@omnicross/daemon 0.1.9 → 0.1.10

package/dist/cli.js

@@ -1,86 +1,633 @@
 #!/usr/bin/env node
 
-// src/commands/import-ccr.ts
-import { readFileSync as readFileSync3 } from "fs";
+// src/commands/audit.ts
+import { readdirSync as readdirSync3 } from "fs";
+import { join as join5 } from "path";
 import { parseArgs } from "util";
 
-// src/ccr-import.ts
-function parseCcrConfig(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("CCR config: top-level value must be an object");
+// src/audit/auditBodyReader.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { join as join2 } from "path";
+import { gunzipSync } from "zlib";
+
+// src/audit/auditBodyStore.ts
+var ANCHOR_EVERY = 64;
+var ANCHOR_DELTA_RATIO = 0.75;
+var DIVERGED_PREFIX_RATIO = 0.25;
+var MAX_BASE_CHARS = 4e6;
+var CACHE_BUDGET_CHARS = 16e6;
+var CACHE_MAX_SESSIONS = 32;
+var MAX_BASES_PER_SESSION = 4;
+var isHighSurrogate = (code) => code >= 55296 && code <= 56319;
+var isLowSurrogate = (code) => code >= 56320 && code <= 57343;
+function computeBodyDelta(prev, next) {
+  const shortest = Math.min(prev.length, next.length);
+  let pre = 0;
+  while (pre < shortest && prev.charCodeAt(pre) === next.charCodeAt(pre)) pre += 1;
+  if (pre > 0 && isHighSurrogate(prev.charCodeAt(pre - 1))) pre -= 1;
+  const maxSuf = shortest - pre;
+  let suf = 0;
+  while (suf < maxSuf && prev.charCodeAt(prev.length - 1 - suf) === next.charCodeAt(next.length - 1 - suf)) {
+    suf += 1;
+  }
+  if (suf > 0 && isLowSurrogate(prev.charCodeAt(prev.length - suf))) suf -= 1;
+  return { pre, suf, ins: next.slice(pre, next.length - suf) };
+}
+function applyBodyDelta(prev, delta) {
+  const head = delta.pre > 0 ? prev.slice(0, delta.pre) : "";
+  const tail = delta.suf > 0 ? prev.slice(prev.length - delta.suf) : "";
+  return head + delta.ins + tail;
+}
+var SessionBaseCache = class {
+  constructor(maxSessions = CACHE_MAX_SESSIONS, budgetChars = CACHE_BUDGET_CHARS, maxBaseChars = MAX_BASE_CHARS, maxHeads = MAX_BASES_PER_SESSION) {
+    this.maxSessions = maxSessions;
+    this.budgetChars = budgetChars;
+    this.maxBaseChars = maxBaseChars;
+    this.maxHeads = maxHeads;
+  }
+  maxSessions;
+  budgetChars;
+  maxBaseChars;
+  maxHeads;
+  /** Session key to its retained heads, most-recent first. */
+  entries = /* @__PURE__ */ new Map();
+  chars = 0;
+  /** Retained sessions (tests + diagnostics). */
+  get size() {
+    return this.entries.size;
+  }
+  /** A session's retained heads, most-recent first. Refreshes LRU recency. */
+  get(sessionKey) {
+    const found = this.entries.get(sessionKey);
+    if (!found) return [];
+    this.entries.delete(sessionKey);
+    this.entries.set(sessionKey, found);
+    return found;
   }
-  const obj = raw;
-  const Providers = Array.isArray(obj["Providers"]) ? obj["Providers"] : [];
-  const Router = obj["Router"] && typeof obj["Router"] === "object" ? obj["Router"] : {};
-  return { Providers, Router };
+  /**
+   * Retain `base` as a head of `sessionKey`.
+   *
+   * `replacesId` is the head this turn CONTINUES (its body was preserved whole
+   * inside the new one), which is swapped out so a linear conversation keeps
+   * exactly one head. Omit it when the turn started a distinct stream %s that
+   * head is added alongside, which is what keeps a fork's branches apart.
+   *
+   * A body larger than `maxBaseChars` is not retained: the next turn anchors
+   * rather than letting one oversized session monopolize the budget.
+   */
+  remember(sessionKey, base, replacesId) {
+    const heads = this.entries.get(sessionKey) ?? [];
+    if (replacesId !== void 0) {
+      const at = heads.findIndex((head) => head.lastId === replacesId);
+      if (at >= 0) {
+        this.chars -= heads[at].text.length;
+        heads.splice(at, 1);
+      }
+    }
+    if (base.text.length <= this.maxBaseChars) {
+      heads.unshift(base);
+      this.chars += base.text.length;
+    }
+    while (heads.length > this.maxHeads) {
+      const dropped = heads.pop();
+      if (dropped) this.chars -= dropped.text.length;
+    }
+    this.entries.delete(sessionKey);
+    if (heads.length > 0) this.entries.set(sessionKey, heads);
+    this.evict();
+  }
+  /** Drop a session's heads (eviction, or a write failure invalidating them). */
+  forget(sessionKey) {
+    const heads = this.entries.get(sessionKey);
+    if (!heads) return;
+    for (const head of heads) this.chars -= head.text.length;
+    this.entries.delete(sessionKey);
+  }
+  /** Drop everything (writer disposal / test teardown). */
+  clear() {
+    this.entries.clear();
+    this.chars = 0;
+  }
+  /** Evict least-recently-used sessions until both bounds hold. */
+  evict() {
+    while (this.entries.size > this.maxSessions || this.chars > this.budgetChars && this.entries.size > 1) {
+      const oldest = this.entries.keys().next();
+      if (oldest.done) break;
+      this.forget(oldest.value);
+    }
+  }
+};
+function anchorReason(base, dayDir, delta, nextLength) {
+  if (!base || !delta) return "new";
+  if (base.dayDir !== dayDir) return "day";
+  if (base.chainLen >= ANCHOR_EVERY) return "chain";
+  if (delta.pre < base.text.length * DIVERGED_PREFIX_RATIO) return "diverged";
+  if (delta.ins.length > nextLength * ANCHOR_DELTA_RATIO) return "costly";
+  return null;
 }
-function inferApiFormat(provider) {
-  const hay = `${provider.api_base_url ?? ""} ${provider.name ?? ""}`.toLowerCase();
-  if (hay.includes("anthropic") || hay.includes("claude")) {
-    return { format: "anthropic", ambiguous: false };
+function pickBase(heads, next) {
+  let best = null;
+  for (const base of heads) {
+    const delta = computeBodyDelta(base.text, next);
+    if (best !== null && delta.ins.length >= best.delta.ins.length) continue;
+    best = { base, delta, continues: delta.pre + delta.suf >= base.text.length };
+  }
+  return best;
+}
+function encodeBodyEntry(record, sessionKey, dayDir, cache) {
+  const requestBody = record.requestBody;
+  const responseBody = record.responseBody;
+  if (requestBody === void 0 && responseBody === void 0) return null;
+  const entry = { id: record.id, ts: record.ts };
+  if (requestBody !== void 0) {
+    const heads = cache.get(sessionKey);
+    const sameDay = heads.filter((head) => head.dayDir === dayDir);
+    const chosen = pickBase(sameDay, requestBody);
+    const reason = heads.length > 0 && sameDay.length === 0 ? "day" : anchorReason(chosen?.base, dayDir, chosen?.delta ?? null, requestBody.length);
+    if (reason !== null) {
+      entry.req = { base: null, anchor: reason, pre: 0, suf: 0, ins: requestBody };
+      cache.remember(
+        sessionKey,
+        { dayDir, lastId: record.id, text: requestBody, chainLen: 0 },
+        chosen?.continues === true ? chosen.base.lastId : void 0
+      );
+    } else {
+      const picked = chosen;
+      entry.req = {
+        base: picked.base.lastId,
+        ...picked.continues ? { cont: true } : {},
+        pre: picked.delta.pre,
+        suf: picked.delta.suf,
+        ins: picked.delta.ins
+      };
+      cache.remember(
+        sessionKey,
+        { dayDir, lastId: record.id, text: requestBody, chainLen: picked.base.chainLen + 1 },
+        picked.continues ? picked.base.lastId : void 0
+      );
+    }
   }
-  if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
-    return { format: "gemini", ambiguous: false };
+  if (responseBody !== void 0) entry.res = responseBody;
+  return JSON.stringify(entry);
+}
+function isAuditBodyEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  if (typeof entry["id"] !== "string" || typeof entry["ts"] !== "number") return false;
+  if (entry["res"] !== void 0 && typeof entry["res"] !== "string") return false;
+  const req = entry["req"];
+  if (req === void 0) return true;
+  if (!req || typeof req !== "object" || Array.isArray(req)) return false;
+  const delta = req;
+  if (delta["anchor"] !== void 0 && typeof delta["anchor"] !== "string") return false;
+  if (delta["cont"] !== void 0 && typeof delta["cont"] !== "boolean") return false;
+  return (delta["base"] === null || typeof delta["base"] === "string") && Number.isSafeInteger(delta["pre"]) && delta["pre"] >= 0 && Number.isSafeInteger(delta["suf"]) && delta["suf"] >= 0 && typeof delta["ins"] === "string";
+}
+
+// src/audit/auditDictionary.ts
+import { existsSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// src/audit/auditFiles.ts
+var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+var AUDIT_DAY_DIR_RE = /^audit-(\d{4})-(\d{2})-(\d{2})$/;
+var AUDIT_META_FILE = "meta.jsonl";
+var AUDIT_BODIES_DIR = "bodies";
+var AUDIT_SESSION_KEY_RE = /^[0-9a-f]{8,64}$/;
+var pad2 = (n) => String(n).padStart(2, "0");
+var localDateStamp = (ts) => {
+  const d = new Date(ts);
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}`;
+};
+function auditDayDirName(ts) {
+  return `audit-${localDateStamp(ts)}`;
+}
+function isAuditDayDir(name) {
+  return AUDIT_DAY_DIR_RE.test(name);
+}
+function isSafeSessionKey(key) {
+  return typeof key === "string" && AUDIT_SESSION_KEY_RE.test(key);
+}
+function auditBodyFileName(sessionKey) {
+  return `${sessionKey}.jsonl`;
+}
+function auditFileDateMs(name) {
+  const m = AUDIT_FILE_RE.exec(name) ?? AUDIT_DAY_DIR_RE.exec(name);
+  if (!m) return null;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const d = new Date(year, month - 1, day);
+  if (d.getFullYear() !== year || d.getMonth() !== month - 1 || d.getDate() !== day) {
+    return null;
   }
-  if (hay.includes("/responses")) {
-    return { format: "openai-response", ambiguous: false };
+  return d.getTime();
+}
+
+// src/audit/auditDictionary.ts
+var AUDIT_DICT_FILE = "_dict.jsonl";
+var DICT_BASE_PREFIX = "dict:";
+var DICT_CANDIDATES = 3;
+var MIN_SAVING_RATIO = 0.2;
+function parseEntries(raw) {
+  const entries = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (isAuditBodyEntry(parsed)) entries.push(parsed);
+    } catch {
+    }
   }
-  if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
-    return { format: "openai", ambiguous: false };
+  return entries;
+}
+function plainShards(bodiesPath) {
+  try {
+    return readdirSync(bodiesPath).filter(
+      (file) => file.endsWith(".jsonl") && isSafeSessionKey(file.slice(0, -".jsonl".length))
+    );
+  } catch {
+    return [];
   }
-  return { format: "openai", ambiguous: true };
 }
-function mapProviders(providers, notes) {
-  const rows = [];
-  for (const [i, p] of providers.entries()) {
-    const id = p.name?.trim();
-    if (!id) {
-      notes.push(`Providers[${i}] has no name \u2014 skipped.`);
+function chooseDictionary(anchors) {
+  if (anchors.length < 2) return null;
+  const total = anchors.reduce((sum, body) => sum + body.length, 0);
+  const candidates = [...anchors].sort((a, b) => b.length - a.length).slice(0, DICT_CANDIDATES);
+  let best = null;
+  for (const candidate of candidates) {
+    let cost = candidate.length;
+    for (const body of anchors) {
+      cost += body === candidate ? 0 : computeBodyDelta(candidate, body).ins.length;
+    }
+    if (best === null || cost < best.cost) best = { body: candidate, cost };
+  }
+  if (best === null) return null;
+  return total - best.cost >= total * MIN_SAVING_RATIO ? best.body : null;
+}
+var EMPTY = { shards: 0, anchors: 0, savedBytes: 0 };
+function compactAuditDay(dayPath) {
+  const bodiesPath = join(dayPath, AUDIT_BODIES_DIR);
+  if (!existsSync(bodiesPath)) return EMPTY;
+  const dictPath = join(bodiesPath, AUDIT_DICT_FILE);
+  if (existsSync(dictPath) || existsSync(`${dictPath}.gz`)) return EMPTY;
+  const shardFiles = plainShards(bodiesPath);
+  if (shardFiles.length < 2) return EMPTY;
+  const loaded = /* @__PURE__ */ new Map();
+  const anchors = [];
+  for (const file of shardFiles) {
+    let entries;
+    try {
+      entries = parseEntries(readFileSync(join(bodiesPath, file), "utf8"));
+    } catch {
       continue;
     }
-    const { format, ambiguous } = inferApiFormat(p);
-    if (ambiguous) {
-      notes.push(
-        `Provider '${id}': could not infer apiFormat from base URL \u2014 defaulted to 'openai'. Edit the config if this provider speaks a different wire format.`
-      );
+    loaded.set(file, entries);
+    for (const entry of entries) {
+      if (entry.req && entry.req.base === null) anchors.push(entry.req.ins);
     }
-    rows.push({
-      id,
-      apiFormat: format,
-      baseUrl: p.api_base_url ?? "",
-      apiKey: p.api_key ?? "",
-      models: Array.isArray(p.models) ? p.models : void 0
+  }
+  if (anchors.length < 2) return EMPTY;
+  const dictionary = chooseDictionary(anchors);
+  if (dictionary === null) return EMPTY;
+  const dictEntry = {
+    id: `${DICT_BASE_PREFIX}0`,
+    ts: 0,
+    req: { base: null, anchor: "dict", pre: 0, suf: 0, ins: dictionary }
+  };
+  writeFileSync(dictPath, JSON.stringify(dictEntry) + "\n", "utf8");
+  const result = { shards: 0, anchors: 0, savedBytes: 0 };
+  for (const [file, entries] of loaded) {
+    let changed = false;
+    let saved = 0;
+    const rewritten = entries.map((entry) => {
+      if (!entry.req || entry.req.base !== null || entry.req.ins === dictionary) return entry;
+      const delta = computeBodyDelta(dictionary, entry.req.ins);
+      if (delta.ins.length >= entry.req.ins.length) return entry;
+      changed = true;
+      saved += entry.req.ins.length - delta.ins.length;
+      return {
+        ...entry,
+        req: { base: dictEntry.id, pre: delta.pre, suf: delta.suf, ins: delta.ins }
+      };
     });
+    if (!changed) continue;
+    const target = join(bodiesPath, file);
+    const temp = `${target}.compacting`;
+    try {
+      writeFileSync(temp, rewritten.map((e) => JSON.stringify(e)).join("\n") + "\n", "utf8");
+      renameSync(temp, target);
+    } catch {
+      try {
+        if (existsSync(temp)) unlinkSync(temp);
+      } catch {
+      }
+      continue;
+    }
+    result.shards += 1;
+    result.anchors += rewritten.filter((e) => e.req?.base === dictEntry.id).length;
+    result.savedBytes += saved;
   }
-  return rows;
+  if (result.shards === 0) {
+    try {
+      unlinkSync(dictPath);
+    } catch {
+    }
+  }
+  return result;
 }
-function noteRouterRoles(router, notes) {
-  if (router.think) {
-    notes.push(`Router.think \u2192 folded into 'default' (omnicross has no think slot).`);
+function compactAllClosedAuditDays(auditDir, now = Date.now) {
+  const run = { days: 0, shards: 0, savedBytes: 0 };
+  if (!existsSync(auditDir)) return run;
+  const today = auditDayDirName(now());
+  let names;
+  try {
+    names = readdirSync(auditDir).filter(isAuditDayDir).sort();
+  } catch {
+    return run;
   }
-  if (router.longContext) {
-    notes.push(
-      `Router.longContext \u2192 folded into 'default' (no longContext slot; longContextThreshold dropped).`
-    );
+  for (const name of names) {
+    if (name === today) continue;
+    try {
+      const result = compactAuditDay(join(auditDir, name));
+      if (result.shards === 0) continue;
+      run.days += 1;
+      run.shards += result.shards;
+      run.savedBytes += result.savedBytes;
+    } catch {
+    }
   }
-  if (router.image) {
-    notes.push(`Router.image \u2192 mapped to 'vision' (CCR forceUseImageAgent dropped).`);
+  return run;
+}
+
+// src/audit/auditJsonl.ts
+import { closeSync, openSync, readSync, statSync } from "fs";
+var WINDOW_BYTES = 1 << 20;
+var MAX_LINE_BYTES = 32 * 1024 * 1024;
+var NEWLINE = 10;
+function forEachLineFromTail(path2, onLine) {
+  let fd;
+  let end;
+  try {
+    end = statSync(path2).size;
+    if (end === 0) return;
+    fd = openSync(path2, "r");
+  } catch {
+    return;
   }
-  if (router.webSearch) {
-    notes.push(
-      `Router.webSearch \u2192 DROPPED. omnicross injects web search via an interception port rather than routing to a natively-online model; the CCR webSearch model ('${router.webSearch}') was not carried over.`
-    );
+  try {
+    let carry = Buffer.alloc(0);
+    while (end > 0) {
+      const start = Math.max(0, end - WINDOW_BYTES);
+      const window = Buffer.allocUnsafe(end - start);
+      let read;
+      try {
+        read = readSync(fd, window, 0, end - start, start);
+      } catch {
+        return;
+      }
+      const chunk = carry.length > 0 ? Buffer.concat([window.subarray(0, read), carry]) : window.subarray(0, read);
+      let lineEnd = chunk.length;
+      let nl = lineEnd > 0 ? chunk.lastIndexOf(NEWLINE, lineEnd - 1) : -1;
+      while (nl >= 0) {
+        if (nl + 1 < lineEnd) {
+          const line = chunk.subarray(nl + 1, lineEnd).toString("utf8").trim();
+          if (line && onLine(line)) return;
+        }
+        lineEnd = nl;
+        nl = lineEnd > 0 ? chunk.lastIndexOf(NEWLINE, lineEnd - 1) : -1;
+      }
+      if (start === 0) {
+        if (lineEnd > 0) {
+          const line = chunk.subarray(0, lineEnd).toString("utf8").trim();
+          if (line) onLine(line);
+        }
+        return;
+      }
+      if (lineEnd > MAX_LINE_BYTES) return;
+      carry = Buffer.from(chunk.subarray(0, lineEnd));
+      end = start;
+    }
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+    }
   }
 }
-function mapCcrToOmnicross(ccr) {
-  const notes = [];
-  const providers = mapProviders(ccr.Providers ?? [], notes);
-  noteRouterRoles(ccr.Router ?? {}, notes);
-  return { config: { providers }, notes };
+
+// src/audit/auditBodyReader.ts
+function candidateDays(auditDir, ts) {
+  if (typeof ts === "number" && Number.isFinite(ts)) {
+    const named = auditDayDirName(ts);
+    if (existsSync2(join2(auditDir, named))) return [named];
+  }
+  try {
+    return readdirSync2(auditDir).filter(isAuditDayDir).sort().reverse();
+  } catch {
+    return [];
+  }
+}
+function readShard(auditDir, day, sessionKey) {
+  const base = join2(auditDir, day, AUDIT_BODIES_DIR, auditBodyFileName(sessionKey));
+  try {
+    if (existsSync2(base)) return readFileSync2(base, "utf8");
+    const gz = `${base}.gz`;
+    if (existsSync2(gz)) return gunzipSync(readFileSync2(gz)).toString("utf8");
+  } catch {
+    return null;
+  }
+  return null;
+}
+function parseShard(raw) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (isAuditBodyEntry(parsed)) entries.set(parsed.id, parsed);
+  }
+  return entries;
+}
+function withDictionary(auditDir, day, entries) {
+  let needed = false;
+  for (const entry of entries.values()) {
+    if (entry.req?.base?.startsWith(DICT_BASE_PREFIX)) {
+      needed = true;
+      break;
+    }
+  }
+  if (!needed) return entries;
+  const base = join2(auditDir, day, AUDIT_BODIES_DIR, AUDIT_DICT_FILE);
+  let raw = null;
+  try {
+    if (existsSync2(base)) raw = readFileSync2(base, "utf8");
+    else if (existsSync2(`${base}.gz`)) raw = gunzipSync(readFileSync2(`${base}.gz`)).toString("utf8");
+  } catch {
+    return entries;
+  }
+  if (raw === null) return entries;
+  for (const [id, entry] of parseShard(raw)) entries.set(id, entry);
+  return entries;
+}
+function reconstructRequest(entries, entry) {
+  if (!entry.req) return void 0;
+  const chain = [];
+  const visited = /* @__PURE__ */ new Set();
+  let cursor = entry;
+  while (cursor?.req) {
+    if (visited.has(cursor.id)) return void 0;
+    visited.add(cursor.id);
+    chain.push(cursor);
+    if (cursor.req.base === null) break;
+    cursor = entries.get(cursor.req.base);
+  }
+  const anchor = chain[chain.length - 1];
+  if (!anchor?.req || anchor.req.base !== null) return void 0;
+  let text = anchor.req.ins;
+  for (let i = chain.length - 2; i >= 0; i -= 1) {
+    const delta = chain[i]?.req;
+    if (!delta) return void 0;
+    if (delta.pre > text.length || delta.suf > text.length - delta.pre) return void 0;
+    text = applyBodyDelta(text, delta);
+  }
+  return text;
+}
+function assignStreams(entries) {
+  const rootOf = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    const seen = /* @__PURE__ */ new Set();
+    let cursor = entry;
+    while (cursor?.req?.cont === true && cursor.req.base !== null && !seen.has(cursor.id)) {
+      seen.add(cursor.id);
+      const next = entries.get(cursor.req.base);
+      if (!next) break;
+      cursor = next;
+    }
+    rootOf.set(entry.id, cursor?.id ?? entry.id);
+  }
+  const firstTs = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    const root = rootOf.get(entry.id);
+    const known = firstTs.get(root);
+    if (known === void 0 || entry.ts < known) firstTs.set(root, entry.ts);
+  }
+  const order = [...firstTs.entries()].sort((a, b) => a[1] - b[1]).map(([root]) => root);
+  const index = new Map(order.map((root, i) => [root, i]));
+  const streams = /* @__PURE__ */ new Map();
+  for (const entry of entries.values()) {
+    streams.set(entry.id, index.get(rootOf.get(entry.id)) ?? 0);
+  }
+  return streams;
+}
+function readAuditBody(auditDir, query2) {
+  if (!isSafeSessionKey(query2.sessionKey) || !query2.id) return {};
+  if (!existsSync2(auditDir)) return {};
+  for (const day of candidateDays(auditDir, query2.ts)) {
+    const raw = readShard(auditDir, day, query2.sessionKey);
+    if (raw === null) continue;
+    const entries = withDictionary(auditDir, day, parseShard(raw));
+    const entry = entries.get(query2.id);
+    if (!entry) continue;
+    const result = {};
+    const requestBody = reconstructRequest(entries, entry);
+    if (requestBody !== void 0) result.requestBody = requestBody;
+    if (entry.res !== void 0) result.responseBody = entry.res;
+    return result;
+  }
+  return readLegacyInlineBody(auditDir, query2.id);
+}
+function readLegacyInlineBody(auditDir, id) {
+  let names;
+  try {
+    names = readdirSync2(auditDir).filter((name) => AUDIT_FILE_RE.test(name)).sort().reverse();
+  } catch {
+    return {};
+  }
+  const needle = JSON.stringify(id);
+  let found = {};
+  for (const name of names) {
+    forEachLineFromTail(join2(auditDir, name), (line) => {
+      if (!line.includes(needle)) return false;
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        return false;
+      }
+      const record = parsed;
+      if (record.id !== id) return false;
+      const result = {};
+      if (typeof record.requestBody === "string") result.requestBody = record.requestBody;
+      if (typeof record.responseBody === "string") result.responseBody = record.responseBody;
+      found = result;
+      return true;
+    });
+    if (found.requestBody !== void 0 || found.responseBody !== void 0) break;
+  }
+  return found;
+}
+function readAuditSessionTurns(auditDir, sessionKey, ts) {
+  if (!isSafeSessionKey(sessionKey) || !existsSync2(auditDir)) return [];
+  for (const day of candidateDays(auditDir, ts)) {
+    const raw = readShard(auditDir, day, sessionKey);
+    if (raw === null) continue;
+    const shardEntries = parseShard(raw);
+    const streams = assignStreams(shardEntries);
+    const entries = withDictionary(auditDir, day, shardEntries);
+    const turns = [];
+    for (const entry of entries.values()) {
+      if (entry.id.startsWith(DICT_BASE_PREFIX)) continue;
+      const turn = { id: entry.id, ts: entry.ts, stream: streams.get(entry.id) ?? 0 };
+      if (entry.req?.anchor === "diverged") turn.diverged = true;
+      const requestBody = reconstructRequest(entries, entry);
+      if (requestBody !== void 0) turn.requestBody = requestBody;
+      if (entry.res !== void 0) turn.responseBody = entry.res;
+      turns.push(turn);
+    }
+    turns.sort((a, b) => a.stream === b.stream ? a.ts - b.ts : a.stream - b.stream);
+    return turns;
+  }
+  return [];
+}
+function listAuditSessions(auditDir, ts) {
+  if (!existsSync2(auditDir)) return [];
+  const summaries = [];
+  for (const day of candidateDays(auditDir, ts)) {
+    const bodiesPath = join2(auditDir, day, AUDIT_BODIES_DIR);
+    let files;
+    try {
+      files = readdirSync2(bodiesPath);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const compressed = file.endsWith(".jsonl.gz");
+      const sessionKey = file.replace(/\.jsonl(\.gz)?$/, "");
+      if (!isSafeSessionKey(sessionKey) || !compressed && !file.endsWith(".jsonl")) continue;
+      let bytes = 0;
+      try {
+        bytes = statSync2(join2(bodiesPath, file)).size;
+      } catch {
+        continue;
+      }
+      const raw = readShard(auditDir, day, sessionKey);
+      const turns = raw === null ? 0 : parseShard(raw).size;
+      summaries.push({ sessionKey, day, turns, bytes, compressed });
+    }
+  }
+  summaries.sort((a, b) => a.day === b.day ? b.bytes - a.bytes : a.day < b.day ? 1 : -1);
+  return summaries;
 }
 
-// src/config.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+// src/commands/paths.ts
+import { dirname as dirname2, join as join4 } from "path";
 
 // src/secrets/envelope.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -139,13 +686,13 @@ function decryptValue(envelope, key) {
 
 // src/secrets/masterKey.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join3 } from "path";
 var MASTER_KEY_ENV = "OMNICROSS_MASTER_KEY";
 var KEY_BYTES2 = 32;
 function defaultMasterKeyPath() {
-  return join(homedir(), ".omnicross", "master.key");
+  return join3(homedir(), ".omnicross", "master.key");
 }
 function decodeEnvKey(raw) {
   const trimmed = raw.trim();
@@ -161,7 +708,7 @@ function decodeEnvKey(raw) {
   return buf;
 }
 function readKeyFile(path2) {
-  const raw = readFileSync(path2);
+  const raw = readFileSync3(path2);
   if (raw.length === KEY_BYTES2) return raw;
   const text = raw.toString("utf8").trim();
   if (/^[0-9a-fA-F]{64}$/.test(text)) return Buffer.from(text, "hex");
@@ -174,7 +721,7 @@ function readKeyFile(path2) {
 function generateKeyFile(path2) {
   const key = randomBytes2(KEY_BYTES2);
   mkdirSync(dirname(path2), { recursive: true });
-  writeFileSync(path2, key, { mode: 384 });
+  writeFileSync2(path2, key, { mode: 384 });
   try {
     chmodSync(path2, 384);
   } catch {
@@ -187,7 +734,7 @@ function resolveMasterKey(options = {}) {
     return decodeEnvKey(envRaw);
   }
   const keyFilePath = options.keyFilePath ?? defaultMasterKeyPath();
-  if (existsSync(keyFilePath)) {
+  if (existsSync3(keyFilePath)) {
     return readKeyFile(keyFilePath);
   }
   return generateKeyFile(keyFilePath);
@@ -403,39 +950,266 @@ function transformTokens(tokens, fn) {
     if (block && typeof block === "object" && !Array.isArray(block)) {
       bag[provider] = transformTokenBlock(block, fields, fn);
     }
-    const accountsKey = `${provider}Accounts`;
-    const accounts = bag[accountsKey];
-    if (Array.isArray(accounts)) {
-      bag[accountsKey] = accounts.map((entry) => {
-        if (entry && typeof entry === "object" && "tokens" in entry && entry.tokens && typeof entry.tokens === "object") {
-          const nextEntry = {
-            ...entry,
-            tokens: transformTokenBlock(
-              entry.tokens,
-              fields,
-              fn
-            )
-          };
-          const proxy = entry.proxy;
-          if (proxy && typeof proxy === "object") {
-            nextEntry.proxy = transformProxyConfig(proxy, fn);
-          }
-          return nextEntry;
-        }
-        return entry;
-      });
+    const accountsKey = `${provider}Accounts`;
+    const accounts = bag[accountsKey];
+    if (Array.isArray(accounts)) {
+      bag[accountsKey] = accounts.map((entry) => {
+        if (entry && typeof entry === "object" && "tokens" in entry && entry.tokens && typeof entry.tokens === "object") {
+          const nextEntry = {
+            ...entry,
+            tokens: transformTokenBlock(
+              entry.tokens,
+              fields,
+              fn
+            )
+          };
+          const proxy = entry.proxy;
+          if (proxy && typeof proxy === "object") {
+            nextEntry.proxy = transformProxyConfig(proxy, fn);
+          }
+          return nextEntry;
+        }
+        return entry;
+      });
+    }
+  }
+  return next;
+}
+function encryptTokens(tokens, box) {
+  return transformTokens(tokens, (v) => box.encryptMaybe(v));
+}
+function decryptTokens(tokens, box) {
+  return transformTokens(tokens, (v) => box.decryptMaybe(v));
+}
+
+// src/commands/paths.ts
+function defaultKeysPath(configPath) {
+  return join4(dirname2(configPath), "keys.json");
+}
+function defaultVouchersPath(configPath) {
+  return join4(dirname2(configPath), "vouchers.json");
+}
+function defaultTokensPath(configPath) {
+  return join4(dirname2(configPath), "tokens.json");
+}
+function defaultIntegrationsPath(configPath) {
+  return join4(dirname2(configPath), "integrations.json");
+}
+function defaultPricingPath(configPath) {
+  return join4(dirname2(configPath), "pricing.json");
+}
+function defaultPricingRefreshStatePath(configPath) {
+  return join4(dirname2(configPath), "pricing-refresh.json");
+}
+function defaultAccountAllowancePath(configPath) {
+  return join4(dirname2(configPath), "allowance-cache.json");
+}
+function defaultUsageEventsPath(configPath) {
+  return join4(dirname2(configPath), "usage-events.jsonl");
+}
+function defaultAuditDir(configPath) {
+  return join4(dirname2(configPath), "audit");
+}
+function defaultBillingDir(configPath) {
+  return join4(dirname2(configPath), "billing");
+}
+function resolveSecretBox(masterKeyFilePath) {
+  return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
+}
+
+// src/commands/audit.ts
+function parseDate(value) {
+  if (!value) return void 0;
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value.trim());
+  if (!m) throw new Error(`audit: --date must be YYYY-MM-DD (got ${value})`);
+  const d = new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
+  return d.getTime();
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function runAudit(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    options: {
+      config: { type: "string", short: "c" },
+      session: { type: "string", short: "s" },
+      date: { type: "string", short: "d" },
+      id: { type: "string" }
+    },
+    allowPositionals: true
+  });
+  const configPath = values.config;
+  if (!configPath) throw new Error("audit: --config <path> is required");
+  const auditDir = defaultAuditDir(configPath);
+  const ts = parseDate(values.date);
+  const action = positionals[0];
+  if (action === "sessions") {
+    const sessions2 = listAuditSessions(auditDir, ts);
+    if (sessions2.length === 0) {
+      console.info("No audit body shards found. Is `captureBodies` enabled?");
+      return;
+    }
+    console.info(["DAY", "SESSION", "TURNS", "SIZE", "ARCHIVED"].join("	"));
+    for (const s of sessions2) {
+      console.info(
+        [s.day, s.sessionKey, String(s.turns), formatBytes(s.bytes), s.compressed ? "gz" : "-"].join("	")
+      );
+    }
+    return;
+  }
+  if (action === "show") {
+    const sessionKey = values.session;
+    if (!sessionKey) throw new Error("audit show: --session <key> is required");
+    if (values.id) {
+      const body = readAuditBody(auditDir, { id: values.id, sessionKey, ...ts !== void 0 ? { ts } : {} });
+      if (body.requestBody === void 0 && body.responseBody === void 0) {
+        throw new Error(`audit show: no body found for record ${values.id}`);
+      }
+      if (body.requestBody !== void 0) console.info(`--- request ${values.id} ---
+${body.requestBody}`);
+      if (body.responseBody !== void 0) console.info(`--- response ${values.id} ---
+${body.responseBody}`);
+      return;
+    }
+    const turns = readAuditSessionTurns(auditDir, sessionKey, ts);
+    if (turns.length === 0) throw new Error(`audit show: no shard found for session ${sessionKey}`);
+    let stream = -1;
+    for (const turn of turns) {
+      const when = new Date(turn.ts).toISOString();
+      if (turn.stream !== stream) {
+        stream = turn.stream;
+        console.info(`
+########## stream ${stream} ##########`);
+      }
+      if (turn.diverged) {
+        console.info("=== prefix diverged here (system prompt changed, or a restart reused this session) ===");
+      }
+      if (turn.requestBody !== void 0) {
+        console.info(`--- request ${turn.id} @ ${when} ---
+${turn.requestBody}`);
+      }
+      if (turn.responseBody !== void 0) {
+        console.info(`--- response ${turn.id} @ ${when} ---
+${turn.responseBody}`);
+      }
+    }
+    return;
+  }
+  if (action === "compact") {
+    const todayDir = auditDayDirName(Date.now());
+    let names;
+    try {
+      names = readdirSync3(auditDir).filter(isAuditDayDir).sort();
+    } catch {
+      names = [];
+    }
+    const targets = ts !== void 0 ? names.filter((name) => name === auditDayDirName(ts)) : names.filter((name) => name !== todayDir);
+    if (targets.length === 0) {
+      console.info("Nothing to compact (today is skipped; a day is compacted once).");
+      return;
+    }
+    let shards = 0;
+    let saved = 0;
+    for (const name of targets) {
+      if (name === todayDir) {
+        console.info(`Skipping ${name}: the current day is still being written.`);
+        continue;
+      }
+      const result = compactAuditDay(join5(auditDir, name));
+      shards += result.shards;
+      saved += result.savedBytes;
+      console.info(`${name}: ${result.shards} shard(s), ${result.anchors} anchor(s), ${formatBytes(result.savedBytes)} saved`);
+    }
+    console.info(`Done: ${shards} shard(s) rewritten, ${formatBytes(saved)} saved.`);
+    return;
+  }
+  throw new Error("audit: expected `sessions`, `show`, or `compact` (see `omnicross help`)");
+}
+
+// src/commands/import-ccr.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { parseArgs as parseArgs2 } from "util";
+
+// src/ccr-import.ts
+function parseCcrConfig(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("CCR config: top-level value must be an object");
+  }
+  const obj = raw;
+  const Providers = Array.isArray(obj["Providers"]) ? obj["Providers"] : [];
+  const Router = obj["Router"] && typeof obj["Router"] === "object" ? obj["Router"] : {};
+  return { Providers, Router };
+}
+function inferApiFormat(provider) {
+  const hay = `${provider.api_base_url ?? ""} ${provider.name ?? ""}`.toLowerCase();
+  if (hay.includes("anthropic") || hay.includes("claude")) {
+    return { format: "anthropic", ambiguous: false };
+  }
+  if (hay.includes("generativelanguage") || hay.includes("gemini") || hay.includes("google")) {
+    return { format: "gemini", ambiguous: false };
+  }
+  if (hay.includes("/responses")) {
+    return { format: "openai-response", ambiguous: false };
+  }
+  if (hay.includes("openai") || hay.includes("/v1") || hay.includes("chat/completions")) {
+    return { format: "openai", ambiguous: false };
+  }
+  return { format: "openai", ambiguous: true };
+}
+function mapProviders(providers, notes) {
+  const rows = [];
+  for (const [i, p] of providers.entries()) {
+    const id = p.name?.trim();
+    if (!id) {
+      notes.push(`Providers[${i}] has no name \u2014 skipped.`);
+      continue;
+    }
+    const { format, ambiguous } = inferApiFormat(p);
+    if (ambiguous) {
+      notes.push(
+        `Provider '${id}': could not infer apiFormat from base URL \u2014 defaulted to 'openai'. Edit the config if this provider speaks a different wire format.`
+      );
     }
+    rows.push({
+      id,
+      apiFormat: format,
+      baseUrl: p.api_base_url ?? "",
+      apiKey: p.api_key ?? "",
+      models: Array.isArray(p.models) ? p.models : void 0
+    });
   }
-  return next;
+  return rows;
 }
-function encryptTokens(tokens, box) {
-  return transformTokens(tokens, (v) => box.encryptMaybe(v));
+function noteRouterRoles(router, notes) {
+  if (router.think) {
+    notes.push(`Router.think \u2192 folded into 'default' (omnicross has no think slot).`);
+  }
+  if (router.longContext) {
+    notes.push(
+      `Router.longContext \u2192 folded into 'default' (no longContext slot; longContextThreshold dropped).`
+    );
+  }
+  if (router.image) {
+    notes.push(`Router.image \u2192 mapped to 'vision' (CCR forceUseImageAgent dropped).`);
+  }
+  if (router.webSearch) {
+    notes.push(
+      `Router.webSearch \u2192 DROPPED. omnicross injects web search via an interception port rather than routing to a natively-online model; the CCR webSearch model ('${router.webSearch}') was not carried over.`
+    );
+  }
 }
-function decryptTokens(tokens, box) {
-  return transformTokens(tokens, (v) => box.decryptMaybe(v));
+function mapCcrToOmnicross(ccr) {
+  const notes = [];
+  const providers = mapProviders(ccr.Providers ?? [], notes);
+  noteRouterRoles(ccr.Router ?? {}, notes);
+  return { config: { providers }, notes };
 }
 
 // src/config.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 var DEFAULT_ADMIN_PORT = 8766;
 function validateAdmin(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -728,7 +1502,7 @@ function setSecretBox(box) {
 function loadConfig(path2) {
   let raw;
   try {
-    raw = readFileSync2(path2, "utf8");
+    raw = readFileSync4(path2, "utf8");
   } catch {
     throw new Error(`config: cannot read file at '${path2}'`);
   }
@@ -743,48 +1517,12 @@ function loadConfig(path2) {
 }
 function saveConfig(path2, cfg) {
   const toWrite = secretBox ? encryptConfigSecrets(cfg, secretBox) : cfg;
-  writeFileSync2(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
-}
-
-// src/commands/paths.ts
-import { dirname as dirname2, join as join2 } from "path";
-function defaultKeysPath(configPath) {
-  return join2(dirname2(configPath), "keys.json");
-}
-function defaultVouchersPath(configPath) {
-  return join2(dirname2(configPath), "vouchers.json");
-}
-function defaultTokensPath(configPath) {
-  return join2(dirname2(configPath), "tokens.json");
-}
-function defaultIntegrationsPath(configPath) {
-  return join2(dirname2(configPath), "integrations.json");
-}
-function defaultPricingPath(configPath) {
-  return join2(dirname2(configPath), "pricing.json");
-}
-function defaultPricingRefreshStatePath(configPath) {
-  return join2(dirname2(configPath), "pricing-refresh.json");
-}
-function defaultAccountAllowancePath(configPath) {
-  return join2(dirname2(configPath), "allowance-cache.json");
-}
-function defaultUsageEventsPath(configPath) {
-  return join2(dirname2(configPath), "usage-events.jsonl");
-}
-function defaultAuditDir(configPath) {
-  return join2(dirname2(configPath), "audit");
-}
-function defaultBillingDir(configPath) {
-  return join2(dirname2(configPath), "billing");
-}
-function resolveSecretBox(masterKeyFilePath) {
-  return new SecretBox(() => resolveMasterKey({ keyFilePath: masterKeyFilePath }));
+  writeFileSync3(path2, JSON.stringify(toWrite, null, 2) + "\n", "utf8");
 }
 
 // src/commands/import-ccr.ts
 async function runImportCcr(argv) {
-  const { values, positionals } = parseArgs({
+  const { values, positionals } = parseArgs2({
     args: argv,
     options: {
       out: { type: "string", short: "o" },
@@ -799,7 +1537,7 @@ async function runImportCcr(argv) {
   const outPath = values.out ?? "omnicross.config.json";
   let raw;
   try {
-    raw = JSON.parse(readFileSync3(ccrPath, "utf8"));
+    raw = JSON.parse(readFileSync5(ccrPath, "utf8"));
   } catch {
     throw new Error(`import-ccr: cannot read or parse '${ccrPath}'`);
   }
@@ -821,24 +1559,24 @@ async function runImportCcr(argv) {
 
 // src/commands/integrations.ts
 import { resolve as resolve2 } from "path";
-import { parseArgs as parseArgs2 } from "util";
+import { parseArgs as parseArgs3 } from "util";
 
 // src/integrations/IntegrationManager.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync5, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join3, resolve } from "path";
+import { dirname as dirname4, join as join6, resolve } from "path";
 import { createIntegrationKey } from "@omnicross/core";
 
 // src/integrations/IntegrationStateStore.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync2,
+  existsSync as existsSync4,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync,
-  unlinkSync,
-  writeFileSync as writeFileSync3
+  readFileSync as readFileSync6,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync4
 } from "fs";
 import { dirname as dirname3 } from "path";
 var EMPTY_STATE = { version: 1, clients: {} };
@@ -850,10 +1588,10 @@ var IntegrationStateStore = class {
   path;
   box;
   load() {
-    if (!existsSync2(this.path)) return { ...EMPTY_STATE, clients: {} };
+    if (!existsSync4(this.path)) return { ...EMPTY_STATE, clients: {} };
     let raw;
     try {
-      raw = JSON.parse(readFileSync4(this.path, "utf8"));
+      raw = JSON.parse(readFileSync6(this.path, "utf8"));
     } catch {
       throw new Error(`integration state '${this.path}' is not valid JSON`);
     }
@@ -923,17 +1661,17 @@ function isManagedFileRecord(value) {
 function atomicWrite(path2, content) {
   mkdirSync2(dirname3(path2), { recursive: true });
   const temp = `${path2}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync3(temp, content, { encoding: "utf8", mode: 384 });
+  writeFileSync4(temp, content, { encoding: "utf8", mode: 384 });
   try {
-    renameSync(temp, path2);
+    renameSync2(temp, path2);
   } catch (error) {
     try {
-      unlinkSync(temp);
+      unlinkSync2(temp);
     } catch {
     }
     throw error;
   } finally {
-    if (existsSync2(path2)) {
+    if (existsSync4(path2)) {
       try {
         chmodSync2(path2, 384);
       } catch {
@@ -1427,10 +2165,10 @@ var IntegrationManager = class {
     };
   }
   defaultConfigPath(client) {
-    return client === "codex" ? join3(this.homeDir, ".codex", "config.toml") : join3(this.homeDir, ".claude", "settings.json");
+    return client === "codex" ? join6(this.homeDir, ".codex", "config.toml") : join6(this.homeDir, ".claude", "settings.json");
   }
   codexAuthPathForConfig(configPath) {
-    return join3(dirname4(configPath), "auth.json");
+    return join6(dirname4(configPath), "auth.json");
   }
   renderInstalled(client, base, secret) {
     if (client === "claude") {
@@ -1443,7 +2181,7 @@ var IntegrationManager = class {
   }
 };
 function readOptional(path2) {
-  return existsSync3(path2) ? readFileSync5(path2, "utf8") : null;
+  return existsSync5(path2) ? readFileSync7(path2, "utf8") : null;
 }
 function sha256(value) {
   return createHash("sha256").update(value, "utf8").digest("hex");
@@ -1507,7 +2245,7 @@ function writeOptional(path2, content) {
     atomicWrite(path2, content);
     return;
   }
-  if (existsSync3(path2)) unlinkSync2(path2);
+  if (existsSync5(path2)) unlinkSync3(path2);
 }
 function assertLoopbackGatewayUrl(value) {
   let url;
@@ -1524,7 +2262,7 @@ function assertLoopbackGatewayUrl(value) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
 var JsonOutboundKeyDb = class {
   /**
    * @param secretBox OPTIONAL reversible-secret codec. When present, a created
@@ -1657,16 +2395,16 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync4(this.keysPath)) return [];
+    if (!existsSync6(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync6(this.keysPath, "utf8"));
+      const parsed = JSON.parse(readFileSync8(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    writeFileSync4(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    writeFileSync5(this.keysPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 function applyPolicyField(row, field, value) {
@@ -1677,7 +2415,7 @@ function applyPolicyField(row, field, value) {
 
 // src/commands/integrations.ts
 async function runIntegrations(argv) {
-  const { values, positionals } = parseArgs2({
+  const { values, positionals } = parseArgs3({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -1727,10 +2465,10 @@ function isClient(value) {
 }
 
 // src/commands/keys.ts
-import { parseArgs as parseArgs3 } from "util";
+import { parseArgs as parseArgs4 } from "util";
 import { createNamedKey } from "@omnicross/core/outbound-api";
 async function runKeys(argv) {
-  const { values, positionals } = parseArgs3({
+  const { values, positionals } = parseArgs4({
     args: argv,
     options: { config: { type: "string", short: "c" } },
     allowPositionals: true
@@ -1784,9 +2522,9 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync20 } from "fs";
-import { delimiter as delimiter2, join as join12 } from "path";
-import { parseArgs as parseArgs4 } from "util";
+import { existsSync as existsSync22 } from "fs";
+import { delimiter as delimiter2, join as join15 } from "path";
+import { parseArgs as parseArgs5 } from "util";
 import {
   buildChatCliLaunchConfig as buildChatCliLaunchConfig2,
   buildGeminiCliLaunchConfig as buildGeminiCliLaunchConfig2
@@ -1794,7 +2532,7 @@ import {
 import { ROUTE_LEASE_REQUEST_SCHEMA as ROUTE_LEASE_REQUEST_SCHEMA2 } from "@omnicross/core/provider-proxy";
 
 // src/bootstrap.ts
-import { accessSync, constants as fsConstants, existsSync as existsSync19 } from "fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync21 } from "fs";
 import { DEFAULT_AUDIT_CONFIG } from "@omnicross/contracts/audit-types";
 import { DEFAULT_BILLING_CONFIG } from "@omnicross/contracts/billing-types";
 import { getGeminiCodeAssistProjectResolver } from "@omnicross/core/auth/GeminiCodeAssistProjectResolver";
@@ -1828,7 +2566,12 @@ import {
 } from "@omnicross/core/provider-proxy";
 import { routeLeaseDescriptorPort } from "@omnicross/cli-launcher";
 import { KeySpendTracker } from "@omnicross/core/outbound-api";
-import { PricingEngine, UsageRecorder } from "@omnicross/core/usage";
+import {
+  __resetSharedUsageThroughputTrackerForTests,
+  getSharedUsageThroughputTracker as getSharedUsageThroughputTracker2,
+  PricingEngine,
+  UsageRecorder
+} from "@omnicross/core/usage";
 import {
   setSubscriptionAccountService,
   setSubscriptionProviderRegistry,
@@ -2335,13 +3078,13 @@ var ClaudeAllowanceRefreshScheduler = class {
 // src/allowance/JsonAccountAllowancePersistence.ts
 import { randomUUID } from "crypto";
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync7,
-  renameSync as renameSync2,
+  readFileSync as readFileSync9,
+  renameSync as renameSync3,
   rmSync,
-  statSync,
-  writeFileSync as writeFileSync5
+  statSync as statSync3,
+  writeFileSync as writeFileSync6
 } from "fs";
 import { dirname as dirname5 } from "path";
 import { normalizeAccountAllowanceSnapshot } from "@omnicross/core/pipeline/AccountAllowanceStore";
@@ -2355,10 +3098,10 @@ var JsonAccountAllowancePersistence = class {
   cachePath;
   /** Read only the `snapshots` payload; all row validation remains defensive. */
   load() {
-    if (!existsSync5(this.cachePath)) return [];
+    if (!existsSync7(this.cachePath)) return [];
     try {
-      if (statSync(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
-      const raw = readFileSync7(this.cachePath, "utf8");
+      if (statSync3(this.cachePath).size > MAX_ALLOWANCE_CACHE_BYTES) return [];
+      const raw = readFileSync9(this.cachePath, "utf8");
       if (!raw.trim()) return [];
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed)) return parsed;
@@ -2389,8 +3132,8 @@ var JsonAccountAllowancePersistence = class {
     mkdirSync3(dirname5(this.cachePath), { recursive: true });
     const temporaryPath = `${this.cachePath}.${process.pid}.${randomUUID()}.tmp`;
     try {
-      writeFileSync5(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
-      renameSync2(temporaryPath, this.cachePath);
+      writeFileSync6(temporaryPath, serialized, { encoding: "utf8", flag: "wx" });
+      renameSync3(temporaryPath, this.cachePath);
     } finally {
       rmSync(temporaryPath, { force: true });
     }
@@ -2432,6 +3175,37 @@ function handleAuditQuery(req, res, reader) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ records }));
 }
+function handleAuditBodyQuery(req, res, reader) {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const id = url.searchParams.get("id")?.trim();
+  const sessionKey = url.searchParams.get("session")?.trim();
+  if (!id || !sessionKey) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "id and session are required" }));
+    return;
+  }
+  const query2 = { id, sessionKey };
+  const ts = intParam(url.searchParams.get("ts"));
+  if (ts !== void 0) query2.ts = ts;
+  const body = reader ? reader(query2) : {};
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function handleAuditCompact(res, compact) {
+  if (!compact) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ days: 0, shards: 0, savedBytes: 0 }));
+    return;
+  }
+  try {
+    const result = compact();
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(result));
+  } catch (error) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: error instanceof Error ? error.message : "compaction failed" }));
+  }
+}
 async function handleAuditStatsQuery(req, res, reader) {
   const url = new URL(req.url ?? "/", "http://localhost");
   const query2 = {};
@@ -3177,10 +3951,10 @@ async function exchangeGemini(code, codeVerifier, exchangeFetch) {
 // src/admin/cliLaunch.ts
 import { exec, spawn } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync6, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync8, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import { createServer } from "net";
 import { tmpdir } from "os";
-import { delimiter, join as join4 } from "path";
+import { delimiter, join as join7 } from "path";
 import {
   buildChatCliLaunchConfig,
   buildClaudeCliLaunchConfig,
@@ -3237,8 +4011,8 @@ function isLaunchCliId(id) {
 function probeDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
   for (const seg of segments) {
-    const full = join4(seg, candidate);
-    if (existsSync6(full)) return full;
+    const full = join7(seg, candidate);
+    if (existsSync8(full)) return full;
   }
   return null;
 }
@@ -3342,10 +4116,10 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
   const runLine = [command, ...extraArgs].map(shq).join(" ");
   const script = `${cwd ? `cd ${shq(cwd)}; ` : ""}${runLine}`;
   if (platform === "darwin") {
-    const launchDir = mkdtempSync(join4(tmpdir(), "omnicross-terminal-"));
-    const commandFile = join4(launchDir, "launch.command");
-    const bootstrapFile = join4(launchDir, "bootstrap.cjs");
-    const socketPath = macIpc.socketPath ?? join4(launchDir, "descriptor.sock");
+    const launchDir = mkdtempSync(join7(tmpdir(), "omnicross-terminal-"));
+    const commandFile = join7(launchDir, "launch.command");
+    const bootstrapFile = join7(launchDir, "bootstrap.cjs");
+    const socketPath = macIpc.socketPath ?? join7(launchDir, "descriptor.sock");
     const openerEnv = { ...process.env };
     for (const key of Object.keys(env)) delete openerEnv[key];
     let claimed = false;
@@ -3415,8 +4189,8 @@ function openTerminal({ cli, command, extraArgs, env, cwd, platform, onFailure }
       }
     };
     try {
-      writeFileSync6(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
-      writeFileSync6(commandFile, `#!/bin/bash
+      writeFileSync7(bootstrapFile, MAC_TERMINAL_BOOTSTRAP_SOURCE, { encoding: "utf8", mode: 448 });
+      writeFileSync7(commandFile, `#!/bin/bash
 rm -f -- "$0"
 exec ${shq(process.execPath)} ${shq(bootstrapFile)} ${shq(socketPath)} ${shq(launchDir)} ${shq(cwd ?? "")} ${runLine}
 `, {
@@ -4087,6 +4861,7 @@ function applyAuditConfig(config) {
   } else {
     setAuditCaptureConfig(null);
     setAuditSink(null);
+    writer?.reset();
     if (sweeper) {
       if (config) sweeper.configure(config);
       sweeper.dispose();
@@ -4673,6 +5448,7 @@ async function handleImport(body, deps) {
 }
 
 // src/admin/usagePricing.ts
+import { getSharedUsageThroughputTracker } from "@omnicross/core/usage";
 var err4 = (status, message) => ({
   status,
   body: { error: { type: "admin_api_error", message } }
@@ -4698,6 +5474,9 @@ var BUCKET_SPAN_MS = {
 };
 var MAX_TIMESERIES_BUCKETS = 2e3;
 async function handleUsageGet(view, query2, deps) {
+  if (view === "throughput") {
+    return { status: 200, body: getSharedUsageThroughputTracker().snapshot() };
+  }
   const range = parseRange(query2);
   if (!isRange(range)) return range;
   switch (view) {
@@ -6334,7 +7113,7 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
 }
 
 // src/admin/uiStatic.ts
-import { existsSync as existsSync7, statSync as statSync2 } from "fs";
+import { existsSync as existsSync9, statSync as statSync4 } from "fs";
 import { readFile } from "fs/promises";
 import { createRequire } from "module";
 import path from "path";
@@ -6357,13 +7136,13 @@ var CONTENT_TYPES = {
 function resolveUiDist() {
   const fromEnv = process.env["OMNICROSS_UI_DIST"];
   if (fromEnv) {
-    return existsSync7(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
+    return existsSync9(path.join(fromEnv, "index.html")) ? path.resolve(fromEnv) : null;
   }
   try {
     const req = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
     const pkgJson = req.resolve("@omnicross/ui/package.json");
     const dist = path.join(path.dirname(pkgJson), "dist");
-    return existsSync7(path.join(dist, "index.html")) ? dist : null;
+    return existsSync9(path.join(dist, "index.html")) ? dist : null;
   } catch {
     return null;
   }
@@ -6412,7 +7191,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
     return true;
   }
   let target = filePath;
-  if (!existsSync7(target) || statSync2(target).isDirectory()) {
+  if (!existsSync9(target) || statSync4(target).isDirectory()) {
     if (path.extname(rel) === "") {
       target = path.join(uiDist, "index.html");
     } else {
@@ -6429,7 +7208,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.1.9" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.1.10" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -6541,6 +7320,14 @@ var AdminServer = class {
       await handleAuditStatsQuery(req, res, this.deps.auditStatsReader);
       return;
     }
+    if (path2 === "/admin/api/audit/body" && (req.method === "GET" || req.method === "HEAD")) {
+      handleAuditBodyQuery(req, res, this.deps.auditBodyReader);
+      return;
+    }
+    if (path2 === "/admin/api/audit/compact" && req.method === "POST") {
+      handleAuditCompact(res, this.deps.auditCompactor);
+      return;
+    }
     if (path2 === "/admin/api/billing-status" && (req.method === "GET" || req.method === "HEAD")) {
       handleBillingStatus(res, this.deps.billingStatusReader);
       return;
@@ -7153,7 +7940,7 @@ function safeStringify(value) {
 }
 
 // src/ports/JsonApiServerSettingsStore.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
 import { OUTBOUND_API_SERVER_CONFIG_KEY } from "@omnicross/core/outbound-api";
 var JsonApiServerSettingsStore = class {
   /**
@@ -7180,7 +7967,7 @@ var JsonApiServerSettingsStore = class {
     if (key !== OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
-    writeFileSync7(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
+    writeFileSync8(this.configPath, JSON.stringify(file, null, 2) + "\n", "utf8");
   }
   /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
   encryptSecrets(config) {
@@ -7203,7 +7990,7 @@ var JsonApiServerSettingsStore = class {
   /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
   readFile() {
     try {
-      const raw = readFileSync8(this.configPath, "utf8");
+      const raw = readFileSync10(this.configPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object") return parsed;
     } catch {
@@ -7214,7 +8001,7 @@ var JsonApiServerSettingsStore = class {
 
 // src/ports/JsonlUsageEventStore.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { appendFileSync, existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
 var JsonlUsageEventStore = class {
   constructor(eventsPath, isPriced) {
     this.eventsPath = eventsPath;
@@ -7428,10 +8215,10 @@ var JsonlUsageEventStore = class {
   }
   /** Parse every line, skipping malformed/torn lines defensively. */
   readAllRows() {
-    if (!existsSync8(this.eventsPath)) return [];
+    if (!existsSync10(this.eventsPath)) return [];
     let raw;
     try {
-      raw = readFileSync9(this.eventsPath, "utf8");
+      raw = readFileSync11(this.eventsPath, "utf8");
     } catch {
       return [];
     }
@@ -7470,15 +8257,15 @@ function nextBoundary(ts, bucket) {
       return new Date(d.getFullYear(), d.getMonth() + 1, 1).getTime();
   }
 }
-var pad2 = (n) => String(n).padStart(2, "0");
+var pad22 = (n) => String(n).padStart(2, "0");
 function bucketLabel(bucketStartTs, bucket) {
   const d = new Date(bucketStartTs);
   const y = d.getFullYear();
-  const mo = pad2(d.getMonth() + 1);
-  const day = pad2(d.getDate());
+  const mo = pad22(d.getMonth() + 1);
+  const day = pad22(d.getDate());
   switch (bucket) {
     case "hour":
-      return `${mo}-${day} ${pad2(d.getHours())}:00`;
+      return `${mo}-${day} ${pad22(d.getHours())}:00`;
     case "day":
       return `${y}-${mo}-${day}`;
     case "month":
@@ -7534,7 +8321,7 @@ function median(values) {
 }
 
 // src/ports/JsonPricingStore.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync12, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "fs";
 import { randomUUID as randomUUID5 } from "crypto";
 var JsonPricingStore = class {
   constructor(pricingPath) {
@@ -7549,9 +8336,9 @@ var JsonPricingStore = class {
    * otherwise unusable pricing table after a crash or manual file edit.
    */
   hasUsableSnapshot() {
-    if (!existsSync9(this.pricingPath)) return false;
+    if (!existsSync11(this.pricingPath)) return false;
     try {
-      const parsed = JSON.parse(readFileSync10(this.pricingPath, "utf8"));
+      const parsed = JSON.parse(readFileSync12(this.pricingPath, "utf8"));
       return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
     } catch {
       return false;
@@ -7664,9 +8451,9 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync9(this.pricingPath)) return [];
+    if (!existsSync11(this.pricingPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync10(this.pricingPath, "utf8"));
+      const parsed = JSON.parse(readFileSync12(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
@@ -7675,7 +8462,7 @@ var JsonPricingStore = class {
   writeRows(rows) {
     const temporaryPath = `${this.pricingPath}.${process.pid}.${randomUUID5()}.tmp`;
     try {
-      writeFileSync8(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
+      writeFileSync9(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
         encoding: "utf8",
         flag: "wx"
       });
@@ -7686,7 +8473,7 @@ var JsonPricingStore = class {
   }
   /** Isolated for deterministic failure testing; never removes the target. */
   replaceFile(temporaryPath) {
-    renameSync3(temporaryPath, this.pricingPath);
+    renameSync4(temporaryPath, this.pricingPath);
   }
 };
 function isUsablePricingRow(value) {
@@ -7696,7 +8483,7 @@ function isUsablePricingRow(value) {
 }
 
 // src/pricing/PricingRefreshScheduler.ts
-import { existsSync as existsSync10, readFileSync as readFileSync11, renameSync as renameSync4, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync13, renameSync as renameSync5, writeFileSync as writeFileSync10 } from "fs";
 var EMPTY_STATE2 = {
   lastAttemptAt: null,
   lastSuccessAt: null,
@@ -7734,9 +8521,9 @@ var PricingRefreshScheduler = class {
     this.timer = null;
   }
   getState() {
-    if (!existsSync10(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    if (!existsSync12(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
     try {
-      const value = JSON.parse(readFileSync11(this.statePath, "utf8"));
+      const value = JSON.parse(readFileSync13(this.statePath, "utf8"));
       return {
         lastAttemptAt: finiteOrNull(value.lastAttemptAt),
         lastSuccessAt: finiteOrNull(value.lastSuccessAt),
@@ -7789,9 +8576,9 @@ var PricingRefreshScheduler = class {
   }
   writeState(state) {
     const temporaryPath = `${this.statePath}.tmp`;
-    writeFileSync9(temporaryPath, `${JSON.stringify(state, null, 2)}
+    writeFileSync10(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
-    renameSync4(temporaryPath, this.statePath);
+    renameSync5(temporaryPath, this.statePath);
   }
 };
 function finiteOrNull(value) {
@@ -7799,7 +8586,7 @@ function finiteOrNull(value) {
 }
 
 // src/ports/JsonVoucherDb.ts
-import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -7877,21 +8664,21 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!existsSync11(this.vouchersPath)) return [];
+    if (!existsSync13(this.vouchersPath)) return [];
     try {
-      const parsed = JSON.parse(readFileSync12(this.vouchersPath, "utf8"));
+      const parsed = JSON.parse(readFileSync14(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    writeFileSync10(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    writeFileSync11(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname6 } from "path";
 import { getSharedAccountHealth as getSharedAccountHealth2 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
 import { getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling3 } from "@omnicross/core/pipeline/AccountAllowanceScheduling";
@@ -7945,11 +8732,11 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-import { existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { join as join8 } from "path";
 function externalStorePath(provider, home = homedir3()) {
-  return provider === "claude" ? join5(home, ".claude", ".credentials.json") : join5(home, ".codex", "auth.json");
+  return provider === "claude" ? join8(home, ".claude", ".credentials.json") : join8(home, ".codex", "auth.json");
 }
 function decodeJwtExpiryMs(token) {
   try {
@@ -7998,10 +8785,10 @@ function parseCodexTokensEnvelope(raw) {
 }
 function readExternalCliCredentials(provider, home = homedir3()) {
   const path2 = externalStorePath(provider, home);
-  if (!existsSync12(path2)) return null;
+  if (!existsSync14(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse(readFileSync13(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync15(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -8574,7 +9361,7 @@ var JsonSubscriptionCredentialStore = class {
   persist(config) {
     mkdirSync4(dirname6(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    writeFileSync11(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    writeFileSync12(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
   }
   /**
    * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
@@ -8590,10 +9377,10 @@ var JsonSubscriptionCredentialStore = class {
    * `config.ts loadConfig`, which decrypts outside its parse try.
    */
   readConfig() {
-    if (!existsSync13(this.tokensPath)) return { updatedAt: "" };
+    if (!existsSync15(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse(readFileSync14(this.tokensPath, "utf8"));
+      const raw = JSON.parse(readFileSync16(this.tokensPath, "utf8"));
       parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
     } catch {
       parsed = null;
@@ -9113,39 +9900,21 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-import { existsSync as existsSync15, readdirSync as readdirSync2, unlinkSync as unlinkSync3 } from "fs";
-import { join as join7 } from "path";
-
-// src/audit/auditFiles.ts
-var AUDIT_FILE_RE = /^audit-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
-var pad22 = (n) => String(n).padStart(2, "0");
-function auditFileName(ts) {
-  const d = new Date(ts);
-  return `audit-${d.getFullYear()}-${pad22(d.getMonth() + 1)}-${pad22(d.getDate())}.jsonl`;
-}
-function auditFileDateMs(fileName) {
-  const m = AUDIT_FILE_RE.exec(fileName);
-  if (!m) return null;
-  const year = Number(m[1]);
-  const month = Number(m[2]);
-  const day = Number(m[3]);
-  const d = new Date(year, month - 1, day);
-  if (d.getFullYear() !== year || d.getMonth() !== month - 1 || d.getDate() !== day) {
-    return null;
-  }
-  return d.getTime();
-}
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync17, readdirSync as readdirSync5, rmSync as rmSync4, unlinkSync as unlinkSync4 } from "fs";
+import { join as join10 } from "path";
+import { pipeline } from "stream/promises";
+import { createGzip } from "zlib";
 
 // src/audit/auditStats.ts
 import {
   createReadStream,
-  existsSync as existsSync14,
-  readFileSync as readFileSync15,
-  readdirSync,
-  statSync as statSync3,
-  writeFileSync as writeFileSync12
+  existsSync as existsSync16,
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync4,
+  statSync as statSync5,
+  writeFileSync as writeFileSync13
 } from "fs";
-import { basename, dirname as dirname7, join as join6 } from "path";
+import { basename, dirname as dirname7, join as join9 } from "path";
 var SIDECAR_VERSION = 1;
 var META_PREFIX_BYTES = 64 * 1024;
 var READ_CHUNK_BYTES = 4 * 1024 * 1024;
@@ -9153,9 +9922,9 @@ function auditStatsFileName(auditFile) {
   return auditFile.replace(/\.jsonl$/, ".stats.json");
 }
 function readPersisted(path2) {
-  if (!existsSync14(path2)) return null;
+  if (!existsSync16(path2)) return null;
   try {
-    const value = JSON.parse(readFileSync15(path2, "utf8"));
+    const value = JSON.parse(readFileSync17(path2, "utf8"));
     if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
       return null;
     }
@@ -9165,7 +9934,7 @@ function readPersisted(path2) {
   }
 }
 function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfter, record) {
-  const statsPath = join6(dirname7(auditPath), auditStatsFileName(basename(auditPath)));
+  const statsPath = join9(dirname7(auditPath), auditStatsFileName(basename(auditPath)));
   const previous = auditBytesBefore === 0 ? {
     version: SIDECAR_VERSION,
     auditBytes: 0,
@@ -9185,13 +9954,13 @@ function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfte
     minTs: previous.minTs === null ? record.ts : Math.min(previous.minTs, record.ts),
     maxTs: previous.maxTs === null ? record.ts : Math.max(previous.maxTs, record.ts)
   };
-  writeFileSync12(statsPath, JSON.stringify(next), "utf8");
+  writeFileSync13(statsPath, JSON.stringify(next), "utf8");
 }
 function queryCovers(stats, from, to) {
   return stats.requestCount === 0 || stats.minTs !== null && stats.maxTs !== null && from <= stats.minTs && to >= stats.maxTs;
 }
-function fileOverlaps(file, from, to) {
-  const start = auditFileDateMs(file);
+function fileOverlaps(name, from, to) {
+  const start = auditFileDateMs(name);
   if (start === null) return false;
   const date = new Date(start);
   const end = new Date(date.getFullYear(), date.getMonth(), date.getDate() + 1).getTime();
@@ -9296,21 +10065,27 @@ function mergePersistedStats(previous, appended) {
   };
 }
 async function readAuditStats(auditDir, query2 = {}) {
-  if (!existsSync14(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  if (!existsSync16(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
-  let files;
+  let sources;
   try {
-    files = readdirSync(auditDir).filter((file) => AUDIT_FILE_RE.test(file) && fileOverlaps(file, from, to)).sort();
+    sources = readdirSync4(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
+      (name) => AUDIT_DAY_DIR_RE.test(name) ? {
+        auditPath: join9(auditDir, name, AUDIT_META_FILE),
+        statsPath: join9(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
+      } : {
+        auditPath: join9(auditDir, name),
+        statsPath: join9(auditDir, auditStatsFileName(name))
+      }
+    ).filter((source) => existsSync16(source.auditPath));
   } catch {
     return { requestCount: 0, errorCount: 0, complete: false };
   }
   const total = { requestCount: 0, errorCount: 0, complete: true };
-  for (const file of files) {
-    const auditPath = join6(auditDir, file);
+  for (const { auditPath, statsPath } of sources) {
     try {
-      const auditBytes = statSync3(auditPath).size;
-      const statsPath = join6(auditDir, auditStatsFileName(file));
+      const auditBytes = statSync5(auditPath).size;
       const persisted = readPersisted(statsPath);
       if (persisted && persisted.complete && persisted.auditBytes === auditBytes && queryCovers(persisted, from, to)) {
         total.requestCount += persisted.requestCount;
@@ -9329,7 +10104,7 @@ async function readAuditStats(auditDir, query2 = {}) {
       total.errorCount += scanned.filtered.errorCount + (resumable?.errorCount ?? 0);
       total.complete = total.complete && scanned.filtered.complete;
       const current = resumable ? mergePersistedStats(resumable, scanned.all) : scanned.all;
-      if (current.complete) writeFileSync12(statsPath, JSON.stringify(current), "utf8");
+      if (current.complete) writeFileSync13(statsPath, JSON.stringify(current), "utf8");
     } catch {
       total.complete = false;
     }
@@ -9340,6 +10115,7 @@ async function readAuditStats(auditDir, query2 = {}) {
 // src/audit/AuditPruneSweeper.ts
 var DAY_MS = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
+var ARCHIVE_BATCH = 64;
 var AuditPruneSweeper = class {
   constructor(auditDir, logger, config, intervalMs = SWEEP_INTERVAL_MS2, now = Date.now) {
     this.auditDir = auditDir;
@@ -9355,6 +10131,7 @@ var AuditPruneSweeper = class {
   now;
   timer = null;
   sweeping = false;
+  archiving = false;
   /** Whether pruning is active (audit enabled). */
   get enabled() {
     return this.config.enabled;
@@ -9364,13 +10141,13 @@ var AuditPruneSweeper = class {
     this.config = config;
   }
   /**
-   * Arm the prune interval AND run one prune immediately (boot cleanup). No-op
-   * when audit is disabled (zero regression). Idempotent.
+   * Arm the interval AND run one pass immediately (boot cleanup). No-op when
+   * audit is disabled (zero regression). Idempotent.
    */
   start() {
     if (this.timer || !this.config.enabled) return;
-    void this.sweep();
-    this.timer = setInterval(() => void this.sweep(), this.intervalMs);
+    void this.runOnce();
+    this.timer = setInterval(() => void this.runOnce(), this.intervalMs);
     this.timer.unref?.();
   }
   /** Clear the interval (daemon shutdown / test teardown). Idempotent. */
@@ -9380,31 +10157,43 @@ var AuditPruneSweeper = class {
       this.timer = null;
     }
   }
+  /** Prune first, then archive — never spend CPU compressing a day about to go. */
+  async runOnce() {
+    await this.sweep();
+    await this.archive();
+  }
+  /** The LOCAL-midnight epoch ms of the current day. */
+  todayMidnight() {
+    const today = new Date(this.now());
+    return new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
+  }
   /**
-   * One prune: unlink every audit date file strictly OLDER than the retention
-   * cutoff (`now - retentionDays` days, at local-midnight granularity). Exposed
-   * for tests; never throws. Returns the number of files removed.
+   * One prune: remove every audit day strictly OLDER than the retention cutoff
+   * (`now - retentionDays` days, at local-midnight granularity). Exposed for
+   * tests; never throws. Returns the number of days removed.
    */
   async sweep() {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!existsSync15(this.auditDir)) return 0;
-      const today = new Date(this.now());
-      const todayMidnight = new Date(today.getFullYear(), today.getMonth(), today.getDate()).getTime();
-      const cutoff = todayMidnight - (this.config.retentionDays - 1) * DAY_MS;
+      if (!existsSync17(this.auditDir)) return 0;
+      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS;
       let removed = 0;
-      for (const file of readdirSync2(this.auditDir)) {
-        const dateMs = auditFileDateMs(file);
+      for (const name of readdirSync5(this.auditDir)) {
+        const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
-          unlinkSync3(join7(this.auditDir, file));
+          if (isAuditDayDir(name)) {
+            rmSync4(join10(this.auditDir, name), { recursive: true, force: true });
+          } else {
+            unlinkSync4(join10(this.auditDir, name));
+            const statsPath = join10(this.auditDir, auditStatsFileName(name));
+            if (existsSync17(statsPath)) unlinkSync4(statsPath);
+          }
           removed += 1;
-          const statsPath = join7(this.auditDir, auditStatsFileName(file));
-          if (existsSync15(statsPath)) unlinkSync3(statsPath);
         } catch (error) {
-          this.logger.warn("[AuditPruneSweeper] failed to unlink expired audit file", {
-            file,
+          this.logger.warn("[AuditPruneSweeper] failed to remove expired audit day", {
+            name,
             error: error instanceof Error ? error.message : String(error)
           });
         }
@@ -9420,59 +10209,158 @@ var AuditPruneSweeper = class {
       this.sweeping = false;
     }
   }
+  /**
+   * Gzip the body shards of every CLOSED day (anything before today). Today is
+   * deliberately left as plain text so it stays greppable while it is the day you
+   * are debugging. Exposed for tests; never throws. Returns shards compressed.
+   */
+  async archive() {
+    if (!this.config.enabled || this.archiving) return 0;
+    this.archiving = true;
+    try {
+      if (!existsSync17(this.auditDir)) return 0;
+      const today = this.todayMidnight();
+      let compressed = 0;
+      for (const name of readdirSync5(this.auditDir)) {
+        if (compressed >= ARCHIVE_BATCH) break;
+        const dateMs = auditFileDateMs(name);
+        if (dateMs === null || dateMs >= today || !isAuditDayDir(name)) continue;
+        const dayPath = join10(this.auditDir, name);
+        try {
+          const compaction = compactAuditDay(dayPath);
+          if (compaction.shards > 0) {
+            this.logger.debug("audit cross-session compaction complete", {
+              day: name,
+              shards: compaction.shards,
+              anchors: compaction.anchors,
+              savedBytes: compaction.savedBytes
+            });
+          }
+        } catch (error) {
+          this.logger.warn("[AuditPruneSweeper] cross-session compaction failed", {
+            day: name,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+        compressed += await this.archiveDay(
+          join10(dayPath, AUDIT_BODIES_DIR),
+          ARCHIVE_BATCH - compressed
+        );
+      }
+      if (compressed > 0) this.logger.debug("audit archive complete", { compressed });
+      return compressed;
+    } catch (error) {
+      this.logger.warn("audit archive pass failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return 0;
+    } finally {
+      this.archiving = false;
+    }
+  }
+  /** Gzip up to `budget` plain shards in one day's `bodies/` directory. */
+  async archiveDay(bodiesPath, budget) {
+    let shards;
+    try {
+      shards = readdirSync5(bodiesPath).filter((file) => file.endsWith(".jsonl"));
+    } catch {
+      return 0;
+    }
+    let compressed = 0;
+    for (const shard of shards) {
+      if (compressed >= budget) break;
+      const source = join10(bodiesPath, shard);
+      const target = `${source}.gz`;
+      try {
+        if (existsSync17(target)) {
+          unlinkSync4(source);
+          continue;
+        }
+        await pipeline(createReadStream2(source), createGzip(), createWriteStream2(target));
+        unlinkSync4(source);
+        compressed += 1;
+      } catch (error) {
+        try {
+          if (existsSync17(target)) unlinkSync4(target);
+        } catch {
+        }
+        this.logger.warn("[AuditPruneSweeper] failed to archive audit body shard", {
+          shard,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return compressed;
+  }
 };
 
 // src/audit/auditReader.ts
-import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync16 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync6 } from "fs";
+import { join as join11 } from "path";
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
-function readAuditRecords(auditDir, query2 = {}) {
-  if (!existsSync16(auditDir)) return [];
-  let files;
+var OVERSCAN = 256;
+function daySources(auditDir) {
+  let names;
   try {
-    files = readdirSync3(auditDir).filter((f) => AUDIT_FILE_RE.test(f));
+    names = readdirSync6(auditDir);
   } catch {
     return [];
   }
+  const sources = [];
+  for (const name of names) {
+    const dateMs = auditFileDateMs(name);
+    if (dateMs === null) continue;
+    if (AUDIT_DAY_DIR_RE.test(name)) {
+      const path2 = join11(auditDir, name, AUDIT_META_FILE);
+      if (existsSync18(path2)) sources.push({ path: path2, dateMs });
+    } else if (AUDIT_FILE_RE.test(name)) {
+      sources.push({ path: join11(auditDir, name), dateMs });
+    }
+  }
+  return sources.sort((a, b) => b.dateMs - a.dateMs);
+}
+function isAuditRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["method"] === "string" && typeof r["path"] === "string" && typeof r["status"] === "number";
+}
+function toMetaRecord(record) {
+  if (record.requestBody === void 0 && record.responseBody === void 0) return record;
+  const { requestBody: _req, responseBody: _res, ...meta } = record;
+  return { ...meta, hasBody: true };
+}
+function readAuditRecords(auditDir, query2 = {}) {
+  if (!existsSync18(auditDir)) return [];
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
   const matched = [];
-  for (const file of files.sort().reverse()) {
-    let raw;
-    try {
-      raw = readFileSync16(join8(auditDir, file), "utf8");
-    } catch {
-      continue;
-    }
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      let rec;
+  for (const source of daySources(auditDir)) {
+    const before = matched.length;
+    forEachLineFromTail(source.path, (line) => {
+      let parsed;
       try {
-        rec = JSON.parse(trimmed);
+        parsed = JSON.parse(line);
       } catch {
-        continue;
+        return false;
       }
-      if (!isAuditRecord(rec)) continue;
-      if (query2.keyId !== void 0 && rec.keyId !== query2.keyId) continue;
-      if (rec.ts < from || rec.ts > to) continue;
-      matched.push(rec);
-    }
+      if (!isAuditRecord(parsed)) return false;
+      if (query2.keyId !== void 0 && parsed.keyId !== query2.keyId) return false;
+      if (query2.sessionKey !== void 0 && parsed.sessionKey !== query2.sessionKey) return false;
+      if (parsed.ts < from || parsed.ts > to) return false;
+      matched.push(toMetaRecord(parsed));
+      return matched.length - before >= limit + OVERSCAN;
+    });
+    if (matched.length >= limit) break;
   }
   matched.sort((a, b) => b.ts - a.ts);
   return matched.slice(0, limit);
 }
-function isAuditRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const r = value;
-  return typeof r["id"] === "string" && typeof r["ts"] === "number" && typeof r["method"] === "string" && typeof r["path"] === "string" && typeof r["status"] === "number";
-}
 
 // src/audit/AuditWriter.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync17, mkdirSync as mkdirSync5, statSync as statSync4 } from "fs";
-import { join as join9 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync19, mkdirSync as mkdirSync5, statSync as statSync6 } from "fs";
+import { join as join12 } from "path";
 var AuditWriter = class {
   constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
     this.auditDir = auditDir;
@@ -9482,10 +10370,13 @@ var AuditWriter = class {
   auditDir;
   logger;
   defer;
-  dirEnsured = false;
+  /** Day directories already created this process (avoids an mkdir per record). */
+  ensuredDirs = /* @__PURE__ */ new Set();
+  /** Per-session encoding bases. Memory-only; a miss simply writes a full snapshot. */
+  bases = new SessionBaseCache();
   /**
-   * Enqueue one record for append. Returns IMMEDIATELY (fire-and-forget); the fs
-   * write happens on the deferred tick. A failure is logged, never thrown.
+   * Enqueue one record. Returns IMMEDIATELY (fire-and-forget); every fs write and
+   * the delta encoding happen on the deferred tick. A failure is logged, never thrown.
    */
   record(record) {
     this.defer(() => {
@@ -9498,25 +10389,41 @@ var AuditWriter = class {
       }
     });
   }
+  /** Drop all retained encoding bases (config reload / shutdown / test teardown). */
+  reset() {
+    this.bases.clear();
+    this.ensuredDirs.clear();
+  }
   /**
-   * Append synchronously — the awaitable form tests use to assert the line landed.
-   * Ensures the `audit/` directory exists on first write (lazy, like the usage
-   * store's lazy file creation).
+   * Append synchronously — the awaitable form tests use to assert a line landed.
+   * Writes the metadata line first (canonical), then the body shard.
    */
   appendNow(record) {
-    if (!this.dirEnsured) {
-      mkdirSync5(this.auditDir, { recursive: true });
-      this.dirEnsured = true;
-    }
-    const file = join9(this.auditDir, auditFileName(record.ts));
-    const line = JSON.stringify(record) + "\n";
-    const auditBytesBefore = existsSync17(file) ? statSync4(file).size : 0;
+    const dayDir = auditDayDirName(record.ts);
+    const dayPath = this.ensureDir(join12(this.auditDir, dayDir));
+    this.appendMeta(dayPath, record);
+    this.appendBody(dayPath, dayDir, record);
+  }
+  /** Create a directory once per process and remember it. */
+  ensureDir(path2) {
+    if (!this.ensuredDirs.has(path2)) {
+      mkdirSync5(path2, { recursive: true });
+      this.ensuredDirs.add(path2);
+    }
+    return path2;
+  }
+  /** Write the body-free metadata line + refresh the exact-count sidecar. */
+  appendMeta(dayPath, record) {
+    const { requestBody: _req, responseBody: _res, ...meta } = record;
+    const file = join12(dayPath, AUDIT_META_FILE);
+    const line = JSON.stringify(meta) + "\n";
+    const bytesBefore = existsSync19(file) ? statSync6(file).size : 0;
     appendFileSync2(file, line, "utf8");
     try {
       updateAuditStatsAfterAppend(
         file,
-        auditBytesBefore,
-        auditBytesBefore + Buffer.byteLength(line, "utf8"),
+        bytesBefore,
+        bytesBefore + Buffer.byteLength(line, "utf8"),
         record
       );
     } catch (error) {
@@ -9525,12 +10432,39 @@ var AuditWriter = class {
       });
     }
   }
+  /**
+   * Write the delta-encoded body shard for one record. A no-op when nothing was
+   * captured or when the session key is missing/unsafe — in which case the body
+   * is dropped rather than written to an unvalidated path.
+   */
+  appendBody(dayPath, dayDir, record) {
+    if (record.requestBody === void 0 && record.responseBody === void 0) return;
+    const sessionKey = record.sessionKey;
+    if (!isSafeSessionKey(sessionKey)) {
+      this.logger.warn("[AuditWriter] dropping audit body with no usable session key", {
+        id: record.id
+      });
+      return;
+    }
+    try {
+      const line = encodeBodyEntry(record, sessionKey, dayDir, this.bases);
+      if (line === null) return;
+      const bodiesPath = this.ensureDir(join12(dayPath, AUDIT_BODIES_DIR));
+      appendFileSync2(join12(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
+    } catch (error) {
+      this.bases.forget(sessionKey);
+      this.logger.warn("[AuditWriter] failed to append audit body shard", {
+        id: record.id,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
 };
 
 // src/billing/BillingPublisher.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6 } from "fs";
 import { createHmac } from "crypto";
-import { join as join10 } from "path";
+import { join as join13 } from "path";
 import { fetchUpstream as fetchUpstream5 } from "@omnicross/core/pipeline/upstreamFetch";
 
 // src/billing/billingFiles.ts
@@ -9601,7 +10535,7 @@ var BillingPublisher = class {
    */
   appendNow(event) {
     this.ensureDir();
-    const file = join10(this.billingDir, billingFileName(event.ts));
+    const file = join13(this.billingDir, billingFileName(event.ts));
     appendFileSync3(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
@@ -9651,7 +10585,7 @@ var BillingPublisher = class {
   markDelivered(event) {
     try {
       this.ensureDir();
-      const file = join10(this.billingDir, deliveredFileName(event.ts));
+      const file = join13(this.billingDir, deliveredFileName(event.ts));
       appendFileSync3(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
@@ -9667,14 +10601,14 @@ var BillingPublisher = class {
 };
 
 // src/billing/billingReader.ts
-import { existsSync as existsSync18, readdirSync as readdirSync4, readFileSync as readFileSync17 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync7, readFileSync as readFileSync18 } from "fs";
+import { join as join14 } from "path";
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!existsSync18(billingDir)) return view;
+  if (!existsSync20(billingDir)) return view;
   let files;
   try {
-    files = readdirSync4(billingDir);
+    files = readdirSync7(billingDir);
   } catch {
     return view;
   }
@@ -9705,7 +10639,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = readFileSync17(join11(dir, file), "utf8");
+    raw = readFileSync18(join14(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -10209,8 +11143,10 @@ function buildDaemon(config, paths) {
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
   );
   const keySpendTracker = new KeySpendTracker(usageEventStore);
+  const usageThroughput = getSharedUsageThroughputTracker2();
   const usageRecorder = new UsageRecorder(usageEventStore, pricingEngine, logger, {
-    onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at)
+    onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at),
+    onEvent: (row, at) => usageThroughput.record(row, at)
   });
   const providerProxy = getProviderProxy({ llmConfig, apiKeyPool, usageRecorder });
   const routeLeaseManager = new RouteLeaseManager(
@@ -10359,6 +11295,11 @@ function buildDaemon(config, paths) {
     // NEVER unauth, NEVER on `/health`. Routed in `AdminServer` (not `adminApi.ts`).
     auditReader: (query2) => readAuditRecords(auditDir, query2),
     auditStatsReader: (query2) => readAuditStats(auditDir, query2),
+    // audit-store-sharding: bodies live in per-session shards, so opening ONE
+    // record's payload is a separate authed call that replays its delta chain.
+    auditBodyReader: (query2) => readAuditBody(auditDir, query2),
+    // audit-store-sharding D8: the manual counterpart to the daily pass.
+    auditCompactor: () => compactAllClosedAuditDays(auditDir),
     // billing-event-stream: the AUTHED `GET /admin/api/billing-status` returns the
     // secret-free total/delivered/pending counts of the durable ledger.
     billingStatusReader: () => readBillingStatus(billingDir)
@@ -10417,7 +11358,7 @@ function buildDaemon(config, paths) {
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!existsSync19(tokensPath)) return true;
+    if (!existsSync21(tokensPath)) return true;
     accessSync(tokensPath, fsConstants.R_OK);
     return true;
   } catch {
@@ -10465,8 +11406,8 @@ function buildCliSpawnPlan(opts) {
 function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(delimiter2).filter(Boolean);
   for (const seg of segments) {
-    const full = join12(seg, candidate);
-    if (existsSync20(full)) return full;
+    const full = join15(seg, candidate);
+    if (existsSync22(full)) return full;
   }
   return null;
 }
@@ -10474,7 +11415,7 @@ async function runLaunch(argv, deps) {
   const sep = argv.indexOf("--");
   const own = sep === -1 ? argv : argv.slice(0, sep);
   const passthrough = sep === -1 ? [] : argv.slice(sep + 1);
-  const { values, positionals } = parseArgs4({
+  const { values, positionals } = parseArgs5({
     args: own,
     options: {
       provider: { type: "string", short: "p" },
@@ -10644,12 +11585,12 @@ function spawnCliInherit(plan) {
 // src/commands/login.ts
 import { spawn as spawn3 } from "child_process";
 import { createInterface } from "readline";
-import { parseArgs as parseArgs5 } from "util";
+import { parseArgs as parseArgs6 } from "util";
 import { fetchUpstream as fetchUpstream8, setUpstreamProxyResolver as setUpstreamProxyResolver2 } from "@omnicross/core/pipeline/upstreamFetch";
 import { claudeOAuth as claudeOAuth3, codexOAuth as codexOAuth3, geminiOAuth as geminiOAuth3 } from "@omnicross/subscriptions";
 var PROVIDERS2 = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
-  const { values, positionals } = parseArgs5({
+  const { values, positionals } = parseArgs6({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -10817,9 +11758,9 @@ function promptPaste(prompt) {
 
 // src/commands/providers.ts
 import { randomUUID as randomUUID7 } from "crypto";
-import { parseArgs as parseArgs6 } from "util";
+import { parseArgs as parseArgs7 } from "util";
 async function runProviders(argv) {
-  const { values, positionals } = parseArgs6({
+  const { values, positionals } = parseArgs7({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -10966,10 +11907,10 @@ function providersRmKey(configPath, providerId, keyId) {
 }
 
 // src/commands/secrets.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "fs";
-import { parseArgs as parseArgs7 } from "util";
+import { existsSync as existsSync23, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "fs";
+import { parseArgs as parseArgs8 } from "util";
 async function runSecrets(argv) {
-  const { values, positionals } = parseArgs7({
+  const { values, positionals } = parseArgs8({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -11039,12 +11980,12 @@ function secretsStatus(args) {
     reportField("admin.token", cfg.admin.token);
   }
   const tokensPath = defaultTokensPath(args.config);
-  if (existsSync21(tokensPath)) {
+  if (existsSync23(tokensPath)) {
     console.info(`Secret status for ${tokensPath}:`);
     reportTokenFields(tokensPath);
   }
   const integrationsPath = defaultIntegrationsPath(args.config);
-  if (existsSync21(integrationsPath)) {
+  if (existsSync23(integrationsPath)) {
     const state = readRawJson(integrationsPath);
     const key = state.gatewayKey;
     if (key && typeof key === "object" && !Array.isArray(key)) {
@@ -11098,8 +12039,8 @@ async function secretsRotate(args) {
   const integrationsPath = defaultIntegrationsPath(args.config);
   try {
     cfg = loadConfig(args.config);
-    if (existsSync21(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
-    if (existsSync21(integrationsPath)) {
+    if (existsSync23(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+    if (existsSync23(integrationsPath)) {
       integrationsPlain = new IntegrationStateStore(integrationsPath, oldBox).load();
     }
   } finally {
@@ -11134,20 +12075,20 @@ function secretsDecrypt(args) {
   let tokensPlain = null;
   try {
     cfg = loadConfig(args.config);
-    if (existsSync21(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+    if (existsSync23(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
   } finally {
     setSecretBox(null);
   }
   saveConfig(args.config, cfg);
   if (tokensPlain) {
-    writeFileSync13(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
+    writeFileSync14(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
   }
   console.info(`Decrypted secrets to plaintext in ${args.config}` + tokensSuffix(args.config));
 }
 function readRawConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync18(path2, "utf8"));
+    parsed = JSON.parse(readFileSync19(path2, "utf8"));
   } catch {
     throw new Error(`secrets: cannot read or parse '${path2}'`);
   }
@@ -11155,7 +12096,7 @@ function readRawConfig(path2) {
 }
 function readRawJson(path2) {
   try {
-    const parsed = JSON.parse(readFileSync18(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync19(path2, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -11165,13 +12106,13 @@ function readRawJson(path2) {
 }
 function encryptTokensFileInPlace(configPath, box) {
   const tokensPath = defaultTokensPath(configPath);
-  if (!existsSync21(tokensPath)) return;
+  if (!existsSync23(tokensPath)) return;
   const plain = decryptTokensFile(tokensPath, box);
   writeTokensEncrypted(tokensPath, plain, box);
 }
 function rewriteIntegrationState(configPath, readBox, writeBox) {
   const path2 = defaultIntegrationsPath(configPath);
-  if (!existsSync21(path2)) return;
+  if (!existsSync23(path2)) return;
   const state = new IntegrationStateStore(path2, readBox).load();
   new IntegrationStateStore(path2, writeBox).save(state);
 }
@@ -11184,7 +12125,7 @@ function writeTokensEncrypted(tokensPath, plain, box) {
     { updatedAt: "", ...plain },
     box
   );
-  writeFileSync13(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  writeFileSync14(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
 }
 var TOKEN_FIELDS2 = {
   claude: ["accessToken", "refreshToken"],
@@ -11207,11 +12148,11 @@ function walkTokens(raw, fn) {
   return next;
 }
 function tokensSuffix(configPath) {
-  return existsSync21(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+  return existsSync23(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
 }
 
 // src/commands/start.ts
-import { parseArgs as parseArgs8 } from "util";
+import { parseArgs as parseArgs9 } from "util";
 import { loadServerConfig as loadServerConfig3 } from "@omnicross/core/outbound-api";
 import { getSharedAccountHealth as getSharedAccountHealth5 } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
 import { getSharedAccountAllowanceScheduling as getSharedAccountAllowanceScheduling6 } from "@omnicross/core/pipeline/AccountAllowanceScheduling";
@@ -11250,7 +12191,7 @@ async function seedIdentities(store, credentialStore) {
 
 // src/commands/start.ts
 async function runStart(argv) {
-  const { values } = parseArgs8({
+  const { values } = parseArgs9({
     args: argv,
     options: {
       config: { type: "string", short: "c" },
@@ -11390,6 +12331,10 @@ Usage:
   omnicross secrets encrypt --config <p>   Encrypt all at-rest secrets in place.
   omnicross secrets status --config <p>    Report each secret field (no values shown).
   omnicross secrets rotate --config <p> --new-master-key-file <p>  Re-seal under a new master key.
+
+  omnicross audit sessions --config <p> [--date YYYY-MM-DD]        List captured body shards per session.
+  omnicross audit show --config <p> --session <key> [--id <recordId>]  Print reconstructed request/response bodies.
+  omnicross audit compact --config <p> [--date YYYY-MM-DD]         Run cross-session body compaction now.
 `;
 async function main() {
   const [, , subcommand, ...rest] = process.argv;
@@ -11421,6 +12366,9 @@ async function main() {
     case "secrets":
       await runSecrets(rest);
       return;
+    case "audit":
+      await runAudit(rest);
+      return;
     case void 0:
     case "-h":
     case "--help":