@omnicross/daemon 0.1.4 → 0.1.6

package/dist/index.cjs

@@ -53,16 +53,18 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/bootstrap.ts
-var import_node_fs19 = require("fs");
+var import_node_fs22 = require("fs");
 var import_audit_types = require("@omnicross/contracts/audit-types");
 var import_billing_types = require("@omnicross/contracts/billing-types");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
 var import_outbound_api4 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
-var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
+var import_SubscriptionAccountHealth3 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceScheduling4 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy = require("@omnicross/core/provider-proxy");
 var import_outbound_api5 = require("@omnicross/core/outbound-api");
@@ -174,8 +176,448 @@ function handleCodexOAuthStatus(sessionId, deps) {
   return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
 }
 
+// src/allowance/AccountAllowanceService.ts
+var import_AccountAllowanceStore2 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceScheduling = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+
+// src/allowance/ClaudeAllowanceCollector.ts
+var import_AccountAllowanceStore = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch = require("@omnicross/core/pipeline/upstreamFetch");
+var import_fingerprintHeaders = require("@omnicross/core/provider-proxy/identity/fingerprintHeaders");
+var import_SubscriptionIdentityStore = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
+var CLAUDE_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+function finitePercent(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const number = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(number) && number >= 0 && number <= 100 ? number : null;
+}
+function isoInstant(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const time = Date.parse(value);
+  return Number.isFinite(time) ? new Date(time).toISOString() : void 0;
+}
+function secondsUntil(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function windowFromPayload(id, payload, now) {
+  const usedPercent = finitePercent(payload?.utilization);
+  const resetsAt = isoInstant(payload?.resets_at);
+  const isSonnet = id === "seven-day-sonnet";
+  const isFiveHour = id === "five-hour";
+  return {
+    id,
+    label: isFiveHour ? "5 hours" : isSonnet ? "7 days \xB7 Sonnet" : "7 days",
+    scope: isSonnet ? "model-family" : "all",
+    modelFamily: isSonnet ? "sonnet" : void 0,
+    usedPercent,
+    windowMinutes: isFiveHour ? 5 * 60 : 7 * 24 * 60,
+    resetsAt,
+    remainingSeconds: secondsUntil(resetsAt, now),
+    state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+  };
+}
+function emptyClaudeWindows(state) {
+  return [
+    {
+      id: "five-hour",
+      label: "5 hours",
+      scope: "all",
+      usedPercent: null,
+      windowMinutes: 5 * 60,
+      state
+    },
+    {
+      id: "seven-day",
+      label: "7 days",
+      scope: "all",
+      usedPercent: null,
+      windowMinutes: 7 * 24 * 60,
+      state
+    },
+    {
+      id: "seven-day-sonnet",
+      label: "7 days \xB7 Sonnet",
+      scope: "model-family",
+      modelFamily: "sonnet",
+      usedPercent: null,
+      windowMinutes: 7 * 24 * 60,
+      state
+    }
+  ];
+}
+function hasHeader(headers, name) {
+  const wanted = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === wanted);
+}
+var ClaudeAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch.fetchUpstream)(url, init, { providerId: "claude", accountId }), identityStore = (0, import_SubscriptionIdentityStore.getSharedIdentityStore)(), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.identityStore = identityStore;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  identityStore;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    const unsupported = account.tokens.isSetupToken || account.tokens.authMethod !== "oauth";
+    if (unsupported) {
+      const existing = this.store.get("claude", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) return Promise.resolve(existing);
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("claude", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) return Promise.resolve(cached);
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id).catch(() => this.failureSnapshot(account.id, "claude_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.source !== "oauth-usage-api") return false;
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId) {
+    let token = await this.credentials.getAccessTokenForAccount("claude", accountId);
+    if (!token) return this.failureSnapshot(accountId, "claude_usage_token_unavailable", this.now());
+    let response = await this.request(accountId, token);
+    if (response.status === 401) {
+      const refreshed = await this.credentials.refreshAccountToken("claude", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "claude_usage_unauthorized", this.now());
+      token = await this.credentials.getAccessTokenForAccount("claude", accountId);
+      if (!token) return this.failureSnapshot(accountId, "claude_usage_token_unavailable", this.now());
+      response = await this.request(accountId, token);
+    }
+    if (response.status === 403) {
+      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "claude_usage_unsupported");
+      this.store.set(snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) {
+      return this.failureSnapshot(accountId, "claude_usage_http_error", this.now());
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(accountId, "claude_usage_invalid_response", this.now());
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      return this.failureSnapshot(accountId, "claude_usage_invalid_response", this.now());
+    }
+    const now = this.now();
+    const usage = payload;
+    const snapshot = {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        windowFromPayload("five-hour", usage.five_hour, now),
+        windowFromPayload("seven-day", usage.seven_day, now),
+        windowFromPayload("seven-day-sonnet", usage.seven_day_sonnet, now)
+      ]
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  request(accountId, token) {
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      "anthropic-beta": "oauth-2025-04-20",
+      "Accept-Language": "en-US,en;q=0.9"
+    };
+    (0, import_fingerprintHeaders.applyFingerprint)(this.identityStore, headers, "claude", accountId, void 0);
+    if (!hasHeader(headers, "user-agent")) {
+      headers["User-Agent"] = "claude-cli/2.0.53 (external, cli)";
+    }
+    return this.fetchImpl(CLAUDE_USAGE_URL, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("claude", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: emptyClaudeWindows("unavailable"),
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now, code = "claude_usage_unsupported_auth") {
+    return {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: emptyClaudeWindows("unsupported"),
+      lastErrorCode: code
+    };
+  }
+};
+
+// src/allowance/AccountAllowanceService.ts
+function codexUnavailable(accountId, now) {
+  return {
+    providerId: "codex",
+    accountId,
+    source: "response-headers",
+    observedAt: new Date(now).toISOString(),
+    windows: [
+      { id: "primary", label: "Primary", scope: "all", usedPercent: null, state: "unavailable" },
+      { id: "secondary", label: "Secondary", scope: "all", usedPercent: null, state: "unavailable" }
+    ],
+    lastErrorCode: "codex_allowance_not_observed"
+  };
+}
+var AccountAllowanceService = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore2.getSharedAccountAllowanceStore)(), collector, now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.now = now;
+    this.claudeCollector = collector ?? new ClaudeAllowanceCollector(credentials, store);
+  }
+  credentials;
+  store;
+  now;
+  claudeCollector;
+  /**
+   * Read all/filtered snapshots. Claude's five-minute cache is refreshed lazily;
+   * Codex remains passive and reports not-observed until a real model response.
+   */
+  async list(filter = {}) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    const wantsClaude = !filter.providerId || filter.providerId === "claude";
+    const claudeAccounts = (config.claudeAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsClaude) await this.claudeCollector.collectMany(claudeAccounts);
+    const wantsCodex = !filter.providerId || filter.providerId === "codex";
+    const codexAccounts = (config.codexAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsCodex) {
+      for (const account of codexAccounts) {
+        if (!this.store.get("codex", account.id)) this.store.set(codexUnavailable(account.id, this.now()));
+      }
+    }
+    const known = /* @__PURE__ */ new Set();
+    if (wantsClaude) for (const account of claudeAccounts) known.add(`claude\0${account.id}`);
+    if (wantsCodex) for (const account of codexAccounts) known.add(`codex\0${account.id}`);
+    return this.store.list(filter).filter((snapshot) => known.has(`${snapshot.providerId}\0${snapshot.accountId}`));
+  }
+  /** Force-refresh Claude usage for one account or every stored Claude account. */
+  async refreshClaude(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    const accounts = (config.claudeAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.claudeCollector.collectMany(accounts, { force: true });
+  }
+  /**
+   * Keep Claude snapshots warm for allowance-aware routing. This deliberately
+   * excludes Codex (whose quota is learned from real response headers) and
+   * preserves the collector's cache + per-account in-flight coalescing.
+   */
+  async maintainClaudeCache(refreshAheadMs) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    await this.claudeCollector.collectMany(config.claudeAccounts ?? [], { refreshAheadMs });
+  }
+  /** Remove a cache row as soon as an account is deleted by the admin path. */
+  removeAccountSnapshot(providerId, accountId) {
+    this.store.delete(providerId, accountId);
+  }
+  /** Remove all allowance rows for a provider block that was deleted. */
+  removeProviderSnapshots(providerId) {
+    for (const snapshot of this.store.list({ providerId })) {
+      this.store.delete(snapshot.providerId, snapshot.accountId);
+    }
+  }
+  /** Secret-free policy diagnostics for the settings/accounts UI. */
+  getSchedulingStatus() {
+    const scheduling = (0, import_AccountAllowanceScheduling.getSharedAccountAllowanceScheduling)();
+    return { config: scheduling.getConfig(), history: scheduling.getHistory() };
+  }
+};
+
+// src/allowance/ClaudeAllowanceRefreshScheduler.ts
+var CLAUDE_ALLOWANCE_CHECK_INTERVAL_MS = 6e4;
+var CLAUDE_ALLOWANCE_REFRESH_AHEAD_MS = 9e4;
+var ClaudeAllowanceRefreshScheduler = class {
+  constructor(service, logger, intervalMs = CLAUDE_ALLOWANCE_CHECK_INTERVAL_MS, refreshAheadMs = CLAUDE_ALLOWANCE_REFRESH_AHEAD_MS) {
+    this.service = service;
+    this.logger = logger;
+    this.intervalMs = intervalMs;
+    this.refreshAheadMs = refreshAheadMs;
+  }
+  service;
+  logger;
+  intervalMs;
+  refreshAheadMs;
+  timer = null;
+  started = false;
+  enabled = false;
+  sweeping = false;
+  /**
+   * Apply live server policy. Once started, enable/disable changes arm or disarm
+   * immediately; the initial enabled sweep is fire-and-forget.
+   */
+  configure(config) {
+    const nextEnabled = config?.enabled === true;
+    if (this.enabled === nextEnabled) return;
+    this.enabled = nextEnabled;
+    if (!this.started) return;
+    if (nextEnabled) {
+      this.arm();
+      void this.sweep();
+    } else {
+      this.disarm();
+    }
+  }
+  /** Start the lifecycle. Disabled policy remains completely inert. */
+  start() {
+    if (this.started) return;
+    this.started = true;
+    if (!this.enabled) return;
+    this.arm();
+    void this.sweep();
+  }
+  /** Stop all future checks. Idempotent and safe during an in-flight refresh. */
+  dispose() {
+    this.started = false;
+    this.disarm();
+  }
+  /** One non-overlapping cache-maintenance pass. Exposed for focused tests. */
+  async sweep() {
+    if (!this.enabled || this.sweeping) return;
+    this.sweeping = true;
+    try {
+      await this.service.maintainClaudeCache(this.refreshAheadMs);
+    } catch (error) {
+      this.logger.warn("Claude allowance background refresh failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.sweeping = false;
+    }
+  }
+  arm() {
+    if (this.timer) return;
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  disarm() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+};
+
+// src/allowance/JsonAccountAllowancePersistence.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_AccountAllowanceStore3 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var ACCOUNT_ALLOWANCE_CACHE_VERSION = 1;
+var MAX_PERSISTED_ALLOWANCE_SNAPSHOTS = 256;
+var MAX_ALLOWANCE_CACHE_BYTES = 1e6;
+var JsonAccountAllowancePersistence = class {
+  constructor(cachePath) {
+    this.cachePath = cachePath;
+  }
+  cachePath;
+  /** Read only the `snapshots` payload; all row validation remains defensive. */
+  load() {
+    if (!(0, import_node_fs.existsSync)(this.cachePath)) return [];
+    try {
+      if ((0, import_node_fs.statSync)(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
+      const raw = (0, import_node_fs.readFileSync)(this.cachePath, "utf8");
+      if (!raw.trim()) return [];
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) return parsed;
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+      const file = parsed;
+      return file.version === ACCOUNT_ALLOWANCE_CACHE_VERSION && Array.isArray(file.snapshots) ? file.snapshots : [];
+    } catch {
+      return [];
+    }
+  }
+  /** Replace the file atomically; the target remains intact if replacement fails. */
+  save(snapshots) {
+    const rows = [];
+    for (const snapshot of snapshots) {
+      const normalized = (0, import_AccountAllowanceStore3.normalizeAccountAllowanceSnapshot)(snapshot);
+      if (!normalized) continue;
+      rows.push(normalized);
+      if (rows.length >= MAX_PERSISTED_ALLOWANCE_SNAPSHOTS) break;
+    }
+    const file = {
+      version: ACCOUNT_ALLOWANCE_CACHE_VERSION,
+      snapshots: rows
+    };
+    const serialized = JSON.stringify(file, null, 2) + "\n";
+    if (Buffer.byteLength(serialized, "utf8") > MAX_ALLOWANCE_CACHE_BYTES) {
+      throw new Error("account allowance cache exceeds its size limit");
+    }
+    (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(this.cachePath), { recursive: true });
+    const temporaryPath = `${this.cachePath}.${process.pid}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
+    try {
+      (0, import_node_fs.writeFileSync)(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
+      (0, import_node_fs.renameSync)(temporaryPath, this.cachePath);
+    } finally {
+      (0, import_node_fs.rmSync)(temporaryPath, { force: true });
+    }
+  }
+};
+
 // src/admin/AdminServer.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_http2 = __toESM(require("http"), 1);
 var import_health_logging_types = require("@omnicross/contracts/health-logging-types");
 
@@ -194,16 +636,16 @@ function intParam(value) {
 }
 function handleAuditQuery(req, res, reader) {
   const url = new URL(req.url ?? "/", "http://localhost");
-  const query = {};
+  const query2 = {};
   const keyId = url.searchParams.get("keyId");
-  if (keyId && keyId.trim()) query.keyId = keyId.trim();
+  if (keyId && keyId.trim()) query2.keyId = keyId.trim();
   const from = intParam(url.searchParams.get("from"));
-  if (from !== void 0) query.from = from;
+  if (from !== void 0) query2.from = from;
   const to = intParam(url.searchParams.get("to"));
-  if (to !== void 0) query.to = to;
+  if (to !== void 0) query2.to = to;
   const limit = intParam(url.searchParams.get("limit"));
-  if (limit !== void 0) query.limit = limit;
-  const records = reader ? reader(query) : [];
+  if (limit !== void 0) query2.limit = limit;
+  const records = reader ? reader(query2) : [];
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ records }));
 }
@@ -275,19 +717,19 @@ function resetWebhookRuntimeForTests() {
 
 // src/admin/webhookTestApi.ts
 function readJsonBody(req) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       try {
         const raw = Buffer.concat(chunks).toString("utf8");
         const parsed = raw ? JSON.parse(raw) : {};
-        resolve(parsed && typeof parsed === "object" ? parsed : {});
+        resolve2(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
-        resolve({});
+        resolve2({});
       }
     });
-    req.on("error", () => resolve({}));
+    req.on("error", () => resolve2({}));
   });
 }
 async function handleWebhookTest(req, res) {
@@ -306,13 +748,15 @@ async function handleWebhookTest(req, res) {
 // src/admin/adminApi.ts
 var import_node_http = __toESM(require("http"), 1);
 var import_outbound_api2 = require("@omnicross/core/outbound-api");
-var import_upstreamFetch2 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/config.ts
-var import_node_fs2 = require("fs");
+var import_node_fs3 = require("fs");
 
 // src/secrets/envelope.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var ENVELOPE_PREFIX = "enc:";
 var ENVELOPE_VERSION = "v1";
 var KEY_BYTES = 32;
@@ -342,8 +786,8 @@ function encryptValue(plain, key) {
   if (key.length !== KEY_BYTES) {
     throw new Error(`secret key must be ${KEY_BYTES} bytes`);
   }
-  const iv = (0, import_node_crypto2.randomBytes)(IV_BYTES);
-  const cipher = (0, import_node_crypto2.createCipheriv)("aes-256-gcm", key, iv);
+  const iv = (0, import_node_crypto3.randomBytes)(IV_BYTES);
+  const cipher = (0, import_node_crypto3.createCipheriv)("aes-256-gcm", key, iv);
   const ciphertext = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
   return [
@@ -360,21 +804,21 @@ function decryptValue(envelope, key) {
     throw new Error(`secret key must be ${KEY_BYTES} bytes`);
   }
   const { iv, tag, ciphertext } = parseEnvelope(envelope);
-  const decipher = (0, import_node_crypto2.createDecipheriv)("aes-256-gcm", key, iv);
+  const decipher = (0, import_node_crypto3.createDecipheriv)("aes-256-gcm", key, iv);
   decipher.setAuthTag(tag);
   const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   return plain.toString("utf8");
 }
 
 // src/secrets/masterKey.ts
-var import_node_crypto3 = require("crypto");
-var import_node_fs = require("fs");
+var import_node_crypto4 = require("crypto");
+var import_node_fs2 = require("fs");
 var import_node_os = require("os");
-var import_node_path = require("path");
+var import_node_path2 = require("path");
 var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
 var KEY_BYTES2 = 32;
 function defaultMasterKeyPath() {
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".omnicross", "master.key");
+  return (0, import_node_path2.join)((0, import_node_os.homedir)(), ".omnicross", "master.key");
 }
 function decodeEnvKey(raw) {
   const trimmed = raw.trim();
@@ -390,7 +834,7 @@ function decodeEnvKey(raw) {
   return buf;
 }
 function readKeyFile(path2) {
-  const raw = (0, import_node_fs.readFileSync)(path2);
+  const raw = (0, import_node_fs2.readFileSync)(path2);
   if (raw.length === KEY_BYTES2) return raw;
   const text = raw.toString("utf8").trim();
   if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
@@ -401,11 +845,11 @@ function readKeyFile(path2) {
   );
 }
 function generateKeyFile(path2) {
-  const key = (0, import_node_crypto3.randomBytes)(KEY_BYTES2);
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path2), { recursive: true });
-  (0, import_node_fs.writeFileSync)(path2, key, { mode: 384 });
+  const key = (0, import_node_crypto4.randomBytes)(KEY_BYTES2);
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path2), { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path2, key, { mode: 384 });
   try {
-    (0, import_node_fs.chmodSync)(path2, 384);
+    (0, import_node_fs2.chmodSync)(path2, 384);
   } catch {
   }
   return key;
@@ -416,7 +860,7 @@ function resolveMasterKey(options = {}) {
     return decodeEnvKey(envRaw);
   }
   const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
-  if ((0, import_node_fs.existsSync)(keyFilePath)) {
+  if ((0, import_node_fs2.existsSync)(keyFilePath)) {
     return readKeyFile(keyFilePath);
   }
   return generateKeyFile(keyFilePath);
@@ -695,7 +1139,19 @@ function validateLogging(raw) {
   if (typeof l["file"] === "string" && l["file"].length > 0) out.file = l["file"];
   return out.level !== void 0 || out.format !== void 0 || out.file !== void 0 ? out : void 0;
 }
-var VALID_FORMATS = ["openai", "anthropic", "gemini"];
+var VALID_FORMATS = [
+  "openai",
+  "anthropic",
+  "gemini",
+  "openai-response"
+];
+var FORMAT_AXIS_TRANSFORMERS = [
+  "openai",
+  "anthropic",
+  "gemini",
+  "openai-response",
+  "gemini-code-assist"
+];
 function validateApiKeys(raw) {
   if (!Array.isArray(raw)) return void 0;
   const out = [];
@@ -800,6 +1256,33 @@ function validateApiModes(raw) {
   }
   return out.length > 0 ? out : void 0;
 }
+function transformerEntryName(entry) {
+  return typeof entry === "string" ? entry : entry[0];
+}
+function migrateFormatAxis(apiFormat, transformer) {
+  const use = transformer?.use;
+  if (!use || use.length === 0) return { apiFormat, transformer };
+  const hasFormatEntry = use.some((e) => FORMAT_AXIS_TRANSFORMERS.includes(transformerEntryName(e)));
+  if (!hasFormatEntry) return { apiFormat, transformer };
+  let migratedFormat = apiFormat;
+  if (apiFormat === "openai") {
+    const promoted = use.map(transformerEntryName).find((n) => VALID_FORMATS.includes(n));
+    if (promoted) migratedFormat = promoted;
+  }
+  const rest = use.filter((e) => !FORMAT_AXIS_TRANSFORMERS.includes(transformerEntryName(e)));
+  const next = {};
+  let kept = false;
+  if (rest.length > 0) {
+    next.use = rest;
+    kept = true;
+  }
+  for (const key of Object.keys(transformer)) {
+    if (key === "use") continue;
+    next[key] = transformer[key];
+    kept = true;
+  }
+  return { apiFormat: migratedFormat, transformer: kept ? next : void 0 };
+}
 function validateProvider(raw, index) {
   if (!raw || typeof raw !== "object") {
     throw new Error(`config: providers[${index}] is not an object`);
@@ -830,10 +1313,14 @@ function validateProvider(raw, index) {
   const apiVersion = typeof p["apiVersion"] === "string" && p["apiVersion"].length > 0 ? p["apiVersion"] : void 0;
   const maxConcurrency = typeof p["maxConcurrency"] === "number" && Number.isFinite(p["maxConcurrency"]) ? p["maxConcurrency"] : void 0;
   const modelsEndpoint = typeof p["modelsEndpoint"] === "string" && p["modelsEndpoint"].length > 0 ? p["modelsEndpoint"] : void 0;
+  const { apiFormat: migratedFormat, transformer: migratedTransformer } = migrateFormatAxis(
+    apiFormat,
+    validateTransformer(p["transformer"])
+  );
   return {
     id,
     name,
-    apiFormat,
+    apiFormat: migratedFormat,
     baseUrl,
     apiKey,
     models: Array.isArray(models) ? models.filter((m) => typeof m === "string") : void 0,
@@ -847,7 +1334,9 @@ function validateProvider(raw, index) {
     modelsEndpoint,
     // Provider transformer config (app-parity child 5): load-guard, collapse-to-
     // undefined; non-secret; ENFORCED via resolveTransformerChain (parity-2 child 2).
-    transformer: validateTransformer(p["transformer"]),
+    // Format-axis entries are stripped by `migrateFormatAxis` — `use[]` is the
+    // MODIFIER axis only.
+    transformer: migratedTransformer,
     // Coding-plan endpoint (app-parity-2 child 3): load-guard, collapse-to-undefined.
     // SECRET-bearing (apiKey encrypted at rest); enforced by core's resolveProviderEndpoint.
     codingPlan: validateCodingPlan(p["codingPlan"]),
@@ -879,7 +1368,7 @@ function setSecretBox(box) {
 function loadConfig(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs2.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs3.readFileSync)(path2, "utf8");
   } catch {
     throw new Error(`config: cannot read file at '${path2}'`);
   }
@@ -894,7 +1383,7 @@ function loadConfig(path2) {
 }
 function saveConfig(path2, cfg) {
   const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
-  (0, import_node_fs2.writeFileSync)(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
+  (0, import_node_fs3.writeFileSync)(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
 }
 
 // src/pool/resolveEnvKey.ts
@@ -906,6 +1395,698 @@ function resolveEnvKey(rawKey) {
   return rawKey;
 }
 
+// src/integrations/IntegrationManager.ts
+var import_node_crypto5 = require("crypto");
+var import_node_fs5 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path4 = require("path");
+var import_core = require("@omnicross/core");
+
+// src/integrations/IntegrationStateStore.ts
+var import_node_fs4 = require("fs");
+var import_node_path3 = require("path");
+var EMPTY_STATE = { version: 1, clients: {} };
+var IntegrationStateStore = class {
+  constructor(path2, box) {
+    this.path = path2;
+    this.box = box;
+  }
+  path;
+  box;
+  load() {
+    if (!(0, import_node_fs4.existsSync)(this.path)) return { ...EMPTY_STATE, clients: {} };
+    let raw;
+    try {
+      raw = JSON.parse((0, import_node_fs4.readFileSync)(this.path, "utf8"));
+    } catch {
+      throw new Error(`integration state '${this.path}' is not valid JSON`);
+    }
+    if (!isState(raw)) {
+      throw new Error(`integration state '${this.path}' has an unsupported shape`);
+    }
+    return {
+      version: 1,
+      gatewayKey: raw.gatewayKey ? { ...raw.gatewayKey, secret: this.box.decryptMaybe(raw.gatewayKey.secret) } : void 0,
+      clients: decryptClients(raw.clients, this.box)
+    };
+  }
+  save(state) {
+    const encrypted = {
+      version: 1,
+      gatewayKey: state.gatewayKey ? { ...state.gatewayKey, secret: this.box.encrypt(state.gatewayKey.secret) } : void 0,
+      clients: encryptClients(state.clients, this.box)
+    };
+    atomicWrite(this.path, JSON.stringify(encrypted, null, 2) + "\n");
+  }
+};
+function transformClients(clients, transform) {
+  const out = {};
+  for (const client of ["codex", "claude"]) {
+    const row = clients[client];
+    if (row) {
+      out[client] = {
+        ...row,
+        originalContent: transform(row.originalContent),
+        credentialFile: row.credentialFile ? { ...row.credentialFile, originalContent: transform(row.credentialFile.originalContent) } : void 0
+      };
+    }
+  }
+  return out;
+}
+function decryptClients(clients, box) {
+  return transformClients(clients, (value) => box.decryptMaybe(value));
+}
+function encryptClients(clients, box) {
+  return transformClients(clients, (value) => box.encrypt(value));
+}
+function isState(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  if (row.version !== 1 || !row.clients || typeof row.clients !== "object") return false;
+  if (row.gatewayKey !== void 0) {
+    const key = row.gatewayKey;
+    if (!key || typeof key !== "object" || typeof key.id !== "string" || typeof key.secret !== "string" || typeof key.createdAt !== "number") return false;
+  }
+  for (const client of ["codex", "claude"]) {
+    const candidate = row.clients[client];
+    if (candidate === void 0) continue;
+    if (!isInstallRecord(candidate, client)) return false;
+  }
+  return true;
+}
+function isInstallRecord(value, client) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return row.client === client && typeof row.configPath === "string" && typeof row.originalExisted === "boolean" && typeof row.originalContent === "string" && typeof row.originalHash === "string" && typeof row.installedHash === "string" && typeof row.installedAt === "number" && typeof row.gatewayBaseUrl === "string" && (row.credentialFile === void 0 || isManagedFileRecord(row.credentialFile));
+}
+function isManagedFileRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return typeof row.path === "string" && typeof row.originalExisted === "boolean" && typeof row.originalContent === "string" && typeof row.originalHash === "string" && typeof row.installedHash === "string";
+}
+function atomicWrite(path2, content) {
+  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
+  const temp = `${path2}.tmp-${process.pid}-${Date.now()}`;
+  (0, import_node_fs4.writeFileSync)(temp, content, { encoding: "utf8", mode: 384 });
+  try {
+    (0, import_node_fs4.renameSync)(temp, path2);
+  } catch (error) {
+    try {
+      (0, import_node_fs4.unlinkSync)(temp);
+    } catch {
+    }
+    throw error;
+  } finally {
+    if ((0, import_node_fs4.existsSync)(path2)) {
+      try {
+        (0, import_node_fs4.chmodSync)(path2, 384);
+      } catch {
+      }
+    }
+  }
+}
+
+// src/integrations/configAdapters.ts
+var CODEX_BEGIN = "# >>> omnicross managed provider >>>";
+var CODEX_END = "# <<< omnicross managed provider <<<";
+var CODEX_PROVIDER = "omnicross";
+var CLAUDE_API_KEY_SENTINEL = "omnicross-gateway";
+function renderCodexConfig(input) {
+  if (input.existing.includes(CODEX_BEGIN) || input.existing.includes(CODEX_END)) {
+    throw new Error("Codex config contains an unmanaged/orphaned Omnicross marker");
+  }
+  if (/^\s*\[\s*model_providers\s*\.\s*["']?omnicross["']?\s*]/m.test(input.existing)) {
+    throw new Error("Codex config already defines model_providers.omnicross");
+  }
+  const eol = input.existing.includes("\r\n") ? "\r\n" : "\n";
+  const lines = input.existing.replace(/\r\n/g, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+  const rootEnd = firstTable < 0 ? lines.length : firstTable;
+  const assignments = {
+    model_provider: [],
+    preferred_auth_method: []
+  };
+  for (let index = 0; index < rootEnd; index += 1) {
+    if (/^\s*#/.test(lines[index])) continue;
+    for (const key of Object.keys(assignments)) {
+      if (new RegExp(`^\\s*${key}\\s*=`).test(lines[index])) assignments[key].push(index);
+    }
+  }
+  if (assignments.model_provider.length > 1) {
+    throw new Error("Codex config has duplicate top-level model_provider keys");
+  }
+  if (assignments.preferred_auth_method.length > 1) {
+    throw new Error("Codex config has duplicate top-level preferred_auth_method keys");
+  }
+  const managedRoot = {
+    model_provider: `model_provider = "${CODEX_PROVIDER}" # managed by Omnicross`,
+    preferred_auth_method: 'preferred_auth_method = "apikey" # managed by Omnicross'
+  };
+  const missing = [];
+  for (const key of Object.keys(assignments)) {
+    const [index] = assignments[key];
+    if (index === void 0) missing.push(managedRoot[key]);
+    else lines[index] = managedRoot[key];
+  }
+  if (missing.length > 0) lines.splice(rootEnd, 0, ...missing, "");
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const base = lines.length > 0 ? `${lines.join("\n")}
+
+` : "";
+  const root = trimTrailingSlash(input.gatewayBaseUrl);
+  const block = [
+    CODEX_BEGIN,
+    `[model_providers.${CODEX_PROVIDER}]`,
+    'name = "Omnicross Local Gateway"',
+    `base_url = ${tomlString(`${root}/v1`)}`,
+    'wire_api = "responses"',
+    "requires_openai_auth = true",
+    "supports_websockets = false",
+    CODEX_END,
+    ""
+  ].join("\n");
+  return (base + block).replace(/\n/g, eol);
+}
+function renderCodexAuth(secret) {
+  return JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: secret }, null, 2) + "\n";
+}
+function renderClaudeSettings(existing, gatewayBaseUrl, secret) {
+  let parsed = {};
+  if (existing.trim()) {
+    try {
+      parsed = JSON.parse(existing);
+    } catch {
+      throw new Error("Claude settings file is not valid JSON");
+    }
+  }
+  if (!isPlainObject(parsed)) throw new Error("Claude settings root must be a JSON object");
+  const settings = { ...parsed };
+  const oldEnv = settings.env;
+  if (oldEnv !== void 0 && !isPlainObject(oldEnv)) {
+    throw new Error("Claude settings env field must be a JSON object");
+  }
+  settings.env = {
+    ...oldEnv,
+    ANTHROPIC_BASE_URL: trimTrailingSlash(gatewayBaseUrl),
+    ANTHROPIC_AUTH_TOKEN: secret,
+    ANTHROPIC_API_KEY: CLAUDE_API_KEY_SENTINEL
+  };
+  return JSON.stringify(settings, null, 2) + "\n";
+}
+function restoreCodexBase(current, original) {
+  const hasBegin = current.includes(CODEX_BEGIN);
+  const hasEnd = current.includes(CODEX_END);
+  if (hasBegin !== hasEnd) throw new Error("Codex config has an incomplete Omnicross managed block");
+  const eol = current.includes("\r\n") ? "\r\n" : "\n";
+  let normalized = current.replace(/\r\n/g, "\n");
+  if (hasBegin) {
+    const start = normalized.indexOf(CODEX_BEGIN);
+    const endMarker = normalized.indexOf(CODEX_END, start);
+    if (endMarker < 0) throw new Error("Codex config has an incomplete Omnicross managed block");
+    const end = normalized.indexOf("\n", endMarker);
+    normalized = normalized.slice(0, start) + (end < 0 ? "" : normalized.slice(end + 1));
+  }
+  const lines = normalized.split("\n");
+  for (const key of ["model_provider", "preferred_auth_method"]) {
+    const originalAssignment = rootAssignment(original, key);
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+    const rootEnd = firstTable < 0 ? lines.length : firstTable;
+    const managedIndex = lines.slice(0, rootEnd).findIndex(
+      (line) => new RegExp(`^\\s*${key}\\s*=.*#\\s*managed by Omnicross\\s*$`).test(line)
+    );
+    if (managedIndex >= 0) {
+      if (originalAssignment) lines[managedIndex] = originalAssignment;
+      else lines.splice(managedIndex, 1);
+    }
+  }
+  return lines.join("\n").replace(/\n/g, eol);
+}
+function restoreClaudeBase(current, original, gatewayBaseUrl, secret) {
+  const currentRoot = parseSettings(current);
+  const originalRoot = parseSettings(original);
+  const env = isPlainObject(currentRoot.env) ? { ...currentRoot.env } : {};
+  const originalEnv = isPlainObject(originalRoot.env) ? originalRoot.env : {};
+  const expected = {
+    ANTHROPIC_BASE_URL: trimTrailingSlash(gatewayBaseUrl),
+    ANTHROPIC_AUTH_TOKEN: secret,
+    ANTHROPIC_API_KEY: CLAUDE_API_KEY_SENTINEL
+  };
+  for (const [key, value] of Object.entries(expected)) {
+    if (env[key] !== value) continue;
+    if (Object.prototype.hasOwnProperty.call(originalEnv, key)) env[key] = originalEnv[key];
+    else delete env[key];
+  }
+  const next = { ...currentRoot };
+  if (Object.keys(env).length > 0 || Object.prototype.hasOwnProperty.call(originalRoot, "env")) next.env = env;
+  else delete next.env;
+  return JSON.stringify(next, null, 2) + "\n";
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseSettings(value) {
+  if (!value.trim()) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Claude settings file is not valid JSON");
+  }
+  if (!isPlainObject(parsed)) throw new Error("Claude settings root must be a JSON object");
+  return parsed;
+}
+function rootAssignment(content, key) {
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+  const root = lines.slice(0, firstTable < 0 ? lines.length : firstTable);
+  return root.find((line) => new RegExp(`^\\s*${key}\\s*=`).test(line) && !/^\s*#/.test(line));
+}
+
+// src/integrations/IntegrationManager.ts
+var IntegrationConflictError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IntegrationConflictError";
+  }
+};
+var IntegrationManager = class {
+  constructor(options) {
+    this.options = options;
+    assertLoopbackGatewayUrl(options.gatewayBaseUrl);
+    this.homeDir = options.homeDir ?? (0, import_node_os2.homedir)();
+  }
+  options;
+  homeDir;
+  async listStatus() {
+    const state = this.options.stateStore.load();
+    const keyUsable = await this.isKeyUsable(state);
+    return ["codex", "claude"].map((client) => this.statusFor(client, state, keyUsable));
+  }
+  async plan(client, configPath = this.defaultConfigPath(client)) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    const target = record?.configPath ?? (0, import_node_path4.resolve)(configPath);
+    const status = this.statusFor(client, state, await this.isKeyUsable(state));
+    const changes = client === "codex" ? [
+      "model_provider",
+      "preferred_auth_method",
+      "model_providers.omnicross",
+      "auth.json.auth_mode",
+      "auth.json.OPENAI_API_KEY"
+    ] : ["env.ANTHROPIC_BASE_URL", "env.ANTHROPIC_AUTH_TOKEN", "env.ANTHROPIC_API_KEY"];
+    if (!record) return { client, configPath: target, action: "install", canApply: true, changes, warnings: [] };
+    if (status.status === "enabled") {
+      return { client, configPath: target, action: "none", canApply: true, changes: [], warnings: [] };
+    }
+    return {
+      client,
+      configPath: target,
+      action: "repair",
+      canApply: true,
+      changes,
+      warnings: ["Configuration changed after installation; repair preserves unrelated current settings."]
+    };
+  }
+  async install(client, configPath = this.defaultConfigPath(client)) {
+    const target = (0, import_node_path4.resolve)(configPath);
+    const state = this.options.stateStore.load();
+    const existingRecord = state.clients[client];
+    if (existingRecord) {
+      const status = this.statusFor(client, state, await this.isKeyUsable(state));
+      if (status.status === "enabled") return status;
+      throw new IntegrationConflictError(
+        `${client} integration configuration has drifted; restore or remove it before reinstalling`
+      );
+    }
+    const key = await this.ensureGatewayKey(state);
+    const original = readOptional(target);
+    const originalContent = original ?? "";
+    const installed = this.renderInstalled(client, originalContent, key.secret);
+    const credentialPath = client === "codex" ? this.codexAuthPathForConfig(target) : void 0;
+    const originalCredential = credentialPath ? readOptional(credentialPath) : null;
+    const installedCredential = credentialPath ? renderCodexAuth(key.secret) : void 0;
+    const record = {
+      client,
+      configPath: target,
+      originalExisted: original !== null,
+      originalContent,
+      originalHash: sha256(originalContent),
+      installedHash: sha256(installed),
+      installedAt: Date.now(),
+      gatewayBaseUrl: this.options.gatewayBaseUrl,
+      credentialFile: credentialPath && installedCredential ? managedFileRecord(credentialPath, originalCredential, installedCredential) : void 0
+    };
+    const prior = state.clients[client];
+    state.clients[client] = record;
+    this.options.stateStore.save(state);
+    try {
+      applyFileChangesWithRollback([
+        { path: target, content: installed },
+        ...credentialPath && installedCredential ? [{ path: credentialPath, content: installedCredential }] : []
+      ]);
+    } catch (error) {
+      if (prior) state.clients[client] = prior;
+      else delete state.clients[client];
+      this.options.stateStore.save(state);
+      throw error;
+    }
+    return this.statusFor(client, state, true);
+  }
+  async repair(client) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    if (!record) return this.install(client);
+    const previouslyInstalledSecret = state.gatewayKey?.secret;
+    const currentFile = readOptional(record.configPath);
+    if (client === "claude" && currentFile !== null && !previouslyInstalledSecret) {
+      throw new IntegrationConflictError(
+        "Claude integration key state is missing; refusing to repair an ambiguous settings file"
+      );
+    }
+    const key = await this.ensureGatewayKey(state);
+    const current = currentFile ?? record.originalContent;
+    const base = client === "codex" ? restoreCodexBase(current, record.originalContent) : restoreClaudeBase(
+      current,
+      record.originalContent,
+      record.gatewayBaseUrl,
+      previouslyInstalledSecret ?? key.secret
+    );
+    const installed = this.renderInstalled(client, base, key.secret);
+    const credentialPath = client === "codex" ? record.credentialFile?.path ?? this.codexAuthPathForConfig(record.configPath) : void 0;
+    const currentCredential = credentialPath ? readOptional(credentialPath) : null;
+    const originalCredential = record.credentialFile ? originalSnapshotForRepair(record.credentialFile, currentCredential) : currentCredential;
+    const installedCredential = credentialPath ? renderCodexAuth(key.secret) : void 0;
+    const prior = {
+      ...record,
+      credentialFile: record.credentialFile ? { ...record.credentialFile } : void 0
+    };
+    Object.assign(record, {
+      originalExisted: currentFile !== null || record.originalExisted,
+      originalContent: base,
+      originalHash: sha256(base),
+      installedHash: sha256(installed),
+      installedAt: Date.now(),
+      gatewayBaseUrl: this.options.gatewayBaseUrl,
+      credentialFile: credentialPath && installedCredential ? managedFileRecord(credentialPath, originalCredential, installedCredential) : void 0
+    });
+    this.options.stateStore.save(state);
+    try {
+      applyFileChangesWithRollback([
+        { path: record.configPath, content: installed },
+        ...credentialPath && installedCredential ? [{ path: credentialPath, content: installedCredential }] : []
+      ]);
+    } catch (error) {
+      state.clients[client] = prior;
+      this.options.stateStore.save(state);
+      throw error;
+    }
+    return this.statusFor(client, state, true);
+  }
+  async remove(client) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    if (!record) return this.statusFor(client, state, await this.isKeyUsable(state));
+    const files = [primaryManagedFile(record), ...record.credentialFile ? [record.credentialFile] : []];
+    const currentFiles = files.map((file) => ({ file, current: readOptional(file.path) }));
+    const dispositions = currentFiles.map(({ file, current }) => managedFileDisposition(file, current));
+    if (dispositions.some((disposition) => disposition !== "installed" && disposition !== "restored")) {
+      throw new IntegrationConflictError(
+        `${client} configuration changed after Omnicross installed it; refusing to overwrite user edits`
+      );
+    }
+    const changes = currentFiles.flatMap(({ file }, index) => dispositions[index] === "installed" ? [{ path: file.path, content: file.originalExisted ? file.originalContent : null }] : []);
+    applyFileChangesWithRollback(changes);
+    delete state.clients[client];
+    this.options.stateStore.save(state);
+    return this.statusFor(client, state, await this.isKeyUsable(state));
+  }
+  async rotateGatewayKey() {
+    const state = this.options.stateStore.load();
+    const previousGatewayKey = state.gatewayKey;
+    const oldKeyId = state.gatewayKey?.id;
+    const claude = state.clients.claude;
+    const codex = state.clients.codex;
+    let nextClaude;
+    let nextCodexAuth;
+    if (claude) {
+      const current = readOptional(claude.configPath);
+      if (current === null || sha256(current) !== claude.installedHash) {
+        throw new IntegrationConflictError("Claude configuration drift must be resolved before key rotation");
+      }
+    }
+    if (codex) {
+      const current = readOptional(codex.configPath);
+      if (current === null || sha256(current) !== codex.installedHash) {
+        throw new IntegrationConflictError("Codex configuration drift must be resolved before key rotation");
+      }
+      if (!codex.credentialFile) {
+        throw new IntegrationConflictError("Codex integration must be repaired before key rotation");
+      }
+      const currentAuth = readOptional(codex.credentialFile.path);
+      if (currentAuth === null || sha256(currentAuth) !== codex.credentialFile.installedHash) {
+        throw new IntegrationConflictError("Codex credential drift must be resolved before key rotation");
+      }
+    }
+    const created = await (0, import_core.createIntegrationKey)(this.options.keyDb, "Omnicross native CLI integration");
+    const nextGatewayKey = {
+      id: created.id,
+      secret: created.plaintextOnce,
+      createdAt: created.createdAt
+    };
+    state.gatewayKey = nextGatewayKey;
+    const previousClaudeHash = claude?.installedHash;
+    const previousCodexAuthHash = codex?.credentialFile?.installedHash;
+    if (claude) {
+      const current = readOptional(claude.configPath) ?? "{}";
+      nextClaude = renderClaudeSettings(current, this.options.gatewayBaseUrl, created.plaintextOnce);
+      claude.installedHash = sha256(nextClaude);
+    }
+    if (codex?.credentialFile) {
+      nextCodexAuth = renderCodexAuth(created.plaintextOnce);
+      codex.credentialFile.installedHash = sha256(nextCodexAuth);
+    }
+    try {
+      this.options.stateStore.save(state);
+      applyFileChangesWithRollback([
+        ...codex?.credentialFile && nextCodexAuth !== void 0 ? [{ path: codex.credentialFile.path, content: nextCodexAuth }] : [],
+        ...claude && nextClaude !== void 0 ? [{ path: claude.configPath, content: nextClaude }] : []
+      ]);
+    } catch (error) {
+      state.gatewayKey = previousGatewayKey;
+      if (claude && previousClaudeHash !== void 0) claude.installedHash = previousClaudeHash;
+      if (codex?.credentialFile && previousCodexAuthHash !== void 0) {
+        codex.credentialFile.installedHash = previousCodexAuthHash;
+      }
+      try {
+        this.options.stateStore.save(state);
+      } finally {
+        await this.options.keyDb.outboundApiKeysRevoke(created.id);
+      }
+      throw error;
+    }
+    if (oldKeyId && oldKeyId !== created.id) await this.options.keyDb.outboundApiKeysRevoke(oldKeyId);
+    return { keyId: created.id };
+  }
+  async getGatewayToken() {
+    const state = this.options.stateStore.load();
+    if (!state.gatewayKey || !await this.isKeyUsable(state)) {
+      throw new Error("Omnicross integration key is missing or revoked; reinstall the CLI integration");
+    }
+    return state.gatewayKey.secret;
+  }
+  async ensureGatewayKey(state) {
+    if (state.gatewayKey && await this.isKeyUsable(state)) return state.gatewayKey;
+    const created = await (0, import_core.createIntegrationKey)(this.options.keyDb, "Omnicross native CLI integration");
+    const previousGatewayKey = state.gatewayKey;
+    const nextGatewayKey = {
+      id: created.id,
+      secret: created.plaintextOnce,
+      createdAt: created.createdAt
+    };
+    state.gatewayKey = nextGatewayKey;
+    try {
+      this.options.stateStore.save(state);
+      return nextGatewayKey;
+    } catch (error) {
+      state.gatewayKey = previousGatewayKey;
+      try {
+        await this.options.keyDb.outboundApiKeysRevoke(created.id);
+      } catch {
+      }
+      throw error;
+    }
+  }
+  async isKeyUsable(state) {
+    if (!state.gatewayKey) return false;
+    const rows = await this.options.keyDb.outboundApiKeysList();
+    return rows.some((row) => row.id === state.gatewayKey?.id && row.enabled && row.revokedAt === null && row.kind === "integration");
+  }
+  statusFor(client, state, keyUsable) {
+    const record = state.clients[client];
+    if (!record) return { client, status: "not-installed", configPath: this.defaultConfigPath(client) };
+    const current = readOptional(record.configPath);
+    if (current === null) {
+      return {
+        client,
+        status: "configuration-missing",
+        configPath: record.configPath,
+        installedAt: record.installedAt,
+        gatewayBaseUrl: record.gatewayBaseUrl
+      };
+    }
+    if (sha256(current) !== record.installedHash) {
+      return {
+        client,
+        status: "configuration-drift",
+        configPath: record.configPath,
+        installedAt: record.installedAt,
+        gatewayBaseUrl: record.gatewayBaseUrl
+      };
+    }
+    if (client === "codex") {
+      if (!record.credentialFile) {
+        return {
+          client,
+          status: "configuration-drift",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex integration uses a legacy authentication layout and must be repaired."
+        };
+      }
+      const credential = readOptional(record.credentialFile.path);
+      if (credential === null) {
+        return {
+          client,
+          status: "configuration-missing",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex auth.json is missing."
+        };
+      }
+      if (sha256(credential) !== record.credentialFile.installedHash) {
+        return {
+          client,
+          status: "configuration-drift",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex auth.json changed after installation."
+        };
+      }
+    }
+    return {
+      client,
+      status: keyUsable ? "enabled" : "key-missing",
+      configPath: record.configPath,
+      installedAt: record.installedAt,
+      gatewayBaseUrl: record.gatewayBaseUrl
+    };
+  }
+  defaultConfigPath(client) {
+    return client === "codex" ? (0, import_node_path4.join)(this.homeDir, ".codex", "config.toml") : (0, import_node_path4.join)(this.homeDir, ".claude", "settings.json");
+  }
+  codexAuthPathForConfig(configPath) {
+    return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "auth.json");
+  }
+  renderInstalled(client, base, secret) {
+    if (client === "claude") {
+      return renderClaudeSettings(base, this.options.gatewayBaseUrl, secret);
+    }
+    return renderCodexConfig({
+      existing: base,
+      gatewayBaseUrl: this.options.gatewayBaseUrl
+    });
+  }
+};
+function readOptional(path2) {
+  return (0, import_node_fs5.existsSync)(path2) ? (0, import_node_fs5.readFileSync)(path2, "utf8") : null;
+}
+function sha256(value) {
+  return (0, import_node_crypto5.createHash)("sha256").update(value, "utf8").digest("hex");
+}
+function managedFileRecord(path2, original, installed) {
+  const originalContent = original ?? "";
+  return {
+    path: path2,
+    originalExisted: original !== null,
+    originalContent,
+    originalHash: sha256(originalContent),
+    installedHash: sha256(installed)
+  };
+}
+function primaryManagedFile(record) {
+  return {
+    path: record.configPath,
+    originalExisted: record.originalExisted,
+    originalContent: record.originalContent,
+    originalHash: record.originalHash,
+    installedHash: record.installedHash
+  };
+}
+function managedFileDisposition(record, current) {
+  if (current !== null && sha256(current) === record.installedHash) return "installed";
+  const matchesOriginalExistence = record.originalExisted ? current !== null : current === null;
+  if (matchesOriginalExistence && sha256(current ?? "") === record.originalHash) return "restored";
+  return current === null ? "missing" : "drift";
+}
+function originalSnapshotForRepair(record, current) {
+  const disposition = managedFileDisposition(record, current);
+  if (disposition === "installed" || disposition === "restored") {
+    return record.originalExisted ? record.originalContent : null;
+  }
+  return current;
+}
+function applyFileChangesWithRollback(changes) {
+  if (changes.length === 0) return;
+  const snapshots = changes.map((change) => ({ path: change.path, content: readOptional(change.path) }));
+  try {
+    for (const change of changes) writeOptional(change.path, change.content);
+  } catch (error) {
+    const rollbackFailures = [];
+    for (const snapshot of [...snapshots].reverse()) {
+      try {
+        writeOptional(snapshot.path, snapshot.content);
+      } catch {
+        rollbackFailures.push(snapshot.path);
+      }
+    }
+    if (rollbackFailures.length > 0) {
+      throw new IntegrationConflictError(
+        `CLI integration update failed and rollback could not restore: ${rollbackFailures.join(", ")}`
+      );
+    }
+    throw error;
+  }
+}
+function writeOptional(path2, content) {
+  if (content !== null) {
+    atomicWrite(path2, content);
+    return;
+  }
+  if ((0, import_node_fs5.existsSync)(path2)) (0, import_node_fs5.unlinkSync)(path2);
+}
+function assertLoopbackGatewayUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("gatewayBaseUrl must be a valid loopback URL");
+  }
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const literalLoopback = host === "::1" || /^127(?:\.\d{1,3}){3}$/.test(host);
+  if (url.protocol !== "http:" || !literalLoopback || url.username || url.password || url.search || url.hash) {
+    throw new Error("native CLI integrations require an unauthenticated literal HTTP loopback gateway URL");
+  }
+}
+
 // src/preset-catalog.ts
 var presetsModule = __toESM(require("@omnicross/contracts/provider-presets"), 1);
 function normalizeCatalogModule(m) {
@@ -926,14 +2107,13 @@ function getCatalog() {
 
 // src/preset-map.ts
 var EXCLUSION_REASONS = {
-  "openai-response": "daemon rows have no openai-response format; the Responses API needs a transformer chain that a BYO daemon provider row cannot express.",
   "azure-openai": "Azure needs an apiVersion + a deployment-name-as-model URL template + an empty baseUrl; a daemon provider row cannot express that shape."
 };
 var FORMAT_MAP = {
   openai: "openai",
   anthropic: "anthropic",
   google: "gemini",
-  "openai-response": null,
+  "openai-response": "openai-response",
   "azure-openai": null
 };
 function resolveFormat(raw) {
@@ -1054,11 +2234,11 @@ function preserveOutboundProxySecrets(incoming, current) {
 }
 
 // src/proxy/upstreamProxyResolver.ts
-var import_upstreamFetch = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch2 = require("@omnicross/core/pipeline/upstreamFetch");
 var serverProxy;
 function setServerProxyConfig(proxy) {
   serverProxy = proxy;
-  (0, import_upstreamFetch.bumpUpstreamProxyGeneration)();
+  (0, import_upstreamFetch2.bumpUpstreamProxyGeneration)();
 }
 function getServerProxyConfig() {
   return serverProxy;
@@ -1138,6 +2318,67 @@ var VALID_PROVIDER_IDS = [
 function asSubscriptionProviderId(id) {
   return VALID_PROVIDER_IDS.includes(id) ? id : null;
 }
+var ACCOUNT_PATCH_KEYS = /* @__PURE__ */ new Set(["label", "enabled", "priority", "group", "tags"]);
+function validateAccountMetadataPatch(body) {
+  const keys = Object.keys(body);
+  if (keys.length === 0 || keys.some((key) => !ACCOUNT_PATCH_KEYS.has(key))) return null;
+  const patch = {};
+  if ("label" in body) {
+    if (typeof body["label"] !== "string" || body["label"].trim().length > 120) return null;
+    patch.label = body["label"].trim();
+  }
+  if ("enabled" in body) {
+    if (typeof body["enabled"] !== "boolean") return null;
+    patch.enabled = body["enabled"];
+  }
+  if ("priority" in body) {
+    const priority = body["priority"];
+    if (typeof priority !== "number" || !Number.isFinite(priority) || priority < -1e4 || priority > 1e4) return null;
+    patch.priority = priority;
+  }
+  if ("group" in body) {
+    const group = body["group"];
+    if (group !== null && typeof group !== "string") return null;
+    const normalized = typeof group === "string" ? group.trim() : null;
+    if (normalized !== null && normalized.length > 80) return null;
+    patch.group = normalized || null;
+  }
+  if ("tags" in body) {
+    const tags = body["tags"];
+    if (!Array.isArray(tags) || tags.length > 20) return null;
+    const normalized = tags.map((tag) => typeof tag === "string" ? tag.trim() : "");
+    if (normalized.some((tag) => !tag || tag.length > 40)) return null;
+    patch.tags = [...new Set(normalized)];
+  }
+  return patch;
+}
+function validateAccountBatchBody(body) {
+  const action = body["action"];
+  const rawAccounts = body["accounts"];
+  if (!Array.isArray(rawAccounts) || rawAccounts.length < 1 || rawAccounts.length > 100) return null;
+  if (action !== "enable" && action !== "disable" && action !== "set-group" && action !== "delete") return null;
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of rawAccounts) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const row = raw;
+    const providerId = typeof row["providerId"] === "string" ? asSubscriptionProviderId(row["providerId"]) : null;
+    const accountId = typeof row["accountId"] === "string" ? row["accountId"].trim() : "";
+    if (!providerId || !accountId || accountId.length > 200) return null;
+    const key = `${providerId}\0${accountId}`;
+    if (seen.has(key)) return null;
+    seen.add(key);
+    refs.push({ providerId, accountId });
+  }
+  if (action === "set-group") {
+    const group = body["group"];
+    if (group !== null && typeof group !== "string") return null;
+    const normalized = typeof group === "string" ? group.trim() : null;
+    if (normalized !== null && normalized.length > 80) return null;
+    return { refs, mutation: { action, group: normalized || null } };
+  }
+  return { refs, mutation: { action } };
+}
 var CLAUDE_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "setup_token", "manual"]);
 var OAUTH_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "manual"]);
 var TOKEN_STATUSES = /* @__PURE__ */ new Set([
@@ -1349,9 +2590,9 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 
 // src/admin/cliLaunch.ts
 var import_node_child_process = require("child_process");
-var import_node_crypto4 = require("crypto");
-var import_node_fs3 = require("fs");
-var import_node_path2 = require("path");
+var import_node_crypto6 = require("crypto");
+var import_node_fs6 = require("fs");
+var import_node_path5 = require("path");
 var import_cli_launcher = require("@omnicross/cli-launcher");
 var LAUNCHABLE_CLIS = [
   { id: "claude", displayName: "Claude Code", command: "claude" },
@@ -1374,10 +2615,10 @@ function isLaunchCliId(id) {
   return id !== void 0 && LAUNCHABLE_IDS.has(id);
 }
 function probeDefault(candidate) {
-  const segments = (process.env["PATH"] ?? "").split(import_node_path2.delimiter).filter(Boolean);
+  const segments = (process.env["PATH"] ?? "").split(import_node_path5.delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = (0, import_node_path2.join)(seg, candidate);
-    if ((0, import_node_fs3.existsSync)(full)) return full;
+    const full = (0, import_node_path5.join)(seg, candidate);
+    if ((0, import_node_fs6.existsSync)(full)) return full;
   }
   return null;
 }
@@ -1464,10 +2705,10 @@ var sessions = /* @__PURE__ */ new Map();
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
-var defaultCommandRunner = (command) => new Promise((resolve) => {
+var defaultCommandRunner = (command) => new Promise((resolve2) => {
   (0, import_node_child_process.exec)(command, { timeout: 18e4 }, (err5, _stdout, stderr) => {
-    if (err5) resolve({ ok: false, error: stderr.trim() || err5.message });
-    else resolve({ ok: true });
+    if (err5) resolve2({ ok: false, error: stderr.trim() || err5.message });
+    else resolve2({ ok: true });
   });
 });
 async function handleCliInstall(cli, runner = defaultCommandRunner) {
@@ -1529,7 +2770,7 @@ async function handleCliLaunch(cli, body, ctx) {
     launch.onSessionEnd();
     return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
   }
-  const id = (0, import_node_crypto4.randomUUID)();
+  const id = (0, import_node_crypto6.randomUUID)();
   sessions.set(id, {
     id,
     cli,
@@ -1542,12 +2783,12 @@ async function handleCliLaunch(cli, body, ctx) {
 }
 
 // src/admin/auditConfigBody.ts
-var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateAuditSegment(patch) {
   const errors = [];
   const audit = patch.audit;
   if (audit === void 0) return errors;
-  if (!isPlainObject(audit)) {
+  if (!isPlainObject2(audit)) {
     errors.push("audit must be an object");
     return errors;
   }
@@ -1569,12 +2810,12 @@ function validateAuditSegment(patch) {
 
 // src/admin/billingConfigBody.ts
 var BILLING_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
-var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateBillingSegment(patch) {
   const errors = [];
   const billing = patch.billing;
   if (billing === void 0) return errors;
-  if (!isPlainObject2(billing)) {
+  if (!isPlainObject3(billing)) {
     errors.push("billing must be an object");
     return errors;
   }
@@ -1710,6 +2951,96 @@ function parseKeyPolicyBody(body) {
   return { ok: true, policy };
 }
 
+// src/admin/gatewayBindingBody.ts
+var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
+var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
+var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function nonBlank(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function validateStringArray(value, path2, errors) {
+  if (!Array.isArray(value) || value.some((entry) => !nonBlank(entry))) {
+    errors.push(`${path2} must be an array of non-empty strings`);
+  }
+}
+function validateGatewayBindingsSegment(patch) {
+  if (!Object.prototype.hasOwnProperty.call(patch, "bindings")) return [];
+  const raw = patch.bindings;
+  if (!Array.isArray(raw)) return ["bindings must be an array"];
+  if (raw.length > 1e3) return ["bindings cannot contain more than 1000 entries"];
+  const errors = [];
+  const ids = /* @__PURE__ */ new Set();
+  raw.forEach((entry, index) => {
+    const path2 = `bindings[${index}]`;
+    if (!isRecord(entry)) {
+      errors.push(`${path2} must be an object`);
+      return;
+    }
+    if (!nonBlank(entry.id)) errors.push(`${path2}.id is required`);
+    else if (ids.has(entry.id.trim())) errors.push(`${path2}.id must be unique`);
+    else ids.add(entry.id.trim());
+    if (!nonBlank(entry.name)) errors.push(`${path2}.name is required`);
+    if (typeof entry.enabled !== "boolean") errors.push(`${path2}.enabled must be boolean`);
+    if (!ENDPOINTS.has(String(entry.endpoint))) errors.push(`${path2}.endpoint is invalid`);
+    if (!FALLBACKS.has(String(entry.fallback))) {
+      errors.push(`${path2}.fallback must be next or fail`);
+    }
+    if (entry.priority !== void 0 && (typeof entry.priority !== "number" || !Number.isInteger(entry.priority) || entry.priority < 0 || entry.priority > 1e4)) {
+      errors.push(`${path2}.priority must be an integer from 0 to 10000`);
+    }
+    if (entry.apiKeyIds !== void 0) validateStringArray(entry.apiKeyIds, `${path2}.apiKeyIds`, errors);
+    if (entry.keyScope !== void 0 && entry.keyScope !== "all" && entry.keyScope !== "selected") {
+      errors.push(`${path2}.keyScope must be all or selected`);
+    }
+    if (entry.modelMode !== void 0 && entry.modelMode !== "passthrough" && entry.modelMode !== "mapped") {
+      errors.push(`${path2}.modelMode must be passthrough or mapped`);
+    }
+    if (entry.modelMappings !== void 0) {
+      if (!Array.isArray(entry.modelMappings)) {
+        errors.push(`${path2}.modelMappings must be an array`);
+      } else if (entry.modelMappings.length > 100) {
+        errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
+      } else if (entry.modelMappings.some(
+        (mapping) => !isRecord(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+      )) {
+        errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
+      }
+    }
+    if (!isRecord(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+      errors.push(`${path2}.target is invalid`);
+    } else {
+      if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
+      if (entry.target.kind === "account" && !nonBlank(entry.target.accountId)) {
+        errors.push(`${path2}.target.accountId is required`);
+      }
+      if (entry.target.kind === "account-group" && !nonBlank(entry.target.group)) {
+        errors.push(`${path2}.target.group is required`);
+      }
+      if (entry.target.kind === "provider" && entry.target.keyId !== void 0 && !nonBlank(entry.target.keyId)) {
+        errors.push(`${path2}.target.keyId must be a non-empty string`);
+      }
+    }
+    if (entry.modelMap !== void 0) {
+      if (!isRecord(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+        errors.push(`${path2}.modelMap must contain string values`);
+      }
+    }
+    if (entry.models !== void 0) validateStringArray(entry.models, `${path2}.models`, errors);
+    if (entry.backgroundModelIds !== void 0) {
+      validateStringArray(entry.backgroundModelIds, `${path2}.backgroundModelIds`, errors);
+    }
+    for (const field of ["defaultModel", "backgroundModel"]) {
+      if (entry[field] !== void 0 && typeof entry[field] !== "string") {
+        errors.push(`${path2}.${field} must be a string`);
+      }
+    }
+  });
+  return errors;
+}
+
 // src/admin/voucherAdmin.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
 function writeJson(res, status, body) {
@@ -1720,15 +3051,15 @@ function writeErr(res, status, message) {
   writeJson(res, status, { error: { type: "voucher_error", message } });
 }
 function readJsonBody2(req) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw.trim()) return resolve({});
+      if (!raw.trim()) return resolve2({});
       try {
         const parsed = JSON.parse(raw);
-        resolve(parsed && typeof parsed === "object" ? parsed : {});
+        resolve2(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
         reject(new Error("invalid-json"));
       }
@@ -1818,12 +3149,12 @@ async function handleVoucher(req, res, method, rest, deps) {
 // src/admin/webhookConfigBody.ts
 var import_webhook_types = require("@omnicross/contracts/webhook-types");
 var WEBHOOK_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
-var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateWebhookSegment(patch) {
   const errors = [];
   const webhook = patch.webhook;
   if (webhook === void 0) return errors;
-  if (!isPlainObject3(webhook)) {
+  if (!isPlainObject4(webhook)) {
     errors.push("webhook must be an object");
     return errors;
   }
@@ -1837,7 +3168,7 @@ function validateWebhookSegment(patch) {
   }
   const seenIds = /* @__PURE__ */ new Set();
   for (const [i, raw] of (Array.isArray(destinations) ? destinations : []).entries()) {
-    if (!isPlainObject3(raw)) {
+    if (!isPlainObject4(raw)) {
       errors.push(`webhook.destinations[${i}] must be an object`);
       continue;
     }
@@ -1903,12 +3234,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+var import_node_path6 = require("path");
 var import_auditSink = require("@omnicross/core/pipeline/auditSink");
+var import_upstreamTrace = require("@omnicross/core/pipeline/upstreamTrace");
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1920,9 +3255,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    (0, import_upstreamTrace.setUpstreamTracePath)(config.captureBodies ? (0, import_node_path6.join)(auditDir, "upstream-trace.jsonl") : null);
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
+    (0, import_upstreamTrace.setUpstreamTracePath)(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1932,9 +3269,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   (0, import_auditSink.setAuditCaptureConfig)(null);
   (0, import_auditSink.setAuditSink)(null);
+  (0, import_upstreamTrace.setUpstreamTracePath)(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -1974,7 +3313,7 @@ function resetBillingRuntimeForTests() {
 }
 
 // src/ports/account-multi.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var PROVIDER_KEYS = {
   claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
   codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
@@ -2040,7 +3379,7 @@ function migrateLazily(config) {
 }
 function addAccount(config, p, tokens, label) {
   const accounts = [...getAccounts(config, p)];
-  const id = (0, import_node_crypto5.randomUUID)();
+  const id = (0, import_node_crypto7.randomUUID)();
   accounts.push({
     id,
     label: label ?? `Account ${accounts.length + 1}`,
@@ -2116,9 +3455,13 @@ function sanitizeAccounts(config, p) {
   const activeId = getActiveId(config, p);
   return accounts.map((a) => {
     const t = a.tokens;
+    const enabled = a.enabled !== false;
     return {
       id: a.id,
       label: a.label,
+      enabled,
+      group: a.group?.trim() || p,
+      tags: a.tags ?? [],
       status: t.status ?? "unconfigured",
       authMethod: t.authMethod,
       subscriptionLevel: t.subscriptionLevel,
@@ -2127,6 +3470,8 @@ function sanitizeAccounts(config, p) {
       isSetupToken: t.isSetupToken,
       hasAccessToken: !!(t.accessToken || t.apiKey),
       isActive: a.id === activeId,
+      schedulable: enabled,
+      errorMessage: sanitizeDiagnosticMessage(t.errorMessage),
       // Scheduling metadata (subscription-account-scheduling): editable priority
       // (default 50 shown when unset) + display-only lastUsedAt. Secret-free.
       priority: a.priority,
@@ -2141,6 +3486,54 @@ function sanitizeAccounts(config, p) {
     };
   });
 }
+function sanitizeDiagnosticMessage(value) {
+  if (!value) return void 0;
+  const lower = value.toLowerCase();
+  if (lower.includes("timeout") || lower.includes("timed out")) return "Credential operation timed out.";
+  if (lower.includes("network") || lower.includes("fetch")) return "Credential network request failed.";
+  if (lower.includes("401") || lower.includes("unauthorized") || lower.includes("revoked")) {
+    return "Credential authorization was rejected.";
+  }
+  return "Credential operation failed.";
+}
+function patchAccountMetadata(config, p, id, patch) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((account) => account.id === id)) return { ok: false };
+  setAccounts(config, p, accounts.map((account) => {
+    if (account.id !== id) return account;
+    const next = { ...account };
+    if (patch.label !== void 0) next.label = patch.label;
+    if (patch.enabled !== void 0) next.enabled = patch.enabled;
+    if (patch.priority !== void 0) next.priority = patch.priority;
+    if (patch.group !== void 0) {
+      if (patch.group === null || patch.group === "") delete next.group;
+      else next.group = patch.group;
+    }
+    if (patch.tags !== void 0) next.tags = patch.tags;
+    return next;
+  }));
+  return { ok: true };
+}
+function batchManageAccounts(config, refs, mutation) {
+  for (const ref of refs) {
+    if (!getAccounts(config, ref.providerId).some((account) => account.id === ref.accountId)) {
+      return { ok: false, missing: ref };
+    }
+  }
+  for (const ref of refs) {
+    if (mutation.action === "delete") {
+      removeAccount(config, ref.providerId, ref.accountId);
+    } else {
+      patchAccountMetadata(
+        config,
+        ref.providerId,
+        ref.accountId,
+        mutation.action === "set-group" ? { group: mutation.group } : { enabled: mutation.action === "enable" }
+      );
+    }
+  }
+  return { ok: true, affected: refs.length };
+}
 function renameAccount(config, p, id, label) {
   const accounts = getAccounts(config, p);
   if (!accounts.some((a) => a.id === id)) return { ok: false };
@@ -2230,7 +3623,7 @@ function clearProvider(config, p) {
 var DAEMON_PROVIDER_KEYS = PROVIDER_KEYS;
 
 // src/migration/packCodec.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var PACK_MAGIC = "OMCXPACK";
 var PACK_VERSION = 1;
 var KDF_ALGORITHM = "scrypt";
@@ -2268,17 +3661,17 @@ function fromB64Url(s) {
   return Buffer.from(s, "base64url").toString("utf8");
 }
 function deriveKey(passphrase, salt, N, r, p) {
-  return (0, import_node_crypto6.scryptSync)(passphrase, salt, KEY_BYTES3, { N, r, p, maxmem: SCRYPT_MAXMEM });
+  return (0, import_node_crypto8.scryptSync)(passphrase, salt, KEY_BYTES3, { N, r, p, maxmem: SCRYPT_MAXMEM });
 }
 function aadFor(magic, version, kdf) {
   return Buffer.from(`${magic}|${version}|${kdf}`, "utf8");
 }
 function sealPack(bundleJson, passphrase) {
   assertPassphraseStrength(passphrase);
-  const salt = (0, import_node_crypto6.randomBytes)(SCRYPT_SALT_BYTES);
-  const iv = (0, import_node_crypto6.randomBytes)(IV_BYTES2);
+  const salt = (0, import_node_crypto8.randomBytes)(SCRYPT_SALT_BYTES);
+  const iv = (0, import_node_crypto8.randomBytes)(IV_BYTES2);
   const key = deriveKey(passphrase, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);
-  const cipher = (0, import_node_crypto6.createCipheriv)("aes-256-gcm", key, iv);
+  const cipher = (0, import_node_crypto8.createCipheriv)("aes-256-gcm", key, iv);
   cipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   const ciphertext = Buffer.concat([cipher.update(bundleJson, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -2326,7 +3719,7 @@ function openPack(packString, passphrase) {
     throw new PackAuthError("migration pack is malformed (invalid iv/tag length)");
   }
   const key = deriveKey(passphrase, salt, header.N, header.r, header.p);
-  const decipher = (0, import_node_crypto6.createDecipheriv)("aes-256-gcm", key, iv);
+  const decipher = (0, import_node_crypto8.createDecipheriv)("aes-256-gcm", key, iv);
   decipher.setAAD(aadFor(PACK_MAGIC, PACK_VERSION, KDF_ALGORITHM));
   decipher.setAuthTag(tag);
   try {
@@ -2478,9 +3871,9 @@ function parseFiniteInt(raw) {
   const n = Number(raw);
   return Number.isFinite(n) && Number.isInteger(n) ? n : null;
 }
-function parseRange(query) {
-  const startTs = parseFiniteInt(query.get("startTs"));
-  const endTs = parseFiniteInt(query.get("endTs"));
+function parseRange(query2) {
+  const startTs = parseFiniteInt(query2.get("startTs"));
+  const endTs = parseFiniteInt(query2.get("endTs"));
   if (startTs === null || endTs === null) {
     return err4(400, "startTs and endTs are required finite-integer unix-millis query params");
   }
@@ -2493,8 +3886,8 @@ var BUCKET_SPAN_MS = {
   month: 28 * 864e5
 };
 var MAX_TIMESERIES_BUCKETS = 2e3;
-async function handleUsageGet(view, query, deps) {
-  const range = parseRange(query);
+async function handleUsageGet(view, query2, deps) {
+  const range = parseRange(query2);
   if (!isRange(range)) return range;
   switch (view) {
     case "totals":
@@ -2502,7 +3895,7 @@ async function handleUsageGet(view, query, deps) {
     case "by-model":
       return { status: 200, body: await deps.usageRecorder.getByModel(range) };
     case "timeseries": {
-      const bucket = query.get("bucket");
+      const bucket = query2.get("bucket");
       if (bucket !== "hour" && bucket !== "day" && bucket !== "month") {
         return err4(400, "bucket must be one of 'hour', 'day', 'month'");
       }
@@ -2588,9 +3981,9 @@ async function handlePricingUpsert(body, deps) {
   const entry = await deps.pricingEngine.upsertManual(input);
   return { status: 200, body: { entry } };
 }
-async function handlePricingDelete(query, deps) {
-  const providerId = query.get("providerId")?.trim() ?? "";
-  const modelId = query.get("modelId")?.trim() ?? "";
+async function handlePricingDelete(query2, deps) {
+  const providerId = query2.get("providerId")?.trim() ?? "";
+  const modelId = query2.get("modelId")?.trim() ?? "";
   if (!providerId || !modelId) {
     return err4(400, "delete requires providerId and modelId query params");
   }
@@ -2607,7 +4000,8 @@ async function handlePricingFetchLatest(deps) {
         appliedCount: result.applied.length,
         conflicts: result.conflicts,
         fetchedAt: result.fetchedAt,
-        sourceUrl: result.sourceUrl
+        sourceUrl: result.sourceUrl,
+        sources: result.sources
       }
     };
   } catch (e) {
@@ -2655,12 +4049,80 @@ async function handlePricingResolveConflicts(body, deps) {
   return { status: 200, body: { ...resolution, staleCount } };
 }
 
+// src/admin/accountAllowanceApi.ts
+function writeJson2(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeError(res, status, message) {
+  writeJson2(res, status, { error: { type: "account_allowance_error", message } });
+}
+function readJson(req) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    req.on("end", () => {
+      try {
+        const text = Buffer.concat(chunks).toString("utf8");
+        const parsed = text ? JSON.parse(text) : {};
+        resolve2(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+      } catch (error) {
+        reject(error);
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function query(req) {
+  const raw = req.url ?? "";
+  const index = raw.indexOf("?");
+  return new URLSearchParams(index >= 0 ? raw.slice(index + 1) : "");
+}
+function allowanceProvider(value) {
+  if (!value) return void 0;
+  return value === "claude" || value === "codex" ? value : null;
+}
+async function handleAccountAllowanceApi(req, res, method, rest, service) {
+  if (!service) return writeError(res, 501, "account allowance service is not available");
+  if (method === "GET" && rest.length === 1 && rest[0] === "scheduling") {
+    if (!service.getSchedulingStatus) {
+      return writeError(res, 501, "allowance scheduling diagnostics are not available");
+    }
+    return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
+  }
+  if (method === "GET") {
+    const params = query(req);
+    const pathProvider = rest.length >= 2 ? rest[0] : null;
+    const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
+    if (providerId === null) return writeError(res, 400, "providerId must be claude or codex");
+    const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
+    const allowances = await service.list({ providerId, accountId });
+    return writeJson2(res, 200, { allowances });
+  }
+  if (method === "POST" && rest[0] === "refresh") {
+    const body = await readJson(req);
+    const requestedProvider = allowanceProvider(
+      typeof body["providerId"] === "string" ? body["providerId"] : "claude"
+    );
+    if (requestedProvider !== "claude") {
+      return writeError(res, 400, "only Claude allowances support explicit refresh");
+    }
+    const accountId = typeof body["accountId"] === "string" && body["accountId"].trim() ? body["accountId"].trim() : void 0;
+    const allowances = await service.refreshClaude(accountId);
+    if (accountId && allowances.length === 0) {
+      return writeError(res, 404, `Claude account '${accountId}' not found`);
+    }
+    return writeJson2(res, 200, { allowances });
+  }
+  return writeError(res, 405, `method ${method} not allowed on account allowances`);
+}
+
 // src/admin/adminApi.ts
 function readBody(req) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -2674,12 +4136,12 @@ async function readJsonBody3(req) {
     return {};
   }
 }
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson2(res, status, { error: { type: "admin_api_error", message } });
+  writeJson3(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -2696,6 +4158,9 @@ function toKeyInfo(row) {
     createdAt: row.createdAt,
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
+    kind: row.kind,
+    allowedEndpoints: row.allowedEndpoints,
+    loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
     // Key-policy envelope (outbound-key-policy) — all secret-free scalar fields;
     // the UI reads them to render + pre-fill the policy editor.
@@ -2781,6 +4246,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleAccounts(req, res, method, rest, deps);
       case "cli":
         return await handleCli(req, res, method, rest, deps);
+      case "integrations":
+        return await handleIntegrations(req, res, method, rest, deps);
       case "status":
         return await handleStatus(res, method, deps);
       case "playground":
@@ -2808,7 +4275,7 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson2(res, result.status, result.body);
+  writeJson3(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
@@ -2817,7 +4284,7 @@ async function handleUsage(req, res, method, rest, deps) {
 async function handleDashboardRoute(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
@@ -2850,13 +4317,13 @@ async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
   const body = await readJsonBody3(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
   const body = await readJsonBody3(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -2887,10 +4354,10 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson2(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson3(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson2(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson3(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
     const body = await readJsonBody3(req);
@@ -2901,7 +4368,7 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson2(res, 201, { provider: toProviderView(provider) });
+    return writeJson3(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -2914,12 +4381,12 @@ async function handleProviders(req, res, method, rest, deps) {
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson2(res, 200, { provider: toProviderView(updated) });
+    return writeJson3(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson2(res, 200, { ok: true });
+    return writeJson3(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -2952,14 +4419,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson2(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson3(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  if (row.apiFormat !== "openai") {
-    return writeJson2(res, 200, { models: [], unsupportedFormat: true });
+  if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
+    return writeJson3(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -2967,7 +4434,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch2.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await (0, import_upstreamFetch3.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -2976,17 +4443,17 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson2(res, 200, {
+      return writeJson3(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson2(res, 200, { models });
+    return writeJson3(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson2(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson3(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
@@ -2997,13 +4464,13 @@ async function handleTestModel(req, res, id, cfg) {
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson2(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson3(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson2(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson3(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
-  const url = row.baseUrl.replace(/\/+$/, "");
+  let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
   const headers = { "Content-Type": "application/json" };
   let payload;
@@ -3011,6 +4478,10 @@ async function handleTestModel(req, res, id, cfg) {
     headers["x-api-key"] = resolvedKey;
     headers["anthropic-version"] = "2023-06-01";
     payload = { model, max_tokens: 16, messages: [{ role: "user", content: prompt }] };
+  } else if (row.apiFormat === "openai-response") {
+    headers["Authorization"] = `Bearer ${resolvedKey}`;
+    if (!/\/responses$/.test(url)) url = `${url}/v1/responses`;
+    payload = { model, max_output_tokens: 16, stream: false, input: prompt };
   } else {
     headers["Authorization"] = `Bearer ${resolvedKey}`;
     payload = {
@@ -3022,7 +4493,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch2.fetchUpstream)(
+    const response = await (0, import_upstreamFetch3.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -3036,9 +4507,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson2(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson3(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson2(res, 200, {
+    return writeJson3(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -3046,7 +4517,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson2(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson3(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -3087,7 +4558,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -3118,7 +4589,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3138,7 +4609,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3152,7 +4623,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3166,7 +4637,7 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -3284,7 +4755,9 @@ function parseProviderInput(body, existing) {
   const baseUrl = body["baseUrl"];
   if (!id) return null;
   const name = typeof body["name"] === "string" && body["name"].length > 0 ? body["name"] : body["name"] === null ? void 0 : existing?.name;
-  if (apiFormat !== "openai" && apiFormat !== "anthropic" && apiFormat !== "gemini") return null;
+  if (apiFormat !== "openai" && apiFormat !== "anthropic" && apiFormat !== "gemini" && apiFormat !== "openai-response") {
+    return null;
+  }
   if (typeof baseUrl !== "string" || !baseUrl.trim()) return null;
   const rawKey = body["apiKey"];
   let apiKey = typeof rawKey === "string" && rawKey.length > 0 ? rawKey : existing?.apiKey ?? "";
@@ -3306,10 +4779,11 @@ function parseProviderInput(body, existing) {
       apiKey = mode.apiKey;
     }
   }
+  const migrated = migrateFormatAxis(apiFormat, transformer);
   return {
     id,
     name,
-    apiFormat,
+    apiFormat: migrated.apiFormat,
     baseUrl: baseUrl.trim(),
     apiKey,
     models,
@@ -3320,7 +4794,7 @@ function parseProviderInput(body, existing) {
     apiVersion,
     maxConcurrency,
     modelsEndpoint,
-    transformer,
+    transformer: migrated.transformer,
     codingPlan,
     apiModes,
     selectedApiModeId
@@ -3337,13 +4811,13 @@ function handlePresets(res, method) {
     baseUrl: p.baseUrl,
     models: p.models
   }));
-  return writeJson2(res, 200, { presets, excluded });
+  return writeJson3(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson2(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson3(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -3355,13 +4829,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson2(res, 200, { keys });
+    return writeJson3(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
     const body = await readJsonBody3(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await (0, import_outbound_api2.createNamedKey)(deps.keyDb, name);
-    return writeJson2(res, 201, {
+    return writeJson3(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -3373,13 +4847,13 @@ async function handleKeys(req, res, method, rest, deps) {
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson2(res, ok ? 200 : 404, { ok });
+    return writeJson3(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
     const body = await readJsonBody3(req);
     const enabled = body["enabled"] === true;
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson2(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson3(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "max-concurrency") {
     const body = await readJsonBody3(req);
@@ -3397,14 +4871,14 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson2(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson3(res, ok ? 200 : 404, { ok, maxConcurrency: value });
   }
   if (method === "POST" && id && action === "policy") {
     const body = await readJsonBody3(req);
     const parsed = parseKeyPolicyBody(body);
     if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson2(res, ok ? 200 : 404, { ok });
+    return writeJson3(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
@@ -3415,10 +4889,10 @@ function validateQueueSegments(patch) {
       errors.push(`${label} must be a number ${min}..${max}`);
     }
   };
-  const isPlainObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  const isPlainObject5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const umq = patch.userMessageQueue;
   if (umq !== void 0) {
-    if (!isPlainObject4(umq)) {
+    if (!isPlainObject5(umq)) {
       errors.push("userMessageQueue must be an object");
     } else {
       if (typeof umq.enabled !== "boolean") {
@@ -3430,7 +4904,7 @@ function validateQueueSegments(patch) {
   }
   const cq = patch.concurrencyQueue;
   if (cq !== void 0) {
-    if (!isPlainObject4(cq)) {
+    if (!isPlainObject5(cq)) {
       errors.push("concurrencyQueue must be an object");
     } else {
       checkNum("concurrencyQueue.maxQueueSizeFactor", cq.maxQueueSizeFactor, 1, 10);
@@ -3440,7 +4914,7 @@ function validateQueueSegments(patch) {
   }
   const ah = patch.accountHealth;
   if (ah !== void 0) {
-    if (!isPlainObject4(ah)) {
+    if (!isPlainObject5(ah)) {
       errors.push("accountHealth must be an object");
     } else {
       if (typeof ah.overloadCooldownEnabled !== "boolean") {
@@ -3451,6 +4925,31 @@ function validateQueueSegments(patch) {
   }
   return errors;
 }
+function validateAllowanceSchedulingSegment(patch) {
+  const value = patch.allowanceScheduling;
+  if (value === void 0) return [];
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return ["allowanceScheduling must be an object"];
+  }
+  const allowance = value;
+  const errors = [];
+  const checkNumber = (field, min, max) => {
+    const candidate = allowance[field];
+    if (typeof candidate !== "number" || !Number.isFinite(candidate) || candidate < min || candidate > max) {
+      errors.push(`allowanceScheduling.${field} must be a number ${min}..${max}`);
+    }
+  };
+  if (typeof allowance.enabled !== "boolean") {
+    errors.push("allowanceScheduling.enabled must be a boolean");
+  }
+  checkNumber("demoteAtPercent", 0, 100);
+  checkNumber("pauseAtPercent", 0, 100);
+  checkNumber("priorityPenalty", 1, 1e3);
+  if (typeof allowance.demoteAtPercent === "number" && typeof allowance.pauseAtPercent === "number" && allowance.pauseAtPercent < allowance.demoteAtPercent) {
+    errors.push("allowanceScheduling.pauseAtPercent must be >= demoteAtPercent");
+  }
+  return errors;
+}
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
     const config = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
@@ -3458,7 +4957,7 @@ async function handleServer(req, res, method, deps) {
     if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
     if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
     if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
-    return writeJson2(res, 200, { server });
+    return writeJson3(res, 200, { server });
   }
   if (method === "PUT") {
     const patch = await readJsonBody3(req);
@@ -3466,6 +4965,18 @@ async function handleServer(req, res, method, deps) {
     if (queueErrors.length > 0) {
       return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
     }
+    const allowanceErrors = validateAllowanceSchedulingSegment(patch);
+    if (allowanceErrors.length > 0) {
+      return writeJsonError(
+        res,
+        400,
+        `invalid allowance scheduling config: ${allowanceErrors.join("; ")}`
+      );
+    }
+    const bindingErrors = validateGatewayBindingsSegment(patch);
+    if (bindingErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
+    }
     const webhookErrors = validateWebhookSegment(patch);
     if (webhookErrors.length > 0) {
       return writeJsonError(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
@@ -3487,71 +4998,118 @@ async function handleServer(req, res, method, deps) {
       effectivePatch = { ...effectivePatch, webhook: preserveWebhookSecrets(patch.webhook, current.webhook) };
     }
     if (patch.billing) {
-      effectivePatch = { ...effectivePatch, billing: preserveBillingSecret(patch.billing, current.billing) };
-    }
-    const merged = (0, import_outbound_api2.mergeServerConfig)(current, effectivePatch);
-    await (0, import_outbound_api2.saveServerConfig)(deps.settingsStore, merged);
-    setServerProxyConfig(merged.proxy);
-    applyWebhookConfig(merged.webhook);
-    applyAuditConfig(merged.audit);
-    applyBillingConfig(merged.billing);
-    if (merged.enabled) {
-      const missing = (0, import_outbound_api2.validateServerModelConfig)(merged);
-      if (missing.length > 0) {
-        if (deps.outboundApiServer.getStatus().running) {
-          await deps.outboundApiServer.stop();
-        }
-        return writeJson2(res, 200, {
-          server: merged,
-          error: { code: "incomplete-model-config", missing }
-        });
-      }
-    }
-    try {
-      await deps.outboundApiServer.applyConfig({
-        enabled: merged.enabled,
-        networkBinding: merged.networkBinding,
-        endpoints: merged.endpoints,
-        port: merged.port,
-        userMessageQueue: merged.userMessageQueue,
-        concurrencyQueue: merged.concurrencyQueue,
-        // voucher-redemption #9: hot-apply the voucher flag so enabling the product
-        // takes effect without a restart.
-        voucher: merged.voucher
-      });
-    } catch (err5) {
-      const missing = incompleteConfigMissing(err5);
-      if (missing) {
-        return writeJson2(res, 200, {
-          server: merged,
-          error: { code: "incomplete-model-config", missing }
-        });
-      }
-      throw err5;
+      effectivePatch = { ...effectivePatch, billing: preserveBillingSecret(patch.billing, current.billing) };
     }
-    return writeJson2(res, 200, { server: merged });
+    const merged = (0, import_outbound_api2.mergeServerConfig)(current, effectivePatch);
+    await (0, import_outbound_api2.saveServerConfig)(deps.settingsStore, merged);
+    setServerProxyConfig(merged.proxy);
+    (0, import_AccountAllowanceScheduling2.getSharedAccountAllowanceScheduling)().configure(merged.allowanceScheduling);
+    deps.allowanceRefreshScheduler?.configure(merged.allowanceScheduling);
+    applyWebhookConfig(merged.webhook);
+    applyAuditConfig(merged.audit);
+    applyBillingConfig(merged.billing);
+    await deps.outboundApiServer.applyConfig({
+      enabled: merged.enabled,
+      networkBinding: merged.networkBinding,
+      endpoints: merged.endpoints,
+      bindings: merged.bindings,
+      port: merged.port,
+      userMessageQueue: merged.userMessageQueue,
+      concurrencyQueue: merged.concurrencyQueue,
+      // voucher-redemption #9: hot-apply the voucher flag so enabling the product
+      // takes effect without a restart.
+      voucher: merged.voucher
+    });
+    return writeJson3(res, 200, { server: merged });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
-function incompleteConfigMissing(err5) {
-  if (typeof err5 !== "object" || err5 === null) return null;
-  const missing = err5.missing;
-  return Array.isArray(missing) ? missing : null;
-}
 async function handleAccounts(req, res, method, rest, deps) {
+  if (rest[0] === "allowances") {
+    return handleAccountAllowanceApi(
+      req,
+      res,
+      method,
+      rest.slice(1),
+      deps.accountAllowanceService
+    );
+  }
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson2(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson3(res, 200, { accounts, providerAccounts, externalCli });
+  }
+  if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
+    const body = await readJsonBody3(req);
+    const parsed = validateAccountBatchBody(body);
+    if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
+    const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
+    if (!result.ok) {
+      return writeJsonError(
+        res,
+        404,
+        `account '${result.missing.accountId}' not found for provider '${result.missing.providerId}'`
+      );
+    }
+    if (parsed.mutation.action === "delete") {
+      for (const ref of parsed.refs) {
+        deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
+      }
+    }
+    return writeJson3(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
     const result = handleCodexOAuthCancel(rest[2], deps);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
+  }
+  if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const accountId = rest[1];
+    const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+    if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+      return writeJsonError(res, 404, `account '${accountId}' not found`);
+    }
+    const health2 = (0, import_SubscriptionAccountHealth.getSharedAccountHealth)().getDiagnostics({ providerId, accountId });
+    const allowance = deps.accountAllowanceService?.getSchedulingStatus?.()?.history.filter((entry) => entry.providerId === providerId && entry.accountId === accountId).map((entry) => ({
+      kind: "allowance-policy",
+      at: Date.parse(entry.decidedAt),
+      providerId: entry.providerId,
+      accountId: entry.accountId,
+      action: entry.action,
+      reason: entry.reason,
+      usedPercent: entry.usedPercent,
+      resumeAt: entry.resumeAt
+    })) ?? [];
+    const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
+    return writeJson3(res, 200, { diagnostics });
+  }
+  if (method === "GET" && rest.length === 3 && rest[2] === "events") {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const accountId = rest[1];
+    const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+    if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+      return writeJsonError(res, 404, `account '${accountId}' not found`);
+    }
+    const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
+    const diagnostics = (0, import_SubscriptionAccountHealth.getSharedAccountHealth)().getDiagnostics({ providerId, accountId });
+    return writeJson3(res, 200, { events: snapshot?.records ?? [], diagnostics });
+  }
+  if (method === "PATCH" && rest.length === 2) {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const body = await readJsonBody3(req);
+    const patch = validateAccountMetadataPatch(body);
+    if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
+    const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
+    if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
+    return writeJson3(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -3560,12 +5118,12 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson2(res, result.status, result.body);
+      return writeJson3(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
       const body2 = await readJsonBody3(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson2(res, result.status, result.body);
+      return writeJson3(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
       const body2 = await readJsonBody3(req);
@@ -3576,7 +5134,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson3(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
@@ -3589,7 +5147,13 @@ async function handleAccounts(req, res, method, rest, deps) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, { ok: true, account: status2 ?? void 0 });
+      return writeJson3(res, 200, {
+        ok: true,
+        account: status2 ?? void 0,
+        nativeCredentialMode: result.nativeCredentialMode,
+        refreshWritesNativeCredentials: result.refreshWritesNativeCredentials,
+        message: "Imported a read-only copy. Omnicross does not manage the native CLI credential file and future refreshes do not write it."
+      });
     }
     if (method === "POST" && rest[1] === "refresh") {
       if (providerId === "opencodego") {
@@ -3598,7 +5162,17 @@ async function handleAccounts(req, res, method, rest, deps) {
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson3(res, 200, { ok, account: status2 ?? void 0 });
+    }
+    if (method === "POST" && rest.length === 3 && rest[2] === "test") {
+      const accountId = rest[1];
+      if (!deps.accountProbeService) return writeJsonError(res, 501, "account probe service unavailable");
+      const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+      if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+        return writeJsonError(res, 404, `account '${accountId}' not found`);
+      }
+      const result = await deps.accountProbeService.probeAccount(providerId, accountId);
+      return writeJson3(res, 200, { ok: result.ok, marked: result.marked });
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
@@ -3606,7 +5180,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
@@ -3618,7 +5192,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
@@ -3631,7 +5205,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
@@ -3640,7 +5214,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
       const body2 = await readJsonBody3(req);
@@ -3648,17 +5222,22 @@ async function handleAccounts(req, res, method, rest, deps) {
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
-    if (method === "DELETE" && rest.length >= 2) {
+    if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
+      return writeJson3(res, 200, { ok: true });
     }
-    if (method === "DELETE") {
+    if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
-      return writeJson2(res, 200, { ok: true });
+      deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
+      return writeJson3(res, 200, { ok: true });
+    }
+    if (method === "DELETE") {
+      return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
     }
     const body = await readJsonBody3(req);
     const config = validateTokenBody(providerId, body);
@@ -3667,22 +5246,22 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson2(res, 200, status ? { account: status } : { ok: true });
+    return writeJson3(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -3690,7 +5269,7 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
@@ -3705,28 +5284,100 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
+async function handleIntegrations(req, res, method, rest, deps) {
+  const factory = deps.integrationManagerFactory;
+  if (!factory) return writeJsonError(res, 501, "native CLI integration is not available");
+  const manager = factory();
+  try {
+    if (method === "GET" && rest.length === 0) {
+      return writeJson3(res, 200, {
+        integrations: await manager.listStatus(),
+        gateway: deps.outboundApiServer.getStatus()
+      });
+    }
+    if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
+      await manager.rotateGatewayKey();
+      return writeJson3(res, 200, { ok: true, integrations: await manager.listStatus() });
+    }
+    const client = rest[0];
+    if (!isIntegrationClient(client)) {
+      return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
+    }
+    if (method === "POST" && rest[1] === "plan") {
+      const body = await readJsonBody3(req);
+      const configPath = body.configPath;
+      if (configPath !== void 0 && typeof configPath !== "string") {
+        return writeJsonError(res, 400, "configPath must be a string");
+      }
+      const plan = await manager.plan(client, configPath);
+      return writeJson3(res, 200, { plan });
+    }
+    if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
+      const body = await readJsonBody3(req);
+      const configPath = body.configPath;
+      if (configPath !== void 0 && typeof configPath !== "string") {
+        return writeJsonError(res, 400, "configPath must be a string");
+      }
+      const status = await manager.install(client, configPath);
+      return writeJson3(res, 200, { integration: status });
+    }
+    if (method === "POST" && rest[1] === "repair") {
+      const status = await manager.repair(client);
+      return writeJson3(res, 200, { integration: status });
+    }
+    if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
+      const status = await manager.remove(client);
+      return writeJson3(res, 200, { integration: status });
+    }
+    return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
+  } catch (error) {
+    if (error instanceof IntegrationConflictError) {
+      return writeJsonError(res, 409, error.message);
+    }
+    throw error;
+  }
+}
+function isIntegrationClient(value) {
+  return value === "codex" || value === "claude";
+}
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
   const serverConfig = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
-  const endpoints = serverConfig.endpoints.map((e) => {
-    if ((0, import_outbound_api2.isKindMappedEndpoint)(e.endpoint)) {
-      return { endpoint: e.endpoint, kinds: e.modelMap ?? {}, useSubscription: e.useSubscription };
+  const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
+    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => (0, import_outbound_api2.gatewayBindingToEndpointConfig)(binding));
+    const useSubscription = routes.some((route) => route.useSubscription);
+    if ((0, import_outbound_api2.isKindMappedEndpoint)(endpoint)) {
+      const kinds = {};
+      for (const route of routes) {
+        for (const [kind, ref] of Object.entries(route.modelMap ?? {})) {
+          if (ref?.trim() && !kinds[kind]) kinds[kind] = ref;
+        }
+      }
+      return { endpoint, kinds, useSubscription };
     }
-    if (e.endpoint === "chat") {
-      return { endpoint: e.endpoint, models: e.models ?? [], useSubscription: e.useSubscription };
+    if (endpoint === "chat") {
+      return {
+        endpoint,
+        models: [...new Set(routes.flatMap((route) => route.models ?? []))],
+        useSubscription
+      };
     }
-    return { endpoint: e.endpoint, model: e.defaultModel ?? "", useSubscription: e.useSubscription };
+    return {
+      endpoint,
+      model: routes.find((route) => route.defaultModel?.trim())?.defaultModel ?? "",
+      useSubscription
+    };
   });
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson2(res, 200, { ...status, endpoints, queueStatus });
+    return writeJson3(res, 200, { ...status, endpoints, queueStatus });
   }
-  return writeJson2(res, 200, { ...status, endpoints });
+  return writeJson3(res, 200, { ...status, endpoints });
 }
 function resolvePlaygroundPath(endpoint, body) {
   switch (endpoint) {
@@ -3752,16 +5403,16 @@ async function handlePlayground(req, res, method, deps) {
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord2(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord(v) {
+function isRecord2(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const upstream = import_node_http.default.request(
       {
         host: "127.0.0.1",
@@ -3782,14 +5433,14 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         proxRes.on("data", (chunk) => res.write(chunk));
         proxRes.on("end", () => {
           res.end();
-          resolve();
+          resolve2();
         });
       }
     );
     upstream.on("error", (err5) => {
       if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err5.message}`);
       else res.end();
-      resolve();
+      resolve2();
     });
     upstream.write(body);
     upstream.end();
@@ -3797,10 +5448,10 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-var import_node_fs4 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path3 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -3821,13 +5472,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(fromEnv, "index.html")) ? import_node_path3.default.resolve(fromEnv) : null;
+    return (0, import_node_fs7.existsSync)(import_node_path7.default.join(fromEnv, "index.html")) ? import_node_path7.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path3.default.join(import_node_path3.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs4.existsSync)(import_node_path3.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path7.default.join(import_node_path7.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs7.existsSync)(import_node_path7.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -3869,16 +5520,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path3.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path3.default.sep)) {
+  const filePath = import_node_path7.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path7.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
-  if (!(0, import_node_fs4.existsSync)(target) || (0, import_node_fs4.statSync)(target).isDirectory()) {
-    if (import_node_path3.default.extname(rel) === "") {
-      target = import_node_path3.default.join(uiDist, "index.html");
+  if (!(0, import_node_fs7.existsSync)(target) || (0, import_node_fs7.statSync)(target).isDirectory()) {
+    if (import_node_path7.default.extname(rel) === "") {
+      target = import_node_path7.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -3886,14 +5537,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path3.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path7.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.6" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -3932,14 +5583,14 @@ var AdminServer = class {
   }
   /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
   listen(bindAddr, port) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const server = import_node_http2.default.createServer((req, res) => {
         this.onRequest(req, res);
       });
       const onError = (err5) => {
         if (err5.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
-          this.listen(bindAddr, 0).then(resolve, reject);
+          this.listen(bindAddr, 0).then(resolve2, reject);
           return;
         }
         reject(err5);
@@ -3951,7 +5602,7 @@ var AdminServer = class {
           server.removeListener("error", onError);
           server.on("error", (e) => this.deps.logger.error("[AdminServer] server error", e));
           this.server = server;
-          resolve(addr.port);
+          resolve2(addr.port);
         } else {
           reject(new Error("Failed to get admin server address"));
         }
@@ -4032,8 +5683,8 @@ var AdminServer = class {
     if (!server) return;
     this.server = null;
     this.boundPort = 0;
-    return new Promise((resolve) => {
-      server.close(() => resolve());
+    return new Promise((resolve2) => {
+      server.close(() => resolve2());
     });
   }
   /** A live status snapshot. */
@@ -4049,7 +5700,7 @@ function constantTimeEquals(a, b) {
   const bufA = Buffer.from(a, "utf8");
   const bufB = Buffer.from(b, "utf8");
   if (bufA.length !== bufB.length) return false;
-  return (0, import_node_crypto7.timingSafeEqual)(bufA, bufB);
+  return (0, import_node_crypto9.timingSafeEqual)(bufA, bufB);
 }
 
 // src/admin/health.ts
@@ -4098,7 +5749,7 @@ function buildHealthReport(deps) {
 }
 
 // src/admin/oauthSessions.ts
-var import_node_crypto8 = __toESM(require("crypto"), 1);
+var import_node_crypto10 = __toESM(require("crypto"), 1);
 var DEFAULT_OAUTH_SESSION_TTL_MS = 10 * 60 * 1e3;
 var OAuthSessionStore = class {
   constructor(ttlMs = DEFAULT_OAUTH_SESSION_TTL_MS) {
@@ -4112,7 +5763,7 @@ var OAuthSessionStore = class {
    */
   put(session) {
     this.sweep();
-    const sessionId = import_node_crypto8.default.randomBytes(24).toString("base64url");
+    const sessionId = import_node_crypto10.default.randomBytes(24).toString("base64url");
     this.sessions.set(sessionId, { ...session, createdAt: Date.now() });
     return sessionId;
   }
@@ -4149,7 +5800,7 @@ function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
 function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
       if (settled) return;
@@ -4180,7 +5831,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       }
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end(pageHtml("Login complete."));
-      finish(server, () => resolve(code));
+      finish(server, () => resolve2(code));
     });
     const abort = () => finish(server, () => reject(new Error("login: cancelled")));
     if (signal?.aborted) {
@@ -4275,32 +5926,43 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-var import_node_path4 = require("path");
+var import_node_path8 = require("path");
 function defaultVouchersPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "vouchers.json");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "vouchers.json");
+}
+function defaultIntegrationsPath(configPath) {
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "integrations.json");
 }
 function defaultPricingPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "pricing.json");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "pricing.json");
+}
+function defaultPricingRefreshStatePath(configPath) {
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "pricing-refresh.json");
+}
+function defaultAccountAllowancePath(configPath) {
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "allowance-cache.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "usage-events.jsonl");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "audit");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "billing");
+  return (0, import_node_path8.join)((0, import_node_path8.dirname)(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
-var import_core = require("@omnicross/core");
+var import_core2 = require("@omnicross/core");
 var EMPTY_CHAIN = {
   providerTransformers: [],
   modelTransformers: []
 };
 var FORMAT_TRANSFORMER = {
+  openai: "openai",
   anthropic: "anthropic",
-  gemini: "gemini"
+  gemini: "gemini",
+  "openai-response": "openai-response"
 };
 var ConfigFileProviderConfigSource = class {
   providers = /* @__PURE__ */ new Map();
@@ -4316,8 +5978,8 @@ var ConfigFileProviderConfigSource = class {
   reloadHook;
   constructor(config) {
     for (const p of config.providers) this.providers.set(p.id, p);
-    this.transformerService = new import_core.TransformerService();
-    void (0, import_core.registerBuiltinTransformers)(this.transformerService);
+    this.transformerService = new import_core2.TransformerService();
+    void (0, import_core2.registerBuiltinTransformers)(this.transformerService);
   }
   // ── Reload hook (key-pool design D4) ───────────────────────────────────────
   /**
@@ -4338,7 +6000,7 @@ var ConfigFileProviderConfigSource = class {
   }
   /** Await the built-in transformer registration (tests await this before dispatch). */
   async ready() {
-    await (0, import_core.registerBuiltinTransformers)(this.transformerService);
+    await (0, import_core2.registerBuiltinTransformers)(this.transformerService);
   }
   // ── Hot-reload seam (admin dashboard, RT3 design D6) ───────────────────────
   /**
@@ -4369,7 +6031,7 @@ var ConfigFileProviderConfigSource = class {
   }
   async getMainTransformer(providerId) {
     const row = this.providers.get(providerId);
-    if (!row || row.apiFormat === "openai") return null;
+    if (!row) return null;
     const name = FORMAT_TRANSFORMER[row.apiFormat];
     const instances = this.transformerService.resolveTransformerReferences([name]);
     return instances[0] ?? null;
@@ -4379,11 +6041,8 @@ var ConfigFileProviderConfigSource = class {
     if (!row) return EMPTY_CHAIN;
     const customRefs = row.transformer?.use ?? [];
     if (customRefs.length === 0) return EMPTY_CHAIN;
-    const formatName = row.apiFormat === "openai" ? void 0 : FORMAT_TRANSFORMER[row.apiFormat];
-    const effectiveRefs = formatName ? customRefs.filter((ref) => (typeof ref === "string" ? ref : ref[0]) !== formatName) : customRefs;
-    if (effectiveRefs.length === 0) return EMPTY_CHAIN;
     return {
-      providerTransformers: this.transformerService.resolveTransformerReferences(effectiveRefs),
+      providerTransformers: this.transformerService.resolveTransformerReferences(customRefs),
       modelTransformers: []
     };
   }
@@ -4414,7 +6073,7 @@ function resolvePreferredApiKey(row) {
 }
 function toLLMProvider(row) {
   const apiFormat = row.apiFormat === "gemini" ? "google" : row.apiFormat;
-  const transformer = row.apiFormat === "openai" ? void 0 : { use: [FORMAT_TRANSFORMER[row.apiFormat]] };
+  const transformer = { use: [FORMAT_TRANSFORMER[row.apiFormat]] };
   const allModels = row.models ?? [];
   const models = row.modelConfigs ? allModels.filter((id) => row.modelConfigs.find((c) => c.id === id)?.enabled !== false) : allModels;
   return {
@@ -4450,7 +6109,7 @@ function toLLMProvider(row) {
 }
 
 // src/ports/ConfigurableLogger.ts
-var import_node_fs5 = require("fs");
+var import_node_fs8 = require("fs");
 var LEVEL_ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
 var RESERVED_JSON_KEYS = /* @__PURE__ */ new Set(["ts", "level", "msg", "error"]);
 var ConfigurableLogger = class {
@@ -4484,7 +6143,7 @@ var ConfigurableLogger = class {
     const stream = this.fileStream;
     this.fileStream = null;
     if (!stream) return Promise.resolve();
-    return new Promise((resolve) => stream.end(() => resolve()));
+    return new Promise((resolve2) => stream.end(() => resolve2()));
   }
   emit(level, message, error, meta) {
     if (LEVEL_ORDER[level] > this.threshold) return;
@@ -4526,7 +6185,7 @@ var ConfigurableLogger = class {
     if (this.fileDisabled || !this.filePath) return null;
     if (this.fileStream) return this.fileStream;
     try {
-      const stream = (0, import_node_fs5.createWriteStream)(this.filePath, { flags: "a" });
+      const stream = (0, import_node_fs8.createWriteStream)(this.filePath, { flags: "a" });
       stream.on("error", () => {
         this.fileDisabled = true;
         this.fileStream = null;
@@ -4595,7 +6254,7 @@ function safeStringify(value) {
 }
 
 // src/ports/JsonApiServerSettingsStore.ts
-var import_node_fs6 = require("fs");
+var import_node_fs9 = require("fs");
 var import_outbound_api3 = require("@omnicross/core/outbound-api");
 var JsonApiServerSettingsStore = class {
   /**
@@ -4622,7 +6281,7 @@ var JsonApiServerSettingsStore = class {
     if (key !== import_outbound_api3.OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
-    (0, import_node_fs6.writeFileSync)(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
+    (0, import_node_fs9.writeFileSync)(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   }
   /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
   encryptSecrets(config) {
@@ -4645,7 +6304,7 @@ var JsonApiServerSettingsStore = class {
   /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
   readFile() {
     try {
-      const raw = (0, import_node_fs6.readFileSync)(this.configPath, "utf8");
+      const raw = (0, import_node_fs9.readFileSync)(this.configPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object") return parsed;
     } catch {
@@ -4655,8 +6314,8 @@ var JsonApiServerSettingsStore = class {
 };
 
 // src/ports/JsonlUsageEventStore.ts
-var import_node_crypto9 = require("crypto");
-var import_node_fs7 = require("fs");
+var import_node_crypto11 = require("crypto");
+var import_node_fs10 = require("fs");
 var JsonlUsageEventStore = class {
   constructor(eventsPath, isPriced) {
     this.eventsPath = eventsPath;
@@ -4668,10 +6327,10 @@ var JsonlUsageEventStore = class {
   async insert(input) {
     const row = {
       ...input,
-      id: (0, import_node_crypto9.randomUUID)(),
+      id: (0, import_node_crypto11.randomUUID)(),
       ts: input.ts ?? Date.now()
     };
-    (0, import_node_fs7.appendFileSync)(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
+    (0, import_node_fs10.appendFileSync)(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
     return row.id;
   }
   async getTotals(range) {
@@ -4766,15 +6425,15 @@ var JsonlUsageEventStore = class {
    * Used to lazily seed the outbound key-policy spend tracker (once per key). A
    * key with no attributed events yields all zeros.
    */
-  async getSpendByKey(query) {
+  async getSpendByKey(query2) {
     let totalUsd = 0;
     let dailyUsd = 0;
     let weeklyUsd = 0;
-    for (const row of this.readRows({ startTs: 0, endTs: query.endTs })) {
-      if (row.apiKeyId !== query.apiKeyId) continue;
+    for (const row of this.readRows({ startTs: 0, endTs: query2.endTs })) {
+      if (row.apiKeyId !== query2.apiKeyId) continue;
       totalUsd += row.costUsd;
-      if (row.ts >= query.dayStartTs) dailyUsd += row.costUsd;
-      if (row.ts >= query.weekStartTs) weeklyUsd += row.costUsd;
+      if (row.ts >= query2.dayStartTs) dailyUsd += row.costUsd;
+      if (row.ts >= query2.weekStartTs) weeklyUsd += row.costUsd;
     }
     return { totalUsd, dailyUsd, weeklyUsd };
   }
@@ -4859,10 +6518,10 @@ var JsonlUsageEventStore = class {
   }
   /** Parse every line, skipping malformed/torn lines defensively. */
   readAllRows() {
-    if (!(0, import_node_fs7.existsSync)(this.eventsPath)) return [];
+    if (!(0, import_node_fs10.existsSync)(this.eventsPath)) return [];
     let raw;
     try {
-      raw = (0, import_node_fs7.readFileSync)(this.eventsPath, "utf8");
+      raw = (0, import_node_fs10.readFileSync)(this.eventsPath, "utf8");
     } catch {
       return [];
     }
@@ -4946,7 +6605,7 @@ function isUsageEventRecord(parsed) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-var import_node_fs8 = require("fs");
+var import_node_fs11 = require("fs");
 var JsonOutboundKeyDb = class {
   constructor(keysPath) {
     this.keysPath = keysPath;
@@ -4972,7 +6631,10 @@ var JsonOutboundKeyDb = class {
       enabled: true,
       createdAt: input.createdAt ?? Date.now(),
       lastUsedAt: null,
-      revokedAt: null
+      revokedAt: null,
+      kind: input.kind,
+      allowedEndpoints: input.allowedEndpoints,
+      loopbackOnly: input.loopbackOnly
     };
     rows.push(row);
     this.writeRows(rows);
@@ -5049,16 +6711,16 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs8.existsSync)(this.keysPath)) return [];
+    if (!(0, import_node_fs11.existsSync)(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs8.readFileSync)(this.keysPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs11.readFileSync)(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs8.writeFileSync)(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    (0, import_node_fs11.writeFileSync)(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 function applyPolicyField(row, field, value) {
@@ -5068,12 +6730,29 @@ function applyPolicyField(row, field, value) {
 }
 
 // src/ports/JsonPricingStore.ts
-var import_node_fs9 = require("fs");
+var import_node_fs12 = require("fs");
+var import_node_crypto12 = require("crypto");
 var JsonPricingStore = class {
   constructor(pricingPath) {
     this.pricingPath = pricingPath;
   }
   pricingPath;
+  /**
+   * Return whether the durable snapshot can actually serve at least one price.
+   *
+   * This intentionally checks the file itself instead of relying on refresh
+   * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
+   * otherwise unusable pricing table after a crash or manual file edit.
+   */
+  hasUsableSnapshot() {
+    if (!(0, import_node_fs12.existsSync)(this.pricingPath)) return false;
+    try {
+      const parsed = JSON.parse((0, import_node_fs12.readFileSync)(this.pricingPath, "utf8"));
+      return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
+    } catch {
+      return false;
+    }
+  }
   async getAll() {
     return this.readRows();
   }
@@ -5086,17 +6765,17 @@ var JsonPricingStore = class {
    */
   async upsert(input, asUserEdit) {
     const rows = this.readRows();
-    const entry = this.applyUpsert(rows, input, asUserEdit);
+    const entry = this.applyUpsert(rows, input, asUserEdit, "litellm");
     this.writeRows(rows);
     return entry;
   }
   /**
    * Apply a batch fetched from a pricing source. Rows whose local copy is
    * user-edited are NOT applied — they come back as `{ current, incoming }`
-   * conflicts; everything else is upserted (source 'litellm'). ONE file write
-   * for the whole batch.
+   * conflicts; everything else is upserted with the supplied automatic source.
+   * ONE file write for the whole batch.
    */
-  async bulkApplyFromSource(entries) {
+  async bulkApplyFromSource(entries, source = "litellm") {
     const rows = this.readRows();
     const applied = [];
     const conflicts = [];
@@ -5112,7 +6791,8 @@ var JsonPricingStore = class {
         rows,
         incoming,
         /* asUserEdit */
-        false
+        false,
+        source
       ));
     }
     if (applied.length > 0) this.writeRows(rows);
@@ -5135,7 +6815,8 @@ var JsonPricingStore = class {
         rows,
         r.incoming,
         /* asUserEdit */
-        false
+        false,
+        "litellm"
       );
       overwrittenCount += 1;
     }
@@ -5156,7 +6837,7 @@ var JsonPricingStore = class {
     return true;
   }
   /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
-  applyUpsert(rows, input, asUserEdit) {
+  applyUpsert(rows, input, asUserEdit, automaticSource) {
     const now = Date.now();
     const entry = {
       providerId: input.providerId,
@@ -5165,7 +6846,7 @@ var JsonPricingStore = class {
       outputPricePer1m: input.outputPricePer1m,
       cacheReadPricePer1m: input.cacheReadPricePer1m ?? null,
       cacheWritePricePer1m: input.cacheWritePricePer1m ?? null,
-      source: asUserEdit ? "user" : "litellm",
+      source: asUserEdit ? "user" : automaticSource,
       userEdited: asUserEdit,
       editedAt: asUserEdit ? now : null,
       updatedAt: now
@@ -5179,21 +6860,142 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs9.existsSync)(this.pricingPath)) return [];
+    if (!(0, import_node_fs12.existsSync)(this.pricingPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs9.readFileSync)(this.pricingPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs12.readFileSync)(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs9.writeFileSync)(this.pricingPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    const temporaryPath = `${this.pricingPath}.${process.pid}.${(0, import_node_crypto12.randomUUID)()}.tmp`;
+    try {
+      (0, import_node_fs12.writeFileSync)(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
+        encoding: "utf8",
+        flag: "wx"
+      });
+      this.replaceFile(temporaryPath);
+    } finally {
+      (0, import_node_fs12.rmSync)(temporaryPath, { force: true });
+    }
+  }
+  /** Isolated for deterministic failure testing; never removes the target. */
+  replaceFile(temporaryPath) {
+    (0, import_node_fs12.renameSync)(temporaryPath, this.pricingPath);
+  }
+};
+function isUsablePricingRow(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return typeof row.providerId === "string" && row.providerId.length > 0 && typeof row.modelId === "string" && row.modelId.length > 0 && typeof row.inputPricePer1m === "number" && Number.isFinite(row.inputPricePer1m) && typeof row.outputPricePer1m === "number" && Number.isFinite(row.outputPricePer1m);
+}
+
+// src/pricing/PricingRefreshScheduler.ts
+var import_node_fs13 = require("fs");
+var EMPTY_STATE2 = {
+  lastAttemptAt: null,
+  lastSuccessAt: null,
+  lastError: null,
+  sources: []
+};
+var PricingRefreshScheduler = class {
+  constructor(engine, catalog2, statePath, logger, options = {}) {
+    this.engine = engine;
+    this.catalog = catalog2;
+    this.statePath = statePath;
+    this.logger = logger;
+    this.staleAfterMs = options.staleAfterMs ?? 24 * 60 * 60 * 1e3;
+    this.intervalMs = options.intervalMs ?? 60 * 60 * 1e3;
+    this.now = options.now ?? Date.now;
+  }
+  engine;
+  catalog;
+  statePath;
+  logger;
+  staleAfterMs;
+  intervalMs;
+  now;
+  timer = null;
+  inFlight = null;
+  /** Fire one stale check immediately and arm an unref'ed periodic check. */
+  start() {
+    if (this.timer) return;
+    void this.refreshIfStale();
+    this.timer = setInterval(() => void this.refreshIfStale(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  dispose() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+  getState() {
+    if (!(0, import_node_fs13.existsSync)(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    try {
+      const value = JSON.parse((0, import_node_fs13.readFileSync)(this.statePath, "utf8"));
+      return {
+        lastAttemptAt: finiteOrNull(value.lastAttemptAt),
+        lastSuccessAt: finiteOrNull(value.lastSuccessAt),
+        lastError: typeof value.lastError === "string" ? value.lastError : null,
+        sources: Array.isArray(value.sources) ? value.sources : []
+      };
+    } catch {
+      return { ...EMPTY_STATE2, sources: [] };
+    }
+  }
+  /** Public for admin/manual tests; concurrent checks share one promise. */
+  refreshIfStale(force = false) {
+    if (this.inFlight) return this.inFlight;
+    const state = this.getState();
+    if (!force && this.catalog.hasUsableSnapshot() && state.lastSuccessAt !== null && this.now() - state.lastSuccessAt < this.staleAfterMs) {
+      return Promise.resolve();
+    }
+    const task = this.runRefresh(state);
+    this.inFlight = task;
+    return task.finally(() => {
+      if (this.inFlight === task) this.inFlight = null;
+    });
+  }
+  async runRefresh(previous) {
+    const lastAttemptAt = this.now();
+    try {
+      const result = await this.engine.fetchLatestFromSource();
+      const failed = result.sources.filter((source) => source.status === "failed");
+      const complete = failed.length === 0;
+      this.writeState({
+        lastAttemptAt,
+        // A partial refresh keeps useful rows, but remains stale so the failed
+        // source is retried on the next hourly check instead of 24 hours later.
+        lastSuccessAt: complete ? this.now() : previous.lastSuccessAt,
+        lastError: complete ? null : failed.map((source) => `${source.source}: ${source.error ?? "failed"}`).join("; "),
+        sources: result.sources
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.writeState({
+        lastAttemptAt,
+        lastSuccessAt: previous.lastSuccessAt,
+        lastError: message,
+        sources: previous.sources
+      });
+      this.logger.warn("[PricingRefreshScheduler] background refresh failed; cached prices retained", {
+        error: message
+      });
+    }
+  }
+  writeState(state) {
+    const temporaryPath = `${this.statePath}.tmp`;
+    (0, import_node_fs13.writeFileSync)(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+    (0, import_node_fs13.renameSync)(temporaryPath, this.statePath);
   }
 };
+function finiteOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 
 // src/ports/JsonVoucherDb.ts
-var import_node_fs10 = require("fs");
+var import_node_fs14 = require("fs");
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -5271,55 +7073,32 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs10.existsSync)(this.vouchersPath)) return [];
+    if (!(0, import_node_fs14.existsSync)(this.vouchersPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs10.readFileSync)(this.vouchersPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs14.readFileSync)(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs10.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    (0, import_node_fs14.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-var import_node_fs13 = require("fs");
-var import_node_path7 = require("path");
-var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_SubscriptionIdentityStore = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
+var import_node_fs16 = require("fs");
+var import_node_path10 = require("path");
+var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
+var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_subscriptions3 = require("@omnicross/subscriptions");
 
 // src/ports/account-sync.ts
-var IMPORT_EXPIRY_MARGIN_MS = 6e4;
 function viewOf(tokens) {
   return tokens;
 }
-function decideExternalImport(captured, external, now = Date.now()) {
-  if (!external?.accessToken) return "no-credential";
-  const capturedRt = viewOf(captured).refreshToken;
-  const hasNewRefresh = Boolean(external.refreshToken && external.refreshToken !== capturedRt);
-  const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > now + IMPORT_EXPIRY_MARGIN_MS : true;
-  return hasNewRefresh || accessStillValid ? "import" : "not-rotated";
-}
-function buildImportedTokens(captured, external) {
-  const imported = {
-    ...captured,
-    accessToken: external.accessToken,
-    status: "authorized",
-    errorMessage: void 0,
-    syncWarning: void 0,
-    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (external.refreshToken) imported.refreshToken = external.refreshToken;
-  if (external.expiresAt) imported.expiresAt = external.expiresAt;
-  else delete imported.expiresAt;
-  if (external.idToken) imported.idToken = external.idToken;
-  if (external.scopes) imported.scopes = external.scopes;
-  return imported;
-}
 function buildTokensFromExternal(provider, external) {
   const base = {
     authMethod: "oauth",
@@ -5340,14 +7119,6 @@ function buildTokensFromExternal(provider, external) {
   if (external.idToken) tokens.idToken = external.idToken;
   return tokens;
 }
-function isExternalDivergent(stored, external) {
-  if (!external?.accessToken || !external.refreshToken) return false;
-  const view = viewOf(stored);
-  if (!view.refreshToken || external.refreshToken === view.refreshToken) return false;
-  const storedExp = view.expiresAt ? Date.parse(view.expiresAt) : NaN;
-  const externalExp = external.expiresAt ? Date.parse(external.expiresAt) : Infinity;
-  return !Number.isFinite(storedExp) || externalExp > storedExp;
-}
 function findDuplicateCredentialIds(accounts) {
   const byCredential = /* @__PURE__ */ new Map();
   for (const account of accounts) {
@@ -5366,11 +7137,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-var import_node_fs11 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path5 = require("path");
-function externalStorePath(provider, home = (0, import_node_os2.homedir)()) {
-  return provider === "claude" ? (0, import_node_path5.join)(home, ".claude", ".credentials.json") : (0, import_node_path5.join)(home, ".codex", "auth.json");
+var import_node_fs15 = require("fs");
+var import_node_os3 = require("os");
+var import_node_path9 = require("path");
+function externalStorePath(provider, home = (0, import_node_os3.homedir)()) {
+  return provider === "claude" ? (0, import_node_path9.join)(home, ".claude", ".credentials.json") : (0, import_node_path9.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -5417,12 +7188,12 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = (0, import_node_os2.homedir)()) {
+function readExternalCliCredentials(provider, home = (0, import_node_os3.homedir)()) {
   const path2 = externalStorePath(provider, home);
-  if (!(0, import_node_fs11.existsSync)(path2)) return null;
+  if (!(0, import_node_fs15.existsSync)(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -5430,84 +7201,6 @@ function readExternalCliCredentials(provider, home = (0, import_node_os2.homedir
   return provider === "claude" ? parseClaudeOAuthEnvelope(raw) : parseCodexTokensEnvelope(raw);
 }
 
-// src/ports/external-cli-store.ts
-var import_node_fs12 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path6 = require("path");
-function markerPath(provider, home) {
-  return `${externalStorePath(provider, home)}.omnicross-managed`;
-}
-function backupPath(provider, home) {
-  return `${externalStorePath(provider, home)}.omnicross-backup`;
-}
-function buildClaudeOAuthEnvelope(tokens) {
-  if (!tokens.accessToken) return null;
-  const envelope = { accessToken: tokens.accessToken };
-  if (tokens.refreshToken) envelope.refreshToken = tokens.refreshToken;
-  if (tokens.expiresAt) {
-    const ms = Date.parse(tokens.expiresAt);
-    if (Number.isFinite(ms)) envelope.expiresAt = ms;
-  }
-  if (tokens.scopes && tokens.scopes.length > 0) envelope.scopes = tokens.scopes;
-  return envelope;
-}
-function buildCodexTokensEnvelope(tokens) {
-  if (!tokens.accessToken && !tokens.idToken) return null;
-  const envelope = { access_token: tokens.accessToken ?? "" };
-  if (tokens.idToken) envelope.id_token = tokens.idToken;
-  if (tokens.refreshToken) envelope.refresh_token = tokens.refreshToken;
-  return envelope;
-}
-function readExistingObject(path2) {
-  if (!(0, import_node_fs12.existsSync)(path2)) return {};
-  try {
-    const parsed = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function writeAtomic(path2, content) {
-  (0, import_node_fs12.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
-  const temp = `${path2}.omnicross-tmp`;
-  (0, import_node_fs12.writeFileSync)(temp, content, "utf8");
-  (0, import_node_fs12.renameSync)(temp, path2);
-}
-function createExternalCliStore(home = (0, import_node_os3.homedir)()) {
-  return {
-    readMarkerAccountId(provider) {
-      const path2 = markerPath(provider, home);
-      if (!(0, import_node_fs12.existsSync)(path2)) return void 0;
-      try {
-        const parsed = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
-        return typeof parsed.accountId === "string" && parsed.accountId ? parsed.accountId : void 0;
-      } catch {
-        return void 0;
-      }
-    },
-    writeMarker(provider, accountId) {
-      writeAtomic(
-        markerPath(provider, home),
-        JSON.stringify({ accountId, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
-      );
-    },
-    writeBack(provider, accountId, tokens) {
-      const owner = this.readMarkerAccountId(provider);
-      if (owner !== accountId) return false;
-      const envelope = provider === "claude" ? buildClaudeOAuthEnvelope(tokens) : buildCodexTokensEnvelope(tokens);
-      if (!envelope) return false;
-      const storePath = externalStorePath(provider, home);
-      if ((0, import_node_fs12.existsSync)(storePath) && !(0, import_node_fs12.existsSync)(backupPath(provider, home))) {
-        (0, import_node_fs12.copyFileSync)(storePath, backupPath(provider, home));
-      }
-      const existing = readExistingObject(storePath);
-      const merged = provider === "claude" ? { ...existing, claudeAiOauth: envelope } : { ...existing, tokens: envelope };
-      writeAtomic(storePath, JSON.stringify(merged, null, 2) + "\n");
-      return true;
-    }
-  };
-}
-
 // src/ports/JsonSubscriptionCredentialStore.ts
 var ACCOUNT_REFRESH_LEAD_MS = 5 * 6e4;
 var JsonSubscriptionCredentialStore = class {
@@ -5520,32 +7213,30 @@ var JsonSubscriptionCredentialStore = class {
    *                    proxy-aware {@link fetchUpstream} that threads the
    *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
    *                    per-account/per-provider proxy is honored on refresh exactly
-   *                    as on relay — refresh egresses from the SAME proxy IP as the
+   *                    as on relay refresh egresses from the SAME proxy IP as the
    *                    account's traffic. NOT used by any read/write path.
    */
-  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials, externalCliStore = createExternalCliStore()) {
+  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials) {
     this.tokensPath = tokensPath;
     this.box = box;
     this.fetchImpl = fetchImpl;
     this.externalCliReader = externalCliReader;
-    this.externalCliStore = externalCliStore;
   }
   tokensPath;
   box;
   fetchImpl;
   externalCliReader;
-  externalCliStore;
   /**
    * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
    * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
    * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
-   * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+   * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch3.fetchUpstream)(url, init, { providerId, accountId }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId }));
   }
   /**
-   * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+   * In-flight refresh coalescing. OAuth refresh tokens are
    * SINGLE-USE: two concurrent refreshes of one account each spend the same
    * token and the loser bricks a healthy account. Every refresh entry point
    * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
@@ -5560,13 +7251,13 @@ var JsonSubscriptionCredentialStore = class {
     return run;
   }
   /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
-   *  file is absent/corrupt). This is the hot read — the codex / gemini auth
+   *  file is absent/corrupt). This is the hot read the codex / gemini auth
    *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
   async getFullConfig() {
     return this.readConfig();
   }
   /** Current Claude OAuth access token, or `null` when none is stored. No inline
-   *  refresh here — the lead-window / 401-retry refresh is driven by the
+   *  refresh here the lead-window / 401-retry refresh is driven by the
    *  subscription auth strategy, which calls `refreshClaudeToken` (now real). */
   async getValidClaudeAccessToken() {
     return this.readConfig().claude?.accessToken ?? null;
@@ -5591,13 +7282,14 @@ var JsonSubscriptionCredentialStore = class {
   /**
    * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
    * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
-   * shape (id/label/status/expiresAt/hasAccessToken/isActive) — NEVER a token.
+   * shape (id/label/status/expiresAt/hasAccessToken/isActive) NEVER a token.
    * Used by the admin accounts GET (secret-IN-never-OUT).
    */
   async listSanitizedAccounts() {
     const config = this.readConfig();
-    const health2 = (0, import_SubscriptionAccountHealth.getSharedAccountHealth)();
-    const identityStore = (0, import_SubscriptionIdentityStore.getSharedIdentityStore)();
+    const health2 = (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)();
+    const allowanceScheduling = (0, import_AccountAllowanceScheduling3.getSharedAccountAllowanceScheduling)();
+    const identityStore = (0, import_SubscriptionIdentityStore2.getSharedIdentityStore)();
     const fingerprintOn = identityStore.isEnabled();
     const now = Date.now();
     const out = {};
@@ -5606,7 +7298,13 @@ var JsonSubscriptionCredentialStore = class {
       if (sanitized.length === 0) continue;
       for (const account of sanitized) {
         const status = health2.getStatus(provider, account.id, now);
+        const allowance = allowanceScheduling.preview(provider, account.id, account.priority ?? 50, now);
         account.health = status.state;
+        account.schedulable = account.enabled && status.state === "healthy" && allowance.schedulable;
+        account.allowanceAction = allowance.action;
+        account.allowanceEffectivePriority = allowance.effectivePriority;
+        account.allowanceUsedPercent = allowance.usedPercent;
+        account.allowanceResumeAt = allowance.resumeAt;
         account.cooldownUntil = status.cooldownUntil !== void 0 ? new Date(status.cooldownUntil).toISOString() : void 0;
         if (fingerprintOn && provider === "claude") {
           account.identityCaptured = identityStore.hasIdentity(provider, account.id);
@@ -5614,31 +7312,25 @@ var JsonSubscriptionCredentialStore = class {
           account.identityCapturedAt = capturedAt !== void 0 ? new Date(capturedAt).toISOString() : void 0;
         }
       }
-      out[provider] = this.attachSyncWarnings(config, provider, sanitized);
+      out[provider] = this.attachDuplicateWarnings(config, provider, sanitized);
     }
     return out;
   }
   /**
-   * List-time credential-conflict warnings (external-cli-sync). Computed, not
-   * persisted: (a) `duplicate-token` when two accounts of one provider share a
-   * credential, (b) `external-divergent` when the external CLI native store has
-   * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
-   * a failed refresh (`external-not-rotated`) takes precedence — it is the most
-   * actionable state.
+   * List-time managed-credential conflict warnings. Computed, not persisted:
+   * `duplicate-token` is projected when two accounts of one provider share a
+   * credential. This deliberately does not inspect either native CLI file.
    */
-  attachSyncWarnings(config, provider, sanitized) {
+  attachDuplicateWarnings(config, provider, sanitized) {
     const duplicates = findDuplicateCredentialIds(listAccounts(config, provider));
-    let divergentId;
-    if (provider === "claude" || provider === "codex") {
-      const active = getActiveAccount(config, provider);
-      if (active && isExternalDivergent(active.tokens, this.safeReadExternal(provider))) {
-        divergentId = active.id;
-      }
-    }
-    if (duplicates.size === 0 && !divergentId) return sanitized;
     return sanitized.map((account) => {
-      const computed = account.id === divergentId ? "external-divergent" : duplicates.has(account.id) ? "duplicate-token" : void 0;
-      return { ...account, syncWarning: account.syncWarning ?? computed };
+      const computed = duplicates.has(account.id) ? "duplicate-token" : void 0;
+      const persisted = account.syncWarning === "duplicate-token" ? account.syncWarning : void 0;
+      if (!persisted && !computed) {
+        const { syncWarning: _obsoleteWarning, ...withoutWarning } = account;
+        return withoutWarning;
+      }
+      return { ...account, syncWarning: persisted ?? computed };
     });
   }
   /** Read the external CLI store, never letting an fs/parse error escape. */
@@ -5651,11 +7343,11 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
-   * the block has no refresh_token (setup-token / manual) — no upstream call, the
+   * the block has no refresh_token (setup-token / manual) no upstream call, the
    * block is untouched. Otherwise mint via the shared claude refresh flow and
    * write back access+refresh+expiresAt+status:authorized+lastRefreshedAt.
-   * On failure → status:expired +
-   * errorMessage → `false`.
+   * On failure status:expired +
+   * errorMessage `false`.
    */
   async refreshClaudeToken() {
     return this.coalesce("claude:active", async () => {
@@ -5680,19 +7372,8 @@ var JsonSubscriptionCredentialStore = class {
           syncWarning: void 0
         };
         this.writeBackById("claude", capturedId, next);
-        this.resyncExternal("claude", capturedId, next);
         return true;
       } catch (error) {
-        if (await this.tryExternalImport("claude", capturedId, claude, async (rt) => {
-          const r = await import_subscriptions3.claudeOAuth.refreshAccessToken(rt, refreshFetch);
-          return {
-            accessToken: r.accessToken,
-            refreshToken: r.refreshToken,
-            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
-          };
-        })) {
-          return true;
-        }
         this.markExpiredById("claude", capturedId, claude, error);
         return false;
       }
@@ -5727,20 +7408,8 @@ var JsonSubscriptionCredentialStore = class {
           syncWarning: void 0
         };
         this.writeBackById("codex", capturedId, next);
-        this.resyncExternal("codex", capturedId, next);
         return true;
       } catch (error) {
-        if (await this.tryExternalImport("codex", capturedId, codex, async (rt) => {
-          const r = await import_subscriptions3.codexOAuth.refreshAccessToken(rt, refreshFetch);
-          return {
-            accessToken: r.accessToken,
-            refreshToken: r.refreshToken,
-            idToken: r.idToken,
-            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
-          };
-        })) {
-          return true;
-        }
         this.markExpiredById("codex", capturedId, codex, error);
         return false;
       }
@@ -5783,11 +7452,10 @@ var JsonSubscriptionCredentialStore = class {
     });
   }
   /**
-   * Refresh a SPECIFIC account by id (background scheduler sweep,
-   * external-cli-sync). Unlike the active-account refreshers it does NOT
-   * attempt the external-import fallback — the external CLI file's lineage can
-   * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
-   * failure flags ONLY that account `expired`.
+   * Refresh a SPECIFIC managed account by id (background scheduler sweep and
+   * account-pool resolution). It uses only that account's stored refresh
+   * token. Coalesced per `provider:id`; on failure flags ONLY that account
+   * `expired`.
    */
   async refreshAccountById(provider, id) {
     return this.coalesce(`${provider}:${id}`, async () => {
@@ -5801,7 +7469,7 @@ var JsonSubscriptionCredentialStore = class {
         const next = {
           ...captured,
           accessToken: refreshed.accessToken,
-          // Gemini's refresh response omits a new refresh token — keep the captured.
+          // Gemini's refresh response omits a new refresh token keep the captured.
           refreshToken: refreshed.refreshToken ?? captured.refreshToken,
           expiresAt: refreshed.expiresAt,
           status: "authorized",
@@ -5811,7 +7479,6 @@ var JsonSubscriptionCredentialStore = class {
         };
         if (refreshed.idToken) next.idToken = refreshed.idToken;
         this.writeBackById(provider, id, next);
-        if (provider !== "gemini") this.resyncExternal(provider, id, next);
         return true;
       } catch (error) {
         this.markExpiredById(provider, id, captured, error);
@@ -5819,7 +7486,7 @@ var JsonSubscriptionCredentialStore = class {
       }
     });
   }
-  // ── By-id account-pool surface (subscription-account-scheduling, design D6) ──
+  // By-id account-pool surface (subscription-account-scheduling, design D6)
   /**
    * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
    * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -5852,7 +7519,7 @@ var JsonSubscriptionCredentialStore = class {
   /**
    * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
    * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
-   * → `false` (no refresh affordance).
+   * `false` (no refresh affordance).
    */
   async refreshAccountToken(providerId, accountId) {
     if (providerId === "opencodego") return false;
@@ -5874,7 +7541,7 @@ var JsonSubscriptionCredentialStore = class {
    * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
    * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
    * an unknown id. Called by the identity store's persistence port on a first-seen
-   * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+   * freeze / TTL refresh, so it stays infrequent. Never throws to the caller the
    * store's port wrapper swallows a rejection so the relay hot path is unaffected.
    */
   async setAccountIdentity(providerId, accountId, identity) {
@@ -5899,7 +7566,7 @@ var JsonSubscriptionCredentialStore = class {
    * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
    * the port). Passing `undefined` clears the override. Write-only password: when
    * the incoming structured proxy omits the password but the account already had
-   * one, the current (decrypted) password is preserved — editing host/port never
+   * one, the current (decrypted) password is preserved editing host/port never
    * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
    */
   async setAccountProxy(providerId, accountId, proxy) {
@@ -5934,75 +7601,25 @@ var JsonSubscriptionCredentialStore = class {
       expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
     };
   }
-  /**
-   * External-import fallback for a FAILED active-account refresh
-   * (external-cli-sync). Reads the CLI native store; imports when the external
-   * lineage ROTATED (different refresh token) or its access token is still
-   * valid. When the imported access token is already expired it refreshes once
-   * with the rotated refresh token. A `not-rotated` outcome persists the
-   * `external-not-rotated` warning on the (about-to-be-expired) account so the
-   * UI can tell "genuine revocation" apart from a plain refresh failure.
-   */
-  async tryExternalImport(provider, capturedId, captured, refreshWithToken) {
-    const markerOwner = this.safeReadMarker(provider);
-    if (markerOwner && markerOwner !== capturedId) return false;
-    const external = this.safeReadExternal(provider);
-    const decision = decideExternalImport(captured, external);
-    if (decision === "not-rotated") {
-      captured.syncWarning = "external-not-rotated";
-      return false;
-    }
-    if (decision !== "import" || !external) return false;
-    let imported = buildImportedTokens(
-      captured,
-      external
-    );
-    const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > Date.now() + 6e4 : true;
-    if (!accessStillValid) {
-      try {
-        const refreshed = await refreshWithToken(external.refreshToken);
-        imported = {
-          ...imported,
-          accessToken: refreshed.accessToken,
-          refreshToken: refreshed.refreshToken ?? imported.refreshToken,
-          expiresAt: refreshed.expiresAt,
-          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        if (refreshed.idToken) imported.idToken = refreshed.idToken;
-      } catch {
-        return false;
-      }
-    }
-    this.writeBackById(provider, capturedId, imported);
-    this.resyncExternal(provider, capturedId, imported);
-    return true;
-  }
-  /**
-   * Marker-gated external write-back (external-cli-sync). After a successful
-   * refresh of the account that OWNS the provider's native CLI store (imported
-   * via `importExternalCliAccount`), push the rotated credential back into the
-   * file — otherwise the daemon's refresh invalidates the single-use refresh
-   * token and silently logs the bare CLI out. NON-FATAL: the internal store is
-   * already persisted; a failed external write only leaves the file stale,
-   * which the `external-divergent` warning surfaces.
-   */
-  resyncExternal(provider, accountId, tokens) {
-    try {
-      this.externalCliStore.writeBack(provider, accountId, tokens);
-    } catch {
-    }
+  /** Atomically patch one account's non-secret management metadata. */
+  async patchAccountMetadata(providerId, accountId, patch) {
+    const config = this.readConfig();
+    const result = patchAccountMetadata(config, providerId, accountId, patch);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
   }
-  /** Read the marker's owning account id, never letting an fs error escape. */
-  safeReadMarker(provider) {
-    try {
-      return this.externalCliStore.readMarkerAccountId(provider);
-    } catch {
-      return void 0;
-    }
+  /** Validate every target, then persist one all-or-nothing batch mutation. */
+  async batchManageAccounts(refs, mutation) {
+    const config = this.readConfig();
+    const result = batchManageAccounts(config, refs, mutation);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
   }
   /**
    * DAEMON-ONLY (admin import button): which providers have a usable external
-   * CLI credential on THIS machine. Pure detection — reads the native files,
+   * CLI credential on THIS machine. Pure detection reads the native files,
    * never mutates anything, never returns a token.
    */
   async listExternalCliAvailability() {
@@ -6013,21 +7630,22 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY (admin import button): import the external CLI's current login
-   * as a NEW account (+ activate), and take MANAGED ownership of the native
-   * store (marker) so subsequent refreshes write back — keeping the bare CLI
-   * and the daemon on the same live credential instead of silently killing one
-   * side's single-use refresh token.
+   * as a NEW account (+ activate). This is a COPY-ONLY import: Omnicross never
+   * claims, writes, moves, restores, or deletes the native CLI credential file
+   * or any legacy `.omnicross-managed` marker/backup beside it. Subsequent
+   * refreshes persist only Omnicross's encrypted token store.
    */
   async importExternalCliAccount(provider, label) {
     const external = this.safeReadExternal(provider);
     if (!external?.accessToken) return { ok: false, reason: "no-credential" };
     const tokens = buildTokensFromExternal(provider, external);
     const result = await this.appendProviderAccount(provider, tokens, label);
-    try {
-      this.externalCliStore.writeMarker(provider, result.id);
-    } catch {
-    }
-    return { ok: true, id: result.id };
+    return {
+      ok: true,
+      id: result.id,
+      nativeCredentialMode: "read-only",
+      refreshWritesNativeCredentials: false
+    };
   }
   /**
    * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
@@ -6060,7 +7678,8 @@ var JsonSubscriptionCredentialStore = class {
     this.writeBackById(providerId, capturedId, {
       ...block,
       status: "expired",
-      errorMessage
+      errorMessage,
+      syncWarning: "syncWarning" in block && block.syncWarning === "duplicate-token" ? "duplicate-token" : void 0
     });
   }
   /**
@@ -6069,7 +7688,7 @@ var JsonSubscriptionCredentialStore = class {
    * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
    * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
    * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
-   * so a first-ever write still produces a valid config. No cache → the next read
+   * so a first-ever write still produces a valid config. No cache the next read
    * sees this write.
    */
   async writeProviderTokens(providerId, config) {
@@ -6079,7 +7698,7 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
-   * (optional label) and set it active, then re-derive the mirror — used by
+   * (optional label) and set it active, then re-derive the mirror used by
    * `omnicross login <provider> --label` to add an account instead of overwriting.
    */
   async appendProviderAccount(providerId, config, label) {
@@ -6113,7 +7732,7 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
-   * rejects an unknown id. Label-only — no token material is read or written
+   * rejects an unknown id. Label-only no token material is read or written
    * (the secret-free invariant holds).
    */
   async renameAccount(providerId, id, label) {
@@ -6136,12 +7755,12 @@ var JsonSubscriptionCredentialStore = class {
   }
   /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
    *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
-   *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
-   *  write — incl. child 4's future refresh writes — lands encrypted. */
+   *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
+   *  write incl. child 4's future refresh writes lands encrypted. */
   persist(config) {
-    (0, import_node_fs13.mkdirSync)((0, import_node_path7.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs16.mkdirSync)((0, import_node_path10.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    (0, import_node_fs13.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    (0, import_node_fs16.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
   /**
    * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -6149,18 +7768,18 @@ var JsonSubscriptionCredentialStore = class {
    * subscription bearer path is byte-identical).
    *
    * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
-   * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
+   * file empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
    * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
-   * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
-   * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
-   * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
+   * box's clear, secret-free error (secrets spec "/ UX":
+   * SHALL fail-fast, SHALL NOT a swallowed decrypt would report "no
+   * tokens" and silently send the WRONG bearer upstream 401). Mirrors
    * `config.ts loadConfig`, which decrypts outside its parse try.
    */
   readConfig() {
-    if (!(0, import_node_fs13.existsSync)(this.tokensPath)) return { updatedAt: "" };
+    if (!(0, import_node_fs16.existsSync)(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse((0, import_node_fs13.readFileSync)(this.tokensPath, "utf8"));
+      const raw = JSON.parse((0, import_node_fs16.readFileSync)(this.tokensPath, "utf8"));
       parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
     } catch {
       parsed = null;
@@ -6172,7 +7791,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/ProbeStrategy.ts
 var PROVIDER_PROBE_PLANS = {
@@ -6215,7 +7834,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch4.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch5.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -6488,8 +8107,8 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-var import_node_fs14 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path11 = require("path");
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6515,8 +8134,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6563,16 +8182,16 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!(0, import_node_fs14.existsSync)(this.auditDir)) return 0;
+      if (!(0, import_node_fs17.existsSync)(this.auditDir)) return 0;
       const today = new Date(this.now());
       const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
       const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
       let removed = 0;
-      for (const file of (0, import_node_fs14.readdirSync)(this.auditDir)) {
+      for (const file of (0, import_node_fs17.readdirSync)(this.auditDir)) {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs14.unlinkSync)((0, import_node_path8.join)(this.auditDir, file));
+          (0, import_node_fs17.unlinkSync)((0, import_node_path11.join)(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6595,26 +8214,26 @@ var AuditPruneSweeper = class {
 };
 
 // src/audit/auditReader.ts
-var import_node_fs15 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path12 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!(0, import_node_fs15.existsSync)(auditDir)) return [];
+function readAuditRecords(auditDir2, query2 = {}) {
+  if (!(0, import_node_fs18.existsSync)(auditDir2)) return [];
   let files;
   try {
-    files = (0, import_node_fs15.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = (0, import_node_fs18.readdirSync)(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
-  const from = typeof query.from === "number" ? query.from : -Infinity;
-  const to = typeof query.to === "number" ? query.to : Infinity;
-  const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit ?? DEFAULT_LIMIT)));
+  const from = typeof query2.from === "number" ? query2.from : -Infinity;
+  const to = typeof query2.to === "number" ? query2.to : Infinity;
+  const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
   const matched = [];
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = (0, import_node_fs15.readFileSync)((0, import_node_path9.join)(auditDir, file), "utf8");
+      raw = (0, import_node_fs18.readFileSync)((0, import_node_path12.join)(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6628,7 +8247,7 @@ function readAuditRecords(auditDir, query = {}) {
         continue;
       }
       if (!isAuditRecord(rec)) continue;
-      if (query.keyId !== void 0 && rec.keyId !== query.keyId) continue;
+      if (query2.keyId !== void 0 && rec.keyId !== query2.keyId) continue;
       if (rec.ts < from || rec.ts > to) continue;
       matched.push(rec);
     }
@@ -6643,11 +8262,11 @@ function isAuditRecord(value) {
 }
 
 // src/audit/AuditWriter.ts
-var import_node_fs16 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs19 = require("fs");
+var import_node_path13 = require("path");
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6677,19 +8296,19 @@ var AuditWriter = class {
    */
   appendNow(record) {
     if (!this.dirEnsured) {
-      (0, import_node_fs16.mkdirSync)(this.auditDir, { recursive: true });
+      (0, import_node_fs19.mkdirSync)(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = (0, import_node_path10.join)(this.auditDir, auditFileName(record.ts));
-    (0, import_node_fs16.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
+    const file = (0, import_node_path13.join)(this.auditDir, auditFileName(record.ts));
+    (0, import_node_fs19.appendFileSync)(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
 
 // src/billing/BillingPublisher.ts
-var import_node_fs17 = require("fs");
-var import_node_crypto10 = require("crypto");
-var import_node_path11 = require("path");
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_node_fs20 = require("fs");
+var import_node_crypto13 = require("crypto");
+var import_node_path14 = require("path");
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6712,7 +8331,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch5.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -6759,8 +8378,8 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = (0, import_node_path11.join)(this.billingDir, billingFileName(event.ts));
-    (0, import_node_fs17.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
+    const file = (0, import_node_path14.join)(this.billingDir, billingFileName(event.ts));
+    (0, import_node_fs20.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
    * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
@@ -6777,7 +8396,7 @@ var BillingPublisher = class {
       const headers = { "Content-Type": "application/json" };
       const secret = this.config?.secret;
       if (secret) {
-        const hmac = (0, import_node_crypto10.createHmac)("sha256", secret).update(body).digest("hex");
+        const hmac = (0, import_node_crypto13.createHmac)("sha256", secret).update(body).digest("hex");
         headers["X-Omnicross-Billing-Signature"] = `sha256=${hmac}`;
       }
       const res = await this.fetchImpl(endpoint, {
@@ -6809,8 +8428,8 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = (0, import_node_path11.join)(this.billingDir, deliveredFileName(event.ts));
-      (0, import_node_fs17.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
+      const file = (0, import_node_path14.join)(this.billingDir, deliveredFileName(event.ts));
+      (0, import_node_fs20.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
         error: error instanceof Error ? error.message : String(error)
@@ -6819,20 +8438,20 @@ var BillingPublisher = class {
   }
   ensureDir() {
     if (this.dirEnsured) return;
-    (0, import_node_fs17.mkdirSync)(this.billingDir, { recursive: true });
+    (0, import_node_fs20.mkdirSync)(this.billingDir, { recursive: true });
     this.dirEnsured = true;
   }
 };
 
 // src/billing/billingReader.ts
-var import_node_fs18 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path15 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!(0, import_node_fs18.existsSync)(billingDir)) return view;
+  if (!(0, import_node_fs21.existsSync)(billingDir)) return view;
   let files;
   try {
-    files = (0, import_node_fs18.readdirSync)(billingDir);
+    files = (0, import_node_fs21.readdirSync)(billingDir);
   } catch {
     return view;
   }
@@ -6863,7 +8482,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs18.readFileSync)((0, import_node_path12.join)(dir, file), "utf8");
+    raw = (0, import_node_fs21.readFileSync)((0, import_node_path15.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7018,8 +8637,9 @@ var TokenRefreshScheduler = class {
     const expiresAt = Date.parse(t.expiresAt);
     return Number.isFinite(expiresAt) && now >= expiresAt - this.leadMs;
   }
-  /** Refresh one account; failures are logged, never thrown (the store has
-   *  already flagged the account `expired`). */
+  /** Refresh one managed account; failures are logged, never thrown. The
+   * store marks only the targeted account `expired` on a failed refresh.
+   */
   async refreshOne(provider, id, isActive) {
     try {
       const ok = isActive ? await this.refreshActive(provider) : await this.store.refreshAccountById(provider, id);
@@ -7049,8 +8669,8 @@ var TokenRefreshScheduler = class {
 };
 
 // src/webhook/WebhookDispatcher.ts
-var import_node_crypto11 = require("crypto");
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_node_crypto14 = require("crypto");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -7070,7 +8690,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -7181,7 +8801,7 @@ function buildCustom(event, dest) {
   const body = JSON.stringify(event);
   const headers = {};
   if (dest.secret) {
-    const hmac = (0, import_node_crypto11.createHmac)("sha256", dest.secret).update(body).digest("hex");
+    const hmac = (0, import_node_crypto14.createHmac)("sha256", dest.secret).update(body).digest("hex");
     headers["X-Omnicross-Signature"] = `sha256=${hmac}`;
   }
   return { body, headers };
@@ -7196,7 +8816,7 @@ function buildFeishu(event, dest, nowMs) {
     const stringToSign = `${timestamp}
 ${dest.secret}`;
     payload["timestamp"] = timestamp;
-    payload["sign"] = (0, import_node_crypto11.createHmac)("sha256", stringToSign).digest("base64");
+    payload["sign"] = (0, import_node_crypto14.createHmac)("sha256", stringToSign).digest("base64");
   }
   return { body: JSON.stringify(payload), headers: {} };
 }
@@ -7224,11 +8844,32 @@ function buildDaemon(config, paths) {
   setSecretBox(secretBox3);
   setSecretBox2(secretBox3);
   const decryptedConfig = decryptConfigSecrets(config, secretBox3);
+  const accountAllowanceStore = new import_AccountAllowanceStore4.AccountAllowanceStore(
+    Date.now,
+    void 0,
+    new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
+  );
+  (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
+  (0, import_AccountAllowanceScheduling4.getSharedAccountAllowanceScheduling)().configure(
+    (0, import_outbound_api4.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+  );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
   const keyDb = new JsonOutboundKeyDb(paths.keysPath);
   const voucherDb = new JsonVoucherDb(defaultVouchersPath(paths.configPath));
   const settingsStore = new JsonApiServerSettingsStore(paths.configPath, secretBox3);
+  const integrationStateStore = new IntegrationStateStore(
+    defaultIntegrationsPath(paths.configPath),
+    secretBox3
+  );
   const credentialStore = new JsonSubscriptionCredentialStore(paths.tokensPath, secretBox3);
+  const accountAllowanceService = new AccountAllowanceService(credentialStore, accountAllowanceStore);
+  const claudeAllowanceRefreshScheduler = new ClaudeAllowanceRefreshScheduler(
+    accountAllowanceService,
+    logger
+  );
+  claudeAllowanceRefreshScheduler.configure(
+    (0, import_outbound_api4.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+  );
   const subscriptionAccounts = new import_subscriptions4.SubscriptionAccountService(credentialStore);
   (0, import_subscriptions4.setSubscriptionAccountService)(subscriptionAccounts);
   const subscriptionRegistry = new import_subscriptions4.SubscriptionProviderRegistry(
@@ -7237,7 +8878,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_subscriptions4.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch7.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch8.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
@@ -7257,7 +8898,17 @@ function buildDaemon(config, paths) {
     }
   );
   const pricingStore = new JsonPricingStore(defaultPricingPath(paths.configPath));
-  const pricingEngine = new import_usage.PricingEngine(pricingStore, logger);
+  const pricingEngine = new import_usage.PricingEngine(pricingStore, logger, {
+    // Catalog egress follows the same global/env proxy policy as every other
+    // daemon upstream call; no provider/account override applies here.
+    fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
+  });
+  const pricingRefreshScheduler = new PricingRefreshScheduler(
+    pricingEngine,
+    pricingStore,
+    defaultPricingRefreshStatePath(paths.configPath),
+    logger
+  );
   const usageEventStore = new JsonlUsageEventStore(
     defaultUsageEventsPath(paths.configPath),
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
@@ -7270,7 +8921,7 @@ function buildDaemon(config, paths) {
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
   const accountHealthProbeScheduler = new AccountHealthProbeScheduler(
     credentialStore,
-    (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
     logger,
     import_outbound_api4.DEFAULT_ACCOUNT_PROBE
   );
@@ -7304,7 +8955,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7318,6 +8969,9 @@ function buildDaemon(config, paths) {
     settingsStore,
     outboundApiServer,
     subscriptionAccounts,
+    accountAllowanceService,
+    allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
+    accountProbeService: accountHealthProbeScheduler,
     // Least-authority token WRITER (design D4) — the concrete credential store
     // exposes `writeProviderTokens` / `clearProvider` as daemon-only methods (NOT
     // on the `SubscriptionCredentialStore` port). The admin API sees ONLY these two
@@ -7338,7 +8992,7 @@ function buildDaemon(config, paths) {
     // inject a mock so no real token endpoint is hit.
     // upstream-proxy: default the OAuth token-exchange fetch to the proxy-aware
     // helper so interactive login honors a configured proxy (global/env layers).
-    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init)),
+    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -7356,6 +9010,16 @@ function buildDaemon(config, paths) {
     cliTerminalOpener: paths.cliTerminalOpener,
     cliPathProbe: paths.cliPathProbe,
     cliCommandRunner: paths.cliCommandRunner,
+    integrationManagerFactory: () => {
+      const live = outboundApiServer.getStatus();
+      const port = live.port || decryptedConfig.server?.port || import_outbound_api4.DEFAULT_OUTBOUND_PORT;
+      return new IntegrationManager({
+        configPath: paths.configPath,
+        gatewayBaseUrl: live.loopbackUrl ?? `http://127.0.0.1:${port}`,
+        keyDb,
+        stateStore: integrationStateStore
+      });
+    },
     // Usage/pricing admin surface (usage-pricing child): stats queries go
     // through the recorder facade, pricing mutations through the engine, and
     // the row DELETE through the concrete store (delete is store-local — the
@@ -7380,19 +9044,19 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query2) => readAuditRecords(auditDir2, query2),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
   });
-  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)());
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, import_audit_types.DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -7404,7 +9068,7 @@ function buildDaemon(config, paths) {
   const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
   const accountHealthSweeper = new AccountHealthSweeper(
     credentialStore,
-    (0, import_SubscriptionAccountHealth2.getSharedAccountHealth)(),
+    (0, import_SubscriptionAccountHealth3.getSharedAccountHealth)(),
     logger
   );
   return {
@@ -7419,8 +9083,11 @@ function buildDaemon(config, paths) {
     credentialStore,
     subscriptionRegistry,
     subscriptionAccounts,
+    accountAllowanceService,
+    claudeAllowanceRefreshScheduler,
     pricingStore,
     pricingEngine,
+    pricingRefreshScheduler,
     usageRecorder,
     adminServer,
     tokenRefreshScheduler,
@@ -7439,7 +9106,7 @@ function resetDaemonSingletonsForTests() {
   (0, import_subscriptionRegistryPort.setSubscriptionRegistryForOutbound)(null);
   (0, import_subscriptions4.setSubscriptionProviderRegistry)(null);
   (0, import_subscriptions4.setSubscriptionAccountService)(null);
-  (0, import_upstreamFetch7.setUpstreamProxyResolver)(null);
+  (0, import_upstreamFetch8.setUpstreamProxyResolver)(null);
   setServerProxyConfig(void 0);
   (0, import_gemini_code_assist_resolver.setGeminiCodeAssistResolver)(null);
   setSecretBox(null);
@@ -7447,12 +9114,14 @@ function resetDaemonSingletonsForTests() {
   resetWebhookRuntimeForTests();
   resetAuditRuntimeForTests();
   resetBillingRuntimeForTests();
-  (0, import_SubscriptionIdentityStore2.__resetSharedIdentityStoreForTests)();
+  (0, import_SubscriptionIdentityStore3.__resetSharedIdentityStoreForTests)();
+  (0, import_AccountAllowanceStore4.__resetSharedAccountAllowanceStoreForTests)();
+  (0, import_AccountAllowanceScheduling4.__resetSharedAccountAllowanceSchedulingForTests)();
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!(0, import_node_fs19.existsSync)(tokensPath)) return true;
-    (0, import_node_fs19.accessSync)(tokensPath, import_node_fs19.constants.R_OK);
+    if (!(0, import_node_fs22.existsSync)(tokensPath)) return true;
+    (0, import_node_fs22.accessSync)(tokensPath, import_node_fs22.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -7498,6 +9167,9 @@ function inferApiFormat(provider) {
   if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
     return { format: "gemini", ambiguous: false };
   }
+  if (hay.includes("/responses")) {
+    return { format: "openai-response", ambiguous: false };
+  }
   if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
     return { format: "openai", ambiguous: false };
   }