@omnicross/daemon 0.1.4 → 0.1.6

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/bootstrap.ts
-import { accessSync, constants as fsConstants, existsSync as existsSync14 } from "fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync17 } from "fs";
 import { DEFAULT_AUDIT_CONFIG } from "@omnicross/contracts/audit-types";
 import { DEFAULT_BILLING_CONFIG } from "@omnicross/contracts/billing-types";
 import { getGeminiCodeAssistProjectResolver } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
@@ -7,11 +7,22 @@ import { ApiKeyPoolService } from "@omnicross/core/completion/ApiKeyPoolService"
 import {
   __resetOutboundApiServerForTests,
   DEFAULT_ACCOUNT_PROBE,
-  getOutboundApiServer
+  DEFAULT_OUTBOUND_PORT,
+  getOutboundApiServer,
+  normalizeServerConfig
 } from "@omnicross/core/outbound-api";
 import { setSubscriptionRegistryForOutbound } from "@omnicross/core/outbound-api/subscriptionRegistryPort";
-import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
-import { fetchUpstream as fetchUpstream6, setUpstreamProxyResolver } from "@omnicross/core/pipeline/upstreamFetch";
+import { getSharedAccountHealth as getSharedAccountHealth3 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import {
+  __resetSharedAccountAllowanceStoreForTests,
+  AccountAllowanceStore as AccountAllowanceStore3,
+  setSharedAccountAllowanceStore
+} from "@omnicross/core/pipeline/AccountAllowanceStore";
+import {
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling4
+} from "@omnicross/core/pipeline/AccountAllowanceScheduling";
+import { fetchUpstream as fetchUpstream7, setUpstreamProxyResolver } from "@omnicross/core/pipeline/upstreamFetch";
 import { __resetSharedIdentityStoreForTests } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
 import { setGeminiCodeAssistResolver } from "@omnicross/core/ports/gemini-code-assist-resolver";
 import {
@@ -132,6 +143,462 @@ function handleCodexOAuthStatus(sessionId, deps) {
   return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
 }
 
+// src/allowance/AccountAllowanceService.ts
+import {
+  getSharedAccountAllowanceStore as getSharedAccountAllowanceStore2
+} from "@omnicross/core/pipeline/AccountAllowanceStore";
+import {
+  getSharedAccountAllowanceScheduling
+} from "@omnicross/core/pipeline/AccountAllowanceScheduling";
+
+// src/allowance/ClaudeAllowanceCollector.ts
+import {
+  getSharedAccountAllowanceStore
+} from "@omnicross/core/pipeline/AccountAllowanceStore";
+import { fetchUpstream } from "@omnicross/core/pipeline/upstreamFetch";
+import { applyFingerprint } from "@omnicross/core/provider-proxy/identity/fingerprintHeaders";
+import {
+  getSharedIdentityStore
+} from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
+var CLAUDE_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+function finitePercent(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const number = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(number) && number >= 0 && number <= 100 ? number : null;
+}
+function isoInstant(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const time = Date.parse(value);
+  return Number.isFinite(time) ? new Date(time).toISOString() : void 0;
+}
+function secondsUntil(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function windowFromPayload(id, payload, now) {
+  const usedPercent = finitePercent(payload?.utilization);
+  const resetsAt = isoInstant(payload?.resets_at);
+  const isSonnet = id === "seven-day-sonnet";
+  const isFiveHour = id === "five-hour";
+  return {
+    id,
+    label: isFiveHour ? "5 hours" : isSonnet ? "7 days \xB7 Sonnet" : "7 days",
+    scope: isSonnet ? "model-family" : "all",
+    modelFamily: isSonnet ? "sonnet" : void 0,
+    usedPercent,
+    windowMinutes: isFiveHour ? 5 * 60 : 7 * 24 * 60,
+    resetsAt,
+    remainingSeconds: secondsUntil(resetsAt, now),
+    state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+  };
+}
+function emptyClaudeWindows(state) {
+  return [
+    {
+      id: "five-hour",
+      label: "5 hours",
+      scope: "all",
+      usedPercent: null,
+      windowMinutes: 5 * 60,
+      state
+    },
+    {
+      id: "seven-day",
+      label: "7 days",
+      scope: "all",
+      usedPercent: null,
+      windowMinutes: 7 * 24 * 60,
+      state
+    },
+    {
+      id: "seven-day-sonnet",
+      label: "7 days \xB7 Sonnet",
+      scope: "model-family",
+      modelFamily: "sonnet",
+      usedPercent: null,
+      windowMinutes: 7 * 24 * 60,
+      state
+    }
+  ];
+}
+function hasHeader(headers, name) {
+  const wanted = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === wanted);
+}
+var ClaudeAllowanceCollector = class {
+  constructor(credentials, store = getSharedAccountAllowanceStore(), fetchImpl = (url, init, accountId) => fetchUpstream(url, init, { providerId: "claude", accountId }), identityStore = getSharedIdentityStore(), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.identityStore = identityStore;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  identityStore;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    const unsupported = account.tokens.isSetupToken || account.tokens.authMethod !== "oauth";
+    if (unsupported) {
+      const existing = this.store.get("claude", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) return Promise.resolve(existing);
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("claude", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) return Promise.resolve(cached);
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id).catch(() => this.failureSnapshot(account.id, "claude_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.source !== "oauth-usage-api") return false;
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId) {
+    let token = await this.credentials.getAccessTokenForAccount("claude", accountId);
+    if (!token) return this.failureSnapshot(accountId, "claude_usage_token_unavailable", this.now());
+    let response = await this.request(accountId, token);
+    if (response.status === 401) {
+      const refreshed = await this.credentials.refreshAccountToken("claude", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "claude_usage_unauthorized", this.now());
+      token = await this.credentials.getAccessTokenForAccount("claude", accountId);
+      if (!token) return this.failureSnapshot(accountId, "claude_usage_token_unavailable", this.now());
+      response = await this.request(accountId, token);
+    }
+    if (response.status === 403) {
+      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "claude_usage_unsupported");
+      this.store.set(snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) {
+      return this.failureSnapshot(accountId, "claude_usage_http_error", this.now());
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(accountId, "claude_usage_invalid_response", this.now());
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      return this.failureSnapshot(accountId, "claude_usage_invalid_response", this.now());
+    }
+    const now = this.now();
+    const usage = payload;
+    const snapshot = {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        windowFromPayload("five-hour", usage.five_hour, now),
+        windowFromPayload("seven-day", usage.seven_day, now),
+        windowFromPayload("seven-day-sonnet", usage.seven_day_sonnet, now)
+      ]
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  request(accountId, token) {
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      "anthropic-beta": "oauth-2025-04-20",
+      "Accept-Language": "en-US,en;q=0.9"
+    };
+    applyFingerprint(this.identityStore, headers, "claude", accountId, void 0);
+    if (!hasHeader(headers, "user-agent")) {
+      headers["User-Agent"] = "claude-cli/2.0.53 (external, cli)";
+    }
+    return this.fetchImpl(CLAUDE_USAGE_URL, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("claude", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: emptyClaudeWindows("unavailable"),
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now, code = "claude_usage_unsupported_auth") {
+    return {
+      providerId: "claude",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: emptyClaudeWindows("unsupported"),
+      lastErrorCode: code
+    };
+  }
+};
+
+// src/allowance/AccountAllowanceService.ts
+function codexUnavailable(accountId, now) {
+  return {
+    providerId: "codex",
+    accountId,
+    source: "response-headers",
+    observedAt: new Date(now).toISOString(),
+    windows: [
+      { id: "primary", label: "Primary", scope: "all", usedPercent: null, state: "unavailable" },
+      { id: "secondary", label: "Secondary", scope: "all", usedPercent: null, state: "unavailable" }
+    ],
+    lastErrorCode: "codex_allowance_not_observed"
+  };
+}
+var AccountAllowanceService = class {
+  constructor(credentials, store = getSharedAccountAllowanceStore2(), collector, now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.now = now;
+    this.claudeCollector = collector ?? new ClaudeAllowanceCollector(credentials, store);
+  }
+  credentials;
+  store;
+  now;
+  claudeCollector;
+  /**
+   * Read all/filtered snapshots. Claude's five-minute cache is refreshed lazily;
+   * Codex remains passive and reports not-observed until a real model response.
+   */
+  async list(filter = {}) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    const wantsClaude = !filter.providerId || filter.providerId === "claude";
+    const claudeAccounts = (config.claudeAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsClaude) await this.claudeCollector.collectMany(claudeAccounts);
+    const wantsCodex = !filter.providerId || filter.providerId === "codex";
+    const codexAccounts = (config.codexAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsCodex) {
+      for (const account of codexAccounts) {
+        if (!this.store.get("codex", account.id)) this.store.set(codexUnavailable(account.id, this.now()));
+      }
+    }
+    const known = /* @__PURE__ */ new Set();
+    if (wantsClaude) for (const account of claudeAccounts) known.add(`claude\0${account.id}`);
+    if (wantsCodex) for (const account of codexAccounts) known.add(`codex\0${account.id}`);
+    return this.store.list(filter).filter((snapshot) => known.has(`${snapshot.providerId}\0${snapshot.accountId}`));
+  }
+  /** Force-refresh Claude usage for one account or every stored Claude account. */
+  async refreshClaude(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    const accounts = (config.claudeAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.claudeCollector.collectMany(accounts, { force: true });
+  }
+  /**
+   * Keep Claude snapshots warm for allowance-aware routing. This deliberately
+   * excludes Codex (whose quota is learned from real response headers) and
+   * preserves the collector's cache + per-account in-flight coalescing.
+   */
+  async maintainClaudeCache(refreshAheadMs) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts([
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
+    ]);
+    await this.claudeCollector.collectMany(config.claudeAccounts ?? [], { refreshAheadMs });
+  }
+  /** Remove a cache row as soon as an account is deleted by the admin path. */
+  removeAccountSnapshot(providerId, accountId) {
+    this.store.delete(providerId, accountId);
+  }
+  /** Remove all allowance rows for a provider block that was deleted. */
+  removeProviderSnapshots(providerId) {
+    for (const snapshot of this.store.list({ providerId })) {
+      this.store.delete(snapshot.providerId, snapshot.accountId);
+    }
+  }
+  /** Secret-free policy diagnostics for the settings/accounts UI. */
+  getSchedulingStatus() {
+    const scheduling = getSharedAccountAllowanceScheduling();
+    return { config: scheduling.getConfig(), history: scheduling.getHistory() };
+  }
+};
+
+// src/allowance/ClaudeAllowanceRefreshScheduler.ts
+var CLAUDE_ALLOWANCE_CHECK_INTERVAL_MS = 6e4;
+var CLAUDE_ALLOWANCE_REFRESH_AHEAD_MS = 9e4;
+var ClaudeAllowanceRefreshScheduler = class {
+  constructor(service, logger, intervalMs = CLAUDE_ALLOWANCE_CHECK_INTERVAL_MS, refreshAheadMs = CLAUDE_ALLOWANCE_REFRESH_AHEAD_MS) {
+    this.service = service;
+    this.logger = logger;
+    this.intervalMs = intervalMs;
+    this.refreshAheadMs = refreshAheadMs;
+  }
+  service;
+  logger;
+  intervalMs;
+  refreshAheadMs;
+  timer = null;
+  started = false;
+  enabled = false;
+  sweeping = false;
+  /**
+   * Apply live server policy. Once started, enable/disable changes arm or disarm
+   * immediately; the initial enabled sweep is fire-and-forget.
+   */
+  configure(config) {
+    const nextEnabled = config?.enabled === true;
+    if (this.enabled === nextEnabled) return;
+    this.enabled = nextEnabled;
+    if (!this.started) return;
+    if (nextEnabled) {
+      this.arm();
+      void this.sweep();
+    } else {
+      this.disarm();
+    }
+  }
+  /** Start the lifecycle. Disabled policy remains completely inert. */
+  start() {
+    if (this.started) return;
+    this.started = true;
+    if (!this.enabled) return;
+    this.arm();
+    void this.sweep();
+  }
+  /** Stop all future checks. Idempotent and safe during an in-flight refresh. */
+  dispose() {
+    this.started = false;
+    this.disarm();
+  }
+  /** One non-overlapping cache-maintenance pass. Exposed for focused tests. */
+  async sweep() {
+    if (!this.enabled || this.sweeping) return;
+    this.sweeping = true;
+    try {
+      await this.service.maintainClaudeCache(this.refreshAheadMs);
+    } catch (error) {
+      this.logger.warn("Claude allowance background refresh failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      this.sweeping = false;
+    }
+  }
+  arm() {
+    if (this.timer) return;
+    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  disarm() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+};
+
+// src/allowance/JsonAccountAllowancePersistence.ts
+import { randomUUID } from "crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+import { normalizeAccountAllowanceSnapshot } from "@omnicross/core/pipeline/AccountAllowanceStore";
+var ACCOUNT_ALLOWANCE_CACHE_VERSION = 1;
+var MAX_PERSISTED_ALLOWANCE_SNAPSHOTS = 256;
+var MAX_ALLOWANCE_CACHE_BYTES = 1e6;
+var JsonAccountAllowancePersistence = class {
+  constructor(cachePath) {
+    this.cachePath = cachePath;
+  }
+  cachePath;
+  /** Read only the `snapshots` payload; all row validation remains defensive. */
+  load() {
+    if (!existsSync(this.cachePath)) return [];
+    try {
+      if (statSync(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
+      const raw = readFileSync(this.cachePath, "utf8");
+      if (!raw.trim()) return [];
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) return parsed;
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+      const file = parsed;
+      return file.version === ACCOUNT_ALLOWANCE_CACHE_VERSION && Array.isArray(file.snapshots) ? file.snapshots : [];
+    } catch {
+      return [];
+    }
+  }
+  /** Replace the file atomically; the target remains intact if replacement fails. */
+  save(snapshots) {
+    const rows = [];
+    for (const snapshot of snapshots) {
+      const normalized = normalizeAccountAllowanceSnapshot(snapshot);
+      if (!normalized) continue;
+      rows.push(normalized);
+      if (rows.length >= MAX_PERSISTED_ALLOWANCE_SNAPSHOTS) break;
+    }
+    const file = {
+      version: ACCOUNT_ALLOWANCE_CACHE_VERSION,
+      snapshots: rows
+    };
+    const serialized = JSON.stringify(file, null, 2) + "\n";
+    if (Buffer.byteLength(serialized, "utf8") > MAX_ALLOWANCE_CACHE_BYTES) {
+      throw new Error("account allowance cache exceeds its size limit");
+    }
+    mkdirSync(dirname(this.cachePath), { recursive: true });
+    const temporaryPath = `${this.cachePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
+      renameSync(temporaryPath, this.cachePath);
+    } finally {
+      rmSync(temporaryPath, { force: true });
+    }
+  }
+};
+
 // src/admin/AdminServer.ts
 import { timingSafeEqual } from "crypto";
 import http2 from "http";
@@ -154,16 +621,16 @@ function intParam(value) {
 }
 function handleAuditQuery(req, res, reader) {
   const url = new URL(req.url ?? "/", "http://localhost");
-  const query = {};
+  const query2 = {};
   const keyId = url.searchParams.get("keyId");
-  if (keyId && keyId.trim()) query.keyId = keyId.trim();
+  if (keyId && keyId.trim()) query2.keyId = keyId.trim();
   const from = intParam(url.searchParams.get("from"));
-  if (from !== void 0) query.from = from;
+  if (from !== void 0) query2.from = from;
   const to = intParam(url.searchParams.get("to"));
-  if (to !== void 0) query.to = to;
+  if (to !== void 0) query2.to = to;
   const limit = intParam(url.searchParams.get("limit"));
-  if (limit !== void 0) query.limit = limit;
-  const records = reader ? reader(query) : [];
+  if (limit !== void 0) query2.limit = limit;
+  const records = reader ? reader(query2) : [];
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ records }));
 }
@@ -235,19 +702,19 @@ function resetWebhookRuntimeForTests() {
 
 // src/admin/webhookTestApi.ts
 function readJsonBody(req) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       try {
         const raw = Buffer.concat(chunks).toString("utf8");
         const parsed = raw ? JSON.parse(raw) : {};
-        resolve(parsed && typeof parsed === "object" ? parsed : {});
+        resolve2(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
-        resolve({});
+        resolve2({});
       }
     });
-    req.on("error", () => resolve({}));
+    req.on("error", () => resolve2({}));
   });
 }
 async function handleWebhookTest(req, res) {
@@ -267,17 +734,19 @@ async function handleWebhookTest(req, res) {
 import http from "http";
 import {
   createNamedKey,
+  gatewayBindingToEndpointConfig,
   isKindMappedEndpoint,
   loadServerConfig as loadServerConfig2,
   mergeServerConfig,
   normalizeProxyConfig,
-  saveServerConfig,
-  validateServerModelConfig
+  saveServerConfig
 } from "@omnicross/core/outbound-api";
-import { fetchUpstream } from "@omnicross/core/pipeline/upstreamFetch";
+import { getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling2 } from "@omnicross/core/pipeline/AccountAllowanceScheduling";
+import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import { fetchUpstream as fetchUpstream2 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/config.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 
 // src/secrets/envelope.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -336,9 +805,9 @@ function decryptValue(envelope, key) {
 
 // src/secrets/masterKey.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname as dirname2, join } from "path";
 var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
 var KEY_BYTES2 = 32;
 function defaultMasterKeyPath() {
@@ -358,7 +827,7 @@ function decodeEnvKey(raw) {
   return buf;
 }
 function readKeyFile(path2) {
-  const raw = readFileSync(path2);
+  const raw = readFileSync2(path2);
   if (raw.length === KEY_BYTES2) return raw;
   const text = raw.toString("utf8").trim();
   if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
@@ -370,8 +839,8 @@ function readKeyFile(path2) {
 }
 function generateKeyFile(path2) {
   const key = randomBytes2(KEY_BYTES2);
-  mkdirSync(dirname(path2), { recursive: true });
-  writeFileSync(path2, key, { mode: 384 });
+  mkdirSync2(dirname2(path2), { recursive: true });
+  writeFileSync2(path2, key, { mode: 384 });
   try {
     chmodSync(path2, 384);
   } catch {
@@ -384,7 +853,7 @@ function resolveMasterKey(options = {}) {
     return decodeEnvKey(envRaw);
   }
   const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
-  if (existsSync(keyFilePath)) {
+  if (existsSync2(keyFilePath)) {
     return readKeyFile(keyFilePath);
   }
   return generateKeyFile(keyFilePath);
@@ -663,7 +1132,19 @@ function validateLogging(raw) {
   if (typeof l["file"] === "string" && l["file"].length > 0) out.file = l["file"];
   return out.level !== void 0 || out.format !== void 0 || out.file !== void 0 ? out : void 0;
 }
-var VALID_FORMATS = ["openai", "anthropic", "gemini"];
+var VALID_FORMATS = [
+  "openai",
+  "anthropic",
+  "gemini",
+  "openai-response"
+];
+var FORMAT_AXIS_TRANSFORMERS = [
+  "openai",
+  "anthropic",
+  "gemini",
+  "openai-response",
+  "gemini-code-assist"
+];
 function validateApiKeys(raw) {
   if (!Array.isArray(raw)) return void 0;
   const out = [];
@@ -768,6 +1249,33 @@ function validateApiModes(raw) {
   }
   return out.length > 0 ? out : void 0;
 }
+function transformerEntryName(entry) {
+  return typeof entry === "string" ? entry : entry[0];
+}
+function migrateFormatAxis(apiFormat, transformer) {
+  const use = transformer?.use;
+  if (!use || use.length === 0) return { apiFormat, transformer };
+  const hasFormatEntry = use.some((e) => FORMAT_AXIS_TRANSFORMERS.includes(transformerEntryName(e)));
+  if (!hasFormatEntry) return { apiFormat, transformer };
+  let migratedFormat = apiFormat;
+  if (apiFormat === "openai") {
+    const promoted = use.map(transformerEntryName).find((n) => VALID_FORMATS.includes(n));
+    if (promoted) migratedFormat = promoted;
+  }
+  const rest = use.filter((e) => !FORMAT_AXIS_TRANSFORMERS.includes(transformerEntryName(e)));
+  const next = {};
+  let kept = false;
+  if (rest.length > 0) {
+    next.use = rest;
+    kept = true;
+  }
+  for (const key of Object.keys(transformer)) {
+    if (key === "use") continue;
+    next[key] = transformer[key];
+    kept = true;
+  }
+  return { apiFormat: migratedFormat, transformer: kept ? next : void 0 };
+}
 function validateProvider(raw, index) {
   if (!raw || typeof raw !== "object") {
     throw new Error(`config: providers[${index}] is not an object`);
@@ -798,10 +1306,14 @@ function validateProvider(raw, index) {
   const apiVersion = typeof p["apiVersion"] === "string" && p["apiVersion"].length > 0 ? p["apiVersion"] : void 0;
   const maxConcurrency = typeof p["maxConcurrency"] === "number" && Number.isFinite(p["maxConcurrency"]) ? p["maxConcurrency"] : void 0;
   const modelsEndpoint = typeof p["modelsEndpoint"] === "string" && p["modelsEndpoint"].length > 0 ? p["modelsEndpoint"] : void 0;
+  const { apiFormat: migratedFormat, transformer: migratedTransformer } = migrateFormatAxis(
+    apiFormat,
+    validateTransformer(p["transformer"])
+  );
   return {
     id,
     name,
-    apiFormat,
+    apiFormat: migratedFormat,
     baseUrl,
     apiKey,
     models: Array.isArray(models) ? models.filter((m) => typeof m === "string") : void 0,
@@ -815,7 +1327,9 @@ function validateProvider(raw, index) {
     modelsEndpoint,
     // Provider transformer config (app-parity child 5): load-guard, collapse-to-
     // undefined; non-secret; ENFORCED via resolveTransformerChain (parity-2 child 2).
-    transformer: validateTransformer(p["transformer"]),
+    // Format-axis entries are stripped by `migrateFormatAxis` — `use[]` is the
+    // MODIFIER axis only.
+    transformer: migratedTransformer,
     // Coding-plan endpoint (app-parity-2 child 3): load-guard, collapse-to-undefined.
     // SECRET-bearing (apiKey encrypted at rest); enforced by core's resolveProviderEndpoint.
     codingPlan: validateCodingPlan(p["codingPlan"]),
@@ -847,7 +1361,7 @@ function setSecretBox(box) {
 function loadConfig(path2) {
   let raw;
   try {
-    raw = readFileSync2(path2, "utf8");
+    raw = readFileSync3(path2, "utf8");
   } catch {
     throw new Error(`config: cannot read file at '${path2}'`);
   }
@@ -862,7 +1376,7 @@ function loadConfig(path2) {
 }
 function saveConfig(path2, cfg) {
   const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
-  writeFileSync2(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
+  writeFileSync3(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
 }
 
 // src/pool/resolveEnvKey.ts
@@ -874,6 +1388,706 @@ function resolveEnvKey(rawKey) {
   return rawKey;
 }
 
+// src/integrations/IntegrationManager.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync5, unlinkSync as unlinkSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join2, resolve } from "path";
+import { createIntegrationKey } from "@omnicross/core";
+
+// src/integrations/IntegrationStateStore.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname3 } from "path";
+var EMPTY_STATE = { version: 1, clients: {} };
+var IntegrationStateStore = class {
+  constructor(path2, box) {
+    this.path = path2;
+    this.box = box;
+  }
+  path;
+  box;
+  load() {
+    if (!existsSync3(this.path)) return { ...EMPTY_STATE, clients: {} };
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync4(this.path, "utf8"));
+    } catch {
+      throw new Error(`integration state '${this.path}' is not valid JSON`);
+    }
+    if (!isState(raw)) {
+      throw new Error(`integration state '${this.path}' has an unsupported shape`);
+    }
+    return {
+      version: 1,
+      gatewayKey: raw.gatewayKey ? { ...raw.gatewayKey, secret: this.box.decryptMaybe(raw.gatewayKey.secret) } : void 0,
+      clients: decryptClients(raw.clients, this.box)
+    };
+  }
+  save(state) {
+    const encrypted = {
+      version: 1,
+      gatewayKey: state.gatewayKey ? { ...state.gatewayKey, secret: this.box.encrypt(state.gatewayKey.secret) } : void 0,
+      clients: encryptClients(state.clients, this.box)
+    };
+    atomicWrite(this.path, JSON.stringify(encrypted, null, 2) + "\n");
+  }
+};
+function transformClients(clients, transform) {
+  const out = {};
+  for (const client of ["codex", "claude"]) {
+    const row = clients[client];
+    if (row) {
+      out[client] = {
+        ...row,
+        originalContent: transform(row.originalContent),
+        credentialFile: row.credentialFile ? { ...row.credentialFile, originalContent: transform(row.credentialFile.originalContent) } : void 0
+      };
+    }
+  }
+  return out;
+}
+function decryptClients(clients, box) {
+  return transformClients(clients, (value) => box.decryptMaybe(value));
+}
+function encryptClients(clients, box) {
+  return transformClients(clients, (value) => box.encrypt(value));
+}
+function isState(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  if (row.version !== 1 || !row.clients || typeof row.clients !== "object") return false;
+  if (row.gatewayKey !== void 0) {
+    const key = row.gatewayKey;
+    if (!key || typeof key !== "object" || typeof key.id !== "string" || typeof key.secret !== "string" || typeof key.createdAt !== "number") return false;
+  }
+  for (const client of ["codex", "claude"]) {
+    const candidate = row.clients[client];
+    if (candidate === void 0) continue;
+    if (!isInstallRecord(candidate, client)) return false;
+  }
+  return true;
+}
+function isInstallRecord(value, client) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return row.client === client && typeof row.configPath === "string" && typeof row.originalExisted === "boolean" && typeof row.originalContent === "string" && typeof row.originalHash === "string" && typeof row.installedHash === "string" && typeof row.installedAt === "number" && typeof row.gatewayBaseUrl === "string" && (row.credentialFile === void 0 || isManagedFileRecord(row.credentialFile));
+}
+function isManagedFileRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return typeof row.path === "string" && typeof row.originalExisted === "boolean" && typeof row.originalContent === "string" && typeof row.originalHash === "string" && typeof row.installedHash === "string";
+}
+function atomicWrite(path2, content) {
+  mkdirSync3(dirname3(path2), { recursive: true });
+  const temp = `${path2}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync4(temp, content, { encoding: "utf8", mode: 384 });
+  try {
+    renameSync2(temp, path2);
+  } catch (error) {
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  } finally {
+    if (existsSync3(path2)) {
+      try {
+        chmodSync2(path2, 384);
+      } catch {
+      }
+    }
+  }
+}
+
+// src/integrations/configAdapters.ts
+var CODEX_BEGIN = "# >>> omnicross managed provider >>>";
+var CODEX_END = "# <<< omnicross managed provider <<<";
+var CODEX_PROVIDER = "omnicross";
+var CLAUDE_API_KEY_SENTINEL = "omnicross-gateway";
+function renderCodexConfig(input) {
+  if (input.existing.includes(CODEX_BEGIN) || input.existing.includes(CODEX_END)) {
+    throw new Error("Codex config contains an unmanaged/orphaned Omnicross marker");
+  }
+  if (/^\s*\[\s*model_providers\s*\.\s*["']?omnicross["']?\s*]/m.test(input.existing)) {
+    throw new Error("Codex config already defines model_providers.omnicross");
+  }
+  const eol = input.existing.includes("\r\n") ? "\r\n" : "\n";
+  const lines = input.existing.replace(/\r\n/g, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+  const rootEnd = firstTable < 0 ? lines.length : firstTable;
+  const assignments = {
+    model_provider: [],
+    preferred_auth_method: []
+  };
+  for (let index = 0; index < rootEnd; index += 1) {
+    if (/^\s*#/.test(lines[index])) continue;
+    for (const key of Object.keys(assignments)) {
+      if (new RegExp(`^\\s*${key}\\s*=`).test(lines[index])) assignments[key].push(index);
+    }
+  }
+  if (assignments.model_provider.length > 1) {
+    throw new Error("Codex config has duplicate top-level model_provider keys");
+  }
+  if (assignments.preferred_auth_method.length > 1) {
+    throw new Error("Codex config has duplicate top-level preferred_auth_method keys");
+  }
+  const managedRoot = {
+    model_provider: `model_provider = "${CODEX_PROVIDER}" # managed by Omnicross`,
+    preferred_auth_method: 'preferred_auth_method = "apikey" # managed by Omnicross'
+  };
+  const missing = [];
+  for (const key of Object.keys(assignments)) {
+    const [index] = assignments[key];
+    if (index === void 0) missing.push(managedRoot[key]);
+    else lines[index] = managedRoot[key];
+  }
+  if (missing.length > 0) lines.splice(rootEnd, 0, ...missing, "");
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const base = lines.length > 0 ? `${lines.join("\n")}
+
+` : "";
+  const root = trimTrailingSlash(input.gatewayBaseUrl);
+  const block = [
+    CODEX_BEGIN,
+    `[model_providers.${CODEX_PROVIDER}]`,
+    'name = "Omnicross Local Gateway"',
+    `base_url = ${tomlString(`${root}/v1`)}`,
+    'wire_api = "responses"',
+    "requires_openai_auth = true",
+    "supports_websockets = false",
+    CODEX_END,
+    ""
+  ].join("\n");
+  return (base + block).replace(/\n/g, eol);
+}
+function renderCodexAuth(secret) {
+  return JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: secret }, null, 2) + "\n";
+}
+function renderClaudeSettings(existing, gatewayBaseUrl, secret) {
+  let parsed = {};
+  if (existing.trim()) {
+    try {
+      parsed = JSON.parse(existing);
+    } catch {
+      throw new Error("Claude settings file is not valid JSON");
+    }
+  }
+  if (!isPlainObject(parsed)) throw new Error("Claude settings root must be a JSON object");
+  const settings = { ...parsed };
+  const oldEnv = settings.env;
+  if (oldEnv !== void 0 && !isPlainObject(oldEnv)) {
+    throw new Error("Claude settings env field must be a JSON object");
+  }
+  settings.env = {
+    ...oldEnv,
+    ANTHROPIC_BASE_URL: trimTrailingSlash(gatewayBaseUrl),
+    ANTHROPIC_AUTH_TOKEN: secret,
+    ANTHROPIC_API_KEY: CLAUDE_API_KEY_SENTINEL
+  };
+  return JSON.stringify(settings, null, 2) + "\n";
+}
+function restoreCodexBase(current, original) {
+  const hasBegin = current.includes(CODEX_BEGIN);
+  const hasEnd = current.includes(CODEX_END);
+  if (hasBegin !== hasEnd) throw new Error("Codex config has an incomplete Omnicross managed block");
+  const eol = current.includes("\r\n") ? "\r\n" : "\n";
+  let normalized = current.replace(/\r\n/g, "\n");
+  if (hasBegin) {
+    const start = normalized.indexOf(CODEX_BEGIN);
+    const endMarker = normalized.indexOf(CODEX_END, start);
+    if (endMarker < 0) throw new Error("Codex config has an incomplete Omnicross managed block");
+    const end = normalized.indexOf("\n", endMarker);
+    normalized = normalized.slice(0, start) + (end < 0 ? "" : normalized.slice(end + 1));
+  }
+  const lines = normalized.split("\n");
+  for (const key of ["model_provider", "preferred_auth_method"]) {
+    const originalAssignment = rootAssignment(original, key);
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+    const rootEnd = firstTable < 0 ? lines.length : firstTable;
+    const managedIndex = lines.slice(0, rootEnd).findIndex(
+      (line) => new RegExp(`^\\s*${key}\\s*=.*#\\s*managed by Omnicross\\s*$`).test(line)
+    );
+    if (managedIndex >= 0) {
+      if (originalAssignment) lines[managedIndex] = originalAssignment;
+      else lines.splice(managedIndex, 1);
+    }
+  }
+  return lines.join("\n").replace(/\n/g, eol);
+}
+function restoreClaudeBase(current, original, gatewayBaseUrl, secret) {
+  const currentRoot = parseSettings(current);
+  const originalRoot = parseSettings(original);
+  const env = isPlainObject(currentRoot.env) ? { ...currentRoot.env } : {};
+  const originalEnv = isPlainObject(originalRoot.env) ? originalRoot.env : {};
+  const expected = {
+    ANTHROPIC_BASE_URL: trimTrailingSlash(gatewayBaseUrl),
+    ANTHROPIC_AUTH_TOKEN: secret,
+    ANTHROPIC_API_KEY: CLAUDE_API_KEY_SENTINEL
+  };
+  for (const [key, value] of Object.entries(expected)) {
+    if (env[key] !== value) continue;
+    if (Object.prototype.hasOwnProperty.call(originalEnv, key)) env[key] = originalEnv[key];
+    else delete env[key];
+  }
+  const next = { ...currentRoot };
+  if (Object.keys(env).length > 0 || Object.prototype.hasOwnProperty.call(originalRoot, "env")) next.env = env;
+  else delete next.env;
+  return JSON.stringify(next, null, 2) + "\n";
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseSettings(value) {
+  if (!value.trim()) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Claude settings file is not valid JSON");
+  }
+  if (!isPlainObject(parsed)) throw new Error("Claude settings root must be a JSON object");
+  return parsed;
+}
+function rootAssignment(content, key) {
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line) && !/^\s*#/.test(line));
+  const root = lines.slice(0, firstTable < 0 ? lines.length : firstTable);
+  return root.find((line) => new RegExp(`^\\s*${key}\\s*=`).test(line) && !/^\s*#/.test(line));
+}
+
+// src/integrations/IntegrationManager.ts
+var IntegrationConflictError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IntegrationConflictError";
+  }
+};
+var IntegrationManager = class {
+  constructor(options) {
+    this.options = options;
+    assertLoopbackGatewayUrl(options.gatewayBaseUrl);
+    this.homeDir = options.homeDir ?? homedir2();
+  }
+  options;
+  homeDir;
+  async listStatus() {
+    const state = this.options.stateStore.load();
+    const keyUsable = await this.isKeyUsable(state);
+    return ["codex", "claude"].map((client) => this.statusFor(client, state, keyUsable));
+  }
+  async plan(client, configPath = this.defaultConfigPath(client)) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    const target = record?.configPath ?? resolve(configPath);
+    const status = this.statusFor(client, state, await this.isKeyUsable(state));
+    const changes = client === "codex" ? [
+      "model_provider",
+      "preferred_auth_method",
+      "model_providers.omnicross",
+      "auth.json.auth_mode",
+      "auth.json.OPENAI_API_KEY"
+    ] : ["env.ANTHROPIC_BASE_URL", "env.ANTHROPIC_AUTH_TOKEN", "env.ANTHROPIC_API_KEY"];
+    if (!record) return { client, configPath: target, action: "install", canApply: true, changes, warnings: [] };
+    if (status.status === "enabled") {
+      return { client, configPath: target, action: "none", canApply: true, changes: [], warnings: [] };
+    }
+    return {
+      client,
+      configPath: target,
+      action: "repair",
+      canApply: true,
+      changes,
+      warnings: ["Configuration changed after installation; repair preserves unrelated current settings."]
+    };
+  }
+  async install(client, configPath = this.defaultConfigPath(client)) {
+    const target = resolve(configPath);
+    const state = this.options.stateStore.load();
+    const existingRecord = state.clients[client];
+    if (existingRecord) {
+      const status = this.statusFor(client, state, await this.isKeyUsable(state));
+      if (status.status === "enabled") return status;
+      throw new IntegrationConflictError(
+        `${client} integration configuration has drifted; restore or remove it before reinstalling`
+      );
+    }
+    const key = await this.ensureGatewayKey(state);
+    const original = readOptional(target);
+    const originalContent = original ?? "";
+    const installed = this.renderInstalled(client, originalContent, key.secret);
+    const credentialPath = client === "codex" ? this.codexAuthPathForConfig(target) : void 0;
+    const originalCredential = credentialPath ? readOptional(credentialPath) : null;
+    const installedCredential = credentialPath ? renderCodexAuth(key.secret) : void 0;
+    const record = {
+      client,
+      configPath: target,
+      originalExisted: original !== null,
+      originalContent,
+      originalHash: sha256(originalContent),
+      installedHash: sha256(installed),
+      installedAt: Date.now(),
+      gatewayBaseUrl: this.options.gatewayBaseUrl,
+      credentialFile: credentialPath && installedCredential ? managedFileRecord(credentialPath, originalCredential, installedCredential) : void 0
+    };
+    const prior = state.clients[client];
+    state.clients[client] = record;
+    this.options.stateStore.save(state);
+    try {
+      applyFileChangesWithRollback([
+        { path: target, content: installed },
+        ...credentialPath && installedCredential ? [{ path: credentialPath, content: installedCredential }] : []
+      ]);
+    } catch (error) {
+      if (prior) state.clients[client] = prior;
+      else delete state.clients[client];
+      this.options.stateStore.save(state);
+      throw error;
+    }
+    return this.statusFor(client, state, true);
+  }
+  async repair(client) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    if (!record) return this.install(client);
+    const previouslyInstalledSecret = state.gatewayKey?.secret;
+    const currentFile = readOptional(record.configPath);
+    if (client === "claude" && currentFile !== null && !previouslyInstalledSecret) {
+      throw new IntegrationConflictError(
+        "Claude integration key state is missing; refusing to repair an ambiguous settings file"
+      );
+    }
+    const key = await this.ensureGatewayKey(state);
+    const current = currentFile ?? record.originalContent;
+    const base = client === "codex" ? restoreCodexBase(current, record.originalContent) : restoreClaudeBase(
+      current,
+      record.originalContent,
+      record.gatewayBaseUrl,
+      previouslyInstalledSecret ?? key.secret
+    );
+    const installed = this.renderInstalled(client, base, key.secret);
+    const credentialPath = client === "codex" ? record.credentialFile?.path ?? this.codexAuthPathForConfig(record.configPath) : void 0;
+    const currentCredential = credentialPath ? readOptional(credentialPath) : null;
+    const originalCredential = record.credentialFile ? originalSnapshotForRepair(record.credentialFile, currentCredential) : currentCredential;
+    const installedCredential = credentialPath ? renderCodexAuth(key.secret) : void 0;
+    const prior = {
+      ...record,
+      credentialFile: record.credentialFile ? { ...record.credentialFile } : void 0
+    };
+    Object.assign(record, {
+      originalExisted: currentFile !== null || record.originalExisted,
+      originalContent: base,
+      originalHash: sha256(base),
+      installedHash: sha256(installed),
+      installedAt: Date.now(),
+      gatewayBaseUrl: this.options.gatewayBaseUrl,
+      credentialFile: credentialPath && installedCredential ? managedFileRecord(credentialPath, originalCredential, installedCredential) : void 0
+    });
+    this.options.stateStore.save(state);
+    try {
+      applyFileChangesWithRollback([
+        { path: record.configPath, content: installed },
+        ...credentialPath && installedCredential ? [{ path: credentialPath, content: installedCredential }] : []
+      ]);
+    } catch (error) {
+      state.clients[client] = prior;
+      this.options.stateStore.save(state);
+      throw error;
+    }
+    return this.statusFor(client, state, true);
+  }
+  async remove(client) {
+    const state = this.options.stateStore.load();
+    const record = state.clients[client];
+    if (!record) return this.statusFor(client, state, await this.isKeyUsable(state));
+    const files = [primaryManagedFile(record), ...record.credentialFile ? [record.credentialFile] : []];
+    const currentFiles = files.map((file) => ({ file, current: readOptional(file.path) }));
+    const dispositions = currentFiles.map(({ file, current }) => managedFileDisposition(file, current));
+    if (dispositions.some((disposition) => disposition !== "installed" && disposition !== "restored")) {
+      throw new IntegrationConflictError(
+        `${client} configuration changed after Omnicross installed it; refusing to overwrite user edits`
+      );
+    }
+    const changes = currentFiles.flatMap(({ file }, index) => dispositions[index] === "installed" ? [{ path: file.path, content: file.originalExisted ? file.originalContent : null }] : []);
+    applyFileChangesWithRollback(changes);
+    delete state.clients[client];
+    this.options.stateStore.save(state);
+    return this.statusFor(client, state, await this.isKeyUsable(state));
+  }
+  async rotateGatewayKey() {
+    const state = this.options.stateStore.load();
+    const previousGatewayKey = state.gatewayKey;
+    const oldKeyId = state.gatewayKey?.id;
+    const claude = state.clients.claude;
+    const codex = state.clients.codex;
+    let nextClaude;
+    let nextCodexAuth;
+    if (claude) {
+      const current = readOptional(claude.configPath);
+      if (current === null || sha256(current) !== claude.installedHash) {
+        throw new IntegrationConflictError("Claude configuration drift must be resolved before key rotation");
+      }
+    }
+    if (codex) {
+      const current = readOptional(codex.configPath);
+      if (current === null || sha256(current) !== codex.installedHash) {
+        throw new IntegrationConflictError("Codex configuration drift must be resolved before key rotation");
+      }
+      if (!codex.credentialFile) {
+        throw new IntegrationConflictError("Codex integration must be repaired before key rotation");
+      }
+      const currentAuth = readOptional(codex.credentialFile.path);
+      if (currentAuth === null || sha256(currentAuth) !== codex.credentialFile.installedHash) {
+        throw new IntegrationConflictError("Codex credential drift must be resolved before key rotation");
+      }
+    }
+    const created = await createIntegrationKey(this.options.keyDb, "Omnicross native CLI integration");
+    const nextGatewayKey = {
+      id: created.id,
+      secret: created.plaintextOnce,
+      createdAt: created.createdAt
+    };
+    state.gatewayKey = nextGatewayKey;
+    const previousClaudeHash = claude?.installedHash;
+    const previousCodexAuthHash = codex?.credentialFile?.installedHash;
+    if (claude) {
+      const current = readOptional(claude.configPath) ?? "{}";
+      nextClaude = renderClaudeSettings(current, this.options.gatewayBaseUrl, created.plaintextOnce);
+      claude.installedHash = sha256(nextClaude);
+    }
+    if (codex?.credentialFile) {
+      nextCodexAuth = renderCodexAuth(created.plaintextOnce);
+      codex.credentialFile.installedHash = sha256(nextCodexAuth);
+    }
+    try {
+      this.options.stateStore.save(state);
+      applyFileChangesWithRollback([
+        ...codex?.credentialFile && nextCodexAuth !== void 0 ? [{ path: codex.credentialFile.path, content: nextCodexAuth }] : [],
+        ...claude && nextClaude !== void 0 ? [{ path: claude.configPath, content: nextClaude }] : []
+      ]);
+    } catch (error) {
+      state.gatewayKey = previousGatewayKey;
+      if (claude && previousClaudeHash !== void 0) claude.installedHash = previousClaudeHash;
+      if (codex?.credentialFile && previousCodexAuthHash !== void 0) {
+        codex.credentialFile.installedHash = previousCodexAuthHash;
+      }
+      try {
+        this.options.stateStore.save(state);
+      } finally {
+        await this.options.keyDb.outboundApiKeysRevoke(created.id);
+      }
+      throw error;
+    }
+    if (oldKeyId && oldKeyId !== created.id) await this.options.keyDb.outboundApiKeysRevoke(oldKeyId);
+    return { keyId: created.id };
+  }
+  async getGatewayToken() {
+    const state = this.options.stateStore.load();
+    if (!state.gatewayKey || !await this.isKeyUsable(state)) {
+      throw new Error("Omnicross integration key is missing or revoked; reinstall the CLI integration");
+    }
+    return state.gatewayKey.secret;
+  }
+  async ensureGatewayKey(state) {
+    if (state.gatewayKey && await this.isKeyUsable(state)) return state.gatewayKey;
+    const created = await createIntegrationKey(this.options.keyDb, "Omnicross native CLI integration");
+    const previousGatewayKey = state.gatewayKey;
+    const nextGatewayKey = {
+      id: created.id,
+      secret: created.plaintextOnce,
+      createdAt: created.createdAt
+    };
+    state.gatewayKey = nextGatewayKey;
+    try {
+      this.options.stateStore.save(state);
+      return nextGatewayKey;
+    } catch (error) {
+      state.gatewayKey = previousGatewayKey;
+      try {
+        await this.options.keyDb.outboundApiKeysRevoke(created.id);
+      } catch {
+      }
+      throw error;
+    }
+  }
+  async isKeyUsable(state) {
+    if (!state.gatewayKey) return false;
+    const rows = await this.options.keyDb.outboundApiKeysList();
+    return rows.some((row) => row.id === state.gatewayKey?.id && row.enabled && row.revokedAt === null && row.kind === "integration");
+  }
+  statusFor(client, state, keyUsable) {
+    const record = state.clients[client];
+    if (!record) return { client, status: "not-installed", configPath: this.defaultConfigPath(client) };
+    const current = readOptional(record.configPath);
+    if (current === null) {
+      return {
+        client,
+        status: "configuration-missing",
+        configPath: record.configPath,
+        installedAt: record.installedAt,
+        gatewayBaseUrl: record.gatewayBaseUrl
+      };
+    }
+    if (sha256(current) !== record.installedHash) {
+      return {
+        client,
+        status: "configuration-drift",
+        configPath: record.configPath,
+        installedAt: record.installedAt,
+        gatewayBaseUrl: record.gatewayBaseUrl
+      };
+    }
+    if (client === "codex") {
+      if (!record.credentialFile) {
+        return {
+          client,
+          status: "configuration-drift",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex integration uses a legacy authentication layout and must be repaired."
+        };
+      }
+      const credential = readOptional(record.credentialFile.path);
+      if (credential === null) {
+        return {
+          client,
+          status: "configuration-missing",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex auth.json is missing."
+        };
+      }
+      if (sha256(credential) !== record.credentialFile.installedHash) {
+        return {
+          client,
+          status: "configuration-drift",
+          configPath: record.configPath,
+          installedAt: record.installedAt,
+          gatewayBaseUrl: record.gatewayBaseUrl,
+          message: "Codex auth.json changed after installation."
+        };
+      }
+    }
+    return {
+      client,
+      status: keyUsable ? "enabled" : "key-missing",
+      configPath: record.configPath,
+      installedAt: record.installedAt,
+      gatewayBaseUrl: record.gatewayBaseUrl
+    };
+  }
+  defaultConfigPath(client) {
+    return client === "codex" ? join2(this.homeDir, ".codex", "config.toml") : join2(this.homeDir, ".claude", "settings.json");
+  }
+  codexAuthPathForConfig(configPath) {
+    return join2(dirname4(configPath), "auth.json");
+  }
+  renderInstalled(client, base, secret) {
+    if (client === "claude") {
+      return renderClaudeSettings(base, this.options.gatewayBaseUrl, secret);
+    }
+    return renderCodexConfig({
+      existing: base,
+      gatewayBaseUrl: this.options.gatewayBaseUrl
+    });
+  }
+};
+function readOptional(path2) {
+  return existsSync4(path2) ? readFileSync5(path2, "utf8") : null;
+}
+function sha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function managedFileRecord(path2, original, installed) {
+  const originalContent = original ?? "";
+  return {
+    path: path2,
+    originalExisted: original !== null,
+    originalContent,
+    originalHash: sha256(originalContent),
+    installedHash: sha256(installed)
+  };
+}
+function primaryManagedFile(record) {
+  return {
+    path: record.configPath,
+    originalExisted: record.originalExisted,
+    originalContent: record.originalContent,
+    originalHash: record.originalHash,
+    installedHash: record.installedHash
+  };
+}
+function managedFileDisposition(record, current) {
+  if (current !== null && sha256(current) === record.installedHash) return "installed";
+  const matchesOriginalExistence = record.originalExisted ? current !== null : current === null;
+  if (matchesOriginalExistence && sha256(current ?? "") === record.originalHash) return "restored";
+  return current === null ? "missing" : "drift";
+}
+function originalSnapshotForRepair(record, current) {
+  const disposition = managedFileDisposition(record, current);
+  if (disposition === "installed" || disposition === "restored") {
+    return record.originalExisted ? record.originalContent : null;
+  }
+  return current;
+}
+function applyFileChangesWithRollback(changes) {
+  if (changes.length === 0) return;
+  const snapshots = changes.map((change) => ({ path: change.path, content: readOptional(change.path) }));
+  try {
+    for (const change of changes) writeOptional(change.path, change.content);
+  } catch (error) {
+    const rollbackFailures = [];
+    for (const snapshot of [...snapshots].reverse()) {
+      try {
+        writeOptional(snapshot.path, snapshot.content);
+      } catch {
+        rollbackFailures.push(snapshot.path);
+      }
+    }
+    if (rollbackFailures.length > 0) {
+      throw new IntegrationConflictError(
+        `CLI integration update failed and rollback could not restore: ${rollbackFailures.join(", ")}`
+      );
+    }
+    throw error;
+  }
+}
+function writeOptional(path2, content) {
+  if (content !== null) {
+    atomicWrite(path2, content);
+    return;
+  }
+  if (existsSync4(path2)) unlinkSync2(path2);
+}
+function assertLoopbackGatewayUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("gatewayBaseUrl must be a valid loopback URL");
+  }
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const literalLoopback = host === "::1" || /^127(?:\.\d{1,3}){3}$/.test(host);
+  if (url.protocol !== "http:" || !literalLoopback || url.username || url.password || url.search || url.hash) {
+    throw new Error("native CLI integrations require an unauthenticated literal HTTP loopback gateway URL");
+  }
+}
+
 // src/preset-catalog.ts
 import * as presetsModule from "@omnicross/contracts/provider-presets";
 function normalizeCatalogModule(m) {
@@ -894,14 +2108,13 @@ function getCatalog() {
 
 // src/preset-map.ts
 var EXCLUSION_REASONS = {
-  "openai-response": "daemon rows have no openai-response format; the Responses API needs a transformer chain that a BYO daemon provider row cannot express.",
   "azure-openai": "Azure needs an apiVersion + a deployment-name-as-model URL template + an empty baseUrl; a daemon provider row cannot express that shape."
 };
 var FORMAT_MAP = {
   openai: "openai",
   anthropic: "anthropic",
   google: "gemini",
-  "openai-response": null,
+  "openai-response": "openai-response",
   "azure-openai": null
 };
 function resolveFormat(raw) {
@@ -1108,6 +2321,67 @@ var VALID_PROVIDER_IDS = [
 function asSubscriptionProviderId(id) {
   return VALID_PROVIDER_IDS.includes(id) ? id : null;
 }
+var ACCOUNT_PATCH_KEYS = /* @__PURE__ */ new Set(["label", "enabled", "priority", "group", "tags"]);
+function validateAccountMetadataPatch(body) {
+  const keys = Object.keys(body);
+  if (keys.length === 0 || keys.some((key) => !ACCOUNT_PATCH_KEYS.has(key))) return null;
+  const patch = {};
+  if ("label" in body) {
+    if (typeof body["label"] !== "string" || body["label"].trim().length > 120) return null;
+    patch.label = body["label"].trim();
+  }
+  if ("enabled" in body) {
+    if (typeof body["enabled"] !== "boolean") return null;
+    patch.enabled = body["enabled"];
+  }
+  if ("priority" in body) {
+    const priority = body["priority"];
+    if (typeof priority !== "number" || !Number.isFinite(priority) || priority < -1e4 || priority > 1e4) return null;
+    patch.priority = priority;
+  }
+  if ("group" in body) {
+    const group = body["group"];
+    if (group !== null && typeof group !== "string") return null;
+    const normalized = typeof group === "string" ? group.trim() : null;
+    if (normalized !== null && normalized.length > 80) return null;
+    patch.group = normalized || null;
+  }
+  if ("tags" in body) {
+    const tags = body["tags"];
+    if (!Array.isArray(tags) || tags.length > 20) return null;
+    const normalized = tags.map((tag) => typeof tag === "string" ? tag.trim() : "");
+    if (normalized.some((tag) => !tag || tag.length > 40)) return null;
+    patch.tags = [...new Set(normalized)];
+  }
+  return patch;
+}
+function validateAccountBatchBody(body) {
+  const action = body["action"];
+  const rawAccounts = body["accounts"];
+  if (!Array.isArray(rawAccounts) || rawAccounts.length < 1 || rawAccounts.length > 100) return null;
+  if (action !== "enable" && action !== "disable" && action !== "set-group" && action !== "delete") return null;
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of rawAccounts) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const row = raw;
+    const providerId = typeof row["providerId"] === "string" ? asSubscriptionProviderId(row["providerId"]) : null;
+    const accountId = typeof row["accountId"] === "string" ? row["accountId"].trim() : "";
+    if (!providerId || !accountId || accountId.length > 200) return null;
+    const key = `${providerId}\0${accountId}`;
+    if (seen.has(key)) return null;
+    seen.add(key);
+    refs.push({ providerId, accountId });
+  }
+  if (action === "set-group") {
+    const group = body["group"];
+    if (group !== null && typeof group !== "string") return null;
+    const normalized = typeof group === "string" ? group.trim() : null;
+    if (normalized !== null && normalized.length > 80) return null;
+    return { refs, mutation: { action, group: normalized || null } };
+  }
+  return { refs, mutation: { action } };
+}
 var CLAUDE_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "setup_token", "manual"]);
 var OAUTH_AUTH_METHODS = /* @__PURE__ */ new Set(["oauth", "manual"]);
 var TOKEN_STATUSES = /* @__PURE__ */ new Set([
@@ -1319,9 +2593,9 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 
 // src/admin/cliLaunch.ts
 import { exec, spawn } from "child_process";
-import { randomUUID } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { delimiter, join as join2 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync5 } from "fs";
+import { delimiter, join as join3 } from "path";
 import {
   buildChatCliLaunchConfig,
   buildClaudeCliLaunchConfig,
@@ -1351,8 +2625,8 @@ function isLaunchCliId(id) {
 function probeDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = join2(seg, candidate);
-    if (existsSync2(full)) return full;
+    const full = join3(seg, candidate);
+    if (existsSync5(full)) return full;
   }
   return null;
 }
@@ -1439,10 +2713,10 @@ var sessions = /* @__PURE__ */ new Map();
 function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
-var defaultCommandRunner = (command) => new Promise((resolve) => {
+var defaultCommandRunner = (command) => new Promise((resolve2) => {
   exec(command, { timeout: 18e4 }, (err5, _stdout, stderr) => {
-    if (err5) resolve({ ok: false, error: stderr.trim() || err5.message });
-    else resolve({ ok: true });
+    if (err5) resolve2({ ok: false, error: stderr.trim() || err5.message });
+    else resolve2({ ok: true });
   });
 });
 async function handleCliInstall(cli, runner = defaultCommandRunner) {
@@ -1504,7 +2778,7 @@ async function handleCliLaunch(cli, body, ctx) {
     launch.onSessionEnd();
     return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
   }
-  const id = randomUUID();
+  const id = randomUUID2();
   sessions.set(id, {
     id,
     cli,
@@ -1517,12 +2791,12 @@ async function handleCliLaunch(cli, body, ctx) {
 }
 
 // src/admin/auditConfigBody.ts
-var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateAuditSegment(patch) {
   const errors = [];
   const audit = patch.audit;
   if (audit === void 0) return errors;
-  if (!isPlainObject(audit)) {
+  if (!isPlainObject2(audit)) {
     errors.push("audit must be an object");
     return errors;
   }
@@ -1544,12 +2818,12 @@ function validateAuditSegment(patch) {
 
 // src/admin/billingConfigBody.ts
 var BILLING_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
-var isPlainObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateBillingSegment(patch) {
   const errors = [];
   const billing = patch.billing;
   if (billing === void 0) return errors;
-  if (!isPlainObject2(billing)) {
+  if (!isPlainObject3(billing)) {
     errors.push("billing must be an object");
     return errors;
   }
@@ -1685,6 +2959,96 @@ function parseKeyPolicyBody(body) {
   return { ok: true, policy };
 }
 
+// src/admin/gatewayBindingBody.ts
+var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
+var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
+var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function nonBlank(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function validateStringArray(value, path2, errors) {
+  if (!Array.isArray(value) || value.some((entry) => !nonBlank(entry))) {
+    errors.push(`${path2} must be an array of non-empty strings`);
+  }
+}
+function validateGatewayBindingsSegment(patch) {
+  if (!Object.prototype.hasOwnProperty.call(patch, "bindings")) return [];
+  const raw = patch.bindings;
+  if (!Array.isArray(raw)) return ["bindings must be an array"];
+  if (raw.length > 1e3) return ["bindings cannot contain more than 1000 entries"];
+  const errors = [];
+  const ids = /* @__PURE__ */ new Set();
+  raw.forEach((entry, index) => {
+    const path2 = `bindings[${index}]`;
+    if (!isRecord(entry)) {
+      errors.push(`${path2} must be an object`);
+      return;
+    }
+    if (!nonBlank(entry.id)) errors.push(`${path2}.id is required`);
+    else if (ids.has(entry.id.trim())) errors.push(`${path2}.id must be unique`);
+    else ids.add(entry.id.trim());
+    if (!nonBlank(entry.name)) errors.push(`${path2}.name is required`);
+    if (typeof entry.enabled !== "boolean") errors.push(`${path2}.enabled must be boolean`);
+    if (!ENDPOINTS.has(String(entry.endpoint))) errors.push(`${path2}.endpoint is invalid`);
+    if (!FALLBACKS.has(String(entry.fallback))) {
+      errors.push(`${path2}.fallback must be next or fail`);
+    }
+    if (entry.priority !== void 0 && (typeof entry.priority !== "number" || !Number.isInteger(entry.priority) || entry.priority < 0 || entry.priority > 1e4)) {
+      errors.push(`${path2}.priority must be an integer from 0 to 10000`);
+    }
+    if (entry.apiKeyIds !== void 0) validateStringArray(entry.apiKeyIds, `${path2}.apiKeyIds`, errors);
+    if (entry.keyScope !== void 0 && entry.keyScope !== "all" && entry.keyScope !== "selected") {
+      errors.push(`${path2}.keyScope must be all or selected`);
+    }
+    if (entry.modelMode !== void 0 && entry.modelMode !== "passthrough" && entry.modelMode !== "mapped") {
+      errors.push(`${path2}.modelMode must be passthrough or mapped`);
+    }
+    if (entry.modelMappings !== void 0) {
+      if (!Array.isArray(entry.modelMappings)) {
+        errors.push(`${path2}.modelMappings must be an array`);
+      } else if (entry.modelMappings.length > 100) {
+        errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
+      } else if (entry.modelMappings.some(
+        (mapping) => !isRecord(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+      )) {
+        errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
+      }
+    }
+    if (!isRecord(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+      errors.push(`${path2}.target is invalid`);
+    } else {
+      if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
+      if (entry.target.kind === "account" && !nonBlank(entry.target.accountId)) {
+        errors.push(`${path2}.target.accountId is required`);
+      }
+      if (entry.target.kind === "account-group" && !nonBlank(entry.target.group)) {
+        errors.push(`${path2}.target.group is required`);
+      }
+      if (entry.target.kind === "provider" && entry.target.keyId !== void 0 && !nonBlank(entry.target.keyId)) {
+        errors.push(`${path2}.target.keyId must be a non-empty string`);
+      }
+    }
+    if (entry.modelMap !== void 0) {
+      if (!isRecord(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+        errors.push(`${path2}.modelMap must contain string values`);
+      }
+    }
+    if (entry.models !== void 0) validateStringArray(entry.models, `${path2}.models`, errors);
+    if (entry.backgroundModelIds !== void 0) {
+      validateStringArray(entry.backgroundModelIds, `${path2}.backgroundModelIds`, errors);
+    }
+    for (const field of ["defaultModel", "backgroundModel"]) {
+      if (entry[field] !== void 0 && typeof entry[field] !== "string") {
+        errors.push(`${path2}.${field} must be a string`);
+      }
+    }
+  });
+  return errors;
+}
+
 // src/admin/voucherAdmin.ts
 import {
   generateVoucherCode,
@@ -1702,15 +3066,15 @@ function writeErr(res, status, message) {
   writeJson(res, status, { error: { type: "voucher_error", message } });
 }
 function readJsonBody2(req) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw.trim()) return resolve({});
+      if (!raw.trim()) return resolve2({});
       try {
         const parsed = JSON.parse(raw);
-        resolve(parsed && typeof parsed === "object" ? parsed : {});
+        resolve2(parsed && typeof parsed === "object" ? parsed : {});
       } catch {
         reject(new Error("invalid-json"));
       }
@@ -1803,12 +3167,12 @@ import {
   WEBHOOK_EVENT_KINDS
 } from "@omnicross/contracts/webhook-types";
 var WEBHOOK_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022";
-var isPlainObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isPlainObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function validateWebhookSegment(patch) {
   const errors = [];
   const webhook = patch.webhook;
   if (webhook === void 0) return errors;
-  if (!isPlainObject3(webhook)) {
+  if (!isPlainObject4(webhook)) {
     errors.push("webhook must be an object");
     return errors;
   }
@@ -1822,7 +3186,7 @@ function validateWebhookSegment(patch) {
   }
   const seenIds = /* @__PURE__ */ new Set();
   for (const [i, raw] of (Array.isArray(destinations) ? destinations : []).entries()) {
-    if (!isPlainObject3(raw)) {
+    if (!isPlainObject4(raw)) {
       errors.push(`webhook.destinations[${i}] must be an object`);
       continue;
     }
@@ -1888,12 +3252,16 @@ function preserveWebhookSecrets(incoming, current) {
 }
 
 // src/audit/auditRuntime.ts
+import { join as join4 } from "path";
 import { setAuditCaptureConfig, setAuditSink } from "@omnicross/core/pipeline/auditSink";
+import { setUpstreamTracePath } from "@omnicross/core/pipeline/upstreamTrace";
 var writer = null;
 var sweeper = null;
-function setAuditRuntime(w, s) {
+var auditDir = "";
+function setAuditRuntime(w, s, dir) {
   writer = w;
   sweeper = s;
+  auditDir = dir;
 }
 function applyAuditConfig(config) {
   const enabled = config?.enabled === true && writer !== null;
@@ -1905,9 +3273,11 @@ function applyAuditConfig(config) {
       sweeper.configure(config);
       sweeper.start();
     }
+    setUpstreamTracePath(config.captureBodies ? join4(auditDir, "upstream-trace.jsonl") : null);
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    setUpstreamTracePath(null);
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -1917,9 +3287,11 @@ function applyAuditConfig(config) {
 function resetAuditRuntimeForTests() {
   setAuditCaptureConfig(null);
   setAuditSink(null);
+  setUpstreamTracePath(null);
   if (sweeper) sweeper.dispose();
   writer = null;
   sweeper = null;
+  auditDir = "";
 }
 
 // src/billing/billingRuntime.ts
@@ -1959,7 +3331,7 @@ function resetBillingRuntimeForTests() {
 }
 
 // src/ports/account-multi.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 var PROVIDER_KEYS = {
   claude: { block: "claude", accounts: "claudeAccounts", active: "activeClaudeAccountId" },
   codex: { block: "codex", accounts: "codexAccounts", active: "activeCodexAccountId" },
@@ -2025,7 +3397,7 @@ function migrateLazily(config) {
 }
 function addAccount(config, p, tokens, label) {
   const accounts = [...getAccounts(config, p)];
-  const id = randomUUID2();
+  const id = randomUUID3();
   accounts.push({
     id,
     label: label ?? `Account ${accounts.length + 1}`,
@@ -2101,9 +3473,13 @@ function sanitizeAccounts(config, p) {
   const activeId = getActiveId(config, p);
   return accounts.map((a) => {
     const t = a.tokens;
+    const enabled = a.enabled !== false;
     return {
       id: a.id,
       label: a.label,
+      enabled,
+      group: a.group?.trim() || p,
+      tags: a.tags ?? [],
       status: t.status ?? "unconfigured",
       authMethod: t.authMethod,
       subscriptionLevel: t.subscriptionLevel,
@@ -2112,6 +3488,8 @@ function sanitizeAccounts(config, p) {
       isSetupToken: t.isSetupToken,
       hasAccessToken: !!(t.accessToken || t.apiKey),
       isActive: a.id === activeId,
+      schedulable: enabled,
+      errorMessage: sanitizeDiagnosticMessage(t.errorMessage),
       // Scheduling metadata (subscription-account-scheduling): editable priority
       // (default 50 shown when unset) + display-only lastUsedAt. Secret-free.
       priority: a.priority,
@@ -2126,6 +3504,54 @@ function sanitizeAccounts(config, p) {
     };
   });
 }
+function sanitizeDiagnosticMessage(value) {
+  if (!value) return void 0;
+  const lower = value.toLowerCase();
+  if (lower.includes("timeout") || lower.includes("timed out")) return "Credential operation timed out.";
+  if (lower.includes("network") || lower.includes("fetch")) return "Credential network request failed.";
+  if (lower.includes("401") || lower.includes("unauthorized") || lower.includes("revoked")) {
+    return "Credential authorization was rejected.";
+  }
+  return "Credential operation failed.";
+}
+function patchAccountMetadata(config, p, id, patch) {
+  const accounts = getAccounts(config, p);
+  if (!accounts.some((account) => account.id === id)) return { ok: false };
+  setAccounts(config, p, accounts.map((account) => {
+    if (account.id !== id) return account;
+    const next = { ...account };
+    if (patch.label !== void 0) next.label = patch.label;
+    if (patch.enabled !== void 0) next.enabled = patch.enabled;
+    if (patch.priority !== void 0) next.priority = patch.priority;
+    if (patch.group !== void 0) {
+      if (patch.group === null || patch.group === "") delete next.group;
+      else next.group = patch.group;
+    }
+    if (patch.tags !== void 0) next.tags = patch.tags;
+    return next;
+  }));
+  return { ok: true };
+}
+function batchManageAccounts(config, refs, mutation) {
+  for (const ref of refs) {
+    if (!getAccounts(config, ref.providerId).some((account) => account.id === ref.accountId)) {
+      return { ok: false, missing: ref };
+    }
+  }
+  for (const ref of refs) {
+    if (mutation.action === "delete") {
+      removeAccount(config, ref.providerId, ref.accountId);
+    } else {
+      patchAccountMetadata(
+        config,
+        ref.providerId,
+        ref.accountId,
+        mutation.action === "set-group" ? { group: mutation.group } : { enabled: mutation.action === "enable" }
+      );
+    }
+  }
+  return { ok: true, affected: refs.length };
+}
 function renameAccount(config, p, id, label) {
   const accounts = getAccounts(config, p);
   if (!accounts.some((a) => a.id === id)) return { ok: false };
@@ -2463,9 +3889,9 @@ function parseFiniteInt(raw) {
   const n = Number(raw);
   return Number.isFinite(n) && Number.isInteger(n) ? n : null;
 }
-function parseRange(query) {
-  const startTs = parseFiniteInt(query.get("startTs"));
-  const endTs = parseFiniteInt(query.get("endTs"));
+function parseRange(query2) {
+  const startTs = parseFiniteInt(query2.get("startTs"));
+  const endTs = parseFiniteInt(query2.get("endTs"));
   if (startTs === null || endTs === null) {
     return err4(400, "startTs and endTs are required finite-integer unix-millis query params");
   }
@@ -2478,8 +3904,8 @@ var BUCKET_SPAN_MS = {
   month: 28 * 864e5
 };
 var MAX_TIMESERIES_BUCKETS = 2e3;
-async function handleUsageGet(view, query, deps) {
-  const range = parseRange(query);
+async function handleUsageGet(view, query2, deps) {
+  const range = parseRange(query2);
   if (!isRange(range)) return range;
   switch (view) {
     case "totals":
@@ -2487,7 +3913,7 @@ async function handleUsageGet(view, query, deps) {
     case "by-model":
       return { status: 200, body: await deps.usageRecorder.getByModel(range) };
     case "timeseries": {
-      const bucket = query.get("bucket");
+      const bucket = query2.get("bucket");
       if (bucket !== "hour" && bucket !== "day" && bucket !== "month") {
         return err4(400, "bucket must be one of 'hour', 'day', 'month'");
       }
@@ -2573,9 +3999,9 @@ async function handlePricingUpsert(body, deps) {
   const entry = await deps.pricingEngine.upsertManual(input);
   return { status: 200, body: { entry } };
 }
-async function handlePricingDelete(query, deps) {
-  const providerId = query.get("providerId")?.trim() ?? "";
-  const modelId = query.get("modelId")?.trim() ?? "";
+async function handlePricingDelete(query2, deps) {
+  const providerId = query2.get("providerId")?.trim() ?? "";
+  const modelId = query2.get("modelId")?.trim() ?? "";
   if (!providerId || !modelId) {
     return err4(400, "delete requires providerId and modelId query params");
   }
@@ -2592,7 +4018,8 @@ async function handlePricingFetchLatest(deps) {
         appliedCount: result.applied.length,
         conflicts: result.conflicts,
         fetchedAt: result.fetchedAt,
-        sourceUrl: result.sourceUrl
+        sourceUrl: result.sourceUrl,
+        sources: result.sources
       }
     };
   } catch (e) {
@@ -2628,24 +4055,92 @@ async function handlePricingResolveConflicts(body, deps) {
     if (incoming.providerId !== providerId || incoming.modelId !== modelId) {
       return err4(400, "resolution providerId/modelId must match the echoed incoming entry");
     }
-    const key = `${providerId}::${modelId}`;
-    if (action === "overwrite" && !userEditedKeys.has(key)) {
-      staleCount += 1;
-      continue;
+    const key = `${providerId}::${modelId}`;
+    if (action === "overwrite" && !userEditedKeys.has(key)) {
+      staleCount += 1;
+      continue;
+    }
+    decisions.push({ providerId, modelId, action });
+    pendingIncoming.set(key, incoming);
+  }
+  const resolution = await deps.pricingEngine.resolveConflicts(decisions, pendingIncoming);
+  return { status: 200, body: { ...resolution, staleCount } };
+}
+
+// src/admin/accountAllowanceApi.ts
+function writeJson2(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeError(res, status, message) {
+  writeJson2(res, status, { error: { type: "account_allowance_error", message } });
+}
+function readJson(req) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    req.on("end", () => {
+      try {
+        const text = Buffer.concat(chunks).toString("utf8");
+        const parsed = text ? JSON.parse(text) : {};
+        resolve2(parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {});
+      } catch (error) {
+        reject(error);
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function query(req) {
+  const raw = req.url ?? "";
+  const index = raw.indexOf("?");
+  return new URLSearchParams(index >= 0 ? raw.slice(index + 1) : "");
+}
+function allowanceProvider(value) {
+  if (!value) return void 0;
+  return value === "claude" || value === "codex" ? value : null;
+}
+async function handleAccountAllowanceApi(req, res, method, rest, service) {
+  if (!service) return writeError(res, 501, "account allowance service is not available");
+  if (method === "GET" && rest.length === 1 && rest[0] === "scheduling") {
+    if (!service.getSchedulingStatus) {
+      return writeError(res, 501, "allowance scheduling diagnostics are not available");
+    }
+    return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
+  }
+  if (method === "GET") {
+    const params = query(req);
+    const pathProvider = rest.length >= 2 ? rest[0] : null;
+    const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
+    if (providerId === null) return writeError(res, 400, "providerId must be claude or codex");
+    const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
+    const allowances = await service.list({ providerId, accountId });
+    return writeJson2(res, 200, { allowances });
+  }
+  if (method === "POST" && rest[0] === "refresh") {
+    const body = await readJson(req);
+    const requestedProvider = allowanceProvider(
+      typeof body["providerId"] === "string" ? body["providerId"] : "claude"
+    );
+    if (requestedProvider !== "claude") {
+      return writeError(res, 400, "only Claude allowances support explicit refresh");
     }
-    decisions.push({ providerId, modelId, action });
-    pendingIncoming.set(key, incoming);
+    const accountId = typeof body["accountId"] === "string" && body["accountId"].trim() ? body["accountId"].trim() : void 0;
+    const allowances = await service.refreshClaude(accountId);
+    if (accountId && allowances.length === 0) {
+      return writeError(res, 404, `Claude account '${accountId}' not found`);
+    }
+    return writeJson2(res, 200, { allowances });
   }
-  const resolution = await deps.pricingEngine.resolveConflicts(decisions, pendingIncoming);
-  return { status: 200, body: { ...resolution, staleCount } };
+  return writeError(res, 405, `method ${method} not allowed on account allowances`);
 }
 
 // src/admin/adminApi.ts
 function readBody(req) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -2659,12 +4154,12 @@ async function readJsonBody3(req) {
     return {};
   }
 }
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson2(res, status, { error: { type: "admin_api_error", message } });
+  writeJson3(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -2681,6 +4176,9 @@ function toKeyInfo(row) {
     createdAt: row.createdAt,
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
+    kind: row.kind,
+    allowedEndpoints: row.allowedEndpoints,
+    loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
     // Key-policy envelope (outbound-key-policy) — all secret-free scalar fields;
     // the UI reads them to render + pre-fill the policy editor.
@@ -2766,6 +4264,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleAccounts(req, res, method, rest, deps);
       case "cli":
         return await handleCli(req, res, method, rest, deps);
+      case "integrations":
+        return await handleIntegrations(req, res, method, rest, deps);
       case "status":
         return await handleStatus(res, method, deps);
       case "playground":
@@ -2793,7 +4293,7 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson2(res, result.status, result.body);
+  writeJson3(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
@@ -2802,7 +4302,7 @@ async function handleUsage(req, res, method, rest, deps) {
 async function handleDashboardRoute(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
@@ -2835,13 +4335,13 @@ async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
   const body = await readJsonBody3(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
   const body = await readJsonBody3(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson2(res, result.status, result.body);
+  return writeJson3(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -2872,10 +4372,10 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson2(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson3(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson2(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson3(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
     const body = await readJsonBody3(req);
@@ -2886,7 +4386,7 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson2(res, 201, { provider: toProviderView(provider) });
+    return writeJson3(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -2899,12 +4399,12 @@ async function handleProviders(req, res, method, rest, deps) {
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson2(res, 200, { provider: toProviderView(updated) });
+    return writeJson3(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson2(res, 200, { ok: true });
+    return writeJson3(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -2937,14 +4437,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson2(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson3(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  if (row.apiFormat !== "openai") {
-    return writeJson2(res, 200, { models: [], unsupportedFormat: true });
+  if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
+    return writeJson3(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -2952,7 +4452,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await fetchUpstream(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await fetchUpstream2(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -2961,17 +4461,17 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson2(res, 200, {
+      return writeJson3(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson2(res, 200, { models });
+    return writeJson3(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson2(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson3(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
@@ -2982,13 +4482,13 @@ async function handleTestModel(req, res, id, cfg) {
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson2(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson3(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson2(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson3(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
-  const url = row.baseUrl.replace(/\/+$/, "");
+  let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
   const headers = { "Content-Type": "application/json" };
   let payload;
@@ -2996,6 +4496,10 @@ async function handleTestModel(req, res, id, cfg) {
     headers["x-api-key"] = resolvedKey;
     headers["anthropic-version"] = "2023-06-01";
     payload = { model, max_tokens: 16, messages: [{ role: "user", content: prompt }] };
+  } else if (row.apiFormat === "openai-response") {
+    headers["Authorization"] = `Bearer ${resolvedKey}`;
+    if (!/\/responses$/.test(url)) url = `${url}/v1/responses`;
+    payload = { model, max_output_tokens: 16, stream: false, input: prompt };
   } else {
     headers["Authorization"] = `Bearer ${resolvedKey}`;
     payload = {
@@ -3007,7 +4511,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await fetchUpstream(
+    const response = await fetchUpstream2(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -3021,9 +4525,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson2(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson3(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson2(res, 200, {
+    return writeJson3(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -3031,7 +4535,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson2(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson3(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -3072,7 +4576,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -3103,7 +4607,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3123,7 +4627,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3137,7 +4641,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -3151,7 +4655,7 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson2(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -3269,7 +4773,9 @@ function parseProviderInput(body, existing) {
   const baseUrl = body["baseUrl"];
   if (!id) return null;
   const name = typeof body["name"] === "string" && body["name"].length > 0 ? body["name"] : body["name"] === null ? void 0 : existing?.name;
-  if (apiFormat !== "openai" && apiFormat !== "anthropic" && apiFormat !== "gemini") return null;
+  if (apiFormat !== "openai" && apiFormat !== "anthropic" && apiFormat !== "gemini" && apiFormat !== "openai-response") {
+    return null;
+  }
   if (typeof baseUrl !== "string" || !baseUrl.trim()) return null;
   const rawKey = body["apiKey"];
   let apiKey = typeof rawKey === "string" && rawKey.length > 0 ? rawKey : existing?.apiKey ?? "";
@@ -3291,10 +4797,11 @@ function parseProviderInput(body, existing) {
       apiKey = mode.apiKey;
     }
   }
+  const migrated = migrateFormatAxis(apiFormat, transformer);
   return {
     id,
     name,
-    apiFormat,
+    apiFormat: migrated.apiFormat,
     baseUrl: baseUrl.trim(),
     apiKey,
     models,
@@ -3305,7 +4812,7 @@ function parseProviderInput(body, existing) {
     apiVersion,
     maxConcurrency,
     modelsEndpoint,
-    transformer,
+    transformer: migrated.transformer,
     codingPlan,
     apiModes,
     selectedApiModeId
@@ -3322,13 +4829,13 @@ function handlePresets(res, method) {
     baseUrl: p.baseUrl,
     models: p.models
   }));
-  return writeJson2(res, 200, { presets, excluded });
+  return writeJson3(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson2(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson3(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -3340,13 +4847,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson2(res, 200, { keys });
+    return writeJson3(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
     const body = await readJsonBody3(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
     const created = await createNamedKey(deps.keyDb, name);
-    return writeJson2(res, 201, {
+    return writeJson3(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -3358,13 +4865,13 @@ async function handleKeys(req, res, method, rest, deps) {
   const action = rest[1];
   if (method === "POST" && id && action === "revoke") {
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson2(res, ok ? 200 : 404, { ok });
+    return writeJson3(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
     const body = await readJsonBody3(req);
     const enabled = body["enabled"] === true;
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson2(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson3(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "max-concurrency") {
     const body = await readJsonBody3(req);
@@ -3382,14 +4889,14 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson2(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson3(res, ok ? 200 : 404, { ok, maxConcurrency: value });
   }
   if (method === "POST" && id && action === "policy") {
     const body = await readJsonBody3(req);
     const parsed = parseKeyPolicyBody(body);
     if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson2(res, ok ? 200 : 404, { ok });
+    return writeJson3(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
@@ -3400,10 +4907,10 @@ function validateQueueSegments(patch) {
       errors.push(`${label} must be a number ${min}..${max}`);
     }
   };
-  const isPlainObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  const isPlainObject5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const umq = patch.userMessageQueue;
   if (umq !== void 0) {
-    if (!isPlainObject4(umq)) {
+    if (!isPlainObject5(umq)) {
       errors.push("userMessageQueue must be an object");
     } else {
       if (typeof umq.enabled !== "boolean") {
@@ -3415,7 +4922,7 @@ function validateQueueSegments(patch) {
   }
   const cq = patch.concurrencyQueue;
   if (cq !== void 0) {
-    if (!isPlainObject4(cq)) {
+    if (!isPlainObject5(cq)) {
       errors.push("concurrencyQueue must be an object");
     } else {
       checkNum("concurrencyQueue.maxQueueSizeFactor", cq.maxQueueSizeFactor, 1, 10);
@@ -3425,7 +4932,7 @@ function validateQueueSegments(patch) {
   }
   const ah = patch.accountHealth;
   if (ah !== void 0) {
-    if (!isPlainObject4(ah)) {
+    if (!isPlainObject5(ah)) {
       errors.push("accountHealth must be an object");
     } else {
       if (typeof ah.overloadCooldownEnabled !== "boolean") {
@@ -3436,6 +4943,31 @@ function validateQueueSegments(patch) {
   }
   return errors;
 }
+function validateAllowanceSchedulingSegment(patch) {
+  const value = patch.allowanceScheduling;
+  if (value === void 0) return [];
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return ["allowanceScheduling must be an object"];
+  }
+  const allowance = value;
+  const errors = [];
+  const checkNumber = (field, min, max) => {
+    const candidate = allowance[field];
+    if (typeof candidate !== "number" || !Number.isFinite(candidate) || candidate < min || candidate > max) {
+      errors.push(`allowanceScheduling.${field} must be a number ${min}..${max}`);
+    }
+  };
+  if (typeof allowance.enabled !== "boolean") {
+    errors.push("allowanceScheduling.enabled must be a boolean");
+  }
+  checkNumber("demoteAtPercent", 0, 100);
+  checkNumber("pauseAtPercent", 0, 100);
+  checkNumber("priorityPenalty", 1, 1e3);
+  if (typeof allowance.demoteAtPercent === "number" && typeof allowance.pauseAtPercent === "number" && allowance.pauseAtPercent < allowance.demoteAtPercent) {
+    errors.push("allowanceScheduling.pauseAtPercent must be >= demoteAtPercent");
+  }
+  return errors;
+}
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
     const config = await loadServerConfig2(deps.settingsStore);
@@ -3443,7 +4975,7 @@ async function handleServer(req, res, method, deps) {
     if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
     if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
     if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
-    return writeJson2(res, 200, { server });
+    return writeJson3(res, 200, { server });
   }
   if (method === "PUT") {
     const patch = await readJsonBody3(req);
@@ -3451,6 +4983,18 @@ async function handleServer(req, res, method, deps) {
     if (queueErrors.length > 0) {
       return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
     }
+    const allowanceErrors = validateAllowanceSchedulingSegment(patch);
+    if (allowanceErrors.length > 0) {
+      return writeJsonError(
+        res,
+        400,
+        `invalid allowance scheduling config: ${allowanceErrors.join("; ")}`
+      );
+    }
+    const bindingErrors = validateGatewayBindingsSegment(patch);
+    if (bindingErrors.length > 0) {
+      return writeJsonError(res, 400, `invalid gateway bindings: ${bindingErrors.join("; ")}`);
+    }
     const webhookErrors = validateWebhookSegment(patch);
     if (webhookErrors.length > 0) {
       return writeJsonError(res, 400, `invalid webhook config: ${webhookErrors.join("; ")}`);
@@ -3477,66 +5021,113 @@ async function handleServer(req, res, method, deps) {
     const merged = mergeServerConfig(current, effectivePatch);
     await saveServerConfig(deps.settingsStore, merged);
     setServerProxyConfig(merged.proxy);
+    getSharedAccountAllowanceScheduling2().configure(merged.allowanceScheduling);
+    deps.allowanceRefreshScheduler?.configure(merged.allowanceScheduling);
     applyWebhookConfig(merged.webhook);
     applyAuditConfig(merged.audit);
     applyBillingConfig(merged.billing);
-    if (merged.enabled) {
-      const missing = validateServerModelConfig(merged);
-      if (missing.length > 0) {
-        if (deps.outboundApiServer.getStatus().running) {
-          await deps.outboundApiServer.stop();
-        }
-        return writeJson2(res, 200, {
-          server: merged,
-          error: { code: "incomplete-model-config", missing }
-        });
-      }
-    }
-    try {
-      await deps.outboundApiServer.applyConfig({
-        enabled: merged.enabled,
-        networkBinding: merged.networkBinding,
-        endpoints: merged.endpoints,
-        port: merged.port,
-        userMessageQueue: merged.userMessageQueue,
-        concurrencyQueue: merged.concurrencyQueue,
-        // voucher-redemption #9: hot-apply the voucher flag so enabling the product
-        // takes effect without a restart.
-        voucher: merged.voucher
-      });
-    } catch (err5) {
-      const missing = incompleteConfigMissing(err5);
-      if (missing) {
-        return writeJson2(res, 200, {
-          server: merged,
-          error: { code: "incomplete-model-config", missing }
-        });
-      }
-      throw err5;
-    }
-    return writeJson2(res, 200, { server: merged });
+    await deps.outboundApiServer.applyConfig({
+      enabled: merged.enabled,
+      networkBinding: merged.networkBinding,
+      endpoints: merged.endpoints,
+      bindings: merged.bindings,
+      port: merged.port,
+      userMessageQueue: merged.userMessageQueue,
+      concurrencyQueue: merged.concurrencyQueue,
+      // voucher-redemption #9: hot-apply the voucher flag so enabling the product
+      // takes effect without a restart.
+      voucher: merged.voucher
+    });
+    return writeJson3(res, 200, { server: merged });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
-function incompleteConfigMissing(err5) {
-  if (typeof err5 !== "object" || err5 === null) return null;
-  const missing = err5.missing;
-  return Array.isArray(missing) ? missing : null;
-}
 async function handleAccounts(req, res, method, rest, deps) {
+  if (rest[0] === "allowances") {
+    return handleAccountAllowanceApi(
+      req,
+      res,
+      method,
+      rest.slice(1),
+      deps.accountAllowanceService
+    );
+  }
   if (method === "GET" && rest.length === 0) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson2(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson3(res, 200, { accounts, providerAccounts, externalCli });
+  }
+  if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
+    const body = await readJsonBody3(req);
+    const parsed = validateAccountBatchBody(body);
+    if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
+    const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
+    if (!result.ok) {
+      return writeJsonError(
+        res,
+        404,
+        `account '${result.missing.accountId}' not found for provider '${result.missing.providerId}'`
+      );
+    }
+    if (parsed.mutation.action === "delete") {
+      for (const ref of parsed.refs) {
+        deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
+      }
+    }
+    return writeJson3(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
     const result = handleCodexOAuthCancel(rest[2], deps);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
+  }
+  if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const accountId = rest[1];
+    const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+    if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+      return writeJsonError(res, 404, `account '${accountId}' not found`);
+    }
+    const health2 = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
+    const allowance = deps.accountAllowanceService?.getSchedulingStatus?.()?.history.filter((entry) => entry.providerId === providerId && entry.accountId === accountId).map((entry) => ({
+      kind: "allowance-policy",
+      at: Date.parse(entry.decidedAt),
+      providerId: entry.providerId,
+      accountId: entry.accountId,
+      action: entry.action,
+      reason: entry.reason,
+      usedPercent: entry.usedPercent,
+      resumeAt: entry.resumeAt
+    })) ?? [];
+    const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
+    return writeJson3(res, 200, { diagnostics });
+  }
+  if (method === "GET" && rest.length === 3 && rest[2] === "events") {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const accountId = rest[1];
+    const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+    if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+      return writeJsonError(res, 404, `account '${accountId}' not found`);
+    }
+    const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
+    const diagnostics = getSharedAccountHealth().getDiagnostics({ providerId, accountId });
+    return writeJson3(res, 200, { events: snapshot?.records ?? [], diagnostics });
+  }
+  if (method === "PATCH" && rest.length === 2) {
+    const providerId = asSubscriptionProviderId(rest[0]);
+    if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
+    const body = await readJsonBody3(req);
+    const patch = validateAccountMetadataPatch(body);
+    if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
+    const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
+    if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
+    return writeJson3(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -3545,12 +5136,12 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson2(res, result.status, result.body);
+      return writeJson3(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
       const body2 = await readJsonBody3(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson2(res, result.status, result.body);
+      return writeJson3(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
       const body2 = await readJsonBody3(req);
@@ -3561,7 +5152,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson3(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
@@ -3574,7 +5165,13 @@ async function handleAccounts(req, res, method, rest, deps) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, { ok: true, account: status2 ?? void 0 });
+      return writeJson3(res, 200, {
+        ok: true,
+        account: status2 ?? void 0,
+        nativeCredentialMode: result.nativeCredentialMode,
+        refreshWritesNativeCredentials: result.refreshWritesNativeCredentials,
+        message: "Imported a read-only copy. Omnicross does not manage the native CLI credential file and future refreshes do not write it."
+      });
     }
     if (method === "POST" && rest[1] === "refresh") {
       if (providerId === "opencodego") {
@@ -3583,7 +5180,17 @@ async function handleAccounts(req, res, method, rest, deps) {
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson2(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson3(res, 200, { ok, account: status2 ?? void 0 });
+    }
+    if (method === "POST" && rest.length === 3 && rest[2] === "test") {
+      const accountId = rest[1];
+      if (!deps.accountProbeService) return writeJsonError(res, 501, "account probe service unavailable");
+      const listed = await deps.subscriptionTokenWriter.listSanitizedAccounts();
+      if (!(listed[providerId] ?? []).some((account) => account.id === accountId)) {
+        return writeJsonError(res, 404, `account '${accountId}' not found`);
+      }
+      const result = await deps.accountProbeService.probeAccount(providerId, accountId);
+      return writeJson3(res, 200, { ok: result.ok, marked: result.marked });
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
@@ -3591,7 +5198,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
@@ -3603,7 +5210,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
@@ -3616,7 +5223,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
@@ -3625,7 +5232,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
       const body2 = await readJsonBody3(req);
@@ -3633,17 +5240,22 @@ async function handleAccounts(req, res, method, rest, deps) {
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      return writeJson3(res, 200, { ok: true });
     }
-    if (method === "DELETE" && rest.length >= 2) {
+    if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson2(res, 200, { ok: true });
+      deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
+      return writeJson3(res, 200, { ok: true });
     }
-    if (method === "DELETE") {
+    if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
-      return writeJson2(res, 200, { ok: true });
+      deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
+      return writeJson3(res, 200, { ok: true });
+    }
+    if (method === "DELETE") {
+      return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
     }
     const body = await readJsonBody3(req);
     const config = validateTokenBody(providerId, body);
@@ -3652,22 +5264,22 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson2(res, 200, status ? { account: status } : { ok: true });
+    return writeJson3(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -3675,7 +5287,7 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
@@ -3690,28 +5302,100 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson2(res, result.status, result.body);
+    return writeJson3(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
+async function handleIntegrations(req, res, method, rest, deps) {
+  const factory = deps.integrationManagerFactory;
+  if (!factory) return writeJsonError(res, 501, "native CLI integration is not available");
+  const manager = factory();
+  try {
+    if (method === "GET" && rest.length === 0) {
+      return writeJson3(res, 200, {
+        integrations: await manager.listStatus(),
+        gateway: deps.outboundApiServer.getStatus()
+      });
+    }
+    if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
+      await manager.rotateGatewayKey();
+      return writeJson3(res, 200, { ok: true, integrations: await manager.listStatus() });
+    }
+    const client = rest[0];
+    if (!isIntegrationClient(client)) {
+      return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
+    }
+    if (method === "POST" && rest[1] === "plan") {
+      const body = await readJsonBody3(req);
+      const configPath = body.configPath;
+      if (configPath !== void 0 && typeof configPath !== "string") {
+        return writeJsonError(res, 400, "configPath must be a string");
+      }
+      const plan = await manager.plan(client, configPath);
+      return writeJson3(res, 200, { plan });
+    }
+    if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
+      const body = await readJsonBody3(req);
+      const configPath = body.configPath;
+      if (configPath !== void 0 && typeof configPath !== "string") {
+        return writeJsonError(res, 400, "configPath must be a string");
+      }
+      const status = await manager.install(client, configPath);
+      return writeJson3(res, 200, { integration: status });
+    }
+    if (method === "POST" && rest[1] === "repair") {
+      const status = await manager.repair(client);
+      return writeJson3(res, 200, { integration: status });
+    }
+    if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
+      const status = await manager.remove(client);
+      return writeJson3(res, 200, { integration: status });
+    }
+    return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
+  } catch (error) {
+    if (error instanceof IntegrationConflictError) {
+      return writeJsonError(res, 409, error.message);
+    }
+    throw error;
+  }
+}
+function isIntegrationClient(value) {
+  return value === "codex" || value === "claude";
+}
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
   const serverConfig = await loadServerConfig2(deps.settingsStore);
-  const endpoints = serverConfig.endpoints.map((e) => {
-    if (isKindMappedEndpoint(e.endpoint)) {
-      return { endpoint: e.endpoint, kinds: e.modelMap ?? {}, useSubscription: e.useSubscription };
+  const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
+    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => gatewayBindingToEndpointConfig(binding));
+    const useSubscription = routes.some((route) => route.useSubscription);
+    if (isKindMappedEndpoint(endpoint)) {
+      const kinds = {};
+      for (const route of routes) {
+        for (const [kind, ref] of Object.entries(route.modelMap ?? {})) {
+          if (ref?.trim() && !kinds[kind]) kinds[kind] = ref;
+        }
+      }
+      return { endpoint, kinds, useSubscription };
     }
-    if (e.endpoint === "chat") {
-      return { endpoint: e.endpoint, models: e.models ?? [], useSubscription: e.useSubscription };
+    if (endpoint === "chat") {
+      return {
+        endpoint,
+        models: [...new Set(routes.flatMap((route) => route.models ?? []))],
+        useSubscription
+      };
     }
-    return { endpoint: e.endpoint, model: e.defaultModel ?? "", useSubscription: e.useSubscription };
+    return {
+      endpoint,
+      model: routes.find((route) => route.defaultModel?.trim())?.defaultModel ?? "",
+      useSubscription
+    };
   });
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson2(res, 200, { ...status, endpoints, queueStatus });
+    return writeJson3(res, 200, { ...status, endpoints, queueStatus });
   }
-  return writeJson2(res, 200, { ...status, endpoints });
+  return writeJson3(res, 200, { ...status, endpoints });
 }
 function resolvePlaygroundPath(endpoint, body) {
   switch (endpoint) {
@@ -3737,16 +5421,16 @@ async function handlePlayground(req, res, method, deps) {
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord2(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord(v) {
+function isRecord2(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const upstream = http.request(
       {
         host: "127.0.0.1",
@@ -3767,14 +5451,14 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         proxRes.on("data", (chunk) => res.write(chunk));
         proxRes.on("end", () => {
           res.end();
-          resolve();
+          resolve2();
         });
       }
     );
     upstream.on("error", (err5) => {
       if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err5.message}`);
       else res.end();
-      resolve();
+      resolve2();
     });
     upstream.write(body);
     upstream.end();
@@ -3782,7 +5466,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-import { existsSync as existsSync3, statSync } from "fs";
+import { existsSync as existsSync6, statSync as statSync2 } from "fs";
 import { readFile } from "fs/promises";
 import { createRequire } from "module";
 import path from "path";
@@ -3805,13 +5489,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return existsSync3(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
+    return existsSync6(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
   }
   try {
     const req = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
     const dist = path.join(path.dirname(pkgJson), "dist");
-    return existsSync3(path.join(dist, "index.html")) ? dist : null;
+    return existsSync6(path.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -3860,7 +5544,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     return true;
   }
   let target = filePath;
-  if (!existsSync3(target) || statSync(target).isDirectory()) {
+  if (!existsSync6(target) || statSync2(target).isDirectory()) {
     if (path.extname(rel) === "") {
       target = path.join(uiDist, "index.html");
     } else {
@@ -3877,7 +5561,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.6" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -3916,14 +5600,14 @@ var AdminServer = class {
   }
   /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
   listen(bindAddr, port) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const server = http2.createServer((req, res) => {
         this.onRequest(req, res);
       });
       const onError = (err5) => {
         if (err5.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
-          this.listen(bindAddr, 0).then(resolve, reject);
+          this.listen(bindAddr, 0).then(resolve2, reject);
           return;
         }
         reject(err5);
@@ -3935,7 +5619,7 @@ var AdminServer = class {
           server.removeListener("error", onError);
           server.on("error", (e) => this.deps.logger.error("[AdminServer] server error", e));
           this.server = server;
-          resolve(addr.port);
+          resolve2(addr.port);
         } else {
           reject(new Error("Failed to get admin server address"));
         }
@@ -4016,8 +5700,8 @@ var AdminServer = class {
     if (!server) return;
     this.server = null;
     this.boundPort = 0;
-    return new Promise((resolve) => {
-      server.close(() => resolve());
+    return new Promise((resolve2) => {
+      server.close(() => resolve2());
     });
   }
   /** A live status snapshot. */
@@ -4133,7 +5817,7 @@ function pageHtml(message) {
   return `<!doctype html><meta charset="utf-8"><title>omnicross login</title><body style="font-family:sans-serif;padding:2rem"><h2>${message}</h2><p>You can close this window and return to the terminal.</p></body>`;
 }
 function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const finish = (server2, fn) => {
       if (settled) return;
@@ -4164,7 +5848,7 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       }
       res.writeHead(200, { "Content-Type": "text/html" });
       res.end(pageHtml("Login complete."));
-      finish(server, () => resolve(code));
+      finish(server, () => resolve2(code));
     });
     const abort = () => finish(server, () => reject(new Error("login: cancelled")));
     if (signal?.aborted) {
@@ -4259,21 +5943,30 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/commands/paths.ts
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname5, join as join5 } from "path";
 function defaultVouchersPath(configPath) {
-  return join3(dirname2(configPath), "vouchers.json");
+  return join5(dirname5(configPath), "vouchers.json");
+}
+function defaultIntegrationsPath(configPath) {
+  return join5(dirname5(configPath), "integrations.json");
 }
 function defaultPricingPath(configPath) {
-  return join3(dirname2(configPath), "pricing.json");
+  return join5(dirname5(configPath), "pricing.json");
+}
+function defaultPricingRefreshStatePath(configPath) {
+  return join5(dirname5(configPath), "pricing-refresh.json");
+}
+function defaultAccountAllowancePath(configPath) {
+  return join5(dirname5(configPath), "allowance-cache.json");
 }
 function defaultUsageEventsPath(configPath) {
-  return join3(dirname2(configPath), "usage-events.jsonl");
+  return join5(dirname5(configPath), "usage-events.jsonl");
 }
 function defaultAuditDir(configPath) {
-  return join3(dirname2(configPath), "audit");
+  return join5(dirname5(configPath), "audit");
 }
 function defaultBillingDir(configPath) {
-  return join3(dirname2(configPath), "billing");
+  return join5(dirname5(configPath), "billing");
 }
 
 // src/ports/ConfigFileProviderConfigSource.ts
@@ -4286,8 +5979,10 @@ var EMPTY_CHAIN = {
   modelTransformers: []
 };
 var FORMAT_TRANSFORMER = {
+  openai: "openai",
   anthropic: "anthropic",
-  gemini: "gemini"
+  gemini: "gemini",
+  "openai-response": "openai-response"
 };
 var ConfigFileProviderConfigSource = class {
   providers = /* @__PURE__ */ new Map();
@@ -4356,7 +6051,7 @@ var ConfigFileProviderConfigSource = class {
   }
   async getMainTransformer(providerId) {
     const row = this.providers.get(providerId);
-    if (!row || row.apiFormat === "openai") return null;
+    if (!row) return null;
     const name = FORMAT_TRANSFORMER[row.apiFormat];
     const instances = this.transformerService.resolveTransformerReferences([name]);
     return instances[0] ?? null;
@@ -4366,11 +6061,8 @@ var ConfigFileProviderConfigSource = class {
     if (!row) return EMPTY_CHAIN;
     const customRefs = row.transformer?.use ?? [];
     if (customRefs.length === 0) return EMPTY_CHAIN;
-    const formatName = row.apiFormat === "openai" ? void 0 : FORMAT_TRANSFORMER[row.apiFormat];
-    const effectiveRefs = formatName ? customRefs.filter((ref) => (typeof ref === "string" ? ref : ref[0]) !== formatName) : customRefs;
-    if (effectiveRefs.length === 0) return EMPTY_CHAIN;
     return {
-      providerTransformers: this.transformerService.resolveTransformerReferences(effectiveRefs),
+      providerTransformers: this.transformerService.resolveTransformerReferences(customRefs),
       modelTransformers: []
     };
   }
@@ -4401,7 +6093,7 @@ function resolvePreferredApiKey(row) {
 }
 function toLLMProvider(row) {
   const apiFormat = row.apiFormat === "gemini" ? "google" : row.apiFormat;
-  const transformer = row.apiFormat === "openai" ? void 0 : { use: [FORMAT_TRANSFORMER[row.apiFormat]] };
+  const transformer = { use: [FORMAT_TRANSFORMER[row.apiFormat]] };
   const allModels = row.models ?? [];
   const models = row.modelConfigs ? allModels.filter((id) => row.modelConfigs.find((c) => c.id === id)?.enabled !== false) : allModels;
   return {
@@ -4471,7 +6163,7 @@ var ConfigurableLogger = class {
     const stream = this.fileStream;
     this.fileStream = null;
     if (!stream) return Promise.resolve();
-    return new Promise((resolve) => stream.end(() => resolve()));
+    return new Promise((resolve2) => stream.end(() => resolve2()));
   }
   emit(level, message, error, meta) {
     if (LEVEL_ORDER[level] > this.threshold) return;
@@ -4582,7 +6274,7 @@ function safeStringify(value) {
 }
 
 // src/ports/JsonApiServerSettingsStore.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { OUTBOUND_API_SERVER_CONFIG_KEY } from "@omnicross/core/outbound-api";
 var JsonApiServerSettingsStore = class {
   /**
@@ -4609,7 +6301,7 @@ var JsonApiServerSettingsStore = class {
     if (key !== OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
-    writeFileSync3(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
+    writeFileSync5(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   }
   /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
   encryptSecrets(config) {
@@ -4632,7 +6324,7 @@ var JsonApiServerSettingsStore = class {
   /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
   readFile() {
     try {
-      const raw = readFileSync3(this.configPath, "utf8");
+      const raw = readFileSync6(this.configPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object") return parsed;
     } catch {
@@ -4642,8 +6334,8 @@ var JsonApiServerSettingsStore = class {
 };
 
 // src/ports/JsonlUsageEventStore.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { appendFileSync, existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { randomUUID as randomUUID4 } from "crypto";
+import { appendFileSync, existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
 var JsonlUsageEventStore = class {
   constructor(eventsPath, isPriced) {
     this.eventsPath = eventsPath;
@@ -4655,7 +6347,7 @@ var JsonlUsageEventStore = class {
   async insert(input) {
     const row = {
       ...input,
-      id: randomUUID3(),
+      id: randomUUID4(),
       ts: input.ts ?? Date.now()
     };
     appendFileSync(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
@@ -4753,15 +6445,15 @@ var JsonlUsageEventStore = class {
    * Used to lazily seed the outbound key-policy spend tracker (once per key). A
    * key with no attributed events yields all zeros.
    */
-  async getSpendByKey(query) {
+  async getSpendByKey(query2) {
     let totalUsd = 0;
     let dailyUsd = 0;
     let weeklyUsd = 0;
-    for (const row of this.readRows({ startTs: 0, endTs: query.endTs })) {
-      if (row.apiKeyId !== query.apiKeyId) continue;
+    for (const row of this.readRows({ startTs: 0, endTs: query2.endTs })) {
+      if (row.apiKeyId !== query2.apiKeyId) continue;
       totalUsd += row.costUsd;
-      if (row.ts >= query.dayStartTs) dailyUsd += row.costUsd;
-      if (row.ts >= query.weekStartTs) weeklyUsd += row.costUsd;
+      if (row.ts >= query2.dayStartTs) dailyUsd += row.costUsd;
+      if (row.ts >= query2.weekStartTs) weeklyUsd += row.costUsd;
     }
     return { totalUsd, dailyUsd, weeklyUsd };
   }
@@ -4846,10 +6538,10 @@ var JsonlUsageEventStore = class {
   }
   /** Parse every line, skipping malformed/torn lines defensively. */
   readAllRows() {
-    if (!existsSync4(this.eventsPath)) return [];
+    if (!existsSync7(this.eventsPath)) return [];
     let raw;
     try {
-      raw = readFileSync4(this.eventsPath, "utf8");
+      raw = readFileSync7(this.eventsPath, "utf8");
     } catch {
       return [];
     }
@@ -4933,7 +6625,7 @@ function isUsageEventRecord(parsed) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
 var JsonOutboundKeyDb = class {
   constructor(keysPath) {
     this.keysPath = keysPath;
@@ -4959,7 +6651,10 @@ var JsonOutboundKeyDb = class {
       enabled: true,
       createdAt: input.createdAt ?? Date.now(),
       lastUsedAt: null,
-      revokedAt: null
+      revokedAt: null,
+      kind: input.kind,
+      allowedEndpoints: input.allowedEndpoints,
+      loopbackOnly: input.loopbackOnly
     };
     rows.push(row);
     this.writeRows(rows);
@@ -5036,16 +6731,16 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync5(this.keysPath)) return [];
+    if (!existsSync8(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync5(this.keysPath, "utf8"));
+      const parsed = JSON.parse(readFileSync8(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    writeFileSync4(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    writeFileSync6(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 function applyPolicyField(row, field, value) {
@@ -5055,12 +6750,29 @@ function applyPolicyField(row, field, value) {
 }
 
 // src/ports/JsonPricingStore.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
+import { randomUUID as randomUUID5 } from "crypto";
 var JsonPricingStore = class {
   constructor(pricingPath) {
     this.pricingPath = pricingPath;
   }
   pricingPath;
+  /**
+   * Return whether the durable snapshot can actually serve at least one price.
+   *
+   * This intentionally checks the file itself instead of relying on refresh
+   * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
+   * otherwise unusable pricing table after a crash or manual file edit.
+   */
+  hasUsableSnapshot() {
+    if (!existsSync9(this.pricingPath)) return false;
+    try {
+      const parsed = JSON.parse(readFileSync9(this.pricingPath, "utf8"));
+      return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
+    } catch {
+      return false;
+    }
+  }
   async getAll() {
     return this.readRows();
   }
@@ -5073,17 +6785,17 @@ var JsonPricingStore = class {
    */
   async upsert(input, asUserEdit) {
     const rows = this.readRows();
-    const entry = this.applyUpsert(rows, input, asUserEdit);
+    const entry = this.applyUpsert(rows, input, asUserEdit, "litellm");
     this.writeRows(rows);
     return entry;
   }
   /**
    * Apply a batch fetched from a pricing source. Rows whose local copy is
    * user-edited are NOT applied — they come back as `{ current, incoming }`
-   * conflicts; everything else is upserted (source 'litellm'). ONE file write
-   * for the whole batch.
+   * conflicts; everything else is upserted with the supplied automatic source.
+   * ONE file write for the whole batch.
    */
-  async bulkApplyFromSource(entries) {
+  async bulkApplyFromSource(entries, source = "litellm") {
     const rows = this.readRows();
     const applied = [];
     const conflicts = [];
@@ -5099,7 +6811,8 @@ var JsonPricingStore = class {
         rows,
         incoming,
         /* asUserEdit */
-        false
+        false,
+        source
       ));
     }
     if (applied.length > 0) this.writeRows(rows);
@@ -5122,7 +6835,8 @@ var JsonPricingStore = class {
         rows,
         r.incoming,
         /* asUserEdit */
-        false
+        false,
+        "litellm"
       );
       overwrittenCount += 1;
     }
@@ -5143,7 +6857,7 @@ var JsonPricingStore = class {
     return true;
   }
   /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
-  applyUpsert(rows, input, asUserEdit) {
+  applyUpsert(rows, input, asUserEdit, automaticSource) {
     const now = Date.now();
     const entry = {
       providerId: input.providerId,
@@ -5152,7 +6866,7 @@ var JsonPricingStore = class {
       outputPricePer1m: input.outputPricePer1m,
       cacheReadPricePer1m: input.cacheReadPricePer1m ?? null,
       cacheWritePricePer1m: input.cacheWritePricePer1m ?? null,
-      source: asUserEdit ? "user" : "litellm",
+      source: asUserEdit ? "user" : automaticSource,
       userEdited: asUserEdit,
       editedAt: asUserEdit ? now : null,
       updatedAt: now
@@ -5166,21 +6880,142 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync6(this.pricingPath)) return [];
+    if (!existsSync9(this.pricingPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync6(this.pricingPath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    writeFileSync5(this.pricingPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID5()}.tmp`;
+    try {
+      writeFileSync7(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
+        encoding: "utf8",
+        flag: "wx"
+      });
+      this.replaceFile(temporaryPath);
+    } finally {
+      rmSync2(temporaryPath, { force: true });
+    }
+  }
+  /** Isolated for deterministic failure testing; never removes the target. */
+  replaceFile(temporaryPath) {
+    renameSync3(temporaryPath, this.pricingPath);
+  }
+};
+function isUsablePricingRow(value) {
+  if (!value || typeof value !== "object") return false;
+  const row = value;
+  return typeof row.providerId === "string" && row.providerId.length > 0 && typeof row.modelId === "string" && row.modelId.length > 0 && typeof row.inputPricePer1m === "number" && Number.isFinite(row.inputPricePer1m) && typeof row.outputPricePer1m === "number" && Number.isFinite(row.outputPricePer1m);
+}
+
+// src/pricing/PricingRefreshScheduler.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10, renameSync as renameSync4, writeFileSync as writeFileSync8 } from "fs";
+var EMPTY_STATE2 = {
+  lastAttemptAt: null,
+  lastSuccessAt: null,
+  lastError: null,
+  sources: []
+};
+var PricingRefreshScheduler = class {
+  constructor(engine, catalog2, statePath, logger, options = {}) {
+    this.engine = engine;
+    this.catalog = catalog2;
+    this.statePath = statePath;
+    this.logger = logger;
+    this.staleAfterMs = options.staleAfterMs ?? 24 * 60 * 60 * 1e3;
+    this.intervalMs = options.intervalMs ?? 60 * 60 * 1e3;
+    this.now = options.now ?? Date.now;
+  }
+  engine;
+  catalog;
+  statePath;
+  logger;
+  staleAfterMs;
+  intervalMs;
+  now;
+  timer = null;
+  inFlight = null;
+  /** Fire one stale check immediately and arm an unref'ed periodic check. */
+  start() {
+    if (this.timer) return;
+    void this.refreshIfStale();
+    this.timer = setInterval(() => void this.refreshIfStale(), this.intervalMs);
+    this.timer.unref?.();
+  }
+  dispose() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+  getState() {
+    if (!existsSync10(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    try {
+      const value = JSON.parse(readFileSync10(this.statePath, "utf8"));
+      return {
+        lastAttemptAt: finiteOrNull(value.lastAttemptAt),
+        lastSuccessAt: finiteOrNull(value.lastSuccessAt),
+        lastError: typeof value.lastError === "string" ? value.lastError : null,
+        sources: Array.isArray(value.sources) ? value.sources : []
+      };
+    } catch {
+      return { ...EMPTY_STATE2, sources: [] };
+    }
+  }
+  /** Public for admin/manual tests; concurrent checks share one promise. */
+  refreshIfStale(force = false) {
+    if (this.inFlight) return this.inFlight;
+    const state = this.getState();
+    if (!force && this.catalog.hasUsableSnapshot() && state.lastSuccessAt !== null && this.now() - state.lastSuccessAt < this.staleAfterMs) {
+      return Promise.resolve();
+    }
+    const task = this.runRefresh(state);
+    this.inFlight = task;
+    return task.finally(() => {
+      if (this.inFlight === task) this.inFlight = null;
+    });
+  }
+  async runRefresh(previous) {
+    const lastAttemptAt = this.now();
+    try {
+      const result = await this.engine.fetchLatestFromSource();
+      const failed = result.sources.filter((source) => source.status === "failed");
+      const complete = failed.length === 0;
+      this.writeState({
+        lastAttemptAt,
+        // A partial refresh keeps useful rows, but remains stale so the failed
+        // source is retried on the next hourly check instead of 24 hours later.
+        lastSuccessAt: complete ? this.now() : previous.lastSuccessAt,
+        lastError: complete ? null : failed.map((source) => `${source.source}: ${source.error ?? "failed"}`).join("; "),
+        sources: result.sources
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.writeState({
+        lastAttemptAt,
+        lastSuccessAt: previous.lastSuccessAt,
+        lastError: message,
+        sources: previous.sources
+      });
+      this.logger.warn("[PricingRefreshScheduler] background refresh failed; cached prices retained", {
+        error: message
+      });
+    }
+  }
+  writeState(state) {
+    const temporaryPath = `${this.statePath}.tmp`;
+    writeFileSync8(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+    renameSync4(temporaryPath, this.statePath);
   }
 };
+function finiteOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 
 // src/ports/JsonVoucherDb.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -5258,25 +7093,26 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync7(this.vouchersPath)) return [];
+    if (!existsSync11(this.vouchersPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync7(this.vouchersPath, "utf8"));
+      const parsed = JSON.parse(readFileSync11(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    writeFileSync6(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    writeFileSync9(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname4 } from "path";
-import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
-import { fetchUpstream as fetchUpstream2 } from "@omnicross/core/pipeline/upstreamFetch";
-import { getSharedIdentityStore } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname6 } from "path";
+import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import { getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling3 } from "@omnicross/core/pipeline/AccountAllowanceScheduling";
+import { fetchUpstream as fetchUpstream3 } from "@omnicross/core/pipeline/upstreamFetch";
+import { getSharedIdentityStore as getSharedIdentityStore2 } from "@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore";
 import {
   claudeOAuth as claudeOAuth2,
   codexOAuth as codexOAuth2,
@@ -5284,33 +7120,9 @@ import {
 } from "@omnicross/subscriptions";
 
 // src/ports/account-sync.ts
-var IMPORT_EXPIRY_MARGIN_MS = 6e4;
 function viewOf(tokens) {
   return tokens;
 }
-function decideExternalImport(captured, external, now = Date.now()) {
-  if (!external?.accessToken) return "no-credential";
-  const capturedRt = viewOf(captured).refreshToken;
-  const hasNewRefresh = Boolean(external.refreshToken && external.refreshToken !== capturedRt);
-  const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > now + IMPORT_EXPIRY_MARGIN_MS : true;
-  return hasNewRefresh || accessStillValid ? "import" : "not-rotated";
-}
-function buildImportedTokens(captured, external) {
-  const imported = {
-    ...captured,
-    accessToken: external.accessToken,
-    status: "authorized",
-    errorMessage: void 0,
-    syncWarning: void 0,
-    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (external.refreshToken) imported.refreshToken = external.refreshToken;
-  if (external.expiresAt) imported.expiresAt = external.expiresAt;
-  else delete imported.expiresAt;
-  if (external.idToken) imported.idToken = external.idToken;
-  if (external.scopes) imported.scopes = external.scopes;
-  return imported;
-}
 function buildTokensFromExternal(provider, external) {
   const base = {
     authMethod: "oauth",
@@ -5331,14 +7143,6 @@ function buildTokensFromExternal(provider, external) {
   if (external.idToken) tokens.idToken = external.idToken;
   return tokens;
 }
-function isExternalDivergent(stored, external) {
-  if (!external?.accessToken || !external.refreshToken) return false;
-  const view = viewOf(stored);
-  if (!view.refreshToken || external.refreshToken === view.refreshToken) return false;
-  const storedExp = view.expiresAt ? Date.parse(view.expiresAt) : NaN;
-  const externalExp = external.expiresAt ? Date.parse(external.expiresAt) : Infinity;
-  return !Number.isFinite(storedExp) || externalExp > storedExp;
-}
 function findDuplicateCredentialIds(accounts) {
   const byCredential = /* @__PURE__ */ new Map();
   for (const account of accounts) {
@@ -5357,11 +7161,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
-function externalStorePath(provider, home = homedir2()) {
-  return provider === "claude" ? join4(home, ".claude", ".credentials.json") : join4(home, ".codex", "auth.json");
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+function externalStorePath(provider, home = homedir3()) {
+  return provider === "claude" ? join6(home, ".claude", ".credentials.json") : join6(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -5408,12 +7212,12 @@ function parseCodexTokensEnvelope(raw) {
   }
   return parsed;
 }
-function readExternalCliCredentials(provider, home = homedir2()) {
+function readExternalCliCredentials(provider, home = homedir3()) {
   const path2 = externalStorePath(provider, home);
-  if (!existsSync8(path2)) return null;
+  if (!existsSync12(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse(readFileSync8(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync12(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -5421,84 +7225,6 @@ function readExternalCliCredentials(provider, home = homedir2()) {
   return provider === "claude" ? parseClaudeOAuthEnvelope(raw) : parseCodexTokensEnvelope(raw);
 }
 
-// src/ports/external-cli-store.ts
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync9, renameSync, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3 } from "path";
-function markerPath(provider, home) {
-  return `${externalStorePath(provider, home)}.omnicross-managed`;
-}
-function backupPath(provider, home) {
-  return `${externalStorePath(provider, home)}.omnicross-backup`;
-}
-function buildClaudeOAuthEnvelope(tokens) {
-  if (!tokens.accessToken) return null;
-  const envelope = { accessToken: tokens.accessToken };
-  if (tokens.refreshToken) envelope.refreshToken = tokens.refreshToken;
-  if (tokens.expiresAt) {
-    const ms = Date.parse(tokens.expiresAt);
-    if (Number.isFinite(ms)) envelope.expiresAt = ms;
-  }
-  if (tokens.scopes && tokens.scopes.length > 0) envelope.scopes = tokens.scopes;
-  return envelope;
-}
-function buildCodexTokensEnvelope(tokens) {
-  if (!tokens.accessToken && !tokens.idToken) return null;
-  const envelope = { access_token: tokens.accessToken ?? "" };
-  if (tokens.idToken) envelope.id_token = tokens.idToken;
-  if (tokens.refreshToken) envelope.refresh_token = tokens.refreshToken;
-  return envelope;
-}
-function readExistingObject(path2) {
-  if (!existsSync9(path2)) return {};
-  try {
-    const parsed = JSON.parse(readFileSync9(path2, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function writeAtomic(path2, content) {
-  mkdirSync2(dirname3(path2), { recursive: true });
-  const temp = `${path2}.omnicross-tmp`;
-  writeFileSync7(temp, content, "utf8");
-  renameSync(temp, path2);
-}
-function createExternalCliStore(home = homedir3()) {
-  return {
-    readMarkerAccountId(provider) {
-      const path2 = markerPath(provider, home);
-      if (!existsSync9(path2)) return void 0;
-      try {
-        const parsed = JSON.parse(readFileSync9(path2, "utf8"));
-        return typeof parsed.accountId === "string" && parsed.accountId ? parsed.accountId : void 0;
-      } catch {
-        return void 0;
-      }
-    },
-    writeMarker(provider, accountId) {
-      writeAtomic(
-        markerPath(provider, home),
-        JSON.stringify({ accountId, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
-      );
-    },
-    writeBack(provider, accountId, tokens) {
-      const owner = this.readMarkerAccountId(provider);
-      if (owner !== accountId) return false;
-      const envelope = provider === "claude" ? buildClaudeOAuthEnvelope(tokens) : buildCodexTokensEnvelope(tokens);
-      if (!envelope) return false;
-      const storePath = externalStorePath(provider, home);
-      if (existsSync9(storePath) && !existsSync9(backupPath(provider, home))) {
-        copyFileSync(storePath, backupPath(provider, home));
-      }
-      const existing = readExistingObject(storePath);
-      const merged = provider === "claude" ? { ...existing, claudeAiOauth: envelope } : { ...existing, tokens: envelope };
-      writeAtomic(storePath, JSON.stringify(merged, null, 2) + "\n");
-      return true;
-    }
-  };
-}
-
 // src/ports/JsonSubscriptionCredentialStore.ts
 var ACCOUNT_REFRESH_LEAD_MS = 5 * 6e4;
 var JsonSubscriptionCredentialStore = class {
@@ -5511,32 +7237,30 @@ var JsonSubscriptionCredentialStore = class {
    *                    proxy-aware {@link fetchUpstream} that threads the
    *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
    *                    per-account/per-provider proxy is honored on refresh exactly
-   *                    as on relay — refresh egresses from the SAME proxy IP as the
+   *                    as on relay refresh egresses from the SAME proxy IP as the
    *                    account's traffic. NOT used by any read/write path.
    */
-  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials, externalCliStore = createExternalCliStore()) {
+  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials) {
     this.tokensPath = tokensPath;
     this.box = box;
     this.fetchImpl = fetchImpl;
     this.externalCliReader = externalCliReader;
-    this.externalCliStore = externalCliStore;
   }
   tokensPath;
   box;
   fetchImpl;
   externalCliReader;
-  externalCliStore;
   /**
    * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
    * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
    * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
-   * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+   * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => fetchUpstream2(url, init, { providerId, accountId }));
+    return this.fetchImpl ?? ((url, init) => fetchUpstream3(url, init, { providerId, accountId }));
   }
   /**
-   * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+   * In-flight refresh coalescing. OAuth refresh tokens are
    * SINGLE-USE: two concurrent refreshes of one account each spend the same
    * token and the loser bricks a healthy account. Every refresh entry point
    * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
@@ -5551,13 +7275,13 @@ var JsonSubscriptionCredentialStore = class {
     return run;
   }
   /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
-   *  file is absent/corrupt). This is the hot read — the codex / gemini auth
+   *  file is absent/corrupt). This is the hot read the codex / gemini auth
    *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
   async getFullConfig() {
     return this.readConfig();
   }
   /** Current Claude OAuth access token, or `null` when none is stored. No inline
-   *  refresh here — the lead-window / 401-retry refresh is driven by the
+   *  refresh here the lead-window / 401-retry refresh is driven by the
    *  subscription auth strategy, which calls `refreshClaudeToken` (now real). */
   async getValidClaudeAccessToken() {
     return this.readConfig().claude?.accessToken ?? null;
@@ -5582,13 +7306,14 @@ var JsonSubscriptionCredentialStore = class {
   /**
    * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
    * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
-   * shape (id/label/status/expiresAt/hasAccessToken/isActive) — NEVER a token.
+   * shape (id/label/status/expiresAt/hasAccessToken/isActive) NEVER a token.
    * Used by the admin accounts GET (secret-IN-never-OUT).
    */
   async listSanitizedAccounts() {
     const config = this.readConfig();
-    const health2 = getSharedAccountHealth();
-    const identityStore = getSharedIdentityStore();
+    const health2 = getSharedAccountHealth2();
+    const allowanceScheduling = getSharedAccountAllowanceScheduling3();
+    const identityStore = getSharedIdentityStore2();
     const fingerprintOn = identityStore.isEnabled();
     const now = Date.now();
     const out = {};
@@ -5597,7 +7322,13 @@ var JsonSubscriptionCredentialStore = class {
       if (sanitized.length === 0) continue;
       for (const account of sanitized) {
         const status = health2.getStatus(provider, account.id, now);
+        const allowance = allowanceScheduling.preview(provider, account.id, account.priority ?? 50, now);
         account.health = status.state;
+        account.schedulable = account.enabled && status.state === "healthy" && allowance.schedulable;
+        account.allowanceAction = allowance.action;
+        account.allowanceEffectivePriority = allowance.effectivePriority;
+        account.allowanceUsedPercent = allowance.usedPercent;
+        account.allowanceResumeAt = allowance.resumeAt;
         account.cooldownUntil = status.cooldownUntil !== void 0 ? new Date(status.cooldownUntil).toISOString() : void 0;
         if (fingerprintOn && provider === "claude") {
           account.identityCaptured = identityStore.hasIdentity(provider, account.id);
@@ -5605,31 +7336,25 @@ var JsonSubscriptionCredentialStore = class {
           account.identityCapturedAt = capturedAt !== void 0 ? new Date(capturedAt).toISOString() : void 0;
         }
       }
-      out[provider] = this.attachSyncWarnings(config, provider, sanitized);
+      out[provider] = this.attachDuplicateWarnings(config, provider, sanitized);
     }
     return out;
   }
   /**
-   * List-time credential-conflict warnings (external-cli-sync). Computed, not
-   * persisted: (a) `duplicate-token` when two accounts of one provider share a
-   * credential, (b) `external-divergent` when the external CLI native store has
-   * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
-   * a failed refresh (`external-not-rotated`) takes precedence — it is the most
-   * actionable state.
+   * List-time managed-credential conflict warnings. Computed, not persisted:
+   * `duplicate-token` is projected when two accounts of one provider share a
+   * credential. This deliberately does not inspect either native CLI file.
    */
-  attachSyncWarnings(config, provider, sanitized) {
+  attachDuplicateWarnings(config, provider, sanitized) {
     const duplicates = findDuplicateCredentialIds(listAccounts(config, provider));
-    let divergentId;
-    if (provider === "claude" || provider === "codex") {
-      const active = getActiveAccount(config, provider);
-      if (active && isExternalDivergent(active.tokens, this.safeReadExternal(provider))) {
-        divergentId = active.id;
-      }
-    }
-    if (duplicates.size === 0 && !divergentId) return sanitized;
     return sanitized.map((account) => {
-      const computed = account.id === divergentId ? "external-divergent" : duplicates.has(account.id) ? "duplicate-token" : void 0;
-      return { ...account, syncWarning: account.syncWarning ?? computed };
+      const computed = duplicates.has(account.id) ? "duplicate-token" : void 0;
+      const persisted = account.syncWarning === "duplicate-token" ? account.syncWarning : void 0;
+      if (!persisted && !computed) {
+        const { syncWarning: _obsoleteWarning, ...withoutWarning } = account;
+        return withoutWarning;
+      }
+      return { ...account, syncWarning: persisted ?? computed };
     });
   }
   /** Read the external CLI store, never letting an fs/parse error escape. */
@@ -5642,11 +7367,11 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
-   * the block has no refresh_token (setup-token / manual) — no upstream call, the
+   * the block has no refresh_token (setup-token / manual) no upstream call, the
    * block is untouched. Otherwise mint via the shared claude refresh flow and
    * write back access+refresh+expiresAt+status:authorized+lastRefreshedAt.
-   * On failure → status:expired +
-   * errorMessage → `false`.
+   * On failure status:expired +
+   * errorMessage `false`.
    */
   async refreshClaudeToken() {
     return this.coalesce("claude:active", async () => {
@@ -5671,19 +7396,8 @@ var JsonSubscriptionCredentialStore = class {
           syncWarning: void 0
         };
         this.writeBackById("claude", capturedId, next);
-        this.resyncExternal("claude", capturedId, next);
         return true;
       } catch (error) {
-        if (await this.tryExternalImport("claude", capturedId, claude, async (rt) => {
-          const r = await claudeOAuth2.refreshAccessToken(rt, refreshFetch);
-          return {
-            accessToken: r.accessToken,
-            refreshToken: r.refreshToken,
-            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
-          };
-        })) {
-          return true;
-        }
         this.markExpiredById("claude", capturedId, claude, error);
         return false;
       }
@@ -5718,20 +7432,8 @@ var JsonSubscriptionCredentialStore = class {
           syncWarning: void 0
         };
         this.writeBackById("codex", capturedId, next);
-        this.resyncExternal("codex", capturedId, next);
         return true;
       } catch (error) {
-        if (await this.tryExternalImport("codex", capturedId, codex, async (rt) => {
-          const r = await codexOAuth2.refreshAccessToken(rt, refreshFetch);
-          return {
-            accessToken: r.accessToken,
-            refreshToken: r.refreshToken,
-            idToken: r.idToken,
-            expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
-          };
-        })) {
-          return true;
-        }
         this.markExpiredById("codex", capturedId, codex, error);
         return false;
       }
@@ -5774,11 +7476,10 @@ var JsonSubscriptionCredentialStore = class {
     });
   }
   /**
-   * Refresh a SPECIFIC account by id (background scheduler sweep,
-   * external-cli-sync). Unlike the active-account refreshers it does NOT
-   * attempt the external-import fallback — the external CLI file's lineage can
-   * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
-   * failure flags ONLY that account `expired`.
+   * Refresh a SPECIFIC managed account by id (background scheduler sweep and
+   * account-pool resolution). It uses only that account's stored refresh
+   * token. Coalesced per `provider:id`; on failure flags ONLY that account
+   * `expired`.
    */
   async refreshAccountById(provider, id) {
     return this.coalesce(`${provider}:${id}`, async () => {
@@ -5792,7 +7493,7 @@ var JsonSubscriptionCredentialStore = class {
         const next = {
           ...captured,
           accessToken: refreshed.accessToken,
-          // Gemini's refresh response omits a new refresh token — keep the captured.
+          // Gemini's refresh response omits a new refresh token keep the captured.
           refreshToken: refreshed.refreshToken ?? captured.refreshToken,
           expiresAt: refreshed.expiresAt,
           status: "authorized",
@@ -5802,7 +7503,6 @@ var JsonSubscriptionCredentialStore = class {
         };
         if (refreshed.idToken) next.idToken = refreshed.idToken;
         this.writeBackById(provider, id, next);
-        if (provider !== "gemini") this.resyncExternal(provider, id, next);
         return true;
       } catch (error) {
         this.markExpiredById(provider, id, captured, error);
@@ -5810,7 +7510,7 @@ var JsonSubscriptionCredentialStore = class {
       }
     });
   }
-  // ── By-id account-pool surface (subscription-account-scheduling, design D6) ──
+  // By-id account-pool surface (subscription-account-scheduling, design D6)
   /**
    * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
    * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -5843,7 +7543,7 @@ var JsonSubscriptionCredentialStore = class {
   /**
    * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
    * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
-   * → `false` (no refresh affordance).
+   * `false` (no refresh affordance).
    */
   async refreshAccountToken(providerId, accountId) {
     if (providerId === "opencodego") return false;
@@ -5865,7 +7565,7 @@ var JsonSubscriptionCredentialStore = class {
    * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
    * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
    * an unknown id. Called by the identity store's persistence port on a first-seen
-   * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+   * freeze / TTL refresh, so it stays infrequent. Never throws to the caller the
    * store's port wrapper swallows a rejection so the relay hot path is unaffected.
    */
   async setAccountIdentity(providerId, accountId, identity) {
@@ -5890,7 +7590,7 @@ var JsonSubscriptionCredentialStore = class {
    * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
    * the port). Passing `undefined` clears the override. Write-only password: when
    * the incoming structured proxy omits the password but the account already had
-   * one, the current (decrypted) password is preserved — editing host/port never
+   * one, the current (decrypted) password is preserved editing host/port never
    * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
    */
   async setAccountProxy(providerId, accountId, proxy) {
@@ -5925,75 +7625,25 @@ var JsonSubscriptionCredentialStore = class {
       expiresAt: new Date(Date.now() + r.expiresIn * 1e3).toISOString()
     };
   }
-  /**
-   * External-import fallback for a FAILED active-account refresh
-   * (external-cli-sync). Reads the CLI native store; imports when the external
-   * lineage ROTATED (different refresh token) or its access token is still
-   * valid. When the imported access token is already expired it refreshes once
-   * with the rotated refresh token. A `not-rotated` outcome persists the
-   * `external-not-rotated` warning on the (about-to-be-expired) account so the
-   * UI can tell "genuine revocation" apart from a plain refresh failure.
-   */
-  async tryExternalImport(provider, capturedId, captured, refreshWithToken) {
-    const markerOwner = this.safeReadMarker(provider);
-    if (markerOwner && markerOwner !== capturedId) return false;
-    const external = this.safeReadExternal(provider);
-    const decision = decideExternalImport(captured, external);
-    if (decision === "not-rotated") {
-      captured.syncWarning = "external-not-rotated";
-      return false;
-    }
-    if (decision !== "import" || !external) return false;
-    let imported = buildImportedTokens(
-      captured,
-      external
-    );
-    const accessStillValid = external.expiresAt ? Date.parse(external.expiresAt) > Date.now() + 6e4 : true;
-    if (!accessStillValid) {
-      try {
-        const refreshed = await refreshWithToken(external.refreshToken);
-        imported = {
-          ...imported,
-          accessToken: refreshed.accessToken,
-          refreshToken: refreshed.refreshToken ?? imported.refreshToken,
-          expiresAt: refreshed.expiresAt,
-          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        if (refreshed.idToken) imported.idToken = refreshed.idToken;
-      } catch {
-        return false;
-      }
-    }
-    this.writeBackById(provider, capturedId, imported);
-    this.resyncExternal(provider, capturedId, imported);
-    return true;
-  }
-  /**
-   * Marker-gated external write-back (external-cli-sync). After a successful
-   * refresh of the account that OWNS the provider's native CLI store (imported
-   * via `importExternalCliAccount`), push the rotated credential back into the
-   * file — otherwise the daemon's refresh invalidates the single-use refresh
-   * token and silently logs the bare CLI out. NON-FATAL: the internal store is
-   * already persisted; a failed external write only leaves the file stale,
-   * which the `external-divergent` warning surfaces.
-   */
-  resyncExternal(provider, accountId, tokens) {
-    try {
-      this.externalCliStore.writeBack(provider, accountId, tokens);
-    } catch {
-    }
+  /** Atomically patch one account's non-secret management metadata. */
+  async patchAccountMetadata(providerId, accountId, patch) {
+    const config = this.readConfig();
+    const result = patchAccountMetadata(config, providerId, accountId, patch);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
   }
-  /** Read the marker's owning account id, never letting an fs error escape. */
-  safeReadMarker(provider) {
-    try {
-      return this.externalCliStore.readMarkerAccountId(provider);
-    } catch {
-      return void 0;
-    }
+  /** Validate every target, then persist one all-or-nothing batch mutation. */
+  async batchManageAccounts(refs, mutation) {
+    const config = this.readConfig();
+    const result = batchManageAccounts(config, refs, mutation);
+    if (!result.ok) return result;
+    this.persist({ ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    return result;
   }
   /**
    * DAEMON-ONLY (admin import button): which providers have a usable external
-   * CLI credential on THIS machine. Pure detection — reads the native files,
+   * CLI credential on THIS machine. Pure detection reads the native files,
    * never mutates anything, never returns a token.
    */
   async listExternalCliAvailability() {
@@ -6004,21 +7654,22 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY (admin import button): import the external CLI's current login
-   * as a NEW account (+ activate), and take MANAGED ownership of the native
-   * store (marker) so subsequent refreshes write back — keeping the bare CLI
-   * and the daemon on the same live credential instead of silently killing one
-   * side's single-use refresh token.
+   * as a NEW account (+ activate). This is a COPY-ONLY import: Omnicross never
+   * claims, writes, moves, restores, or deletes the native CLI credential file
+   * or any legacy `.omnicross-managed` marker/backup beside it. Subsequent
+   * refreshes persist only Omnicross's encrypted token store.
    */
   async importExternalCliAccount(provider, label) {
     const external = this.safeReadExternal(provider);
     if (!external?.accessToken) return { ok: false, reason: "no-credential" };
     const tokens = buildTokensFromExternal(provider, external);
     const result = await this.appendProviderAccount(provider, tokens, label);
-    try {
-      this.externalCliStore.writeMarker(provider, result.id);
-    } catch {
-    }
-    return { ok: true, id: result.id };
+    return {
+      ok: true,
+      id: result.id,
+      nativeCredentialMode: "read-only",
+      refreshWritesNativeCredentials: false
+    };
   }
   /**
    * Materialize a lazily-synthesized account id to disk (design D3). On a legacy
@@ -6051,7 +7702,8 @@ var JsonSubscriptionCredentialStore = class {
     this.writeBackById(providerId, capturedId, {
       ...block,
       status: "expired",
-      errorMessage
+      errorMessage,
+      syncWarning: "syncWarning" in block && block.syncWarning === "duplicate-token" ? "duplicate-token" : void 0
     });
   }
   /**
@@ -6060,7 +7712,7 @@ var JsonSubscriptionCredentialStore = class {
    * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
    * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
    * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
-   * so a first-ever write still produces a valid config. No cache → the next read
+   * so a first-ever write still produces a valid config. No cache the next read
    * sees this write.
    */
   async writeProviderTokens(providerId, config) {
@@ -6070,7 +7722,7 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
-   * (optional label) and set it active, then re-derive the mirror — used by
+   * (optional label) and set it active, then re-derive the mirror used by
    * `omnicross login <provider> --label` to add an account instead of overwriting.
    */
   async appendProviderAccount(providerId, config, label) {
@@ -6104,7 +7756,7 @@ var JsonSubscriptionCredentialStore = class {
   }
   /**
    * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
-   * rejects an unknown id. Label-only — no token material is read or written
+   * rejects an unknown id. Label-only no token material is read or written
    * (the secret-free invariant holds).
    */
   async renameAccount(providerId, id, label) {
@@ -6127,12 +7779,12 @@ var JsonSubscriptionCredentialStore = class {
   }
   /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
    *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
-   *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
-   *  write — incl. child 4's future refresh writes — lands encrypted. */
+   *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
+   *  write incl. child 4's future refresh writes lands encrypted. */
   persist(config) {
-    mkdirSync3(dirname4(this.tokensPath), { recursive: true });
+    mkdirSync4(dirname6(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    writeFileSync8(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    writeFileSync10(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
   /**
    * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -6140,18 +7792,18 @@ var JsonSubscriptionCredentialStore = class {
    * subscription bearer path is byte-identical).
    *
    * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
-   * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
+   * file empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
    * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
-   * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
-   * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
-   * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
+   * box's clear, secret-free error (secrets spec "/ UX":
+   * SHALL fail-fast, SHALL NOT a swallowed decrypt would report "no
+   * tokens" and silently send the WRONG bearer upstream 401). Mirrors
    * `config.ts loadConfig`, which decrypts outside its parse try.
    */
   readConfig() {
-    if (!existsSync10(this.tokensPath)) return { updatedAt: "" };
+    if (!existsSync13(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse(readFileSync10(this.tokensPath, "utf8"));
+      const raw = JSON.parse(readFileSync13(this.tokensPath, "utf8"));
       parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
     } catch {
       parsed = null;
@@ -6163,7 +7815,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-import { fetchUpstream as fetchUpstream3 } from "@omnicross/core/pipeline/upstreamFetch";
+import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/probe/ProbeStrategy.ts
 var PROVIDER_PROBE_PLANS = {
@@ -6206,7 +7858,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? fetchUpstream3;
+    this.fetchImpl = opts.fetchImpl ?? fetchUpstream4;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -6479,8 +8131,8 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-import { existsSync as existsSync11, readdirSync, unlinkSync } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync14, readdirSync, unlinkSync as unlinkSync3 } from "fs";
+import { join as join7 } from "path";
 
 // src/audit/auditFiles.ts
 var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6506,8 +8158,8 @@ function auditFileDateMs(fileName) {
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var AuditPruneSweeper = class {
-  constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.config = config;
     this.intervalMs = intervalMs;
@@ -6554,7 +8206,7 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!existsSync11(this.auditDir)) return 0;
+      if (!existsSync14(this.auditDir)) return 0;
       const today = new Date(this.now());
       const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
       const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
@@ -6563,7 +8215,7 @@ var AuditPruneSweeper = class {
         const dateMs = auditFileDateMs(file);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync(join5(this.auditDir, file));
+          unlinkSync3(join7(this.auditDir, file));
           removed += 1;
         } catch (error) {
           this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
@@ -6586,26 +8238,26 @@ var AuditPruneSweeper = class {
 };
 
 // src/audit/auditReader.ts
-import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync2, readFileSync as readFileSync14 } from "fs";
+import { join as join8 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query = {}) {
-  if (!existsSync12(auditDir)) return [];
+function readAuditRecords(auditDir2, query2 = {}) {
+  if (!existsSync15(auditDir2)) return [];
   let files;
   try {
-    files = readdirSync2(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    files = readdirSync2(auditDir2).filter((f) => AUDIT_FILE_RE.test(f));
   } catch {
     return [];
   }
-  const from = typeof query.from === "number" ? query.from : -Infinity;
-  const to = typeof query.to === "number" ? query.to : Infinity;
-  const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query.limit ?? DEFAULT_LIMIT)));
+  const from = typeof query2.from === "number" ? query2.from : -Infinity;
+  const to = typeof query2.to === "number" ? query2.to : Infinity;
+  const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
   const matched = [];
   for (const file of files.sort().reverse()) {
     let raw;
     try {
-      raw = readFileSync11(join6(auditDir, file), "utf8");
+      raw = readFileSync14(join8(auditDir2, file), "utf8");
     } catch {
       continue;
     }
@@ -6619,7 +8271,7 @@ function readAuditRecords(auditDir, query = {}) {
         continue;
       }
       if (!isAuditRecord(rec)) continue;
-      if (query.keyId !== void 0 && rec.keyId !== query.keyId) continue;
+      if (query2.keyId !== void 0 && rec.keyId !== query2.keyId) continue;
       if (rec.ts < from || rec.ts > to) continue;
       matched.push(rec);
     }
@@ -6634,11 +8286,11 @@ function isAuditRecord(value) {
 }
 
 // src/audit/AuditWriter.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync4 } from "fs";
-import { join as join7 } from "path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5 } from "fs";
+import { join as join9 } from "path";
 var AuditWriter = class {
-  constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
-    this.auditDir = auditDir;
+  constructor(auditDir2, logger, defer = (fn) => setTimeout(fn, 0)) {
+    this.auditDir = auditDir2;
     this.logger = logger;
     this.defer = defer;
   }
@@ -6668,19 +8320,19 @@ var AuditWriter = class {
    */
   appendNow(record) {
     if (!this.dirEnsured) {
-      mkdirSync4(this.auditDir, { recursive: true });
+      mkdirSync5(this.auditDir, { recursive: true });
       this.dirEnsured = true;
     }
-    const file = join7(this.auditDir, auditFileName(record.ts));
+    const file = join9(this.auditDir, auditFileName(record.ts));
     appendFileSync2(file, JSON.stringify(record) + "\n", "utf8");
   }
 };
 
 // src/billing/BillingPublisher.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync5 } from "fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6 } from "fs";
 import { createHmac } from "crypto";
-import { join as join8 } from "path";
-import { fetchUpstream as fetchUpstream4 } from "@omnicross/core/pipeline/upstreamFetch";
+import { join as join10 } from "path";
+import { fetchUpstream as fetchUpstream5 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -6703,7 +8355,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream4(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream5(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -6750,7 +8402,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join8(this.billingDir, billingFileName(event.ts));
+    const file = join10(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -6800,7 +8452,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join8(this.billingDir, deliveredFileName(event.ts));
+      const file = join10(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -6810,17 +8462,17 @@ var BillingPublisher = class {
   }
   ensureDir() {
     if (this.dirEnsured) return;
-    mkdirSync5(this.billingDir, { recursive: true });
+    mkdirSync6(this.billingDir, { recursive: true });
     this.dirEnsured = true;
   }
 };
 
 // src/billing/billingReader.ts
-import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync15 } from "fs";
+import { join as join11 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!existsSync13(billingDir)) return view;
+  if (!existsSync16(billingDir)) return view;
   let files;
   try {
     files = readdirSync3(billingDir);
@@ -6854,7 +8506,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync12(join9(dir, file), "utf8");
+    raw = readFileSync15(join11(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -7009,8 +8661,9 @@ var TokenRefreshScheduler = class {
     const expiresAt = Date.parse(t.expiresAt);
     return Number.isFinite(expiresAt) && now >= expiresAt - this.leadMs;
   }
-  /** Refresh one account; failures are logged, never thrown (the store has
-   *  already flagged the account `expired`). */
+  /** Refresh one managed account; failures are logged, never thrown. The
+   * store marks only the targeted account `expired` on a failed refresh.
+   */
   async refreshOne(provider, id, isActive) {
     try {
       const ok = isActive ? await this.refreshActive(provider) : await this.store.refreshAccountById(provider, id);
@@ -7041,7 +8694,7 @@ var TokenRefreshScheduler = class {
 
 // src/webhook/WebhookDispatcher.ts
 import { createHmac as createHmac2 } from "crypto";
-import { fetchUpstream as fetchUpstream5 } from "@omnicross/core/pipeline/upstreamFetch";
+import { fetchUpstream as fetchUpstream6 } from "@omnicross/core/pipeline/upstreamFetch";
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -7061,7 +8714,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream5(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => fetchUpstream6(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -7215,11 +8868,32 @@ function buildDaemon(config, paths) {
   setSecretBox(secretBox3);
   setSecretBox2(secretBox3);
   const decryptedConfig = decryptConfigSecrets(config, secretBox3);
+  const accountAllowanceStore = new AccountAllowanceStore3(
+    Date.now,
+    void 0,
+    new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
+  );
+  setSharedAccountAllowanceStore(accountAllowanceStore);
+  getSharedAccountAllowanceScheduling4().configure(
+    normalizeServerConfig(decryptedConfig.server).allowanceScheduling
+  );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
   const keyDb = new JsonOutboundKeyDb(paths.keysPath);
   const voucherDb = new JsonVoucherDb(defaultVouchersPath(paths.configPath));
   const settingsStore = new JsonApiServerSettingsStore(paths.configPath, secretBox3);
+  const integrationStateStore = new IntegrationStateStore(
+    defaultIntegrationsPath(paths.configPath),
+    secretBox3
+  );
   const credentialStore = new JsonSubscriptionCredentialStore(paths.tokensPath, secretBox3);
+  const accountAllowanceService = new AccountAllowanceService(credentialStore, accountAllowanceStore);
+  const claudeAllowanceRefreshScheduler = new ClaudeAllowanceRefreshScheduler(
+    accountAllowanceService,
+    logger
+  );
+  claudeAllowanceRefreshScheduler.configure(
+    normalizeServerConfig(decryptedConfig.server).allowanceScheduling
+  );
   const subscriptionAccounts = new SubscriptionAccountService(credentialStore);
   setSubscriptionAccountService(subscriptionAccounts);
   const subscriptionRegistry = new SubscriptionProviderRegistry(
@@ -7248,7 +8922,17 @@ function buildDaemon(config, paths) {
     }
   );
   const pricingStore = new JsonPricingStore(defaultPricingPath(paths.configPath));
-  const pricingEngine = new PricingEngine(pricingStore, logger);
+  const pricingEngine = new PricingEngine(pricingStore, logger, {
+    // Catalog egress follows the same global/env proxy policy as every other
+    // daemon upstream call; no provider/account override applies here.
+    fetchImpl: ((input, init) => fetchUpstream7(String(input), init ?? {}))
+  });
+  const pricingRefreshScheduler = new PricingRefreshScheduler(
+    pricingEngine,
+    pricingStore,
+    defaultPricingRefreshStatePath(paths.configPath),
+    logger
+  );
   const usageEventStore = new JsonlUsageEventStore(
     defaultUsageEventsPath(paths.configPath),
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
@@ -7261,7 +8945,7 @@ function buildDaemon(config, paths) {
   llmConfig.setReloadHook(() => apiKeyPool.invalidateCache());
   const accountHealthProbeScheduler = new AccountHealthProbeScheduler(
     credentialStore,
-    getSharedAccountHealth2(),
+    getSharedAccountHealth3(),
     logger,
     DEFAULT_ACCOUNT_PROBE
   );
@@ -7295,7 +8979,7 @@ function buildDaemon(config, paths) {
     // lines through the injected logger (honors level/format/file sink).
     logger
   });
-  const auditDir = defaultAuditDir(paths.configPath);
+  const auditDir2 = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
   const adminServer = new AdminServer({
     configPath: paths.configPath,
@@ -7309,6 +8993,9 @@ function buildDaemon(config, paths) {
     settingsStore,
     outboundApiServer,
     subscriptionAccounts,
+    accountAllowanceService,
+    allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
+    accountProbeService: accountHealthProbeScheduler,
     // Least-authority token WRITER (design D4) — the concrete credential store
     // exposes `writeProviderTokens` / `clearProvider` as daemon-only methods (NOT
     // on the `SubscriptionCredentialStore` port). The admin API sees ONLY these two
@@ -7329,7 +9016,7 @@ function buildDaemon(config, paths) {
     // inject a mock so no real token endpoint is hit.
     // upstream-proxy: default the OAuth token-exchange fetch to the proxy-aware
     // helper so interactive login honors a configured proxy (global/env layers).
-    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => fetchUpstream6(url, init)),
+    oauthExchangeFetch: paths.oauthExchangeFetch ?? ((url, init) => fetchUpstream7(url, init)),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -7347,6 +9034,16 @@ function buildDaemon(config, paths) {
     cliTerminalOpener: paths.cliTerminalOpener,
     cliPathProbe: paths.cliPathProbe,
     cliCommandRunner: paths.cliCommandRunner,
+    integrationManagerFactory: () => {
+      const live = outboundApiServer.getStatus();
+      const port = live.port || decryptedConfig.server?.port || DEFAULT_OUTBOUND_PORT;
+      return new IntegrationManager({
+        configPath: paths.configPath,
+        gatewayBaseUrl: live.loopbackUrl ?? `http://127.0.0.1:${port}`,
+        keyDb,
+        stateStore: integrationStateStore
+      });
+    },
     // Usage/pricing admin surface (usage-pricing child): stats queries go
     // through the recorder facade, pricing mutations through the engine, and
     // the row DELETE through the concrete store (delete is store-local — the
@@ -7371,19 +9068,19 @@ function buildDaemon(config, paths) {
     // date-rotated audit store. Bound to the store dir here so the AdminServer
     // carries no path/store coupling. Records hold IP/UA/bodies → admin-only,
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
-    auditReader: (query) => readAuditRecords(auditDir, query),
+    auditReader: (query2) => readAuditRecords(auditDir2, query2),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => fetchUpstream6(url, init)
+    fetchImpl: (url, init) => fetchUpstream7(url, init)
   });
-  setWebhookRuntime(webhookDispatcher, getSharedAccountHealth2());
-  const auditWriter = new AuditWriter(auditDir, logger);
-  const auditPruneSweeper = new AuditPruneSweeper(auditDir, logger, DEFAULT_AUDIT_CONFIG);
-  setAuditRuntime(auditWriter, auditPruneSweeper);
+  setWebhookRuntime(webhookDispatcher, getSharedAccountHealth3());
+  const auditWriter = new AuditWriter(auditDir2, logger);
+  const auditPruneSweeper = new AuditPruneSweeper(auditDir2, logger, DEFAULT_AUDIT_CONFIG);
+  setAuditRuntime(auditWriter, auditPruneSweeper, auditDir2);
   const billingPublisher = new BillingPublisher(billingDir, logger);
   const billingRetrySweeper = new BillingRetrySweeper(
     billingDir,
@@ -7395,7 +9092,7 @@ function buildDaemon(config, paths) {
   const tokenRefreshScheduler = new TokenRefreshScheduler(credentialStore, logger);
   const accountHealthSweeper = new AccountHealthSweeper(
     credentialStore,
-    getSharedAccountHealth2(),
+    getSharedAccountHealth3(),
     logger
   );
   return {
@@ -7410,8 +9107,11 @@ function buildDaemon(config, paths) {
     credentialStore,
     subscriptionRegistry,
     subscriptionAccounts,
+    accountAllowanceService,
+    claudeAllowanceRefreshScheduler,
     pricingStore,
     pricingEngine,
+    pricingRefreshScheduler,
     usageRecorder,
     adminServer,
     tokenRefreshScheduler,
@@ -7439,10 +9139,12 @@ function resetDaemonSingletonsForTests() {
   resetAuditRuntimeForTests();
   resetBillingRuntimeForTests();
   __resetSharedIdentityStoreForTests();
+  __resetSharedAccountAllowanceStoreForTests();
+  __resetSharedAccountAllowanceSchedulingForTests();
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!existsSync14(tokensPath)) return true;
+    if (!existsSync17(tokensPath)) return true;
     accessSync(tokensPath, fsConstants.R_OK);
     return true;
   } catch {
@@ -7489,6 +9191,9 @@ function inferApiFormat(provider) {
   if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
     return { format: "gemini", ambiguous: false };
   }
+  if (hay.includes("/responses")) {
+    return { format: "openai-response", ambiguous: false };
+  }
   if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
     return { format: "openai", ambiguous: false };
   }