { provider, accountId: id });
+      else this.logger.warn("account-health recovery refresh failed", { provider, accountId: id });
+    } catch (error) {
+      this.logger.warn("account-health recovery refresh threw", {
+        provider,
+        accountId: id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+};
+
+// src/audit/AuditPruneSweeper.ts
+import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
+import { join as join5 } from "path";
+
+// src/audit/auditFiles.ts
+var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var pad22 = (n) => String(n).padStart(2, "0");
+function auditFileName(ts) {
+  const d = new Date(ts);
+  return `audit-${d.getFullYear()}-${pad22(d.getMonth() + 1)}-${pad22(d.getDate())}.jsonl`;
+}
+function auditFileDateMs(fileName) {
+  const m = AUDIT_FILE_RE.exec(fileName);
+  if (!m) return null;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const d = new Date(year, month - 1, day);
+  if (d.getFullYear() !== year || d.getMonth() !== month - 1 || d.getDate() !== day) {
+    return null;
+  }
+  return d.getTime();
+}
+
+// src/audit/AuditPruneSweeper.ts
+var DAY_MS = 24 * 60 * 6e4;
+var SWEEP_INTERVAL_MS2 = 60 * 6e4;
+var AuditPruneSweeper = class {
+  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir;
+    this.logger = logger;
+    this.config = config;
+    this.intervalMs = intervalMs;
+    this.now = now;
+  }
+  auditDir;
+  logger;
+  config;
+  intervalMs;
+  now;
+  timer = null;
+  sweeping = false;
+  /** Whether pruning is active (audit enabled). */
+  get enabled() {
+    return this.config.enabled;
+  }
+  /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+  configure(config) {
+    this.config = config;
+  }
+  /**
+   * Arm the prune interval AND run one prune immediately (boot cleanup). No-op
+   * when audit is disabled (zero regression). Idempotent.
+   */
+  start() {
+    if (this.timer || !this.config.enabled) return;
+    void this.sweep();
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+  dispose() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+  /**
+   * One prune: unlink every audit date file strictly OLDER than the retention
+   * cutoff (`now - retentionDays` days, at local-midnight granularity). Exposed
+   * for tests; never throws. Returns the number of files removed.
+   */
+  async sweep() {
+    if (!this.config.enabled || this.sweeping) return 0;
+    this.sweeping = true;
+    try {
+      if (!existsSync11(this.auditDir)) return 0;
+      const today = new Date(this.now());
+      const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
+      const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
+      let removed = 0;
+      for (const file of readdirSync(this.auditDir)) {
+        const dateMs = auditFileDateMs(file);
+        if (dateMs === null || dateMs >= cutoff) continue;
+        try {
+          unlinkSync(join5(this.auditDir, file));
+          removed += 1;
+        } catch (error) {
+          this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
+            file,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      if (removed > 0) this.logger.debug("audit prune complete", { removed });
+      return removed;
+    } catch (error) {
+      this.logger.warn("audit prune sweep failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return 0;
+    } finally {
+      this.sweeping = false;
+    }
+  }
+};
+
+// src/audit/auditReader.ts
+import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "fs";
+import { join as join6 } from "path";
+var DEFAULT_LIMIT = 200;
+var MAX_LIMIT = 2e3;
+function readAuditRecords(auditDir, query = {}) {
+  if (!existsSync12(auditDir)) return [];
+  let files;
+  try {
+    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+  } catch {
+    return [];
+  }
+  const from = typeof query.from === "number" ? query.from : -Infinity;
+  const to = typeof query.to === "number" ? query.to : Infinity;
+  const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit ?? DEFAULT_LIMIT)));
+  const matched = [];
+  for (const file of files.sort().reverse()) {
+    let raw;
+    try {
+      raw = readFileSync12(join6(auditDir, file), "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      let rec;
+      try {
+        rec = JSON.parse(trimmed);
+      } catch {
+        continue;
+      }
+      if (!isAuditRecord(rec)) continue;
+      if (query.keyId !== void 0 && rec.keyId !== query.keyId) continue;
+      if (rec.ts < from || rec.ts > to) continue;
+      matched.push(rec);
+    }
+  }
+  matched.sort((a, b) => b.ts - a.ts);
+  return matched.slice(0, limit);
+}
+function isAuditRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["method"] === "string" && typeof r["path"] === "string" && typeof r["status"] === "number";
+}
+
+// src/audit/AuditWriter.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
+import { join as join7 } from "path";
+var AuditWriter = class {
+  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir;
+    this.logger = logger;
+    this.defer = defer;
+  }
+  auditDir;
+  logger;
+  defer;
+  dirEnsured = false;
+  /**
+   * Enqueue one record for append. Returns IMMEDIATELY (fire-and-forget); the fs
+   * write happens on the deferred tick. A failure is logged, never thrown.
+   */
+  record(record) {
+    this.defer(() => {
+      try {
+        this.appendNow(record);
+      } catch (error) {
+        this.logger.warn("[AuditWriter] failed to append audit record", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    });
+  }
+  /**
+   * Append synchronously — the awaitable form tests use to assert the line landed.
+   * Ensures the `audit/` directory exists on first write (lazy, like the usage
+   * store's lazy file creation).
    */
-  async writeProviderTokens(providerId, config) {
-    const current = this.readConfig();
-    writeActiveTokens(current, providerId, config);
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  appendNow(record) {
+    if (!this.dirEnsured) {
+      mkdirSync4(this.auditDir, { recursive: true });
+      this.dirEnsured = true;
+    }
+    const file = join7(this.auditDir, auditFileName(record.ts));
+    appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
+  }
+};
+
+// src/billing/BillingPublisher.ts
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
+import { createHmac } from "crypto";
+import { join as join8 } from "path";
+import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
+
+// src/billing/billingFiles.ts
+var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var DELIVERED_FILE_RE = /^delivered-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var pad23 = (n) => String(n).padStart(2, "0");
+function dateStamp(ts) {
+  const d = new Date(ts);
+  return `${d.getFullYear()}-${pad23(d.getMonth() + 1)}-${pad23(d.getDate())}`;
+}
+function billingFileName(ts) {
+  return `billing-${dateStamp(ts)}.jsonl`;
+}
+function deliveredFileName(ts) {
+  return `delivered-${dateStamp(ts)}.jsonl`;
+}
+
+// src/billing/BillingPublisher.ts
+var BILLING_POST_TIMEOUT_MS = 1e4;
+var BillingPublisher = class {
+  constructor(billingDir, logger, opts = {}) {
+    this.billingDir = billingDir;
+    this.logger = logger;
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream4(url, init));
+    this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
+    this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
+    this.now = opts.now ?? Date.now;
+  }
+  billingDir;
+  logger;
+  config;
+  dirEnsured = false;
+  fetchImpl;
+  defer;
+  timeoutMs;
+  now;
+  /** Install/replace the live billing config (endpoint + secret + retry bound). */
+  setConfig(config) {
+    this.config = config;
   }
   /**
-   * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
-   * (optional label) and set it active, then re-derive the mirror — used by
-   * `omnicross login <provider> --label` to add an account instead of overwriting.
+   * Record one billing event. DURABLE-FIRST: append synchronously (the event is
+   * now on disk, never lost), THEN schedule a best-effort POST off the caller's
+   * stack (non-blocking; ledger-only when no endpoint). Returns IMMEDIATELY and
+   * NEVER throws — a failing append/POST is logged, never propagated.
    */
-  async appendProviderAccount(providerId, config, label) {
-    const current = this.readConfig();
-    const result = addAccount(current, providerId, config, label);
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-    return result;
+  record(event) {
+    let appended = false;
+    try {
+      this.appendNow(event);
+      appended = true;
+    } catch (error) {
+      this.logger.warn("[BillingPublisher] failed to append billing event", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    if (appended && this.config?.endpoint) {
+      this.defer(() => {
+        void this.deliverNow(event).catch(() => {
+        });
+      });
+    }
   }
   /**
-   * DAEMON-ONLY active switch (design D5, NOT on the port). Switch the active
-   * account for a provider; rejects an unknown id. Re-derives the mirror.
+   * Append the event as one JSON line to `billing-YYYY-MM-DD.jsonl` (the event's
+   * LOCAL date). Synchronous — the awaitable form tests use to assert the ledger
+   * line landed BEFORE any delivery. Ensures the `billing/` directory on first write.
    */
-  async setActiveAccount(providerId, id) {
-    const current = this.readConfig();
-    const result = setActiveAccount(current, providerId, id);
-    if (!result.ok) return result;
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-    return result;
+  appendNow(event) {
+    this.ensureDir();
+    const file = join8(this.billingDir, billingFileName(event.ts));
+    appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
-   * DAEMON-ONLY per-account remove (design D5, NOT on the port). Remove one
-   * account; promote the most-recent remaining on active-removal (or clear the
-   * mirror when none remain). Re-derives the mirror.
+   * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
+   * event JSON to the configured endpoint (optionally HMAC-signed); on a 2xx ack
+   * appends a delivery marker and returns `true`. Any non-2xx / thrown / timed-out
+   * attempt returns `false` — the event stays UNdelivered in the ledger (never
+   * lost). NEVER rejects. A no-op `false` when no endpoint is configured.
    */
-  async removeAccount(providerId, id) {
-    const current = this.readConfig();
-    const result = removeAccount(current, providerId, id);
-    if (!result.removed) return result;
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-    return result;
+  async deliverNow(event) {
+    const endpoint = this.config?.endpoint;
+    if (!endpoint) return false;
+    try {
+      const body = JSON.stringify(event);
+      const headers = { "Content-Type": "application/json" };
+      const secret = this.config?.secret;
+      if (secret) {
+        const hmac = createHmac("sha256", secret).update(body).digest("hex");
+        headers["X-Omnicross-Billing-Signature"] = `sha256=${hmac}`;
+      }
+      const res = await this.fetchImpl(endpoint, {
+        method: "POST",
+        headers,
+        body,
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      if (!res.ok) {
+        this.logger.debug(`[billing] delivery failed ${event.id} (HTTP ${res.status})`);
+        return false;
+      }
+      this.markDelivered(event);
+      this.logger.debug(`[billing] delivered ${event.id}`);
+      return true;
+    } catch (error) {
+      this.logger.debug(
+        `[billing] delivery error ${event.id}: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return false;
+    }
   }
   /**
-   * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
-   * rejects an unknown id. Label-only — no token material is read or written
-   * (the secret-free invariant holds).
+   * Append a delivery marker `{ id, deliveredAt }` to `delivered-YYYY-MM-DD.jsonl`
+   * (keyed by the EVENT's date so the reader finds both together). Idempotent at
+   * the reconciliation layer — the reader unions marker ids into a delivered set,
+   * so a duplicate marker is harmless. A marker-write failure is logged, never thrown.
    */
-  async renameAccount(providerId, id, label) {
-    const current = this.readConfig();
-    const result = renameAccount(current, providerId, id, label);
-    if (!result.ok) return result;
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-    return result;
+  markDelivered(event) {
+    try {
+      this.ensureDir();
+      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
+    } catch (error) {
+      this.logger.warn("[BillingPublisher] failed to append delivery marker", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  ensureDir() {
+    if (this.dirEnsured) return;
+    mkdirSync5(this.billingDir, { recursive: true });
+    this.dirEnsured = true;
+  }
+};
+
+// src/billing/billingReader.ts
+import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync13 } from "fs";
+import { join as join9 } from "path";
+function readBillingLedger(billingDir) {
+  const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
+  if (!existsSync13(billingDir)) return view;
+  let files;
+  try {
+    files = readdirSync3(billingDir);
+  } catch {
+    return view;
+  }
+  for (const file of files.sort()) {
+    if (BILLING_FILE_RE.test(file)) {
+      for (const rec of parseLines(billingDir, file)) {
+        if (isBillingEvent(rec)) view.events.push(rec);
+      }
+    } else if (DELIVERED_FILE_RE.test(file)) {
+      for (const rec of parseLines(billingDir, file)) {
+        const id = rec.id;
+        if (typeof id === "string") view.deliveredIds.add(id);
+      }
+    }
+  }
+  return view;
+}
+function readUndeliveredEvents(billingDir) {
+  const { events, deliveredIds } = readBillingLedger(billingDir);
+  return events.filter((e) => !deliveredIds.has(e.id)).sort((a, b) => a.ts - b.ts);
+}
+function readBillingStatus(billingDir) {
+  const { events, deliveredIds } = readBillingLedger(billingDir);
+  let delivered = 0;
+  for (const e of events) if (deliveredIds.has(e.id)) delivered += 1;
+  return { total: events.length, delivered, pending: events.length - delivered };
+}
+function parseLines(dir, file) {
+  let raw;
+  try {
+    raw = readFileSync13(join9(dir, file), "utf8");
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      out.push(JSON.parse(trimmed));
+    } catch {
+    }
+  }
+  return out;
+}
+function isBillingEvent(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["model"] === "string" && typeof r["status"] === "number";
+}
+
+// src/billing/BillingRetrySweeper.ts
+var SWEEP_INTERVAL_MS3 = 5 * 6e4;
+var BillingRetrySweeper = class {
+  constructor(billingDir, publisher2, logger, config, intervalMs = SWEEP_INTERVAL_MS3, now = Date.now) {
+    this.billingDir = billingDir;
+    this.publisher = publisher2;
+    this.logger = logger;
+    this.config = config;
+    this.intervalMs = intervalMs;
+    this.now = now;
+  }
+  billingDir;
+  publisher;
+  logger;
+  config;
+  intervalMs;
+  now;
+  timer = null;
+  sweeping = false;
+  /** Whether retrying is active: billing enabled AND an endpoint is configured. */
+  get enabled() {
+    return this.config.enabled && typeof this.config.endpoint === "string" && this.config.endpoint.length > 0;
+  }
+  /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+  configure(config) {
+    this.config = config;
   }
   /**
-   * DAEMON-ONLY CLEAR (design D1/D3, NOT on the port). Remove a single provider's
-   * block from `tokens.json` and re-persist (the strategies already tolerate an
-   * absent block). Stamps a fresh `updatedAt`. A no-op-shaped write when the
-   * provider was already absent (still re-stamps + persists).
+   * Arm the retry interval AND run one sweep immediately (boot catch-up for events
+   * that failed to deliver while the daemon was down). No-op when disabled or in
+   * ledger-only mode (no endpoint to POST to). Idempotent.
    */
-  async clearProvider(providerId) {
-    const current = this.readConfig();
-    clearProvider(current, providerId);
-    this.persist({ ...current, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  start() {
+    if (this.timer || !this.enabled) return;
+    void this.sweep();
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
   }
-  /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
-   *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
-   *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
-   *  write — incl. child 4's future refresh writes — lands encrypted. */
-  persist(config) {
-    mkdirSync3(dirname4(this.tokensPath), { recursive: true });
-    const encrypted = encryptTokens(config, this.box);
-    writeFileSync7(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+  dispose() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
   }
   /**
-   * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
-   * the token-material fields so every getter returns plaintext (the
-   * subscription bearer path is byte-identical).
-   *
-   * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
-   * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
-   * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
-   * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
-   * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
-   * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
-   * `config.ts loadConfig`, which decrypts outside its parse try.
+   * One sweep: re-POST every UNdelivered ledger event still within
+   * `maxRetryAgeMs`; leave over-age undelivered events for reconciliation (NEVER
+   * deleted). Exposed for tests; never throws. Returns the number of events a
+   * re-POST was attempted for.
    */
-  readConfig() {
-    if (!existsSync9(this.tokensPath)) return { updatedAt: "" };
-    let parsed;
+  async sweep() {
+    if (!this.enabled || this.sweeping) return 0;
+    this.sweeping = true;
     try {
-      const raw = JSON.parse(readFileSync10(this.tokensPath, "utf8"));
-      parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
-    } catch {
-      parsed = null;
+      const cutoff = this.now() - this.config.maxRetryAgeMs;
+      let attempted = 0;
+      for (const event of readUndeliveredEvents(this.billingDir)) {
+        if (event.ts < cutoff) continue;
+        attempted += 1;
+        await this.publisher.deliverNow(event);
+      }
+      if (attempted > 0) this.logger.debug("billing retry sweep complete", { attempted });
+      return attempted;
+    } catch (error) {
+      this.logger.warn("billing retry sweep failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return 0;
+    } finally {
+      this.sweeping = false;
     }
-    if (!parsed) return { updatedAt: "" };
-    const decrypted = decryptTokens(parsed, this.box);
-    return migrateLazily(decrypted);
   }
 };
 
 // src/TokenRefreshScheduler.ts
-var REFRESH_LEAD_MS = 5 * 6e4;
-var SWEEP_INTERVAL_MS = 6e4;
-var OAUTH_PROVIDERS = ["claude", "codex", "gemini"];
+var REFRESH_LEAD_MS2 = 5 * 6e4;
+var SWEEP_INTERVAL_MS4 = 6e4;
+var OAUTH_PROVIDERS2 = ["claude", "codex", "gemini"];
 var TokenRefreshScheduler = class {
-  constructor(store, logger, intervalMs = SWEEP_INTERVAL_MS, leadMs = REFRESH_LEAD_MS) {
+  constructor(store, logger, intervalMs = SWEEP_INTERVAL_MS4, leadMs = REFRESH_LEAD_MS2) {
     this.store = store;
     this.logger = logger;
     this.intervalMs = intervalMs;
@@ -4607,7 +7178,7 @@ var TokenRefreshScheduler = class {
     this.sweeping = true;
     try {
       const config = await this.store.getFullConfig();
-      for (const provider of OAUTH_PROVIDERS) {
+      for (const provider of OAUTH_PROVIDERS2) {
         const activeId = getActiveAccount(config, provider)?.id;
         for (const account of listAccounts(config, provider)) {
           if (!this.needsRefresh(account.tokens, now)) continue;
@@ -4660,16 +7231,186 @@ var TokenRefreshScheduler = class {
   }
 };
 
+// src/webhook/WebhookDispatcher.ts
+import { createHmac as createHmac2 } from "crypto";
+import { fetchUpstream as fetchUpstream5 } from "@omnicross/core/pipeline/upstreamFetch";
+var WEBHOOK_MAX_ATTEMPTS = 3;
+var WEBHOOK_QUEUE_MAX = 1e3;
+var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
+var WEBHOOK_BASE_BACKOFF_MS = 200;
+var defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var WebhookDispatcher = class {
+  config;
+  queue = [];
+  draining = false;
+  warnedFull = false;
+  fetchImpl;
+  logger;
+  maxAttempts;
+  queueMax;
+  timeoutMs;
+  baseBackoffMs;
+  sleep;
+  now;
+  constructor(opts = {}) {
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream5(url, init));
+    this.logger = opts.logger;
+    this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
+    this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
+    this.timeoutMs = opts.timeoutMs ?? WEBHOOK_SEND_TIMEOUT_MS;
+    this.baseBackoffMs = opts.baseBackoffMs ?? WEBHOOK_BASE_BACKOFF_MS;
+    this.sleep = opts.sleep ?? defaultSleep;
+    this.now = opts.now ?? Date.now;
+  }
+  /** Install/replace the live webhook config (destinations + master switch). */
+  setConfig(config) {
+    this.config = config;
+  }
+  /**
+   * Enqueue an event and return IMMEDIATELY (fire-and-forget). NEVER awaits a
+   * send, NEVER throws — the drain loop does all sending on a side channel. A
+   * full queue drops the OLDEST event (with a one-shot warn) so a runaway source
+   * can't OOM the process.
+   */
+  emit(event) {
+    if (this.queue.length >= this.queueMax) {
+      this.queue.shift();
+      if (!this.warnedFull) {
+        this.logger?.warn("[webhook] queue full \u2014 dropping oldest events");
+        this.warnedFull = true;
+      }
+    }
+    this.queue.push(event);
+    if (!this.draining) {
+      this.draining = true;
+      queueMicrotask(() => void this.drain());
+    }
+  }
+  /** Drain the queue, sending each event to its matching destinations concurrently. */
+  async drain() {
+    try {
+      while (this.queue.length > 0) {
+        const event = this.queue.shift();
+        const destinations = this.matchingDestinations(event.kind);
+        if (destinations.length === 0) continue;
+        await Promise.all(destinations.map((d) => this.sendWithRetry(event, d)));
+      }
+    } finally {
+      this.draining = false;
+      if (this.queue.length > 0) {
+        this.draining = true;
+        queueMicrotask(() => void this.drain());
+      }
+    }
+  }
+  /** The enabled destinations whose event filter admits this kind (empty ⇒ all). */
+  matchingDestinations(kind) {
+    const cfg = this.config;
+    if (!cfg || !cfg.enabled) return [];
+    return cfg.destinations.filter(
+      (d) => d.enabled && (!d.events || d.events.length === 0 || d.events.includes(kind))
+    );
+  }
+  /** Send with bounded exponential backoff; log-and-drop after `maxAttempts`. */
+  async sendWithRetry(event, dest) {
+    for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {
+      const result = await this.sendOnce(event, dest);
+      if (result.ok) {
+        this.logger?.debug(`[webhook] delivered ${event.kind} \u2192 ${dest.id} (${result.status})`);
+        return;
+      }
+      if (attempt < this.maxAttempts) {
+        await this.sleep(this.baseBackoffMs * 2 ** (attempt - 1));
+      } else {
+        this.logger?.warn(
+          `[webhook] dropped ${event.kind} \u2192 ${dest.id} after ${this.maxAttempts} attempts: ${result.error ?? `HTTP ${result.status}`}`
+        );
+      }
+    }
+  }
+  /** One POST attempt. Returns an outcome; a thrown error becomes `{ ok:false }`. */
+  async sendOnce(event, dest) {
+    try {
+      const { body, headers } = buildRequest(event, dest, this.now());
+      const res = await this.fetchImpl(dest.url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...headers },
+        body,
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+      return res.ok ? { ok: true, status: res.status } : { ok: false, status: res.status };
+    } catch (err5) {
+      return { ok: false, error: err5 instanceof Error ? err5.message : String(err5) };
+    }
+  }
+  /**
+   * ADMIN test path (design D8): deliver a `test` event to ONE destination and
+   * AWAIT the single-attempt result. This is the ONLY awaited send — it runs on
+   * the admin request path (an operator clicking "Test"), NEVER on a relay path,
+   * so awaiting it is safe. Finds the destination regardless of its `enabled`
+   * flag or the master switch (an explicit operator action).
+   */
+  async deliverTest(destinationId) {
+    const dest = this.config?.destinations.find((d) => d.id === destinationId);
+    if (!dest) return { ok: false, error: "destination not found" };
+    return this.sendOnce({ kind: "test", at: this.now() }, dest);
+  }
+};
+function buildRequest(event, dest, nowMs) {
+  if (dest.type === "feishu") return buildFeishu(event, dest, nowMs);
+  return buildCustom(event, dest);
+}
+function buildCustom(event, dest) {
+  const body = JSON.stringify(event);
+  const headers = {};
+  if (dest.secret) {
+    const hmac = createHmac2("sha256", dest.secret).update(body).digest("hex");
+    headers["X-Omnicross-Signature"] = `sha256=${hmac}`;
+  }
+  return { body, headers };
+}
+function buildFeishu(event, dest, nowMs) {
+  const payload = {
+    msg_type: "text",
+    content: { text: feishuText(event) }
+  };
+  if (dest.secret) {
+    const timestamp = Math.floor(nowMs / 1e3).toString();
+    const stringToSign = `${timestamp}
+${dest.secret}`;
+    payload["timestamp"] = timestamp;
+    payload["sign"] = createHmac2("sha256", stringToSign).digest("base64");
+  }
+  return { body: JSON.stringify(payload), headers: {} };
+}
+function feishuText(event) {
+  switch (event.kind) {
+    case "account.recovery":
+      return `omnicross: account recovered \u2014 ${event.providerId}/${event.accountId}`;
+    case "account.anomaly":
+      return `omnicross: account anomaly [${event.state}] \u2014 ${event.providerId}/${event.accountId}`;
+    case "key.quotaWarning":
+      return `omnicross: key quota warning (${event.scope}) \u2014 $${event.spentUsd.toFixed(2)} of $${event.limitUsd.toFixed(2)} (key ${event.keyId})`;
+    case "key.quotaExceeded":
+      return `omnicross: key quota EXCEEDED (${event.scope}) \u2014 $${event.spentUsd.toFixed(2)} of $${event.limitUsd.toFixed(2)} (key ${event.keyId})`;
+    case "server.error":
+      return `omnicross: server error \u2014 ${event.message}`;
+    case "test":
+      return "omnicross: webhook test";
+  }
+}
+
 // src/bootstrap.ts
 function buildDaemon(config, paths) {
-  const logger = new ConsoleLogger();
+  const logger = new ConfigurableLogger(config.logging);
   const secretBox3 = new SecretBox(() => resolveMasterKey({ keyFilePath: paths.masterKeyFilePath }));
   setSecretBox(secretBox3);
   setSecretBox2(secretBox3);
   const decryptedConfig = decryptConfigSecrets(config, secretBox3);
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
   const keyDb = new JsonOutboundKeyDb(paths.keysPath);
-  const settingsStore = new JsonApiServerSettingsStore(paths.configPath);
+  const voucherDb = new JsonVoucherDb(defaultVouchersPath(paths.configPath));
+  const settingsStore = new JsonApiServerSettingsStore(paths.configPath, secretBox3);
   const credentialStore = new JsonSubscriptionCredentialStore(paths.tokensPath, secretBox3);
   const subscriptionAccounts = new SubscriptionAccountService(credentialStore);
   setSubscriptionAccountService(subscriptionAccounts);
@@ -4678,6 +7419,12 @@ function buildDaemon(config, paths) {
     credentialStore
   );
   setSubscriptionProviderRegistry(subscriptionRegistry);
+  setServerProxyConfig(decryptedConfig.server?.proxy);
+  setUpstreamProxyResolver(
+    createUpstreamProxyResolver({
+      getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
+    })
+  );
   setGeminiCodeAssistResolver(getGeminiCodeAssistProjectResolver());
   const autoDisableStore = new AutoDisableStore();
   const apiKeyPool = new ApiKeyPoolService(
@@ -4698,19 +7445,59 @@ function buildDaemon(config, paths) {
     defaultUsageEventsPath(paths.configPath),
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
   );
-  const usageRecorder = new UsageRecorder(usageEventStore, pricingEngine, logger);
+  const keySpendTracker = new KeySpendTracker(usageEventStore);
+  const usageRecorder = new UsageRecorder(usageEventStore, pricingEngine, logger, {
+    onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at)
+  });
   const providerProxy = getProviderProxy({ llmConfig, apiKeyPool, usageRecorder });
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
+  const accountHealthProbeScheduler = new AccountHealthProbeScheduler(
+    credentialStore,
+    getSharedAccountHealth2(),
+    logger,
+    DEFAULT_ACCOUNT_PROBE
+  );
+  const getHealthReport = () => buildHealthReport({
+    version: DAEMON_VERSION,
+    // CRITICAL: the config loaded with a providers array.
+    configPresent: () => Array.isArray(decryptedConfig.providers),
+    // CRITICAL: the credential store's tokens.json is readable WITHOUT
+    // decrypting (a missing file is fine — no accounts yet). A stat/access
+    // only; never reads or decrypts token material.
+    credentialStoreReadable: () => isTokensStoreReadable(paths.tokensPath),
+    outboundServerRunning: () => outboundApiServer.getStatus().running,
+    adminServerRunning: () => adminServer.getStatus().running,
+    // Coarse, account-anonymous probe signal (#8, D5) — added to `checks` ONLY
+    // when probing is ENABLED; disabled ⇒ `undefined` ⇒ key omitted ⇒ the
+    // `/health` body stays byte-identical (zero regression).
+    subscriptionAccountsHealthy: () => accountHealthProbeScheduler.enabled ? accountHealthProbeScheduler.probedAccountsHealthy() : void 0
+  });
   const outboundApiServer = getOutboundApiServer({
     db: keyDb,
+    // voucher-redemption #9: the key-authenticated `POST /redeem` endpoint redeems
+    // cards against the presenting key (gated on `voucher.enabled`).
+    voucherDb,
     llmConfig,
     providerProxy,
-    proxyDeps: providerProxy.getDeps()
+    proxyDeps: providerProxy.getDeps(),
+    healthReportProvider: getHealthReport,
+    // outbound-key-policy: the wire layer's 402 cost check reads per-key spend.
+    keySpendTracker,
+    // configurable-logging: route the server's OWN lifecycle + relay dispatch-error
+    // lines through the injected logger (honors level/format/file sink).
+    logger
   });
+  const auditDir = defaultAuditDir(paths.configPath);
+  const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
     llmConfig,
     keyDb,
+    // voucher-redemption #9: the admin `/admin/api/voucher` surface generates/
+    // lists/revokes redemption cards (gated on `voucher.enabled`).
+    voucherDb,
+    // outbound-key-policy: the admin key list surfaces each key's OWN spend.
+    keySpendReader: keySpendTracker,
     settingsStore,
     outboundApiServer,
     subscriptionAccounts,
@@ -4732,14 +7519,16 @@ function buildDaemon(config, paths) {
     oauthSessions: new OAuthSessionStore(),
     // Real global fetch by default; a test seam (`paths.oauthExchangeFetch`) can
     // inject a mock so no real token endpoint is hit.
-    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => fetch(url, init)),
+    // upstream-proxy: default the OAuth token-exchange fetch to the proxy-aware
+    // helper so interactive login honors a configured proxy (global/env layers).
+    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => fetchUpstream6(url, init)),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
     // the app polls the token-free status. A test seam (`paths.codexAwaitLoopback`)
     // can inject a mock so no real port is bound.
     codexSessions: new CodexOAuthSessionStore(),
-    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs) => awaitLoopbackCode(state, timeoutMs)),
+    codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs, signal) => awaitLoopbackCode(state, timeoutMs, signal)),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -4759,9 +7548,48 @@ function buildDaemon(config, paths) {
     pricingStore,
     // Use the DECRYPTED config so `admin.token` (if stored as `enc:`) is the
     // plaintext bearer the AdminServer's constant-time compare expects (D4).
-    getAdminConfig: () => resolveAdminConfig(decryptedConfig.admin)
+    getAdminConfig: () => resolveAdminConfig(decryptedConfig.admin),
+    // Unauthenticated `/health` probe (daemon-health-endpoint) — the SAME shared
+    // builder the outbound server uses, served before the admin auth gate.
+    getHealthReport,
+    // configurable-logging: the admin listener's lifecycle lines route through
+    // the injected logger.
+    logger,
+    // subscription-account-probe #8: the AUTHED `GET /admin/api/account-probes`
+    // reads per-account probe history from the scheduler (secret-free — ids +
+    // status labels only). Routed in `AdminServer` (not `adminApi.ts`).
+    probeHistoryReader: accountHealthProbeScheduler,
+    // request-audit-log: the AUTHED `GET /admin/api/audit` reads + filters the
+    // date-rotated audit store. Bound to the store dir here so the AdminServer
+    // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
+    // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
+    auditReader: (query) => readAuditRecords(auditDir, query),
+    // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
+    // secret-free total/delivered/pending counts of the durable ledger.
+    billingStatusReader: () => readBillingStatus(billingDir)
   });
+  const webhookDispatcher = new WebhookDispatcher({
+    logger,
+    fetchImpl: (url, init) => fetchUpstream6(url, init)
+  });
+  setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
+  const auditWriter = new AuditWriter(auditDir, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper);
+  const billingPublisher = new BillingPublisher(billingDir, logger);
+  const billingRetrySweeper = new BillingRetrySweeper(
+    billingDir,
+    billingPublisher,
+    logger,
+    DEFAULT_BILLING_CONFIG
+  );
+  setBillingRuntime(billingPublisher, billingRetrySweeper);
   const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
+  const accountHealthSweeper = new AccountHealthSweeper(
+    credentialStore,
+    getSharedAccountHealth2(),
+    logger
+  );
   return {
     logger,
     llmConfig,
@@ -4778,9 +7606,25 @@ function buildDaemon(config, paths) {
     pricingEngine,
     usageRecorder,
     adminServer,
-    tokenRefreshScheduler
+    tokenRefreshScheduler,
+    accountHealthSweeper,
+    accountHealthProbeScheduler,
+    webhookDispatcher,
+    auditWriter,
+    auditPruneSweeper,
+    billingPublisher,
+    billingRetrySweeper
   };
 }
+function isTokensStoreReadable(tokensPath) {
+  try {
+    if (!existsSync14(tokensPath)) return true;
+    accessSync(tokensPath, fsConstants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/commands/launch.ts
 var SUPPORTED_LAUNCH_CLIS = [
@@ -4822,8 +7666,8 @@ function buildCliSpawnPlan(opts) {
 function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean);
   for (const seg of segments) {
-    const full = join5(seg, candidate);
-    if (existsSync10(full)) return full;
+    const full = join10(seg, candidate);
+    if (existsSync15(full)) return full;
   }
   return null;
 }
@@ -4866,6 +7710,10 @@ async function runLaunch(argv, deps) {
   } catch (err5) {
     daemon.apiKeyPool.dispose();
     daemon.tokenRefreshScheduler.dispose();
+    daemon.accountHealthSweeper.dispose();
+    daemon.accountHealthProbeScheduler.dispose();
+    daemon.auditPruneSweeper.dispose();
+    daemon.billingRetrySweeper.dispose();
     throw err5;
   }
   let launch;
@@ -4878,6 +7726,10 @@ async function runLaunch(argv, deps) {
     await daemon.providerProxy.stop();
     daemon.apiKeyPool.dispose();
     daemon.tokenRefreshScheduler.dispose();
+    daemon.accountHealthSweeper.dispose();
+    daemon.accountHealthProbeScheduler.dispose();
+    daemon.auditPruneSweeper.dispose();
+    daemon.billingRetrySweeper.dispose();
     throw err5;
   }
   try {
@@ -4900,6 +7752,10 @@ async function runLaunch(argv, deps) {
     await daemon.providerProxy.stop();
     daemon.apiKeyPool.dispose();
     daemon.tokenRefreshScheduler.dispose();
+    daemon.accountHealthSweeper.dispose();
+    daemon.accountHealthProbeScheduler.dispose();
+    daemon.auditPruneSweeper.dispose();
+    daemon.billingRetrySweeper.dispose();
   }
 }
 async function buildLaunchConfig(cli, llmConfig, opts) {
@@ -4972,6 +7828,7 @@ function spawnCliInherit(plan) {
 import { spawn as spawn3 } from "child_process";
 import { createInterface } from "readline";
 import { parseArgs as parseArgs4 } from "util";
+import { fetchUpstream as fetchUpstream7, setUpstreamProxyResolver as setUpstreamProxyResolver2 } from "@omnicross/core/pipeline/upstreamFetch";
 import { claudeOAuth as claudeOAuth3, codexOAuth as codexOAuth3, geminiOAuth as geminiOAuth3 } from "@omnicross/subscriptions";
 var PROVIDERS = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
@@ -5003,9 +7860,10 @@ async function runLogin(argv, deps) {
   };
   const box = resolveSecretBox(values["master-key-file"]);
   setSecretBox(box);
+  setUpstreamProxyResolver2(createUpstreamProxyResolver());
   try {
     const tokensPath = defaultTokensPath(values.config);
-    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => fetch(url, init));
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => fetchUpstream7(url, init, { providerId: provider }));
     const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
     const expiresAt = await runProviderLogin(
       provider,
@@ -5018,6 +7876,7 @@ async function runLogin(argv, deps) {
     console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
   } finally {
     setSecretBox(null);
+    setUpstreamProxyResolver2(null);
   }
 }
 async function runProviderLogin(provider, store, deps, exchangeFetch, label) {
@@ -5290,7 +8149,7 @@ function providersRmKey(configPath, providerId, keyId) {
 }
 
 // src/commands/secrets.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 import { parseArgs as parseArgs6 } from "util";
 async function runSecrets(argv) {
   const { values, positionals } = parseArgs6({
@@ -5362,7 +8221,7 @@ function secretsStatus(args) {
     reportField("admin.token", cfg.admin.token);
   }
   const tokensPath = defaultTokensPath(args.config);
-  if (existsSync11(tokensPath)) {
+  if (existsSync16(tokensPath)) {
     console.info(`Secret status for ${tokensPath}:`);
     reportTokenFields(tokensPath);
   }
@@ -5402,7 +8261,7 @@ function secretsRotate(args) {
   const tokensPath = defaultTokensPath(args.config);
   try {
     cfg = loadConfig(args.config);
-    if (existsSync11(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+    if (existsSync16(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
   } finally {
     setSecretBox(null);
   }
@@ -5431,20 +8290,20 @@ function secretsDecrypt(args) {
   let tokensPlain = null;
   try {
     cfg = loadConfig(args.config);
-    if (existsSync11(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+    if (existsSync16(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
   } finally {
     setSecretBox(null);
   }
   saveConfig(args.config, cfg);
   if (tokensPlain) {
-    writeFileSync8(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
+    writeFileSync9(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
   }
   console.info(`Decrypted secrets to plaintext in ${args.config}` + tokensSuffix(args.config));
 }
 function readRawConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(path2, "utf8"));
+    parsed = JSON.parse(readFileSync14(path2, "utf8"));
   } catch {
     throw new Error(`secrets: cannot read or parse '${path2}'`);
   }
@@ -5452,7 +8311,7 @@ function readRawConfig(path2) {
 }
 function readRawJson(path2) {
   try {
-    const parsed = JSON.parse(readFileSync11(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync14(path2, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -5462,7 +8321,7 @@ function readRawJson(path2) {
 }
 function encryptTokensFileInPlace(configPath, box) {
   const tokensPath = defaultTokensPath(configPath);
-  if (!existsSync11(tokensPath)) return;
+  if (!existsSync16(tokensPath)) return;
   const plain = decryptTokensFile(tokensPath, box);
   writeTokensEncrypted(tokensPath, plain, box);
 }
@@ -5475,7 +8334,7 @@ function writeTokensEncrypted(tokensPath, plain, box) {
     { updatedAt: "", ...plain },
     box
   );
-  writeFileSync8(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  writeFileSync9(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
 }
 var TOKEN_FIELDS2 = {
   claude: ["accessToken", "refreshToken"],
@@ -5498,12 +8357,47 @@ function walkTokens(raw, fn) {
   return next;
 }
 function tokensSuffix(configPath) {
-  return existsSync11(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+  return existsSync16(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
 }
 
 // src/commands/start.ts
 import { parseArgs as parseArgs7 } from "util";
-import { loadServerConfig as loadServerConfig2 } from "@omnicross/core/outbound-api";
+import { loadServerConfig as loadServerConfig3, OutboundApiConfigError } from "@omnicross/core/outbound-api";
+import { getSharedAccountHealth as getSharedAccountHealth3 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+
+// src/identity/identityRuntime.ts
+import { getSharedIdentityStore as getSharedIdentityStore2 } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
+async function applyFingerprintConfig(config, credentialStore) {
+  const store = getSharedIdentityStore2();
+  const enabled = config?.enabled === true;
+  store.configure({ enabled, ua: config?.ua ?? null });
+  if (!enabled) {
+    store.setPersistence(null);
+    return;
+  }
+  await seedIdentities(store, credentialStore);
+  store.setPersistence({
+    persist: (providerId, accountId, identity) => {
+      void credentialStore.setAccountIdentity(providerId, accountId, identity).catch(() => {
+      });
+    }
+  });
+}
+async function seedIdentities(store, credentialStore) {
+  let config;
+  try {
+    config = await credentialStore.getFullConfig();
+  } catch {
+    return;
+  }
+  for (const provider of Object.keys(DAEMON_PROVIDER_KEYS)) {
+    for (const account of listAccounts(config, provider)) {
+      if (account.identity) store.seed(provider, account.id, account.identity);
+    }
+  }
+}
+
+// src/commands/start.ts
 async function runStart(argv) {
   const { values } = parseArgs7({
     args: argv,
@@ -5528,19 +8422,45 @@ async function runStart(argv) {
   const daemon = buildDaemon(config, paths);
   await daemon.llmConfig.ready();
   await daemon.providerProxy.start();
-  const serverConfig = await loadServerConfig2(daemon.settingsStore);
-  await daemon.outboundApiServer.applyConfig({
-    enabled: true,
-    networkBinding: serverConfig.networkBinding,
-    endpoints: serverConfig.endpoints,
-    port: serverConfig.port
+  const serverConfig = await loadServerConfig3(daemon.settingsStore);
+  getSharedAccountHealth3().configure({
+    overloadEnabled: serverConfig.accountHealth?.overloadCooldownEnabled,
+    overloadTtlMs: serverConfig.accountHealth?.overloadCooldownMs
   });
+  try {
+    await daemon.outboundApiServer.applyConfig({
+      enabled: true,
+      networkBinding: serverConfig.networkBinding,
+      endpoints: serverConfig.endpoints,
+      port: serverConfig.port,
+      userMessageQueue: serverConfig.userMessageQueue,
+      concurrencyQueue: serverConfig.concurrencyQueue,
+      // voucher-redemption #9: carry the persisted flag so `POST /redeem` works on
+      // boot when the operator has enabled the product.
+      voucher: serverConfig.voucher
+    });
+  } catch (err5) {
+    if (err5 instanceof OutboundApiConfigError) {
+      console.warn(`[outbound] not started \u2014 incomplete model configuration: ${err5.message}`);
+    } else {
+      throw err5;
+    }
+  }
   let dashboardUrl = null;
   if (!values["no-dashboard"]) {
     await daemon.adminServer.start();
     dashboardUrl = daemon.adminServer.getStatus().url;
   }
   daemon.tokenRefreshScheduler.start();
+  daemon.accountHealthSweeper.start();
+  if (serverConfig.accountProbe) {
+    daemon.accountHealthProbeScheduler.configure(serverConfig.accountProbe);
+  }
+  daemon.accountHealthProbeScheduler.start();
+  applyWebhookConfig(serverConfig.webhook);
+  applyAuditConfig(serverConfig.audit);
+  applyBillingConfig(serverConfig.billing);
+  await applyFingerprintConfig(serverConfig.fingerprint, daemon.credentialStore);
   const status = daemon.outboundApiServer.getStatus();
   console.info("omnicross daemon is running.");
   if (dashboardUrl) console.info(`  dashboard : ${dashboardUrl}`);