@omnicross/daemon 0.1.6 → 0.1.8

package/dist/index.d.cts

@@ -2,7 +2,7 @@ import * as _omnicross_core from '@omnicross/core';
 import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1 } from '@omnicross/core';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
 import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
-import { ProviderProxy } from '@omnicross/core/provider-proxy';
+import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
@@ -15,7 +15,7 @@ import { SubscriptionIdentityStore } from '@omnicross/core/provider-proxy/identi
 import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
 import { SubscriptionAccountHealth } from '@omnicross/core/pipeline/SubscriptionAccountHealth';
 import { fetchUpstream } from '@omnicross/core/pipeline/upstreamFetch';
-import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+import { AuditRecord, AuditStats, AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
@@ -579,6 +579,12 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
      * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
      * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
+     *
+     * `redactBodies` is REQUIRED here: this round-trip sends the refresh_token and
+     * receives a fresh access/refresh token pair. Carrying a `providerId` opts the
+     * call into the upstream trace (so a failing refresh is diagnosable), and the
+     * trace captures bodies verbatim — without this flag every refresh would write
+     * a plaintext token pair into `upstream-trace.jsonl`.
      */
     buildRefreshFetch(providerId: string, accountId?: string): FetchLike;
     /**
@@ -923,11 +929,12 @@ interface SubscriptionTokenWriter {
  * app-parity child 4, design D1).
  *
  * `start` mints a crypto-random `sessionId` and stashes the per-session PKCE
- * `{ providerId, codeVerifier, state }` here; `complete` does a SINGLE-USE
- * `take(sessionId)` (returns + deletes) and exchanges the code. The map is
+ * `{ providerId, codeVerifier, state }` here; `complete` `peek`s the session,
+ * exchanges the code, and `consume`s it ONLY once a token was minted — so a
+ * failed exchange leaves the session retryable instead of burning it. The map is
  * NEVER serialized to the client — only the opaque `sessionId` + the public
  * `authUrl` cross the wire. Sessions are short-lived (OQ3 = 10-min TTL); a sweep
- * reaps abandoned sessions, and `take` re-checks the TTL so an expired-but-not-
+ * reaps abandoned sessions, and `peek` re-checks the TTL so an expired-but-not-
  * yet-swept session is still rejected. A daemon restart simply drops in-flight
  * logins (correct fail-safe — no partial token is ever written).
  *
@@ -963,13 +970,25 @@ declare class OAuthSessionStore {
      */
     put(session: Omit<PendingOAuthSession, 'createdAt'>): string;
     /**
-     * SINGLE-USE consume: return + delete the session for `sessionId`, or `null`
-     * when it is unknown, already used, or past its TTL (in which case it is
-     * dropped). A `null` return means the completer must reject (no exchange, no
-     * write).
+     * NON-DESTRUCTIVE lookup: return the session for `sessionId`, or `null` when
+     * it is unknown, already consumed, or past its TTL (an expired entry is
+     * dropped here). A `null` return means the completer must reject (no
+     * exchange, no write).
+     *
+     * Deliberately NOT a consume: the completer peeks, runs the token exchange,
+     * and only {@link consume}s once a token has actually been minted. Consuming
+     * up-front burned the session on EVERY failed exchange (a mistyped/expired
+     * pasted code, a proxy hiccup), so the user's natural retry hit
+     * "session is unknown, expired, or already used" and the login became
+     * unrecoverable without restarting the whole flow.
+     */
+    peek(sessionId: string): PendingOAuthSession | null;
+    /**
+     * SINGLE-USE burn: drop the session so the same `sessionId` can never be
+     * completed twice. Called ONLY after a successful token exchange.
      */
-    take(sessionId: string): PendingOAuthSession | null;
-    /** Drop every session past its TTL. Called on each put/take. */
+    consume(sessionId: string): void;
+    /** Drop every session past its TTL. Called on each put/peek. */
     private sweep;
 }
 
@@ -983,10 +1002,12 @@ declare class OAuthSessionStore {
  * provider's authorize params and stashes the per-session `{ codeVerifier, state }`
  * in the `OAuthSessionStore` keyed by a minted opaque `sessionId`, returning ONLY
  * `{ authUrl, sessionId }` (the `authUrl` carries client_id + PKCE challenge +
- * state — all public). `complete` does a SINGLE-USE `take(sessionId)`, validates
- * state (claude's `code#state`), `exchangeCodeForTokens(...)`, persists the minted
- * token through the encrypted credential store (`appendProviderAccount`) + marks
- * it active, and responds ONLY the sanitized `SubscriptionListEntry`.
+ * state — all public). `complete` `peek`s the session, validates state (claude's
+ * `code#state`), `exchangeCodeForTokens(...)`, then — and ONLY then — `consume`s
+ * the session (single-use), persists the minted token through the encrypted
+ * credential store (`appendProviderAccount`) + marks it active, and responds ONLY
+ * the sanitized `SubscriptionListEntry`. A FAILED exchange leaves the session
+ * intact so the user can retry within its TTL instead of being locked out by a 410.
  *
  * SECRET SPINE (the load-bearing invariant): the minted access/refresh token
  * NEVER appears in any response body or log; the `codeVerifier` / session map is
@@ -1283,7 +1304,14 @@ interface ProbeRecord {
     /** Upstream round-trip latency (ms); absent for a local-tier record. */
     latencyMs?: number;
     /** Which tier produced this record. */
-    tier: 'local' | 'upstream';
+    tier: 'local' | 'upstream' | 'generation';
+}
+/** Secret-free outcome returned by the manual account connection-test route. */
+interface AccountConnectionProbeOutcome {
+    ok: boolean;
+    marked: boolean;
+    tier: ProbeRecord['tier'];
+    model?: string;
 }
 /** Per-account probe history for the authed admin surface (names account ids). */
 interface AccountProbeHistorySnapshot {
@@ -1303,6 +1331,8 @@ interface AccountProbeHistoryReader {
 interface ProbeCredentialStore {
     getFullConfig(): Promise<AccountTokensConfig>;
     getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+    /** Optional serving-parity retry seam for an upstream Codex 401. */
+    refreshAccountToken?(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
 }
 /** Proxy-aware upstream fetch signature (#3 `fetchUpstream`). */
 type ProbeFetch = typeof fetchUpstream;
@@ -1352,10 +1382,13 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
      * no upstream); else the upstream tier when a verified endpoint exists. Records
      * the rolling history entry either way; returns whether the tracker was MARKED.
      */
-    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<{
-        ok: boolean;
-        marked: boolean;
-    }>;
+    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
+    /**
+     * Manual connection test. Codex performs a real, quota-consuming generation;
+     * every other provider keeps its existing cheap probe. Scheduled sweeps never
+     * call this method, so they remain non-billable.
+     */
+    testAccountConnection(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
     /** Per-account rolling history for the authed admin surface (design D5). */
     getAllHistory(): AccountProbeHistorySnapshot[];
     /**
@@ -1374,6 +1407,7 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
     private record;
     /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
     private readBounded;
+    private runCodexGenerationAttempt;
     private key;
     private parseKey;
 }
@@ -1400,6 +1434,18 @@ interface AuditQuery {
     limit?: number;
 }
 
+/**
+ * Metadata-only audit aggregation. The overview needs request/error counts, not
+ * multi-gigabyte request/response bodies. A compact per-day sidecar is updated
+ * with each new record; legacy files are scanned once with a bounded prefix per
+ * JSONL row and then cached in the same sidecar.
+ */
+
+interface AuditStatsQuery {
+    from?: number;
+    to?: number;
+}
+
 /**
  * auditQueryApi — the AUTHED `GET /admin/api/audit?keyId=&from=&to=&limit=`
  * handler (request-audit-log, design D6).
@@ -1419,6 +1465,8 @@ interface AuditQuery {
 
 /** The read surface the AdminServer consumes (bootstrap binds it to the store). */
 type AuditQueryReader = (query: AuditQuery) => AuditRecord[];
+/** Metadata-only aggregate reader used by the overview. */
+type AuditStatsReader = (query: AuditStatsQuery) => Promise<AuditStats> | AuditStats;
 
 /**
  * billingStatusApi — the AUTHED `GET /admin/api/billing-status` handler
@@ -1783,6 +1831,7 @@ declare class IntegrationManager {
 /** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
 type PathProbe = (candidate: string) => string | null;
 /** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalCleanup = () => void;
 type TerminalOpener = (input: {
     cli: string;
     command: string;
@@ -1790,7 +1839,8 @@ type TerminalOpener = (input: {
     env: Record<string, string>;
     cwd?: string;
     platform: NodeJS.Platform;
-}) => void;
+    onFailure?: () => void;
+}) => void | TerminalCleanup;
 /**
  * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
  * default execs the install command with a bounded timeout). Returns the host's
@@ -1899,6 +1949,8 @@ interface AdminApiDeps {
     readonly settingsStore: JsonApiServerSettingsStore;
     /** The running outbound server (status + live applyConfig). */
     readonly outboundApiServer: OutboundApiServer;
+    /** Process-local machine-managed routing leases (optional for light embedders). */
+    readonly routeLeaseManager?: RouteLeaseManager;
     /** Subscription accounts (token-free `listAll`). */
     readonly subscriptionAccounts: AdminAccountsLister;
     /**
@@ -1914,6 +1966,12 @@ interface AdminApiDeps {
             ok: boolean;
             marked: boolean;
         }>;
+        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+            tier: 'local' | 'upstream' | 'generation';
+            model?: string;
+        }>;
     };
     /**
      * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
@@ -1936,11 +1994,13 @@ interface AdminApiDeps {
      */
     readonly oauthSessions: OAuthSessionStore;
     /**
-     * Injected token-exchange `FetchLike` (oauth design D2-a) — defaults to global
-     * `fetch` in `bootstrap.ts`; tests inject a mock so no real token endpoint is
-     * hit. Mirrors how `login.ts` injects its exchange fetch.
+     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
+     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
+     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
+     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
+     * injects its exchange fetch.
      */
-    readonly oauthExchangeFetch: FetchLike;
+    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
     /**
      * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
      * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
@@ -2062,6 +2122,8 @@ interface AdminServerDeps extends AdminApiDeps {
      * unauthenticated, NEVER on `/health`.
      */
     auditReader?: AuditQueryReader;
+    /** Metadata-only audit aggregate used by the overview error-rate metric. */
+    auditStatsReader?: AuditStatsReader;
     /**
      * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
      * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
@@ -2106,7 +2168,16 @@ declare class AdminServer {
 
 declare class JsonOutboundKeyDb implements OutboundKeyDb {
     private readonly keysPath;
-    constructor(keysPath: string);
+    private readonly secretBox?;
+    /**
+     * @param secretBox OPTIONAL reversible-secret codec. When present, a created
+     * key's plaintext is persisted as a `keySecret` `enc:` envelope (enabling the
+     * operator "view key" affordance via `outboundApiKeysReveal`). When absent the
+     * store stays hash-only (byte-identical to the legacy behavior) and reveal
+     * always returns `null`. Existing 1-arg call sites (tests, lightweight
+     * embedders) keep working.
+     */
+    constructor(keysPath: string, secretBox?: SecretBox | undefined);
     outboundApiKeysList(): Promise<OutboundKeyDbRow[]>;
     outboundApiKeysGetByHash(hash: string): Promise<OutboundKeyDbRow | null>;
     outboundApiKeysCreate(input: {
@@ -2118,7 +2189,10 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: _omnicross_core.OutboundEndpoint[];
         loopbackOnly?: boolean;
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    outboundApiKeysDelete(id: string): Promise<boolean>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
@@ -2642,6 +2716,7 @@ interface Daemon {
     readonly keyDb: JsonOutboundKeyDb;
     readonly settingsStore: JsonApiServerSettingsStore;
     readonly providerProxy: ProviderProxy;
+    readonly routeLeaseManager: RouteLeaseManager;
     readonly outboundApiServer: OutboundApiServer;
     /**
      * Multi-key load balancer. Wired into the proxy deps slot

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import * as _omnicross_core from '@omnicross/core';
 import { OutboundApiServerConfig, Logger, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1 } from '@omnicross/core';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
 import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
-import { ProviderProxy } from '@omnicross/core/provider-proxy';
+import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, SubscriptionProviderRegistry, SubscriptionAccountService } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
@@ -15,7 +15,7 @@ import { SubscriptionIdentityStore } from '@omnicross/core/provider-proxy/identi
 import { LoggingConfig, HealthReport } from '@omnicross/contracts/health-logging-types';
 import { SubscriptionAccountHealth } from '@omnicross/core/pipeline/SubscriptionAccountHealth';
 import { fetchUpstream } from '@omnicross/core/pipeline/upstreamFetch';
-import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+import { AuditRecord, AuditStats, AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
@@ -579,6 +579,12 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
      * through {@link fetchUpstream} with the account's `{ providerId, accountId }`
      * ctx so the per-account/provider proxy applies. `@internal` also a test seam.
+     *
+     * `redactBodies` is REQUIRED here: this round-trip sends the refresh_token and
+     * receives a fresh access/refresh token pair. Carrying a `providerId` opts the
+     * call into the upstream trace (so a failing refresh is diagnosable), and the
+     * trace captures bodies verbatim — without this flag every refresh would write
+     * a plaintext token pair into `upstream-trace.jsonl`.
      */
     buildRefreshFetch(providerId: string, accountId?: string): FetchLike;
     /**
@@ -923,11 +929,12 @@ interface SubscriptionTokenWriter {
  * app-parity child 4, design D1).
  *
  * `start` mints a crypto-random `sessionId` and stashes the per-session PKCE
- * `{ providerId, codeVerifier, state }` here; `complete` does a SINGLE-USE
- * `take(sessionId)` (returns + deletes) and exchanges the code. The map is
+ * `{ providerId, codeVerifier, state }` here; `complete` `peek`s the session,
+ * exchanges the code, and `consume`s it ONLY once a token was minted — so a
+ * failed exchange leaves the session retryable instead of burning it. The map is
  * NEVER serialized to the client — only the opaque `sessionId` + the public
  * `authUrl` cross the wire. Sessions are short-lived (OQ3 = 10-min TTL); a sweep
- * reaps abandoned sessions, and `take` re-checks the TTL so an expired-but-not-
+ * reaps abandoned sessions, and `peek` re-checks the TTL so an expired-but-not-
  * yet-swept session is still rejected. A daemon restart simply drops in-flight
  * logins (correct fail-safe — no partial token is ever written).
  *
@@ -963,13 +970,25 @@ declare class OAuthSessionStore {
      */
     put(session: Omit<PendingOAuthSession, 'createdAt'>): string;
     /**
-     * SINGLE-USE consume: return + delete the session for `sessionId`, or `null`
-     * when it is unknown, already used, or past its TTL (in which case it is
-     * dropped). A `null` return means the completer must reject (no exchange, no
-     * write).
+     * NON-DESTRUCTIVE lookup: return the session for `sessionId`, or `null` when
+     * it is unknown, already consumed, or past its TTL (an expired entry is
+     * dropped here). A `null` return means the completer must reject (no
+     * exchange, no write).
+     *
+     * Deliberately NOT a consume: the completer peeks, runs the token exchange,
+     * and only {@link consume}s once a token has actually been minted. Consuming
+     * up-front burned the session on EVERY failed exchange (a mistyped/expired
+     * pasted code, a proxy hiccup), so the user's natural retry hit
+     * "session is unknown, expired, or already used" and the login became
+     * unrecoverable without restarting the whole flow.
+     */
+    peek(sessionId: string): PendingOAuthSession | null;
+    /**
+     * SINGLE-USE burn: drop the session so the same `sessionId` can never be
+     * completed twice. Called ONLY after a successful token exchange.
      */
-    take(sessionId: string): PendingOAuthSession | null;
-    /** Drop every session past its TTL. Called on each put/take. */
+    consume(sessionId: string): void;
+    /** Drop every session past its TTL. Called on each put/peek. */
     private sweep;
 }
 
@@ -983,10 +1002,12 @@ declare class OAuthSessionStore {
  * provider's authorize params and stashes the per-session `{ codeVerifier, state }`
  * in the `OAuthSessionStore` keyed by a minted opaque `sessionId`, returning ONLY
  * `{ authUrl, sessionId }` (the `authUrl` carries client_id + PKCE challenge +
- * state — all public). `complete` does a SINGLE-USE `take(sessionId)`, validates
- * state (claude's `code#state`), `exchangeCodeForTokens(...)`, persists the minted
- * token through the encrypted credential store (`appendProviderAccount`) + marks
- * it active, and responds ONLY the sanitized `SubscriptionListEntry`.
+ * state — all public). `complete` `peek`s the session, validates state (claude's
+ * `code#state`), `exchangeCodeForTokens(...)`, then — and ONLY then — `consume`s
+ * the session (single-use), persists the minted token through the encrypted
+ * credential store (`appendProviderAccount`) + marks it active, and responds ONLY
+ * the sanitized `SubscriptionListEntry`. A FAILED exchange leaves the session
+ * intact so the user can retry within its TTL instead of being locked out by a 410.
  *
  * SECRET SPINE (the load-bearing invariant): the minted access/refresh token
  * NEVER appears in any response body or log; the `codeVerifier` / session map is
@@ -1283,7 +1304,14 @@ interface ProbeRecord {
     /** Upstream round-trip latency (ms); absent for a local-tier record. */
     latencyMs?: number;
     /** Which tier produced this record. */
-    tier: 'local' | 'upstream';
+    tier: 'local' | 'upstream' | 'generation';
+}
+/** Secret-free outcome returned by the manual account connection-test route. */
+interface AccountConnectionProbeOutcome {
+    ok: boolean;
+    marked: boolean;
+    tier: ProbeRecord['tier'];
+    model?: string;
 }
 /** Per-account probe history for the authed admin surface (names account ids). */
 interface AccountProbeHistorySnapshot {
@@ -1303,6 +1331,8 @@ interface AccountProbeHistoryReader {
 interface ProbeCredentialStore {
     getFullConfig(): Promise<AccountTokensConfig>;
     getAccessTokenForAccount(providerId: SubscriptionProviderId, accountId: string): Promise<string | null>;
+    /** Optional serving-parity retry seam for an upstream Codex 401. */
+    refreshAccountToken?(providerId: SubscriptionProviderId, accountId: string): Promise<boolean>;
 }
 /** Proxy-aware upstream fetch signature (#3 `fetchUpstream`). */
 type ProbeFetch = typeof fetchUpstream;
@@ -1352,10 +1382,13 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
      * no upstream); else the upstream tier when a verified endpoint exists. Records
      * the rolling history entry either way; returns whether the tracker was MARKED.
      */
-    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<{
-        ok: boolean;
-        marked: boolean;
-    }>;
+    probeAccount(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
+    /**
+     * Manual connection test. Codex performs a real, quota-consuming generation;
+     * every other provider keeps its existing cheap probe. Scheduled sweeps never
+     * call this method, so they remain non-billable.
+     */
+    testAccountConnection(providerId: SubscriptionProviderId, accountId: string): Promise<AccountConnectionProbeOutcome>;
     /** Per-account rolling history for the authed admin surface (design D5). */
     getAllHistory(): AccountProbeHistorySnapshot[];
     /**
@@ -1374,6 +1407,7 @@ declare class AccountHealthProbeScheduler implements AccountProbeHistoryReader {
     private record;
     /** Read a bounded slice of the response body for the 403-ban sniff (never throws). */
     private readBounded;
+    private runCodexGenerationAttempt;
     private key;
     private parseKey;
 }
@@ -1400,6 +1434,18 @@ interface AuditQuery {
     limit?: number;
 }
 
+/**
+ * Metadata-only audit aggregation. The overview needs request/error counts, not
+ * multi-gigabyte request/response bodies. A compact per-day sidecar is updated
+ * with each new record; legacy files are scanned once with a bounded prefix per
+ * JSONL row and then cached in the same sidecar.
+ */
+
+interface AuditStatsQuery {
+    from?: number;
+    to?: number;
+}
+
 /**
  * auditQueryApi — the AUTHED `GET /admin/api/audit?keyId=&from=&to=&limit=`
  * handler (request-audit-log, design D6).
@@ -1419,6 +1465,8 @@ interface AuditQuery {
 
 /** The read surface the AdminServer consumes (bootstrap binds it to the store). */
 type AuditQueryReader = (query: AuditQuery) => AuditRecord[];
+/** Metadata-only aggregate reader used by the overview. */
+type AuditStatsReader = (query: AuditStatsQuery) => Promise<AuditStats> | AuditStats;
 
 /**
  * billingStatusApi — the AUTHED `GET /admin/api/billing-status` handler
@@ -1783,6 +1831,7 @@ declare class IntegrationManager {
 /** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
 type PathProbe = (candidate: string) => string | null;
 /** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalCleanup = () => void;
 type TerminalOpener = (input: {
     cli: string;
     command: string;
@@ -1790,7 +1839,8 @@ type TerminalOpener = (input: {
     env: Record<string, string>;
     cwd?: string;
     platform: NodeJS.Platform;
-}) => void;
+    onFailure?: () => void;
+}) => void | TerminalCleanup;
 /**
  * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
  * default execs the install command with a bounded timeout). Returns the host's
@@ -1899,6 +1949,8 @@ interface AdminApiDeps {
     readonly settingsStore: JsonApiServerSettingsStore;
     /** The running outbound server (status + live applyConfig). */
     readonly outboundApiServer: OutboundApiServer;
+    /** Process-local machine-managed routing leases (optional for light embedders). */
+    readonly routeLeaseManager?: RouteLeaseManager;
     /** Subscription accounts (token-free `listAll`). */
     readonly subscriptionAccounts: AdminAccountsLister;
     /**
@@ -1914,6 +1966,12 @@ interface AdminApiDeps {
             ok: boolean;
             marked: boolean;
         }>;
+        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+            tier: 'local' | 'upstream' | 'generation';
+            model?: string;
+        }>;
     };
     /**
      * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
@@ -1936,11 +1994,13 @@ interface AdminApiDeps {
      */
     readonly oauthSessions: OAuthSessionStore;
     /**
-     * Injected token-exchange `FetchLike` (oauth design D2-a) — defaults to global
-     * `fetch` in `bootstrap.ts`; tests inject a mock so no real token endpoint is
-     * hit. Mirrors how `login.ts` injects its exchange fetch.
+     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
+     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
+     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
+     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
+     * injects its exchange fetch.
      */
-    readonly oauthExchangeFetch: FetchLike;
+    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
     /**
      * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
      * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
@@ -2062,6 +2122,8 @@ interface AdminServerDeps extends AdminApiDeps {
      * unauthenticated, NEVER on `/health`.
      */
     auditReader?: AuditQueryReader;
+    /** Metadata-only audit aggregate used by the overview error-rate metric. */
+    auditStatsReader?: AuditStatsReader;
     /**
      * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
      * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
@@ -2106,7 +2168,16 @@ declare class AdminServer {
 
 declare class JsonOutboundKeyDb implements OutboundKeyDb {
     private readonly keysPath;
-    constructor(keysPath: string);
+    private readonly secretBox?;
+    /**
+     * @param secretBox OPTIONAL reversible-secret codec. When present, a created
+     * key's plaintext is persisted as a `keySecret` `enc:` envelope (enabling the
+     * operator "view key" affordance via `outboundApiKeysReveal`). When absent the
+     * store stays hash-only (byte-identical to the legacy behavior) and reveal
+     * always returns `null`. Existing 1-arg call sites (tests, lightweight
+     * embedders) keep working.
+     */
+    constructor(keysPath: string, secretBox?: SecretBox | undefined);
     outboundApiKeysList(): Promise<OutboundKeyDbRow[]>;
     outboundApiKeysGetByHash(hash: string): Promise<OutboundKeyDbRow | null>;
     outboundApiKeysCreate(input: {
@@ -2118,7 +2189,10 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb {
         kind?: 'client' | 'integration';
         allowedEndpoints?: _omnicross_core.OutboundEndpoint[];
         loopbackOnly?: boolean;
+        plaintext?: string;
     }): Promise<OutboundKeyDbRow>;
+    outboundApiKeysReveal(id: string): Promise<string | null>;
+    outboundApiKeysDelete(id: string): Promise<boolean>;
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
@@ -2642,6 +2716,7 @@ interface Daemon {
     readonly keyDb: JsonOutboundKeyDb;
     readonly settingsStore: JsonApiServerSettingsStore;
     readonly providerProxy: ProviderProxy;
+    readonly routeLeaseManager: RouteLeaseManager;
     readonly outboundApiServer: OutboundApiServer;
     /**
      * Multi-key load balancer. Wired into the proxy deps slot