@omnicross/daemon 0.1.8 → 0.1.10

package/dist/cli.cjs

@@ -23,87 +23,634 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/commands/import-ccr.ts
-var import_node_fs3 = require("fs");
+// src/commands/audit.ts
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
 var import_node_util = require("util");
 
-// src/ccr-import.ts
-function parseCcrConfig(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("CCR config: top-level value must be an object");
+// src/audit/auditBodyReader.ts
+var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
+var import_node_zlib = require("zlib");
+
+// src/audit/auditBodyStore.ts
+var ANCHOR_EVERY = 64;
+var ANCHOR_DELTA_RATIO = 0.75;
+var DIVERGED_PREFIX_RATIO = 0.25;
+var MAX_BASE_CHARS = 4e6;
+var CACHE_BUDGET_CHARS = 16e6;
+var CACHE_MAX_SESSIONS = 32;
+var MAX_BASES_PER_SESSION = 4;
+var isHighSurrogate = (code) => code >= 55296 && code <= 56319;
+var isLowSurrogate = (code) => code >= 56320 && code <= 57343;
+function computeBodyDelta(prev, next) {
+  const shortest = Math.min(prev.length, next.length);
+  let pre = 0;
+  while (pre < shortest && prev.charCodeAt(pre) === next.charCodeAt(pre)) pre += 1;
+  if (pre > 0 && isHighSurrogate(prev.charCodeAt(pre - 1))) pre -= 1;
+  const maxSuf = shortest - pre;
+  let suf = 0;
+  while (suf < maxSuf && prev.charCodeAt(prev.length - 1 - suf) === next.charCodeAt(next.length - 1 - suf)) {
+    suf += 1;
+  }
+  if (suf > 0 && isLowSurrogate(prev.charCodeAt(prev.length - suf))) suf -= 1;
+  return { pre, suf, ins: next.slice(pre, next.length - suf) };
+}
+function applyBodyDelta(prev, delta) {
+  const head = delta.pre > 0 ? prev.slice(0, delta.pre) : "";
+  const tail = delta.suf > 0 ? prev.slice(prev.length - delta.suf) : "";
+  return head + delta.ins + tail;
+}
+var SessionBaseCache = class {
+  constructor(maxSessions = CACHE_MAX_SESSIONS, budgetChars = CACHE_BUDGET_CHARS, maxBaseChars = MAX_BASE_CHARS, maxHeads = MAX_BASES_PER_SESSION) {
+    this.maxSessions = maxSessions;
+    this.budgetChars = budgetChars;
+    this.maxBaseChars = maxBaseChars;
+    this.maxHeads = maxHeads;
+  }
+  maxSessions;
+  budgetChars;
+  maxBaseChars;
+  maxHeads;
+  /** Session key to its retained heads, most-recent first. */
+  entries = /* @__PURE__ */ new Map();
+  chars = 0;
+  /** Retained sessions (tests + diagnostics). */
+  get size() {
+    return this.entries.size;
+  }
+  /** A session's retained heads, most-recent first. Refreshes LRU recency. */
+  get(sessionKey) {
+    const found = this.entries.get(sessionKey);
+    if (!found) return [];
+    this.entries.delete(sessionKey);
+    this.entries.set(sessionKey, found);
+    return found;
   }
-  const obj = raw;
-  const Providers = Array.isArray(obj["Providers"]) ? obj["Providers"] : [];
-  const Router = obj["Router"] && typeof obj["Router"] === "object" ? obj["Router"] : {};
-  return { Providers, Router };
+  /**
+   * Retain `base` as a head of `sessionKey`.
+   *
+   * `replacesId` is the head this turn CONTINUES (its body was preserved whole
+   * inside the new one), which is swapped out so a linear conversation keeps
+   * exactly one head. Omit it when the turn started a distinct stream %s that
+   * head is added alongside, which is what keeps a fork's branches apart.
+   *
+   * A body larger than `maxBaseChars` is not retained: the next turn anchors
+   * rather than letting one oversized session monopolize the budget.
+   */
+  remember(sessionKey, base, replacesId) {
+    const heads = this.entries.get(sessionKey) ?? [];
+    if (replacesId !== void 0) {
+      const at = heads.findIndex((head) => head.lastId === replacesId);
+      if (at >= 0) {
+        this.chars -= heads[at].text.length;
+        heads.splice(at, 1);
+      }
+    }
+    if (base.text.length <= this.maxBaseChars) {
+      heads.unshift(base);
+      this.chars += base.text.length;
+    }
+    while (heads.length > this.maxHeads) {
+      const dropped = heads.pop();
+      if (dropped) this.chars -= dropped.text.length;
+    }
+    this.entries.delete(sessionKey);
+    if (heads.length > 0) this.entries.set(sessionKey, heads);
+    this.evict();
+  }
+  /** Drop a session's heads (eviction, or a write failure invalidating them). */
+  forget(sessionKey) {
+    const heads = this.entries.get(sessionKey);
+    if (!heads) return;
+    for (const head of heads) this.chars -= head.text.length;
+    this.entries.delete(sessionKey);
+  }
+  /** Drop everything (writer disposal / test teardown). */
+  clear() {
+    this.entries.clear();
+    this.chars = 0;
+  }
+  /** Evict least-recently-used sessions until both bounds hold. */
+  evict() {
+    while (this.entries.size > this.maxSessions || this.chars > this.budgetChars && this.entries.size > 1) {
+      const oldest = this.entries.keys().next();
+      if (oldest.done) break;
+      this.forget(oldest.value);
+    }
+  }
+};
+function anchorReason(base, dayDir, delta, nextLength) {
+  if (!base || !delta) return "new";
+  if (base.dayDir !== dayDir) return "day";
+  if (base.chainLen >= ANCHOR_EVERY) return "chain";
+  if (delta.pre < base.text.length * DIVERGED_PREFIX_RATIO) return "diverged";
+  if (delta.ins.length > nextLength * ANCHOR_DELTA_RATIO) return "costly";
+  return null;
 }
-function inferApiFormat(provider) {
-  const hay = `${provider.api_base_url ?? ""} ${provider.name ?? ""}`.toLowerCase();
-  if (hay.includes("anthropic") || hay.includes("claude")) {
-    return { format: "anthropic", ambiguous: false };
+function pickBase(heads, next) {
+  let best = null;
+  for (const base of heads) {
+    const delta = computeBodyDelta(base.text, next);
+    if (best !== null && delta.ins.length >= best.delta.ins.length) continue;
+    best = { base, delta, continues: delta.pre + delta.suf >= base.text.length };
+  }
+  return best;
+}
+function encodeBodyEntry(record, sessionKey, dayDir, cache) {
+  const requestBody = record.requestBody;
+  const responseBody = record.responseBody;
+  if (requestBody === void 0 && responseBody === void 0) return null;
+  const entry = { id: record.id, ts: record.ts };
+  if (requestBody !== void 0) {
+    const heads = cache.get(sessionKey);
+    const sameDay = heads.filter((head) => head.dayDir === dayDir);
+    const chosen = pickBase(sameDay, requestBody);
+    const reason = heads.length > 0 && sameDay.length === 0 ? "day" : anchorReason(chosen?.base, dayDir, chosen?.delta ?? null, requestBody.length);
+    if (reason !== null) {
+      entry.req = { base: null, anchor: reason, pre: 0, suf: 0, ins: requestBody };
+      cache.remember(
+        sessionKey,
+        { dayDir, lastId: record.id, text: requestBody, chainLen: 0 },
+        chosen?.continues === true ? chosen.base.lastId : void 0
+      );
+    } else {
+      const picked = chosen;
+      entry.req = {
+        base: picked.base.lastId,
+        ...picked.continues ? { cont: true } : {},
+        pre: picked.delta.pre,
+        suf: picked.delta.suf,
+        ins: picked.delta.ins
+      };
+      cache.remember(
+        sessionKey,
+        { dayDir, lastId: record.id, text: requestBody, chainLen: picked.base.chainLen + 1 },
+        picked.continues ? picked.base.lastId : void 0
+      );
+    }
   }
-  if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
-    return { format: "gemini", ambiguous: false };
+  if (responseBody !== void 0) entry.res = responseBody;
+  return JSON.stringify(entry);
+}
+function isAuditBodyEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  if (typeof entry["id"] !== "string" || typeof entry["ts"] !== "number") return false;
+  if (entry["res"] !== void 0 && typeof entry["res"] !== "string") return false;
+  const req = entry["req"];
+  if (req === void 0) return true;
+  if (!req || typeof req !== "object" || Array.isArray(req)) return false;
+  const delta = req;
+  if (delta["anchor"] !== void 0 && typeof delta["anchor"] !== "string") return false;
+  if (delta["cont"] !== void 0 && typeof delta["cont"] !== "boolean") return false;
+  return (delta["base"] === null || typeof delta["base"] === "string") && Number.isSafeInteger(delta["pre"]) && delta["pre"] >= 0 && Number.isSafeInteger(delta["suf"]) && delta["suf"] >= 0 && typeof delta["ins"] === "string";
+}
+
+// src/audit/auditDictionary.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+
+// src/audit/auditFiles.ts
+var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var AUDIT_DAY_DIR_RE = /^audit-(\d{4})-(\d{2})-(\d{2})$/;
+var AUDIT_META_FILE = "meta.jsonl";
+var AUDIT_BODIES_DIR = "bodies";
+var AUDIT_SESSION_KEY_RE = /^[0-9a-f]{8,64}$/;
+var pad2 = (n) => String(n).padStart(2, "0");
+var localDateStamp = (ts) => {
+  const d = new Date(ts);
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}`;
+};
+function auditDayDirName(ts) {
+  return `audit-${localDateStamp(ts)}`;
+}
+function isAuditDayDir(name) {
+  return AUDIT_DAY_DIR_RE.test(name);
+}
+function isSafeSessionKey(key) {
+  return typeof key === "string" && AUDIT_SESSION_KEY_RE.test(key);
+}
+function auditBodyFileName(sessionKey) {
+  return `${sessionKey}.jsonl`;
+}
+function auditFileDateMs(name) {
+  const m = AUDIT_FILE_RE.exec(name) ?? AUDIT_DAY_DIR_RE.exec(name);
+  if (!m) return null;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const d = new Date(year, month - 1, day);
+  if (d.getFullYear() !== year || d.getMonth() !== month - 1 || d.getDate() !== day) {
+    return null;
   }
-  if (hay.includes("/responses")) {
-    return { format: "openai-response", ambiguous: false };
+  return d.getTime();
+}
+
+// src/audit/auditDictionary.ts
+var AUDIT_DICT_FILE = "_dict.jsonl";
+var DICT_BASE_PREFIX = "dict:";
+var DICT_CANDIDATES = 3;
+var MIN_SAVING_RATIO = 0.2;
+function parseEntries(raw) {
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (isAuditBodyEntry(parsed)) entries.push(parsed);
+    } catch {
+    }
   }
-  if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
-    return { format: "openai", ambiguous: false };
+  return entries;
+}
+function plainShards(bodiesPath) {
+  try {
+    return (0, import_node_fs.readdirSync)(bodiesPath).filter(
+      (file) => file.endsWith(".jsonl") && isSafeSessionKey(file.slice(0, -".jsonl".length))
+    );
+  } catch {
+    return [];
   }
-  return { format: "openai", ambiguous: true };
 }
-function mapProviders(providers, notes) {
-  const rows = [];
-  for (const [i, p] of providers.entries()) {
-    const id = p.name?.trim();
-    if (!id) {
-      notes.push(`Providers[${i}] has no name \u2014 skipped.`);
+function chooseDictionary(anchors) {
+  if (anchors.length < 2) return null;
+  const total = anchors.reduce((sum, body) => sum + body.length, 0);
+  const candidates = [...anchors].sort((a, b) => b.length - a.length).slice(0, DICT_CANDIDATES);
+  let best = null;
+  for (const candidate of candidates) {
+    let cost = candidate.length;
+    for (const body of anchors) {
+      cost += body === candidate ? 0 : computeBodyDelta(candidate, body).ins.length;
+    }
+    if (best === null || cost < best.cost) best = { body: candidate, cost };
+  }
+  if (best === null) return null;
+  return total - best.cost >= total * MIN_SAVING_RATIO ? best.body : null;
+}
+var EMPTY = { shards: 0, anchors: 0, savedBytes: 0 };
+function compactAuditDay(dayPath) {
+  const bodiesPath = (0, import_node_path.join)(dayPath, AUDIT_BODIES_DIR);
+  if (!(0, import_node_fs.existsSync)(bodiesPath)) return EMPTY;
+  const dictPath = (0, import_node_path.join)(bodiesPath, AUDIT_DICT_FILE);
+  if ((0, import_node_fs.existsSync)(dictPath) || (0, import_node_fs.existsSync)(`${dictPath}.gz`)) return EMPTY;
+  const shardFiles = plainShards(bodiesPath);
+  if (shardFiles.length < 2) return EMPTY;
+  const loaded = /* @__PURE__ */ new Map();
+  const anchors = [];
+  for (const file of shardFiles) {
+    let entries;
+    try {
+      entries = parseEntries((0, import_node_fs.readFileSync)((0, import_node_path.join)(bodiesPath, file), "utf8"));
+    } catch {
       continue;
     }
-    const { format, ambiguous } = inferApiFormat(p);
-    if (ambiguous) {
-      notes.push(
-        `Provider '${id}': could not infer apiFormat from base URL \u2014 defaulted to 'openai'. Edit the config if this provider speaks a different wire format.`
-      );
+    loaded.set(file, entries);
+    for (const entry of entries) {
+      if (entry.req && entry.req.base === null) anchors.push(entry.req.ins);
     }
-    rows.push({
-      id,
-      apiFormat: format,
-      baseUrl: p.api_base_url ?? "",
-      apiKey: p.api_key ?? "",
-      models: Array.isArray(p.models) ? p.models : void 0
+  }
+  if (anchors.length < 2) return EMPTY;
+  const dictionary = chooseDictionary(anchors);
+  if (dictionary === null) return EMPTY;
+  const dictEntry = {
+    id: `${DICT_BASE_PREFIX}0`,
+    ts: 0,
+    req: { base: null, anchor: "dict", pre: 0, suf: 0, ins: dictionary }
+  };
+  (0, import_node_fs.writeFileSync)(dictPath, JSON.stringify(dictEntry) + "\n", "utf8");
+  const result = { shards: 0, anchors: 0, savedBytes: 0 };
+  for (const [file, entries] of loaded) {
+    let changed = false;
+    let saved = 0;
+    const rewritten = entries.map((entry) => {
+      if (!entry.req || entry.req.base !== null || entry.req.ins === dictionary) return entry;
+      const delta = computeBodyDelta(dictionary, entry.req.ins);
+      if (delta.ins.length >= entry.req.ins.length) return entry;
+      changed = true;
+      saved += entry.req.ins.length - delta.ins.length;
+      return {
+        ...entry,
+        req: { base: dictEntry.id, pre: delta.pre, suf: delta.suf, ins: delta.ins }
+      };
     });
+    if (!changed) continue;
+    const target = (0, import_node_path.join)(bodiesPath, file);
+    const temp = `${target}.compacting`;
+    try {
+      (0, import_node_fs.writeFileSync)(temp, rewritten.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf8");
+      (0, import_node_fs.renameSync)(temp, target);
+    } catch {
+      try {
+        if ((0, import_node_fs.existsSync)(temp)) (0, import_node_fs.unlinkSync)(temp);
+      } catch {
+      }
+      continue;
+    }
+    result.shards += 1;
+    result.anchors += rewritten.filter((e) => e.req?.base === dictEntry.id).length;
+    result.savedBytes += saved;
   }
-  return rows;
+  if (result.shards === 0) {
+    try {
+      (0, import_node_fs.unlinkSync)(dictPath);
+    } catch {
+    }
+  }
+  return result;
 }
-function noteRouterRoles(router, notes) {
-  if (router.think) {
-    notes.push(`Router.think \u2192 folded into 'default' (omnicross has no think slot).`);
+function compactAllClosedAuditDays(auditDir, now = Date.now) {
+  const run = { days: 0, shards: 0, savedBytes: 0 };
+  if (!(0, import_node_fs.existsSync)(auditDir)) return run;
+  const today = auditDayDirName(now());
+  let names;
+  try {
+    names = (0, import_node_fs.readdirSync)(auditDir).filter(isAuditDayDir).sort();
+  } catch {
+    return run;
   }
-  if (router.longContext) {
-    notes.push(
-      `Router.longContext \u2192 folded into 'default' (no longContext slot; longContextThreshold dropped).`
-    );
+  for (const name of names) {
+    if (name === today) continue;
+    try {
+      const result = compactAuditDay((0, import_node_path.join)(auditDir, name));
+      if (result.shards === 0) continue;
+      run.days += 1;
+      run.shards += result.shards;
+      run.savedBytes += result.savedBytes;
+    } catch {
+    }
   }
-  if (router.image) {
-    notes.push(`Router.image \u2192 mapped to 'vision' (CCR forceUseImageAgent dropped).`);
+  return run;
+}
+
+// src/audit/auditJsonl.ts
+var import_node_fs2 = require("fs");
+var WINDOW_BYTES = 1 << 20;
+var MAX_LINE_BYTES = 32 * 1024 * 1024;
+var NEWLINE = 10;
+function forEachLineFromTail(path2, onLine) {
+  let fd;
+  let end;
+  try {
+    end = (0, import_node_fs2.statSync)(path2).size;
+    if (end === 0) return;
+    fd = (0, import_node_fs2.openSync)(path2, "r");
+  } catch {
+    return;
   }
-  if (router.webSearch) {
-    notes.push(
-      `Router.webSearch \u2192 DROPPED. omnicross injects web search via an interception port rather than routing to a natively-online model; the CCR webSearch model ('${router.webSearch}') was not carried over.`
-    );
+  try {
+    let carry = Buffer.alloc(0);
+    while (end > 0) {
+      const start = Math.max(0, end - WINDOW_BYTES);
+      const window = Buffer.allocUnsafe(end - start);
+      let read;
+      try {
+        read = (0, import_node_fs2.readSync)(fd, window, 0, end - start, start);
+      } catch {
+        return;
+      }
+      const chunk = carry.length > 0 ? Buffer.concat([window.subarray(0, read), carry]) : window.subarray(0, read);
+      let lineEnd = chunk.length;
+      let nl = lineEnd > 0 ? chunk.lastIndexOf(NEWLINE, lineEnd - 1) : -1;
+      while (nl >= 0) {
+        if (nl + 1 < lineEnd) {
+          const line = chunk.subarray(nl + 1, lineEnd).toString("utf8").trim();
+          if (line && onLine(line)) return;
+        }
+        lineEnd = nl;
+        nl = lineEnd > 0 ? chunk.lastIndexOf(NEWLINE, lineEnd - 1) : -1;
+      }
+      if (start === 0) {
+        if (lineEnd > 0) {
+          const line = chunk.subarray(0, lineEnd).toString("utf8").trim();
+          if (line) onLine(line);
+        }
+        return;
+      }
+      if (lineEnd > MAX_LINE_BYTES) return;
+      carry = Buffer.from(chunk.subarray(0, lineEnd));
+      end = start;
+    }
+  } finally {
+    try {
+      (0, import_node_fs2.closeSync)(fd);
+    } catch {
+    }
   }
 }
-function mapCcrToOmnicross(ccr) {
-  const notes = [];
-  const providers = mapProviders(ccr.Providers ?? [], notes);
-  noteRouterRoles(ccr.Router ?? {}, notes);
-  return { config: { providers }, notes };
+
+// src/audit/auditBodyReader.ts
+function candidateDays(auditDir, ts) {
+  if (typeof ts === "number" && Number.isFinite(ts)) {
+    const named = auditDayDirName(ts);
+    if ((0, import_node_fs3.existsSync)((0, import_node_path2.join)(auditDir, named))) return [named];
+  }
+  try {
+    return (0, import_node_fs3.readdirSync)(auditDir).filter(isAuditDayDir).sort().reverse();
+  } catch {
+    return [];
+  }
+}
+function readShard(auditDir, day, sessionKey) {
+  const base = (0, import_node_path2.join)(auditDir, day, AUDIT_BODIES_DIR, auditBodyFileName(sessionKey));
+  try {
+    if ((0, import_node_fs3.existsSync)(base)) return (0, import_node_fs3.readFileSync)(base, "utf8");
+    const gz = `${base}.gz`;
+    if ((0, import_node_fs3.existsSync)(gz)) return (0, import_node_zlib.gunzipSync)((0, import_node_fs3.readFileSync)(gz)).toString("utf8");
+  } catch {
+    return null;
+  }
+  return null;
+}
+function parseShard(raw) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (isAuditBodyEntry(parsed)) entries.set(parsed.id, parsed);
+  }
+  return entries;
+}
+function withDictionary(auditDir, day, entries) {
+  let needed = false;
+  for (const entry of entries.values()) {
+    if (entry.req?.base?.startsWith(DICT_BASE_PREFIX)) {
+      needed = true;
+      break;
+    }
+  }
+  if (!needed) return entries;
+  const base = (0, import_node_path2.join)(auditDir, day, AUDIT_BODIES_DIR, AUDIT_DICT_FILE);
+  let raw = null;
+  try {
+    if ((0, import_node_fs3.existsSync)(base)) raw = (0, import_node_fs3.readFileSync)(base, "utf8");
+    else if ((0, import_node_fs3.existsSync)(`${base}.gz`)) raw = (0, import_node_zlib.gunzipSync)((0, import_node_fs3.readFileSync)(`${base}.gz`)).toString("utf8");
+  } catch {
+    return entries;
+  }
+  if (raw === null) return entries;
+  for (const [id, entry] of parseShard(raw)) entries.set(id, entry);
+  return entries;
+}
+function reconstructRequest(entries, entry) {
+  if (!entry.req) return void 0;
+  const chain = [];
+  const visited = /* @__PURE__ */ new Set();
+  let cursor = entry;
+  while (cursor?.req) {
+    if (visited.has(cursor.id)) return void 0;
+    visited.add(cursor.id);
+    chain.push(cursor);
+    if (cursor.req.base === null) break;
+    cursor = entries.get(cursor.req.base);
+  }
+  const anchor = chain[chain.length - 1];
+  if (!anchor?.req || anchor.req.base !== null) return void 0;
+  let text = anchor.req.ins;
+  for (let i = chain.length - 2; i >= 0; i -= 1) {
+    const delta = chain[i]?.req;
+    if (!delta) return void 0;
+    if (delta.pre > text.length || delta.suf > text.length - delta.pre) return void 0;
+    text = applyBodyDelta(text, delta);
+  }
+  return text;
+}
+function assignStreams(entries) {
+  const rootOf = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    const seen = /* @__PURE__ */ new Set();
+    let cursor = entry;
+    while (cursor?.req?.cont === true && cursor.req.base !== null && !seen.has(cursor.id)) {
+      seen.add(cursor.id);
+      const next = entries.get(cursor.req.base);
+      if (!next) break;
+      cursor = next;
+    }
+    rootOf.set(entry.id, cursor?.id ?? entry.id);
+  }
+  const firstTs = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    const root = rootOf.get(entry.id);
+    const known = firstTs.get(root);
+    if (known === void 0 || entry.ts < known) firstTs.set(root, entry.ts);
+  }
+  const order = [...firstTs.entries()].sort((a, b) => a[1] - b[1]).map(([root]) => root);
+  const index = new Map(order.map((root, i) => [root, i]));
+  const streams = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    streams.set(entry.id, index.get(rootOf.get(entry.id)) ?? 0);
+  }
+  return streams;
+}
+function readAuditBody(auditDir, query2) {
+  if (!isSafeSessionKey(query2.sessionKey) || !query2.id) return {};
+  if (!(0, import_node_fs3.existsSync)(auditDir)) return {};
+  for (const day of candidateDays(auditDir, query2.ts)) {
+    const raw = readShard(auditDir, day, query2.sessionKey);
+    if (raw === null) continue;
+    const entries = withDictionary(auditDir, day, parseShard(raw));
+    const entry = entries.get(query2.id);
+    if (!entry) continue;
+    const result = {};
+    const requestBody = reconstructRequest(entries, entry);
+    if (requestBody !== void 0) result.requestBody = requestBody;
+    if (entry.res !== void 0) result.responseBody = entry.res;
+    return result;
+  }
+  return readLegacyInlineBody(auditDir, query2.id);
+}
+function readLegacyInlineBody(auditDir, id) {
+  let names;
+  try {
+    names = (0, import_node_fs3.readdirSync)(auditDir).filter((name) => AUDIT_FILE_RE.test(name)).sort().reverse();
+  } catch {
+    return {};
+  }
+  const needle = JSON.stringify(id);
+  let found = {};
+  for (const name of names) {
+    forEachLineFromTail((0, import_node_path2.join)(auditDir, name), (line) => {
+      if (!line.includes(needle)) return false;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        return false;
+      }
+      const record = parsed;
+      if (record.id !== id) return false;
+      const result = {};
+      if (typeof record.requestBody === "string") result.requestBody = record.requestBody;
+      if (typeof record.responseBody === "string") result.responseBody = record.responseBody;
+      found = result;
+      return true;
+    });
+    if (found.requestBody !== void 0 || found.responseBody !== void 0) break;
+  }
+  return found;
+}
+function readAuditSessionTurns(auditDir, sessionKey, ts) {
+  if (!isSafeSessionKey(sessionKey) || !(0, import_node_fs3.existsSync)(auditDir)) return [];
+  for (const day of candidateDays(auditDir, ts)) {
+    const raw = readShard(auditDir, day, sessionKey);
+    if (raw === null) continue;
+    const shardEntries = parseShard(raw);
+    const streams = assignStreams(shardEntries);
+    const entries = withDictionary(auditDir, day, shardEntries);
+    const turns = [];
+    for (const entry of entries.values()) {
+      if (entry.id.startsWith(DICT_BASE_PREFIX)) continue;
+      const turn = { id: entry.id, ts: entry.ts, stream: streams.get(entry.id) ?? 0 };
+      if (entry.req?.anchor === "diverged") turn.diverged = true;
+      const requestBody = reconstructRequest(entries, entry);
+      if (requestBody !== void 0) turn.requestBody = requestBody;
+      if (entry.res !== void 0) turn.responseBody = entry.res;
+      turns.push(turn);
+    }
+    turns.sort((a, b) => a.stream === b.stream ? a.ts - b.ts : a.stream - b.stream);
+    return turns;
+  }
+  return [];
+}
+function listAuditSessions(auditDir, ts) {
+  if (!(0, import_node_fs3.existsSync)(auditDir)) return [];
+  const summaries = [];
+  for (const day of candidateDays(auditDir, ts)) {
+    const bodiesPath = (0, import_node_path2.join)(auditDir, day, AUDIT_BODIES_DIR);
+    let files;
+    try {
+      files = (0, import_node_fs3.readdirSync)(bodiesPath);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const compressed = file.endsWith(".jsonl.gz");
+      const sessionKey = file.replace(/\.jsonl(\.gz)?$/, "");
+      if (!isSafeSessionKey(sessionKey) || !compressed && !file.endsWith(".jsonl")) continue;
+      let bytes = 0;
+      try {
+        bytes = (0, import_node_fs3.statSync)((0, import_node_path2.join)(bodiesPath, file)).size;
+      } catch {
+        continue;
+      }
+      const raw = readShard(auditDir, day, sessionKey);
+      const turns = raw === null ? 0 : parseShard(raw).size;
+      summaries.push({ sessionKey, day, turns, bytes, compressed });
+    }
+  }
+  summaries.sort((a, b) => a.day === b.day ? b.bytes - a.bytes : a.day < b.day ? 1 : -1);
+  return summaries;
 }
 
-// src/config.ts
-var import_node_fs2 = require("fs");
+// src/commands/paths.ts
+var import_node_path4 = require("path");
 
 // src/secrets/envelope.ts
 var import_node_crypto = require("crypto");
@@ -162,13 +709,13 @@ function decryptValue(envelope, key) {
 
 // src/secrets/masterKey.ts
 var import_node_crypto2 = require("crypto");
-var import_node_fs = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_os = require("os");
-var import_node_path = require("path");
+var import_node_path3 = require("path");
 var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
 var KEY_BYTES2 = 32;
 function defaultMasterKeyPath() {
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".omnicross", "master.key");
+  return (0, import_node_path3.join)((0, import_node_os.homedir)(), ".omnicross", "master.key");
 }
 function decodeEnvKey(raw) {
   const trimmed = raw.trim();
@@ -184,7 +731,7 @@ function decodeEnvKey(raw) {
   return buf;
 }
 function readKeyFile(path2) {
-  const raw = (0, import_node_fs.readFileSync)(path2);
+  const raw = (0, import_node_fs4.readFileSync)(path2);
   if (raw.length === KEY_BYTES2) return raw;
   const text = raw.toString("utf8").trim();
   if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
@@ -196,10 +743,10 @@ function readKeyFile(path2) {
 }
 function generateKeyFile(path2) {
   const key = (0, import_node_crypto2.randomBytes)(KEY_BYTES2);
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path2), { recursive: true });
-  (0, import_node_fs.writeFileSync)(path2, key, { mode: 384 });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(path2, key, { mode: 384 });
   try {
-    (0, import_node_fs.chmodSync)(path2, 384);
+    (0, import_node_fs4.chmodSync)(path2, 384);
   } catch {
   }
   return key;
@@ -210,7 +757,7 @@ function resolveMasterKey(options = {}) {
     return decodeEnvKey(envRaw);
   }
   const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
-  if ((0, import_node_fs.existsSync)(keyFilePath)) {
+  if ((0, import_node_fs4.existsSync)(keyFilePath)) {
     return readKeyFile(keyFilePath);
   }
   return generateKeyFile(keyFilePath);
@@ -458,7 +1005,234 @@ function decryptTokens(tokens, box) {
   return transformTokens(tokens, (v) => box.decryptMaybe(v));
 }
 
+// src/commands/paths.ts
+function defaultKeysPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "keys.json");
+}
+function defaultVouchersPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "vouchers.json");
+}
+function defaultTokensPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "tokens.json");
+}
+function defaultIntegrationsPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "integrations.json");
+}
+function defaultPricingPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "pricing.json");
+}
+function defaultPricingRefreshStatePath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "pricing-refresh.json");
+}
+function defaultAccountAllowancePath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "allowance-cache.json");
+}
+function defaultUsageEventsPath(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "usage-events.jsonl");
+}
+function defaultAuditDir(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "audit");
+}
+function defaultBillingDir(configPath) {
+  return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "billing");
+}
+function resolveSecretBox(masterKeyFilePath) {
+  return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
+}
+
+// src/commands/audit.ts
+function parseDate(value) {
+  if (!value) return void 0;
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value.trim());
+  if (!m) throw new Error(`audit: --date must be YYYY-MM-DD (got ${value})`);
+  const d = new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+  return d.getTime();
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function runAudit(argv) {
+  const { values, positionals } = (0, import_node_util.parseArgs)({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      session: { type: "string", short: "s" },
+      date: { type: "string", short: "d" },
+      id: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const configPath = values.config;
+  if (!configPath) throw new Error("audit: --config <path> is required");
+  const auditDir = defaultAuditDir(configPath);
+  const ts = parseDate(values.date);
+  const action = positionals[0];
+  if (action === "sessions") {
+    const sessions2 = listAuditSessions(auditDir, ts);
+    if (sessions2.length === 0) {
+      console.info("No audit body shards found. Is `captureBodies` enabled?");
+      return;
+    }
+    console.info(["DAY", "SESSION", "TURNS", "SIZE", "ARCHIVED"].join("	"));
+    for (const s of sessions2) {
+      console.info(
+        [s.day, s.sessionKey, String(s.turns), formatBytes(s.bytes), s.compressed ? "gz" : "-"].join("	")
+      );
+    }
+    return;
+  }
+  if (action === "show") {
+    const sessionKey = values.session;
+    if (!sessionKey) throw new Error("audit show: --session <key> is required");
+    if (values.id) {
+      const body = readAuditBody(auditDir, { id: values.id, sessionKey, ...ts !== void 0 ? { ts } : {} });
+      if (body.requestBody === void 0 && body.responseBody === void 0) {
+        throw new Error(`audit show: no body found for record ${values.id}`);
+      }
+      if (body.requestBody !== void 0) console.info(`--- request ${values.id} ---
+${body.requestBody}`);
+      if (body.responseBody !== void 0) console.info(`--- response ${values.id} ---
+${body.responseBody}`);
+      return;
+    }
+    const turns = readAuditSessionTurns(auditDir, sessionKey, ts);
+    if (turns.length === 0) throw new Error(`audit show: no shard found for session ${sessionKey}`);
+    let stream = -1;
+    for (const turn of turns) {
+      const when = new Date(turn.ts).toISOString();
+      if (turn.stream !== stream) {
+        stream = turn.stream;
+        console.info(`
+########## stream ${stream} ##########`);
+      }
+      if (turn.diverged) {
+        console.info("=== prefix diverged here (system prompt changed, or a restart reused this session) ===");
+      }
+      if (turn.requestBody !== void 0) {
+        console.info(`--- request ${turn.id} @ ${when} ---
+${turn.requestBody}`);
+      }
+      if (turn.responseBody !== void 0) {
+        console.info(`--- response ${turn.id} @ ${when} ---
+${turn.responseBody}`);
+      }
+    }
+    return;
+  }
+  if (action === "compact") {
+    const todayDir = auditDayDirName(Date.now());
+    let names;
+    try {
+      names = (0, import_node_fs5.readdirSync)(auditDir).filter(isAuditDayDir).sort();
+    } catch {
+      names = [];
+    }
+    const targets = ts !== void 0 ? names.filter((name) => name === auditDayDirName(ts)) : names.filter((name) => name !== todayDir);
+    if (targets.length === 0) {
+      console.info("Nothing to compact (today is skipped; a day is compacted once).");
+      return;
+    }
+    let shards = 0;
+    let saved = 0;
+    for (const name of targets) {
+      if (name === todayDir) {
+        console.info(`Skipping ${name}: the current day is still being written.`);
+        continue;
+      }
+      const result = compactAuditDay((0, import_node_path5.join)(auditDir, name));
+      shards += result.shards;
+      saved += result.savedBytes;
+      console.info(`${name}: ${result.shards} shard(s), ${result.anchors} anchor(s), ${formatBytes(result.savedBytes)} saved`);
+    }
+    console.info(`Done: ${shards} shard(s) rewritten, ${formatBytes(saved)} saved.`);
+    return;
+  }
+  throw new Error("audit: expected `sessions`, `show`, or `compact` (see `omnicross help`)");
+}
+
+// src/commands/import-ccr.ts
+var import_node_fs7 = require("fs");
+var import_node_util2 = require("util");
+
+// src/ccr-import.ts
+function parseCcrConfig(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("CCR config: top-level value must be an object");
+  }
+  const obj = raw;
+  const Providers = Array.isArray(obj["Providers"]) ? obj["Providers"] : [];
+  const Router = obj["Router"] && typeof obj["Router"] === "object" ? obj["Router"] : {};
+  return { Providers, Router };
+}
+function inferApiFormat(provider) {
+  const hay = `${provider.api_base_url ?? ""} ${provider.name ?? ""}`.toLowerCase();
+  if (hay.includes("anthropic") || hay.includes("claude")) {
+    return { format: "anthropic", ambiguous: false };
+  }
+  if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
+    return { format: "gemini", ambiguous: false };
+  }
+  if (hay.includes("/responses")) {
+    return { format: "openai-response", ambiguous: false };
+  }
+  if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
+    return { format: "openai", ambiguous: false };
+  }
+  return { format: "openai", ambiguous: true };
+}
+function mapProviders(providers, notes) {
+  const rows = [];
+  for (const [i, p] of providers.entries()) {
+    const id = p.name?.trim();
+    if (!id) {
+      notes.push(`Providers[${i}] has no name \u2014 skipped.`);
+      continue;
+    }
+    const { format, ambiguous } = inferApiFormat(p);
+    if (ambiguous) {
+      notes.push(
+        `Provider '${id}': could not infer apiFormat from base URL \u2014 defaulted to 'openai'. Edit the config if this provider speaks a different wire format.`
+      );
+    }
+    rows.push({
+      id,
+      apiFormat: format,
+      baseUrl: p.api_base_url ?? "",
+      apiKey: p.api_key ?? "",
+      models: Array.isArray(p.models) ? p.models : void 0
+    });
+  }
+  return rows;
+}
+function noteRouterRoles(router, notes) {
+  if (router.think) {
+    notes.push(`Router.think \u2192 folded into 'default' (omnicross has no think slot).`);
+  }
+  if (router.longContext) {
+    notes.push(
+      `Router.longContext \u2192 folded into 'default' (no longContext slot; longContextThreshold dropped).`
+    );
+  }
+  if (router.image) {
+    notes.push(`Router.image \u2192 mapped to 'vision' (CCR forceUseImageAgent dropped).`);
+  }
+  if (router.webSearch) {
+    notes.push(
+      `Router.webSearch \u2192 DROPPED. omnicross injects web search via an interception port rather than routing to a natively-online model; the CCR webSearch model ('${router.webSearch}') was not carried over.`
+    );
+  }
+}
+function mapCcrToOmnicross(ccr) {
+  const notes = [];
+  const providers = mapProviders(ccr.Providers ?? [], notes);
+  noteRouterRoles(ccr.Router ?? {}, notes);
+  return { config: { providers }, notes };
+}
+
 // src/config.ts
+var import_node_fs6 = require("fs");
 var DEFAULT_ADMIN_PORT = 8766;
 function validateAdmin(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -520,6 +1294,35 @@ function validateApiKeys(raw) {
   }
   return out.length > 0 ? out : void 0;
 }
+var THINK_LEVELS = /* @__PURE__ */ new Set([
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+]);
+function validateThinkingLevels(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  if (!raw.every((level) => typeof level === "string" && THINK_LEVELS.has(level))) {
+    return void 0;
+  }
+  return [...raw];
+}
+function validateThinkingTokenLimit(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const bounds = raw;
+  const min = bounds["min"];
+  const max = bounds["max"];
+  if (typeof min !== "number" || !Number.isFinite(min) || !Number.isInteger(min) || min < 0) {
+    return void 0;
+  }
+  if (typeof max !== "number" || !Number.isFinite(max) || !Number.isInteger(max) || max < min) {
+    return void 0;
+  }
+  return { min, max };
+}
 function validateModelConfigs(raw) {
   if (!Array.isArray(raw)) return void 0;
   const out = [];
@@ -534,6 +1337,10 @@ function validateModelConfigs(raw) {
     if (typeof m["enabled"] === "boolean") entry.enabled = m["enabled"];
     if (typeof m["vision"] === "boolean") entry.vision = m["vision"];
     if (typeof m["reasoning"] === "boolean") entry.reasoning = m["reasoning"];
+    const thinkingLevels = validateThinkingLevels(m["thinkingLevels"]);
+    if (thinkingLevels) entry.thinkingLevels = thinkingLevels;
+    const thinkingTokenLimit = validateThinkingTokenLimit(m["thinkingTokenLimit"]);
+    if (thinkingTokenLimit) entry.thinkingTokenLimit = thinkingTokenLimit;
     out.push(entry);
   }
   return out.length > 0 ? out : void 0;
@@ -718,7 +1525,7 @@ function setSecretBox(box) {
 function loadConfig(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs2.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs6.readFileSync)(path2, "utf8");
   } catch {
     throw new Error(`config: cannot read file at '${path2}'`);
   }
@@ -733,48 +1540,12 @@ function loadConfig(path2) {
 }
 function saveConfig(path2, cfg) {
   const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
-  (0, import_node_fs2.writeFileSync)(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
-}
-
-// src/commands/paths.ts
-var import_node_path2 = require("path");
-function defaultKeysPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "keys.json");
-}
-function defaultVouchersPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "vouchers.json");
-}
-function defaultTokensPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "tokens.json");
-}
-function defaultIntegrationsPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "integrations.json");
-}
-function defaultPricingPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "pricing.json");
-}
-function defaultPricingRefreshStatePath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "pricing-refresh.json");
-}
-function defaultAccountAllowancePath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "allowance-cache.json");
-}
-function defaultUsageEventsPath(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "usage-events.jsonl");
-}
-function defaultAuditDir(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "audit");
-}
-function defaultBillingDir(configPath) {
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(configPath), "billing");
-}
-function resolveSecretBox(masterKeyFilePath) {
-  return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
+  (0, import_node_fs6.writeFileSync)(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
 }
 
 // src/commands/import-ccr.ts
 async function runImportCcr(argv) {
-  const { values, positionals } = (0, import_node_util.parseArgs)({
+  const { values, positionals } = (0, import_node_util2.parseArgs)({
     args: argv,
     options: {
       out: { type: "string", short: "o" },
@@ -789,7 +1560,7 @@ async function runImportCcr(argv) {
   const outPath = values.out ?? "omnicross.config.json";
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs3.readFileSync)(ccrPath, "utf8"));
+    raw = JSON.parse((0, import_node_fs7.readFileSync)(ccrPath, "utf8"));
   } catch {
     throw new Error(`import-ccr: cannot read or parse '${ccrPath}'`);
   }
@@ -810,19 +1581,19 @@ async function runImportCcr(argv) {
 }
 
 // src/commands/integrations.ts
-var import_node_path5 = require("path");
-var import_node_util2 = require("util");
+var import_node_path8 = require("path");
+var import_node_util3 = require("util");
 
 // src/integrations/IntegrationManager.ts
 var import_node_crypto3 = require("crypto");
-var import_node_fs5 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path4 = require("path");
+var import_node_path7 = require("path");
 var import_core = require("@omnicross/core");
 
 // src/integrations/IntegrationStateStore.ts
-var import_node_fs4 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path6 = require("path");
 var EMPTY_STATE = { version: 1, clients: {} };
 var IntegrationStateStore = class {
   constructor(path2, box) {
@@ -832,10 +1603,10 @@ var IntegrationStateStore = class {
   path;
   box;
   load() {
-    if (!(0, import_node_fs4.existsSync)(this.path)) return { ...EMPTY_STATE, clients: {} };
+    if (!(0, import_node_fs8.existsSync)(this.path)) return { ...EMPTY_STATE, clients: {} };
     let raw;
     try {
-      raw = JSON.parse((0, import_node_fs4.readFileSync)(this.path, "utf8"));
+      raw = JSON.parse((0, import_node_fs8.readFileSync)(this.path, "utf8"));
     } catch {
       throw new Error(`integration state '${this.path}' is not valid JSON`);
     }
@@ -903,21 +1674,21 @@ function isManagedFileRecord(value) {
   return typeof row.path === "string" && typeof row.originalExisted === "boolean" && typeof row.originalContent === "string" && typeof row.originalHash === "string" && typeof row.installedHash === "string";
 }
 function atomicWrite(path2, content) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
+  (0, import_node_fs8.mkdirSync)((0, import_node_path6.dirname)(path2), { recursive: true });
   const temp = `${path2}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs4.writeFileSync)(temp, content, { encoding: "utf8", mode: 384 });
+  (0, import_node_fs8.writeFileSync)(temp, content, { encoding: "utf8", mode: 384 });
   try {
-    (0, import_node_fs4.renameSync)(temp, path2);
+    (0, import_node_fs8.renameSync)(temp, path2);
   } catch (error) {
     try {
-      (0, import_node_fs4.unlinkSync)(temp);
+      (0, import_node_fs8.unlinkSync)(temp);
     } catch {
     }
     throw error;
   } finally {
-    if ((0, import_node_fs4.existsSync)(path2)) {
+    if ((0, import_node_fs8.existsSync)(path2)) {
       try {
-        (0, import_node_fs4.chmodSync)(path2, 384);
+        (0, import_node_fs8.chmodSync)(path2, 384);
       } catch {
       }
     }
@@ -1109,7 +1880,7 @@ var IntegrationManager = class {
   async plan(client, configPath = this.defaultConfigPath(client)) {
     const state = this.options.stateStore.load();
     const record = state.clients[client];
-    const target = record?.configPath ?? (0, import_node_path4.resolve)(configPath);
+    const target = record?.configPath ?? (0, import_node_path7.resolve)(configPath);
     const status = this.statusFor(client, state, await this.isKeyUsable(state));
     const changes = client === "codex" ? [
       "model_provider",
@@ -1132,7 +1903,7 @@ var IntegrationManager = class {
     };
   }
   async install(client, configPath = this.defaultConfigPath(client)) {
-    const target = (0, import_node_path4.resolve)(configPath);
+    const target = (0, import_node_path7.resolve)(configPath);
     const state = this.options.stateStore.load();
     const existingRecord = state.clients[client];
     if (existingRecord) {
@@ -1409,10 +2180,10 @@ var IntegrationManager = class {
     };
   }
   defaultConfigPath(client) {
-    return client === "codex" ? (0, import_node_path4.join)(this.homeDir, ".codex", "config.toml") : (0, import_node_path4.join)(this.homeDir, ".claude", "settings.json");
+    return client === "codex" ? (0, import_node_path7.join)(this.homeDir, ".codex", "config.toml") : (0, import_node_path7.join)(this.homeDir, ".claude", "settings.json");
   }
   codexAuthPathForConfig(configPath) {
-    return (0, import_node_path4.join)((0, import_node_path4.dirname)(configPath), "auth.json");
+    return (0, import_node_path7.join)((0, import_node_path7.dirname)(configPath), "auth.json");
   }
   renderInstalled(client, base, secret) {
     if (client === "claude") {
@@ -1425,7 +2196,7 @@ var IntegrationManager = class {
   }
 };
 function readOptional(path2) {
-  return (0, import_node_fs5.existsSync)(path2) ? (0, import_node_fs5.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs9.existsSync)(path2) ? (0, import_node_fs9.readFileSync)(path2, "utf8") : null;
 }
 function sha256(value) {
   return (0, import_node_crypto3.createHash)("sha256").update(value, "utf8").digest("hex");
@@ -1489,7 +2260,7 @@ function writeOptional(path2, content) {
     atomicWrite(path2, content);
     return;
   }
-  if ((0, import_node_fs5.existsSync)(path2)) (0, import_node_fs5.unlinkSync)(path2);
+  if ((0, import_node_fs9.existsSync)(path2)) (0, import_node_fs9.unlinkSync)(path2);
 }
 function assertLoopbackGatewayUrl(value) {
   let url;
@@ -1506,7 +2277,7 @@ function assertLoopbackGatewayUrl(value) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-var import_node_fs6 = require("fs");
+var import_node_fs10 = require("fs");
 var JsonOutboundKeyDb = class {
   /**
    * @param secretBox OPTIONAL reversible-secret codec. When present, a created
@@ -1639,16 +2410,16 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs6.existsSync)(this.keysPath)) return [];
+    if (!(0, import_node_fs10.existsSync)(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs6.readFileSync)(this.keysPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs10.readFileSync)(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs6.writeFileSync)(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    (0, import_node_fs10.writeFileSync)(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 function applyPolicyField(row, field, value) {
@@ -1659,7 +2430,7 @@ function applyPolicyField(row, field, value) {
 
 // src/commands/integrations.ts
 async function runIntegrations(argv) {
-  const { values, positionals } = (0, import_node_util2.parseArgs)({
+  const { values, positionals } = (0, import_node_util3.parseArgs)({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -1680,7 +2451,7 @@ async function runIntegrations(argv) {
   const savedUrl = saved.clients.codex?.gatewayBaseUrl ?? saved.clients.claude?.gatewayBaseUrl;
   const gatewayBaseUrl = values["gateway-base-url"] ?? savedUrl ?? "http://127.0.0.1:8765";
   const manager = new IntegrationManager({
-    configPath: (0, import_node_path5.resolve)(values.config),
+    configPath: (0, import_node_path8.resolve)(values.config),
     gatewayBaseUrl,
     keyDb: new JsonOutboundKeyDb(defaultKeysPath(values.config)),
     stateStore: store
@@ -1709,10 +2480,10 @@ function isClient(value) {
 }
 
 // src/commands/keys.ts
-var import_node_util3 = require("util");
+var import_node_util4 = require("util");
 var import_outbound_api = require("@omnicross/core/outbound-api");
 async function runKeys(argv) {
-  const { values, positionals } = (0, import_node_util3.parseArgs)({
+  const { values, positionals } = (0, import_node_util4.parseArgs)({
     args: argv,
     options: { config: { type: "string", short: "c" } },
     allowPositionals: true
@@ -1766,14 +2537,14 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 var import_node_child_process2 = require("child_process");
 var import_node_crypto15 = require("crypto");
-var import_node_fs25 = require("fs");
-var import_node_path17 = require("path");
-var import_node_util4 = require("util");
+var import_node_fs29 = require("fs");
+var import_node_path20 = require("path");
+var import_node_util5 = require("util");
 var import_cli_launcher3 = require("@omnicross/cli-launcher");
 var import_provider_proxy5 = require("@omnicross/core/provider-proxy");
 
 // src/bootstrap.ts
-var import_node_fs24 = require("fs");
+var import_node_fs28 = require("fs");
 var import_audit_types = require("@omnicross/contracts/audit-types");
 var import_billing_types = require("@omnicross/contracts/billing-types");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
@@ -1789,7 +2560,7 @@ var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-c
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
 var import_outbound_api6 = require("@omnicross/core/outbound-api");
-var import_usage = require("@omnicross/core/usage");
+var import_usage2 = require("@omnicross/core/usage");
 var import_subscriptions4 = require("@omnicross/subscriptions");
 
 // src/admin/accountsCodexOAuth.ts
@@ -2282,8 +3053,8 @@ var ClaudeAllowanceRefreshScheduler = class {
 
 // src/allowance/JsonAccountAllowancePersistence.ts
 var import_node_crypto5 = require("crypto");
-var import_node_fs7 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path9 = require("path");
 var import_AccountAllowanceStore3 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var ACCOUNT_ALLOWANCE_CACHE_VERSION = 1;
 var MAX_PERSISTED_ALLOWANCE_SNAPSHOTS = 256;
@@ -2295,10 +3066,10 @@ var JsonAccountAllowancePersistence = class {
   cachePath;
   /** Read only the `snapshots` payload; all row validation remains defensive. */
   load() {
-    if (!(0, import_node_fs7.existsSync)(this.cachePath)) return [];
+    if (!(0, import_node_fs11.existsSync)(this.cachePath)) return [];
     try {
-      if ((0, import_node_fs7.statSync)(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
-      const raw = (0, import_node_fs7.readFileSync)(this.cachePath, "utf8");
+      if ((0, import_node_fs11.statSync)(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
+      const raw = (0, import_node_fs11.readFileSync)(this.cachePath, "utf8");
       if (!raw.trim()) return [];
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed)) return parsed;
@@ -2326,13 +3097,13 @@ var JsonAccountAllowancePersistence = class {
     if (Buffer.byteLength(serialized, "utf8") > MAX_ALLOWANCE_CACHE_BYTES) {
       throw new Error("account allowance cache exceeds its size limit");
     }
-    (0, import_node_fs7.mkdirSync)((0, import_node_path6.dirname)(this.cachePath), { recursive: true });
+    (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(this.cachePath), { recursive: true });
     const temporaryPath = `${this.cachePath}.${process.pid}.${(0, import_node_crypto5.randomUUID)()}.tmp`;
     try {
-      (0, import_node_fs7.writeFileSync)(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
-      (0, import_node_fs7.renameSync)(temporaryPath, this.cachePath);
+      (0, import_node_fs11.writeFileSync)(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
+      (0, import_node_fs11.renameSync)(temporaryPath, this.cachePath);
     } finally {
-      (0, import_node_fs7.rmSync)(temporaryPath, { force: true });
+      (0, import_node_fs11.rmSync)(temporaryPath, { force: true });
     }
   }
 };
@@ -2370,6 +3141,37 @@ function handleAuditQuery(req, res, reader) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ records }));
 }
+function handleAuditBodyQuery(req, res, reader) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const id = url.searchParams.get("id")?.trim();
+  const sessionKey = url.searchParams.get("session")?.trim();
+  if (!id || !sessionKey) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "id and session are required" }));
+    return;
+  }
+  const query2 = { id, sessionKey };
+  const ts = intParam(url.searchParams.get("ts"));
+  if (ts !== void 0) query2.ts = ts;
+  const body = reader ? reader(query2) : {};
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function handleAuditCompact(res, compact) {
+  if (!compact) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ days: 0, shards: 0, savedBytes: 0 }));
+    return;
+  }
+  try {
+    const result = compact();
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(result));
+  } catch (error) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: error instanceof Error ? error.message : "compaction failed" }));
+  }
+}
 async function handleAuditStatsQuery(req, res, reader) {
   const url = new URL(req.url ?? "/", "http://localhost");
   const query2 = {};
@@ -3100,10 +3902,10 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 // src/admin/cliLaunch.ts
 var import_node_child_process = require("child_process");
 var import_node_crypto6 = require("crypto");
-var import_node_fs8 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_net = require("net");
 var import_node_os3 = require("os");
-var import_node_path7 = require("path");
+var import_node_path10 = require("path");
 var import_cli_launcher = require("@omnicross/cli-launcher");
 var import_provider_proxy2 = require("@omnicross/core/provider-proxy");
 
@@ -3150,10 +3952,10 @@ function isLaunchCliId(id) {
   return id !== void 0 && LAUNCHABLE_IDS.has(id);
 }
 function probeDefault(candidate) {
-  const segments = (process.env["PATH"] ?? "").split(import_node_path7.delimiter).filter(Boolean);
+  const segments = (process.env["PATH"] ?? "").split(import_node_path10.delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = (0, import_node_path7.join)(seg, candidate);
-    if ((0, import_node_fs8.existsSync)(full)) return full;
+    const full = (0, import_node_path10.join)(seg, candidate);
+    if ((0, import_node_fs12.existsSync)(full)) return full;
   }
   return null;
 }
@@ -3257,10 +4059,10 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
   const runLine = [command, ...extraArgs].map(shq).join(" ");
   const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const launchDir = (0, import_node_fs8.mkdtempSync)((0, import_node_path7.join)((0, import_node_os3.tmpdir)(), "omnicross-terminal-"));
-    const commandFile = (0, import_node_path7.join)(launchDir, "launch.command");
-    const bootstrapFile = (0, import_node_path7.join)(launchDir, "bootstrap.cjs");
-    const socketPath = macIpc.socketPath ?? (0, import_node_path7.join)(launchDir, "descriptor.sock");
+    const launchDir = (0, import_node_fs12.mkdtempSync)((0, import_node_path10.join)((0, import_node_os3.tmpdir)(), "omnicross-terminal-"));
+    const commandFile = (0, import_node_path10.join)(launchDir, "launch.command");
+    const bootstrapFile = (0, import_node_path10.join)(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? (0, import_node_path10.join)(launchDir, "descriptor.sock");
     const openerEnv = { ...process.env };
     for (const key of Object.keys(env)) delete openerEnv[key];
     let claimed = false;
@@ -3319,7 +4121,7 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
         if (macIpc.removeArtifacts) {
           macIpc.removeArtifacts(launchDir);
         } else {
-          (0, import_node_fs8.rmSync)(launchDir, {
+          (0, import_node_fs12.rmSync)(launchDir, {
             recursive: true,
             force: true,
             maxRetries: 3,
@@ -3330,23 +4132,23 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
       }
     };
     try {
-      (0, import_node_fs8.writeFileSync)(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
-      (0, import_node_fs8.writeFileSync)(commandFile, `#!/bin/bash
+      (0, import_node_fs12.writeFileSync)(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
+      (0, import_node_fs12.writeFileSync)(commandFile, `#!/bin/bash
 rm -f -- "$0"
 exec ${shq(process.execPath)} ${shq(bootstrapFile)} ${shq(socketPath)} ${shq(launchDir)} ${shq(cwd ?? "")} ${runLine}
 `, {
         encoding: "utf8",
         mode: 448
       });
-      (0, import_node_fs8.chmodSync)(commandFile, 448);
-      (0, import_node_fs8.chmodSync)(bootstrapFile, 448);
+      (0, import_node_fs12.chmodSync)(commandFile, 448);
+      (0, import_node_fs12.chmodSync)(bootstrapFile, 448);
       server.once("error", handleLaunchFailure);
       server.listen(socketPath, () => {
         if (cleaned) return;
         try {
           macIpc.onListening?.();
           if (cleaned) return;
-          if (process.platform !== "win32") (0, import_node_fs8.chmodSync)(socketPath, 384);
+          if (process.platform !== "win32") (0, import_node_fs12.chmodSync)(socketPath, 384);
           const opener = spawnProcess("open", ["-n", "-a", "Terminal", commandFile], {
             env: openerEnv,
             detached: true,
@@ -3992,6 +4794,7 @@ function applyAuditConfig(config) {
   } else {
     (0, import_auditSink.setAuditCaptureConfig)(null);
     (0, import_auditSink.setAuditSink)(null);
+    writer?.reset();
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -4578,6 +5381,7 @@ async function handleImport(body, deps) {
 }
 
 // src/admin/usagePricing.ts
+var import_usage = require("@omnicross/core/usage");
 var err4 = (status, message) => ({
   status,
   body: { error: { type: "admin_api_error", message } }
@@ -4603,6 +5407,9 @@ var BUCKET_SPAN_MS = {
 };
 var MAX_TIMESERIES_BUCKETS = 2e3;
 async function handleUsageGet(view, query2, deps) {
+  if (view === "throughput") {
+    return { status: 200, body: (0, import_usage.getSharedUsageThroughputTracker)().snapshot() };
+  }
   const range = parseRange(query2);
   if (!isRange(range)) return range;
   switch (view) {
@@ -5405,6 +6212,12 @@ function parseModelConfigsInput(raw, existing) {
     else if (typeof prior?.vision === "boolean") entry.vision = prior.vision;
     if (typeof m["reasoning"] === "boolean") entry.reasoning = m["reasoning"];
     else if (typeof prior?.reasoning === "boolean") entry.reasoning = prior.reasoning;
+    const thinkingLevels = validateThinkingLevels(m["thinkingLevels"]);
+    if (thinkingLevels) entry.thinkingLevels = thinkingLevels;
+    else if (prior?.thinkingLevels) entry.thinkingLevels = prior.thinkingLevels;
+    const thinkingTokenLimit = validateThinkingTokenLimit(m["thinkingTokenLimit"]);
+    if (thinkingTokenLimit) entry.thinkingTokenLimit = thinkingTokenLimit;
+    else if (prior?.thinkingTokenLimit) entry.thinkingTokenLimit = prior.thinkingTokenLimit;
     out.push(entry);
   }
   return out.length > 0 ? out : void 0;
@@ -6230,10 +7043,10 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-var import_node_fs9 = require("fs");
+var import_node_fs13 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_module = require("module");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 var import_meta = {};
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -6254,13 +7067,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return (0, import_node_fs9.existsSync)(import_node_path8.default.join(fromEnv, "index.html")) ? import_node_path8.default.resolve(fromEnv) : null;
+    return (0, import_node_fs13.existsSync)(import_node_path11.default.join(fromEnv, "index.html")) ? import_node_path11.default.resolve(fromEnv) : null;
   }
   try {
     const req = (0, import_node_module.createRequire)(typeof __filename !== "undefined" ? __filename : import_meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
-    const dist = import_node_path8.default.join(import_node_path8.default.dirname(pkgJson), "dist");
-    return (0, import_node_fs9.existsSync)(import_node_path8.default.join(dist, "index.html")) ? dist : null;
+    const dist = import_node_path11.default.join(import_node_path11.default.dirname(pkgJson), "dist");
+    return (0, import_node_fs13.existsSync)(import_node_path11.default.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -6302,16 +7115,16 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     res.end(JSON.stringify({ error: { type: "bad_request", message: "invalid path" } }));
     return true;
   }
-  const filePath = import_node_path8.default.resolve(uiDist, rel === "" ? "index.html" : rel);
-  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path8.default.sep)) {
+  const filePath = import_node_path11.default.resolve(uiDist, rel === "" ? "index.html" : rel);
+  if (filePath !== uiDist && !filePath.startsWith(uiDist + import_node_path11.default.sep)) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { type: "forbidden", message: "path outside ui root" } }));
     return true;
   }
   let target = filePath;
-  if (!(0, import_node_fs9.existsSync)(target) || (0, import_node_fs9.statSync)(target).isDirectory()) {
-    if (import_node_path8.default.extname(rel) === "") {
-      target = import_node_path8.default.join(uiDist, "index.html");
+  if (!(0, import_node_fs13.existsSync)(target) || (0, import_node_fs13.statSync)(target).isDirectory()) {
+    if (import_node_path11.default.extname(rel) === "") {
+      target = import_node_path11.default.join(uiDist, "index.html");
     } else {
       res.writeHead(404, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: { type: "not_found", message: "no such ui asset" } }));
@@ -6319,14 +7132,14 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     }
   }
   const body = await (0, import_promises.readFile)(target);
-  const type = CONTENT_TYPES[import_node_path8.default.extname(target).toLowerCase()] ?? "application/octet-stream";
+  const type = CONTENT_TYPES[import_node_path11.default.extname(target).toLowerCase()] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": type, "Content-Length": body.length });
   res.end(req.method === "HEAD" ? void 0 : body);
   return true;
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.8" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.10" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -6438,6 +7251,14 @@ var AdminServer = class {
       await handleAuditStatsQuery(req, res, this.deps.auditStatsReader);
       return;
     }
+    if (path2 === "/admin/api/audit/body" && (req.method === "GET" || req.method === "HEAD")) {
+      handleAuditBodyQuery(req, res, this.deps.auditBodyReader);
+      return;
+    }
+    if (path2 === "/admin/api/audit/compact" && req.method === "POST") {
+      handleAuditCompact(res, this.deps.auditCompactor);
+      return;
+    }
     if (path2 === "/admin/api/billing-status" && (req.method === "GET" || req.method === "HEAD")) {
       handleBillingStatus(res, this.deps.billingStatusReader);
       return;
@@ -6867,6 +7688,15 @@ function toLLMProvider(row) {
     api_base_url: row.baseUrl,
     api_key: resolvePreferredApiKey(row),
     models,
+    modelConfigs: row.modelConfigs?.map((config) => ({
+      id: config.id,
+      name: config.name ?? config.id,
+      enabled: config.enabled ?? true,
+      vision: config.vision,
+      reasoning: config.reasoning,
+      thinkingLevels: config.thinkingLevels,
+      thinkingTokenLimit: config.thinkingTokenLimit
+    })),
     enabled: true,
     transformer,
     // app-parity-2 child 3: POPULATE the coding-plan endpoint onto the core
@@ -6893,7 +7723,7 @@ function toLLMProvider(row) {
 }
 
 // src/ports/ConfigurableLogger.ts
-var import_node_fs10 = require("fs");
+var import_node_fs14 = require("fs");
 var LEVEL_ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
 var RESERVED_JSON_KEYS = /* @__PURE__ */ new Set(["ts", "level", "msg", "error"]);
 var ConfigurableLogger = class {
@@ -6969,7 +7799,7 @@ var ConfigurableLogger = class {
     if (this.fileDisabled || !this.filePath) return null;
     if (this.fileStream) return this.fileStream;
     try {
-      const stream = (0, import_node_fs10.createWriteStream)(this.filePath, { flags: "a" });
+      const stream = (0, import_node_fs14.createWriteStream)(this.filePath, { flags: "a" });
       stream.on("error", () => {
         this.fileDisabled = true;
         this.fileStream = null;
@@ -7038,7 +7868,7 @@ function safeStringify(value) {
 }
 
 // src/ports/JsonApiServerSettingsStore.ts
-var import_node_fs11 = require("fs");
+var import_node_fs15 = require("fs");
 var import_outbound_api4 = require("@omnicross/core/outbound-api");
 var JsonApiServerSettingsStore = class {
   /**
@@ -7065,7 +7895,7 @@ var JsonApiServerSettingsStore = class {
     if (key !== import_outbound_api4.OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
-    (0, import_node_fs11.writeFileSync)(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
+    (0, import_node_fs15.writeFileSync)(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   }
   /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
   encryptSecrets(config) {
@@ -7088,7 +7918,7 @@ var JsonApiServerSettingsStore = class {
   /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
   readFile() {
     try {
-      const raw = (0, import_node_fs11.readFileSync)(this.configPath, "utf8");
+      const raw = (0, import_node_fs15.readFileSync)(this.configPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object") return parsed;
     } catch {
@@ -7099,7 +7929,7 @@ var JsonApiServerSettingsStore = class {
 
 // src/ports/JsonlUsageEventStore.ts
 var import_node_crypto11 = require("crypto");
-var import_node_fs12 = require("fs");
+var import_node_fs16 = require("fs");
 var JsonlUsageEventStore = class {
   constructor(eventsPath, isPriced) {
     this.eventsPath = eventsPath;
@@ -7114,7 +7944,7 @@ var JsonlUsageEventStore = class {
       id: (0, import_node_crypto11.randomUUID)(),
       ts: input.ts ?? Date.now()
     };
-    (0, import_node_fs12.appendFileSync)(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
+    (0, import_node_fs16.appendFileSync)(this.eventsPath, JSON.stringify(row) + "\n", "utf8");
     return row.id;
   }
   async getTotals(range) {
@@ -7313,10 +8143,10 @@ var JsonlUsageEventStore = class {
   }
   /** Parse every line, skipping malformed/torn lines defensively. */
   readAllRows() {
-    if (!(0, import_node_fs12.existsSync)(this.eventsPath)) return [];
+    if (!(0, import_node_fs16.existsSync)(this.eventsPath)) return [];
     let raw;
     try {
-      raw = (0, import_node_fs12.readFileSync)(this.eventsPath, "utf8");
+      raw = (0, import_node_fs16.readFileSync)(this.eventsPath, "utf8");
     } catch {
       return [];
     }
@@ -7355,15 +8185,15 @@ function nextBoundary(ts, bucket) {
       return new Date(d.getFullYear(), d.getMonth() + 1, 1).getTime();
   }
 }
-var pad2 = (n) => String(n).padStart(2, "0");
+var pad22 = (n) => String(n).padStart(2, "0");
 function bucketLabel(bucketStartTs, bucket) {
   const d = new Date(bucketStartTs);
   const y = d.getFullYear();
-  const mo = pad2(d.getMonth() + 1);
-  const day = pad2(d.getDate());
+  const mo = pad22(d.getMonth() + 1);
+  const day = pad22(d.getDate());
   switch (bucket) {
     case "hour":
-      return `${mo}-${day} ${pad2(d.getHours())}:00`;
+      return `${mo}-${day} ${pad22(d.getHours())}:00`;
     case "day":
       return `${y}-${mo}-${day}`;
     case "month":
@@ -7419,7 +8249,7 @@ function median(values) {
 }
 
 // src/ports/JsonPricingStore.ts
-var import_node_fs13 = require("fs");
+var import_node_fs17 = require("fs");
 var import_node_crypto12 = require("crypto");
 var JsonPricingStore = class {
   constructor(pricingPath) {
@@ -7434,9 +8264,9 @@ var JsonPricingStore = class {
    * otherwise unusable pricing table after a crash or manual file edit.
    */
   hasUsableSnapshot() {
-    if (!(0, import_node_fs13.existsSync)(this.pricingPath)) return false;
+    if (!(0, import_node_fs17.existsSync)(this.pricingPath)) return false;
     try {
-      const parsed = JSON.parse((0, import_node_fs13.readFileSync)(this.pricingPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs17.readFileSync)(this.pricingPath, "utf8"));
       return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
     } catch {
       return false;
@@ -7549,9 +8379,9 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs13.existsSync)(this.pricingPath)) return [];
+    if (!(0, import_node_fs17.existsSync)(this.pricingPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs13.readFileSync)(this.pricingPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs17.readFileSync)(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
@@ -7560,18 +8390,18 @@ var JsonPricingStore = class {
   writeRows(rows) {
     const temporaryPath = `${this.pricingPath}.${process.pid}.${(0, import_node_crypto12.randomUUID)()}.tmp`;
     try {
-      (0, import_node_fs13.writeFileSync)(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
+      (0, import_node_fs17.writeFileSync)(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
         encoding: "utf8",
         flag: "wx"
       });
       this.replaceFile(temporaryPath);
     } finally {
-      (0, import_node_fs13.rmSync)(temporaryPath, { force: true });
+      (0, import_node_fs17.rmSync)(temporaryPath, { force: true });
     }
   }
   /** Isolated for deterministic failure testing; never removes the target. */
   replaceFile(temporaryPath) {
-    (0, import_node_fs13.renameSync)(temporaryPath, this.pricingPath);
+    (0, import_node_fs17.renameSync)(temporaryPath, this.pricingPath);
   }
 };
 function isUsablePricingRow(value) {
@@ -7581,7 +8411,7 @@ function isUsablePricingRow(value) {
 }
 
 // src/pricing/PricingRefreshScheduler.ts
-var import_node_fs14 = require("fs");
+var import_node_fs18 = require("fs");
 var EMPTY_STATE2 = {
   lastAttemptAt: null,
   lastSuccessAt: null,
@@ -7619,9 +8449,9 @@ var PricingRefreshScheduler = class {
     this.timer = null;
   }
   getState() {
-    if (!(0, import_node_fs14.existsSync)(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    if (!(0, import_node_fs18.existsSync)(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
     try {
-      const value = JSON.parse((0, import_node_fs14.readFileSync)(this.statePath, "utf8"));
+      const value = JSON.parse((0, import_node_fs18.readFileSync)(this.statePath, "utf8"));
       return {
         lastAttemptAt: finiteOrNull(value.lastAttemptAt),
         lastSuccessAt: finiteOrNull(value.lastSuccessAt),
@@ -7674,9 +8504,9 @@ var PricingRefreshScheduler = class {
   }
   writeState(state) {
     const temporaryPath = `${this.statePath}.tmp`;
-    (0, import_node_fs14.writeFileSync)(temporaryPath, `${JSON.stringify(state, null, 2)}
+    (0, import_node_fs18.writeFileSync)(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
-    (0, import_node_fs14.renameSync)(temporaryPath, this.statePath);
+    (0, import_node_fs18.renameSync)(temporaryPath, this.statePath);
   }
 };
 function finiteOrNull(value) {
@@ -7684,7 +8514,7 @@ function finiteOrNull(value) {
 }
 
 // src/ports/JsonVoucherDb.ts
-var import_node_fs15 = require("fs");
+var import_node_fs19 = require("fs");
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -7762,22 +8592,22 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs15.existsSync)(this.vouchersPath)) return [];
+    if (!(0, import_node_fs19.existsSync)(this.vouchersPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs15.readFileSync)(this.vouchersPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs19.readFileSync)(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs15.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    (0, import_node_fs19.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-var import_node_fs17 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path13 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
@@ -7826,11 +8656,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-var import_node_fs16 = require("fs");
+var import_node_fs20 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path9 = require("path");
+var import_node_path12 = require("path");
 function externalStorePath(provider, home = (0, import_node_os4.homedir)()) {
-  return provider === "claude" ? (0, import_node_path9.join)(home, ".claude", ".credentials.json") : (0, import_node_path9.join)(home, ".codex", "auth.json");
+  return provider === "claude" ? (0, import_node_path12.join)(home, ".claude", ".credentials.json") : (0, import_node_path12.join)(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -7879,10 +8709,10 @@ function parseCodexTokensEnvelope(raw) {
 }
 function readExternalCliCredentials(provider, home = (0, import_node_os4.homedir)()) {
   const path2 = externalStorePath(provider, home);
-  if (!(0, import_node_fs16.existsSync)(path2)) return null;
+  if (!(0, import_node_fs20.existsSync)(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -8453,9 +9283,9 @@ var JsonSubscriptionCredentialStore = class {
    *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
    *  write incl. child 4's future refresh writes lands encrypted. */
   persist(config) {
-    (0, import_node_fs17.mkdirSync)((0, import_node_path10.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs21.mkdirSync)((0, import_node_path13.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    (0, import_node_fs17.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    (0, import_node_fs21.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
   /**
    * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -8471,10 +9301,10 @@ var JsonSubscriptionCredentialStore = class {
    * `config.ts loadConfig`, which decrypts outside its parse try.
    */
   readConfig() {
-    if (!(0, import_node_fs17.existsSync)(this.tokensPath)) return { updatedAt: "" };
+    if (!(0, import_node_fs21.existsSync)(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse((0, import_node_fs17.readFileSync)(this.tokensPath, "utf8"));
+      const raw = JSON.parse((0, import_node_fs21.readFileSync)(this.tokensPath, "utf8"));
       parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
     } catch {
       parsed = null;
@@ -8991,32 +9821,14 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-var import_node_fs19 = require("fs");
-var import_node_path12 = require("path");
-
-// src/audit/auditFiles.ts
-var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
-var pad22 = (n) => String(n).padStart(2, "0");
-function auditFileName(ts) {
-  const d = new Date(ts);
-  return `audit-${d.getFullYear()}-${pad22(d.getMonth() + 1)}-${pad22(d.getDate())}.jsonl`;
-}
-function auditFileDateMs(fileName) {
-  const m = AUDIT_FILE_RE.exec(fileName);
-  if (!m) return null;
-  const year = Number(m[1]);
-  const month = Number(m[2]);
-  const day = Number(m[3]);
-  const d = new Date(year, month - 1, day);
-  if (d.getFullYear() !== year || d.getMonth() !== month - 1 || d.getDate() !== day) {
-    return null;
-  }
-  return d.getTime();
-}
+var import_node_fs23 = require("fs");
+var import_node_path15 = require("path");
+var import_promises2 = require("stream/promises");
+var import_node_zlib2 = require("zlib");
 
 // src/audit/auditStats.ts
-var import_node_fs18 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path14 = require("path");
 var SIDECAR_VERSION = 1;
 var META_PREFIX_BYTES = 64 * 1024;
 var READ_CHUNK_BYTES = 4 * 1024 * 1024;
@@ -9024,9 +9836,9 @@ function auditStatsFileName(auditFile) {
   return auditFile.replace(/\.jsonl$/, ".stats.json");
 }
 function readPersisted(path2) {
-  if (!(0, import_node_fs18.existsSync)(path2)) return null;
+  if (!(0, import_node_fs22.existsSync)(path2)) return null;
   try {
-    const value = JSON.parse((0, import_node_fs18.readFileSync)(path2, "utf8"));
+    const value = JSON.parse((0, import_node_fs22.readFileSync)(path2, "utf8"));
     if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
       return null;
     }
@@ -9036,7 +9848,7 @@ function readPersisted(path2) {
   }
 }
 function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfter, record) {
-  const statsPath = (0, import_node_path11.join)((0, import_node_path11.dirname)(auditPath), auditStatsFileName((0, import_node_path11.basename)(auditPath)));
+  const statsPath = (0, import_node_path14.join)((0, import_node_path14.dirname)(auditPath), auditStatsFileName((0, import_node_path14.basename)(auditPath)));
   const previous = auditBytesBefore === 0 ? {
     version: SIDECAR_VERSION,
     auditBytes: 0,
@@ -9056,13 +9868,13 @@ function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfte
     minTs: previous.minTs === null ? record.ts : Math.min(previous.minTs, record.ts),
     maxTs: previous.maxTs === null ? record.ts : Math.max(previous.maxTs, record.ts)
   };
-  (0, import_node_fs18.writeFileSync)(statsPath, JSON.stringify(next), "utf8");
+  (0, import_node_fs22.writeFileSync)(statsPath, JSON.stringify(next), "utf8");
 }
 function queryCovers(stats, from, to) {
   return stats.requestCount === 0 || stats.minTs !== null && stats.maxTs !== null && from <= stats.minTs && to >= stats.maxTs;
 }
-function fileOverlaps(file, from, to) {
-  const start = auditFileDateMs(file);
+function fileOverlaps(name, from, to) {
+  const start = auditFileDateMs(name);
   if (start === null) return false;
   const date = new Date(start);
   const end = new Date(date.getFullYear(), date.getMonth(), date.getDate() + 1).getTime();
@@ -9114,7 +9926,7 @@ async function scanAuditFile(auditPath, startByte, auditBytes, from, to) {
     prefixTruncated = false;
   };
   if (auditBytes > startByte) {
-    const stream = (0, import_node_fs18.createReadStream)(auditPath, {
+    const stream = (0, import_node_fs22.createReadStream)(auditPath, {
       start: startByte,
       end: auditBytes - 1,
       highWaterMark: READ_CHUNK_BYTES
@@ -9167,21 +9979,27 @@ function mergePersistedStats(previous, appended) {
   };
 }
 async function readAuditStats(auditDir, query2 = {}) {
-  if (!(0, import_node_fs18.existsSync)(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  if (!(0, import_node_fs22.existsSync)(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
-  let files;
+  let sources;
   try {
-    files = (0, import_node_fs18.readdirSync)(auditDir).filter((file) => AUDIT_FILE_RE.test(file) && fileOverlaps(file, from, to)).sort();
+    sources = (0, import_node_fs22.readdirSync)(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
+      (name) => AUDIT_DAY_DIR_RE.test(name) ? {
+        auditPath: (0, import_node_path14.join)(auditDir, name, AUDIT_META_FILE),
+        statsPath: (0, import_node_path14.join)(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
+      } : {
+        auditPath: (0, import_node_path14.join)(auditDir, name),
+        statsPath: (0, import_node_path14.join)(auditDir, auditStatsFileName(name))
+      }
+    ).filter((source) => (0, import_node_fs22.existsSync)(source.auditPath));
   } catch {
     return { requestCount: 0, errorCount: 0, complete: false };
   }
   const total = { requestCount: 0, errorCount: 0, complete: true };
-  for (const file of files) {
-    const auditPath = (0, import_node_path11.join)(auditDir, file);
+  for (const { auditPath, statsPath } of sources) {
     try {
-      const auditBytes = (0, import_node_fs18.statSync)(auditPath).size;
-      const statsPath = (0, import_node_path11.join)(auditDir, auditStatsFileName(file));
+      const auditBytes = (0, import_node_fs22.statSync)(auditPath).size;
       const persisted = readPersisted(statsPath);
       if (persisted && persisted.complete && persisted.auditBytes === auditBytes && queryCovers(persisted, from, to)) {
         total.requestCount += persisted.requestCount;
@@ -9200,7 +10018,7 @@ async function readAuditStats(auditDir, query2 = {}) {
       total.errorCount += scanned.filtered.errorCount + (resumable?.errorCount ?? 0);
       total.complete = total.complete && scanned.filtered.complete;
       const current = resumable ? mergePersistedStats(resumable, scanned.all) : scanned.all;
-      if (current.complete) (0, import_node_fs18.writeFileSync)(statsPath, JSON.stringify(current), "utf8");
+      if (current.complete) (0, import_node_fs22.writeFileSync)(statsPath, JSON.stringify(current), "utf8");
     } catch {
       total.complete = false;
     }
@@ -9211,6 +10029,7 @@ async function readAuditStats(auditDir, query2 = {}) {
 // src/audit/AuditPruneSweeper.ts
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
+var ARCHIVE_BATCH = 64;
 var AuditPruneSweeper = class {
   constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
     this.auditDir = auditDir;
@@ -9226,6 +10045,7 @@ var AuditPruneSweeper = class {
   now;
   timer = null;
   sweeping = false;
+  archiving = false;
   /** Whether pruning is active (audit enabled). */
   get enabled() {
     return this.config.enabled;
@@ -9235,13 +10055,13 @@ var AuditPruneSweeper = class {
     this.config = config;
   }
   /**
-   * Arm the prune interval AND run one prune immediately (boot cleanup). No-op
-   * when audit is disabled (zero regression). Idempotent.
+   * Arm the interval AND run one pass immediately (boot cleanup). No-op when
+   * audit is disabled (zero regression). Idempotent.
    */
   start() {
     if (this.timer || !this.config.enabled) return;
-    void this.sweep();
-    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    void this.runOnce();
+    this.timer = setInterval(() => void this.runOnce(), this.intervalMs);
     this.timer.unref?.();
   }
   /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
@@ -9251,31 +10071,43 @@ var AuditPruneSweeper = class {
       this.timer = null;
     }
   }
+  /** Prune first, then archive — never spend CPU compressing a day about to go. */
+  async runOnce() {
+    await this.sweep();
+    await this.archive();
+  }
+  /** The LOCAL-midnight epoch ms of the current day. */
+  todayMidnight() {
+    const today = new Date(this.now());
+    return new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
+  }
   /**
-   * One prune: unlink every audit date file strictly OLDER than the retention
-   * cutoff (`now - retentionDays` days, at local-midnight granularity). Exposed
-   * for tests; never throws. Returns the number of files removed.
+   * One prune: remove every audit day strictly OLDER than the retention cutoff
+   * (`now - retentionDays` days, at local-midnight granularity). Exposed for
+   * tests; never throws. Returns the number of days removed.
    */
   async sweep() {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!(0, import_node_fs19.existsSync)(this.auditDir)) return 0;
-      const today = new Date(this.now());
-      const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
-      const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
+      if (!(0, import_node_fs23.existsSync)(this.auditDir)) return 0;
+      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS;
       let removed = 0;
-      for (const file of (0, import_node_fs19.readdirSync)(this.auditDir)) {
-        const dateMs = auditFileDateMs(file);
+      for (const name of (0, import_node_fs23.readdirSync)(this.auditDir)) {
+        const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          (0, import_node_fs19.unlinkSync)((0, import_node_path12.join)(this.auditDir, file));
+          if (isAuditDayDir(name)) {
+            (0, import_node_fs23.rmSync)((0, import_node_path15.join)(this.auditDir, name), { recursive: true, force: true });
+          } else {
+            (0, import_node_fs23.unlinkSync)((0, import_node_path15.join)(this.auditDir, name));
+            const statsPath = (0, import_node_path15.join)(this.auditDir, auditStatsFileName(name));
+            if ((0, import_node_fs23.existsSync)(statsPath)) (0, import_node_fs23.unlinkSync)(statsPath);
+          }
           removed += 1;
-          const statsPath = (0, import_node_path12.join)(this.auditDir, auditStatsFileName(file));
-          if ((0, import_node_fs19.existsSync)(statsPath)) (0, import_node_fs19.unlinkSync)(statsPath);
         } catch (error) {
-          this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
-            file,
+          this.logger.warn("[AuditPruneSweeper] failed to remove expired audit day", {
+            name,
             error: error instanceof Error ? error.message : String(error)
           });
         }
@@ -9291,59 +10123,158 @@ var AuditPruneSweeper = class {
       this.sweeping = false;
     }
   }
+  /**
+   * Gzip the body shards of every CLOSED day (anything before today). Today is
+   * deliberately left as plain text so it stays greppable while it is the day you
+   * are debugging. Exposed for tests; never throws. Returns shards compressed.
+   */
+  async archive() {
+    if (!this.config.enabled || this.archiving) return 0;
+    this.archiving = true;
+    try {
+      if (!(0, import_node_fs23.existsSync)(this.auditDir)) return 0;
+      const today = this.todayMidnight();
+      let compressed = 0;
+      for (const name of (0, import_node_fs23.readdirSync)(this.auditDir)) {
+        if (compressed >= ARCHIVE_BATCH) break;
+        const dateMs = auditFileDateMs(name);
+        if (dateMs === null || dateMs >= today || !isAuditDayDir(name)) continue;
+        const dayPath = (0, import_node_path15.join)(this.auditDir, name);
+        try {
+          const compaction = compactAuditDay(dayPath);
+          if (compaction.shards > 0) {
+            this.logger.debug("audit cross-session compaction complete", {
+              day: name,
+              shards: compaction.shards,
+              anchors: compaction.anchors,
+              savedBytes: compaction.savedBytes
+            });
+          }
+        } catch (error) {
+          this.logger.warn("[AuditPruneSweeper] cross-session compaction failed", {
+            day: name,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        compressed += await this.archiveDay(
+          (0, import_node_path15.join)(dayPath, AUDIT_BODIES_DIR),
+          ARCHIVE_BATCH - compressed
+        );
+      }
+      if (compressed > 0) this.logger.debug("audit archive complete", { compressed });
+      return compressed;
+    } catch (error) {
+      this.logger.warn("audit archive pass failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return 0;
+    } finally {
+      this.archiving = false;
+    }
+  }
+  /** Gzip up to `budget` plain shards in one day's `bodies/` directory. */
+  async archiveDay(bodiesPath, budget) {
+    let shards;
+    try {
+      shards = (0, import_node_fs23.readdirSync)(bodiesPath).filter((file) => file.endsWith(".jsonl"));
+    } catch {
+      return 0;
+    }
+    let compressed = 0;
+    for (const shard of shards) {
+      if (compressed >= budget) break;
+      const source = (0, import_node_path15.join)(bodiesPath, shard);
+      const target = `${source}.gz`;
+      try {
+        if ((0, import_node_fs23.existsSync)(target)) {
+          (0, import_node_fs23.unlinkSync)(source);
+          continue;
+        }
+        await (0, import_promises2.pipeline)((0, import_node_fs23.createReadStream)(source), (0, import_node_zlib2.createGzip)(), (0, import_node_fs23.createWriteStream)(target));
+        (0, import_node_fs23.unlinkSync)(source);
+        compressed += 1;
+      } catch (error) {
+        try {
+          if ((0, import_node_fs23.existsSync)(target)) (0, import_node_fs23.unlinkSync)(target);
+        } catch {
+        }
+        this.logger.warn("[AuditPruneSweeper] failed to archive audit body shard", {
+          shard,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return compressed;
+  }
 };
 
 // src/audit/auditReader.ts
-var import_node_fs20 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs24 = require("fs");
+var import_node_path16 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query2 = {}) {
-  if (!(0, import_node_fs20.existsSync)(auditDir)) return [];
-  let files;
+var OVERSCAN = 256;
+function daySources(auditDir) {
+  let names;
   try {
-    files = (0, import_node_fs20.readdirSync)(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    names = (0, import_node_fs24.readdirSync)(auditDir);
   } catch {
     return [];
   }
+  const sources = [];
+  for (const name of names) {
+    const dateMs = auditFileDateMs(name);
+    if (dateMs === null) continue;
+    if (AUDIT_DAY_DIR_RE.test(name)) {
+      const path2 = (0, import_node_path16.join)(auditDir, name, AUDIT_META_FILE);
+      if ((0, import_node_fs24.existsSync)(path2)) sources.push({ path: path2, dateMs });
+    } else if (AUDIT_FILE_RE.test(name)) {
+      sources.push({ path: (0, import_node_path16.join)(auditDir, name), dateMs });
+    }
+  }
+  return sources.sort((a, b) => b.dateMs - a.dateMs);
+}
+function isAuditRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["method"] === "string" && typeof r["path"] === "string" && typeof r["status"] === "number";
+}
+function toMetaRecord(record) {
+  if (record.requestBody === void 0 && record.responseBody === void 0) return record;
+  const { requestBody: _req, responseBody: _res, ...meta } = record;
+  return { ...meta, hasBody: true };
+}
+function readAuditRecords(auditDir, query2 = {}) {
+  if (!(0, import_node_fs24.existsSync)(auditDir)) return [];
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
   const matched = [];
-  for (const file of files.sort().reverse()) {
-    let raw;
-    try {
-      raw = (0, import_node_fs20.readFileSync)((0, import_node_path13.join)(auditDir, file), "utf8");
-    } catch {
-      continue;
-    }
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      let rec;
+  for (const source of daySources(auditDir)) {
+    const before = matched.length;
+    forEachLineFromTail(source.path, (line) => {
+      let parsed;
       try {
-        rec = JSON.parse(trimmed);
+        parsed = JSON.parse(line);
       } catch {
-        continue;
+        return false;
       }
-      if (!isAuditRecord(rec)) continue;
-      if (query2.keyId !== void 0 && rec.keyId !== query2.keyId) continue;
-      if (rec.ts < from || rec.ts > to) continue;
-      matched.push(rec);
-    }
+      if (!isAuditRecord(parsed)) return false;
+      if (query2.keyId !== void 0 && parsed.keyId !== query2.keyId) return false;
+      if (query2.sessionKey !== void 0 && parsed.sessionKey !== query2.sessionKey) return false;
+      if (parsed.ts < from || parsed.ts > to) return false;
+      matched.push(toMetaRecord(parsed));
+      return matched.length - before >= limit + OVERSCAN;
+    });
+    if (matched.length >= limit) break;
   }
   matched.sort((a, b) => b.ts - a.ts);
   return matched.slice(0, limit);
 }
-function isAuditRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const r = value;
-  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["method"] === "string" && typeof r["path"] === "string" && typeof r["status"] === "number";
-}
 
 // src/audit/AuditWriter.ts
-var import_node_fs21 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_path17 = require("path");
 var AuditWriter = class {
   constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
     this.auditDir = auditDir;
@@ -9353,10 +10284,13 @@ var AuditWriter = class {
   auditDir;
   logger;
   defer;
-  dirEnsured = false;
+  /** Day directories already created this process (avoids an mkdir per record). */
+  ensuredDirs = /* @__PURE__ */ new Set();
+  /** Per-session encoding bases. Memory-only; a miss simply writes a full snapshot. */
+  bases = new SessionBaseCache();
   /**
-   * Enqueue one record for append. Returns IMMEDIATELY (fire-and-forget); the fs
-   * write happens on the deferred tick. A failure is logged, never thrown.
+   * Enqueue one record. Returns IMMEDIATELY (fire-and-forget); every fs write and
+   * the delta encoding happen on the deferred tick. A failure is logged, never thrown.
    */
   record(record) {
     this.defer(() => {
@@ -9369,25 +10303,41 @@ var AuditWriter = class {
       }
     });
   }
+  /** Drop all retained encoding bases (config reload / shutdown / test teardown). */
+  reset() {
+    this.bases.clear();
+    this.ensuredDirs.clear();
+  }
   /**
-   * Append synchronously — the awaitable form tests use to assert the line landed.
-   * Ensures the `audit/` directory exists on first write (lazy, like the usage
-   * store's lazy file creation).
+   * Append synchronously — the awaitable form tests use to assert a line landed.
+   * Writes the metadata line first (canonical), then the body shard.
    */
   appendNow(record) {
-    if (!this.dirEnsured) {
-      (0, import_node_fs21.mkdirSync)(this.auditDir, { recursive: true });
-      this.dirEnsured = true;
-    }
-    const file = (0, import_node_path14.join)(this.auditDir, auditFileName(record.ts));
-    const line = JSON.stringify(record) + "\n";
-    const auditBytesBefore = (0, import_node_fs21.existsSync)(file) ? (0, import_node_fs21.statSync)(file).size : 0;
-    (0, import_node_fs21.appendFileSync)(file, line, "utf8");
+    const dayDir = auditDayDirName(record.ts);
+    const dayPath = this.ensureDir((0, import_node_path17.join)(this.auditDir, dayDir));
+    this.appendMeta(dayPath, record);
+    this.appendBody(dayPath, dayDir, record);
+  }
+  /** Create a directory once per process and remember it. */
+  ensureDir(path2) {
+    if (!this.ensuredDirs.has(path2)) {
+      (0, import_node_fs25.mkdirSync)(path2, { recursive: true });
+      this.ensuredDirs.add(path2);
+    }
+    return path2;
+  }
+  /** Write the body-free metadata line + refresh the exact-count sidecar. */
+  appendMeta(dayPath, record) {
+    const { requestBody: _req, responseBody: _res, ...meta } = record;
+    const file = (0, import_node_path17.join)(dayPath, AUDIT_META_FILE);
+    const line = JSON.stringify(meta) + "\n";
+    const bytesBefore = (0, import_node_fs25.existsSync)(file) ? (0, import_node_fs25.statSync)(file).size : 0;
+    (0, import_node_fs25.appendFileSync)(file, line, "utf8");
     try {
       updateAuditStatsAfterAppend(
         file,
-        auditBytesBefore,
-        auditBytesBefore + Buffer.byteLength(line, "utf8"),
+        bytesBefore,
+        bytesBefore + Buffer.byteLength(line, "utf8"),
         record
       );
     } catch (error) {
@@ -9396,12 +10346,39 @@ var AuditWriter = class {
       });
     }
   }
+  /**
+   * Write the delta-encoded body shard for one record. A no-op when nothing was
+   * captured or when the session key is missing/unsafe — in which case the body
+   * is dropped rather than written to an unvalidated path.
+   */
+  appendBody(dayPath, dayDir, record) {
+    if (record.requestBody === void 0 && record.responseBody === void 0) return;
+    const sessionKey = record.sessionKey;
+    if (!isSafeSessionKey(sessionKey)) {
+      this.logger.warn("[AuditWriter] dropping audit body with no usable session key", {
+        id: record.id
+      });
+      return;
+    }
+    try {
+      const line = encodeBodyEntry(record, sessionKey, dayDir, this.bases);
+      if (line === null) return;
+      const bodiesPath = this.ensureDir((0, import_node_path17.join)(dayPath, AUDIT_BODIES_DIR));
+      (0, import_node_fs25.appendFileSync)((0, import_node_path17.join)(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
+    } catch (error) {
+      this.bases.forget(sessionKey);
+      this.logger.warn("[AuditWriter] failed to append audit body shard", {
+        id: record.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
 };
 
 // src/billing/BillingPublisher.ts
-var import_node_fs22 = require("fs");
+var import_node_fs26 = require("fs");
 var import_node_crypto13 = require("crypto");
-var import_node_path15 = require("path");
+var import_node_path18 = require("path");
 var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
@@ -9472,8 +10449,8 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = (0, import_node_path15.join)(this.billingDir, billingFileName(event.ts));
-    (0, import_node_fs22.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
+    const file = (0, import_node_path18.join)(this.billingDir, billingFileName(event.ts));
+    (0, import_node_fs26.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
    * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
@@ -9522,8 +10499,8 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = (0, import_node_path15.join)(this.billingDir, deliveredFileName(event.ts));
-      (0, import_node_fs22.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
+      const file = (0, import_node_path18.join)(this.billingDir, deliveredFileName(event.ts));
+      (0, import_node_fs26.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
         error: error instanceof Error ? error.message : String(error)
@@ -9532,20 +10509,20 @@ var BillingPublisher = class {
   }
   ensureDir() {
     if (this.dirEnsured) return;
-    (0, import_node_fs22.mkdirSync)(this.billingDir, { recursive: true });
+    (0, import_node_fs26.mkdirSync)(this.billingDir, { recursive: true });
     this.dirEnsured = true;
   }
 };
 
 // src/billing/billingReader.ts
-var import_node_fs23 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs27 = require("fs");
+var import_node_path19 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!(0, import_node_fs23.existsSync)(billingDir)) return view;
+  if (!(0, import_node_fs27.existsSync)(billingDir)) return view;
   let files;
   try {
-    files = (0, import_node_fs23.readdirSync)(billingDir);
+    files = (0, import_node_fs27.readdirSync)(billingDir);
   } catch {
     return view;
   }
@@ -9576,7 +10553,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs23.readFileSync)((0, import_node_path16.join)(dir, file), "utf8");
+    raw = (0, import_node_fs27.readFileSync)((0, import_node_path19.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -10062,7 +11039,7 @@ function buildDaemon(config, paths) {
     }
   );
   const pricingStore = new JsonPricingStore(defaultPricingPath(paths.configPath));
-  const pricingEngine = new import_usage.PricingEngine(pricingStore, logger, {
+  const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
     fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
@@ -10078,8 +11055,10 @@ function buildDaemon(config, paths) {
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
   );
   const keySpendTracker = new import_outbound_api6.KeySpendTracker(usageEventStore);
-  const usageRecorder = new import_usage.UsageRecorder(usageEventStore, pricingEngine, logger, {
-    onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at)
+  const usageThroughput = (0, import_usage2.getSharedUsageThroughputTracker)();
+  const usageRecorder = new import_usage2.UsageRecorder(usageEventStore, pricingEngine, logger, {
+    onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at),
+    onEvent: (row, at) => usageThroughput.record(row, at)
   });
   const providerProxy = (0, import_provider_proxy4.getProviderProxy)({ llmConfig, apiKeyPool, usageRecorder });
   const routeLeaseManager = new import_provider_proxy4.RouteLeaseManager(
@@ -10228,6 +11207,11 @@ function buildDaemon(config, paths) {
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
     auditReader: (query2) => readAuditRecords(auditDir, query2),
     auditStatsReader: (query2) => readAuditStats(auditDir, query2),
+    // audit-store-sharding: bodies live in per-session shards, so opening ONE
+    // record's payload is a separate authed call that replays its delta chain.
+    auditBodyReader: (query2) => readAuditBody(auditDir, query2),
+    // audit-store-sharding D8: the manual counterpart to the daily pass.
+    auditCompactor: () => compactAllClosedAuditDays(auditDir),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -10286,8 +11270,8 @@ function buildDaemon(config, paths) {
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!(0, import_node_fs24.existsSync)(tokensPath)) return true;
-    (0, import_node_fs24.accessSync)(tokensPath, import_node_fs24.constants.R_OK);
+    if (!(0, import_node_fs28.existsSync)(tokensPath)) return true;
+    (0, import_node_fs28.accessSync)(tokensPath, import_node_fs28.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -10332,10 +11316,10 @@ function buildCliSpawnPlan(opts) {
   };
 }
 function resolveInPathDefault(candidate) {
-  const segments = (process.env["PATH"] ?? "").split(import_node_path17.delimiter).filter(Boolean);
+  const segments = (process.env["PATH"] ?? "").split(import_node_path20.delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = (0, import_node_path17.join)(seg, candidate);
-    if ((0, import_node_fs25.existsSync)(full)) return full;
+    const full = (0, import_node_path20.join)(seg, candidate);
+    if ((0, import_node_fs29.existsSync)(full)) return full;
   }
   return null;
 }
@@ -10343,7 +11327,7 @@ async function runLaunch(argv, deps) {
   const sep = argv.indexOf("--");
   const own = sep === -1 ? argv : argv.slice(0, sep);
   const passthrough = sep === -1 ? [] : argv.slice(sep + 1);
-  const { values, positionals } = (0, import_node_util4.parseArgs)({
+  const { values, positionals } = (0, import_node_util5.parseArgs)({
     args: own,
     options: {
       provider: { type: "string", short: "p" },
@@ -10513,12 +11497,12 @@ function spawnCliInherit(plan) {
 // src/commands/login.ts
 var import_node_child_process3 = require("child_process");
 var import_node_readline = require("readline");
-var import_node_util5 = require("util");
+var import_node_util6 = require("util");
 var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_subscriptions5 = require("@omnicross/subscriptions");
 var PROVIDERS2 = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
-  const { values, positionals } = (0, import_node_util5.parseArgs)({
+  const { values, positionals } = (0, import_node_util6.parseArgs)({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -10686,9 +11670,9 @@ function promptPaste(prompt) {
 
 // src/commands/providers.ts
 var import_node_crypto16 = require("crypto");
-var import_node_util6 = require("util");
+var import_node_util7 = require("util");
 async function runProviders(argv) {
-  const { values, positionals } = (0, import_node_util6.parseArgs)({
+  const { values, positionals } = (0, import_node_util7.parseArgs)({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -10835,10 +11819,10 @@ function providersRmKey(configPath, providerId, keyId) {
 }
 
 // src/commands/secrets.ts
-var import_node_fs26 = require("fs");
-var import_node_util7 = require("util");
+var import_node_fs30 = require("fs");
+var import_node_util8 = require("util");
 async function runSecrets(argv) {
-  const { values, positionals } = (0, import_node_util7.parseArgs)({
+  const { values, positionals } = (0, import_node_util8.parseArgs)({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -10908,12 +11892,12 @@ function secretsStatus(args) {
     reportField("admin.token", cfg.admin.token);
   }
   const tokensPath = defaultTokensPath(args.config);
-  if ((0, import_node_fs26.existsSync)(tokensPath)) {
+  if ((0, import_node_fs30.existsSync)(tokensPath)) {
     console.info(`Secret status for ${tokensPath}:`);
     reportTokenFields(tokensPath);
   }
   const integrationsPath = defaultIntegrationsPath(args.config);
-  if ((0, import_node_fs26.existsSync)(integrationsPath)) {
+  if ((0, import_node_fs30.existsSync)(integrationsPath)) {
     const state = readRawJson(integrationsPath);
     const key = state.gatewayKey;
     if (key && typeof key === "object" && !Array.isArray(key)) {
@@ -10967,8 +11951,8 @@ async function secretsRotate(args) {
   const integrationsPath = defaultIntegrationsPath(args.config);
   try {
     cfg = loadConfig(args.config);
-    if ((0, import_node_fs26.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
-    if ((0, import_node_fs26.existsSync)(integrationsPath)) {
+    if ((0, import_node_fs30.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+    if ((0, import_node_fs30.existsSync)(integrationsPath)) {
       integrationsPlain = new IntegrationStateStore(integrationsPath, oldBox).load();
     }
   } finally {
@@ -11003,20 +11987,20 @@ function secretsDecrypt(args) {
   let tokensPlain = null;
   try {
     cfg = loadConfig(args.config);
-    if ((0, import_node_fs26.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+    if ((0, import_node_fs30.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
   } finally {
     setSecretBox(null);
   }
   saveConfig(args.config, cfg);
   if (tokensPlain) {
-    (0, import_node_fs26.writeFileSync)(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
+    (0, import_node_fs30.writeFileSync)(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
   }
   console.info(`Decrypted secrets to plaintext in ${args.config}` + tokensSuffix(args.config));
 }
 function readRawConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+    parsed = JSON.parse((0, import_node_fs30.readFileSync)(path2, "utf8"));
   } catch {
     throw new Error(`secrets: cannot read or parse '${path2}'`);
   }
@@ -11024,7 +12008,7 @@ function readRawConfig(path2) {
 }
 function readRawJson(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs30.readFileSync)(path2, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -11034,13 +12018,13 @@ function readRawJson(path2) {
 }
 function encryptTokensFileInPlace(configPath, box) {
   const tokensPath = defaultTokensPath(configPath);
-  if (!(0, import_node_fs26.existsSync)(tokensPath)) return;
+  if (!(0, import_node_fs30.existsSync)(tokensPath)) return;
   const plain = decryptTokensFile(tokensPath, box);
   writeTokensEncrypted(tokensPath, plain, box);
 }
 function rewriteIntegrationState(configPath, readBox, writeBox) {
   const path2 = defaultIntegrationsPath(configPath);
-  if (!(0, import_node_fs26.existsSync)(path2)) return;
+  if (!(0, import_node_fs30.existsSync)(path2)) return;
   const state = new IntegrationStateStore(path2, readBox).load();
   new IntegrationStateStore(path2, writeBox).save(state);
 }
@@ -11053,7 +12037,7 @@ function writeTokensEncrypted(tokensPath, plain, box) {
     { updatedAt: "", ...plain },
     box
   );
-  (0, import_node_fs26.writeFileSync)(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  (0, import_node_fs30.writeFileSync)(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
 }
 var TOKEN_FIELDS2 = {
   claude: ["accessToken", "refreshToken"],
@@ -11076,11 +12060,11 @@ function walkTokens(raw, fn) {
   return next;
 }
 function tokensSuffix(configPath) {
-  return (0, import_node_fs26.existsSync)(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+  return (0, import_node_fs30.existsSync)(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
 }
 
 // src/commands/start.ts
-var import_node_util8 = require("util");
+var import_node_util9 = require("util");
 var import_outbound_api7 = require("@omnicross/core/outbound-api");
 var import_SubscriptionAccountHealth5 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling6 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
@@ -11119,7 +12103,7 @@ async function seedIdentities(store, credentialStore) {
 
 // src/commands/start.ts
 async function runStart(argv) {
-  const { values } = (0, import_node_util8.parseArgs)({
+  const { values } = (0, import_node_util9.parseArgs)({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -11259,6 +12243,10 @@ Usage:
   omnicross secrets encrypt --config <p>   Encrypt all at-rest secrets in place.
   omnicross secrets status --config <p>    Report each secret field (no values shown).
   omnicross secrets rotate --config <p> --new-master-key-file <p>  Re-seal under a new master key.
+
+  omnicross audit sessions --config <p> [--date YYYY-MM-DD]        List captured body shards per session.
+  omnicross audit show --config <p> --session <key> [--id <recordId>]  Print reconstructed request/response bodies.
+  omnicross audit compact --config <p> [--date YYYY-MM-DD]         Run cross-session body compaction now.
 `;
 async function main() {
   const [, , subcommand, ...rest] = process.argv;
@@ -11290,6 +12278,9 @@ async function main() {
     case "secrets":
       await runSecrets(rest);
       return;
+    case "audit":
+      await runAudit(rest);
+      return;
     case void 0:
     case "-h":
     case "--help":