@omnicross/daemon 0.1.5 → 0.1.7

package/dist/index.d.ts

@@ -1,19 +1,25 @@
-import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, OutboundKeyDb as OutboundKeyDb$1, OutboundKeyDbRow, OutboundKeyPolicy } from '@omnicross/core';
+import * as _omnicross_core from '@omnicross/core';
+import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1 } from '@omnicross/core';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { AccountProbeConfig, OutboundKeyDb, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
+import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
-import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity } from '@omnicross/contracts/account-tokens-types';
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
+import * as _omnicross_contracts_subscription_types from '@omnicross/contracts/subscription-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { AccountAllowanceStore } from '@omnicross/core/pipeline/AccountAllowanceStore';
+import { AllowanceSchedulingDecision } from '@omnicross/core/pipeline/AccountAllowanceScheduling';
+import { SubscriptionIdentityStore } from '@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore';
+import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
 import { SubscriptionAccountHealth } from '@omnicross/core/pipeline/SubscriptionAccountHealth';
 import { fetchUpstream } from '@omnicross/core/pipeline/upstreamFetch';
-import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+import { AuditRecord, AuditStats, AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
-import { PricingEntry, PricingEntryInput, PricingResolution } from '@omnicross/contracts/pricing-types';
+import { PricingEntry, PricingEntryInput, PricingResolution, PricingSourceRefreshResult } from '@omnicross/contracts/pricing-types';
 import { WebhookConfig, WebhookEvent } from '@omnicross/contracts/webhook-types';
 
 /**
@@ -104,8 +110,17 @@ declare class SecretBox {
  * @module @omnicross/daemon/config
  */
 
-/** The wire formats the daemon's BYO providers can speak. */
-type DaemonApiFormat = 'openai' | 'anthropic' | 'gemini';
+/**
+ * The wire formats the daemon's BYO providers can speak.
+ *
+ * Each value names EXACTLY ONE provider-slot format transformer (see
+ * `ConfigFileProviderConfigSource.FORMAT_TRANSFORMER`). `openai-response` used
+ * to be inexpressible here, so a Responses-wire upstream had to smuggle its
+ * format through `transformer.use[]` — which put TWO format transformers in
+ * reach of the provider slot. Naming it here keeps `use[]` purely a modifier
+ * list. `validateProvider` migrates the old shape on load.
+ */
+type DaemonApiFormat = 'openai' | 'anthropic' | 'gemini' | 'openai-response';
 /**
  * One pool key on a provider row (design D1). Structurally compatible with
  * core's `ApiKeyEntry` (`@omnicross/contracts/llm-config`) — a hand-authored SUBSET: only
@@ -406,21 +421,54 @@ declare function loadConfig(path: string): DaemonConfig;
 declare function saveConfig(path: string, cfg: DaemonConfig): void;
 
 /**
- * external-cli-credentials — read-only access to the external CLI native
+ * account-multi — daemon-side pure helpers for the subscription multi-account
+ * layout.
+ *
+ * Host-clean: no I/O, no encryption — callers persist through their own
+ * encrypted writers.
+ *
+ * Load-bearing invariant: the top-level per-provider block is ALWAYS a byte-equal
+ * mirror of the active account's `tokens`; every mutator re-derives it last.
+ *
+ * @module @omnicross/daemon/ports/account-multi
+ */
+
+/** Provider id → owned contract field names. */
+type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego';
+interface AccountMetadataPatch {
+    label?: string;
+    enabled?: boolean;
+    priority?: number;
+    group?: string | null;
+    tags?: string[];
+}
+interface AccountRef {
+    providerId: DaemonProvider;
+    accountId: string;
+}
+type AccountBatchMutation = {
+    action: 'enable' | 'disable';
+} | {
+    action: 'set-group';
+    group: string | null;
+} | {
+    action: 'delete';
+};
+
+/**
+ * external-cli-credentials read-only access to the external CLI native
  * credential stores (external-cli-sync).
  *
- * The daemon never WRITES these files (they belong to the CLIs); it only reads
- * them back to (a) recover from the rotating-refresh-token race — when e.g.
- * Claude Code refreshes `~/.claude/.credentials.json` it rotates OUR stored
- * refresh token out from under us, and the external file then holds the only
- * live credential — and (b) detect divergence for the account-list warning.
+ * The daemon never WRITES these files (they belong to the CLIs); it reads them
+ * only for the explicit admin availability check and copy-as-new-account import
+ * flow. Normal account reads and refreshes never call this reader.
  *
  * File shapes (mirrors the shapes the CLIs themselves write):
  *   claude `~/.claude/.credentials.json`
- *     → `{ claudeAiOauth: { accessToken, refreshToken?, expiresAt(number ms),
+ *     `{ claudeAiOauth: { accessToken, refreshToken, expiresAt(number ms),
  *          scopes? } }`
  *   codex `~/.codex/auth.json`
- *     → `{ tokens: { id_token?, access_token, refresh_token? } }` — no explicit
+ *     `{ tokens: { id_token, access_token, refresh_token } }` no explicit
  *       expiry; the access token's JWT `exp` claim is the only expiry signal.
  *
  * Gemini is deliberately excluded: the gemini CLI's oauth store is not a
@@ -445,56 +493,9 @@ interface ExternalCliCredentials {
     /** claude only. */
     scopes?: string[];
 }
-/** Reader port — injectable so tests never touch the real home directory. */
+/** Reader port injectable so tests never touch the real home directory. */
 type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentials | null;
 
-/**
- * external-cli-store — WRITE side of the external CLI native credential stores
- * (external-cli-sync, import + write-back).
- *
- * Counterpart of `external-cli-credentials` (the read side). The daemon only
- * ever writes a file it MANAGES: an explicit "import existing CLI login" puts
- * an `.omnicross-managed` marker (recording the owning account id) next to the
- * native store, and every subsequent successful refresh of THAT account writes
- * the rotated credential back into the file. Without the write-back, the
- * daemon's refresh would rotate the single-use refresh token and silently log
- * the user's bare CLI out — the write-back keeps both sides on the same live
- * credential.
- *
- * Safety properties:
- *  - NEVER writes without a matching marker (an unmanaged / foreign-account
- *    file is untouched);
- *  - read-then-merge: unrelated top-level keys in the native file (e.g.
- *    claude `email`, codex `OPENAI_API_KEY`) are preserved;
- *  - one-time `.omnicross-backup` of the original file before the FIRST
- *    overwrite (restorable by hand if the user wants the daemon out);
- *  - atomic write (temp file → rename) so a crash never leaves a torn file.
- *
- * The envelope shapes mirror what the CLIs themselves write — the round-trip
- * test parses a written file back through `external-cli-credentials` to keep
- * the two sides from drifting.
- *
- * @module @omnicross/daemon/ports/external-cli-store
- */
-
-/** Token blocks the write-back accepts (the two external-store providers). */
-type ExternalWritableTokens = ClaudeTokenConfig | CodexTokenConfig;
-/**
- * Injectable port over the external store writes (tests use an in-memory fake;
- * the store wires `realExternalCliStore`).
- */
-interface ExternalCliStorePort {
-    /** The owning account id recorded by the marker, or undefined when unmanaged. */
-    readMarkerAccountId(provider: ExternalCliProvider): string | undefined;
-    /** Record (or move) ownership of the provider's native store to an account. */
-    writeMarker(provider: ExternalCliProvider, accountId: string): void;
-    /**
-     * Write the refreshed tokens back into the native store — ONLY when the
-     * marker names `accountId`. Returns true when a write happened.
-     */
-    writeBack(provider: ExternalCliProvider, accountId: string, tokens: ExternalWritableTokens): boolean;
-}
-
 /**
  * JsonSubscriptionCredentialStore — the daemon's file-backed
  * `SubscriptionCredentialStore` port impl (design D1).
@@ -503,7 +504,7 @@ interface ExternalCliStorePort {
  * over a sibling `tokens.json` holding an `AccountTokensConfig`-shaped object
  * (`{ claude?, codex?, gemini?, opencodego?, updatedAt }`). Modeled on
  * `JsonOutboundKeyDb`: the constructor takes the path; reads are
- * `existsSync` → `readFileSync` → `JSON.parse`, tolerating a missing/corrupt
+ * `existsSync` `readFileSync` `JSON.parse`, tolerating a missing/corrupt
  * file by returning a minimal `{ updatedAt }` config (the strategies already
  * guard `?.accessToken`, so a partial/empty config never crashes dispatch).
  *
@@ -513,7 +514,7 @@ interface ExternalCliStorePort {
  * (strategies only consume + refresh, never log in).
  *
  * DAEMON-ONLY WRITE PATH (token-paste, design D1): `writeProviderTokens` /
- * `clearProvider` are CONCRETE-CLASS methods — NOT part of the
+ * `clearProvider` are CONCRETE-CLASS methods NOT part of the
  * `SubscriptionCredentialStore` port. The registry / auth strategies / account
  * service never see them (they hold the port type), so a mutation can never leak
  * into the subscription block. Only the daemon admin API (which holds the
@@ -523,7 +524,7 @@ interface ExternalCliStorePort {
  *
  * AT-REST ENCRYPTION (secrets design D6/D7): the constructor takes a `SecretBox`.
  * `readConfig` decrypts the token-material fields on read (so every getter +
- * `getFullConfig` returns PLAINTEXT tokens — the subscription bearer path is
+ * `getFullConfig` returns PLAINTEXT tokens the subscription bearer path is
  * byte-identical), and `persist` encrypts them before writing. Because EVERY
  * write funnels through `persist`, the OAuth-refresh writes below are encrypted
  * at-rest with NO extra work (the store API guarantees it). The "re-read on every
@@ -531,16 +532,16 @@ interface ExternalCliStorePort {
  *
  * REAL TOKEN REFRESH (oauth design D4): `refresh{Claude,Codex,Gemini}Token` mint
  * a new access token via the shared host-clean OAuth refresh functions
- * (`@omnicross/subscriptions/oauth`, injected `FetchLike` — default global
+ * (`@omnicross/subscriptions/oauth`, injected `FetchLike` default global
  * `fetch`), then read-merge the refreshed fields into the provider block and
- * write back through `persist` (→ encrypted). Field-writes:
+ * write back through `persist` (encrypted). Field-writes:
  * claude/codex write access+refresh(+codex idToken)
  * +expiresAt+status:authorized+lastRefreshedAt; gemini writes ONLY access+
- * expiresAt (its refresh response omits refresh_token → the OLD value is reused,
+ * expiresAt (its refresh response omits refresh_token the OLD value is reused,
  * never overwritten). On any failure the block is marked `status:'expired'` +
  * errorMessage and `false` is returned. When the block has NO refresh_token
  * (claude setup-token, manual token), it is an HONEST `false` BEFORE any upstream
- * call — the block is not touched and no refresh_token is invented.
+ * call the block is not touched and no refresh_token is invented.
  *
  * @module @omnicross/daemon/ports/JsonSubscriptionCredentialStore
  */
@@ -548,7 +549,7 @@ interface ExternalCliStorePort {
 /**
  * The per-provider token block accepted by `writeProviderTokens`. Mirrors the
  * `AccountTokensConfig` per-provider field types (one of the four contract token
- * shapes), keyed by `SubscriptionProviderId` — the daemon admin layer validates
+ * shapes), keyed by `SubscriptionProviderId` the daemon admin layer validates
  * the wire body to one of these before calling the writer.
  */
 type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig;
@@ -556,10 +557,8 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     private readonly tokensPath;
     private readonly box;
     private readonly fetchImpl;
-    /** Injectable external CLI native-store reader (external-cli-sync). */
+    /** Injectable, strictly read-only external CLI native-store reader. */
     private readonly externalCliReader;
-    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
-    private readonly externalCliStore;
     /**
      * @param tokensPath  on-disk `tokens.json` location.
      * @param box         at-rest `SecretBox` (encrypt-on-write / decrypt-on-read).
@@ -569,23 +568,27 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      *                    proxy-aware {@link fetchUpstream} that threads the
      *                    `{ providerId, accountId }` ctx (upstream-proxy M1) so a
      *                    per-account/per-provider proxy is honored on refresh exactly
-     *                    as on relay — refresh egresses from the SAME proxy IP as the
+     *                    as on relay refresh egresses from the SAME proxy IP as the
      *                    account's traffic. NOT used by any read/write path.
      */
     constructor(tokensPath: string, box: SecretBox, fetchImpl?: FetchLike | undefined, 
-    /** Injectable external CLI native-store reader (external-cli-sync). */
-    externalCliReader?: ExternalCliReader, 
-    /** Injectable external CLI native-store WRITER (marker-gated write-back). */
-    externalCliStore?: ExternalCliStorePort);
+    /** Injectable, strictly read-only external CLI native-store reader. */
+    externalCliReader?: ExternalCliReader);
     /**
      * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
      * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
      * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
-     * ctx so the per-account/provider proxy applies. `@internal` — also a test seam.
+     * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
+     *
+     * `redactBodies` is REQUIRED here: this round-trip sends the refresh_token and
+     * receives a fresh access/refresh token pair. Carrying a `providerId` opts the
+     * call into the upstream trace (so a failing refresh is diagnosable), and the
+     * trace captures bodies verbatim — without this flag every refresh would write
+     * a plaintext token pair into `upstream-trace.jsonl`.
      */
     buildRefreshFetch(providerId: string, accountId?: string): FetchLike;
     /**
-     * In-flight refresh coalescing (external-cli-sync). OAuth refresh tokens are
+     * In-flight refresh coalescing. OAuth refresh tokens are
      * SINGLE-USE: two concurrent refreshes of one account each spend the same
      * token and the loser bricks a healthy account. Every refresh entry point
      * (auth-strategy lazy refresh, 401 retry, background scheduler) funnels
@@ -594,11 +597,11 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     private readonly inFlightRefreshes;
     private coalesce;
     /** Full parsed account-tokens config (or a minimal `{ updatedAt }` when the
-     *  file is absent/corrupt). This is the hot read — the codex / gemini auth
+     *  file is absent/corrupt). This is the hot read the codex / gemini auth
      *  strategies pull `accessToken` / `expiresAt` / `status` from it. */
     getFullConfig(): Promise<AccountTokensConfig>;
     /** Current Claude OAuth access token, or `null` when none is stored. No inline
-     *  refresh here — the lead-window / 401-retry refresh is driven by the
+     *  refresh here the lead-window / 401-retry refresh is driven by the
      *  subscription auth strategy, which calls `refreshClaudeToken` (now real). */
     getValidClaudeAccessToken(): Promise<string | null>;
     /** Current OpenCodeGo static API key, or `null` when none is stored. */
@@ -614,28 +617,25 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     /**
      * DAEMON-ONLY sanitized accounts list (design D8, NOT on the port). Projects
      * each provider's accounts to the secret-free `SubscriptionAccountSanitized`
-     * shape (id/label/status/expiresAt/hasAccessToken/isActive) — NEVER a token.
+     * shape (id/label/status/expiresAt/hasAccessToken/isActive) NEVER a token.
      * Used by the admin accounts GET (secret-IN-never-OUT).
      */
     listSanitizedAccounts(): Promise<Record<string, SubscriptionAccountSanitized[]>>;
     /**
-     * List-time credential-conflict warnings (external-cli-sync). Computed, not
-     * persisted: (a) `duplicate-token` when two accounts of one provider share a
-     * credential, (b) `external-divergent` when the external CLI native store has
-     * rotated PAST the ACTIVE account (claude/codex only). A warning persisted by
-     * a failed refresh (`external-not-rotated`) takes precedence — it is the most
-     * actionable state.
+     * List-time managed-credential conflict warnings. Computed, not persisted:
+     * `duplicate-token` is projected when two accounts of one provider share a
+     * credential. This deliberately does not inspect either native CLI file.
      */
-    private attachSyncWarnings;
+    private attachDuplicateWarnings;
     /** Read the external CLI store, never letting an fs/parse error escape. */
     private safeReadExternal;
     /**
      * Refresh the Claude OAuth access token (oauth design D4). HONEST `false` when
-     * the block has no refresh_token (setup-token / manual) — no upstream call, the
+     * the block has no refresh_token (setup-token / manual) no upstream call, the
      * block is untouched. Otherwise mint via the shared claude refresh flow and
      * write back access+refresh+expiresAt+status:authorized+lastRefreshedAt.
-     * On failure → status:expired +
-     * errorMessage → `false`.
+     * On failure status:expired +
+     * errorMessage `false`.
      */
     refreshClaudeToken(): Promise<boolean>;
     /**
@@ -653,11 +653,10 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      */
     refreshGeminiToken(): Promise<boolean>;
     /**
-     * Refresh a SPECIFIC account by id (background scheduler sweep,
-     * external-cli-sync). Unlike the active-account refreshers it does NOT
-     * attempt the external-import fallback — the external CLI file's lineage can
-     * only plausibly match the ACTIVE account. Coalesced per `provider:id`; on
-     * failure flags ONLY that account `expired`.
+     * Refresh a SPECIFIC managed account by id (background scheduler sweep and
+     * account-pool resolution). It uses only that account's stored refresh
+     * token. Coalesced per `provider:id`; on failure flags ONLY that account
+     * `expired`.
      */
     refreshAccountById(provider: 'claude' | 'codex' | 'gemini', id: string): Promise<boolean>;
     /**
@@ -672,7 +671,7 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     /**
      * Refresh a SPECIFIC account's OAuth token by id (design D6/D7). Delegates to
      * `refreshAccountById` (coalesced per `provider:id`); opencodego is a static key
-     * → `false` (no refresh affordance).
+     * `false` (no refresh affordance).
      */
     refreshAccountToken(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
     /**
@@ -686,7 +685,7 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * (subscription-client-fingerprint #7, P2). Entry-metadata only (NON-secret
      * whitelisted fingerprint headers; the token mirror is untouched); a no-op for
      * an unknown id. Called by the identity store's persistence port on a first-seen
-     * freeze / TTL refresh, so it stays infrequent. Never throws to the caller — the
+     * freeze / TTL refresh, so it stays infrequent. Never throws to the caller the
      * store's port wrapper swallows a rejection so the relay hot path is unaffected.
      */
     setAccountIdentity(providerId: SubscriptionProviderId, accountId: string, identity: AccountClientIdentity): Promise<void>;
@@ -702,7 +701,7 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * DAEMON-ONLY set/clear per-account proxy (upstream-proxy, admin write, NOT on
      * the port). Passing `undefined` clears the override. Write-only password: when
      * the incoming structured proxy omits the password but the account already had
-     * one, the current (decrypted) password is preserved — editing host/port never
+     * one, the current (decrypted) password is preserved editing host/port never
      * wipes the secret. Persist re-encrypts `proxy.password` via the tokens SecretBox.
      */
     setAccountProxy(providerId: SubscriptionProviderId, accountId: string, proxy: ProxyConfig | undefined): Promise<{
@@ -719,44 +718,36 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     }>;
     /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
     private refreshUpstream;
-    /**
-     * External-import fallback for a FAILED active-account refresh
-     * (external-cli-sync). Reads the CLI native store; imports when the external
-     * lineage ROTATED (different refresh token) or its access token is still
-     * valid. When the imported access token is already expired it refreshes once
-     * with the rotated refresh token. A `not-rotated` outcome persists the
-     * `external-not-rotated` warning on the (about-to-be-expired) account so the
-     * UI can tell "genuine revocation" apart from a plain refresh failure.
-     */
-    private tryExternalImport;
-    /**
-     * Marker-gated external write-back (external-cli-sync). After a successful
-     * refresh of the account that OWNS the provider's native CLI store (imported
-     * via `importExternalCliAccount`), push the rotated credential back into the
-     * file — otherwise the daemon's refresh invalidates the single-use refresh
-     * token and silently logs the bare CLI out. NON-FATAL: the internal store is
-     * already persisted; a failed external write only leaves the file stale,
-     * which the `external-divergent` warning surfaces.
-     */
-    private resyncExternal;
-    /** Read the marker's owning account id, never letting an fs error escape. */
-    private safeReadMarker;
+    /** Atomically patch one account's non-secret management metadata. */
+    patchAccountMetadata(providerId: SubscriptionProviderId, accountId: string, patch: AccountMetadataPatch): Promise<{
+        ok: boolean;
+    }>;
+    /** Validate every target, then persist one all-or-nothing batch mutation. */
+    batchManageAccounts(refs: AccountRef[], mutation: AccountBatchMutation): Promise<{
+        ok: true;
+        affected: number;
+    } | {
+        ok: false;
+        missing: AccountRef;
+    }>;
     /**
      * DAEMON-ONLY (admin import button): which providers have a usable external
-     * CLI credential on THIS machine. Pure detection — reads the native files,
+     * CLI credential on THIS machine. Pure detection reads the native files,
      * never mutates anything, never returns a token.
      */
     listExternalCliAvailability(): Promise<Record<ExternalCliProvider, boolean>>;
     /**
      * DAEMON-ONLY (admin import button): import the external CLI's current login
-     * as a NEW account (+ activate), and take MANAGED ownership of the native
-     * store (marker) so subsequent refreshes write back — keeping the bare CLI
-     * and the daemon on the same live credential instead of silently killing one
-     * side's single-use refresh token.
+     * as a NEW account (+ activate). This is a COPY-ONLY import: Omnicross never
+     * claims, writes, moves, restores, or deletes the native CLI credential file
+     * or any legacy `.omnicross-managed` marker/backup beside it. Subsequent
+     * refreshes persist only Omnicross's encrypted token store.
      */
     importExternalCliAccount(provider: ExternalCliProvider, label?: string): Promise<{
         ok: true;
         id: string;
+        nativeCredentialMode: 'read-only';
+        refreshWritesNativeCredentials: false;
     } | {
         ok: false;
         reason: 'no-credential';
@@ -788,13 +779,13 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * `updatedAt`, and re-persist `tokens.json` as pretty JSON. Preserves every
      * OTHER provider's existing block (read-merge-write, not overwrite). Reuses the
      * tolerate-on-read base (`{ updatedAt: '' }` when the file is absent/corrupt),
-     * so a first-ever write still produces a valid config. No cache → the next read
+     * so a first-ever write still produces a valid config. No cache the next read
      * sees this write.
      */
     writeProviderTokens(providerId: SubscriptionProviderId, config: SubscriptionTokenBlock): Promise<void>;
     /**
      * DAEMON-ONLY login append (design D5, NOT on the port). Append a NEW account
-     * (optional label) and set it active, then re-derive the mirror — used by
+     * (optional label) and set it active, then re-derive the mirror used by
      * `omnicross login <provider> --label` to add an account instead of overwriting.
      */
     appendProviderAccount(providerId: SubscriptionProviderId, config: SubscriptionTokenBlock, label?: string): Promise<{
@@ -817,7 +808,7 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     }>;
     /**
      * DAEMON-ONLY per-account rename (NOT on the port). Update one account's label;
-     * rejects an unknown id. Label-only — no token material is read or written
+     * rejects an unknown id. Label-only no token material is read or written
      * (the secret-free invariant holds).
      */
     renameAccount(providerId: SubscriptionProviderId, id: string, label: string): Promise<{
@@ -832,8 +823,8 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
     clearProvider(providerId: SubscriptionProviderId): Promise<void>;
     /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
      *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
-     *  → `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
-     *  write — incl. child 4's future refresh writes — lands encrypted. */
+     *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
+     *  write incl. child 4's future refresh writes lands encrypted. */
     private persist;
     /**
      * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -841,11 +832,11 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * subscription bearer path is byte-identical).
      *
      * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
-     * file → empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
+     * file empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
      * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
-     * box's clear, secret-free error (secrets spec "错误密钥 / 篡改的解密失败 UX":
-     * SHALL fail-fast, SHALL NOT 静默降级 — a swallowed decrypt would report "no
-     * tokens" and silently send the WRONG bearer upstream → 401). Mirrors
+     * box's clear, secret-free error (secrets spec "/ UX":
+     * SHALL fail-fast, SHALL NOT a swallowed decrypt would report "no
+     * tokens" and silently send the WRONG bearer upstream 401). Mirrors
      * `config.ts loadConfig`, which decrypts outside its parse try.
      */
     private readConfig;
@@ -891,6 +882,18 @@ interface SubscriptionTokenWriter {
     setAccountPriority(providerId: SubscriptionProviderId, id: string, priority: number): Promise<{
         ok: boolean;
     }>;
+    /** Patch non-secret account management metadata in one write. */
+    patchAccountMetadata(providerId: SubscriptionProviderId, id: string, patch: AccountMetadataPatch): Promise<{
+        ok: boolean;
+    }>;
+    /** All-or-nothing multi-provider account management mutation. */
+    batchManageAccounts(refs: AccountRef[], mutation: AccountBatchMutation): Promise<{
+        ok: true;
+        affected: number;
+    } | {
+        ok: false;
+        missing: AccountRef;
+    }>;
     /** Set (or CLEAR, with `undefined`) one account's per-account proxy override
      *  (upstream-proxy). The `proxy.password` is a secret (encrypted at rest, masked
      *  in the sanitized view). Rejects an unknown id. */
@@ -912,6 +915,8 @@ interface SubscriptionTokenWriter {
     importExternalCliAccount(providerId: 'claude' | 'codex', label?: string): Promise<{
         ok: true;
         id: string;
+        nativeCredentialMode: 'read-only';
+        refreshWritesNativeCredentials: false;
     } | {
         ok: false;
         reason: 'no-credential';
@@ -924,11 +929,12 @@ interface SubscriptionTokenWriter {
  * app-parity child 4, design D1).
  *
  * `start` mints a crypto-random `sessionId` and stashes the per-session PKCE
- * `{ providerId, codeVerifier, state }` here; `complete` does a SINGLE-USE
- * `take(sessionId)` (returns + deletes) and exchanges the code. The map is
+ * `{ providerId, codeVerifier, state }` here; `complete` `peek`s the session,
+ * exchanges the code, and `consume`s it ONLY once a token was minted — so a
+ * failed exchange leaves the session retryable instead of burning it. The map is
  * NEVER serialized to the client — only the opaque `sessionId` + the public
  * `authUrl` cross the wire. Sessions are short-lived (OQ3 = 10-min TTL); a sweep
- * reaps abandoned sessions, and `take` re-checks the TTL so an expired-but-not-
+ * reaps abandoned sessions, and `peek` re-checks the TTL so an expired-but-not-
  * yet-swept session is still rejected. A daemon restart simply drops in-flight
  * logins (correct fail-safe — no partial token is ever written).
  *
@@ -964,13 +970,25 @@ declare class OAuthSessionStore {
      */
     put(session: Omit<PendingOAuthSession, 'createdAt'>): string;
     /**
-     * SINGLE-USE consume: return + delete the session for `sessionId`, or `null`
-     * when it is unknown, already used, or past its TTL (in which case it is
-     * dropped). A `null` return means the completer must reject (no exchange, no
-     * write).
+     * NON-DESTRUCTIVE lookup: return the session for `sessionId`, or `null` when
+     * it is unknown, already consumed, or past its TTL (an expired entry is
+     * dropped here). A `null` return means the completer must reject (no
+     * exchange, no write).
+     *
+     * Deliberately NOT a consume: the completer peeks, runs the token exchange,
+     * and only {@link consume}s once a token has actually been minted. Consuming
+     * up-front burned the session on EVERY failed exchange (a mistyped/expired
+     * pasted code, a proxy hiccup), so the user's natural retry hit
+     * "session is unknown, expired, or already used" and the login became
+     * unrecoverable without restarting the whole flow.
+     */
+    peek(sessionId: string): PendingOAuthSession | null;
+    /**
+     * SINGLE-USE burn: drop the session so the same `sessionId` can never be
+     * completed twice. Called ONLY after a successful token exchange.
      */
-    take(sessionId: string): PendingOAuthSession | null;
-    /** Drop every session past its TTL. Called on each put/take. */
+    consume(sessionId: string): void;
+    /** Drop every session past its TTL. Called on each put/peek. */
     private sweep;
 }
 
@@ -984,10 +1002,12 @@ declare class OAuthSessionStore {
  * provider's authorize params and stashes the per-session `{ codeVerifier, state }`
  * in the `OAuthSessionStore` keyed by a minted opaque `sessionId`, returning ONLY
  * `{ authUrl, sessionId }` (the `authUrl` carries client_id + PKCE challenge +
- * state — all public). `complete` does a SINGLE-USE `take(sessionId)`, validates
- * state (claude's `code#state`), `exchangeCodeForTokens(...)`, persists the minted
- * token through the encrypted credential store (`appendProviderAccount`) + marks
- * it active, and responds ONLY the sanitized `SubscriptionListEntry`.
+ * state — all public). `complete` `peek`s the session, validates state (claude's
+ * `code#state`), `exchangeCodeForTokens(...)`, then — and ONLY then — `consume`s
+ * the session (single-use), persists the minted token through the encrypted
+ * credential store (`appendProviderAccount`) + marks it active, and responds ONLY
+ * the sanitized `SubscriptionListEntry`. A FAILED exchange leaves the session
+ * intact so the user can retry within its TTL instead of being locked out by a 410.
  *
  * SECRET SPINE (the load-bearing invariant): the minted access/refresh token
  * NEVER appears in any response body or log; the `codeVerifier` / session map is
@@ -1084,6 +1104,127 @@ declare class CodexOAuthSessionStore {
     private sweep;
 }
 
+/**
+ * Claude OAuth usage collector.
+ *
+ * Fetches one account's five-hour, seven-day, and seven-day Sonnet windows,
+ * coalesces concurrent refreshes by account, and caches every result for five
+ * minutes. Tokens and raw upstream payloads never leave this module.
+ */
+
+interface ClaudeAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'claude', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'claude', accountId: string): Promise<boolean>;
+}
+type ClaudeAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface ClaudeAllowanceCollectOptions {
+    force?: boolean;
+    /**
+     * Treat an otherwise valid cache entry as due when it will expire within this
+     * window. The resident background scheduler uses this to refresh shortly
+     * before expiry without bypassing the normal cache on every tick.
+     */
+    refreshAheadMs?: number;
+}
+declare class ClaudeAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly identityStore;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: ClaudeAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: ClaudeAllowanceFetch, identityStore?: SubscriptionIdentityStore, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<ClaudeTokenConfig>[], options?: ClaudeAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<ClaudeTokenConfig>, options?: ClaudeAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    private request;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
+/** Secret-free account allowance query/refresh facade used by the admin API. */
+
+interface AccountAllowanceCredentialReader extends ClaudeAllowanceCredentialReader {
+    getFullConfig(): Promise<AccountTokensConfig>;
+}
+interface AccountAllowanceFilter {
+    providerId?: SubscriptionProviderId;
+    accountId?: string;
+}
+interface AccountAllowanceSchedulingStatus {
+    config: AllowanceSchedulingConfig;
+    history: AllowanceSchedulingDecision[];
+}
+declare class AccountAllowanceService {
+    private readonly credentials;
+    private readonly store;
+    private readonly now;
+    readonly claudeCollector: ClaudeAllowanceCollector;
+    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, now?: () => number);
+    /**
+     * Read all/filtered snapshots. Claude's five-minute cache is refreshed lazily;
+     * Codex remains passive and reports not-observed until a real model response.
+     */
+    list(filter?: AccountAllowanceFilter): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Claude usage for one account or every stored Claude account. */
+    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /**
+     * Keep Claude snapshots warm for allowance-aware routing. This deliberately
+     * excludes Codex (whose quota is learned from real response headers) and
+     * preserves the collector's cache + per-account in-flight coalescing.
+     */
+    maintainClaudeCache(refreshAheadMs: number): Promise<void>;
+    /** Remove a cache row as soon as an account is deleted by the admin path. */
+    removeAccountSnapshot(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove all allowance rows for a provider block that was deleted. */
+    removeProviderSnapshots(providerId: SubscriptionProviderId): void;
+    /** Secret-free policy diagnostics for the settings/accounts UI. */
+    getSchedulingStatus(): AccountAllowanceSchedulingStatus;
+}
+
+/**
+ * Low-frequency, non-blocking cache maintenance for Claude allowance snapshots.
+ *
+ * The routing policy intentionally ignores stale quota data. Without a resident
+ * UI poll, the five-minute Claude snapshot would therefore age out and silently
+ * stop influencing account selection. This worker checks once a minute and asks
+ * the existing collector to refresh entries that are close to expiry. The
+ * collector remains the cache/coalescing authority, so a tick normally performs
+ * no network I/O and can share an in-flight request with the admin UI.
+ *
+ * Zero-regression invariant: the worker does not arm a timer or perform an
+ * initial sweep unless `server.allowanceScheduling.enabled` is true.
+ */
+
+interface ClaudeAllowanceCacheMaintainer {
+    maintainClaudeCache(refreshAheadMs: number): Promise<void>;
+}
+declare class ClaudeAllowanceRefreshScheduler {
+    private readonly service;
+    private readonly logger;
+    private readonly intervalMs;
+    private readonly refreshAheadMs;
+    private timer;
+    private started;
+    private enabled;
+    private sweeping;
+    constructor(service: ClaudeAllowanceCacheMaintainer, logger: Logger, intervalMs?: number, refreshAheadMs?: number);
+    /**
+     * Apply live server policy. Once started, enable/disable changes arm or disarm
+     * immediately; the initial enabled sweep is fire-and-forget.
+     */
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    /** Start the lifecycle. Disabled policy remains completely inert. */
+    start(): void;
+    /** Stop all future checks. Idempotent and safe during an in-flight refresh. */
+    dispose(): void;
+    /** One non-overlapping cache-maintenance pass. Exposed for focused tests. */
+    sweep(): Promise<void>;
+    private arm;
+    private disarm;
+}
+
 /**
  * ProbeStrategy — the per-provider two-tier probe plan
  * (subscription-account-probe #8, design D1).
@@ -1163,7 +1304,14 @@ interface ProbeRecord {
     /** Upstream round-trip latency (ms); absent for a local-tier record. */
     latencyMs?: number;
     /** Which tier produced this record. */
-    tier: 'local' | 'upstream';
+    tier: 'local' | 'upstream' | 'generation';
+}
+/** Secret-free outcome returned by the manual account connection-test route. */
+interface AccountConnectionProbeOutcome {
+    ok: boolean;
+    marked: boolean;
+    tier: ProbeRecord['tier'];
+    model?: string;
 }
 /** Per-account probe history for the authed admin surface (names account ids). */
 interface AccountProbeHistorySnapshot {
@@ -1183,6 +1331,8 @@ interface AccountProbeHistoryReader {
 interface ProbeCredentialStore {
     getFullConfig(): Promise<AccountTokensConfig>;
     getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+    /** Optional serving-parity retry seam for an upstream Codex 401. */
+    refreshAccountToken?(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
 }
 /** Proxy-aware upstream fetch signature (#3 `fetchUpstream`). */
 type ProbeFetch = typeof fetchUpstream;
@@ -1232,10 +1382,13 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
      * no upstream); else the upstream tier when a verified endpoint exists. Records
      * the rolling history entry either way; returns whether the tracker was MARKED.
      */
-    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<{
-        ok: boolean;
-        marked: boolean;
-    }>;
+    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
+    /**
+     * Manual connection test. Codex performs a real, quota-consuming generation;
+     * every other provider keeps its existing cheap probe. Scheduled sweeps never
+     * call this method, so they remain non-billable.
+     */
+    testAccountConnection(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
     /** Per-account rolling history for the authed admin surface (design D5). */
     getAllHistory(): AccountProbeHistorySnapshot[];
     /**
@@ -1254,6 +1407,7 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
     private record;
     /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
     private readBounded;
+    private runCodexGenerationAttempt;
     private key;
     private parseKey;
 }
@@ -1280,6 +1434,18 @@ interface AuditQuery {
     limit?: number;
 }
 
+/**
+ * Metadata-only audit aggregation. The overview needs request/error counts, not
+ * multi-gigabyte request/response bodies. A compact per-day sidecar is updated
+ * with each new record; legacy files are scanned once with a bounded prefix per
+ * JSONL row and then cached in the same sidecar.
+ */
+
+interface AuditStatsQuery {
+    from?: number;
+    to?: number;
+}
+
 /**
  * auditQueryApi — the AUTHED `GET /admin/api/audit?keyId=&from=&to=&limit=`
  * handler (request-audit-log, design D6).
@@ -1299,6 +1465,8 @@ interface AuditQuery {
 
 /** The read surface the AdminServer consumes (bootstrap binds it to the store). */
 type AuditQueryReader = (query: AuditQuery) => AuditRecord[];
+/** Metadata-only aggregate reader used by the overview. */
+type AuditStatsReader = (query: AuditStatsQuery) => Promise<AuditStats> | AuditStats;
 
 /**
  * billingStatusApi — the AUTHED `GET /admin/api/billing-status` handler
@@ -1498,6 +1666,14 @@ declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
 declare class JsonPricingStore implements PricingStore {
     private readonly pricingPath;
     constructor(pricingPath: string);
+    /**
+     * Return whether the durable snapshot can actually serve at least one price.
+     *
+     * This intentionally checks the file itself instead of relying on refresh
+     * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
+     * otherwise unusable pricing table after a crash or manual file edit.
+     */
+    hasUsableSnapshot(): boolean;
     getAll(): Promise<PricingEntry[]>;
     /**
      * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
@@ -1510,10 +1686,10 @@ declare class JsonPricingStore implements PricingStore {
     /**
      * Apply a batch fetched from a pricing source. Rows whose local copy is
      * user-edited are NOT applied — they come back as `{ current, incoming }`
-     * conflicts; everything else is upserted (source 'litellm'). ONE file write
-     * for the whole batch.
+     * conflicts; everything else is upserted with the supplied automatic source.
+     * ONE file write for the whole batch.
      */
-    bulkApplyFromSource(entries: PricingEntryInput[]): Promise<{
+    bulkApplyFromSource(entries: PricingEntryInput[], source?: AutomaticPricingSource): Promise<{
         applied: PricingEntry[];
         conflicts: Array<{
             current: PricingEntry;
@@ -1539,6 +1715,98 @@ declare class JsonPricingStore implements PricingStore {
     /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
     private readRows;
     private writeRows;
+    /** Isolated for deterministic failure testing; never removes the target. */
+    private replaceFile;
+}
+
+type IntegrationClientId = 'codex' | 'claude';
+type IntegrationStatusKind = 'not-installed' | 'enabled' | 'configuration-drift' | 'configuration-missing' | 'key-missing';
+interface IntegrationClientStatus {
+    client: IntegrationClientId;
+    status: IntegrationStatusKind;
+    configPath: string;
+    installedAt?: number;
+    gatewayBaseUrl?: string;
+    message?: string;
+}
+interface IntegrationChangePlan {
+    client: IntegrationClientId;
+    configPath: string;
+    action: 'install' | 'none' | 'repair';
+    canApply: boolean;
+    /** Redacted logical fields only; never file contents or credential values. */
+    changes: string[];
+    warnings: string[];
+}
+interface IntegrationInstallRecord {
+    client: IntegrationClientId;
+    configPath: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
+    installedAt: number;
+    gatewayBaseUrl: string;
+    /** Codex auth.json snapshot and installed hash; absent on legacy records. */
+    credentialFile?: IntegrationManagedFileRecord;
+}
+interface IntegrationManagedFileRecord {
+    path: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
+}
+interface IntegrationGatewayKeyRecord {
+    id: string;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    secret: string;
+    createdAt: number;
+}
+interface IntegrationState {
+    version: 1;
+    gatewayKey?: IntegrationGatewayKeyRecord;
+    clients: Partial<Record<IntegrationClientId, IntegrationInstallRecord>>;
+}
+
+/** Encrypted, Omnicross-owned state for reversible native CLI configuration. */
+declare class IntegrationStateStore {
+    readonly path: string;
+    private readonly box;
+    constructor(path: string, box: SecretBox);
+    load(): IntegrationState;
+    save(state: IntegrationState): void;
+}
+
+interface IntegrationManagerOptions {
+    configPath: string;
+    gatewayBaseUrl: string;
+    keyDb: OutboundKeyDb;
+    stateStore: IntegrationStateStore;
+    homeDir?: string;
+}
+/** Coordinates a least-privilege gateway key with reversible native CLI config edits. */
+declare class IntegrationManager {
+    private readonly options;
+    private readonly homeDir;
+    constructor(options: IntegrationManagerOptions);
+    listStatus(): Promise<IntegrationClientStatus[]>;
+    plan(client: IntegrationClientId, configPath?: string): Promise<IntegrationChangePlan>;
+    install(client: IntegrationClientId, configPath?: string): Promise<IntegrationClientStatus>;
+    repair(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    remove(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    rotateGatewayKey(): Promise<{
+        keyId: string;
+    }>;
+    getGatewayToken(): Promise<string>;
+    private ensureGatewayKey;
+    private isKeyUsable;
+    private statusFor;
+    private defaultConfigPath;
+    private codexAuthPathForConfig;
+    private renderInstalled;
 }
 
 /**
@@ -1623,22 +1891,18 @@ interface MigrationCredentialStore extends SubscriptionAccountAppender {
     getFullConfig(): Promise<AccountTokensConfig>;
 }
 
-/**
- * adminApi — the daemon admin dashboard's management API router (`/admin/api/*`,
- * JSON) (RT3, design D3/D4/D5).
- *
- * A small method+path router over the LIVE daemon handles + exported core fns.
- * Resources: providers (CRUD + hot-reload), keys (CRUD + one-time plaintext),
- * server config (live apply), accounts (read-only status), status, playground
- * (same-origin proxy to `/v1/*`).
- *
- * SECRET SPINE (design D4 — the load-bearing invariant): secrets flow IN
- * (POST/PUT) and NEVER OUT (GET). The provider mask (`maskProviderApiKey`) and
- * the key DTO map (`toKeyInfo`) are the single places the masking is applied so
- * the invariant lives in one spot.
- *
- * @module @omnicross/daemon/admin/adminApi
- */
+/** Minimal, auth-gated admin API for secret-free account allowance snapshots. */
+
+interface AccountAllowanceAdminReader {
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }): Promise<AccountAllowanceSnapshot[]>;
+    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
+    removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
+    getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
+}
 
 /** Token-free subscription account list entry (passthrough from core's service). */
 interface AdminAccountsLister {
@@ -1666,7 +1930,7 @@ interface AdminApiDeps {
     /** Live provider catalog (hot-reload target). */
     readonly llmConfig: ConfigFileProviderConfigSource;
     /** Named outbound-key store. */
-    readonly keyDb: OutboundKeyDb;
+    readonly keyDb: OutboundKeyDb$1;
     /**
      * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
      * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
@@ -1685,6 +1949,26 @@ interface AdminApiDeps {
     readonly outboundApiServer: OutboundApiServer;
     /** Subscription accounts (token-free `listAll`). */
     readonly subscriptionAccounts: AdminAccountsLister;
+    /**
+     * Secret-free upstream allowance facade. Optional for lightweight embedders;
+     * the standalone daemon wires it and the route returns 501 when absent.
+     */
+    readonly accountAllowanceService?: AccountAllowanceAdminReader;
+    /** Live Claude cache worker; hot-reconfigured with allowance scheduling. */
+    readonly allowanceRefreshScheduler?: Pick<ClaudeAllowanceRefreshScheduler, 'configure'>;
+    /** Optional secret-free account connection probe + rolling history surface. */
+    readonly accountProbeService?: AccountProbeHistoryReader & {
+        probeAccount(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+        }>;
+        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+            tier: 'local' | 'upstream' | 'generation';
+            model?: string;
+        }>;
+    };
     /**
      * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
      * methods (`writeProviderTokens` / `clearProvider`), never a token-returning
@@ -1706,11 +1990,13 @@ interface AdminApiDeps {
      */
     readonly oauthSessions: OAuthSessionStore;
     /**
-     * Injected token-exchange `FetchLike` (oauth design D2-a) — defaults to global
-     * `fetch` in `bootstrap.ts`; tests inject a mock so no real token endpoint is
-     * hit. Mirrors how `login.ts` injects its exchange fetch.
+     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
+     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
+     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
+     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
+     * injects its exchange fetch.
      */
-    readonly oauthExchangeFetch: FetchLike;
+    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
     /**
      * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
      * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
@@ -1765,6 +2051,8 @@ interface AdminApiDeps {
      * actually runs.
      */
     readonly cliCommandRunner?: CommandRunner;
+    /** Factory so each request observes the outbound server's current loopback port. */
+    readonly integrationManagerFactory?: () => IntegrationManager;
 }
 /**
  * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
@@ -1830,6 +2118,8 @@ interface AdminServerDeps extends AdminApiDeps {
      * unauthenticated, NEVER on `/health`.
      */
     auditReader?: AuditQueryReader;
+    /** Metadata-only audit aggregate used by the overview error-rate metric. */
+    auditStatsReader?: AuditStatsReader;
     /**
      * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
      * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
@@ -1872,23 +2162,18 @@ declare class AdminServer {
     getStatus(): AdminServerStatus;
 }
 
-/**
- * JsonOutboundKeyDb — the daemon's file-backed `OutboundKeyDb` port impl
- * (design D3).
- *
- * Durable storage for named outbound API keys, backed by a json file (a sibling
- * of `config.json`, e.g. `keys.json`) holding an `OutboundKeyDbRow[]`. This port
- * provides ONLY storage — it never generates secrets nor hashes. Core's
- * `createNamedKey(db, name)` calls `outboundApiKeysCreate` with the sha256
- * `keyHash` + display `keyPrefix` and returns the one-time plaintext; the hot
- * auth path uses core's `hashKey(presented)` + `outboundApiKeysGetByHash`.
- *
- * @module @omnicross/daemon/ports/JsonOutboundKeyDb
- */
-
-declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
+declare class JsonOutboundKeyDb implements OutboundKeyDb {
     private readonly keysPath;
-    constructor(keysPath: string);
+    private readonly secretBox?;
+    /**
+     * @param secretBox OPTIONAL reversible-secret codec. When present, a created
+     * key's plaintext is persisted as a `keySecret` `enc:` envelope (enabling the
+     * operator "view key" affordance via `outboundApiKeysReveal`). When absent the
+     * store stays hash-only (byte-identical to the legacy behavior) and reveal
+     * always returns `null`. Existing 1-arg call sites (tests, lightweight
+     * embedders) keep working.
+     */
+    constructor(keysPath: string, secretBox?: SecretBox | undefined);
     outboundApiKeysList(): Promise<OutboundKeyDbRow[]>;
     outboundApiKeysGetByHash(hash: string): Promise<OutboundKeyDbRow | null>;
     outboundApiKeysCreate(input: {
@@ -1897,7 +2182,13 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
         keyHash: string;
         keyPrefix: string;
         createdAt?: number;
+        kind?: 'client' | 'integration';
+        allowedEndpoints?: _omnicross_core.OutboundEndpoint[];
+        loopbackOnly?: boolean;
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    outboundApiKeysDelete(id: string): Promise<boolean>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
@@ -1911,6 +2202,41 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb$1 {
     private writeRows;
 }
 
+interface PricingRefreshState {
+    lastAttemptAt: number | null;
+    lastSuccessAt: number | null;
+    lastError: string | null;
+    sources: PricingSourceRefreshResult[];
+}
+interface PricingRefreshSchedulerOptions {
+    staleAfterMs?: number;
+    intervalMs?: number;
+    now?: () => number;
+}
+interface PricingCatalogSnapshot {
+    hasUsableSnapshot(): boolean;
+}
+declare class PricingRefreshScheduler {
+    private readonly engine;
+    private readonly catalog;
+    private readonly statePath;
+    private readonly logger;
+    private readonly staleAfterMs;
+    private readonly intervalMs;
+    private readonly now;
+    private timer;
+    private inFlight;
+    constructor(engine: PricingEngine$1, catalog: PricingCatalogSnapshot, statePath: string, logger: Logger, options?: PricingRefreshSchedulerOptions);
+    /** Fire one stale check immediately and arm an unref'ed periodic check. */
+    start(): void;
+    dispose(): void;
+    getState(): PricingRefreshState;
+    /** Public for admin/manual tests; concurrent checks share one promise. */
+    refreshIfStale(force?: boolean): Promise<void>;
+    private runRefresh;
+    private writeState;
+}
+
 /**
  * AccountHealthSweeper — proactive account-health recovery tick
  * (subscription-account-health, design D6).
@@ -2181,24 +2507,20 @@ declare class BillingRetrySweeper {
 }
 
 /**
- * TokenRefreshScheduler — proactive background OAuth token refresh
- * (external-cli-sync).
+ * TokenRefreshScheduler proactive background OAuth token refresh.
  *
- * The auth strategies already refresh LAZILY (lead-window check before each
- * request + 401 retry), but a daemon that sits idle past a token's lifetime
- * pays the refresh latency — or a dead rotated token — on the first request.
- * This scheduler sweeps every account of every OAuth provider on an interval
- * and refreshes any token entering the expiry lead window.
+ * The auth strategies already refresh lazily (lead-window check before each
+ * request + 401 retry), but an idle daemon can still reach token expiry
+ * before its next request. This scheduler sweeps managed OAuth accounts on
+ * an interval and refreshes tokens entering the expiry lead window.
  *
  * Safety properties:
- *  - the store coalesces in-flight refreshes per account, so a sweep can never
+ *  - the store coalesces in-flight refreshes per account, so a sweep cannot
  *    double-spend a single-use refresh token against a concurrent lazy refresh;
- *  - accounts already flagged `expired` are skipped (a dead refresh token is
- *    not retried every tick — recovery is the external-import fallback or a
- *    re-login);
- *  - the ACTIVE account routes through the provider's active refresher (which
- *    carries the external CLI import fallback); non-active accounts refresh
- *    by id;
+ *  - accounts already flagged `expired` are skipped and remain expired until
+ *    their own managed credential is repaired or re-login occurs;
+ *  - the active account uses its managed active refresher, while non-active
+ *    accounts refresh by id; both paths use only managed stored credentials;
  *  - one sweep runs at a time (a long sweep never overlaps the next tick).
  *
  * Modeled on `ApiKeyPoolService`'s interval lifecycle: `start()` arms an
@@ -2223,8 +2545,9 @@ declare class TokenRefreshScheduler {
     sweep(now?: number): Promise<void>;
     /** Expiring within the lead window, refreshable, and not already dead. */
     private needsRefresh;
-    /** Refresh one account; failures are logged, never thrown (the store has
-     *  already flagged the account `expired`). */
+    /** Refresh one managed account; failures are logged, never thrown. The
+     * store marks only the targeted account `expired` on a failed refresh.
+     */
     private refreshOne;
     private refreshActive;
 }
@@ -2406,10 +2729,20 @@ interface Daemon {
     /** Subscription account service (token-free `listAll`) — now exposed for the
      *  admin dashboard's read-only accounts panel (RT3). */
     readonly subscriptionAccounts: SubscriptionAccountService;
+    /** Secret-free upstream subscription allowance cache/collector facade. */
+    readonly accountAllowanceService: AccountAllowanceService;
+    /**
+     * Claude allowance cache maintenance for allowance-aware routing. Constructed
+     * armed-off; the resident `start` command starts it only when the persisted
+     * scheduling policy is enabled.
+     */
+    readonly claudeAllowanceRefreshScheduler: ClaudeAllowanceRefreshScheduler;
     /** File-backed pricing table (`pricing.json`; concrete for the admin DELETE). */
     readonly pricingStore: JsonPricingStore;
     /** Pricing engine (cost calc + source refresh + conflict resolution). */
     readonly pricingEngine: PricingEngine;
+    /** Non-blocking stale-while-revalidate catalog worker (armed by `start`). */
+    readonly pricingRefreshScheduler: PricingRefreshScheduler;
     /** Usage recorder over `usage-events.jsonl` — also the admin stats query facade. */
     readonly usageRecorder: UsageRecorder;
     /** The localhost admin/dashboard HTTP listener (RT3). Started by `start.ts`. */