@omnicross/daemon 0.2.1 → 0.3.1

package/dist/cli.cjs

@@ -1163,10 +1163,10 @@ var import_node_util2 = require("util");
 var import_outbound_api12 = require("@omnicross/core/outbound-api");
 var import_api4 = require("@omnicross/core/search/api");
 var import_http4 = require("@omnicross/core/search/http");
-var import_search2 = require("@omnicross/core/search");
+var import_search3 = require("@omnicross/core/search");
 
 // src/bootstrap.ts
-var import_node_fs35 = require("fs");
+var import_node_fs36 = require("fs");
 var import_node_path36 = require("path");
 var import_audit_types = require("@omnicross/contracts/audit-types");
 var import_billing_types = require("@omnicross/contracts/billing-types");
@@ -1176,16 +1176,16 @@ var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolSer
 var import_outbound_api10 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore7 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch13 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
 var import_outbound_api11 = require("@omnicross/core/outbound-api");
 var import_usage2 = require("@omnicross/core/usage");
-var import_subscriptions6 = require("@omnicross/subscriptions");
+var import_subscriptions9 = require("@omnicross/subscriptions");
 
 // src/admin/accountsCodexOAuth.ts
 var import_node_crypto3 = __toESM(require("crypto"), 1);
@@ -1292,8 +1292,83 @@ function handleCodexOAuthStatus(sessionId, deps) {
   return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
 }
 
+// src/admin/accountsKimiOAuth.ts
+var import_subscriptions2 = require("@omnicross/subscriptions");
+function err2(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+var DEFAULT_KIMI_OAUTH_TTL_MS = 15 * 6e4;
+async function handleKimiOAuthStart(deps) {
+  if (deps.kimiSessions.isBusy()) {
+    return err2(409, "a kimi sign-in is already in progress \u2014 finish it in the browser or cancel it");
+  }
+  const fetchImpl = deps.oauthExchangeFetch("kimi");
+  const deviceId = import_subscriptions2.kimiOAuth.generateKimiDeviceId();
+  const fingerprint = import_subscriptions2.kimiOAuth.kimiFingerprintHeaders(deviceId);
+  let authorization;
+  try {
+    authorization = await import_subscriptions2.kimiOAuth.requestDeviceAuthorization(fetchImpl, fingerprint);
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : "device authorization failed";
+    return err2(502, `kimi device authorization failed: ${reason}`);
+  }
+  const { sessionId, signal } = deps.kimiSessions.begin();
+  void runKimiDevicePoll(sessionId, authorization.deviceCode, deviceId, fingerprint, signal, deps).catch(() => deps.kimiSessions.settle(sessionId, "error", "kimi sign-in failed"));
+  return {
+    status: 200,
+    body: {
+      authUrl: authorization.verificationUriComplete ?? authorization.verificationUri,
+      userCode: authorization.userCode,
+      sessionId
+    }
+  };
+}
+async function runKimiDevicePoll(sessionId, deviceCode, deviceId, fingerprint, signal, deps) {
+  const fetchImpl = deps.oauthExchangeFetch("kimi");
+  const result = await import_subscriptions2.kimiOAuth.awaitDeviceToken(
+    { userCode: "", deviceCode, verificationUri: "" },
+    fetchImpl,
+    {
+      fingerprint,
+      deadlineMs: DEFAULT_KIMI_OAUTH_TTL_MS,
+      sleep: (ms) => new Promise((resolve11, reject) => {
+        const onAbort = () => {
+          clearTimeout(timer);
+          reject(new Error("login: cancelled"));
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve11();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    }
+  );
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt: new Date(Date.now() + result.expiresIn * 1e3).toISOString(),
+    accountId: import_subscriptions2.kimiOAuth.kimiAccountIdFromAccessToken(result.accessToken),
+    deviceId,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await deps.subscriptionAccountAppender.appendProviderAccount("kimi", block);
+  deps.kimiSessions.settle(sessionId, "done");
+}
+function handleKimiOAuthCancel(sessionId, deps) {
+  if (!deps.kimiSessions.cancel(sessionId)) return err2(404, "unknown or expired kimi sign-in session");
+  return { status: 200, body: { ok: true } };
+}
+function handleKimiOAuthStatus(sessionId, deps) {
+  const s = deps.kimiSessions.get(sessionId);
+  if (!s) return err2(404, "unknown or expired kimi sign-in session");
+  return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
+}
+
 // src/allowance/AccountAllowanceService.ts
-var import_AccountAllowanceStore2 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore5 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 
 // src/allowance/ClaudeAllowanceCollector.ts
@@ -1320,13 +1395,11 @@ function secondsUntil(instant, now) {
 function windowFromPayload(id, payload, now) {
   const usedPercent = finitePercent(payload?.utilization);
   const resetsAt = isoInstant(payload?.resets_at);
-  const isSonnet = id === "seven-day-sonnet";
   const isFiveHour = id === "five-hour";
   return {
     id,
-    label: isFiveHour ? "5 hours" : isSonnet ? "7 days \xB7 Sonnet" : "7 days",
-    scope: isSonnet ? "model-family" : "all",
-    modelFamily: isSonnet ? "sonnet" : void 0,
+    label: isFiveHour ? "5 hours" : "7 days",
+    scope: "all",
     usedPercent,
     windowMinutes: isFiveHour ? 5 * 60 : 7 * 24 * 60,
     resetsAt,
@@ -1334,6 +1407,44 @@ function windowFromPayload(id, payload, now) {
     state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
   };
 }
+function limitEntryWindow(entries, kind) {
+  const entry = entries.find((candidate) => candidate.kind === kind);
+  if (!entry) return void 0;
+  return { utilization: entry.percent, resets_at: entry.resets_at };
+}
+function slugifyDisplayName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function scopedWeeklyWindows(entries, now) {
+  const seen = /* @__PURE__ */ new Set();
+  const windows = [];
+  for (const entry of entries) {
+    if (entry.kind !== "weekly_scoped") continue;
+    const displayName = typeof entry.scope?.model?.display_name === "string" && entry.scope.model.display_name.trim() ? entry.scope.model.display_name.trim() : void 0;
+    if (!displayName) continue;
+    const slug = slugifyDisplayName(displayName);
+    if (!slug || seen.has(slug)) continue;
+    seen.add(slug);
+    const usedPercent = finitePercent(entry.percent);
+    const resetsAt = isoInstant(entry.resets_at);
+    windows.push({
+      id: `seven-day-${slug}`,
+      label: `7 days \xB7 ${displayName}`,
+      scope: "model-family",
+      modelFamily: slug,
+      usedPercent,
+      windowMinutes: 7 * 24 * 60,
+      resetsAt,
+      remainingSeconds: secondsUntil(resetsAt, now),
+      state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+    });
+  }
+  return windows;
+}
+function parseLimitEntries(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry) => !!entry && typeof entry === "object");
+}
 function emptyClaudeWindows(state) {
   return [
     {
@@ -1351,15 +1462,6 @@ function emptyClaudeWindows(state) {
       usedPercent: null,
       windowMinutes: 7 * 24 * 60,
       state
-    },
-    {
-      id: "seven-day-sonnet",
-      label: "7 days \xB7 Sonnet",
-      scope: "model-family",
-      modelFamily: "sonnet",
-      usedPercent: null,
-      windowMinutes: 7 * 24 * 60,
-      state
     }
   ];
 }
@@ -1440,6 +1542,9 @@ var ClaudeAllowanceCollector = class {
     }
     const now = this.now();
     const usage = payload;
+    const limitEntries = parseLimitEntries(usage.limits);
+    const fiveHour = usage.five_hour ?? limitEntryWindow(limitEntries, "session");
+    const sevenDay = usage.seven_day ?? limitEntryWindow(limitEntries, "weekly_all");
     const snapshot = {
       providerId: "claude",
       accountId,
@@ -1447,10 +1552,10 @@ var ClaudeAllowanceCollector = class {
       observedAt: new Date(now).toISOString(),
       expiresAt: new Date(now + CLAUDE_ALLOWANCE_CACHE_MS).toISOString(),
       windows: [
-        windowFromPayload("five-hour", usage.five_hour, now),
-        windowFromPayload("seven-day", usage.seven_day, now),
-        windowFromPayload("seven-day-sonnet", usage.seven_day_sonnet, now)
-      ]
+        windowFromPayload("five-hour", fiveHour, now),
+        windowFromPayload("seven-day", sevenDay, now),
+        ...scopedWeeklyWindows(limitEntries, now)
+      ].slice(0, 8)
     };
     this.store.set(snapshot);
     return snapshot;
@@ -1507,6 +1612,601 @@ var ClaudeAllowanceCollector = class {
   }
 };
 
+// src/allowance/CodexAllowanceCollector.ts
+var import_AccountAllowanceStore2 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch2 = require("@omnicross/core/pipeline/upstreamFetch");
+var CODEX_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+var CODEX_CLI_USER_AGENT = "codex_cli_rs/0.144.5";
+function finiteNumber(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+function finitePercent2(value) {
+  const parsed = finiteNumber(value);
+  return parsed !== null && parsed <= 100 ? parsed : null;
+}
+function epochMs(value) {
+  return value > 1e11 ? value : value * 1e3;
+}
+function secondsUntil2(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function decodeJwtClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const json2 = Buffer.from(parts[1], "base64url").toString("utf8");
+    const parsed = JSON.parse(json2);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function chatgptAccountIdFromClaims(claims) {
+  const auth = claims?.["https://api.openai.com/auth"];
+  if (!auth || typeof auth !== "object") return void 0;
+  const accountId = auth.chatgpt_account_id;
+  return typeof accountId === "string" && accountId.trim() ? accountId.trim() : void 0;
+}
+function resolveCodexChatGptAccountId(tokens) {
+  if (tokens.accountId?.trim()) return tokens.accountId.trim();
+  if (tokens.idToken) {
+    const fromIdToken = chatgptAccountIdFromClaims(decodeJwtClaims(tokens.idToken));
+    if (fromIdToken) return fromIdToken;
+  }
+  if (tokens.accessToken) {
+    return chatgptAccountIdFromClaims(decodeJwtClaims(tokens.accessToken));
+  }
+  return void 0;
+}
+function windowFromPayload2(id, payload, now) {
+  const usedPercent = finitePercent2(payload?.used_percent);
+  const resetAtSeconds = finiteNumber(payload?.reset_at);
+  const resetAfterSeconds = finiteNumber(payload?.reset_after_seconds);
+  const windowSeconds = finiteNumber(payload?.limit_window_seconds);
+  const resetsAt = resetAtSeconds !== null && resetAtSeconds > 0 ? new Date(epochMs(resetAtSeconds)).toISOString() : resetAfterSeconds !== null && resetAfterSeconds > 0 ? new Date(now + resetAfterSeconds * 1e3).toISOString() : void 0;
+  const windowMinutes = windowSeconds !== null && windowSeconds > 0 ? Math.round(windowSeconds / 60) : void 0;
+  return {
+    id,
+    label: id === "primary" ? "Primary" : "Secondary",
+    scope: "all",
+    usedPercent,
+    ...windowMinutes !== void 0 ? { windowMinutes } : {},
+    ...resetsAt !== void 0 ? { resetsAt } : {},
+    remainingSeconds: secondsUntil2(resetsAt, now),
+    state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+  };
+}
+var CodexAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore2.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch2.fetchUpstream)(url, init, { providerId: "codex", accountId, redactBodies: true }), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    const unsupported = account.tokens.authMethod !== "oauth";
+    if (unsupported) {
+      const existing = this.store.get("codex", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) {
+        return Promise.resolve(existing);
+      }
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("codex", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) {
+      return Promise.resolve(cached);
+    }
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id, account.tokens).catch(() => this.failureSnapshot(account.id, "codex_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  /**
+   * A response-header snapshot stays a valid cache hit only while fresh; an
+   * active oauth-usage snapshot is honored on the same 5-minute cadence as
+   * Claude's (the poll is cheap and quota is the scheduling input).
+   */
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId, tokens) {
+    let accessToken = await this.credentials.getAccessTokenForAccount("codex", accountId);
+    if (!accessToken) {
+      return this.failureSnapshot(accountId, "codex_usage_token_unavailable", this.now());
+    }
+    let response = await this.request(accountId, accessToken, tokens);
+    if (response.status === 401) {
+      const refreshed = await this.credentials.refreshAccountToken("codex", accountId);
+      if (!refreshed) {
+        return this.failureSnapshot(accountId, "codex_usage_unauthorized", this.now());
+      }
+      accessToken = await this.credentials.getAccessTokenForAccount("codex", accountId);
+      if (!accessToken) {
+        return this.failureSnapshot(accountId, "codex_usage_token_unavailable", this.now());
+      }
+      response = await this.request(accountId, accessToken, tokens);
+    }
+    if (response.status === 403) {
+      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "codex_usage_unsupported");
+      this.store.set(snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) {
+      return this.failureSnapshot(accountId, "codex_usage_http_error", this.now());
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(accountId, "codex_usage_invalid_response", this.now());
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      return this.failureSnapshot(accountId, "codex_usage_invalid_response", this.now());
+    }
+    const now = this.now();
+    const usage = payload.rate_limit;
+    const previous = this.store.get("codex", accountId, now);
+    const snapshot = {
+      providerId: "codex",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CODEX_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        windowFromPayload2("primary", usage?.primary_window ?? void 0, now),
+        windowFromPayload2("secondary", usage?.secondary_window ?? void 0, now)
+      ],
+      // The wham payload has no ratio field; keep the passively-observed value.
+      ...previous?.primaryOverSecondaryLimitPercent !== void 0 ? { primaryOverSecondaryLimitPercent: previous.primaryOverSecondaryLimitPercent } : {}
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  request(accountId, accessToken, tokens) {
+    const headers = {
+      Authorization: `Bearer ${accessToken}`,
+      Accept: "application/json",
+      "User-Agent": CODEX_CLI_USER_AGENT
+    };
+    const chatgptAccountId = resolveCodexChatGptAccountId(tokens);
+    if (chatgptAccountId) headers["ChatGPT-Account-Id"] = chatgptAccountId;
+    return this.fetchImpl(CODEX_USAGE_URL, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("codex", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + CODEX_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "codex",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + CODEX_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        { id: "primary", label: "Primary", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "secondary", label: "Secondary", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now, code = "codex_usage_unsupported_auth") {
+    return {
+      providerId: "codex",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: [
+        { id: "primary", label: "Primary", scope: "all", usedPercent: null, state: "unsupported" },
+        { id: "secondary", label: "Secondary", scope: "all", usedPercent: null, state: "unsupported" }
+      ],
+      lastErrorCode: code
+    };
+  }
+};
+
+// src/allowance/KimiAllowanceCollector.ts
+var import_AccountAllowanceStore3 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions3 = require("@omnicross/subscriptions");
+var KIMI_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var KIMI_USAGE_URL = "https://api.kimi.com/coding/v1/usages";
+function finiteNumber2(value) {
+  if (value === null || value === void 0 || value === "") return void 0;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseResetMs(row, nowMs) {
+  for (const key of ["reset_at", "resetAt", "reset_time", "resetTime"]) {
+    const value = row[key];
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Date.parse(value);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+    const numeric = finiteNumber2(value);
+    if (numeric !== void 0 && numeric > 1e9) {
+      return numeric > 1e12 ? numeric : numeric * 1e3;
+    }
+  }
+  for (const key of ["reset_in", "resetIn", "ttl", "window"]) {
+    const seconds = finiteNumber2(row[key]);
+    if (seconds !== void 0) return nowMs + seconds * 1e3;
+  }
+  return void 0;
+}
+var MINUTE_MS = 6e4;
+var HOUR_MS = 36e5;
+var DAY_MS = 864e5;
+function canonicalWindow(durationMs) {
+  if (durationMs === 5 * HOUR_MS) return { id: "five-hour", label: "5 hours", minutes: 300 };
+  if (durationMs === 7 * DAY_MS) return { id: "seven-day", label: "7 days", minutes: 10080 };
+  if (durationMs > 0 && durationMs % DAY_MS === 0) {
+    const days = durationMs / DAY_MS;
+    return { id: `${days}d`, label: `${days} day${days === 1 ? "" : "s"}`, minutes: Math.round(durationMs / MINUTE_MS) };
+  }
+  if (durationMs > 0 && durationMs % HOUR_MS === 0) {
+    const hours = durationMs / HOUR_MS;
+    return { id: `${hours}h`, label: `${hours} hour${hours === 1 ? "" : "s"}`, minutes: Math.round(durationMs / MINUTE_MS) };
+  }
+  return void 0;
+}
+function secondsUntil3(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function windowFromRow(row, fallback, now) {
+  const usedPercent = row?.limit !== void 0 && row.limit > 0 && row.used !== void 0 ? Math.round(Math.min(100, row.used / row.limit * 100) * 10) / 10 : null;
+  const resetsAt = row?.resetsAtMs !== void 0 ? new Date(row.resetsAtMs).toISOString() : void 0;
+  return {
+    id: fallback.id,
+    label: fallback.label,
+    scope: "all",
+    usedPercent,
+    windowMinutes: fallback.minutes,
+    ...resetsAt !== void 0 ? { resetsAt } : {},
+    remainingSeconds: secondsUntil3(resetsAt, now),
+    state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+  };
+}
+function parseKimiUsagePayload(payload, now) {
+  if (!isRecord(payload)) return [];
+  const byId = /* @__PURE__ */ new Map();
+  const rowFrom = (data) => {
+    const limit = finiteNumber2(data["limit"]);
+    let used = finiteNumber2(data["used"]);
+    const remaining = finiteNumber2(data["remaining"]);
+    if (used === void 0 && remaining !== void 0 && limit !== void 0) {
+      used = limit - remaining;
+    }
+    let windowDurationMs;
+    const windowData = isRecord(data["window"]) ? data["window"] : void 0;
+    const duration = finiteNumber2(windowData?.["duration"]);
+    const timeUnit = typeof windowData?.["timeUnit"] === "string" ? windowData["timeUnit"].toUpperCase() : "";
+    if (duration !== void 0) {
+      if (timeUnit.includes("MINUTE")) windowDurationMs = duration * MINUTE_MS;
+      else if (timeUnit.includes("HOUR")) windowDurationMs = duration * HOUR_MS;
+      else if (timeUnit.includes("DAY")) windowDurationMs = duration * DAY_MS;
+      else if (timeUnit.includes("WEEK")) windowDurationMs = duration * 7 * DAY_MS;
+      else if (timeUnit.includes("SECOND")) windowDurationMs = duration * 1e3;
+    }
+    const resetsAtMs = parseResetMs(windowData && parseResetMs(windowData, now) !== void 0 ? windowData : data, now);
+    return { used, limit, remaining, ...resetsAtMs !== void 0 ? { resetsAtMs } : {}, ...windowDurationMs !== void 0 ? { windowDurationMs } : {} };
+  };
+  if (isRecord(payload["usage"])) {
+    const row = rowFrom(payload["usage"]);
+    const window = windowFromRow({ ...row, resetsAtMs: row.resetsAtMs }, { id: "seven-day", label: "7 days", minutes: 10080 }, now);
+    byId.set("seven-day", window);
+  }
+  if (Array.isArray(payload["limits"])) {
+    for (const item of payload["limits"]) {
+      if (!isRecord(item)) continue;
+      const detail = isRecord(item["detail"]) ? item["detail"] : item;
+      const row = rowFrom(detail);
+      const canonical = row.windowDurationMs !== void 0 ? canonicalWindow(row.windowDurationMs) : void 0;
+      if (!canonical) continue;
+      const window = windowFromRow(row, canonical, now);
+      const existing = byId.get(canonical.id);
+      if (!existing || (window.usedPercent ?? 0) > (existing.usedPercent ?? 0)) {
+        byId.set(canonical.id, window);
+      }
+    }
+  }
+  return [...byId.values()].sort((a, b) => (a.windowMinutes ?? Infinity) - (b.windowMinutes ?? Infinity)).slice(0, 4);
+}
+var KimiAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore3.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch3.fetchUpstream)(url, init, { providerId: "kimi", accountId, redactBodies: true }), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    if (account.tokens.authMethod !== "oauth") {
+      const existing = this.store.get("kimi", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) {
+        return Promise.resolve(existing);
+      }
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("kimi", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) {
+      return Promise.resolve(cached);
+    }
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id, account.tokens).catch(() => this.failureSnapshot(account.id, "kimi_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId, tokens) {
+    let accessToken = await this.credentials.getAccessTokenForAccount("kimi", accountId);
+    if (!accessToken) return this.failureSnapshot(accountId, "kimi_usage_token_unavailable", this.now());
+    let response = await this.request(accountId, accessToken, tokens);
+    if (response.status === 401) {
+      const refreshed = await this.credentials.refreshAccountToken("kimi", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "kimi_usage_unauthorized", this.now());
+      accessToken = await this.credentials.getAccessTokenForAccount("kimi", accountId);
+      if (!accessToken) return this.failureSnapshot(accountId, "kimi_usage_token_unavailable", this.now());
+      response = await this.request(accountId, accessToken, tokens);
+    }
+    if (response.status === 403) {
+      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "kimi_usage_unsupported");
+      this.store.set(snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) return this.failureSnapshot(accountId, "kimi_usage_http_error", this.now());
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(accountId, "kimi_usage_invalid_response", this.now());
+    }
+    const now = this.now();
+    const windows = parseKimiUsagePayload(payload, now);
+    const snapshot = {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: windows.length > 0 ? windows : [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      ...windows.length > 0 ? {} : { lastErrorCode: "kimi_usage_invalid_response" }
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  request(accountId, accessToken, tokens) {
+    return this.fetchImpl(KIMI_USAGE_URL, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        ...(0, import_subscriptions3.kimiFingerprintHeaders)(tokens.deviceId)
+      },
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("kimi", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now, code = "kimi_usage_unsupported_auth") {
+    return {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unsupported" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unsupported" }
+      ],
+      lastErrorCode: code
+    };
+  }
+};
+
+// src/allowance/OpenCodeGoAllowanceCollector.ts
+var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions4 = require("@omnicross/subscriptions");
+var OPENCODEGO_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var OPENCODEGO_DEFAULT_GO_BASE = "https://opencode.ai/zen/go";
+function finitePercent3(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 && parsed <= 100 ? parsed : null;
+}
+function isoInstant2(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const time = Date.parse(value);
+  return Number.isFinite(time) ? new Date(time).toISOString() : void 0;
+}
+function secondsUntil4(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function windowFromPayload3(id, label, minutes, payload, now) {
+  const statusRateLimited = payload?.status === "rate-limited";
+  const usedPercent = statusRateLimited ? 100 : finitePercent3(payload?.percent);
+  const resetsAt = isoInstant2(payload?.resetsAt);
+  return {
+    id,
+    label,
+    scope: "all",
+    usedPercent,
+    windowMinutes: minutes,
+    ...resetsAt !== void 0 ? { resetsAt } : {},
+    remainingSeconds: secondsUntil4(resetsAt, now),
+    state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+  };
+}
+var OpenCodeGoAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore4.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId: "opencodego", accountId, redactBodies: true }), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    const cached = this.store.get("opencodego", account.id, now);
+    if (!options.force && cached && (cached.windows.every((window) => window.state === "unsupported") || cached.expiresAt && Date.parse(cached.expiresAt) > now + (options.refreshAheadMs ?? 0))) {
+      return Promise.resolve(cached);
+    }
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account).catch(() => this.failureSnapshot(account.id, this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  async fetchAccount(account) {
+    const apiKey = await this.credentials.getAccessTokenForAccount("opencodego", account.id);
+    if (!apiKey) return this.failureSnapshot(account.id, this.now());
+    const base = account.tokens.baseUrl ? (0, import_subscriptions4.normalizeOpenCodeGoBaseUrl)(account.tokens.baseUrl) : OPENCODEGO_DEFAULT_GO_BASE;
+    const response = await this.fetchImpl(`${base}/v1/usage`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      signal: AbortSignal.timeout(15e3)
+    }, account.id);
+    if (response.status === 401 || response.status === 403) {
+      return this.failureSnapshot(account.id, this.now(), "opencodego_usage_unauthorized");
+    }
+    if (!response.ok) return this.failureSnapshot(account.id, this.now());
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(account.id, this.now());
+    }
+    const usage = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.usage : void 0;
+    const now = this.now();
+    const snapshot = {
+      providerId: "opencodego",
+      accountId: account.id,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + OPENCODEGO_ALLOWANCE_CACHE_MS).toISOString(),
+      // Monthly deliberately omitted (module doc).
+      windows: [
+        windowFromPayload3("five-hour", "5 hours", 5 * 60, usage?.rolling ?? void 0, now),
+        windowFromPayload3("seven-day", "7 days", 7 * 24 * 60, usage?.weekly ?? void 0, now)
+      ]
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  failureSnapshot(accountId, now, code = "opencodego_usage_request_failed") {
+    const existing = this.store.get("opencodego", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + OPENCODEGO_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.usedPercent !== null || window.resetsAt ? "stale" : window.state
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "opencodego",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + OPENCODEGO_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+};
+
 // src/allowance/AccountAllowanceService.ts
 function codexUnavailable(accountId, now) {
   return {
@@ -1522,26 +2222,30 @@ function codexUnavailable(accountId, now) {
   };
 }
 var AccountAllowanceService = class {
-  constructor(credentials, store = (0, import_AccountAllowanceStore2.getSharedAccountAllowanceStore)(), collector, now = Date.now) {
+  constructor(credentials, store = (0, import_AccountAllowanceStore5.getSharedAccountAllowanceStore)(), collector, codexCollector, kimiCollector, opencodegoCollector, now = Date.now) {
     this.credentials = credentials;
     this.store = store;
     this.now = now;
     this.claudeCollector = collector ?? new ClaudeAllowanceCollector(credentials, store);
+    this.codexCollector = codexCollector ?? new CodexAllowanceCollector(credentials, store);
+    this.kimiCollector = kimiCollector ?? new KimiAllowanceCollector(credentials, store);
+    this.opencodegoCollector = opencodegoCollector ?? new OpenCodeGoAllowanceCollector(credentials, store);
   }
   credentials;
   store;
   now;
   claudeCollector;
+  codexCollector;
+  kimiCollector;
+  opencodegoCollector;
   /**
-   * Read all/filtered snapshots. Claude's five-minute cache is refreshed lazily;
-   * Codex remains passive and reports not-observed until a real model response.
+   * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
+   * refreshed lazily on read (Codex polls `/backend-api/wham/usage`; the
+   * passive `x-codex-*` header tap still feeds mid-flight updates).
    */
   async list(filter = {}) {
     const config = await this.credentials.getFullConfig();
-    this.store.pruneToKnownAccounts([
-      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
-      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
-    ]);
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
     const wantsClaude = !filter.providerId || filter.providerId === "claude";
     const claudeAccounts = (config.claudeAccounts ?? []).filter(
       (account) => !filter.accountId || account.id === filter.accountId
@@ -1552,39 +2256,90 @@ var AccountAllowanceService = class {
       (account) => !filter.accountId || account.id === filter.accountId
     );
     if (wantsCodex) {
+      await this.codexCollector.collectMany(codexAccounts);
       for (const account of codexAccounts) {
         if (!this.store.get("codex", account.id)) this.store.set(codexUnavailable(account.id, this.now()));
       }
     }
+    const wantsKimi = !filter.providerId || filter.providerId === "kimi";
+    const kimiAccounts = (config.kimiAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsKimi) await this.kimiCollector.collectMany(kimiAccounts);
+    const wantsOpenCodeGo = !filter.providerId || filter.providerId === "opencodego";
+    const opencodegoAccounts = (config.opencodegoAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsOpenCodeGo) await this.opencodegoCollector.collectMany(opencodegoAccounts);
     const known = /* @__PURE__ */ new Set();
     if (wantsClaude) for (const account of claudeAccounts) known.add(`claude\0${account.id}`);
     if (wantsCodex) for (const account of codexAccounts) known.add(`codex\0${account.id}`);
+    if (wantsKimi) for (const account of kimiAccounts) known.add(`kimi\0${account.id}`);
+    if (wantsOpenCodeGo) for (const account of opencodegoAccounts) known.add(`opencodego\0${account.id}`);
     return this.store.list(filter).filter((snapshot) => known.has(`${snapshot.providerId}\0${snapshot.accountId}`));
   }
+  knownAccounts(config) {
+    return [
+      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
+      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id })),
+      ...(config.kimiAccounts ?? []).map((account) => ({ providerId: "kimi", accountId: account.id })),
+      ...(config.opencodegoAccounts ?? []).map((account) => ({ providerId: "opencodego", accountId: account.id }))
+    ];
+  }
   /** Force-refresh Claude usage for one account or every stored Claude account. */
   async refreshClaude(accountId) {
     const config = await this.credentials.getFullConfig();
-    this.store.pruneToKnownAccounts([
-      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
-      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
-    ]);
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
     const accounts = (config.claudeAccounts ?? []).filter(
       (account) => !accountId || account.id === accountId
     );
     return this.claudeCollector.collectMany(accounts, { force: true });
   }
   /**
-   * Keep Claude snapshots warm for allowance-aware routing. This deliberately
-   * excludes Codex (whose quota is learned from real response headers) and
-   * preserves the collector's cache + per-account in-flight coalescing.
+   * Force-refresh Codex usage (`/backend-api/wham/usage`) for one account or
+   * every stored Codex account. Replaces the old probe-request workaround —
+   * no quota is spent reading the usage endpoint.
+   */
+  async refreshCodex(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
+    const accounts = (config.codexAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.codexCollector.collectMany(accounts, { force: true });
+  }
+  /** Force-refresh OpenCodeGo usage (`{go}/v1/usage`) for one/all accounts. */
+  async refreshOpenCodeGo(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
+    const accounts = (config.opencodegoAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.opencodegoCollector.collectMany(accounts, { force: true });
+  }
+  /** Force-refresh Kimi usage (`/coding/v1/usages`) for one/all accounts. */
+  async refreshKimi(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
+    const accounts = (config.kimiAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.kimiCollector.collectMany(accounts, { force: true });
+  }
+  /**
+   * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
+   * collectors preserve their cache + per-account in-flight coalescing; a tick
+   * normally performs no network I/O. (Codex joined the warm path when it
+   * gained an active `/wham/usage` collector — the passive `x-codex-*` header
+   * tap alone could not keep the policy fed while idle.)
    */
   async maintainClaudeCache(refreshAheadMs) {
     const config = await this.credentials.getFullConfig();
-    this.store.pruneToKnownAccounts([
-      ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
-      ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id }))
-    ]);
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
     await this.claudeCollector.collectMany(config.claudeAccounts ?? [], { refreshAheadMs });
+    await this.codexCollector.collectMany(config.codexAccounts ?? [], { refreshAheadMs });
+    await this.kimiCollector.collectMany(config.kimiAccounts ?? [], { refreshAheadMs });
+    await this.opencodegoCollector.collectMany(config.opencodegoAccounts ?? [], { refreshAheadMs });
   }
   /** Remove a cache row as soon as an account is deleted by the admin path. */
   removeAccountSnapshot(providerId, accountId) {
@@ -1679,7 +2434,7 @@ var ClaudeAllowanceRefreshScheduler = class {
 var import_node_crypto4 = require("crypto");
 var import_node_fs6 = require("fs");
 var import_node_path6 = require("path");
-var import_AccountAllowanceStore3 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore6 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var ACCOUNT_ALLOWANCE_CACHE_VERSION = 1;
 var MAX_PERSISTED_ALLOWANCE_SNAPSHOTS = 256;
 var MAX_ALLOWANCE_CACHE_BYTES = 1e6;
@@ -1708,7 +2463,7 @@ var JsonAccountAllowancePersistence = class {
   save(snapshots) {
     const rows = [];
     for (const snapshot of snapshots) {
-      const normalized2 = (0, import_AccountAllowanceStore3.normalizeAccountAllowanceSnapshot)(snapshot);
+      const normalized2 = (0, import_AccountAllowanceStore6.normalizeAccountAllowanceSnapshot)(snapshot);
       if (!normalized2) continue;
       rows.push(normalized2);
       if (rows.length >= MAX_PERSISTED_ALLOWANCE_SNAPSHOTS) break;
@@ -1984,7 +2739,7 @@ var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/image-generation/imagesConfigValidation.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
@@ -3617,11 +4372,11 @@ function preserveOutboundProxySecrets(incoming, current) {
 }
 
 // src/proxy/upstreamProxyResolver.ts
-var import_upstreamFetch2 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 var serverProxy;
 function setServerProxyConfig(proxy) {
   serverProxy = proxy;
-  (0, import_upstreamFetch2.bumpUpstreamProxyGeneration)();
+  (0, import_upstreamFetch5.bumpUpstreamProxyGeneration)();
 }
 function getServerProxyConfig() {
   return serverProxy;
@@ -3689,14 +4444,15 @@ function createUpstreamProxyResolver(src = {}) {
 }
 
 // src/admin/accountsOAuth.ts
-var import_subscriptions2 = require("@omnicross/subscriptions");
+var import_subscriptions5 = require("@omnicross/subscriptions");
 
 // src/admin/accountsWrite.ts
 var VALID_PROVIDER_IDS = [
   "claude",
   "codex",
   "gemini",
-  "opencodego"
+  "opencodego",
+  "kimi"
 ];
 function asSubscriptionProviderId(id) {
   return VALID_PROVIDER_IDS.includes(id) ? id : null;
@@ -3832,6 +4588,18 @@ function validateGemini(body) {
   copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "lastRefreshedAt", "errorMessage"]);
   return out;
 }
+function validateKimi(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !OAUTH_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const out = {
+    authMethod,
+    status
+  };
+  copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "accountId", "deviceId", "lastRefreshedAt", "errorMessage"]);
+  return out;
+}
 function validateOpenCodeGo(body) {
   const authMethod = str(body["authMethod"]);
   const status = str(body["status"]);
@@ -3867,6 +4635,8 @@ function validateTokenBody(providerId, body) {
       return validateGemini(body);
     case "opencodego":
       return validateOpenCodeGo(body);
+    case "kimi":
+      return validateKimi(body);
     default:
       return null;
   }
@@ -3896,37 +4666,37 @@ async function statusEntryFor(reader, providerId) {
 
 // src/admin/accountsOAuth.ts
 var OAUTH_HTTP_PROVIDERS = /* @__PURE__ */ new Set(["claude", "gemini"]);
-function err2(status, message) {
+function err3(status, message) {
   return { status, body: { error: { type: "admin_api_error", message } } };
 }
 function handleOAuthStart(providerId, deps) {
   if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
-    return err2(400, `oauth not available for provider '${providerId}'`);
+    return err3(400, `oauth not available for provider '${providerId}'`);
   }
-  const flow = providerId === "claude" ? import_subscriptions2.claudeOAuth : import_subscriptions2.geminiOAuth;
+  const flow = providerId === "claude" ? import_subscriptions5.claudeOAuth : import_subscriptions5.geminiOAuth;
   const { authUrl, codeVerifier, state } = flow.generateAuthParams();
   const sessionId = deps.oauthSessions.put({ providerId, codeVerifier, state });
   return { status: 200, body: { authUrl, sessionId } };
 }
 async function handleOAuthComplete(providerId, body, deps) {
   if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
-    return err2(400, `oauth not available for provider '${providerId}'`);
+    return err3(400, `oauth not available for provider '${providerId}'`);
   }
   const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : "";
   const rawCode = typeof body["code"] === "string" ? body["code"] : "";
-  if (!sessionId) return err2(400, "oauth complete requires { sessionId }");
-  if (!rawCode) return err2(400, "oauth complete requires { code }");
+  if (!sessionId) return err3(400, "oauth complete requires { sessionId }");
+  if (!rawCode) return err3(400, "oauth complete requires { code }");
   const session = deps.oauthSessions.peek(sessionId);
-  if (!session) return err2(410, "oauth session is unknown, expired, or already used");
+  if (!session) return err3(410, "oauth session is unknown, expired, or already used");
   if (session.providerId !== providerId) {
-    return err2(400, `oauth session does not match provider '${providerId}'`);
+    return err3(400, `oauth session does not match provider '${providerId}'`);
   }
   let code = rawCode.trim();
   if (providerId === "claude") {
     const [splitCode, pastedState] = code.split("#");
-    if (!splitCode) return err2(400, "no authorization code was provided");
+    if (!splitCode) return err3(400, "no authorization code was provided");
     if (pastedState && pastedState !== session.state) {
-      return err2(400, "oauth state did not match (possible CSRF) \u2014 aborting");
+      return err3(400, "oauth state did not match (possible CSRF) \u2014 aborting");
     }
     code = splitCode;
   }
@@ -3936,7 +4706,7 @@ async function handleOAuthComplete(providerId, body, deps) {
     block = providerId === "claude" ? await exchangeClaude(code, session.codeVerifier, session.state, exchangeFetch) : await exchangeGemini(code, session.codeVerifier, exchangeFetch);
   } catch (exchangeError) {
     const reason = exchangeError instanceof Error ? exchangeError.message : "token exchange failed";
-    return err2(502, `oauth token exchange failed for '${providerId}': ${reason}`);
+    return err3(502, `oauth token exchange failed for '${providerId}': ${reason}`);
   }
   deps.oauthSessions.consume(sessionId);
   const label = typeof body["label"] === "string" && body["label"].trim() ? body["label"].trim() : void 0;
@@ -3945,7 +4715,7 @@ async function handleOAuthComplete(providerId, body, deps) {
   return { status: 200, body: status ? { account: status } : { ok: true } };
 }
 async function exchangeClaude(code, codeVerifier, state, exchangeFetch) {
-  const result = await import_subscriptions2.claudeOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions5.claudeOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -3961,7 +4731,7 @@ async function exchangeClaude(code, codeVerifier, state, exchangeFetch) {
   };
 }
 async function exchangeGemini(code, codeVerifier, exchangeFetch) {
-  const result = await import_subscriptions2.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const result = await import_subscriptions5.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
   const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
   return {
     authMethod: "oauth",
@@ -4266,8 +5036,8 @@ function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
 var defaultCommandRunner = (command) => new Promise((resolve11) => {
-  (0, import_node_child_process.exec)(command, { timeout: 18e4 }, (err5, _stdout, stderr) => {
-    if (err5) resolve11({ ok: false, error: stderr.trim() || err5.message });
+  (0, import_node_child_process.exec)(command, { timeout: 18e4 }, (err6, _stdout, stderr) => {
+    if (err6) resolve11({ ok: false, error: stderr.trim() || err6.message });
     else resolve11({ ok: true });
   });
 });
@@ -4313,8 +5083,8 @@ async function handleCliLaunch(cli, body, ctx) {
       providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
       model: typeof body["model"] === "string" ? body["model"] : void 0
     });
-  } catch (err5) {
-    return { status: 400, body: errBody(err5 instanceof Error ? err5.message : "no launch target") };
+  } catch (err6) {
+    return { status: 400, body: errBody(err6 instanceof Error ? err6.message : "no launch target") };
   }
   const id = (0, import_node_crypto7.randomUUID)();
   let leaseId2;
@@ -4342,9 +5112,9 @@ async function handleCliLaunch(cli, body, ctx) {
     } else {
       launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
     }
-  } catch (err5) {
-    const status = err5 instanceof import_provider_proxy2.RouteLeaseError ? err5.status : 400;
-    return { status, body: errBody(err5 instanceof Error ? err5.message : "failed to build launch env") };
+  } catch (err6) {
+    const status = err6 instanceof import_provider_proxy2.RouteLeaseError ? err6.status : 400;
+    return { status, body: errBody(err6 instanceof Error ? err6.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
@@ -4372,9 +5142,9 @@ async function handleCliLaunch(cli, body, ctx) {
       onFailure: onSessionEnd
     });
     if (cleanup) openerCleanup = cleanup;
-  } catch (err5) {
+  } catch (err6) {
     onSessionEnd();
-    return { status: 500, body: errBody(err5 instanceof Error ? err5.message : "failed to open terminal") };
+    return { status: 500, body: errBody(err6 instanceof Error ? err6.message : "failed to open terminal") };
   }
   if (ended) {
     openerCleanup?.();
@@ -4509,6 +5279,7 @@ async function handleDashboard(deps) {
 var import_outbound_api2 = require("@omnicross/core/outbound-api");
 var import_api3 = require("@omnicross/core/search/api");
 var import_http3 = require("@omnicross/core/search/http");
+var import_search2 = require("@omnicross/core/search");
 
 // src/search/searchDoctorProjection.ts
 var import_search_types = require("@omnicross/contracts/search-types");
@@ -4569,7 +5340,7 @@ function buildSearchDoctorSnapshot(contributions = (0, import_http.builtinHttpSe
   }
   return rows;
 }
-var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
 function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
   if (outcome.kind === "results") {
     if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
@@ -4628,6 +5399,7 @@ async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ n
 }
 
 // src/search/SearchAssembly.ts
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_search = require("@omnicross/core/search");
 var import_api2 = require("@omnicross/core/search/api");
 var import_http2 = require("@omnicross/core/search/http");
@@ -4644,11 +5416,24 @@ function searchPolicyFrom(config) {
     ...maxAttempts !== void 0 ? { maxAttempts } : {}
   };
 }
+function resolveSearchUpstreamDispatcher(url) {
+  return (0, import_upstreamFetch6.resolveUpstreamDispatcher)({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
 function searchContributionsFrom(config) {
   return [
-    ...(0, import_http2.builtinHttpSearchContributions)(),
+    ...(0, import_http2.builtinHttpSearchContributions)(
+      (0, import_http2.createSearchHttpTransport)({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
     ...(0, import_api2.apiSearchContributions)(config.providers, {
-      egressPolicy: searchEgressPolicyFrom(config)
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
     })
   ];
 }
@@ -4792,6 +5577,18 @@ async function handleSearchDiagnostics(res, deps) {
   };
   return writeJson(res, 200, { diagnostics: snapshot });
 }
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...(0, import_http3.builtinHttpSearchContributions)(
+        (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...(0, import_api3.apiSearchContributions)(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
 async function handleSearchTest(req, res, deps) {
   const status = deps.searchStatus;
   const body = await readBodyOrReject(req, res);
@@ -4809,16 +5606,8 @@ async function handleSearchTest(req, res, deps) {
   if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
-  const egressPolicy = searchEgressPolicyFrom(search);
   const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
+  const contributions = persistedSearchContributions(search, fetchImpl);
   const contribution = contributions.find((c) => c.id === providerId);
   if (!contribution) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
@@ -4859,48 +5648,49 @@ async function handleSearchQuery(req, res, deps) {
   }
   if (QUERY_CONTROL_CHARS.test(query2)) {
     return writeErr(res, 400, "query must not contain control characters");
-  }
-  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
-  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
-  const providers = search.providers;
-  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
-    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
-  }
-  const egressPolicy = searchEgressPolicyFrom(search);
-  const fetchImpl = status.testFetch;
-  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
-  const contributions = [
-    ...(0, import_http3.builtinHttpSearchContributions)(transport),
-    ...(0, import_api3.apiSearchContributions)(search.providers, {
-      egressPolicy,
-      ...fetchImpl ? { fetchImpl } : {}
-    })
-  ];
-  const contribution = contributions.find((c) => c.id === providerId);
-  if (!contribution) {
+  }
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
     return writeErr(res, 400, `search provider '${providerId}' is not configured`);
   }
+  const fetchImpl = status.testFetch;
+  const runtime = (0, import_search2.createSearchRuntime)({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
     const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
       title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
       url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
       content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
     }));
-    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
-      contribution.id,
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
       { kind: "results", count: sanitized.length },
       checkedAt
     );
     const response = {
       diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
       resultCount: sanitized.length,
       results: sanitized
     };
     return writeJson(res, 200, { result: response });
   } catch (error) {
-    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
     const response = { diagnostic };
     return writeJson(res, 200, { result: response });
   }
@@ -4909,7 +5699,7 @@ async function handleSearchQuery(req, res, deps) {
 // src/admin/searchAdminView.ts
 var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
 var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function redactSearchServerConfig(search) {
@@ -4959,13 +5749,13 @@ function resolveSecretField(entry, field, stored) {
   else delete entry[field];
 }
 function preserveSearchSecrets(incoming, current) {
-  if (!isRecord(incoming)) return incoming;
+  if (!isRecord2(incoming)) return incoming;
   const section = { ...incoming };
   const providersValue = section["providers"];
-  if (!isRecord(providersValue)) return section;
+  if (!isRecord2(providersValue)) return section;
   const providers = {};
   for (const [id, entryValue] of Object.entries(providersValue)) {
-    if (!isRecord(entryValue)) {
+    if (!isRecord2(entryValue)) {
       providers[id] = entryValue;
       continue;
     }
@@ -5043,7 +5833,7 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord2(value) {
+function isRecord3(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -5063,7 +5853,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord2(entry)) {
+    if (!isRecord3(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -5092,12 +5882,12 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord2(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord3(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
       }
     }
-    if (!isRecord2(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord3(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -5112,7 +5902,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord2(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord3(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -5394,7 +6184,8 @@ var PROVIDER_KEYS = {
     block: "opencodego",
     accounts: "opencodegoAccounts",
     active: "activeOpencodegoAccountId"
-  }
+  },
+  kimi: { block: "kimi", accounts: "kimiAccounts", active: "activeKimiAccountId" }
 };
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
@@ -5916,7 +6707,7 @@ async function applyImport(packString, passphrase, mode, deps, parseProviderInpu
 }
 
 // src/admin/adminMigration.ts
-function err3(status, message) {
+function err4(status, message) {
   return { status, body: { error: { type: "admin_api_error", message } } };
 }
 async function handleExport(body, deps) {
@@ -5926,30 +6717,30 @@ async function handleExport(body, deps) {
     return { status: 200, body: { pack, version: BUNDLE_VERSION } };
   } catch (error) {
     if (error instanceof WeakPassphraseError) {
-      return err3(400, error.message);
+      return err4(400, error.message);
     }
-    return err3(500, "failed to build the migration pack");
+    return err4(500, "failed to build the migration pack");
   }
 }
 async function handleImport(body, deps) {
   const blob = typeof body["blob"] === "string" ? body["blob"] : "";
   const passphrase = typeof body["passphrase"] === "string" ? body["passphrase"] : "";
   const mode = body["mode"] === "overwrite" ? "overwrite" : "merge";
-  if (!blob) return err3(400, "import requires { blob }");
+  if (!blob) return err4(400, "import requires { blob }");
   try {
     const counts = await applyImport(blob, passphrase, mode, deps, deps.parseProviderInput);
     return { status: 200, body: counts };
   } catch (error) {
     if (error instanceof WeakPassphraseError) {
-      return err3(400, error.message);
+      return err4(400, error.message);
     }
-    return err3(400, error instanceof Error ? error.message : "import failed");
+    return err4(400, error instanceof Error ? error.message : "import failed");
   }
 }
 
 // src/admin/usagePricing.ts
 var import_usage = require("@omnicross/core/usage");
-var err4 = (status, message) => ({
+var err5 = (status, message) => ({
   status,
   body: { error: { type: "admin_api_error", message } }
 });
@@ -5962,7 +6753,7 @@ function parseRange(query2) {
   const startTs = parseFiniteInt(query2.get("startTs"));
   const endTs = parseFiniteInt(query2.get("endTs"));
   if (startTs === null || endTs === null) {
-    return err4(400, "startTs and endTs are required finite-integer unix-millis query params");
+    return err5(400, "startTs and endTs are required finite-integer unix-millis query params");
   }
   return { startTs, endTs };
 }
@@ -5987,14 +6778,14 @@ async function handleUsageGet(view, query2, deps) {
     case "timeseries": {
       const bucket = query2.get("bucket");
       if (bucket !== "hour" && bucket !== "day" && bucket !== "month") {
-        return err4(400, "bucket must be one of 'hour', 'day', 'month'");
+        return err5(400, "bucket must be one of 'hour', 'day', 'month'");
       }
       const now = Date.now();
       const clamped = { startTs: range.startTs, endTs: Math.min(range.endTs, now) };
       if (clamped.startTs < clamped.endTs) {
         const projected = Math.ceil((clamped.endTs - clamped.startTs) / BUCKET_SPAN_MS[bucket]) + 1;
         if (projected > MAX_TIMESERIES_BUCKETS) {
-          return err4(
+          return err5(
             400,
             `requested range projects ~${projected} '${bucket}' buckets (max ${MAX_TIMESERIES_BUCKETS}); narrow the range or use a coarser bucket`
           );
@@ -6017,7 +6808,7 @@ async function handleUsageGet(view, query2, deps) {
       };
     }
     default:
-      return err4(404, `unknown usage view '${view ?? ""}'`);
+      return err5(404, `unknown usage view '${view ?? ""}'`);
   }
 }
 function poolKeyLabels(cfg) {
@@ -6066,7 +6857,7 @@ async function handlePricingList(deps) {
 async function handlePricingUpsert(body, deps) {
   const input = parsePricingEntryInput(body);
   if (!input) {
-    return err4(400, "invalid pricing entry (providerId, modelId, finite numeric inputPricePer1m/outputPricePer1m required)");
+    return err5(400, "invalid pricing entry (providerId, modelId, finite numeric inputPricePer1m/outputPricePer1m required)");
   }
   const entry = await deps.pricingEngine.upsertManual(input);
   return { status: 200, body: { entry } };
@@ -6075,7 +6866,7 @@ async function handlePricingDelete(query2, deps) {
   const providerId = query2.get("providerId")?.trim() ?? "";
   const modelId = query2.get("modelId")?.trim() ?? "";
   if (!providerId || !modelId) {
-    return err4(400, "delete requires providerId and modelId query params");
+    return err5(400, "delete requires providerId and modelId query params");
   }
   const deleted = await deps.pricingStore.delete(providerId, modelId);
   if (deleted) await deps.pricingEngine.invalidateCache();
@@ -6095,13 +6886,13 @@ async function handlePricingFetchLatest(deps) {
       }
     };
   } catch (e) {
-    return err4(502, `pricing-source fetch failed: ${e instanceof Error ? e.message : String(e)}`);
+    return err5(502, `pricing-source fetch failed: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
 async function handlePricingResolveConflicts(body, deps) {
   const raw = body["resolutions"];
   if (!Array.isArray(raw)) {
-    return err4(400, "resolve-conflicts requires { resolutions: [...] }");
+    return err5(400, "resolve-conflicts requires { resolutions: [...] }");
   }
   const currentRows = await deps.pricingStore.getAll();
   const userEditedKeys = new Set(
@@ -6111,21 +6902,21 @@ async function handlePricingResolveConflicts(body, deps) {
   const pendingIncoming = /* @__PURE__ */ new Map();
   let staleCount = 0;
   for (const item of raw) {
-    if (!item || typeof item !== "object") return err4(400, "invalid resolution entry");
+    if (!item || typeof item !== "object") return err5(400, "invalid resolution entry");
     const r = item;
     const action = r["action"];
     if (action !== "overwrite" && action !== "skip") {
-      return err4(400, "resolution action must be 'overwrite' or 'skip'");
+      return err5(400, "resolution action must be 'overwrite' or 'skip'");
     }
     const providerId = typeof r["providerId"] === "string" && r["providerId"].trim() ? r["providerId"].trim() : "";
     const modelId = typeof r["modelId"] === "string" && r["modelId"].trim() ? r["modelId"].trim() : "";
     if (!providerId || !modelId) {
-      return err4(400, "each resolution requires top-level providerId and modelId");
+      return err5(400, "each resolution requires top-level providerId and modelId");
     }
     const incoming = parsePricingEntryInput(r["incoming"]);
-    if (!incoming) return err4(400, "each resolution must echo a valid incoming pricing entry");
+    if (!incoming) return err5(400, "each resolution must echo a valid incoming pricing entry");
     if (incoming.providerId !== providerId || incoming.modelId !== modelId) {
-      return err4(400, "resolution providerId/modelId must match the echoed incoming entry");
+      return err5(400, "resolution providerId/modelId must match the echoed incoming entry");
     }
     const key = `${providerId}::${modelId}`;
     if (action === "overwrite" && !userEditedKeys.has(key)) {
@@ -6170,7 +6961,7 @@ function query(req) {
 }
 function allowanceProvider(value) {
   if (!value) return void 0;
-  return value === "claude" || value === "codex" ? value : null;
+  return value === "claude" || value === "codex" || value === "kimi" || value === "opencodego" ? value : null;
 }
 async function handleAccountAllowanceApi(req, res, method, rest, service) {
   if (!service) return writeError2(res, 501, "account allowance service is not available");
@@ -6184,7 +6975,9 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     const params = query(req);
     const pathProvider = rest.length >= 2 ? rest[0] : null;
     const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
-    if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
+    if (providerId === null) {
+      return writeError2(res, 400, "providerId must be claude, codex, kimi, or opencodego");
+    }
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
     return writeJson3(res, 200, { allowances });
@@ -6194,10 +6987,37 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     const requestedProvider = allowanceProvider(
       typeof body["providerId"] === "string" ? body["providerId"] : "claude"
     );
-    if (requestedProvider !== "claude") {
-      return writeError2(res, 400, "only Claude allowances support explicit refresh");
-    }
     const accountId = typeof body["accountId"] === "string" && body["accountId"].trim() ? body["accountId"].trim() : void 0;
+    if (requestedProvider === "codex") {
+      if (!service.refreshCodex) {
+        return writeError2(res, 501, "codex allowance refresh is not available");
+      }
+      const allowances2 = await service.refreshCodex(accountId);
+      if (accountId && allowances2.length === 0) {
+        return writeError2(res, 404, `Codex account '${accountId}' not found`);
+      }
+      return writeJson3(res, 200, { allowances: allowances2 });
+    }
+    if (requestedProvider === "kimi") {
+      if (!service.refreshKimi) {
+        return writeError2(res, 501, "kimi allowance refresh is not available");
+      }
+      const allowances2 = await service.refreshKimi(accountId);
+      if (accountId && allowances2.length === 0) {
+        return writeError2(res, 404, `Kimi account '${accountId}' not found`);
+      }
+      return writeJson3(res, 200, { allowances: allowances2 });
+    }
+    if (requestedProvider === "opencodego") {
+      if (!service.refreshOpenCodeGo) {
+        return writeError2(res, 501, "opencodego allowance refresh is not available");
+      }
+      const allowances2 = await service.refreshOpenCodeGo(accountId);
+      if (accountId && allowances2.length === 0) {
+        return writeError2(res, 404, `OpenCodeGo account '${accountId}' not found`);
+      }
+      return writeJson3(res, 200, { allowances: allowances2 });
+    }
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
@@ -6365,8 +7185,8 @@ async function handleAdminApi(req, res, path2, deps) {
       default:
         return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
     }
-  } catch (err5) {
-    writeJsonError(res, 500, err5 instanceof Error ? err5.message : String(err5));
+  } catch (err6) {
+    writeJsonError(res, 500, err6 instanceof Error ? err6.message : String(err6));
   }
 }
 function requestQuery(req) {
@@ -6436,6 +7256,9 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "POST" && rest.length === 4 && rest[1] === "keys" && rest[3] === "enabled") {
     return await handleToggleProviderKey(req, res, rest[0], rest[2], cfg, deps);
   }
+  if (method === "POST" && rest.length === 5 && rest[1] === "keys" && rest[3] === "quota" && rest[4] === "refresh") {
+    return await handleProviderKeyQuotaRefresh(res, rest[0], rest[2], cfg, deps);
+  }
   if (method === "PUT" && rest.length === 3 && rest[1] === "keys") {
     return await handleUpdateProviderKey(req, res, rest[0], rest[2], cfg, deps);
   }
@@ -6534,7 +7357,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await (0, import_upstreamFetch7.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -6551,8 +7374,8 @@ async function handleDiscoverModels(res, id, cfg) {
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
     return writeJson4(res, 200, { models });
-  } catch (err5) {
-    const message = err5 instanceof Error ? err5.message : String(err5);
+  } catch (err6) {
+    const message = err6 instanceof Error ? err6.message : String(err6);
     return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
@@ -6593,7 +7416,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(
+    const response = await (0, import_upstreamFetch7.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -6615,8 +7438,8 @@ async function handleTestModel(req, res, id, cfg) {
       latencyMs,
       sample: extractSampleText(text, row.apiFormat)
     });
-  } catch (err5) {
-    const message = err5 instanceof Error ? err5.message : String(err5);
+  } catch (err6) {
+    const message = err6 instanceof Error ? err6.message : String(err6);
     return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
@@ -6658,7 +7481,30 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  const views = toPoolKeyView(row, cooldown, deps);
+  if (deps.providerKeyQuota) {
+    const quotas = await Promise.allSettled(
+      views.map((view) => deps.providerKeyQuota.quotaFor(row, view.id))
+    );
+    views.forEach((view, index) => {
+      const settled = quotas[index];
+      if (settled.status === "fulfilled" && settled.value) view.quota = settled.value;
+    });
+  }
+  return writeJson4(res, 200, { keys: views });
+}
+async function handleProviderKeyQuotaRefresh(res, id, keyId, cfg, deps) {
+  if (!deps.providerKeyQuota) return writeJsonError(res, 501, "provider key quota is not available");
+  if (!id || !keyId) return writeJsonError(res, 400, "provider id and key id required in path");
+  const row = cfg.providers.find((p) => p.id === id);
+  if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
+  try {
+    const quota = await deps.providerKeyQuota.quotaFor(row, keyId, { force: true });
+    if (!quota) return writeJsonError(res, 404, `no quota endpoint for key '${keyId}'`);
+    return writeJson4(res, 200, { quota });
+  } catch {
+    return writeJsonError(res, 502, "quota refresh failed");
+  }
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -7403,12 +8249,12 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     return writeJson4(res, 200, { ok: true, affected: result.affected });
   }
-  if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
-    const result = handleCodexOAuthStatus(rest[2], deps);
+  if (method === "GET" && (rest[0] === "codex" || rest[0] === "kimi") && rest[1] === "oauth" && rest[3] === "status") {
+    const result = rest[0] === "codex" ? handleCodexOAuthStatus(rest[2], deps) : handleKimiOAuthStatus(rest[2], deps);
     return writeJson4(res, result.status, result.body);
   }
-  if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
-    const result = handleCodexOAuthCancel(rest[2], deps);
+  if (method === "DELETE" && (rest[0] === "codex" || rest[0] === "kimi") && rest[1] === "oauth" && rest[2]) {
+    const result = rest[0] === "codex" ? handleCodexOAuthCancel(rest[2], deps) : handleKimiOAuthCancel(rest[2], deps);
     return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
@@ -7461,7 +8307,15 @@ async function handleAccounts(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
-      const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
+      if (providerId === "codex") {
+        const result2 = handleCodexOAuthStart(deps);
+        return writeJson4(res, result2.status, result2.body);
+      }
+      if (providerId === "kimi") {
+        const result2 = await handleKimiOAuthStart(deps);
+        return writeJson4(res, result2.status, result2.body);
+      }
+      const result = handleOAuthStart(providerId, deps);
       return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
@@ -7955,12 +8809,12 @@ async function handlePlayground(req, res, method, deps) {
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord3(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord4(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord3(v) {
+function isRecord4(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
@@ -7989,8 +8843,8 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         });
       }
     );
-    upstream.on("error", (err5) => {
-      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err5.message}`);
+    upstream.on("error", (err6) => {
+      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err6.message}`);
       else res.end();
       resolve11();
     });
@@ -8096,7 +8950,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.1" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -8139,13 +8993,13 @@ var AdminServer = class {
       const server = import_node_http2.default.createServer((req, res) => {
         this.onRequest(req, res);
       });
-      const onError = (err5) => {
-        if (err5.code === "EADDRINUSE" && port !== 0) {
+      const onError = (err6) => {
+        if (err6.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
           this.listen(bindAddr, 0).then(resolve11, reject);
           return;
         }
-        reject(err5);
+        reject(err6);
       };
       server.on("error", onError);
       server.listen(port, bindAddr, () => {
@@ -8163,8 +9017,8 @@ var AdminServer = class {
   }
   /** Per-request handler: auth gate (when a token is set) → routing. */
   onRequest(req, res) {
-    void this.dispatch(req, res).catch((err5) => {
-      const message = err5 instanceof Error ? err5.message : String(err5);
+    void this.dispatch(req, res).catch((err6) => {
+      const message = err6 instanceof Error ? err6.message : String(err6);
       this.deps.logger.error("[AdminServer] unhandled error:", message);
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
@@ -8428,18 +9282,18 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       return;
     }
     signal?.addEventListener("abort", abort, { once: true });
-    server.on("error", (err5) => {
+    server.on("error", (err6) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (err5.code === "EADDRINUSE") {
+      if (err6.code === "EADDRINUSE") {
         reject(
           new Error(
             `login: cannot bind ${LOOPBACK_HOST}:${LOOPBACK_PORT} (address in use) \u2014 another codex login or process is holding the port`
           )
         );
       } else {
-        reject(err5);
+        reject(err6);
       }
     });
     const timer = setTimeout(() => {
@@ -8514,10 +9368,415 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
   };
 }
 
+// src/allowance/ProviderKeyQuotaService.ts
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+
+// src/allowance/ProviderKeyQuota.ts
+var MINUTE_MS2 = 6e4;
+var HOUR_MS2 = 60 * MINUTE_MS2;
+var DAY_MS2 = 24 * HOUR_MS2;
+var WEEK_MS = 7 * DAY_MS2;
+var MONTH_MS = 30 * DAY_MS2;
+function finiteNumber3(value) {
+  if (value === null || value === void 0 || value === "") return void 0;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+}
+function finitePercent4(value) {
+  const parsed = finiteNumber3(value);
+  return parsed !== void 0 && parsed <= 100 ? parsed : null;
+}
+function isoInstant3(value) {
+  if (typeof value === "string" && value.trim()) {
+    const time = Date.parse(value);
+    if (Number.isFinite(time)) return new Date(time).toISOString();
+  }
+  const numeric = finiteNumber3(value);
+  if (numeric !== void 0 && numeric > 1e9) {
+    const ms = numeric > 1e12 ? numeric : numeric * 1e3;
+    return new Date(ms).toISOString();
+  }
+  return void 0;
+}
+function secondsUntil5(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function isRecord5(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function detectProviderKeyQuotaAdapter(baseUrl) {
+  if (!baseUrl) return null;
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return null;
+  }
+  const host = url.hostname.toLowerCase();
+  const path2 = url.pathname.toLowerCase();
+  if ((host === "api.z.ai" || host === "open.bigmodel.cn") && path2.includes("/coding")) {
+    return "zai";
+  }
+  if ((host === "api.minimax.io" || host === "api.minimaxi.com") && // Token Plan rides the plain openai `/v1` (chat completions) surface; the
+  // anthropic `/anthropic` rows are excluded (their usage impl is unverified).
+  (path2 === "/v1" || path2 === "/v1/" || path2 === "" || path2 === "/")) {
+    return "minimax-token-plan";
+  }
+  if (host === "api.code.umans.ai") return "umans";
+  if (host === "api.synthetic.new") return "synthetic";
+  return null;
+}
+function providerKeyQuotaUrl(adapter, baseUrl) {
+  const origin = new URL(baseUrl).origin;
+  if (adapter === "zai") return `${origin}/api/monitor/usage/quota/limit`;
+  if (adapter === "minimax-token-plan") return `${origin}/v1/token_plan/remains`;
+  if (adapter === "umans") return `${origin}/v1/usage`;
+  return `${origin}/v2/quotas`;
+}
+function providerKeyQuotaAuthHeader(adapter, key) {
+  return adapter === "zai" ? key : `Bearer ${key}`;
+}
+function zaiWindowDurationMs(item) {
+  const count = item.number !== void 0 && item.number > 0 ? item.number : 1;
+  switch (item.unit) {
+    case 3:
+      return count * HOUR_MS2;
+    case 4:
+      return count * DAY_MS2;
+    case 5:
+      return count * MONTH_MS;
+    case 6:
+      return WEEK_MS;
+    default:
+      return void 0;
+  }
+}
+function zaiWindowIdLabel(durationMs) {
+  if (durationMs === WEEK_MS) return { id: "seven-day", label: "7 days" };
+  if (durationMs === 5 * HOUR_MS2) return { id: "five-hour", label: "5 hours" };
+  if (durationMs === MONTH_MS) return { id: "thirty-day", label: "30 days" };
+  if (durationMs !== void 0 && durationMs % DAY_MS2 === 0) {
+    const days = durationMs / DAY_MS2;
+    return { id: `${days}d`, label: `${days} day${days === 1 ? "" : "s"}` };
+  }
+  if (durationMs !== void 0 && durationMs % HOUR_MS2 === 0) {
+    const hours = durationMs / HOUR_MS2;
+    return { id: `${hours}h`, label: `${hours} hour${hours === 1 ? "" : "s"}` };
+  }
+  return { id: "quota", label: "Quota" };
+}
+function parseZaiQuotaPayload(payload, now) {
+  if (!isRecord5(payload)) return null;
+  const data = isRecord5(payload["data"]) ? payload["data"] : payload;
+  if (payload["success"] === false) return null;
+  const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
+  const byWindow = /* @__PURE__ */ new Map();
+  for (const raw of limits) {
+    if (!isRecord5(raw)) continue;
+    const item = raw;
+    if (item.type === void 0) continue;
+    const details = raw["usageDetails"];
+    if (Array.isArray(details) && details.some((d) => isRecord5(d) && d["modelCode"] === "zread")) {
+      continue;
+    }
+    const durationMs = zaiWindowDurationMs(item);
+    const { id, label } = zaiWindowIdLabel(durationMs);
+    const limit = finiteNumber3(item.usage);
+    const used = finiteNumber3(item.currentValue);
+    const fromAbsolute = limit !== void 0 && used !== void 0 && limit > 0 ? Math.min(100, used / limit * 100) : void 0;
+    const fromPercentage = finitePercent4(item.percentage) ?? void 0;
+    const usedPercent = fromAbsolute !== void 0 ? Math.round(fromAbsolute * 10) / 10 : fromPercentage;
+    if (usedPercent === void 0) continue;
+    const resetsAt = isoInstant3(item.nextResetTime);
+    const candidate = {
+      id,
+      label,
+      scope: "all",
+      usedPercent,
+      ...durationMs !== void 0 ? { windowMinutes: Math.round(durationMs / MINUTE_MS2) } : {},
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil5(resetsAt, now),
+      state: "fresh"
+    };
+    const existing = byWindow.get(id);
+    if (!existing || (candidate.usedPercent ?? 0) > (existing.usedPercent ?? 0)) {
+      byWindow.set(id, candidate);
+    }
+  }
+  const windows = [...byWindow.values()].sort((a, b) => (a.windowMinutes ?? Number.POSITIVE_INFINITY) - (b.windowMinutes ?? Number.POSITIVE_INFINITY));
+  return windows.length > 0 ? windows.slice(0, 4) : null;
+}
+var MINIMAX_STATUS_EXHAUSTED = 2;
+var MINIMAX_SHARED_BUCKET = "general";
+function parseMiniMaxBucket(value) {
+  if (!isRecord5(value)) return null;
+  const modelName = typeof value["model_name"] === "string" ? value["model_name"].trim() : "";
+  if (!modelName) return null;
+  const instant = (v) => {
+    const n = finiteNumber3(v);
+    return n !== void 0 && n > 1e9 ? n > 1e12 ? n : n * 1e3 : void 0;
+  };
+  return {
+    modelName,
+    intervalEnd: instant(value["end_time"]),
+    intervalRemainingPercent: finiteNumber3(value["current_interval_remaining_percent"]),
+    intervalStatus: finiteNumber3(value["current_interval_status"]),
+    weeklyEnd: instant(value["weekly_end_time"]),
+    weeklyRemainingPercent: finiteNumber3(value["current_weekly_remaining_percent"]),
+    weeklyStatus: finiteNumber3(value["current_weekly_status"])
+  };
+}
+function minimaxWindow(id, label, windowMinutes, resetsAtMs, remainingPercent, status, now) {
+  const usedPercent = status === MINIMAX_STATUS_EXHAUSTED ? 100 : remainingPercent !== void 0 ? Math.round((100 - remainingPercent) * 10) / 10 : null;
+  const resetsAt = resetsAtMs !== void 0 ? new Date(resetsAtMs).toISOString() : void 0;
+  return {
+    id,
+    label,
+    scope: "all",
+    usedPercent,
+    ...windowMinutes !== void 0 ? { windowMinutes } : {},
+    ...resetsAt !== void 0 ? { resetsAt } : {},
+    remainingSeconds: secondsUntil5(resetsAt, now),
+    state: usedPercent !== null ? "fresh" : "unavailable"
+  };
+}
+function parseMiniMaxTokenPlanPayload(payload, now) {
+  if (!isRecord5(payload)) return null;
+  const baseResp = payload["base_resp"];
+  if (!isRecord5(baseResp) || baseResp["status_code"] !== 0) return null;
+  const buckets = Array.isArray(payload["model_remains"]) ? payload["model_remains"] : [];
+  let general = null;
+  for (const raw of buckets) {
+    const bucket = parseMiniMaxBucket(raw);
+    if (bucket?.modelName === MINIMAX_SHARED_BUCKET) {
+      general = bucket;
+      break;
+    }
+  }
+  if (!general) return null;
+  return [
+    minimaxWindow(
+      "five-hour",
+      "5 hours",
+      5 * 60,
+      general.intervalEnd,
+      general.intervalRemainingPercent,
+      general.intervalStatus,
+      now
+    ),
+    minimaxWindow(
+      "seven-day",
+      "7 days",
+      Math.round(WEEK_MS / MINUTE_MS2),
+      general.weeklyEnd,
+      general.weeklyRemainingPercent,
+      general.weeklyStatus,
+      now
+    )
+  ];
+}
+function parseUmansUsagePayload(payload, now) {
+  if (!isRecord5(payload)) return null;
+  const limits = isRecord5(payload["limits"]) ? payload["limits"] : void 0;
+  const requests = limits && isRecord5(limits["requests"]) ? limits["requests"] : void 0;
+  const usage = isRecord5(payload["usage"]) ? payload["usage"] : void 0;
+  const window = isRecord5(payload["window"]) ? payload["window"] : void 0;
+  const hardCap = finiteNumber3(requests?.["hard_cap"]);
+  const softLimit = finiteNumber3(requests?.["limit"]);
+  const requestsInWindow = finiteNumber3(usage?.["requests_in_window"]);
+  const weightedInWindow = finiteNumber3(usage?.["weighted_in_window"]);
+  const resetsAt = isoInstant3(window?.["resets_at"]);
+  let usedPercent = null;
+  if (hardCap !== void 0 && hardCap > 0 && requestsInWindow !== void 0) {
+    usedPercent = Math.round(Math.min(100, requestsInWindow / hardCap * 100) * 10) / 10;
+  } else if (softLimit !== void 0 && softLimit > 0 && weightedInWindow !== void 0) {
+    usedPercent = Math.round(Math.min(100, weightedInWindow / softLimit * 100) * 10) / 10;
+  }
+  if (usedPercent === null && resetsAt === void 0) return null;
+  return [
+    {
+      id: "five-hour",
+      label: "5 hours",
+      scope: "all",
+      usedPercent,
+      windowMinutes: 5 * 60,
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil5(resetsAt, now),
+      state: "fresh"
+    }
+  ];
+}
+function parseSyntheticQuotasPayload(payload, now) {
+  if (!isRecord5(payload)) return null;
+  const fiveHour = isRecord5(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
+  const weekly = isRecord5(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
+  const windows = [];
+  if (fiveHour) {
+    const max = finiteNumber3(fiveHour["max"]);
+    const remaining = finiteNumber3(fiveHour["remaining"]);
+    const usedPercent = max !== void 0 && max > 0 && remaining !== void 0 ? Math.round(Math.min(100, (max - remaining) / max * 100) * 10) / 10 : null;
+    const resetsAt = isoInstant3(fiveHour["nextTickAt"]);
+    windows.push({
+      id: "five-hour",
+      label: "5 hours",
+      scope: "all",
+      usedPercent,
+      windowMinutes: 5 * 60,
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil5(resetsAt, now),
+      state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+    });
+  }
+  if (weekly) {
+    const percentRemaining = finiteNumber3(weekly["percentRemaining"]);
+    const usedPercent = percentRemaining !== void 0 ? Math.round(Math.min(100, Math.max(0, 100 - percentRemaining)) * 10) / 10 : null;
+    const resetsAt = isoInstant3(weekly["nextRegenAt"]);
+    windows.push({
+      id: "seven-day",
+      label: "7 days",
+      scope: "all",
+      usedPercent,
+      windowMinutes: 7 * 24 * 60,
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil5(resetsAt, now),
+      state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
+    });
+  }
+  return windows.length > 0 ? windows : null;
+}
+
+// src/allowance/ProviderKeyQuotaService.ts
+function parseQuotaPayload(adapter, payload, now) {
+  switch (adapter) {
+    case "zai":
+      return parseZaiQuotaPayload(payload, now);
+    case "minimax-token-plan":
+      return parseMiniMaxTokenPlanPayload(payload, now);
+    case "umans":
+      return parseUmansUsagePayload(payload, now);
+    case "synthetic":
+      return parseSyntheticQuotasPayload(payload, now);
+  }
+}
+var PROVIDER_KEY_QUOTA_CACHE_MS = 5 * 6e4;
+function resolvedBaseUrl(row) {
+  const modes = row.apiModes ?? [];
+  const selected = row.selectedApiModeId ? modes.find((mode) => mode.id === row.selectedApiModeId) : void 0;
+  const fallback = modes[0];
+  const modeBase = selected?.baseUrl ?? fallback?.baseUrl;
+  return modeBase ?? row.codingPlan?.baseUrl ?? row.baseUrl;
+}
+function rowKeyEntries(row) {
+  const pool = (row.apiKeys ?? []).filter((entry) => entry.apiKey.length > 0);
+  if (pool.length > 0) return pool.map((entry) => ({ id: entry.id, apiKey: entry.apiKey }));
+  if (row.apiKey.length > 0) {
+    return [{ id: `${row.id}:default`, apiKey: row.apiKey }];
+  }
+  return [];
+}
+var ProviderKeyQuotaService = class {
+  constructor(box, fetchImpl = (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { redactBodies: true }), now = Date.now) {
+    this.box = box;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  box;
+  fetchImpl;
+  now;
+  cache = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  /**
+   * Quota for one key of a provider row, or `null` when the row has no quota
+   * adapter / no such key. Cache-first; concurrent reads share one flight.
+   */
+  async quotaFor(row, keyId, options = {}) {
+    const adapter = detectProviderKeyQuotaAdapter(resolvedBaseUrl(row));
+    if (!adapter) return null;
+    const entry = rowKeyEntries(row).find((candidate) => candidate.id === keyId);
+    if (!entry) return null;
+    const cacheKey = `${row.id}\0${keyId}`;
+    const now = this.now();
+    const cached = this.cache.get(cacheKey);
+    if (!options.force && cached && Date.parse(cached.expiresAt) > now) return cached;
+    const running = this.inFlight.get(cacheKey);
+    if (running) return running;
+    const promise = this.fetchQuota(adapter, row, entry.apiKey, cacheKey).catch((error) => {
+      void error;
+      const previous = this.cache.get(cacheKey);
+      if (previous) {
+        const degraded = {
+          ...previous,
+          expiresAt: new Date(now + PROVIDER_KEY_QUOTA_CACHE_MS).toISOString(),
+          windows: previous.windows.map((window) => ({
+            ...window,
+            state: window.usedPercent !== null || window.resetsAt ? "stale" : window.state
+          })),
+          errorCode: "quota_request_failed"
+        };
+        this.cache.set(cacheKey, degraded);
+        return degraded;
+      }
+      return null;
+    }).finally(() => this.inFlight.delete(cacheKey));
+    this.inFlight.set(cacheKey, promise);
+    return promise;
+  }
+  /** Drop cached rows for a provider (key added/removed/rotated). */
+  invalidateProvider(providerRowId) {
+    for (const key of this.cache.keys()) {
+      if (key.startsWith(`${providerRowId}\0`)) this.cache.delete(key);
+    }
+  }
+  async fetchQuota(adapter, row, rawKey, cacheKey) {
+    const baseUrl = resolvedBaseUrl(row);
+    const url = providerKeyQuotaUrl(adapter, baseUrl);
+    const key = this.box.decryptMaybe(rawKey);
+    const now = this.now();
+    const response = await this.fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Authorization: providerKeyQuotaAuthHeader(adapter, key),
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (response.status === 401 || response.status === 403) {
+      const snapshot2 = {
+        adapter,
+        observedAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + PROVIDER_KEY_QUOTA_CACHE_MS).toISOString(),
+        windows: [],
+        errorCode: "quota_unauthorized"
+      };
+      this.cache.set(cacheKey, snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new Error("invalid JSON");
+    }
+    const windows = parseQuotaPayload(adapter, payload, now);
+    const snapshot = {
+      adapter,
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + PROVIDER_KEY_QUOTA_CACHE_MS).toISOString(),
+      windows: windows ?? [],
+      ...windows ? {} : { errorCode: "quota_unavailable" }
+    };
+    this.cache.set(cacheKey, snapshot);
+    return snapshot;
+  }
+};
+
 // src/image-generation/ImageDoctorService.ts
 var import_image_generation = require("@omnicross/core/image-generation");
 var import_outbound_api7 = require("@omnicross/core/outbound-api");
-var import_subscriptions3 = require("@omnicross/subscriptions");
+var import_subscriptions6 = require("@omnicross/subscriptions");
 
 // src/image-generation/FileCodexImageCapabilityEvidenceSource.ts
 var import_node_crypto13 = require("crypto");
@@ -8955,7 +10214,7 @@ function createImageDoctorService(options) {
     paths,
     ttlMs: config.evidenceTtlMs
   }));
-  const createLiveVerifier = options.createLiveVerifier ?? ((strategy, config) => (0, import_subscriptions3.createCodexImageLiveVerifier)({
+  const createLiveVerifier = options.createLiveVerifier ?? ((strategy, config) => (0, import_subscriptions6.createCodexImageLiveVerifier)({
     authStrategy: strategy,
     generationTimeoutMs: config.queue.generationTimeoutMs
   }));
@@ -9317,7 +10576,7 @@ var ImageCleanupService = class {
 var import_node_crypto16 = require("crypto");
 var import_image_generation5 = require("@omnicross/core/image-generation");
 var import_outbound_api8 = require("@omnicross/core/outbound-api");
-var import_subscriptions4 = require("@omnicross/subscriptions");
+var import_subscriptions7 = require("@omnicross/subscriptions");
 
 // src/image-generation/ImageApiRuntimeResolver.ts
 var import_node_crypto14 = require("crypto");
@@ -9848,7 +11107,7 @@ function createImageRuntimeGeneration(options) {
       now: options.now ?? Date.now,
       referenceStore: options.storage.referenceStore,
       stateStore: options.storage.stateStore
-    }) : (0, import_subscriptions4.createCodexSubscriptionImageProvider)({
+    }) : (0, import_subscriptions7.createCodexSubscriptionImageProvider)({
       authStrategy,
       evidenceSource: generationEvidenceSource,
       executionScheduler: scheduler,
@@ -14514,10 +15773,13 @@ function bucketLabel(bucketStartTs, bucket) {
 }
 
 // src/ports/JsonOutboundKeyDb.ts
+var import_node_fs23 = require("fs");
+var import_core3 = require("@omnicross/core");
+
+// src/ports/atomicFile.ts
 var import_node_crypto22 = require("crypto");
 var import_node_fs22 = require("fs");
 var import_node_path25 = require("path");
-var import_core3 = require("@omnicross/core");
 function atomicReplaceUtf8(targetPath, contents) {
   const tempPath = (0, import_node_path25.join)(
     (0, import_node_path25.dirname)(targetPath),
@@ -14547,6 +15809,8 @@ function atomicReplaceUtf8(targetPath, contents) {
     throw error;
   }
 }
+
+// src/ports/JsonOutboundKeyDb.ts
 var JsonOutboundKeyDb = class {
   /**
    * @param secretBox OPTIONAL reversible-secret codec. When present, a created
@@ -14689,9 +15953,9 @@ var JsonOutboundKeyDb = class {
   }
   /** Read the key rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs22.existsSync)(this.keysPath)) return [];
+    if (!(0, import_node_fs23.existsSync)(this.keysPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs22.readFileSync)(this.keysPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs23.readFileSync)(this.keysPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
@@ -14708,7 +15972,7 @@ function applyPolicyField(row, field, value) {
 }
 
 // src/ports/JsonPricingStore.ts
-var import_node_fs23 = require("fs");
+var import_node_fs24 = require("fs");
 var import_node_crypto23 = require("crypto");
 var JsonPricingStore = class {
   constructor(pricingPath) {
@@ -14723,9 +15987,9 @@ var JsonPricingStore = class {
    * otherwise unusable pricing table after a crash or manual file edit.
    */
   hasUsableSnapshot() {
-    if (!(0, import_node_fs23.existsSync)(this.pricingPath)) return false;
+    if (!(0, import_node_fs24.existsSync)(this.pricingPath)) return false;
     try {
-      const parsed = JSON.parse((0, import_node_fs23.readFileSync)(this.pricingPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs24.readFileSync)(this.pricingPath, "utf8"));
       return Array.isArray(parsed) && parsed.some(isUsablePricingRow);
     } catch {
       return false;
@@ -14838,9 +16102,9 @@ var JsonPricingStore = class {
   }
   /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs23.existsSync)(this.pricingPath)) return [];
+    if (!(0, import_node_fs24.existsSync)(this.pricingPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs23.readFileSync)(this.pricingPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs24.readFileSync)(this.pricingPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
@@ -14849,18 +16113,18 @@ var JsonPricingStore = class {
   writeRows(rows) {
     const temporaryPath = `${this.pricingPath}.${process.pid}.${(0, import_node_crypto23.randomUUID)()}.tmp`;
     try {
-      (0, import_node_fs23.writeFileSync)(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
+      (0, import_node_fs24.writeFileSync)(temporaryPath, JSON.stringify(rows, null, 2) + "\n", {
         encoding: "utf8",
         flag: "wx"
       });
       this.replaceFile(temporaryPath);
     } finally {
-      (0, import_node_fs23.rmSync)(temporaryPath, { force: true });
+      (0, import_node_fs24.rmSync)(temporaryPath, { force: true });
     }
   }
   /** Isolated for deterministic failure testing; never removes the target. */
   replaceFile(temporaryPath) {
-    (0, import_node_fs23.renameSync)(temporaryPath, this.pricingPath);
+    (0, import_node_fs24.renameSync)(temporaryPath, this.pricingPath);
   }
 };
 function isUsablePricingRow(value) {
@@ -14870,7 +16134,7 @@ function isUsablePricingRow(value) {
 }
 
 // src/pricing/PricingRefreshScheduler.ts
-var import_node_fs24 = require("fs");
+var import_node_fs25 = require("fs");
 var EMPTY_STATE2 = {
   lastAttemptAt: null,
   lastSuccessAt: null,
@@ -14908,9 +16172,9 @@ var PricingRefreshScheduler = class {
     this.timer = null;
   }
   getState() {
-    if (!(0, import_node_fs24.existsSync)(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
+    if (!(0, import_node_fs25.existsSync)(this.statePath)) return { ...EMPTY_STATE2, sources: [] };
     try {
-      const value = JSON.parse((0, import_node_fs24.readFileSync)(this.statePath, "utf8"));
+      const value = JSON.parse((0, import_node_fs25.readFileSync)(this.statePath, "utf8"));
       return {
         lastAttemptAt: finiteOrNull(value.lastAttemptAt),
         lastSuccessAt: finiteOrNull(value.lastSuccessAt),
@@ -14963,9 +16227,9 @@ var PricingRefreshScheduler = class {
   }
   writeState(state) {
     const temporaryPath = `${this.statePath}.tmp`;
-    (0, import_node_fs24.writeFileSync)(temporaryPath, `${JSON.stringify(state, null, 2)}
+    (0, import_node_fs25.writeFileSync)(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, "utf8");
-    (0, import_node_fs24.renameSync)(temporaryPath, this.statePath);
+    (0, import_node_fs25.renameSync)(temporaryPath, this.statePath);
   }
 };
 function finiteOrNull(value) {
@@ -14973,7 +16237,7 @@ function finiteOrNull(value) {
 }
 
 // src/ports/JsonVoucherDb.ts
-var import_node_fs25 = require("fs");
+var import_node_fs26 = require("fs");
 var JsonVoucherDb = class {
   constructor(vouchersPath) {
     this.vouchersPath = vouchersPath;
@@ -15051,27 +16315,27 @@ var JsonVoucherDb = class {
   }
   /** Read the voucher rows, tolerating a missing/corrupt file (→ empty list). */
   readRows() {
-    if (!(0, import_node_fs25.existsSync)(this.vouchersPath)) return [];
+    if (!(0, import_node_fs26.existsSync)(this.vouchersPath)) return [];
     try {
-      const parsed = JSON.parse((0, import_node_fs25.readFileSync)(this.vouchersPath, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs26.readFileSync)(this.vouchersPath, "utf8"));
       return Array.isArray(parsed) ? parsed : [];
     } catch {
       return [];
     }
   }
   writeRows(rows) {
-    (0, import_node_fs25.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
+    (0, import_node_fs26.writeFileSync)(this.vouchersPath, JSON.stringify(rows, null, 2) + "\n", "utf8");
   }
 };
 
 // src/ports/JsonSubscriptionCredentialStore.ts
-var import_node_fs27 = require("fs");
+var import_node_fs28 = require("fs");
 var import_node_path27 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
-var import_subscriptions5 = require("@omnicross/subscriptions");
+var import_subscriptions8 = require("@omnicross/subscriptions");
 
 // src/ports/account-sync.ts
 function viewOf(tokens) {
@@ -15115,7 +16379,7 @@ function findDuplicateCredentialIds(accounts) {
 }
 
 // src/ports/external-cli-credentials.ts
-var import_node_fs26 = require("fs");
+var import_node_fs27 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path26 = require("path");
 function externalStorePath(provider, home = (0, import_node_os5.homedir)()) {
@@ -15168,10 +16432,10 @@ function parseCodexTokensEnvelope(raw) {
 }
 function readExternalCliCredentials(provider, home = (0, import_node_os5.homedir)()) {
   const path2 = externalStorePath(provider, home);
-  if (!(0, import_node_fs26.existsSync)(path2)) return null;
+  if (!(0, import_node_fs27.existsSync)(path2)) return null;
   let raw;
   try {
-    const parsed = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
     raw = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return null;
@@ -15194,16 +16458,18 @@ var JsonSubscriptionCredentialStore = class {
    *                    as on relay refresh egresses from the SAME proxy IP as the
    *                    account's traffic. NOT used by any read/write path.
    */
-  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials) {
+  constructor(tokensPath, box, fetchImpl = void 0, externalCliReader = readExternalCliCredentials, atomicReplace = atomicReplaceUtf8) {
     this.tokensPath = tokensPath;
     this.box = box;
     this.fetchImpl = fetchImpl;
     this.externalCliReader = externalCliReader;
+    this.atomicReplace = atomicReplace;
   }
   tokensPath;
   box;
   fetchImpl;
   externalCliReader;
+  atomicReplace;
   /**
    * The proxy-aware `FetchLike` for one refresh round-trip (upstream-proxy M1). A
    * TEST-injected `fetchImpl` is returned verbatim; otherwise the refresh routes
@@ -15217,7 +16483,7 @@ var JsonSubscriptionCredentialStore = class {
    * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -15258,7 +16524,7 @@ var JsonSubscriptionCredentialStore = class {
    * other hot reads. Never returns token material.
    */
   getAccountProxy(providerId, accountId) {
-    if (providerId !== "claude" && providerId !== "codex" && providerId !== "gemini" && providerId !== "opencodego") {
+    if (providerId !== "claude" && providerId !== "codex" && providerId !== "gemini" && providerId !== "opencodego" && providerId !== "kimi") {
       return void 0;
     }
     return getAccountProxy(this.readConfig(), providerId, accountId);
@@ -15277,7 +16543,7 @@ var JsonSubscriptionCredentialStore = class {
     const fingerprintOn = identityStore.isEnabled();
     const now = Date.now();
     const out = {};
-    for (const provider of ["claude", "codex", "gemini", "opencodego"]) {
+    for (const provider of ["claude", "codex", "gemini", "opencodego", "kimi"]) {
       const sanitized = sanitizeAccounts(config, provider);
       if (sanitized.length === 0) continue;
       for (const account of sanitized) {
@@ -15343,7 +16609,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("claude", capturedId);
       try {
-        const result = await import_subscriptions5.claudeOAuth.refreshAccessToken(claude.refreshToken, refreshFetch);
+        const result = await import_subscriptions8.claudeOAuth.refreshAccessToken(claude.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...claude,
@@ -15378,7 +16644,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("codex", capturedId);
       try {
-        const result = await import_subscriptions5.codexOAuth.refreshAccessToken(codex.refreshToken, refreshFetch);
+        const result = await import_subscriptions8.codexOAuth.refreshAccessToken(codex.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...codex,
@@ -15416,7 +16682,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("gemini", capturedId);
       try {
-        const result = await import_subscriptions5.geminiOAuth.refreshAccessToken(gemini.refreshToken, refreshFetch);
+        const result = await import_subscriptions8.geminiOAuth.refreshAccessToken(gemini.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...gemini,
@@ -15435,6 +16701,47 @@ var JsonSubscriptionCredentialStore = class {
       }
     });
   }
+  /**
+   * Refresh the Kimi Code (Moonshot) OAuth access token (device-flow grant).
+   * Kimi ROTATES the refresh token, so the response's pair is written back
+   * whole; the account's stable `deviceId` (fingerprint header input) is
+   * preserved. The refresh call carries the CLI fingerprint headers. HONEST
+   * `false` when no refresh_token.
+   */
+  async refreshKimiToken() {
+    return this.coalesce("kimi:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "kimi");
+      const kimi = active?.tokens;
+      if (!active || !kimi?.refreshToken) return false;
+      const capturedId = active.id;
+      this.materializeMigration(config);
+      const refreshFetch = this.buildRefreshFetch("kimi", capturedId);
+      try {
+        const result = await import_subscriptions8.kimiOAuth.refreshAccessToken(
+          kimi.refreshToken,
+          refreshFetch,
+          import_subscriptions8.kimiOAuth.kimiFingerprintHeaders(kimi.deviceId)
+        );
+        const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+        const next = {
+          ...kimi,
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+          expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0,
+          syncWarning: void 0
+        };
+        this.writeBackById("kimi", capturedId, next);
+        return true;
+      } catch (error) {
+        this.markExpiredById("kimi", capturedId, kimi, error);
+        return false;
+      }
+    });
+  }
   /**
    * Refresh a SPECIFIC managed account by id (background scheduler sweep and
    * account-pool resolution). It uses only that account's stored refresh
@@ -15487,7 +16794,7 @@ var JsonSubscriptionCredentialStore = class {
     }
     const oauth = account.tokens;
     if (!oauth.accessToken) return null;
-    if (providerId === "codex" || providerId === "gemini") {
+    if (providerId === "codex" || providerId === "gemini" || providerId === "kimi") {
       const expiresAtMs = oauth.expiresAt ? Date.parse(oauth.expiresAt) : 0;
       const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - ACCOUNT_REFRESH_LEAD_MS;
       if (expiringSoon && oauth.refreshToken) {
@@ -15576,8 +16883,23 @@ var JsonSubscriptionCredentialStore = class {
   }
   /** Dispatch one OAuth refresh round-trip to the provider's shared flow. */
   async refreshUpstream(provider, refreshToken, accountId) {
-    const flow = provider === "claude" ? import_subscriptions5.claudeOAuth : provider === "codex" ? import_subscriptions5.codexOAuth : import_subscriptions5.geminiOAuth;
-    const r = await flow.refreshAccessToken(refreshToken, this.buildRefreshFetch(provider, accountId));
+    const refreshFetch = this.buildRefreshFetch(provider, accountId);
+    if (provider === "kimi") {
+      const account = accountId ? getAccountById(this.readConfig(), "kimi", accountId) : void 0;
+      const deviceId = account?.tokens?.deviceId;
+      const r2 = await import_subscriptions8.kimiOAuth.refreshAccessToken(
+        refreshToken,
+        refreshFetch,
+        import_subscriptions8.kimiOAuth.kimiFingerprintHeaders(deviceId)
+      );
+      return {
+        accessToken: r2.accessToken,
+        refreshToken: r2.refreshToken,
+        expiresAt: new Date(Date.now() + r2.expiresIn * 1e3).toISOString()
+      };
+    }
+    const flow = provider === "claude" ? import_subscriptions8.claudeOAuth : provider === "codex" ? import_subscriptions8.codexOAuth : import_subscriptions8.geminiOAuth;
+    const r = await flow.refreshAccessToken(refreshToken, refreshFetch);
     return {
       accessToken: r.accessToken,
       refreshToken: r.refreshToken,
@@ -15740,42 +17062,86 @@ var JsonSubscriptionCredentialStore = class {
   /** Write the merged config to disk as pretty JSON (mkdir parent if needed).
    *  Encrypt-on-write: the token-material fields are encrypted (legacy plaintext
    *  `enc:v1:`; already-`enc:`/`$ENV` untouched) before serializing, so any
-   *  write incl. child 4's future refresh writes lands encrypted. */
+   *  write incl. child 4's future refresh writes lands encrypted.
+   *  ATOMIC: temp + fsync + rename (`atomicReplaceUtf8`) — a failed or
+   *  interrupted write discards only the temp file; the prior `tokens.json`
+   *  survives byte-equal (bare `writeFileSync` truncate-writes lost every
+   *  account on a mid-write failure, 2026-09-06). */
   persist(config) {
-    (0, import_node_fs27.mkdirSync)((0, import_node_path27.dirname)(this.tokensPath), { recursive: true });
+    (0, import_node_fs28.mkdirSync)((0, import_node_path27.dirname)(this.tokensPath), { recursive: true });
     const encrypted = encryptTokens(config, this.box);
-    (0, import_node_fs27.writeFileSync)(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+    this.atomicReplace(this.tokensPath, JSON.stringify(encrypted, null, 2) + "\n");
   }
   /**
-   * Read + parse `tokens.json`, tolerating a missing/corrupt file, then DECRYPT
-   * the token-material fields so every getter returns plaintext (the
-   * subscription bearer path is byte-identical).
+   * Read + parse `tokens.json`, then DECRYPT the token-material fields so every
+   * getter returns plaintext (the subscription bearer path is byte-identical).
    *
-   * The fs-read + JSON-parse tolerance is INSIDE the try (a missing or corrupt
-   * file empty `{ updatedAt: '' }`). The DECRYPT runs OUTSIDE the try, so a
-   * wrong/missing master key or a tampered `enc:` envelope FAILS FAST with the
-   * box's clear, secret-free error (secrets spec "/ UX":
-   * SHALL fail-fast, SHALL NOT a swallowed decrypt would report "no
-   * tokens" and silently send the WRONG bearer upstream 401). Mirrors
-   * `config.ts loadConfig`, which decrypts outside its parse try.
+   * A MISSING file is a legitimate first-boot state → minimal `{ updatedAt: '' }`.
+   * A file that EXISTS but cannot be parsed as a JSON object is CORRUPT →
+   * `quarantineCorrupt` moves it aside (once) before the empty config is
+   * returned, so the unreadable accounts survive for manual recovery.
+   *
+   * The DECRYPT runs OUTSIDE any try, so a wrong/missing master key or a
+   * tampered `enc:` envelope FAILS FAST with the box's clear, secret-free
+   * error (secrets spec "/ UX": SHALL fail-fast, SHALL NOT a swallowed
+   * decrypt would report "no tokens" and silently send the WRONG bearer
+   * upstream 401). Mirrors `config.ts loadConfig`, which decrypts outside
+   * its parse try.
    */
   readConfig() {
-    if (!(0, import_node_fs27.existsSync)(this.tokensPath)) return { updatedAt: "" };
+    if (!(0, import_node_fs28.existsSync)(this.tokensPath)) return { updatedAt: "" };
     let parsed;
     try {
-      const raw = JSON.parse((0, import_node_fs27.readFileSync)(this.tokensPath, "utf8"));
-      parsed = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+      const raw = JSON.parse((0, import_node_fs28.readFileSync)(this.tokensPath, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return this.quarantineCorrupt("parsed JSON is not an object");
+      }
+      parsed = raw;
     } catch {
-      parsed = null;
+      return this.quarantineCorrupt("unparseable JSON");
     }
-    if (!parsed) return { updatedAt: "" };
     const decrypted = decryptTokens(parsed, this.box);
     return migrateLazily(decrypted);
   }
+  /** One-shot latch: a corrupt file is quarantined (or found unmovable) at
+   *  most once per process, so the hot read path never re-attempts or re-logs. */
+  corruptQuarantined = false;
+  /**
+   * Quarantine a present-but-corrupt `tokens.json`, then treat it as empty.
+   *
+   * Renames the file to a sibling `tokens.json.corrupt-<stamp>` backup and
+   * logs loudly (the daemon's stderr log; secret-free — reason + paths only).
+   * The daemon KEEPS SERVING (API-key routing is unaffected; subscription
+   * routing reports no credential, same as an absent file) while the corrupt
+   * bytes survive for manual recovery — and, critically, the NEXT persist
+   * (e.g. the user re-logging in) can no longer overwrite the only copy of
+   * the old accounts, which is exactly how the 2026-09-06 incident turned a
+   * recoverable truncated file into permanent account loss.
+   *
+   * Best-effort: if the rename fails (file locked, permissions), the corrupt
+   * file is left in place and every later read still tolerates it as empty;
+   * the latch still trips so the attempt + log happen exactly once.
+   */
+  quarantineCorrupt(reason) {
+    if (!this.corruptQuarantined) {
+      this.corruptQuarantined = true;
+      const backup = `${this.tokensPath}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+      let moved = false;
+      try {
+        (0, import_node_fs28.renameSync)(this.tokensPath, backup);
+        moved = true;
+      } catch {
+      }
+      console.error(
+        `[JsonSubscriptionCredentialStore] tokens.json is corrupt (${reason}); ` + (moved ? `moved to '${backup}' and treated as empty \u2014 recover accounts from that backup before re-adding them` : `could not move '${this.tokensPath}' \u2014 treated as empty`)
+      );
+    }
+    return { updatedAt: "" };
+  }
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch10 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/CodexGenerationProbe.ts
 var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
@@ -15914,7 +17280,11 @@ var PROVIDER_PROBE_PLANS = {
   // billable/wrong endpoint). Upgrade to `{ kind:'upstream' }` once verified.
   codex: { kind: "local" },
   gemini: { kind: "local" },
-  opencodego: { kind: "local" }
+  opencodego: { kind: "local" },
+  // Kimi's `GET /coding/v1/usages` is a verified FREE authed GET (the allowance
+  // collector uses it), but the probe path also needs the fingerprint headers —
+  // keep the probe local until the collector covers the health surface.
+  kimi: { kind: "local" }
 };
 function probePlanFor(providerId) {
   return PROVIDER_PROBE_PLANS[providerId] ?? { kind: "local" };
@@ -15936,7 +17306,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch5.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch10.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -16280,13 +17650,13 @@ var AccountHealthSweeper = class {
 };
 
 // src/audit/AuditPruneSweeper.ts
-var import_node_fs29 = require("fs");
+var import_node_fs30 = require("fs");
 var import_node_path29 = require("path");
 var import_promises6 = require("stream/promises");
 var import_node_zlib2 = require("zlib");
 
 // src/audit/auditStats.ts
-var import_node_fs28 = require("fs");
+var import_node_fs29 = require("fs");
 var import_node_path28 = require("path");
 var SIDECAR_VERSION = 1;
 var META_PREFIX_BYTES = 64 * 1024;
@@ -16295,9 +17665,9 @@ function auditStatsFileName(auditFile) {
   return auditFile.replace(/\.jsonl$/, ".stats.json");
 }
 function readPersisted(path2) {
-  if (!(0, import_node_fs28.existsSync)(path2)) return null;
+  if (!(0, import_node_fs29.existsSync)(path2)) return null;
   try {
-    const value = JSON.parse((0, import_node_fs28.readFileSync)(path2, "utf8"));
+    const value = JSON.parse((0, import_node_fs29.readFileSync)(path2, "utf8"));
     if (value.version !== SIDECAR_VERSION || !Number.isSafeInteger(value.auditBytes) || (value.auditBytes ?? -1) < 0 || !Number.isSafeInteger(value.requestCount) || (value.requestCount ?? -1) < 0 || !Number.isSafeInteger(value.errorCount) || (value.errorCount ?? -1) < 0 || (value.errorCount ?? 0) > (value.requestCount ?? -1) || typeof value.complete !== "boolean" || value.minTs !== null && !Number.isFinite(value.minTs) || value.maxTs !== null && !Number.isFinite(value.maxTs)) {
       return null;
     }
@@ -16327,7 +17697,7 @@ function updateAuditStatsAfterAppend(auditPath, auditBytesBefore, auditBytesAfte
     minTs: previous.minTs === null ? record.ts : Math.min(previous.minTs, record.ts),
     maxTs: previous.maxTs === null ? record.ts : Math.max(previous.maxTs, record.ts)
   };
-  (0, import_node_fs28.writeFileSync)(statsPath, JSON.stringify(next), "utf8");
+  (0, import_node_fs29.writeFileSync)(statsPath, JSON.stringify(next), "utf8");
 }
 function queryCovers(stats, from, to) {
   return stats.requestCount === 0 || stats.minTs !== null && stats.maxTs !== null && from <= stats.minTs && to >= stats.maxTs;
@@ -16385,7 +17755,7 @@ async function scanAuditFile(auditPath, startByte, auditBytes, from, to) {
     prefixTruncated = false;
   };
   if (auditBytes > startByte) {
-    const stream = (0, import_node_fs28.createReadStream)(auditPath, {
+    const stream = (0, import_node_fs29.createReadStream)(auditPath, {
       start: startByte,
       end: auditBytes - 1,
       highWaterMark: READ_CHUNK_BYTES2
@@ -16438,12 +17808,12 @@ function mergePersistedStats(previous, appended) {
   };
 }
 async function readAuditStats(auditDir, query2 = {}) {
-  if (!(0, import_node_fs28.existsSync)(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
+  if (!(0, import_node_fs29.existsSync)(auditDir)) return { requestCount: 0, errorCount: 0, complete: true };
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   let sources;
   try {
-    sources = (0, import_node_fs28.readdirSync)(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
+    sources = (0, import_node_fs29.readdirSync)(auditDir).filter((name) => fileOverlaps(name, from, to)).sort().map(
       (name) => AUDIT_DAY_DIR_RE.test(name) ? {
         auditPath: (0, import_node_path28.join)(auditDir, name, AUDIT_META_FILE),
         statsPath: (0, import_node_path28.join)(auditDir, name, auditStatsFileName(AUDIT_META_FILE))
@@ -16451,14 +17821,14 @@ async function readAuditStats(auditDir, query2 = {}) {
         auditPath: (0, import_node_path28.join)(auditDir, name),
         statsPath: (0, import_node_path28.join)(auditDir, auditStatsFileName(name))
       }
-    ).filter((source) => (0, import_node_fs28.existsSync)(source.auditPath));
+    ).filter((source) => (0, import_node_fs29.existsSync)(source.auditPath));
   } catch {
     return { requestCount: 0, errorCount: 0, complete: false };
   }
   const total = { requestCount: 0, errorCount: 0, complete: true };
   for (const { auditPath, statsPath } of sources) {
     try {
-      const auditBytes = (0, import_node_fs28.statSync)(auditPath).size;
+      const auditBytes = (0, import_node_fs29.statSync)(auditPath).size;
       const persisted = readPersisted(statsPath);
       if (persisted && persisted.complete && persisted.auditBytes === auditBytes && queryCovers(persisted, from, to)) {
         total.requestCount += persisted.requestCount;
@@ -16477,7 +17847,7 @@ async function readAuditStats(auditDir, query2 = {}) {
       total.errorCount += scanned.filtered.errorCount + (resumable?.errorCount ?? 0);
       total.complete = total.complete && scanned.filtered.complete;
       const current = resumable ? mergePersistedStats(resumable, scanned.all) : scanned.all;
-      if (current.complete) (0, import_node_fs28.writeFileSync)(statsPath, JSON.stringify(current), "utf8");
+      if (current.complete) (0, import_node_fs29.writeFileSync)(statsPath, JSON.stringify(current), "utf8");
     } catch {
       total.complete = false;
     }
@@ -16486,7 +17856,7 @@ async function readAuditStats(auditDir, query2 = {}) {
 }
 
 // src/audit/AuditPruneSweeper.ts
-var DAY_MS = 24 * 60 * 6e4;
+var DAY_MS3 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var ARCHIVE_BATCH = 64;
 var AuditPruneSweeper = class {
@@ -16549,19 +17919,19 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.sweeping) return 0;
     this.sweeping = true;
     try {
-      if (!(0, import_node_fs29.existsSync)(this.auditDir)) return 0;
-      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS;
+      if (!(0, import_node_fs30.existsSync)(this.auditDir)) return 0;
+      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS3;
       let removed = 0;
-      for (const name of (0, import_node_fs29.readdirSync)(this.auditDir)) {
+      for (const name of (0, import_node_fs30.readdirSync)(this.auditDir)) {
         const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= cutoff) continue;
         try {
           if (isAuditDayDir(name)) {
-            (0, import_node_fs29.rmSync)((0, import_node_path29.join)(this.auditDir, name), { recursive: true, force: true });
+            (0, import_node_fs30.rmSync)((0, import_node_path29.join)(this.auditDir, name), { recursive: true, force: true });
           } else {
-            (0, import_node_fs29.unlinkSync)((0, import_node_path29.join)(this.auditDir, name));
+            (0, import_node_fs30.unlinkSync)((0, import_node_path29.join)(this.auditDir, name));
             const statsPath = (0, import_node_path29.join)(this.auditDir, auditStatsFileName(name));
-            if ((0, import_node_fs29.existsSync)(statsPath)) (0, import_node_fs29.unlinkSync)(statsPath);
+            if ((0, import_node_fs30.existsSync)(statsPath)) (0, import_node_fs30.unlinkSync)(statsPath);
           }
           removed += 1;
         } catch (error) {
@@ -16591,10 +17961,10 @@ var AuditPruneSweeper = class {
     if (!this.config.enabled || this.archiving) return 0;
     this.archiving = true;
     try {
-      if (!(0, import_node_fs29.existsSync)(this.auditDir)) return 0;
+      if (!(0, import_node_fs30.existsSync)(this.auditDir)) return 0;
       const today = this.todayMidnight();
       let compressed = 0;
-      for (const name of (0, import_node_fs29.readdirSync)(this.auditDir)) {
+      for (const name of (0, import_node_fs30.readdirSync)(this.auditDir)) {
         if (compressed >= ARCHIVE_BATCH) break;
         const dateMs = auditFileDateMs(name);
         if (dateMs === null || dateMs >= today || !isAuditDayDir(name)) continue;
@@ -16635,7 +18005,7 @@ var AuditPruneSweeper = class {
   async archiveDay(bodiesPath, budget) {
     let shards;
     try {
-      shards = (0, import_node_fs29.readdirSync)(bodiesPath).filter((file) => file.endsWith(".jsonl"));
+      shards = (0, import_node_fs30.readdirSync)(bodiesPath).filter((file) => file.endsWith(".jsonl"));
     } catch {
       return 0;
     }
@@ -16645,16 +18015,16 @@ var AuditPruneSweeper = class {
       const source = (0, import_node_path29.join)(bodiesPath, shard);
       const target = `${source}.gz`;
       try {
-        if ((0, import_node_fs29.existsSync)(target)) {
-          (0, import_node_fs29.unlinkSync)(source);
+        if ((0, import_node_fs30.existsSync)(target)) {
+          (0, import_node_fs30.unlinkSync)(source);
           continue;
         }
-        await (0, import_promises6.pipeline)((0, import_node_fs29.createReadStream)(source), (0, import_node_zlib2.createGzip)(), (0, import_node_fs29.createWriteStream)(target));
-        (0, import_node_fs29.unlinkSync)(source);
+        await (0, import_promises6.pipeline)((0, import_node_fs30.createReadStream)(source), (0, import_node_zlib2.createGzip)(), (0, import_node_fs30.createWriteStream)(target));
+        (0, import_node_fs30.unlinkSync)(source);
         compressed += 1;
       } catch (error) {
         try {
-          if ((0, import_node_fs29.existsSync)(target)) (0, import_node_fs29.unlinkSync)(target);
+          if ((0, import_node_fs30.existsSync)(target)) (0, import_node_fs30.unlinkSync)(target);
         } catch {
         }
         this.logger.warn("[AuditPruneSweeper] failed to archive audit body shard", {
@@ -16668,7 +18038,7 @@ var AuditPruneSweeper = class {
 };
 
 // src/usage/usageMigrate.ts
-var import_node_fs30 = require("fs");
+var import_node_fs31 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_node_path30 = require("path");
 var import_node_readline = require("readline");
@@ -16715,7 +18085,7 @@ async function migrateLegacyUsageEvents(opts) {
   let skipped = 0;
   try {
     const reader = (0, import_node_readline.createInterface)({
-      input: (0, import_node_fs30.createReadStream)(eventsPath, { encoding: "utf8" }),
+      input: (0, import_node_fs31.createReadStream)(eventsPath, { encoding: "utf8" }),
       crlfDelay: Number.POSITIVE_INFINITY
     });
     for await (const line of reader) {
@@ -16807,7 +18177,7 @@ async function closeAll(writers) {
 // src/usage/UsagePruneSweeper.ts
 var import_promises8 = require("fs/promises");
 var import_node_path31 = require("path");
-var DAY_MS2 = 24 * 60 * 6e4;
+var DAY_MS4 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS3 = 60 * 6e4;
 var DEFAULT_USAGE_RETENTION_DAYS = 90;
 var UsagePruneSweeper = class {
@@ -16864,7 +18234,7 @@ var UsagePruneSweeper = class {
     this.sweeping = true;
     try {
       const retentionDays = this.config.retentionDays ?? DEFAULT_USAGE_RETENTION_DAYS;
-      const cutoff = this.todayMidnight() - (retentionDays - 1) * DAY_MS2;
+      const cutoff = this.todayMidnight() - (retentionDays - 1) * DAY_MS4;
       let removed = 0;
       for (const entry of await listUsageDays(this.usageDir)) {
         if (!entry.hasShard) continue;
@@ -16922,7 +18292,7 @@ var UsagePruneSweeper = class {
 };
 
 // src/audit/auditReader.ts
-var import_node_fs31 = require("fs");
+var import_node_fs32 = require("fs");
 var import_node_path32 = require("path");
 var DEFAULT_LIMIT = 200;
 var MAX_LIMIT = 2e3;
@@ -16930,7 +18300,7 @@ var OVERSCAN = 256;
 function daySources(auditDir) {
   let names;
   try {
-    names = (0, import_node_fs31.readdirSync)(auditDir);
+    names = (0, import_node_fs32.readdirSync)(auditDir);
   } catch {
     return [];
   }
@@ -16940,7 +18310,7 @@ function daySources(auditDir) {
     if (dateMs === null) continue;
     if (AUDIT_DAY_DIR_RE.test(name)) {
       const path2 = (0, import_node_path32.join)(auditDir, name, AUDIT_META_FILE);
-      if ((0, import_node_fs31.existsSync)(path2)) sources.push({ path: path2, dateMs });
+      if ((0, import_node_fs32.existsSync)(path2)) sources.push({ path: path2, dateMs });
     } else if (AUDIT_FILE_RE.test(name)) {
       sources.push({ path: (0, import_node_path32.join)(auditDir, name), dateMs });
     }
@@ -16958,7 +18328,7 @@ function toMetaRecord(record) {
   return { ...meta, hasBody: true };
 }
 function readAuditRecords(auditDir, query2 = {}) {
-  if (!(0, import_node_fs31.existsSync)(auditDir)) return [];
+  if (!(0, import_node_fs32.existsSync)(auditDir)) return [];
   const from = typeof query2.from === "number" ? query2.from : -Infinity;
   const to = typeof query2.to === "number" ? query2.to : Infinity;
   const limit = Math.min(MAX_LIMIT, Math.max(1, Math.trunc(query2.limit ?? DEFAULT_LIMIT)));
@@ -16986,7 +18356,7 @@ function readAuditRecords(auditDir, query2 = {}) {
 }
 
 // src/audit/AuditWriter.ts
-var import_node_fs32 = require("fs");
+var import_node_fs33 = require("fs");
 var import_node_path33 = require("path");
 var AuditWriter = class {
   constructor(auditDir, logger, defer = (fn) => setTimeout(fn, 0)) {
@@ -17034,7 +18404,7 @@ var AuditWriter = class {
   /** Create a directory once per process and remember it. */
   ensureDir(path2) {
     if (!this.ensuredDirs.has(path2)) {
-      (0, import_node_fs32.mkdirSync)(path2, { recursive: true });
+      (0, import_node_fs33.mkdirSync)(path2, { recursive: true });
       this.ensuredDirs.add(path2);
     }
     return path2;
@@ -17044,8 +18414,8 @@ var AuditWriter = class {
     const { requestBody: _req, responseBody: _res, ...meta } = record;
     const file = (0, import_node_path33.join)(dayPath, AUDIT_META_FILE);
     const line = JSON.stringify(meta) + "\n";
-    const bytesBefore = (0, import_node_fs32.existsSync)(file) ? (0, import_node_fs32.statSync)(file).size : 0;
-    (0, import_node_fs32.appendFileSync)(file, line, "utf8");
+    const bytesBefore = (0, import_node_fs33.existsSync)(file) ? (0, import_node_fs33.statSync)(file).size : 0;
+    (0, import_node_fs33.appendFileSync)(file, line, "utf8");
     try {
       updateAuditStatsAfterAppend(
         file,
@@ -17077,7 +18447,7 @@ var AuditWriter = class {
       const line = encodeBodyEntry(record, sessionKey, dayDir, this.bases);
       if (line === null) return;
       const bodiesPath = this.ensureDir((0, import_node_path33.join)(dayPath, AUDIT_BODIES_DIR));
-      (0, import_node_fs32.appendFileSync)((0, import_node_path33.join)(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
+      (0, import_node_fs33.appendFileSync)((0, import_node_path33.join)(bodiesPath, auditBodyFileName(sessionKey)), line + "\n", "utf8");
     } catch (error) {
       this.bases.forget(sessionKey);
       this.logger.warn("[AuditWriter] failed to append audit body shard", {
@@ -17089,10 +18459,10 @@ var AuditWriter = class {
 };
 
 // src/billing/BillingPublisher.ts
-var import_node_fs33 = require("fs");
+var import_node_fs34 = require("fs");
 var import_node_crypto24 = require("crypto");
 var import_node_path34 = require("path");
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch11 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -17115,7 +18485,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch11.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -17163,7 +18533,7 @@ var BillingPublisher = class {
   appendNow(event) {
     this.ensureDir();
     const file = (0, import_node_path34.join)(this.billingDir, billingFileName(event.ts));
-    (0, import_node_fs33.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
+    (0, import_node_fs34.appendFileSync)(file, JSON.stringify(event) + "\n", "utf8");
   }
   /**
    * One best-effort delivery attempt for an event ALREADY in the ledger. POSTs the
@@ -17213,7 +18583,7 @@ var BillingPublisher = class {
     try {
       this.ensureDir();
       const file = (0, import_node_path34.join)(this.billingDir, deliveredFileName(event.ts));
-      (0, import_node_fs33.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
+      (0, import_node_fs34.appendFileSync)(file, JSON.stringify({ id: event.id, deliveredAt: this.now() }) + "\n", "utf8");
     } catch (error) {
       this.logger.warn("[BillingPublisher] failed to append delivery marker", {
         error: error instanceof Error ? error.message : String(error)
@@ -17222,20 +18592,20 @@ var BillingPublisher = class {
   }
   ensureDir() {
     if (this.dirEnsured) return;
-    (0, import_node_fs33.mkdirSync)(this.billingDir, { recursive: true });
+    (0, import_node_fs34.mkdirSync)(this.billingDir, { recursive: true });
     this.dirEnsured = true;
   }
 };
 
 // src/billing/billingReader.ts
-var import_node_fs34 = require("fs");
+var import_node_fs35 = require("fs");
 var import_node_path35 = require("path");
 function readBillingLedger(billingDir) {
   const view = { events: [], deliveredIds: /* @__PURE__ */ new Set() };
-  if (!(0, import_node_fs34.existsSync)(billingDir)) return view;
+  if (!(0, import_node_fs35.existsSync)(billingDir)) return view;
   let files;
   try {
-    files = (0, import_node_fs34.readdirSync)(billingDir);
+    files = (0, import_node_fs35.readdirSync)(billingDir);
   } catch {
     return view;
   }
@@ -17266,7 +18636,7 @@ function readBillingStatus(billingDir) {
 function parseLines(dir, file) {
   let raw;
   try {
-    raw = (0, import_node_fs34.readFileSync)((0, import_node_path35.join)(dir, file), "utf8");
+    raw = (0, import_node_fs35.readFileSync)((0, import_node_path35.join)(dir, file), "utf8");
   } catch {
     return [];
   }
@@ -17365,7 +18735,7 @@ var BillingRetrySweeper = class {
 // src/TokenRefreshScheduler.ts
 var REFRESH_LEAD_MS2 = 5 * 6e4;
 var SWEEP_INTERVAL_MS5 = 6e4;
-var OAUTH_PROVIDERS2 = ["claude", "codex", "gemini"];
+var OAUTH_PROVIDERS2 = ["claude", "codex", "gemini", "kimi"];
 var TokenRefreshScheduler = class {
   constructor(store, logger, intervalMs = SWEEP_INTERVAL_MS5, leadMs = REFRESH_LEAD_MS2) {
     this.store = store;
@@ -17448,6 +18818,8 @@ var TokenRefreshScheduler = class {
         return this.store.refreshCodexToken();
       case "gemini":
         return this.store.refreshGeminiToken();
+      case "kimi":
+        return this.store.refreshKimiToken();
     }
   }
 };
@@ -17524,7 +18896,7 @@ function createRouteLeaseSubscriptionPreflight(credentials) {
 
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto25 = require("crypto");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch12 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -17544,7 +18916,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch12.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -17630,8 +19002,8 @@ var WebhookDispatcher = class {
         signal: AbortSignal.timeout(this.timeoutMs)
       });
       return res.ok ? { ok: true, status: res.status } : { ok: false, status: res.status };
-    } catch (err5) {
-      return { ok: false, error: err5 instanceof Error ? err5.message : String(err5) };
+    } catch (err6) {
+      return { ok: false, error: err6 instanceof Error ? err6.message : String(err6) };
     }
   }
   /**
@@ -17750,7 +19122,7 @@ function installImageRuntimeBootstrapSession(initialGeneration) {
 function resolveLoggingConfig(configured, configPath) {
   const file = configured?.file ?? defaultDaemonLogPath(configPath);
   try {
-    (0, import_node_fs35.mkdirSync)(configured?.file ? (0, import_node_path36.dirname)(configured.file) : defaultLogDir(configPath), {
+    (0, import_node_fs36.mkdirSync)(configured?.file ? (0, import_node_path36.dirname)(configured.file) : defaultLogDir(configPath), {
       recursive: true
     });
   } catch {
@@ -17768,12 +19140,12 @@ function buildDaemon(config, paths) {
   setSecretBox(secretBox3);
   setSecretBox2(secretBox3);
   const decryptedConfig = decryptConfigSecrets(config, secretBox3);
-  const accountAllowanceStore = new import_AccountAllowanceStore4.AccountAllowanceStore(
+  const accountAllowanceStore = new import_AccountAllowanceStore7.AccountAllowanceStore(
     Date.now,
     void 0,
     new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
   );
-  (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
+  (0, import_AccountAllowanceStore7.setSharedAccountAllowanceStore)(accountAllowanceStore);
   (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
     (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
@@ -17798,21 +19170,22 @@ function buildDaemon(config, paths) {
   claudeAllowanceRefreshScheduler.configure(
     (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
-  const subscriptionAccounts = new import_subscriptions6.SubscriptionAccountService(credentialStore);
-  (0, import_subscriptions6.setSubscriptionAccountService)(subscriptionAccounts);
-  const subscriptionRegistry = new import_subscriptions6.SubscriptionProviderRegistry(
+  const subscriptionAccounts = new import_subscriptions9.SubscriptionAccountService(credentialStore);
+  (0, import_subscriptions9.setSubscriptionAccountService)(subscriptionAccounts);
+  const subscriptionRegistry = new import_subscriptions9.SubscriptionProviderRegistry(
     subscriptionAccounts,
     credentialStore
   );
-  (0, import_subscriptions6.setSubscriptionProviderRegistry)(subscriptionRegistry);
+  (0, import_subscriptions9.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch8.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch13.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
   );
   (0, import_gemini_code_assist_resolver.setGeminiCodeAssistResolver)((0, import_GeminiCodeAssistProjectResolver.getGeminiCodeAssistProjectResolver)());
   const autoDisableStore = new AutoDisableStore();
+  const providerKeyQuotaService = new ProviderKeyQuotaService(secretBox3);
   const apiKeyPool = new import_ApiKeyPoolService.ApiKeyPoolService(
     createPoolKeysLoader((id) => llmConfig.getProviderRow(id), autoDisableStore),
     resolveEnvKey,
@@ -17829,7 +19202,7 @@ function buildDaemon(config, paths) {
   const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
-    fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
+    fetchImpl: ((input, init) => (0, import_upstreamFetch13.fetchUpstream)(String(input), init ?? {}))
   });
   const pricingRefreshScheduler = new PricingRefreshScheduler(
     pricingEngine,
@@ -18093,6 +19466,11 @@ function buildDaemon(config, paths) {
     // values themselves NEVER leave (masked via `maskProviderApiKey`).
     apiKeyPool,
     autoDisableStore,
+    // BYO provider-key quota (Z.AI coding plan, MiniMax Token Plan, …): a
+    // read-through cached same-key usage probe surfaced on the keys view. The
+    // key plaintext is resolved + decrypted inside the service and never
+    // crosses back out.
+    providerKeyQuota: providerKeyQuotaService,
     // Interactive OAuth login over admin HTTP (app-parity child 4, design
     // D1/D2-a). The in-memory pending-session store (NEVER serialized), the
     // injected token-exchange fetch (global `fetch` here; mocked in tests), and a
@@ -18109,7 +19487,7 @@ function buildDaemon(config, paths) {
     // — `server.proxy.byProvider[...]` was silently skipped — and the call was
     // excluded from the upstream trace, so a failing login left no evidence.
     // `redactBodies` keeps the code/verifier + minted token out of that trace.
-    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { providerId, redactBodies: true }),
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch13.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -18117,6 +19495,10 @@ function buildDaemon(config, paths) {
     // can inject a mock so no real port is bound.
     codexSessions: new CodexOAuthSessionStore(),
     codexAwaitLoopback: paths.codexAwaitLoopback ?? ((state, timeoutMs, signal) => awaitLoopbackCode(state, timeoutMs, signal)),
+    // Kimi interactive OAuth — the async DEVICE-CODE flow store (no port, no
+    // paste; the app shows the verification URL + user code and polls the
+    // token-free status). Token captured + persisted daemon-side.
+    kimiSessions: new CodexOAuthSessionStore(),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -18175,7 +19557,7 @@ function buildDaemon(config, paths) {
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch13.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
@@ -18252,8 +19634,8 @@ function buildDaemon(config, paths) {
 }
 function isTokensStoreReadable(tokensPath) {
   try {
-    if (!(0, import_node_fs35.existsSync)(tokensPath)) return true;
-    (0, import_node_fs35.accessSync)(tokensPath, import_node_fs35.constants.R_OK);
+    if (!(0, import_node_fs36.existsSync)(tokensPath)) return true;
+    (0, import_node_fs36.accessSync)(tokensPath, import_node_fs36.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -18448,9 +19830,9 @@ async function runSearchDoctor(live, env = process.env, source = {}) {
   ];
   const declarations = source.runtime?.listProviders() ?? contributions;
   console.info("omnicross doctor search \u2014 builtin search contributions (offline, no network)");
-  const modes = source.config?.modes ?? import_search2.DEFAULT_SEARCH_FRONTEND_MODES;
+  const modes = source.config?.modes ?? import_search3.DEFAULT_SEARCH_FRONTEND_MODES;
   console.info(
-    `  [i] frontend modes: ${import_search2.SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
+    `  [i] frontend modes: ${import_search3.SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
   );
   console.info(
     "  [i] codex mode applies immediately; responses/anthropic modes, provider config, egress allowlist and policy apply on daemon restart"
@@ -18489,11 +19871,11 @@ async function runLiveProbe(url, key, fetchImpl = fetch) {
       status: res.status,
       estimateHeader: res.headers.get("x-omnicross-count-estimate")
     };
-  } catch (err5) {
+  } catch (err6) {
     return {
       status: null,
       estimateHeader: null,
-      error: err5 instanceof Error ? err5.message : String(err5)
+      error: err6 instanceof Error ? err6.message : String(err6)
     };
   }
 }
@@ -18581,7 +19963,7 @@ async function runDoctor(argv, fetchImpl = fetch) {
 }
 
 // src/commands/import-ccr.ts
-var import_node_fs36 = require("fs");
+var import_node_fs37 = require("fs");
 var import_node_util3 = require("util");
 
 // src/ccr-import.ts
@@ -18676,7 +20058,7 @@ async function runImportCcr(argv) {
   const outPath = values.out ?? "omnicross.config.json";
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs36.readFileSync)(ccrPath, "utf8"));
+    raw = JSON.parse((0, import_node_fs37.readFileSync)(ccrPath, "utf8"));
   } catch {
     throw new Error(`import-ccr: cannot read or parse '${ccrPath}'`);
   }
@@ -18814,7 +20196,7 @@ async function keysRevoke(db, id) {
 // src/commands/launch.ts
 var import_node_child_process2 = require("child_process");
 var import_node_crypto26 = require("crypto");
-var import_node_fs37 = require("fs");
+var import_node_fs38 = require("fs");
 var import_node_path38 = require("path");
 var import_node_util6 = require("util");
 var import_cli_launcher3 = require("@omnicross/cli-launcher");
@@ -18859,7 +20241,7 @@ function resolveInPathDefault(candidate) {
   const segments = (process.env["PATH"] ?? "").split(import_node_path38.delimiter).filter(Boolean);
   for (const seg of segments) {
     const full = (0, import_node_path38.join)(seg, candidate);
-    if ((0, import_node_fs37.existsSync)(full)) return full;
+    if ((0, import_node_fs38.existsSync)(full)) return full;
   }
   return null;
 }
@@ -18900,9 +20282,9 @@ async function runLaunch(argv, deps) {
     await daemon.llmConfig.ready();
     await daemon.migrateUsageStore();
     await daemon.providerProxy.start();
-  } catch (err5) {
+  } catch (err6) {
     await shutdownLaunchDaemon(daemon);
-    throw err5;
+    throw err6;
   }
   let launch;
   try {
@@ -18910,9 +20292,9 @@ async function runLaunch(argv, deps) {
       providerId: values.provider,
       model: values.model
     });
-  } catch (err5) {
+  } catch (err6) {
     await shutdownLaunchDaemon(daemon);
-    throw err5;
+    throw err6;
   }
   try {
     const plan = buildCliSpawnPlan({
@@ -19017,9 +20399,9 @@ function spawnCliInherit(plan) {
       process.removeListener("SIGINT", onSignal);
       process.removeListener("SIGTERM", onSignal);
     };
-    child.on("error", (err5) => {
+    child.on("error", (err6) => {
       detach();
-      if (err5.code === "ENOENT") {
+      if (err6.code === "ENOENT") {
         reject(
           new Error(
             `launch: "${plan.command}" not found on PATH \u2014 install the CLI first.`
@@ -19027,7 +20409,7 @@ function spawnCliInherit(plan) {
         );
         return;
       }
-      reject(err5);
+      reject(err6);
     });
     child.on("exit", (code, signal) => {
       detach();
@@ -19040,9 +20422,9 @@ function spawnCliInherit(plan) {
 var import_node_child_process3 = require("child_process");
 var import_node_readline2 = require("readline");
 var import_node_util7 = require("util");
-var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_subscriptions7 = require("@omnicross/subscriptions");
-var PROVIDERS2 = ["claude", "codex", "gemini"];
+var import_upstreamFetch14 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions10 = require("@omnicross/subscriptions");
+var PROVIDERS2 = ["claude", "codex", "gemini", "kimi"];
 async function runLogin(argv, deps) {
   const { values, positionals } = (0, import_node_util7.parseArgs)({
     args: argv,
@@ -19068,14 +20450,16 @@ async function runLogin(argv, deps) {
     openBrowser: deps?.openBrowser ?? openBrowser,
     promptPaste: deps?.promptPaste ?? promptPaste,
     awaitLoopback: deps?.awaitLoopback ?? ((state) => awaitLoopbackCode(state)),
+    awaitKimiDevice: deps?.awaitKimiDevice ?? ((fetchImpl) => runKimiDeviceFlow(fetchImpl, resolvedOpenBrowser)),
     tokensFetch: deps?.tokensFetch
   };
+  const resolvedOpenBrowser = resolved.openBrowser;
   const box = resolveSecretBox(values["master-key-file"]);
   setSecretBox(box);
-  (0, import_upstreamFetch9.setUpstreamProxyResolver)(createUpstreamProxyResolver());
+  (0, import_upstreamFetch14.setUpstreamProxyResolver)(createUpstreamProxyResolver());
   try {
     const tokensPath = defaultTokensPath(values.config);
-    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch14.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
     const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
     const expiresAt = await runProviderLogin(
       provider,
@@ -19088,19 +20472,20 @@ async function runLogin(argv, deps) {
     console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
   } finally {
     setSecretBox(null);
-    (0, import_upstreamFetch9.setUpstreamProxyResolver)(null);
+    (0, import_upstreamFetch14.setUpstreamProxyResolver)(null);
   }
 }
 async function runProviderLogin(provider, store, deps, exchangeFetch, label) {
   if (provider === "codex") return loginCodex(store, deps, exchangeFetch, label);
   if (provider === "claude") return loginClaude(store, deps, exchangeFetch, label);
+  if (provider === "kimi") return loginKimi(store, deps, exchangeFetch, label);
   return loginGemini(store, deps, exchangeFetch, label);
 }
 async function loginCodex(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier, state } = import_subscriptions7.codexOAuth.generateAuthParams();
+  const { authUrl, codeVerifier, state } = import_subscriptions10.codexOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const code = await deps.awaitLoopback(state);
-  const result = await import_subscriptions7.codexOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions10.codexOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -19119,7 +20504,7 @@ async function loginCodex(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 async function loginClaude(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier, state } = import_subscriptions7.claudeOAuth.generateAuthParams();
+  const { authUrl, codeVerifier, state } = import_subscriptions10.claudeOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const pasted = (await deps.promptPaste("Paste the authorization code (code#state): ")).trim();
   const [code, pastedState] = pasted.split("#");
@@ -19127,7 +20512,7 @@ async function loginClaude(store, deps, exchangeFetch, label) {
   if (pastedState && pastedState !== state) {
     throw new Error("login: pasted state did not match (possible CSRF) \u2014 aborting");
   }
-  const result = await import_subscriptions7.claudeOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions10.claudeOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -19146,11 +20531,11 @@ async function loginClaude(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 async function loginGemini(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier } = import_subscriptions7.geminiOAuth.generateAuthParams();
+  const { authUrl, codeVerifier } = import_subscriptions10.geminiOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const code = (await deps.promptPaste("Paste the authorization code: ")).trim();
   if (!code) throw new Error("login: no authorization code was pasted");
-  const result = await import_subscriptions7.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const result = await import_subscriptions10.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
   const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
   const block = {
     authMethod: "oauth",
@@ -19164,6 +20549,45 @@ async function loginGemini(store, deps, exchangeFetch, label) {
   logMasked("gemini", result.accessToken);
   return expiresAt;
 }
+async function runKimiDeviceFlow(exchangeFetch, openBrowserFn) {
+  const deviceId = import_subscriptions10.kimiOAuth.generateKimiDeviceId();
+  const fingerprint = import_subscriptions10.kimiOAuth.kimiFingerprintHeaders(deviceId);
+  const authorization = await import_subscriptions10.kimiOAuth.requestDeviceAuthorization(exchangeFetch, fingerprint);
+  const url = authorization.verificationUriComplete ?? authorization.verificationUri;
+  console.info("Open this URL in your browser and approve the request:");
+  console.info(`  ${url}`);
+  if (!authorization.verificationUriComplete) {
+    console.info(`  Then enter this code: ${authorization.userCode}`);
+  }
+  await openBrowserFn(url).catch(() => false);
+  const result = await import_subscriptions10.kimiOAuth.awaitDeviceToken(authorization, exchangeFetch, {
+    fingerprint,
+    onPending: () => process.stdout.write(".")
+  });
+  console.info("");
+  return {
+    ...result,
+    accountId: import_subscriptions10.kimiOAuth.kimiAccountIdFromAccessToken(result.accessToken),
+    deviceId
+  };
+}
+async function loginKimi(store, deps, exchangeFetch, label) {
+  const result = await deps.awaitKimiDevice(exchangeFetch);
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    ...result.accountId ? { accountId: result.accountId } : {},
+    deviceId: result.deviceId,
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("kimi", block, label);
+  logMasked("kimi", result.accessToken);
+  return expiresAt;
+}
 function isLoginProvider(value) {
   return PROVIDERS2.includes(value);
 }
@@ -19361,7 +20785,7 @@ function providersRmKey(configPath, providerId, keyId) {
 }
 
 // src/commands/secrets.ts
-var import_node_fs38 = require("fs");
+var import_node_fs39 = require("fs");
 var import_node_util9 = require("util");
 async function runSecrets(argv) {
   const { values, positionals } = (0, import_node_util9.parseArgs)({
@@ -19434,12 +20858,12 @@ function secretsStatus(args) {
     reportField("admin.token", cfg.admin.token);
   }
   const tokensPath = defaultTokensPath(args.config);
-  if ((0, import_node_fs38.existsSync)(tokensPath)) {
+  if ((0, import_node_fs39.existsSync)(tokensPath)) {
     console.info(`Secret status for ${tokensPath}:`);
     reportTokenFields(tokensPath);
   }
   const integrationsPath = defaultIntegrationsPath(args.config);
-  if ((0, import_node_fs38.existsSync)(integrationsPath)) {
+  if ((0, import_node_fs39.existsSync)(integrationsPath)) {
     const state = readRawJson(integrationsPath);
     const key = state.gatewayKey;
     if (key && typeof key === "object" && !Array.isArray(key)) {
@@ -19493,8 +20917,8 @@ async function secretsRotate(args) {
   const integrationsPath = defaultIntegrationsPath(args.config);
   try {
     cfg = loadConfig(args.config);
-    if ((0, import_node_fs38.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
-    if ((0, import_node_fs38.existsSync)(integrationsPath)) {
+    if ((0, import_node_fs39.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, oldBox);
+    if ((0, import_node_fs39.existsSync)(integrationsPath)) {
       integrationsPlain = new IntegrationStateStore(integrationsPath, oldBox).load();
     }
   } finally {
@@ -19529,20 +20953,20 @@ function secretsDecrypt(args) {
   let tokensPlain = null;
   try {
     cfg = loadConfig(args.config);
-    if ((0, import_node_fs38.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
+    if ((0, import_node_fs39.existsSync)(tokensPath)) tokensPlain = decryptTokensFile(tokensPath, box);
   } finally {
     setSecretBox(null);
   }
   saveConfig(args.config, cfg);
   if (tokensPlain) {
-    (0, import_node_fs38.writeFileSync)(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n", "utf8");
+    atomicReplaceUtf8(tokensPath, JSON.stringify(tokensPlain, null, 2) + "\n");
   }
   console.info(`Decrypted secrets to plaintext in ${args.config}` + tokensSuffix(args.config));
 }
 function readRawConfig(path2) {
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
+    parsed = JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
   } catch {
     throw new Error(`secrets: cannot read or parse '${path2}'`);
   }
@@ -19550,7 +20974,7 @@ function readRawConfig(path2) {
 }
 function readRawJson(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -19560,13 +20984,13 @@ function readRawJson(path2) {
 }
 function encryptTokensFileInPlace(configPath, box) {
   const tokensPath = defaultTokensPath(configPath);
-  if (!(0, import_node_fs38.existsSync)(tokensPath)) return;
+  if (!(0, import_node_fs39.existsSync)(tokensPath)) return;
   const plain = decryptTokensFile(tokensPath, box);
   writeTokensEncrypted(tokensPath, plain, box);
 }
 function rewriteIntegrationState(configPath, readBox, writeBox) {
   const path2 = defaultIntegrationsPath(configPath);
-  if (!(0, import_node_fs38.existsSync)(path2)) return;
+  if (!(0, import_node_fs39.existsSync)(path2)) return;
   const state = new IntegrationStateStore(path2, readBox).load();
   new IntegrationStateStore(path2, writeBox).save(state);
 }
@@ -19579,7 +21003,7 @@ function writeTokensEncrypted(tokensPath, plain, box) {
     { updatedAt: "", ...plain },
     box
   );
-  (0, import_node_fs38.writeFileSync)(tokensPath, JSON.stringify(encrypted, null, 2) + "\n", "utf8");
+  atomicReplaceUtf8(tokensPath, JSON.stringify(encrypted, null, 2) + "\n");
 }
 var TOKEN_FIELDS2 = {
   claude: ["accessToken", "refreshToken"],
@@ -19602,7 +21026,7 @@ function walkTokens(raw, fn) {
   return next;
 }
 function tokensSuffix(configPath) {
-  return (0, import_node_fs38.existsSync)(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
+  return (0, import_node_fs39.existsSync)(defaultTokensPath(configPath)) ? " (+ tokens.json)" : "";
 }
 
 // src/commands/start.ts
@@ -19869,7 +21293,7 @@ async function main() {
       process.exitCode = 1;
   }
 }
-main().catch((err5) => {
-  console.error(err5 instanceof Error ? err5.message : String(err5));
+main().catch((err6) => {
+  console.error(err6 instanceof Error ? err6.message : String(err6));
   process.exitCode = 1;
 });