@omnicross/daemon 0.1.2 → 0.1.4

package/dist/index.d.cts

@@ -1,14 +1,20 @@
+import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow, OutboundKeyPolicy } from '@omnicross/core';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { OutboundKeyDb, OutboundApiServer } from '@omnicross/core/outbound-api';
+import { AccountProbeConfig, OutboundKeyDb, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
-import { OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, Logger, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow } from '@omnicross/core';
+import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity } from '@omnicross/contracts/account-tokens-types';
+import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { SubscriptionAccountHealth } from '@omnicross/core/pipeline/SubscriptionAccountHealth';
+import { fetchUpstream } from '@omnicross/core/pipeline/upstreamFetch';
+import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
 import { PricingEntry, PricingEntryInput, PricingResolution } from '@omnicross/contracts/pricing-types';
-import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, SubscriptionAccountSanitized } from '@omnicross/contracts/account-tokens-types';
+import { WebhookConfig, WebhookEvent } from '@omnicross/contracts/webhook-types';
 
 /**
  * SecretBox.ts — a 32-byte master key wrapped with the tri-state secret rules
@@ -376,6 +382,12 @@ interface DaemonConfig {
     server?: OutboundApiServerConfig;
     /** Optional admin-dashboard config (RT3). */
     admin?: DaemonAdminConfig;
+    /**
+     * Optional logging config (configurable-logging). Absent ⇒ the zero-regression
+     * default (console + all levels + text). `file` is a PLAIN value — NOT a secret,
+     * so it is never walked by `decryptConfigSecrets`/`encryptConfigSecrets`.
+     */
+    logging?: LoggingConfig;
 }
 /** Apply defaults to a (possibly absent) admin block: enabled, port 8766,
  *  loopback, no token. NOTE: an EXPLICIT `port: 0` is honored as "bind an
@@ -551,16 +563,27 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     /**
      * @param tokensPath  on-disk `tokens.json` location.
      * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
-     * @param fetchImpl   injectable HTTP port for the OAuth refresh round-trips
-     *                    (oauth design D4). Defaults to the global `fetch` so boot
-     *                    is unchanged; tests inject a mock fetch. NOT used by any
-     *                    read/write path — only by `refresh*Token`.
-     */
-    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike, 
+     * @param fetchImpl   OPTIONAL injectable HTTP port for the OAuth refresh
+     *                    round-trips (oauth design D4). A TEST-injected transport is
+     *                    used verbatim. When ABSENT (production), each refresh uses a
+     *                    proxy-aware {@link fetchUpstream} that threads the
+     *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
+     *                    per-account/per-provider proxy is honored on refresh exactly
+     *                    as on relay — refresh egresses from the SAME proxy IP as the
+     *                    account's traffic. NOT used by any read/write path.
+     */
+    constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike | undefined, 
     /** Injectable external CLI native-store reader (external-cli-sync). */
     externalCliReader?: ExternalCliReader, 
     /** Injectable external CLI native-store WRITER (marker-gated write-back). */
     externalCliStore?: ExternalCliStorePort);
+    /**
+     * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
+     * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
+     * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
+     * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+     */
+    buildRefreshFetch(providerId: string, accountId?: string): FetchLike;
     /**
      * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
      * SINGLE-USE: two concurrent refreshes of one account each spend the same
@@ -580,6 +603,14 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     getValidClaudeAccessToken(): Promise<string | null>;
     /** Current OpenCodeGo static API key, or `null` when none is stored. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
+    /**
+     * DAEMON-ONLY per-account proxy lookup by id (upstream-proxy). Returns the
+     * DECRYPTED `ProxyConfig` for the account (`readConfig` decrypts on read), or
+     * `undefined` for an unknown provider/account or no per-account proxy. Feeds the
+     * winning per-account layer of the upstream-proxy resolver. Synchronous like the
+     * other hot reads. Never returns token material.
+     */
+    getAccountProxy(providerId: string, accountId: string): ProxyConfig | undefined;
     /**
      * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
      * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
@@ -629,6 +660,63 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * failure flags ONLY that account `expired`.
      */
     refreshAccountById(provider: 'claude' | 'codex' | 'gemini', id: string): Promise<boolean>;
+    /**
+     * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
+     * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
+     * (refresh is 401-driven, like `getValidClaudeAccessToken`); codex/gemini refresh
+     * a near-expiry token via `refreshAccountById` (like `resolveAccessToken`);
+     * opencodego returns the account's static key. `null` when unknown/expired/
+     * tokenless.
+     */
+    getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+    /**
+     * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
+     * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
+     * → `false` (no refresh affordance).
+     */
+    refreshAccountToken(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
+    /**
+     * Best-effort record of a selection time onto the account's `lastUsedAt` by id
+     * (design D4). Entry-metadata only (the token mirror is untouched); a no-op for
+     * an unknown id. The selector throttles the call frequency, so this stays cheap.
+     */
+    touchAccountLastUsed(providerId: SubscriptionProviderId, accountId: string, iso: string): Promise<void>;
+    /**
+     * Best-effort write-through of a per-account client `identity`
+     * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
+     * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
+     * an unknown id. Called by the identity store's persistence port on a first-seen
+     * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+     * store's port wrapper swallows a rejection so the relay hot path is unaffected.
+     */
+    setAccountIdentity(providerId: SubscriptionProviderId, accountId: string, identity: AccountClientIdentity): Promise<void>;
+    /**
+     * DAEMON-ONLY set-priority (subscription-account-scheduling, admin write, NOT on
+     * the port). Set one account's scheduling `priority` by id. Secret-free
+     * (entry-metadata only; the mirror invariant is untouched). Rejects an unknown id.
+     */
+    setAccountPriority(providerId: SubscriptionProviderId, accountId: string, priority: number): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
+     * the port). Passing `undefined` clears the override. Write-only password: when
+     * the incoming structured proxy omits the password but the account already had
+     * one, the current (decrypted) password is preserved — editing host/port never
+     * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
+     */
+    setAccountProxy(providerId: SubscriptionProviderId, accountId: string, proxy: ProxyConfig | undefined): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * DAEMON-ONLY set/clear per-account `supportedModels` (subscription-account-
+     * model-map, admin write, NOT on the port). Passing `undefined` clears it.
+     * Secret-free (model ids only; the mirror invariant is untouched). Rejects an
+     * unknown id.
+     */
+    setAccountSupportedModels(providerId: SubscriptionProviderId, accountId: string, supportedModels: string[] | Record<string, string> | undefined): Promise<{
+        ok: boolean;
+    }>;
     /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
     private refreshUpstream;
     /**
@@ -798,6 +886,24 @@ interface SubscriptionTokenWriter {
     renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
         ok: boolean;
     }>;
+    /** Set one account's scheduling priority (secret-free; rejects an unknown id).
+     *  subscription-account-scheduling — lets an operator order a pool. */
+    setAccountPriority(providerId: SubscriptionProviderId, id: string, priority: number): Promise<{
+        ok: boolean;
+    }>;
+    /** Set (or CLEAR, with `undefined`) one account's per-account proxy override
+     *  (upstream-proxy). The `proxy.password` is a secret (encrypted at rest, masked
+     *  in the sanitized view). Rejects an unknown id. */
+    setAccountProxy(providerId: SubscriptionProviderId, id: string, proxy: ProxyConfig | undefined): Promise<{
+        ok: boolean;
+    }>;
+    /** Set (or CLEAR, with `undefined`) one account's `supportedModels`
+     *  (subscription-account-model-map). Secret-free (model ids only). Rejects an
+     *  unknown id. An array = allow-list (skip-only); an object = allow-list keys +
+     *  logical→actual remap values. */
+    setAccountSupportedModels(providerId: SubscriptionProviderId, id: string, supportedModels: string[] | Record<string, string> | undefined): Promise<{
+        ok: boolean;
+    }>;
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
     refreshClaudeToken(): Promise<boolean>;
     refreshCodexToken(): Promise<boolean>;
@@ -942,7 +1048,7 @@ interface SubscriptionAccountAppender {
  */
 
 /** The loopback-listener fn (injected so tests need not bind a real port). */
-type CodexLoopbackFn = (state: string, timeoutMs?: number) => Promise<string>;
+type CodexLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
 /** One codex sign-in flow's polled status (NEVER carries a token). */
 interface CodexFlowState {
     status: 'pending' | 'done' | 'error';
@@ -960,19 +1066,257 @@ declare class CodexOAuthSessionStore {
     private readonly ttlMs;
     private readonly sessions;
     private activeSessionId;
+    private readonly aborters;
     constructor(ttlMs?: number);
     /** Whether a codex sign-in is currently in flight (port 1455 held). */
     isBusy(): boolean;
     /** Mint a fresh sessionId, mark it pending + active, return the id. */
-    begin(): string;
+    begin(): {
+        sessionId: string;
+        signal: AbortSignal;
+    };
     /** Settle a flow (done/error) + free the active slot. */
     settle(sessionId: string, status: 'done' | 'error', error?: string): void;
+    cancel(sessionId: string): boolean;
     /** Read a flow's status (token-free), or null when unknown/expired. */
     get(sessionId: string): CodexFlowState | null;
     /** Drop expired flows; free the active slot if the active flow expired. */
     private sweep;
 }
 
+/**
+ * ProbeStrategy — the per-provider two-tier probe plan
+ * (subscription-account-probe #8, design D1).
+ *
+ * A `ProbePlan` says HOW to probe one provider's account, cheapest signal first:
+ *  - `{ kind: 'local' }` — no upstream call. The scheduler's free local tier reads
+ *    the account's token via the credential store; a missing/expired-unrefreshable
+ *    token is a dead account (recorded as a synthesized 401). A provider is
+ *    local-only until a cheap authed GET endpoint is VERIFIED (the omnicross
+ *    `// UNVERIFIED` convention) — Phase 1 ships codex/gemini/opencodego local-only
+ *    (LEAD OQ1: never GUESS a billable/wrong endpoint).
+ *  - `{ kind: 'upstream'; url; buildInit(token) }` — a minimal AUTHED GET the
+ *    scheduler issues through #3's proxy-aware `fetchUpstream`. Phase 1 wires ONLY
+ *    claude → `GET https://api.anthropic.com/v1/models` (a verified free list;
+ *    NEVER a billable completion). The scheduler adds the timeout `signal` +
+ *    `{ providerId, accountId }` ctx; `buildInit` supplies method + auth header.
+ *
+ * NEVER put a body / max_tokens here — a probe must cost nothing (design D1).
+ *
+ * @module @omnicross/daemon/probe/ProbeStrategy
+ */
+
+/** How to probe one provider's account (design D1). */
+type ProbePlan = {
+    kind: 'local';
+} | {
+    kind: 'upstream';
+    /** The cheap, free, authed GET endpoint. */
+    url: string;
+    /** Build the minimal request init (method + Authorization only — no body). */
+    buildInit(token: string): RequestInit;
+};
+
+/**
+ * AccountHealthProbeScheduler — the scheduled ACTIVE account-health probe
+ * (subscription-account-probe #8, design D1–D6).
+ *
+ * #2's health machine is PASSIVE — an account is only found dead when a REAL
+ * request hits it and fails. This scheduler is the active complement: on a plain
+ * `unref()`ed interval (omnicross has no cron dep) it runs a CHEAP per-account
+ * probe and feeds the outcome into #2's EXISTING shared tracker
+ * (`recordUpstreamOutcome`) — inventing no new marking path. Modeled EXACTLY on
+ * `AccountHealthSweeper`: `start()` arms the timer, `dispose()` clears it, a
+ * single-sweep re-entrancy guard prevents overlap.
+ *
+ * TWO-TIER, cheapest-first (design D1):
+ *  1. FREE local — read the account's token via the credential store; no usable
+ *     token ⇒ dead ⇒ a synthesized `401` outcome, NO upstream call.
+ *  2. Minimal AUTHED upstream GET (only providers with a VERIFIED cheap endpoint)
+ *     via #3's proxy-aware `fetchUpstream` with a short timeout.
+ *
+ * SAFE tracker mapping (LEAD constraint, mirrors #2's bare-429 discipline):
+ * **401/403 → mark; 2xx → clear transient; 429 / 5xx / thrown/timeout → NEVER a
+ * mark** (a probe rate-limit or upstream blip must not blacklist a healthy
+ * account). So only 401/403/2xx are forwarded to the tracker; the rest are
+ * history-only. NEVER a billable probe — the upstream tier is a free authed GET.
+ *
+ * NEVER-STRAND: marking flows through #2, whose ≥2-account gate (in the strategy's
+ * schedulable derivation) keeps a marked SOLE account schedulable — so a probe can
+ * never strand a single-account user. `onlyMultiAccount` (default) additionally
+ * skips single-account providers entirely.
+ *
+ * ZERO REGRESSION: default `enabled:false` ⇒ `start()` never arms + `sweep()`
+ * early-returns ⇒ no probes, no `/health` boolean, byte-identical.
+ *
+ * @module @omnicross/daemon/AccountHealthProbeScheduler
+ */
+
+/** One rolling probe result (design D4; in-memory, cleared on restart). */
+interface ProbeRecord {
+    /** Epoch ms of the probe. */
+    ts: number;
+    /** Whether the probe observed a HEALTHY signal (2xx upstream / token-present local). */
+    ok: boolean;
+    /** The HTTP status (`null` = thrown/timeout); absent for a token-present local record. */
+    status?: number | null;
+    /** Upstream round-trip latency (ms); absent for a local-tier record. */
+    latencyMs?: number;
+    /** Which tier produced this record. */
+    tier: 'local' | 'upstream';
+}
+/** Per-account probe history for the authed admin surface (names account ids). */
+interface AccountProbeHistorySnapshot {
+    providerId: string;
+    accountId: string;
+    records: ProbeRecord[];
+}
+/**
+ * The read surface the AUTHED admin route consumes (subscription-account-probe,
+ * design D5). Structurally satisfied by {@link AccountHealthProbeScheduler}; typed
+ * narrow so the admin layer carries no scheduler coupling.
+ */
+interface AccountProbeHistoryReader {
+    getAllHistory(): AccountProbeHistorySnapshot[];
+}
+/** The narrow credential-store surface the scheduler reads (#1 seams). */
+interface ProbeCredentialStore {
+    getFullConfig(): Promise<AccountTokensConfig>;
+    getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+}
+/** Proxy-aware upstream fetch signature (#3 `fetchUpstream`). */
+type ProbeFetch = typeof fetchUpstream;
+/** Injectable test seams (all default to production behavior). */
+interface ProbeSchedulerOptions {
+    /** Injectable clock (ms). Default `Date.now`. */
+    now?: () => number;
+    /** Injectable proxy-aware fetch (#3). Default `fetchUpstream`. */
+    fetchImpl?: ProbeFetch;
+    /** Injectable inter-probe delay (stagger). Default a real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable per-provider probe-plan resolver. Default {@link probePlanFor}. */
+    planFor?: (providerId: string) => ProbePlan;
+}
+declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
+    private readonly store;
+    private readonly health;
+    private readonly logger;
+    private config;
+    private timer;
+    private sweeping;
+    private readonly history;
+    private readonly now;
+    private readonly fetchImpl;
+    private readonly sleep;
+    private readonly planFor;
+    constructor(store: ProbeCredentialStore, health: SubscriptionAccountHealth, logger: Logger, config: AccountProbeConfig, opts?: ProbeSchedulerOptions);
+    /** Whether probing is enabled by the current config. */
+    get enabled(): boolean;
+    /**
+     * Re-apply config to the live instance (the async `start.ts` loads the persisted
+     * `accountProbe` segment after `buildDaemon`). Call BEFORE `start()`.
+     */
+    configure(config: AccountProbeConfig): void;
+    /** Arm the probe interval. No-op when disabled (zero regression). Idempotent. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: probe every ELIGIBLE account SEQUENTIALLY with a `staggerMs` gap.
+     * Disabled ⇒ no-op. `onlyMultiAccount` skips single-account providers. Exposed
+     * for tests; never throws.
+     */
+    sweep(): Promise<void>;
+    /**
+     * Probe ONE account (design D1). Local tier first (dead token → synthesized 401,
+     * no upstream); else the upstream tier when a verified endpoint exists. Records
+     * the rolling history entry either way; returns whether the tracker was MARKED.
+     */
+    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<{
+        ok: boolean;
+        marked: boolean;
+    }>;
+    /** Per-account rolling history for the authed admin surface (design D5). */
+    getAllHistory(): AccountProbeHistorySnapshot[];
+    /**
+     * The coarse, account-ANONYMOUS `/health` signal (design D5): `true` when no
+     * probed account is currently unhealthy (per #2's tracker). No ids, no counts —
+     * safe for the unauthenticated `/health`. Vacuously `true` when nothing probed.
+     */
+    probedAccountsHealthy(now?: number): boolean;
+    /**
+     * Feed ONLY the account/auth-decisive statuses to #2 (LEAD constraint):
+     * 401/403 → mark; 2xx → clear transient; 429 / 5xx / other 4xx / null →
+     * NOT forwarded (never a mark). Returns whether a NEGATIVE mark was applied.
+     */
+    private applyOutcome;
+    /** Append a record, capping the ring at `historySize` (drop oldest). */
+    private record;
+    /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
+    private readBounded;
+    private key;
+    private parseKey;
+}
+
+/**
+ * auditReader — read + filter the date-rotated audit store (request-audit-log,
+ * design D4/D6). Backs the AUTHED admin query only (the records carry IP/UA +
+ * possibly bodies). Reads the relevant `audit-*.jsonl` files, parses defensively
+ * (a torn final line never poisons a query), filters by key id + time window, and
+ * returns NEWEST-FIRST up to a bounded limit.
+ *
+ * @module @omnicross/daemon/audit/auditReader
+ */
+
+/** Filters for an audit query (all optional). */
+interface AuditQuery {
+    /** Restrict to one outbound key id. */
+    keyId?: string;
+    /** Inclusive lower bound (epoch ms). */
+    from?: number;
+    /** Inclusive upper bound (epoch ms). */
+    to?: number;
+    /** Max rows (default 200, capped 2000). */
+    limit?: number;
+}
+
+/**
+ * auditQueryApi — the AUTHED `GET /admin/api/audit?keyId=&from=&to=&limit=`
+ * handler (request-audit-log, design D6).
+ *
+ * Audit records carry client IP / user-agent (PII) and, when body capture is on,
+ * redacted bodies — so unlike the coarse `/health` boolean they are served ONLY
+ * behind the admin auth gate. This lives in its OWN helper module (the
+ * #4/#8/#10 helper-module convention) so `adminApi.ts` — at its line cap — is not
+ * touched: `AdminServer.dispatch` routes the path here directly, AFTER its auth
+ * gate. NEVER unauthenticated, NEVER surfaced on `/health`.
+ *
+ * SECRET-FREE by construction: it returns exactly the stored records, which never
+ * hold key material / tokens / Authorization (headers are never captured).
+ *
+ * @module @omnicross/daemon/admin/auditQueryApi
+ */
+
+/** The read surface the AdminServer consumes (bootstrap binds it to the store). */
+type AuditQueryReader = (query: AuditQuery) => AuditRecord[];
+
+/**
+ * billingStatusApi — the AUTHED `GET /admin/api/billing-status` handler
+ * (billing-event-stream, design D5/P2).
+ *
+ * Returns the SECRET-FREE aggregate delivery status of the durable billing ledger
+ * (total / delivered / pending counts) so the admin UI can show a delivery
+ * indicator. Lives in its OWN helper module (the #4/#8/#10/#13 convention) so
+ * `adminApi.ts` — at its line cap — is not touched: `AdminServer.dispatch` routes
+ * the path here directly, AFTER its auth gate. Carries no secret and no event
+ * payload — only counts.
+ *
+ * @module @omnicross/daemon/admin/billingStatusApi
+ */
+
+/** The read surface the AdminServer consumes (bootstrap binds it to the ledger dir). */
+type BillingStatusReader = () => BillingDeliveryStatus;
+
 /**
  * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
  *
@@ -1114,9 +1458,22 @@ declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
 
 declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
     private readonly configPath;
-    constructor(configPath: string);
+    private readonly box;
+    /**
+     * @param configPath the daemon config.json whose `server` field is backed.
+     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
+     *                    `server.proxy.*` passwords are encrypted-on-`set` /
+     *                    decrypted-on-`get` (the settings-store path is otherwise not
+     *                    secret-aware — every OTHER server field is non-secret). Null
+     *                    ⇒ passthrough (legacy/pure tests unchanged).
+     */
+    constructor(configPath: string, box?: SecretBox | null);
     get<T = unknown>(key: string): Promise<T | undefined>;
     set<T = unknown>(key: string, value: T): Promise<void>;
+    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
+    private encryptSecrets;
+    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
+    private decryptSecrets;
     /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
     private readFile;
 }
@@ -1310,6 +1667,18 @@ interface AdminApiDeps {
     readonly llmConfig: ConfigFileProviderConfigSource;
     /** Named outbound-key store. */
     readonly keyDb: OutboundKeyDb;
+    /**
+     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
+     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
+     * surface returns 501 (feature not available in this build).
+     */
+    readonly voucherDb?: VoucherDb;
+    /**
+     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
+     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
+     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
+     */
+    readonly keySpendReader?: KeySpendReader;
     /** Outbound server settings store (server config persistence). */
     readonly settingsStore: JsonApiServerSettingsStore;
     /** The running outbound server (status + live applyConfig). */
@@ -1433,6 +1802,40 @@ declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerRespo
 interface AdminServerDeps extends AdminApiDeps {
     /** Read the resolved admin config (enabled/port/networkBinding/token). */
     getAdminConfig: () => ResolvedAdminConfig;
+    /**
+     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
+     * shared closure over live handles (bootstrap wires the SAME builder into the
+     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
+     */
+    getHealthReport: () => HealthReport;
+    /**
+     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
+     * lines (bind/refuse/error) route through it so they honor the configured
+     * level / format / file sink.
+     */
+    logger: Logger;
+    /**
+     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
+     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
+     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
+     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
+     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
+     */
+    probeHistoryReader?: AccountProbeHistoryReader;
+    /**
+     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
+     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
+     * returns filtered records. Absent ⇒ the route serves an empty list. The
+     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
+     * unauthenticated, NEVER on `/health`.
+     */
+    auditReader?: AuditQueryReader;
+    /**
+     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
+     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
+     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
+     */
+    billingStatusReader?: BillingStatusReader;
 }
 /** A live status snapshot for the admin listener. */
 interface AdminServerStatus {
@@ -1469,24 +1872,6 @@ declare class AdminServer {
     getStatus(): AdminServerStatus;
 }
 
-/**
- * ConsoleLogger — the daemon's file-less default `Logger` port impl (design D5).
- *
- * A thin `console.*` wrapper. The serving core depends on the `Logger` port
- * (never a host class), so this trivial implementation is the only logger the
- * standalone daemon needs. `error` uses the WIDEST `(message, error?, meta?)`
- * signature so every core call site stays assignable.
- *
- * @module @omnicross/daemon/ports/ConsoleLogger
- */
-
-declare class ConsoleLogger implements Logger {
-    info(message: string, meta?: Record<string, unknown> | Error | object): void;
-    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
-    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
-    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
-}
-
 /**
  * JsonOutboundKeyDb — the daemon's file-backed `OutboundKeyDb` port impl
  * (design D3).
@@ -1516,6 +1901,9 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
+    outboundApiKeysSetMaxConcurrency(id: string, maxConcurrency: number | null): Promise<boolean>;
+    outboundApiKeysSetPolicy(id: string, policy: OutboundKeyPolicy): Promise<boolean>;
+    outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
     /** Apply `fn` to the row with `id`, persisting when it returns true. */
     private mutateRow;
     /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
@@ -1523,6 +1911,275 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     private writeRows;
 }
 
+/**
+ * AccountHealthSweeper — proactive account-health recovery tick
+ * (subscription-account-health, design D6).
+ *
+ * The health tracker (`@omnicross/core` `SubscriptionAccountHealth`) already
+ * self-heals LAZILY: an elapsed cooldown restores an account on the next
+ * `isSchedulable` read, so CORRECTNESS never depends on this sweeper. What the
+ * tick adds is PROACTIVITY for IDLE accounts (no traffic to trigger a lazy read):
+ *   - it fires the tracker's recovery SIGNAL (the seam #5 webhooks + #8
+ *     health-cron consume — this child only emits it), and
+ *   - it optionally nudges a fresh token for a recovered OAuth account so it
+ *     resumes instantly instead of paying refresh latency on its first request.
+ *
+ * Modeled EXACTLY on `TokenRefreshScheduler`: `start()` arms an `unref()`ed 60s
+ * timer, `dispose()` clears it, and a single-sweep re-entrancy guard means a
+ * long sweep never overlaps the next tick.
+ *
+ * @module @omnicross/daemon/AccountHealthSweeper
+ */
+
+declare class AccountHealthSweeper {
+    private readonly store;
+    private readonly health;
+    private readonly logger;
+    private readonly intervalMs;
+    private readonly leadMs;
+    private timer;
+    private sweeping;
+    constructor(store: JsonSubscriptionCredentialStore, health: SubscriptionAccountHealth, logger: Logger, intervalMs?: number, leadMs?: number);
+    /** Arm the sweep interval. Idempotent. The timer never holds the loop open. */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: surface accounts that just recovered (emits the recovery signal
+     * through the tracker's hook) and nudge a fresh token for any recovered OAuth
+     * account whose token is near expiry. Exposed for tests. Never throws.
+     */
+    sweep(now?: number): Promise<void>;
+    /** Expiring within the lead window, refreshable, and not already dead. */
+    private needsRefresh;
+    /** Refresh one recovered account by id; failures are logged, never thrown. */
+    private refreshOne;
+}
+
+/**
+ * AuditPruneSweeper — the TTL prune for the audit store (request-audit-log,
+ * design D4). Deletes whole `audit-YYYY-MM-DD.jsonl` files whose date is older
+ * than `retentionDays` — a cheap file UNLINK, never a line-level rewrite of a
+ * live file (which jsonl makes awkward). So the store never grows unbounded and
+ * TTL is O(files).
+ *
+ * Modeled on the #8 `AccountHealthProbeScheduler` / `AccountHealthSweeper`:
+ * `start()` arms an `unref()`ed interval, `dispose()` clears it, a single-sweep
+ * re-entrancy guard prevents overlap. A prune ALSO runs once at boot (`start`
+ * fires an immediate sweep). Disabled/zero-retention config ⇒ armed-off ⇒ no-op
+ * (byte-identical zero regression). Never throws.
+ *
+ * @module @omnicross/daemon/audit/AuditPruneSweeper
+ */
+
+declare class AuditPruneSweeper {
+    private readonly auditDir;
+    private readonly logger;
+    private config;
+    private readonly intervalMs;
+    /** Injectable clock (ms) for deterministic tests. */
+    private readonly now;
+    private timer;
+    private sweeping;
+    constructor(auditDir: string, logger: Logger, config: AuditConfig, intervalMs?: number, 
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number);
+    /** Whether pruning is active (audit enabled). */
+    get enabled(): boolean;
+    /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+    configure(config: AuditConfig): void;
+    /**
+     * Arm the prune interval AND run one prune immediately (boot cleanup). No-op
+     * when audit is disabled (zero regression). Idempotent.
+     */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One prune: unlink every audit date file strictly OLDER than the retention
+     * cutoff (`now - retentionDays` days, at local-midnight granularity). Exposed
+     * for tests; never throws. Returns the number of files removed.
+     */
+    sweep(): Promise<number>;
+}
+
+/**
+ * AuditWriter — the daemon's file-backed audit sink (request-audit-log, design
+ * D4/D5). Registered as `@omnicross/core`'s audit sink when audit is enabled; its
+ * {@link record} is what `recordAudit` hands each assembled record to.
+ *
+ * FIRE-AND-FORGET (hard constraint): {@link record} DEFERS the fs append off the
+ * caller's stack (an injectable `defer`, default a zero-delay timer — the
+ * `UsageRecorder` precedent) and returns immediately, so the relay response path
+ * never waits on disk I/O. A write error is swallowed + logged (a failing audit
+ * store must never affect a relay). Each record is appended as ONE JSON line to
+ * `audit/audit-YYYY-MM-DD.jsonl` (the record's LOCAL date), matching the
+ * `usage-events.jsonl` pattern — no new dependency, TTL is a whole-file unlink.
+ *
+ * @module @omnicross/daemon/audit/AuditWriter
+ */
+
+declare class AuditWriter {
+    private readonly auditDir;
+    private readonly logger;
+    /** Deferral used by `record()` to schedule the append off the caller's path. */
+    private readonly defer;
+    private dirEnsured;
+    constructor(auditDir: string, logger: Logger, 
+    /** Deferral used by `record()` to schedule the append off the caller's path. */
+    defer?: (fn: () => void) => void);
+    /**
+     * Enqueue one record for append. Returns IMMEDIATELY (fire-and-forget); the fs
+     * write happens on the deferred tick. A failure is logged, never thrown.
+     */
+    record(record: AuditRecord): void;
+    /**
+     * Append synchronously — the awaitable form tests use to assert the line landed.
+     * Ensures the `audit/` directory exists on first write (lazy, like the usage
+     * store's lazy file creation).
+     */
+    appendNow(record: AuditRecord): void;
+}
+
+/**
+ * BillingPublisher — the daemon's durable-first billing sink (billing-event-stream,
+ * design D2/D4). Registered as `@omnicross/core`'s billing sink when billing is
+ * enabled; its {@link record} is what `publishBillingEvent` hands each assembled
+ * event.
+ *
+ * DURABLE-FIRST (THE key decision, design D2): {@link record}
+ *  1. APPENDS the event as one JSON line to `billing/billing-YYYY-MM-DD.jsonl` —
+ *     SYNCHRONOUSLY, BEFORE any delivery attempt. This is the DURABLE source of
+ *     truth: once appended, the event is NEVER lost, even if the process crashes
+ *     or every delivery attempt fails. A billing ledger is a financial record.
+ *  2. then, only when an `endpoint` is configured, schedules a best-effort POST
+ *     OFF the caller's stack (an injectable `defer`, default a zero-delay timer)
+ *     so {@link record} RETURNS IMMEDIATELY — a slow/failing endpoint never blocks
+ *     the caller (which is already off the relay response path). Ledger-only mode
+ *     (no `endpoint`) simply appends — an external tailer consumes the jsonl.
+ *  3. on a POST ack, appends a delivery marker (`delivered-YYYY-MM-DD.jsonl`); on
+ *     failure the event stays UNdelivered in the ledger for the retry sweep +
+ *     external reconciliation. A delivery failure NEVER drops the event.
+ *
+ * At-least-once: the consumer dedupes on the event `id` (the request id). The
+ * built-in POST optionally signs the body with `X-Omnicross-Billing-Signature:
+ * sha256=<hmac hex>` (node `crypto`, no new dep). The signing `secret` is used
+ * ONLY to sign — it NEVER appears in the payload or a log line. Egress is #3's
+ * proxy-aware `fetchUpstream` (global proxy).
+ *
+ * @module @omnicross/daemon/billing/BillingPublisher
+ */
+
+/** The minimal `fetch` shape the publisher POSTs through (proxy-aware by default). */
+type BillingFetch = (url: string, init: RequestInit) => Promise<Response>;
+/** Constructor knobs (all optional; test seams for fetch/defer/clock). */
+interface BillingPublisherOptions {
+    /** Egress fn; defaults to #3's proxy-aware `fetchUpstream` (global proxy only). */
+    fetchImpl?: BillingFetch;
+    /** Deferral used by `record()` to schedule the POST off the caller's path. */
+    defer?: (fn: () => void) => void;
+    timeoutMs?: number;
+    /** Clock seam for delivery-marker timestamps (tests fix it). */
+    now?: () => number;
+}
+declare class BillingPublisher {
+    private readonly billingDir;
+    private readonly logger;
+    private config;
+    private dirEnsured;
+    private readonly fetchImpl;
+    private readonly defer;
+    private readonly timeoutMs;
+    private readonly now;
+    constructor(billingDir: string, logger: Logger, opts?: BillingPublisherOptions);
+    /** Install/replace the live billing config (endpoint + secret + retry bound). */
+    setConfig(config: BillingConfig | undefined): void;
+    /**
+     * Record one billing event. DURABLE-FIRST: append synchronously (the event is
+     * now on disk, never lost), THEN schedule a best-effort POST off the caller's
+     * stack (non-blocking; ledger-only when no endpoint). Returns IMMEDIATELY and
+     * NEVER throws — a failing append/POST is logged, never propagated.
+     */
+    record(event: BillingEvent): void;
+    /**
+     * Append the event as one JSON line to `billing-YYYY-MM-DD.jsonl` (the event's
+     * LOCAL date). Synchronous — the awaitable form tests use to assert the ledger
+     * line landed BEFORE any delivery. Ensures the `billing/` directory on first write.
+     */
+    appendNow(event: BillingEvent): void;
+    /**
+     * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
+     * event JSON to the configured endpoint (optionally HMAC-signed); on a 2xx ack
+     * appends a delivery marker and returns `true`. Any non-2xx / thrown / timed-out
+     * attempt returns `false` — the event stays UNdelivered in the ledger (never
+     * lost). NEVER rejects. A no-op `false` when no endpoint is configured.
+     */
+    deliverNow(event: BillingEvent): Promise<boolean>;
+    /**
+     * Append a delivery marker `{ id, deliveredAt }` to `delivered-YYYY-MM-DD.jsonl`
+     * (keyed by the EVENT's date so the reader finds both together). Idempotent at
+     * the reconciliation layer — the reader unions marker ids into a delivered set,
+     * so a duplicate marker is harmless. A marker-write failure is logged, never thrown.
+     */
+    markDelivered(event: BillingEvent): void;
+    private ensureDir;
+}
+
+/**
+ * BillingRetrySweeper — the bounded retry + reconciliation sweep for the billing
+ * ledger (billing-event-stream, design D5). Periodically re-POSTs UNdelivered
+ * ledger events (via the publisher's built-in delivery) with a bounded age:
+ *  - an undelivered event WITHIN `maxRetryAgeMs` of its timestamp is re-POSTed
+ *    (the request id makes the re-POST safe — the consumer dedupes);
+ *  - an undelivered event PAST `maxRetryAgeMs` is LEFT in the ledger for external
+ *    reconciliation — it is NEVER deleted (a delivery failure must never drop a
+ *    billing record; the ledger is a financial record, so there is NO prune here,
+ *    unlike the #13 audit TTL);
+ *  - a DELIVERED event (has a marker) is never re-sent (delivery-marking prevents
+ *    double delivery).
+ *
+ * Modeled on the #8/#13 sweepers: `start()` arms an `unref()`ed interval, a
+ * single-sweep re-entrancy guard prevents overlap, `dispose()` clears it. A sweep
+ * ALSO runs once at boot (`start` fires an immediate sweep). Disabled/ledger-only
+ * (no endpoint) ⇒ armed-off ⇒ no-op. Never throws.
+ *
+ * @module @omnicross/daemon/billing/BillingRetrySweeper
+ */
+
+declare class BillingRetrySweeper {
+    private readonly billingDir;
+    private readonly publisher;
+    private readonly logger;
+    private config;
+    private readonly intervalMs;
+    /** Injectable clock (ms) for deterministic tests. */
+    private readonly now;
+    private timer;
+    private sweeping;
+    constructor(billingDir: string, publisher: BillingPublisher, logger: Logger, config: BillingConfig, intervalMs?: number, 
+    /** Injectable clock (ms) for deterministic tests. */
+    now?: () => number);
+    /** Whether retrying is active: billing enabled AND an endpoint is configured. */
+    get enabled(): boolean;
+    /** Re-apply config to the live instance (boot + admin PUT hot-reload). */
+    configure(config: BillingConfig): void;
+    /**
+     * Arm the retry interval AND run one sweep immediately (boot catch-up for events
+     * that failed to deliver while the daemon was down). No-op when disabled or in
+     * ledger-only mode (no endpoint to POST to). Idempotent.
+     */
+    start(): void;
+    /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
+    dispose(): void;
+    /**
+     * One sweep: re-POST every UNdelivered ledger event still within
+     * `maxRetryAgeMs`; leave over-age undelivered events for reconciliation (NEVER
+     * deleted). Exposed for tests; never throws. Returns the number of events a
+     * re-POST was attempted for.
+     */
+    sweep(): Promise<number>;
+}
+
 /**
  * TokenRefreshScheduler — proactive background OAuth token refresh
  * (external-cli-sync).
@@ -1572,6 +2229,96 @@ declare class TokenRefreshScheduler {
     private refreshActive;
 }
 
+/**
+ * WebhookDispatcher — the daemon-side fire-and-forget webhook sender
+ * (webhook-notifications, design D4/D5/D6).
+ *
+ * Registered as the core emit sink at bootstrap. {@link emit} pushes the event
+ * onto a bounded in-memory queue and RETURNS IMMEDIATELY — it never awaits a
+ * send and never throws, so a slow/failing/throwing destination can NEVER block
+ * or delay a relay request (the HARD contract). An async drain loop then:
+ *  - matches each event to every enabled destination whose `events` filter
+ *    allows it (absent/empty ⇒ all kinds),
+ *  - sends to the matching destinations CONCURRENTLY,
+ *  - retries a failed send with bounded exponential backoff up to
+ *    `maxAttempts`, then LOGS (via the injected #10 logger) and DROPS it.
+ * The queue is bounded (drop-OLDEST + a one-shot warn) so a runaway source can't
+ * OOM the process.
+ *
+ * Egress is #3's proxy-aware `fetchUpstream` with NO ctx → the GLOBAL proxy only
+ * (webhooks aren't per-account). Signing uses node `crypto` (no new deps):
+ * `custom` → optional `X-Omnicross-Signature: sha256=<hex hmac of body>`;
+ * `feishu` → Feishu's `timestamp` + `sign` (HMAC-SHA256 base64 of
+ * `timestamp\nsecret`) envelope. The destination `secret` is used ONLY to sign;
+ * it is NEVER placed in a payload or a log line.
+ *
+ * @module @omnicross/daemon/webhook/WebhookDispatcher
+ */
+
+/** The minimal `fetch` shape the dispatcher POSTs through (proxy-aware by default). */
+type WebhookFetch = (url: string, init: RequestInit) => Promise<Response>;
+/** Outcome of a single delivery attempt (used by the admin test path). */
+interface WebhookDeliveryResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+/** Constructor knobs (all optional; test seams for fetch/logger/sleep/clock). */
+interface WebhookDispatcherOptions {
+    /** Egress fn; defaults to #3's proxy-aware `fetchUpstream` (global proxy only). */
+    fetchImpl?: WebhookFetch;
+    /** Injected #10 logger for drop/debug lines (never logs a secret). */
+    logger?: Logger;
+    maxAttempts?: number;
+    queueMax?: number;
+    timeoutMs?: number;
+    baseBackoffMs?: number;
+    /** Backoff sleep seam (tests inject an instant/fake sleep). */
+    sleep?: (ms: number) => Promise<void>;
+    /** Clock seam for the `test` event `at` + Feishu `timestamp` (tests fix it). */
+    now?: () => number;
+}
+declare class WebhookDispatcher {
+    private config;
+    private readonly queue;
+    private draining;
+    private warnedFull;
+    private readonly fetchImpl;
+    private readonly logger;
+    private readonly maxAttempts;
+    private readonly queueMax;
+    private readonly timeoutMs;
+    private readonly baseBackoffMs;
+    private readonly sleep;
+    private readonly now;
+    constructor(opts?: WebhookDispatcherOptions);
+    /** Install/replace the live webhook config (destinations + master switch). */
+    setConfig(config: WebhookConfig | undefined): void;
+    /**
+     * Enqueue an event and return IMMEDIATELY (fire-and-forget). NEVER awaits a
+     * send, NEVER throws — the drain loop does all sending on a side channel. A
+     * full queue drops the OLDEST event (with a one-shot warn) so a runaway source
+     * can't OOM the process.
+     */
+    emit(event: WebhookEvent): void;
+    /** Drain the queue, sending each event to its matching destinations concurrently. */
+    private drain;
+    /** The enabled destinations whose event filter admits this kind (empty ⇒ all). */
+    private matchingDestinations;
+    /** Send with bounded exponential backoff; log-and-drop after `maxAttempts`. */
+    private sendWithRetry;
+    /** One POST attempt. Returns an outcome; a thrown error becomes `{ ok:false }`. */
+    private sendOnce;
+    /**
+     * ADMIN test path (design D8): deliver a `test` event to ONE destination and
+     * AWAIT the single-attempt result. This is the ONLY awaited send — it runs on
+     * the admin request path (an operator clicking "Test"), NEVER on a relay path,
+     * so awaiting it is safe. Finds the destination regardless of its `enabled`
+     * flag or the master switch (an explicit operator action).
+     */
+    deliverTest(destinationId: string): Promise<WebhookDeliveryResult>;
+}
+
 /**
  * bootstrap.ts — `buildDaemon` wires `@omnicross/core`'s `ProviderProxy` +
  * `OutboundApiServer` STANDALONE (design D6).
@@ -1636,7 +2383,8 @@ interface DaemonPaths {
 }
 /** The constructed daemon handles the CLI commands operate on. */
 interface Daemon {
-    readonly logger: ConsoleLogger;
+    /** The injected `Logger` port (a `ConfigurableLogger` built from `config.logging`). */
+    readonly logger: Logger;
     readonly llmConfig: ConfigFileProviderConfigSource;
     readonly keyDb: JsonOutboundKeyDb;
     readonly settingsStore: JsonApiServerSettingsStore;
@@ -1673,6 +2421,54 @@ interface Daemon {
      * still disposes it in cleanup.
      */
     readonly tokenRefreshScheduler: TokenRefreshScheduler;
+    /**
+     * Proactive account-health recovery sweep (subscription-account-health, D6).
+     * NOT started here — `start.ts` arms it for the resident daemon; disposed in
+     * cleanup. Correctness never depends on it (health self-heals lazily on read).
+     */
+    readonly accountHealthSweeper: AccountHealthSweeper;
+    /**
+     * Scheduled ACTIVE account-health probe (subscription-account-probe #8).
+     * Constructed armed-off with default config (`enabled:false`); `start.ts`
+     * `configure(...)`s it from the persisted `accountProbe` segment and starts it
+     * ONLY when enabled. Disposed in cleanup.
+     */
+    readonly accountHealthProbeScheduler: AccountHealthProbeScheduler;
+    /**
+     * Fire-and-forget webhook sender (webhook-notifications). Wired into the core
+     * emit sink + the #2 health signals by `start.ts`/admin PUT via
+     * `applyWebhookConfig`. INERT until a config enables it (zero regression).
+     */
+    readonly webhookDispatcher: WebhookDispatcher;
+    /**
+     * File-backed audit sink (request-audit-log) — appends each captured record to
+     * `audit/audit-YYYY-MM-DD.jsonl` fire-and-forget. Registered as the core sink
+     * (via the audit runtime slot) by `start.ts`/admin PUT ONLY when the `audit`
+     * segment is enabled. INERT until then (no sink ⇒ capture hook is a no-op).
+     */
+    readonly auditWriter: AuditWriter;
+    /**
+     * TTL prune for the audit store (request-audit-log) — unlinks date files past
+     * `retentionDays`. Armed-off; `start.ts` configures from the persisted `audit`
+     * segment + starts it (running one prune at boot) ONLY when enabled. Disposed
+     * in cleanup.
+     */
+    readonly auditPruneSweeper: AuditPruneSweeper;
+    /**
+     * Durable-first billing publisher (billing-event-stream) — appends each event
+     * to `billing/billing-YYYY-MM-DD.jsonl` FIRST, then best-effort POSTs it.
+     * Registered as the core billing sink (via the billing runtime slot) by
+     * `start.ts`/admin PUT ONLY when the `billing` segment is enabled. INERT until
+     * then (no sink ⇒ `publishBillingEvent` is a no-op).
+     */
+    readonly billingPublisher: BillingPublisher;
+    /**
+     * Bounded retry + reconciliation sweep for the billing ledger
+     * (billing-event-stream) — re-POSTs undelivered events within `maxRetryAgeMs`,
+     * NEVER deletes. Armed-off; `start.ts` configures from the persisted `billing`
+     * segment + starts it ONLY when enabled with an endpoint. Disposed in cleanup.
+     */
+    readonly billingRetrySweeper: BillingRetrySweeper;
 }
 /**
  * Construct the standalone daemon from a loaded config + on-disk paths. Does NOT
@@ -1698,6 +2494,137 @@ declare function buildDaemon(config: DaemonConfig, paths: DaemonPaths): Daemon;
  * via `daemon.adminServer.stop()`. */
 declare function resetDaemonSingletonsForTests(): void;
 
+/**
+ * health.ts — the pure `/health` report builder (daemon-health-endpoint, D2).
+ *
+ * `buildHealthReport(deps)` returns a COARSE, SECRET-FREE {@link HealthReport}
+ * from cheap SYNCHRONOUS probes. It NEVER hits an upstream, NEVER blocks, and
+ * NEVER embeds a token/email/config-value/record-count — the body is served
+ * UNAUTHENTICATED (before the admin auth gate, and optionally before the outbound
+ * key-auth), so it must expose nothing sensitive.
+ *
+ * Each check is a caller-supplied boolean thunk; a thunk that THROWS collapses to
+ * `false` (a health probe must never crash the process). Status math:
+ *  - CRITICAL (`config`, `credentialStore`): a false critical → `error`.
+ *  - READINESS (`outboundServer`): the serving-path signal — false → `degraded`.
+ *  - INFORMATIONAL (`adminServer`): reported in `checks` but does NOT affect
+ *    `status` — a disabled/loopback dashboard must not fail the TRAFFIC-port
+ *    probe (the whole point of the outbound secondary mount).
+ * `error` and `degraded` both map to HTTP 503 (see `healthHttpStatus`), so a
+ * probe treats "not fully ready" as not-ready.
+ *
+ * @module @omnicross/daemon/admin/health
+ */
+
+/** The coarse dependency probes + process-stat seams the builder reads. */
+interface HealthReportDeps {
+    /** The daemon package version (non-secret; also on the identity header). */
+    version: string;
+    /** CRITICAL: the bootstrap config is present/loaded. */
+    configPresent: () => boolean;
+    /** CRITICAL: the credential store is constructed + its file readable (no decrypt). */
+    credentialStoreReadable: () => boolean;
+    /** Non-critical: the outbound `/v1/*` serving listener is running. */
+    outboundServerRunning: () => boolean;
+    /** Non-critical: the admin listener is running. */
+    adminServerRunning: () => boolean;
+    /**
+     * OPTIONAL coarse account-probe signal (subscription-account-probe #8, design
+     * D5). Returns `true` when no PROBED account is currently unhealthy, `false`
+     * when one is, or `undefined` when probing is DISABLED (→ the check is OMITTED,
+     * keeping the `/health` body byte-identical when the feature is off).
+     * INFORMATIONAL: it never affects `status` (a marked account is an operational
+     * signal, not a daemon-readiness failure). Account-anonymous — no ids/counts.
+     */
+    subscriptionAccountsHealthy?: () => boolean | undefined;
+    /** TEST SEAM: process memory snapshot (defaults to `process.memoryUsage`). */
+    memoryUsage?: () => NodeJS.MemoryUsage;
+    /** TEST SEAM: process uptime seconds (defaults to `process.uptime`). */
+    uptimeSeconds?: () => number;
+    /** TEST SEAM: wall clock ms (defaults to `Date.now`). */
+    now?: () => number;
+}
+/** Build the coarse, secret-free health report (design D2). */
+declare function buildHealthReport(deps: HealthReportDeps): HealthReport;
+
+/**
+ * ConfigurableLogger — a `Logger` port impl with level / format / file sink
+ * (configurable-logging, design D3). Supersedes `ConsoleLogger` as the injected
+ * daemon logger.
+ *
+ *  - LEVEL: numeric severity `error(0) < warn(1) < info(2) < debug(3)`; a message
+ *    whose level is BELOW the configured threshold (higher ordinal) is dropped.
+ *    Default threshold = `debug` (prints everything).
+ *  - FORMAT: `text` (the legacy `console.*(message, meta)` shape) | `json` (one
+ *    structured line `{ ts, level, msg, ...meta }`). Default `text`.
+ *  - SINK: always the console; PLUS an optional append-only file stream when
+ *    `file` is set (lazy-open; a write/open error is swallowed → the daemon never
+ *    crashes on a logging failure, it just falls back to the console).
+ *
+ * ZERO-REGRESSION DEFAULT: `new ConfigurableLogger()` (no config) = console +
+ * all levels + text = behaviorally byte-identical to the legacy `ConsoleLogger`
+ * (same `console` method per level, same `(message[, meta])` / error arg shape).
+ *
+ * CAUTION (per the #3 host:port-only-logging precedent): the JSON serializer
+ * reduces an `Error` to `{ message, stack }` and spreads a plain `meta` object,
+ * but it is NOT a secret redactor — call sites remain responsible for not passing
+ * secret-bearing objects.
+ *
+ * @module @omnicross/daemon/ports/ConfigurableLogger
+ */
+
+declare class ConfigurableLogger implements Logger {
+    private readonly threshold;
+    private readonly format;
+    private readonly filePath;
+    private fileStream;
+    private fileDisabled;
+    constructor(cfg?: LoggingConfig);
+    info(message: string, meta?: Record<string, unknown> | Error | object): void;
+    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
+    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
+    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
+    /**
+     * Flush + close the file sink (tests / graceful shutdown). Resolves once the
+     * append stream has finished flushing to disk. No-op when no file sink is open.
+     */
+    close(): Promise<void>;
+    private emit;
+    /**
+     * Console sink. In `text` format this reproduces the legacy `ConsoleLogger`
+     * EXACTLY (same method + arg shape) so the unconfigured default is a byte-for-
+     * byte drop-in; in `json` format it prints the structured line.
+     */
+    private writeConsole;
+    /** Append one line to the file sink; a failure disables the sink (swallowed). */
+    private writeFile;
+    /** Lazily open the append-only file stream; disable the sink on any error. */
+    private getFileStream;
+    private consoleFn;
+    /** `{ ts, level, msg, ...meta }` (+ `error` when present) as a single line. */
+    private jsonLine;
+    /** Human-readable file line: `ISO [level] message {metaJson}`. */
+    private textLine;
+}
+
+/**
+ * ConsoleLogger — the daemon's file-less default `Logger` port impl (design D5).
+ *
+ * A thin `console.*` wrapper. The serving core depends on the `Logger` port
+ * (never a host class), so this trivial implementation is the only logger the
+ * standalone daemon needs. `error` uses the WIDEST `(message, error?, meta?)`
+ * signature so every core call site stays assignable.
+ *
+ * @module @omnicross/daemon/ports/ConsoleLogger
+ */
+
+declare class ConsoleLogger implements Logger {
+    info(message: string, meta?: Record<string, unknown> | Error | object): void;
+    warn(message: string, meta?: Record<string, unknown> | Error | object): void;
+    error(message: string, error?: unknown, meta?: Record<string, unknown> | object): void;
+    debug(message: string, meta?: Record<string, unknown> | Error | object): void;
+}
+
 /**
  * ccr-import.ts — translate a `claude-code-router` (CCR) `config.json` into an
  * omnicross daemon config (design D9). Pure + testable: `parseCcrConfig(raw)` +
@@ -1761,4 +2688,4 @@ declare function mapCcrToOmnicross(ccr: CcrConfig): {
     notes: string[];
 };
 
-export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };
+export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConfigurableLogger, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, type HealthReportDeps, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type ResolvedAdminConfig, buildDaemon, buildHealthReport, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };