@omnicross/daemon 0.4.2 → 0.4.4

package/dist/index.d.cts

@@ -1,12 +1,12 @@
 import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
 import { SearchRuntime, SearchFrontendModes } from '@omnicross/core/search';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
+import { AllowanceSchedulingConfig, AccountProbeConfig, ImagesServerConfig, ImageProviderId, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, CodexImageCapabilityEvidenceSource, CodexImageCapabilityEvidenceRequest, CodexImageCapabilityEvidence, CodexImageCapabilityObservation, ImageExecutionScheduler, ImageExecutionAccountKey, ImageExecutionSchedulerRequest, ImageExecutionSchedulerGrant, SubscriptionAccountService, SubscriptionProviderRegistry } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot, AllowanceWindow } from '@omnicross/contracts/account-allowance-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AntigravityTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
 import * as _omnicross_contracts_subscription_types from '@omnicross/contracts/subscription-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 import { AccountAllowanceStore } from '@omnicross/core/pipeline/AccountAllowanceStore';
@@ -21,8 +21,8 @@ import { AuditRecord, AuditStats, AuditBodyResult, AuditConfig } from '@omnicros
 import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import * as _omnicross_contracts_image_generation_types from '@omnicross/contracts/image-generation-types';
-import { ImageCapabilityUnavailableReason, ImageCapabilities, ImageGenerationErrorCode, ImageReferenceMetadata, ImageReferenceId } from '@omnicross/contracts/image-generation-types';
-import { ImageApiContributions, ResponsesImageGenerationContribution, ResponsesImageInspectionInput, ResponsesImageAdmission, ResponsesHostedToolSelection, ResponsesImageRequestScope, ImageTelemetrySink, ImageApiAuditRecord, ImageTelemetryRecord, ImageReferenceStore, ImageReferenceSaveInput, ImageReferenceResolution, ImageTemporaryResourceBudget, ImageTemporaryResourceBudgetLease, ImageApiLimits, ImageRequestResourceScope, ImageApiRuntimeResolver, RemoteImageAssetResolver, ImageProvider, ImageProviderRegistry, ImageOrchestrator } from '@omnicross/core/image-generation';
+import { ImageReferenceMetadata, ImageReferenceId, ImageGenerationErrorCode, ImageCapabilityUnavailableReason, ImageCapabilities } from '@omnicross/contracts/image-generation-types';
+import { ImageReferenceStore, ImageReferenceSaveInput, ImageReferenceResolution, ImageApiContributions, ResponsesImageGenerationContribution, ResponsesImageInspectionInput, ResponsesImageAdmission, ResponsesHostedToolSelection, ResponsesImageRequestScope, ImageTelemetrySink, ImageApiAuditRecord, ImageTelemetryRecord, ImageTemporaryResourceBudget, ImageTemporaryResourceBudgetLease, ImageApiLimits, ImageRequestResourceScope, ImageApiRuntimeResolver, RemoteImageAssetResolver, ImageProvider, ImageProviderRegistry, ImageOrchestrator } from '@omnicross/core/image-generation';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
 import { PricingEntry, PricingEntryInput, PricingResolution, PricingSourceRefreshResult } from '@omnicross/contracts/pricing-types';
 import { ResponsesImageStateStore, ResponsesImageStateCommitInput, ResponsesImageCallBinding, ResponsesImageCallId, ResponsesImageCallResolution, ResponsesImageResponseResolution } from '@omnicross/core/image-generation/responses';
@@ -602,6 +602,32 @@ interface ResolvedAdminConfig {
 }
 /** The default admin port (distinct from the 8765 outbound server). */
 declare const DEFAULT_ADMIN_PORT = 8766;
+/**
+ * Per-provider behavior flags for the antigravity subscription.
+ */
+interface AntigravityProviderConfig {
+    /**
+     * Enable the production→sandbox endpoint failover for retryable antigravity
+     * upstream failures (design D5). DEFAULT OFF — with the switch off a
+     * retryable failure surfaces the original error semantics unchanged.
+     */
+    sandboxFailover?: boolean;
+}
+/**
+ * Per-provider identity config for the OpenCodeGo subscription
+ * (opencodego-egress-identity).
+ */
+interface OpenCodeGoProviderConfig {
+    /**
+     * The `user-agent` every OpenCodeGo egress presents to opencode.ai (relay
+     * traffic AND the background usage poll). An app embedding omnicross sets
+     * its own identity here (e.g. `elftia/1.2.0`); absent ⇒ the product default
+     * `omnicross/<version>`. opencode.ai's announcement asks proxy tools to
+     * identify themselves clearly — a bare relay falls to Node's generic `node`
+     * UA, exactly the shape their traffic monitoring flags. NON-SECRET.
+     */
+    userAgent?: string;
+}
 /** The full daemon config. */
 interface DaemonConfig {
     providers: DaemonProviderConfig[];
@@ -621,6 +647,16 @@ interface DaemonConfig {
      * lifetime per-key spend the outbound key policy seeds from.
      */
     usage?: UsageRetentionConfig;
+    /**
+     * Optional antigravity-subscription behavior flags (sandbox failover et al).
+     * Absent ⇒ every default (failover OFF).
+     */
+    antigravity?: AntigravityProviderConfig;
+    /**
+     * Optional OpenCodeGo identity config (outbound user-agent). Absent ⇒ the
+     * product default `omnicross/<version>` on every opencode.ai egress.
+     */
+    opencodego?: OpenCodeGoProviderConfig;
 }
 /** Apply defaults to a (possibly absent) admin block: enabled, port 8766,
  *  loopback, no token. NOTE: an EXPLICIT `port: 0` is honored as "bind an
@@ -678,7 +714,7 @@ type AtomicFileReplace = (targetPath: string, contents: string) => void;
  */
 
 /** Provider id → owned contract field names. */
-type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot';
+type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot' | 'antigravity';
 interface AccountMetadataPatch {
     label?: string;
     enabled?: boolean;
@@ -807,7 +843,7 @@ type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentia
  * shapes), keyed by `SubscriptionProviderId` the daemon admin layer validates
  * the wire body to one of these before calling the writer.
  */
-type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig;
+type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig | AntigravityTokenConfig;
 declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialStore {
     private readonly tokensPath;
     private readonly box;
@@ -934,13 +970,32 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * the retry instead of looping on a dead token).
      */
     refreshCopilotToken(): Promise<boolean>;
+    /**
+     * Refresh the Antigravity (Google) OAuth access token. Like gemini, the
+     * Google token endpoint does NOT return a refresh_token on refresh, so this
+     * writes ONLY access+expiresAt (+status/lastRefreshedAt) and DELIBERATELY
+     * preserves the stored `refreshToken` — plus the account's `projectId`
+     * (a handshake product; the post-refresh re-validation is the refresh
+     * scheduler's hook, not this write) and `email`. HONEST `false` when no
+     * refresh_token.
+     */
+    refreshAntigravityToken(): Promise<boolean>;
+    /**
+     * Post-refresh project re-validation hook (antigravity design D8): after a
+     * successful antigravity token refresh, re-run the Code Assist project
+     * handshake and write the (possibly rotated) `projectId` back to the account.
+     * A handshake FAILURE keeps the stored projectId untouched (logged) so the
+     * account keeps serving with the last-known-good project until a later
+     * refresh succeeds. Returns whether the handshake produced a project.
+     */
+    revalidateAntigravityProject(accountId: string): Promise<boolean>;
     /**
      * Refresh a SPECIFIC managed account by id (background scheduler sweep and
      * account-pool resolution). It uses only that account's stored refresh
      * token. Coalesced per `provider:id`; on failure flags ONLY that account
      * `expired`.
      */
-    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot', id: string): Promise<boolean>;
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot' | 'antigravity', id: string): Promise<boolean>;
     /**
      * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
      * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -1686,6 +1741,59 @@ declare class GeminiAllowanceCollector {
     private unsupportedSnapshot;
 }
 
+/**
+ * AntigravityAllowanceCollector — the antigravity subscription's quota via the
+ * Code Assist internal quotaSummary RPC (antigravity-subscription-provider
+ * design D6).
+ *
+ * Probes `POST ${daily-cloudcode-pa}/v1internal:retrieveUserQuotaSummary` per
+ * antigravity account (Bearer access token + the antigravity/hub UA the
+ * inference path also carries), parsing the rolling 5h + weekly DUAL buckets —
+ * split by counter family (Google / Anthropic / OpenAI) — into per-model-family
+ * allowance windows: `remainingFraction` (0–1) → used percent, `resetTime` →
+ * resetsAt, `disabled` → the window's hard-block flag. The shared
+ * counter-family ←→ model-family map lives in core (`antigravityQuotaFamily`).
+ *
+ * FALLBACK: when the summary RPC fails, `v1internal:fetchAvailableModels`'s
+ * per-model `quotaInfo` is the legacy source — the collect then updates from
+ * it instead. A total failure NEVER clears the existing windows (stale-marking
+ * only), mirroring the sibling collectors.
+ *
+ * Mirrors the sibling collectors' cache contract: 5-minute cache, per-account
+ * in-flight merging, one 401/403→refresh→retry. Unlike gemini (per-model
+ * fractions, display-only), antigravity IS in the allowance scheduling
+ * whitelist — the account-level dual buckets fit the worst-window rule.
+ *
+ * @module @omnicross/daemon/allowance/AntigravityAllowanceCollector
+ */
+
+interface AntigravityAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'antigravity', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'antigravity', accountId: string): Promise<boolean>;
+}
+type AntigravityAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface AntigravityAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class AntigravityAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: AntigravityAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: AntigravityAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<AntigravityTokenConfig>[], options?: AntigravityAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<AntigravityTokenConfig>, options?: AntigravityAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    /** One upstream round-trip with the antigravity/hub masquerade UA. */
+    private request;
+    private snapshot;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
 /**
  * OpenCodeGo usage collector.
  *
@@ -1733,8 +1841,8 @@ declare class OpenCodeGoAllowanceCollector {
  * literals — extending them all would make the overloads conflict.
  */
 interface AccountAllowanceCredentialReader {
-    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot' | 'gemini', accountId: string): Promise<string | null>;
-    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot' | 'gemini', accountId: string): Promise<boolean>;
+    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot' | 'gemini' | 'antigravity', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot' | 'gemini' | 'antigravity', accountId: string): Promise<boolean>;
     getFullConfig(): Promise<AccountTokensConfig>;
 }
 interface AccountAllowanceFilter {
@@ -1756,7 +1864,8 @@ declare class AccountAllowanceService {
     readonly copilotCollector: CopilotAllowanceCollector;
     readonly opencodegoCollector: OpenCodeGoAllowanceCollector;
     readonly geminiCollector: GeminiAllowanceCollector;
-    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, geminiCollector?: GeminiAllowanceCollector, now?: () => number);
+    readonly antigravityCollector: AntigravityAllowanceCollector;
+    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, geminiCollector?: GeminiAllowanceCollector, antigravityCollector?: AntigravityAllowanceCollector, now?: () => number);
     /**
      * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
      * refreshed lazily on read (Codex polls `/backend-api/wham/usage`; the
@@ -1782,6 +1891,8 @@ declare class AccountAllowanceService {
     refreshGrok(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Force-refresh Gemini usage (Code Assist retrieveUserQuota) for one/all accounts. */
     refreshGemini(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Antigravity usage (quotaSummary dual buckets) for one/all accounts. */
+    refreshAntigravity(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /**
      * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
      * collectors preserve their cache + per-account in-flight coalescing; a tick
@@ -2214,1491 +2325,1575 @@ interface ProviderKeyQuota {
     errorCode?: string;
 }
 
-type PreparedImageRuntimeGeneration = {
-    readonly id: string;
-    readonly enabled: true;
-    readonly imageApi: ImageApiContributions;
-    readonly hosted: ResponsesImageGenerationContribution;
-    readonly hostedRuntime: HostedImageRuntimePolicy;
-    readonly inspectCapability?: (apiKeyId: string) => Promise<Omit<ImageRuntimeCapabilityInspection, 'generationId'>>;
-    readonly readRuntimeStatus?: () => ImageRuntimeResourceStatus;
-    dispose(): void | Promise<void>;
-} | {
-    readonly id: string;
-    readonly enabled: false;
-    dispose(): void | Promise<void>;
-};
-interface HostedImageRuntimeGenerationLease {
-    readonly generationId: string;
-    /** Compatibility/debug view; callers should prefer the deep methods below. */
-    readonly contribution: ResponsesImageGenerationContribution;
-    inspectRequest(input: ResponsesImageInspectionInput): ResponsesImageAdmission;
-    validateSelection(admission: ResponsesImageAdmission, selection: ResponsesHostedToolSelection): void;
-    openRequest(input: HostedImageOpenRequestInput): Promise<ResponsesImageRequestScope>;
-    release(): Promise<void>;
+type DaemonImagePathArea = 'temporary' | 'artifacts' | 'state' | 'evidence' | 'mountManifest';
+interface DaemonImagePaths {
+    readonly applicationDataRoot: string;
+    readonly imagesRoot: string;
+    readonly temporaryRoot: string;
+    readonly durableRoot: string;
+    readonly artifactsRoot: string;
+    readonly stateRoot: string;
+    readonly evidenceRoot: string;
+    readonly mountManifestRoot: string;
+    readonly mountManifestPath: string;
 }
-interface HostedImageRuntimePolicy {
-    readonly providerId: string;
-    readonly imageModel: string;
-    readonly referenceTtlMs: number;
-    readonly maxOutputBytes: number;
-    readonly maxTotalOutputBytes: number;
-    readonly preferredAccountId?: string;
-    readonly preferredAccountGroup?: string;
-    readonly boundAccountFallbackPolicy?: 'strict' | 'pool';
+interface ImageRootValidationOptions {
+    readonly label?: string;
+    readonly processDirectory?: string;
+    readonly userHome?: string;
+    readonly temporaryDirectory?: string;
 }
-interface HostedImageOpenRequestInput {
-    readonly admission: ResponsesImageAdmission;
-    readonly tenantId: string;
-    readonly requestId: string;
-    readonly sessionKey: string;
-    readonly signal: AbortSignal;
-    readonly authorizedPreviousResponseId?: string;
-    /** Trusted affinity fact forwarded unchanged into the contribution scope. */
-    readonly authorizedPreviousResponseKnownEmpty?: boolean;
-    readonly mainProviderId: string;
-    readonly selectedMainAccountId?: string;
+interface CreateDaemonImagePathResolverOptions extends ImageRootValidationOptions {
+    readonly configPath: string;
+    readonly storageRoot?: string;
 }
-/** Dormant integration seam for a later Native Responses owner. */
-interface HostedImageContributionFactory {
-    acquire(): Promise<HostedImageRuntimeGenerationLease>;
+interface VerifiedDaemonImagePath {
+    readonly area: DaemonImagePathArea;
+    readonly absolutePath: string;
+    readonly kind: 'opaque-file' | 'opaque-directory' | 'mount-manifest';
 }
-/** Bind a stable factory to one app-session runtime manager without acquiring. */
-declare function createHostedImageContributionFactory(manager: ImageRuntimeManager): HostedImageContributionFactory;
-interface ImageRuntimeGenerationStatus {
-    readonly generationId: string;
-    readonly enabled: boolean;
-    readonly httpLeases: number;
-    readonly hostedLeases: number;
+/**
+ * Owns all daemon Images filesystem names. Callers receive opaque capabilities,
+ * never a filename-accepting delete primitive; destructive methods revalidate
+ * the root identity, descendant relationship, basename, and symlink state.
+ */
+declare class DaemonImagePathResolver {
+    #private;
+    readonly paths: DaemonImagePaths;
+    constructor(options: CreateDaemonImagePathResolverOptions);
+    createOpaqueFile(area: Exclude<DaemonImagePathArea, 'temporary' | 'mountManifest'>, format?: 'bin' | 'json' | 'tmp'): VerifiedDaemonImagePath;
+    createOpaqueDirectory(area?: Exclude<DaemonImagePathArea, 'mountManifest'>): VerifiedDaemonImagePath;
+    mountManifest(): VerifiedDaemonImagePath;
+    /** Revalidate and return one internal root for store-local bounded I/O. */
+    verifiedRoot(area: DaemonImagePathArea): string;
+    /** Revalidate immediately before unlinking a resolver-issued file capability. */
+    removeFile(target: VerifiedDaemonImagePath): void;
+    /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
+    removeEmptyDirectory(target: VerifiedDaemonImagePath): void;
+    private issue;
+    private verifyDestructiveTarget;
 }
-interface ImageRuntimeManagerStatus {
-    readonly disposed: boolean;
-    readonly current: ImageRuntimeGenerationStatus;
-    readonly draining: readonly ImageRuntimeGenerationStatus[];
+
+interface FileCodexImageCapabilityEvidenceManifestOwnerOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly maxEntries?: number;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly hmacSalt?: Uint8Array;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-type ImageRuntimeSafeUnavailableReason = ImageCapabilityUnavailableReason | 'disabled' | 'runtime_unavailable';
-interface ImageRuntimeCapabilityInspection {
-    readonly generationId: string;
-    readonly enabled: boolean;
-    readonly available: boolean;
-    readonly providerId?: 'codex-subscription';
-    readonly model?: string;
-    readonly reason?: ImageRuntimeSafeUnavailableReason;
-    readonly capabilities?: ImageCapabilities;
+type FileCodexImageCapabilityEvidenceSourceOptions = Readonly<(FileCodexImageCapabilityEvidenceManifestOwnerOptions & {
+    readonly ttlMs: number;
+}) | {
+    readonly owner: FileCodexImageCapabilityEvidenceManifestOwner;
+    readonly ttlMs: number;
+}>;
+interface FileCodexImageCapabilityEvidenceStatus {
+    readonly entries: number;
+    readonly freshEntries: number;
+    readonly staleEntries: number;
+    readonly bytes: number;
 }
-interface ImageRuntimeResourceStatus {
-    readonly queue: Readonly<{
-        activeJobs: number;
-        waitingJobs: number;
-        activeAccounts: number;
-        waitingAccounts: number;
-        waitingTenants: number;
-        maxConcurrentJobsPerAccount: number;
-        maxQueuedJobs: number;
-        accepting: boolean;
-        shuttingDown: boolean;
-    }>;
-    readonly temporary: Readonly<{
-        activeScopes: number;
-        totalBytes: number;
-        tenantCount: number;
-        maxActiveScopes: number;
-        maxTotalBytes: number;
-        maxTenantBytes: number;
-    }>;
-    readonly storage: Readonly<{
-        mounts: number;
-        retiredMounts: number;
-        referenceEntries: number;
-        referenceBytes: number;
-        referenceTombstones: number;
-        stateCalls: number;
-        stateResponses: number;
-        stateTombstones: number;
-        pendingReferenceDeletes: number;
-        maxReferenceEntries: number;
-        maxReferenceBytes: number;
-        maxTenantReferenceBytes: number;
-        maxStateCalls: number;
-        maxStateResponses: number;
+/** Revision-aware manifest owner shared by runtime generations, doctor, and cleanup. */
+declare class FileCodexImageCapabilityEvidenceManifestOwner {
+    #private;
+    constructor(options: FileCodexImageCapabilityEvidenceManifestOwnerOptions);
+    createSource(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
+    resolveWithTtl(request: CodexImageCapabilityEvidenceRequest, ttlMs: number): Promise<CodexImageCapabilityEvidence>;
+    recordSuccessfulVerificationWithTtl(observation: CodexImageCapabilityObservation, ttlMs: number): Promise<void>;
+    cleanup(now: number, limit: number): Promise<{
+        readonly entriesRemoved: number;
+        readonly bytesRemoved: number;
     }>;
+    statusWithTtl(ttlMs: number): FileCodexImageCapabilityEvidenceStatus;
 }
-interface PreparedImageRuntimeChange {
-    readonly generationId: string;
-    publish(): void;
-    rollback(): void;
-    dispose(): Promise<void>;
-}
-/** App-session owner for stable forwarders and generation-pinned work. */
-declare class ImageRuntimeManager {
+/** Immutable TTL view over a revision-aware file-backed evidence manifest owner. */
+declare class FileCodexImageCapabilityEvidenceSource implements CodexImageCapabilityEvidenceSource {
     #private;
-    readonly contributions: ImageApiContributions;
-    constructor(initial?: PreparedImageRuntimeGeneration);
-    prepare(generation: PreparedImageRuntimeGeneration): PreparedImageRuntimeChange;
-    acquireHosted(): Promise<HostedImageRuntimeGenerationLease>;
-    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
-    listAvailableModels(apiKeyId: string): Promise<readonly string[]>;
-    resourceStatus(): ImageRuntimeResourceStatus | undefined;
-    status(): ImageRuntimeManagerStatus;
-    dispose(): Promise<void>;
+    constructor(options: FileCodexImageCapabilityEvidenceSourceOptions);
+    createView(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
+    resolve(request: CodexImageCapabilityEvidenceRequest): Promise<CodexImageCapabilityEvidence>;
+    recordSuccessfulVerification(observation: CodexImageCapabilityObservation): Promise<void>;
+    cleanup(now: number, limit: number): Promise<{
+        readonly entriesRemoved: number;
+        readonly bytesRemoved: number;
+    }>;
+    status(): FileCodexImageCapabilityEvidenceStatus;
+    ttlMs(): number;
+    /** Lifecycle-symmetric no-op; physical safety no longer depends on local leases. */
+    dispose(): void;
 }
 
-type SafeProvider = 'codex-subscription' | 'unknown' | 'other';
-type SafeModel = 'gpt-image-2' | 'unknown' | 'other';
-type SafeErrorCode = ImageGenerationErrorCode | 'none' | 'other';
-type SafeCountOption = 'unknown' | '0' | '1' | '2-4' | '5+';
-type SafeBooleanOption = boolean | 'unknown';
-type SafeQuality = 'auto' | 'low' | 'medium' | 'high' | 'unknown' | 'other';
-type SafeBackground = 'auto' | 'opaque' | 'transparent' | 'unknown' | 'other';
-type SafeOutputFormat = 'png' | 'jpeg' | 'webp' | 'unknown' | 'other';
-declare const IMAGE_CONFIGURATION_AUDIT_FIELDS: readonly ["enablement", "provider", "model", "account", "queue", "temporary", "limits", "retention", "storage", "remote", "evidence"];
-type ImageConfigurationAuditField = typeof IMAGE_CONFIGURATION_AUDIT_FIELDS[number];
-/** Values are deliberately limited to safe categories and internal generation ids. */
-interface ImageConfigurationAuditRecord {
-    readonly outcome: 'applied';
-    readonly fields: readonly ImageConfigurationAuditField[];
-    readonly previousGenerationId?: string;
-    readonly generationId?: string;
-}
-interface ImageHistogramSnapshot {
-    readonly count: number;
-    readonly sum: number;
-    /** Non-cumulative fixed buckets; `upperBound:null` is the overflow bucket. */
-    readonly buckets: readonly {
-        readonly upperBound: number | null;
-        readonly count: number;
-    }[];
+interface FileImageReferenceStoreLimits {
+    readonly ttlMs: number;
+    readonly maxArtifactBytes: number;
+    readonly maxTotalBytes: number;
+    readonly maxTenantBytes: number;
+    readonly maxEntries: number;
+    readonly maxTombstones: number;
+    readonly tombstoneTtlMs: number;
 }
-interface ImageApiMetricDimensions {
-    readonly endpoint: 'images.generate' | 'images.edit';
-    readonly provider: SafeProvider;
-    readonly model: SafeModel;
-    readonly action: 'generate' | 'edit';
-    readonly quality: SafeQuality;
-    readonly background: SafeBackground;
-    readonly outputFormat: SafeOutputFormat;
-    readonly streaming: SafeBooleanOption;
-    readonly requestedOutputs: SafeCountOption;
-    readonly partialImages: SafeCountOption;
-    readonly terminal: 'completed' | 'failed' | 'cancelled';
-    readonly errorCode: SafeErrorCode;
+interface FileImageReferenceStoreOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly limits: FileImageReferenceStoreLimits;
+    readonly secretBox?: SecretBox;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-interface ImageExecutionMetricDimensions {
-    readonly provider: SafeProvider;
-    readonly model: SafeModel;
-    readonly action: 'generate' | 'edit' | 'other';
-    readonly quality: SafeQuality;
-    readonly background: SafeBackground;
-    readonly outputFormat: SafeOutputFormat;
-    readonly streaming: SafeBooleanOption;
-    readonly requestedOutputs: SafeCountOption;
-    readonly terminal: 'completed' | 'failed' | 'cancelled' | 'other';
-    readonly errorCode: SafeErrorCode;
+interface FileImageReferenceReconciliationResult {
+    readonly metadataRemoved: number;
+    readonly metadataDegradedToProviderReference: number;
+    readonly orphanFilesRemoved: number;
+    readonly incompleteFilesRemoved: number;
+    readonly invalidDescendants: number;
 }
-interface ImageApiMetricSnapshot {
-    readonly dimensions: ImageApiMetricDimensions;
-    readonly requests: number;
-    readonly inputCount?: ImageHistogramSnapshot;
-    readonly inputBytes?: ImageHistogramSnapshot;
-    readonly referenceOutcomes: Readonly<{
-        hits: number;
-        notFound: number;
-        expired: number;
-        failed: number;
-    }>;
-    readonly cleanupOutcomes: Readonly<{
-        completed: number;
-        failed: number;
-    }>;
+declare class FileImageReferenceStore implements ImageReferenceStore {
+    #private;
+    constructor(options: FileImageReferenceStoreOptions);
+    save(input: ImageReferenceSaveInput): Promise<ImageReferenceMetadata>;
+    /** Generation-bound write entry point; reads and maintenance remain shared. */
+    saveWithLimits(input: ImageReferenceSaveInput, limits: FileImageReferenceStoreLimits): Promise<ImageReferenceMetadata>;
+    /** Updates only app-session maintenance policy; pinned writes pass their own limits. */
+    updateMaintenanceLimits(limits: FileImageReferenceStoreLimits): void;
+    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
+    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
+    /** Daemon-internal cleanup path; accepts only the local reference-domain tenant HMAC. */
+    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
+    cleanup(now?: number): Promise<number>;
+    status(): {
+        readonly entries: number;
+        readonly bytes: number;
+        readonly tombstones: number;
+    };
+    hasLiveReferenceByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId, now?: number): Promise<boolean>;
+    reconcileOwnedFiles(maxEntries: number): Promise<FileImageReferenceReconciliationResult>;
+    openArtifact(fileName: string, byteLength: number, signal?: AbortSignal): Promise<ReadableStream<Uint8Array>>;
+    private exclusive;
+    private tenantKey;
+    private newReferenceId;
+    private validateSaveInput;
+    private selectVictims;
+    private nextTombstones;
+    private writeArtifact;
+    private artifactPath;
+    private validArtifact;
+    private removeArtifact;
+    private safeUnlinkArtifactPath;
+    private releaseLease;
+    private manifestPath;
+    private persist;
+    private atomicReplace;
+    private loadManifest;
 }
-interface ImageExecutionMetricSnapshot {
-    readonly dimensions: ImageExecutionMetricDimensions;
-    readonly executions: number;
-    readonly finalLatencyMs: ImageHistogramSnapshot;
-    readonly queueWaitMs?: ImageHistogramSnapshot;
-    readonly generationDurationMs?: ImageHistogramSnapshot;
-    readonly firstPartialLatencyMs?: ImageHistogramSnapshot;
-    readonly inputCount: ImageHistogramSnapshot;
-    readonly inputBytes: ImageHistogramSnapshot;
-    readonly outputCount: ImageHistogramSnapshot;
-    readonly outputBytes: ImageHistogramSnapshot;
-    readonly retryCount?: ImageHistogramSnapshot;
-    readonly authRefreshCount?: ImageHistogramSnapshot;
-    readonly referenceSaveCount?: ImageHistogramSnapshot;
-    readonly retentionRollbackFailures?: ImageHistogramSnapshot;
+
+interface FileResponsesImageStateStoreLimits {
+    readonly maxCalls: number;
+    readonly maxResponses: number;
+    readonly maxTombstones: number;
+    readonly tombstoneTtlMs: number;
 }
-interface ImageObservabilitySnapshot {
-    readonly apiRequests: readonly ImageApiMetricSnapshot[];
-    readonly executions: readonly ImageExecutionMetricSnapshot[];
-    readonly configurationChanges: readonly ImageConfigurationAuditRecord[];
-    readonly overflow: Readonly<{
-        apiRecords: number;
-        telemetryRecords: number;
-    }>;
+interface FileResponsesImageStateStoreOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly limits: FileResponsesImageStateStoreLimits;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-interface ImageObservabilityOptions {
-    /** Hard cap applied independently to API and execution dimension maps. */
-    readonly maxDimensionSets?: number;
+interface PendingResponsesImageReferenceDelete {
+    readonly referenceTenantKey: string;
+    readonly binding: ResponsesImageCallBinding;
 }
-/** Process-local, metadata-only aggregation for HTTP and hosted Images work. */
-declare class ImageObservability {
+/** Durable production implementation of the existing Responses image-state contract. */
+declare class FileResponsesImageStateStore implements ResponsesImageStateStore {
     #private;
-    readonly telemetrySink: ImageTelemetrySink;
-    readonly audit: (record: ImageApiAuditRecord) => void;
-    constructor(options?: ImageObservabilityOptions);
-    recordApiAudit(record: ImageApiAuditRecord): void;
-    recordTelemetry(record: ImageTelemetryRecord): void;
-    recordConfigurationAudit(record: ImageConfigurationAuditRecord): void;
-    snapshot(): ImageObservabilitySnapshot;
-    reset(): void;
+    constructor(options: FileResponsesImageStateStoreOptions);
+    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
+    /** Generation-bound write entry point; reads and maintenance remain shared. */
+    commitWithLimits(input: ResponsesImageStateCommitInput, limits: FileResponsesImageStateStoreLimits): Promise<readonly ResponsesImageCallBinding[]>;
+    /** Updates only app-session maintenance policy; pinned commits pass their own limits. */
+    updateMaintenanceLimits(limits: FileResponsesImageStateStoreLimits): void;
+    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
+    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
+    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
+    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
+    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
+    pendingReferenceDeletes(limit?: number): readonly PendingResponsesImageReferenceDelete[];
+    acknowledgeReferenceDeletes(completed: readonly PendingResponsesImageReferenceDelete[]): Promise<number>;
+    reconcileBrokenReferenceLinks(hasLiveReference: (referenceTenantKey: string, referenceId: ResponsesImageCallBinding['referenceId']) => Promise<boolean>, maxEntries: number): Promise<readonly ResponsesImageCallBinding[]>;
+    status(): {
+        readonly calls: number;
+        readonly responses: number;
+        readonly tombstones: number;
+        readonly pendingReferenceDeletes: number;
+    };
+    private exclusive;
+    private failure;
+    private assertCommit;
+    private tenantKey;
+    private rememberTombstone;
+    private enqueuePendingReferenceDelete;
+    private hasTombstone;
+    private prunedTombstones;
+    private pruneTombstonesInPlace;
+    private sameTombstones;
+    private touch;
+    private releaseCall;
+    private releaseResponse;
+    private manifestPath;
+    private persist;
+    private atomicReplace;
+    private loadManifest;
 }
 
-interface PreparedServerConfigChange {
-    /** Publish the prepared snapshot. Implementations should make this an infallible swap. */
-    publish(): void | Promise<void>;
-    /** Restore the exact runtime snapshot that preceded publish. */
-    rollback(): void | Promise<void>;
-    /** Release an unpublished or rolled-back replacement. */
-    dispose(): void | Promise<void>;
+interface ImageStorageMountBackend {
+    readonly id: string;
+    readonly createdAt: number;
+    readonly resolver: DaemonImagePathResolver;
+    readonly references: FileImageReferenceStore;
+    readonly responsesState: FileResponsesImageStateStore;
 }
-
-/**
- * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
- *
- * A DB-backed embedder can persist 401/403 auto-disable durably so a UI can
- * render per-key health. The daemon has no DB, and its only
- * durable layer is `config.json` — but writing auto-disable back there in v1
- * would (1) cause write amplification under a 401 storm and (2) collide with
- * the at-rest encryption schema that owns the `apiKeys[]` on-disk
- * format. So v1 records auto-disable IN MEMORY only:
- *  - `markAutoDisabled(keyId, status, at)` records `{ status, at, reason }`,
- *  - `isDisabled(keyId)` / `get(keyId)` read it back,
- *  - `loadPoolKeys` reads this store and flips a flagged key's `enabled` to
- *    `false`, so `getAvailableKeys` skips it within this process lifetime.
- *
- * Restart resets the store (the honest v1 boundary — see spec). Persistence
- * (encrypted write-back) is a child-3 follow-up.
- *
- * @module @omnicross/daemon/pool/autoDisableStore
- */
-/** One in-memory auto-disable record for a pool key. */
-interface AutoDisableRecord {
-    /** The HTTP status that triggered the disable (401/403). */
-    status: number;
-    /** Epoch-ms when the disable was recorded. */
-    at: number;
-    /** Always `'auth_failure'` in v1 (the only auto-disable trigger). */
-    reason: 'auth_failure';
+interface ImageStorageMountCatalogOptions {
+    readonly pathOptions: Omit<CreateDaemonImagePathResolverOptions, 'storageRoot'>;
+    readonly activeStorageRoot?: string;
+    readonly referenceLimits: FileImageReferenceStoreLimits;
+    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
+    readonly secretBox?: SecretBox;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceCatalog?: (targetPath: string, contents: Uint8Array) => void;
+    readonly reconcileCorruptManifests?: boolean;
 }
-/**
- * A process-lifetime in-memory store of auto-disabled pool keys, keyed by the
- * pool key id. Constructed once in `buildDaemon` and injected as the pool's
- * `disableKey` / `markAutoDisabled` sinks AND read by `loadPoolKeys`.
- */
-declare class AutoDisableStore {
-    private readonly records;
-    /** Record (or overwrite) an auth-failure auto-disable for `keyId`. */
-    markAutoDisabled(keyId: string, status: number, at: number): void;
-    /** Whether `keyId` is currently auto-disabled in this process. */
-    isDisabled(keyId: string): boolean;
-    /** Read the auto-disable record for `keyId`, or `undefined` when healthy. */
-    get(keyId: string): AutoDisableRecord | undefined;
-    /** Clear all records (tests / teardown). */
-    clear(): void;
+interface ImageStorageMountPolicy {
+    readonly referenceLimits: FileImageReferenceStoreLimits;
+    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
 }
-
-/**
- * ConfigFileProviderConfigSource — the daemon's file-backed `ProviderConfigSource`
- * port impl: an embedder of `@omnicross/core`'s provider catalog port.
- *
- * The daemon's `config.json` provider rows ARE the catalog. Of the port's ten
- * methods, FOUR are real (the ones the BYO proxy/outbound path actually hits):
- *  - `getProvider(id)` — map a `DaemonProviderConfig` row to an `LLMProvider`.
- *  - `getTransformerService()` — a single `TransformerService` seeded by
- *    `registerBuiltinTransformers` in the ctor.
- *  - `getMainTransformer(id)` — the transformer for the provider's target wire
- *    format (anthropic → AnthropicTransformer, gemini → GeminiTransformer,
- *    openai → null/identity), mirroring the host `AgentModelsManager` switch.
- *    `resolveProviderChain` unshifts this FORMAT-FIRST into the provider chain.
- *  - `resolveTransformerChain(id, model)` — the provider's CUSTOM
- *    `transformer.use[]` chain (app-parity-2 child 2: ENFORCED). The format
- *    transformer is NOT included here (getMainTransformer supplies it,
- *    format-first); no `transformer.use[]` → empty chain.
- *
- * The remaining SIX are minimal sensible stubs (never hit on the BYO single-key
- * path — the boot smoke test is the proof).
- *
- * @module @omnicross/daemon/ports/ConfigFileProviderConfigSource
- */
-
-declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
-    private readonly providers;
-    private readonly transformerService;
-    /**
-     * Optional reload-hook (key-pool change, design D4). A no-type-coupling
-     * callback invoked at the END of `reload(...)`. `buildDaemon` injects
-     * `() => pool.invalidateCache()` so the `ApiKeyPoolService.keyCache` is
-     * flushed after a hot-reload swaps the catalog — WITHOUT this port ever
-     * importing/depending on `ApiKeyPoolService`. Absent = no-op (single-key
-     * boots that never construct a pool stay byte-identical).
-     */
-    private reloadHook;
-    constructor(config: DaemonConfig);
-    /**
-     * Register a callback fired after every `reload(...)`. Used by `buildDaemon`
-     * to invalidate the pool's keyCache on a hot-reload. The port stays ignorant
-     * of what the callback does (no pool type dependency).
-     */
-    setReloadHook(fn: () => void): void;
-    /**
-     * Read the live (post-reload) provider row for `providerId`, or `undefined`.
-     * Exposed so the pool's `loadKeys` reads the SAME live catalog Map this port
-     * serves (so a hot-reload is observed on the next load after `invalidateCache`).
-     */
-    getProviderRow(providerId: string): DaemonProviderConfig | undefined;
-    /** Await the built-in transformer registration (tests await this before dispatch). */
-    ready(): Promise<void>;
-    /**
-     * Replace the live provider catalog in place (additive — does NOT touch the
-     * ten port methods, the seeded `TransformerService`, or `ready()`). Called by
-     * the admin API after a provider POST/PUT/DELETE persists `config.json`, so the
-     * next outbound request sees the new catalog WITHOUT a daemon restart. The Map
-     * swap is synchronous; an in-flight request keeps its already-resolved
-     * provider (no locking needed for a single-operator local daemon).
-     */
-    reload(config: DaemonConfig): void;
-    /** Clear + repopulate the private providers Map from a fresh provider list. */
-    setProviders(providers: readonly DaemonProviderConfig[]): void;
-    getProvider(id: string): Promise<LLMProvider | null>;
-    getTransformerService(): TransformerService | undefined;
-    getMainTransformer(providerId: string): Promise<Transformer | null>;
-    resolveTransformerChain(providerId: string, _model?: string): Promise<ResolvedTransformerChain>;
-    resolveRoutedModel(): Promise<null>;
-    resolveEffectiveModels(): Promise<{
-        background?: string;
-        vision?: string;
-    }>;
-    getAgentDefaultModels(): Promise<AgentDefaultModels>;
-    hasVisionCapability(): Promise<boolean>;
-    getGlobalModelParameters(): Promise<GlobalModelParameters>;
-    getDiscoveredModelMaxTokens(): Promise<number | undefined>;
+interface PreparedImageStorageMountActivation {
+    readonly backend: ImageStorageMountBackend;
+    publish(): ImageStorageMountBackend;
+    rollback(): void;
+    dispose(): void;
 }
-
-/**
- * JsonApiServerSettingsStore — the daemon's file-backed `ApiServerSettingsStore`
- * port impl.
- *
- * The serving core persists the outbound-API server config (`{ enabled,
- * networkBinding, endpoints, port }`) under a SINGLE settings key
- * (`OUTBOUND_API_SERVER_CONFIG_KEY === 'outboundApiServer.config'`). Here that
- * store is the daemon's `config.json` `server`
- * field. `loadServerConfig(store)` / `saveServerConfig(store, cfg)` (core)
- * normalize + persist through this 2-method surface.
- *
- * Only the one outbound-API key is ever read/written — any other key is a no-op
- * miss (returns `undefined`) so the surface stays honest about what it backs.
- *
- * @module @omnicross/daemon/ports/JsonApiServerSettingsStore
- */
-
-interface JsonSettingsDocumentSnapshot {
-    readonly existed: boolean;
-    /** Raw persisted bytes; may contain encrypted secrets and must never enter a DTO or log. */
-    readonly bytes?: Uint8Array;
+/** Owns the durable-root set independently from any one runtime generation. */
+declare class ImageStorageMountCatalog {
+    #private;
+    constructor(options: ImageStorageMountCatalogOptions);
+    active(): ImageStorageMountBackend;
+    mountsForRead(): readonly ImageStorageMountBackend[];
+    status(): {
+        readonly mounts: number;
+        readonly retiredMounts: number;
+    };
+    startupReconciliationStatus(): {
+        readonly corruptManifestsQuarantined: number;
+    };
+    utilization(): {
+        readonly referenceEntries: number;
+        readonly referenceBytes: number;
+        readonly referenceTombstones: number;
+        readonly stateCalls: number;
+        readonly stateResponses: number;
+        readonly stateTombstones: number;
+        readonly pendingReferenceDeletes: number;
+    };
+    /** Pins a backend object until its owning runtime generation drains. */
+    retainBackend(backend: ImageStorageMountBackend): () => void;
+    activate(storageRoot?: string): ImageStorageMountBackend;
+    /** Prepare a validated backend without changing the catalog's active mount. */
+    prepareActivation(storageRoot?: string, policy?: ImageStorageMountPolicy): PreparedImageStorageMountActivation;
+    retireEmptyMount(mountId: string): boolean;
+    private createResolver;
+    private createBackend;
+    private applyMaintenancePolicy;
+    private newMountId;
+    private isManifestError;
+    private quarantineManifest;
+    private isVerifiedEmpty;
+    private catalogPath;
+    private persist;
+    private atomicReplace;
+    private loadCatalog;
 }
-type AtomicDocumentReplace = (targetPath: string, contents: Uint8Array) => void;
-declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
-    private readonly configPath;
-    private readonly box;
-    private readonly atomicReplace;
-    /**
-     * @param configPath the daemon config.json whose `server` field is backed.
-     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
-     *                    `server.proxy.*` passwords are encrypted-on-`set` /
-     *                    decrypted-on-`get` (the settings-store path is otherwise not
-     *                    secret-aware — every OTHER server field is non-secret). Null
-     *                    ⇒ passthrough (legacy/pure tests unchanged).
-     */
-    constructor(configPath: string, box?: SecretBox | null, atomicReplace?: AtomicDocumentReplace);
-    get<T = unknown>(key: string): Promise<T | undefined>;
-    set<T = unknown>(key: string, value: T): Promise<void>;
-    /** Capture the exact prior document for an admin transaction rollback. */
-    captureDocumentSnapshot(): JsonSettingsDocumentSnapshot;
-    /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
-    restoreDocumentSnapshot(snapshot: JsonSettingsDocumentSnapshot): void;
-    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
-    private encryptSecrets;
-    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
-    private decryptSecrets;
-    /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
-    private readFile;
+declare class MountedImageReferenceStore implements ImageReferenceStore {
+    private readonly catalog;
+    private readonly writeBackend?;
+    private readonly writeLimits?;
+    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileImageReferenceStoreLimits | undefined);
+    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileImageReferenceStoreLimits): MountedImageReferenceStore;
+    status(): Readonly<{
+        referenceEntries: number;
+        referenceBytes: number;
+        referenceTombstones: number;
+        stateCalls: number;
+        stateResponses: number;
+        stateTombstones: number;
+        pendingReferenceDeletes: number;
+        mounts: number;
+        retiredMounts: number;
+    }>;
+    save(input: ImageReferenceSaveInput): Promise<_omnicross_contracts_image_generation_types.ImageReferenceMetadata>;
+    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
+    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
+    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
+    cleanup(now?: number): Promise<number>;
+}
+declare class MountedResponsesImageStateStore implements ResponsesImageStateStore {
+    private readonly catalog;
+    private readonly writeBackend?;
+    private readonly writeLimits?;
+    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileResponsesImageStateStoreLimits | undefined);
+    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileResponsesImageStateStoreLimits): MountedResponsesImageStateStore;
+    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
+    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
+    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
+    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
+    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
+    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
 }
 
-/**
- * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
- *
- * Durable storage for the model pricing table, backed by a pretty-printed json
- * file (a sibling of `config.json`, `pricing.json` by convention) holding a
- * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
- * every mutation rewrites the full array (the table is at most a few thousand
- * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
- * seeding — the first pricing-source refresh (or a manual upsert) populates it.
- *
- * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
- * frozen; the admin DELETE route calls the concrete class and then invalidates
- * the engine cache).
- *
- * @module @omnicross/daemon/ports/JsonPricingStore
- */
-
-declare class JsonPricingStore implements PricingStore {
-    private readonly pricingPath;
-    constructor(pricingPath: string);
-    /**
-     * Return whether the durable snapshot can actually serve at least one price.
-     *
-     * This intentionally checks the file itself instead of relying on refresh
-     * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
-     * otherwise unusable pricing table after a crash or manual file edit.
-     */
-    hasUsableSnapshot(): boolean;
-    getAll(): Promise<PricingEntry[]>;
-    /**
-     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
-     * user provenance (source 'user', userEdited, editedAt now) so the row is
-     * protected from auto-overwrite during source refreshes; a non-user upsert
-     * stamps source 'litellm' and clears nothing it should not (a plain source
-     * upsert through this method overwrites the row wholesale).
-     */
-    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
-    /**
-     * Apply a batch fetched from a pricing source. Rows whose local copy is
-     * user-edited are NOT applied — they come back as `{ current, incoming }`
-     * conflicts; everything else is upserted with the supplied automatic source.
-     * ONE file write for the whole batch.
-     */
-    bulkApplyFromSource(entries: PricingEntryInput[], source?: AutomaticPricingSource): Promise<{
-        applied: PricingEntry[];
-        conflicts: Array<{
-            current: PricingEntry;
-            incoming: PricingEntryInput;
-        }>;
+interface ImageDoctorLocalSnapshot {
+    readonly config: Readonly<{
+        enabled: boolean;
+        provider: ImageProviderId;
+        model: string;
+        valid: boolean;
+        errorCount: number;
+        /** Distinct providers the routing table names (doctor per-provider rows). */
+        routedProviders: readonly ImageProviderId[];
+    }>;
+    readonly roots: Readonly<{
+        valid: boolean;
+        verifiedAreas: number;
+        expectedAreas: number;
+    }>;
+    readonly stores: Readonly<{
+        valid: boolean;
+        mounts: number;
+        retiredMounts: number;
+        referenceEntries: number;
+        referenceBytes: number;
+        stateCalls: number;
+        stateResponses: number;
+        corruptManifestsQuarantined: number;
+    }>;
+    readonly permissions: Readonly<{
+        valid: boolean;
+        rows: number;
+        legacyRows: number;
+        invalidRows: number;
+        imagesAuthorizedRows: number;
+    }>;
+    /** The Codex-subscription account backing codex-routed image models. */
+    readonly account: Readonly<{
+        present: boolean;
+        usable: boolean;
+        reason: 'ready' | 'missing' | 'unavailable';
+    }>;
+    /** The Antigravity-subscription account backing NanoBanana image models. */
+    readonly antigravityAccount: Readonly<{
+        present: boolean;
+        usable: boolean;
+        reason: 'ready' | 'missing' | 'unavailable';
+    }>;
+    readonly evidence: Readonly<FileCodexImageCapabilityEvidenceStatus & {
+        valid: boolean;
     }>;
-    /**
-     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
-     * the incoming values (clearing the user-edited mark), 'skip' counts only.
-     */
-    applyResolutions(resolutions: Array<{
-        incoming: PricingEntryInput;
-        action: 'overwrite' | 'skip';
-    }>): Promise<PricingResolution>;
-    /**
-     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
-     * was actually removed. The admin DELETE handler calls this then invalidates
-     * the engine cache.
-     */
-    delete(providerId: string, modelId: string): Promise<boolean>;
-    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
-    private applyUpsert;
-    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
-    private readRows;
-    private writeRows;
-    /** Isolated for deterministic failure testing; never removes the target. */
-    private replaceFile;
 }
-
-interface CodexAuthHelperConfig {
-    command: string;
-    args: string[];
+type ImageDoctorLiveFailureCode = 'images_disabled' | 'codex_account_unavailable' | 'evidence_store_unavailable' | 'evidence_persist_failed' | ImageGenerationErrorCode;
+type ImageDoctorLiveResult = Readonly<{
+    ok: true;
+    code: 'verified';
+    model: 'gpt-image-2';
+    quality: 'low';
+    outputFormat: 'png';
+    freshEvidenceEntries: number;
+}> | Readonly<{
+    ok: false;
+    code: ImageDoctorLiveFailureCode;
+}>;
+interface ImageDoctorService {
+    inspectLocal(config: ImagesServerConfig): Promise<ImageDoctorLocalSnapshot>;
+    verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
 }
 
-type IntegrationClientId = 'codex' | 'claude';
-type IntegrationKeyOwnership = 'managed' | 'selected';
-/** Secret-free pointer to an access key. The plaintext remains in the encrypted key store. */
-interface IntegrationKeyBinding {
-    keyId: string;
-    ownership: IntegrationKeyOwnership;
+type PreparedImageRuntimeGeneration = {
+    readonly id: string;
+    readonly enabled: true;
+    readonly imageApi: ImageApiContributions;
+    readonly hosted: ResponsesImageGenerationContribution;
+    readonly hostedRuntime: HostedImageRuntimePolicy;
+    readonly inspectCapability?: (apiKeyId: string) => Promise<Omit<ImageRuntimeCapabilityInspection, 'generationId'>>;
+    readonly readRuntimeStatus?: () => ImageRuntimeResourceStatus;
+    dispose(): void | Promise<void>;
+} | {
+    readonly id: string;
+    readonly enabled: false;
+    dispose(): void | Promise<void>;
+};
+interface HostedImageRuntimeGenerationLease {
+    readonly generationId: string;
+    /** Compatibility/debug view; callers should prefer the deep methods below. */
+    readonly contribution: ResponsesImageGenerationContribution;
+    inspectRequest(input: ResponsesImageInspectionInput): ResponsesImageAdmission;
+    validateSelection(admission: ResponsesImageAdmission, selection: ResponsesHostedToolSelection): void;
+    openRequest(input: HostedImageOpenRequestInput): Promise<ResponsesImageRequestScope>;
+    release(): Promise<void>;
 }
-/** Redacted access-key state exposed by the integrations admin API. */
-interface IntegrationKeyBindingStatus {
-    id: string;
-    name: string;
-    keyPrefix: string;
-    ownership: IntegrationKeyOwnership;
-    revealable: boolean;
-    enabled: boolean;
-    revoked: boolean;
-    allowedEndpoints: OutboundPermission[];
-    requiredEndpoints: OutboundPermission[];
-    loopbackOnly: boolean;
+interface HostedImageRuntimePolicy {
+    readonly providerId: string;
+    readonly imageModel: string;
+    readonly referenceTtlMs: number;
+    readonly maxOutputBytes: number;
+    readonly maxTotalOutputBytes: number;
+    readonly preferredAccountId?: string;
+    readonly preferredAccountGroup?: string;
+    readonly boundAccountFallbackPolicy?: 'strict' | 'pool';
 }
-type IntegrationStatusKind = 'not-installed' | 'enabled' | 'configuration-drift' | 'configuration-missing' | 'key-missing';
-interface IntegrationClientStatus {
-    client: IntegrationClientId;
-    status: IntegrationStatusKind;
-    configPath: string;
-    installedAt?: number;
-    gatewayBaseUrl?: string;
-    message?: string;
-    /** Selected key metadata only; never contains plaintext or the encrypted envelope. */
-    key?: IntegrationKeyBindingStatus;
+interface HostedImageOpenRequestInput {
+    readonly admission: ResponsesImageAdmission;
+    readonly tenantId: string;
+    readonly requestId: string;
+    readonly sessionKey: string;
+    readonly signal: AbortSignal;
+    readonly authorizedPreviousResponseId?: string;
+    /** Trusted affinity fact forwarded unchanged into the contribution scope. */
+    readonly authorizedPreviousResponseKnownEmpty?: boolean;
+    readonly mainProviderId: string;
+    readonly selectedMainAccountId?: string;
 }
-interface IntegrationChangePlan {
-    client: IntegrationClientId;
-    configPath: string;
-    action: 'install' | 'none' | 'repair';
-    canApply: boolean;
-    /** Redacted logical fields only; never file contents or credential values. */
-    changes: string[];
-    warnings: string[];
+/** Dormant integration seam for a later Native Responses owner. */
+interface HostedImageContributionFactory {
+    acquire(): Promise<HostedImageRuntimeGenerationLease>;
 }
-interface IntegrationInstallRecord {
-    client: IntegrationClientId;
-    configPath: string;
-    originalExisted: boolean;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    originalContent: string;
-    originalHash: string;
-    installedHash: string;
-    installedAt: number;
-    gatewayBaseUrl: string;
-    /** Codex auth.json snapshot and installed hash; absent on legacy records. */
-    credentialFile?: IntegrationManagedFileRecord;
+/** Bind a stable factory to one app-session runtime manager without acquiring. */
+declare function createHostedImageContributionFactory(manager: ImageRuntimeManager): HostedImageContributionFactory;
+interface ImageRuntimeGenerationStatus {
+    readonly generationId: string;
+    readonly enabled: boolean;
+    readonly httpLeases: number;
+    readonly hostedLeases: number;
 }
-interface IntegrationManagedFileRecord {
-    path: string;
-    originalExisted: boolean;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    originalContent: string;
-    originalHash: string;
-    installedHash: string;
+interface ImageRuntimeManagerStatus {
+    readonly disposed: boolean;
+    readonly current: ImageRuntimeGenerationStatus;
+    readonly draining: readonly ImageRuntimeGenerationStatus[];
 }
-interface IntegrationGatewayKeyRecord {
-    id: string;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    secret: string;
-    createdAt: number;
+type ImageRuntimeSafeUnavailableReason = ImageCapabilityUnavailableReason | 'disabled' | 'runtime_unavailable';
+
+interface ImageRuntimeCapabilityInspection {
+    readonly generationId: string;
+    readonly enabled: boolean;
+    readonly available: boolean;
+    readonly providerId?: ImageProviderId;
+    readonly model?: string;
+    readonly reason?: ImageRuntimeSafeUnavailableReason;
+    readonly capabilities?: ImageCapabilities;
+    /**
+     * Route-table keys whose ROUTED provider's fresh capability intersection
+     * affirms them (multi-provider-image-generation 6.1: /v1/models lists
+     * routed-model × fresh-evidence). Absent on synthetic/legacy generations —
+     * `listAvailableModels` then falls back to the single-model shape.
+     */
+    readonly routedModels?: readonly string[];
+    /**
+     * One row per provider named by the routing table (images-settings-tab D2):
+     * availability with a safe reason, the models its own fresh evidence
+     * affirms, and the capability values for evidence-age projection. Absent on
+     * synthetic/legacy generations.
+     */
+    readonly providers?: readonly ImageRuntimeProviderInspection[];
 }
-interface IntegrationState {
-    version: 1;
-    /** Legacy shared-key layout. New installs use `keyBindings`; retained for safe migration. */
-    gatewayKey?: IntegrationGatewayKeyRecord;
-    keyBindings?: Partial<Record<IntegrationClientId, IntegrationKeyBinding>>;
-    clients: Partial<Record<IntegrationClientId, IntegrationInstallRecord>>;
+/** Per-provider capability inspection row (images-settings-tab D2). */
+interface ImageRuntimeProviderInspection {
+    readonly providerId: ImageProviderId;
+    readonly available: boolean;
+    readonly reason?: ImageRuntimeSafeUnavailableReason;
+    /** This provider's route keys affirmed by its fresh evidence intersection. */
+    readonly models: readonly string[];
+    readonly capabilities?: ImageCapabilities;
 }
-
-/** Encrypted, Omnicross-owned state for reversible native CLI configuration. */
-declare class IntegrationStateStore {
-    readonly path: string;
-    private readonly box;
-    constructor(path: string, box: SecretBox);
-    load(): IntegrationState;
-    save(state: IntegrationState): void;
+interface ImageRuntimeResourceStatus {
+    readonly queue: Readonly<{
+        activeJobs: number;
+        waitingJobs: number;
+        activeAccounts: number;
+        waitingAccounts: number;
+        waitingTenants: number;
+        maxConcurrentJobsPerAccount: number;
+        maxQueuedJobs: number;
+        accepting: boolean;
+        shuttingDown: boolean;
+    }>;
+    readonly temporary: Readonly<{
+        activeScopes: number;
+        totalBytes: number;
+        tenantCount: number;
+        maxActiveScopes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+    }>;
+    readonly storage: Readonly<{
+        mounts: number;
+        retiredMounts: number;
+        referenceEntries: number;
+        referenceBytes: number;
+        referenceTombstones: number;
+        stateCalls: number;
+        stateResponses: number;
+        stateTombstones: number;
+        pendingReferenceDeletes: number;
+        maxReferenceEntries: number;
+        maxReferenceBytes: number;
+        maxTenantReferenceBytes: number;
+        maxStateCalls: number;
+        maxStateResponses: number;
+    }>;
 }
-
-interface IntegrationManagerOptions {
-    configPath: string;
-    gatewayBaseUrl: string;
-    keyDb: OutboundKeyDb;
-    stateStore: IntegrationStateStore;
-    codexAuthHelper?: CodexAuthHelperConfig;
-    homeDir?: string;
+interface PreparedImageRuntimeChange {
+    readonly generationId: string;
+    publish(): void;
+    rollback(): void;
+    dispose(): Promise<void>;
 }
-/** Coordinates per-client least-privilege keys with reversible native CLI config edits. */
-declare class IntegrationManager {
-    private readonly options;
-    private readonly homeDir;
-    private readonly codexAuthHelper;
-    constructor(options: IntegrationManagerOptions);
-    listStatus(): Promise<IntegrationClientStatus[]>;
-    plan(client: IntegrationClientId, configPath?: string): Promise<IntegrationChangePlan>;
-    install(client: IntegrationClientId, configPath?: string): Promise<IntegrationClientStatus>;
-    repair(client: IntegrationClientId): Promise<IntegrationClientStatus>;
-    remove(client: IntegrationClientId): Promise<IntegrationClientStatus>;
-    /** Bind a user-confirmed access key and grant only this client's required endpoints. */
-    bindIntegrationKey(client: IntegrationClientId, keyId: string): Promise<IntegrationClientStatus>;
-    /** Rotate every Omnicross-managed client binding; user-selected keys remain untouched. */
-    rotateGatewayKey(): Promise<{
-        keyIds: Partial<Record<IntegrationClientId, string>>;
-    }>;
-    /** Resolve the plaintext only for the command-auth helper; callers must not log it. */
-    getIntegrationToken(client: IntegrationClientId): Promise<string>;
-    /** Compatibility alias for callers predating per-client bindings. */
-    getGatewayToken(client?: IntegrationClientId): Promise<string>;
-    private ensureClientKey;
-    private createManagedClientKey;
-    private installedSecret;
-    private rebindInstalledClient;
-    private statusFor;
-    private boundKeyDetails;
-    private retireManagedKeys;
-    private defaultConfigPath;
-    private renderInstalled;
+/** App-session owner for stable forwarders and generation-pinned work. */
+declare class ImageRuntimeManager {
+    #private;
+    readonly contributions: ImageApiContributions;
+    constructor(initial?: PreparedImageRuntimeGeneration);
+    prepare(generation: PreparedImageRuntimeGeneration): PreparedImageRuntimeChange;
+    acquireHosted(): Promise<HostedImageRuntimeGenerationLease>;
+    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
+    listAvailableModels(apiKeyId: string): Promise<readonly string[]>;
+    resourceStatus(): ImageRuntimeResourceStatus | undefined;
+    status(): ImageRuntimeManagerStatus;
+    dispose(): Promise<void>;
 }
 
-/**
- * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
- * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
- *
- * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
- * same `@omnicross/cli-launcher` builders (which register one route on the
- * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
- * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
- * NEW terminal window running the CLI with that env injected. The route token —
- * NOT an upstream credential — is the only secret in the env; it is removed when
- * the session is stopped (`onSessionEnd`).
- *
- * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
- * never a provider key. On win32 the token rides the spawned process environment
- * (inherited by the terminal), never the command line / a file on disk.
- *
- * @module @omnicross/daemon/admin/cliLaunch
- */
-
-/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
-type PathProbe = (candidate: string) => string | null;
-/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
-type TerminalCleanup = () => void;
-type TerminalOpener = (input: {
-    cli: string;
-    command: string;
-    extraArgs: string[];
-    env: Record<string, string>;
-    cwd?: string;
-    platform: NodeJS.Platform;
-    onFailure?: () => void;
-}) => void | TerminalCleanup;
-/**
- * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
- * default execs the install command with a bounded timeout). Returns the host's
- * honest install outcome — `error` carries stderr/the failure reason.
- */
-type CommandRunner = (command: string) => Promise<{
-    ok: boolean;
-    error?: string;
-}>;
-
-/**
- * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
- * search-settings-tab D4).
- *
- * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
- * `case 'search'`:
- *
- * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
- *   snapshot: one row per provider the daemon can run (the ONE runtime's
- *   descriptors, plus `unconfigured` rows for known API providers the persisted
- *   config does not name — the doctor's classification), the effective frontend
- *   modes, and the explicit apply semantics (codex immediate, rest restart).
- * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
- *   a configured provider, classified by the doctor's pure functions. The
- *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
- *   caller-supplied query, and never returns result content (plan §11.3 — its
- *   contract is the automated doctor's fixed-query discipline).
- * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
- *   channel for the settings page's per-provider test panel (owner feedback
- *   2026-09-02): ONE operator-typed query through ONE provider's contribution
- *   built from the PERSISTED config, returning the doctor-classified diagnostic
- *   PLUS the sanitized results. The two disciplines stay separate routes on
- *   purpose: bending `/test` to accept a query would erase the boundary its
- *   pinned tests and consumers depend on.
- *
- * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
- * and a failure response carries only the doctor's SANITIZED error shape — raw
- * upstream error bodies (which may quote the stored key) never serialize. The
- * query endpoint additionally sanitizes every returned result field BEFORE
- * serialization (plan §11.1: search results are untrusted input), and the
- * operator's query is never logged anywhere.
- *
- * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
- * that wire no search runtime get 501 for all routes (the voucher/allowance
- * optionality precedent) rather than a fabricated snapshot.
- *
- * @module @omnicross/daemon/admin/searchAdminApi
- */
-
-/**
- * The daemon search state the admin surface needs. Structurally satisfied by
- * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
- * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
- * without any network.
- */
-interface SearchAdminRuntimeStatus {
-    /** The daemon's ONE assembled search runtime (provider descriptors). */
-    readonly runtime: SearchRuntime;
-    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
-    readonly modes: SearchFrontendModes;
-    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
-    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
+type SafeProvider = 'codex-subscription' | 'unknown' | 'other';
+type SafeModel = 'gpt-image-2' | 'unknown' | 'other';
+type SafeErrorCode = ImageGenerationErrorCode | 'none' | 'other';
+type SafeCountOption = 'unknown' | '0' | '1' | '2-4' | '5+';
+type SafeBooleanOption = boolean | 'unknown';
+type SafeQuality = 'auto' | 'low' | 'medium' | 'high' | 'unknown' | 'other';
+type SafeBackground = 'auto' | 'opaque' | 'transparent' | 'unknown' | 'other';
+type SafeOutputFormat = 'png' | 'jpeg' | 'webp' | 'unknown' | 'other';
+declare const IMAGE_CONFIGURATION_AUDIT_FIELDS: readonly ["enablement", "provider", "model", "account", "queue", "temporary", "limits", "retention", "storage", "remote", "evidence"];
+type ImageConfigurationAuditField = typeof IMAGE_CONFIGURATION_AUDIT_FIELDS[number];
+/** Values are deliberately limited to safe categories and internal generation ids. */
+interface ImageConfigurationAuditRecord {
+    readonly outcome: 'applied';
+    readonly fields: readonly ImageConfigurationAuditField[];
+    readonly previousGenerationId?: string;
+    readonly generationId?: string;
 }
-
-/**
- * migration.ts — the export gather + import apply logic for the passphrase pack
- * (app-parity child 6, design D2/D3/D5).
- *
- * EXPORT (`gatherExport`): read the FULL local state DECRYPTED in-memory — every
- * provider row (scalars / modelConfigs / single apiKey / pool apiKeys /
- * transformer) via `loadConfig` (the at-rest box decrypts on read) AND the
- * subscription tokens via `credentialStore.getFullConfig()` (also decrypted) —
- * serialize to ONE bundle JSON, and `sealPack` it under the passphrase-derived
- * key. The caller returns ONLY the opaque pack; the decrypted bundle + the
- * passphrase live only in local variables and are never logged.
- *
- * IMPORT (`applyImport`): `openPack` decrypts + authenticates (a wrong passphrase
- * or a tampered pack fails the GCM auth-tag BEFORE any write — atomic). Every
- * provider is re-validated through `parseProviderInput` and every token block
- * through `validateTokenBody` (deny-by-default — a malicious blob cannot inject
- * unknown fields or escape the allowlist). Validation collects ALL rows BEFORE
- * applying, so a structurally invalid pack does not leave a half-applied state.
- * Apply merges by provider id (additive default): a new id is added; a colliding
- * id is skipped (or overwritten with `mode:'overwrite'`). Writes go through the
- * EXISTING paths (`saveConfig` re-encrypts at-rest under the LOCAL box +
- * `writeProviderTokens`/`appendProviderAccount`), so imported secrets land
- * `enc:`-encrypted under the TARGET machine's key — the passphrase key is used
- * ONLY for transport.
- *
- * SECRET SPINE: the export RESPONSE is the opaque pack ONLY; the import RESPONSE
- * is status-only counts. No decrypted secret + no passphrase ever reaches a
- * response body or a log here.
- *
- * @module @omnicross/daemon/migration/migration
- */
-
-/**
- * The credential-store surface the migration paths need: the full DECRYPTED read
- * (export) + the multi-account append (import re-encrypts at-rest). One shape so
- * `ExportDeps` + `ImportDeps` can be unified into `MigrationDeps` without a
- * `credentialStore` type conflict.
- */
-interface MigrationCredentialStore extends SubscriptionAccountAppender {
-    getFullConfig(): Promise<AccountTokensConfig>;
+interface ImageHistogramSnapshot {
+    readonly count: number;
+    readonly sum: number;
+    /** Non-cumulative fixed buckets; `upperBound:null` is the overflow bucket. */
+    readonly buckets: readonly {
+        readonly upperBound: number | null;
+        readonly count: number;
+    }[];
 }
-
-/** Minimal, auth-gated admin API for secret-free account allowance snapshots. */
-
-interface AccountAllowanceAdminReader {
-    list(filter?: {
-        providerId?: SubscriptionProviderId;
-        accountId?: string;
-    }): Promise<AccountAllowanceSnapshot[]>;
-    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Codex active `/wham/usage` refresh (absent on older daemons). */
-    refreshCodex?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Kimi `/coding/v1/usages` refresh (absent on older daemons). */
-    refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
-    refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
-    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Copilot user-quota refresh (absent on older daemons). */
-    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Gemini Code-Assist quota refresh (absent on older daemons). */
-    refreshGemini?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
-    removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
-    getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
+interface ImageApiMetricDimensions {
+    readonly endpoint: 'images.generate' | 'images.edit';
+    readonly provider: SafeProvider;
+    readonly model: SafeModel;
+    readonly action: 'generate' | 'edit';
+    readonly quality: SafeQuality;
+    readonly background: SafeBackground;
+    readonly outputFormat: SafeOutputFormat;
+    readonly streaming: SafeBooleanOption;
+    readonly requestedOutputs: SafeCountOption;
+    readonly partialImages: SafeCountOption;
+    readonly terminal: 'completed' | 'failed' | 'cancelled';
+    readonly errorCode: SafeErrorCode;
 }
-
-/** Token-free subscription account list entry (passthrough from core's service). */
-interface AdminAccountsLister {
-    listAll(): Promise<unknown[]>;
+interface ImageExecutionMetricDimensions {
+    readonly provider: SafeProvider;
+    readonly model: SafeModel;
+    readonly action: 'generate' | 'edit' | 'other';
+    readonly quality: SafeQuality;
+    readonly background: SafeBackground;
+    readonly outputFormat: SafeOutputFormat;
+    readonly streaming: SafeBooleanOption;
+    readonly requestedOutputs: SafeCountOption;
+    readonly terminal: 'completed' | 'failed' | 'cancelled' | 'other';
+    readonly errorCode: SafeErrorCode;
 }
-/** One key's live cooldown health (mirrors core `KeyHealthEntry`; read-only). */
-interface PoolKeyHealth {
-    until: number;
-    errors: number;
-    lastStatus: number | null;
+interface ImageApiMetricSnapshot {
+    readonly dimensions: ImageApiMetricDimensions;
+    readonly requests: number;
+    readonly inputCount?: ImageHistogramSnapshot;
+    readonly inputBytes?: ImageHistogramSnapshot;
+    readonly referenceOutcomes: Readonly<{
+        hits: number;
+        notFound: number;
+        expired: number;
+        failed: number;
+    }>;
+    readonly cleanupOutcomes: Readonly<{
+        completed: number;
+        failed: number;
+    }>;
 }
-/**
- * The READ-ONLY pool-health surface the admin view needs (key-pool design D7).
- * Structurally satisfied by core's `ApiKeyPoolService.getKeyHealth`; typed as a
- * minimal reader so `adminApi` carries no class coupling and can never reach a
- * key value through it (cooldown health only).
- */
-interface PoolHealthReader {
-    getKeyHealth(providerId: string): Promise<Record<string, PoolKeyHealth>>;
+interface ImageExecutionMetricSnapshot {
+    readonly dimensions: ImageExecutionMetricDimensions;
+    readonly executions: number;
+    readonly finalLatencyMs: ImageHistogramSnapshot;
+    readonly queueWaitMs?: ImageHistogramSnapshot;
+    readonly generationDurationMs?: ImageHistogramSnapshot;
+    readonly firstPartialLatencyMs?: ImageHistogramSnapshot;
+    readonly inputCount: ImageHistogramSnapshot;
+    readonly inputBytes: ImageHistogramSnapshot;
+    readonly outputCount: ImageHistogramSnapshot;
+    readonly outputBytes: ImageHistogramSnapshot;
+    readonly retryCount?: ImageHistogramSnapshot;
+    readonly authRefreshCount?: ImageHistogramSnapshot;
+    readonly referenceSaveCount?: ImageHistogramSnapshot;
+    readonly retentionRollbackFailures?: ImageHistogramSnapshot;
 }
-/**
- * The BYO provider-key quota surface the keys view needs — structurally
- * satisfied by `ProviderKeyQuotaService`. Read-only; the DTO is secret-free by
- * construction (normalized windows + diagnostic codes only).
- */
-interface ProviderKeyQuotaReader {
-    quotaFor(row: DaemonProviderConfig, keyId: string, options?: {
-        force?: boolean;
-    }): Promise<ProviderKeyQuota | null>;
+interface ImageObservabilitySnapshot {
+    readonly apiRequests: readonly ImageApiMetricSnapshot[];
+    readonly executions: readonly ImageExecutionMetricSnapshot[];
+    readonly configurationChanges: readonly ImageConfigurationAuditRecord[];
+    readonly overflow: Readonly<{
+        apiRecords: number;
+        telemetryRecords: number;
+    }>;
 }
-interface AdminImagesStatusReader {
-    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
-    status(): ImageRuntimeManagerStatus;
-    resourceStatus(): ImageRuntimeResourceStatus | undefined;
+interface ImageObservabilityOptions {
+    /** Hard cap applied independently to API and execution dimension maps. */
+    readonly maxDimensionSets?: number;
 }
-/** The live daemon handles the management API operates over. */
-interface AdminApiDeps {
-    /** Path to the daemon's `config.json` (provider catalog + `server` field). */
-    readonly configPath: string;
-    /** Live provider catalog (hot-reload target). */
-    readonly llmConfig: ConfigFileProviderConfigSource;
-    /** Named outbound-key store. */
-    readonly keyDb: OutboundKeyDb$1;
-    /**
-     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
-     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
-     * surface returns 501 (feature not available in this build).
-     */
-    readonly voucherDb?: VoucherDb;
-    /**
-     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
-     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
-     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
-     */
-    readonly keySpendReader?: KeySpendReader;
-    /** Outbound server settings store (server config persistence). */
-    readonly settingsStore: JsonApiServerSettingsStore;
-    /** The running outbound server (status + live applyConfig). */
-    readonly outboundApiServer: OutboundApiServer;
-    /** True only when production composed the hardened per-hop remote resolver. */
-    readonly imageRemoteResolverAvailable?: boolean;
-    /** Optional production Images runtime generation participant. */
-    readonly imageRuntimeConfig?: {
-        prepareConfig(config: ImagesServerConfig): Promise<PreparedServerConfigChange>;
-    };
-    /** Narrow metadata-only reader for authenticated Images capability/status. */
-    readonly imageRuntimeStatus?: AdminImagesStatusReader;
-    /** Metadata-only successful Images configuration audit sink. */
-    readonly imageConfigAudit?: (record: ImageConfigurationAuditRecord) => void;
-    /** Process-local machine-managed routing leases (optional for light embedders). */
-    readonly routeLeaseManager?: RouteLeaseManager;
-    /** Subscription accounts (token-free `listAll`). */
-    readonly subscriptionAccounts: AdminAccountsLister;
-    /**
-     * Secret-free upstream allowance facade. Optional for lightweight embedders;
-     * the standalone daemon wires it and the route returns 501 when absent.
-     */
-    readonly accountAllowanceService?: AccountAllowanceAdminReader;
-    /** Live Claude cache worker; hot-reconfigured with allowance scheduling. */
-    readonly allowanceRefreshScheduler?: Pick<ClaudeAllowanceRefreshScheduler, 'configure'>;
-    /** Optional secret-free account connection probe + rolling history surface. */
-    readonly accountProbeService?: AccountProbeHistoryReader & {
-        probeAccount(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
-            ok: boolean;
-            marked: boolean;
-        }>;
-        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
-            ok: boolean;
-            marked: boolean;
-            tier: 'local' | 'upstream' | 'generation';
-            model?: string;
-        }>;
-    };
-    /**
-     * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
-     * methods (`writeProviderTokens` / `clearProvider`), never a token-returning
-     * read. The token-free `subscriptionAccounts` lister stays separate so a GET
-     * handler can never reach a token through this dep.
-     */
-    readonly subscriptionTokenWriter: SubscriptionTokenWriter;
-    /**
-     * Read-only pool-health reader (key-pool design D7) — cooldown health only,
-     * never a key value. Drives `GET /admin/api/providers/:id/keys`.
-     */
-    readonly apiKeyPool: PoolHealthReader;
-    /** In-memory auto-disable store (design D5) — read-only for the health view. */
-    readonly autoDisableStore: AutoDisableStore;
-    /**
-     * OPTIONAL BYO provider-key quota service — same-key usage/quota probes for
-     * provider rows with a known adapter (Z.AI coding plan, MiniMax Token Plan).
-     * Absent ⇒ the keys view carries no `quota` field (light embedders).
-     */
-    readonly providerKeyQuota?: ProviderKeyQuotaReader;
-    /**
-     * Pending interactive-OAuth sessions (app-parity child 4, design D1) — the
-     * in-memory `{ codeVerifier, state }` map keyed by a minted `sessionId`,
-     * NEVER serialized to the client.
-     */
-    readonly oauthSessions: OAuthSessionStore;
-    /**
-     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
-     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
-     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
-     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
-     * injects its exchange fetch.
-     */
-    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
-    /**
-     * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
-     * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
-     * A minimal interface, NOT the full read-capable store, so no token-returning
-     * read is reachable. Wired from the concrete `credentialStore` in `bootstrap.ts`.
-     */
-    readonly subscriptionAccountAppender: SubscriptionAccountAppender;
-    /**
-     * Codex interactive-OAuth flow store (app-parity-2 child 5). Tracks the async
-     * loopback sign-in's polled status (token-free); only ONE codex login may be in
-     * flight (port 1455 is one resource). Wired in `bootstrap.ts`.
-     */
-    readonly codexSessions: CodexOAuthSessionStore;
-    /**
-     * Kimi interactive-OAuth flow store (device code). Same token-free polled
-     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly kimiSessions: CodexOAuthSessionStore;
-    /**
-     * Grok interactive-OAuth flow store (device code). Same token-free polled
-     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly grokSessions: CodexOAuthSessionStore;
-    /**
-     * Copilot interactive-OAuth flow store (device code). Same token-free
-     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly copilotSessions: CodexOAuthSessionStore;
-    /**
-     * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
-     * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port
-     * is bound. The captured code crosses to the daemon ONLY (never the client).
-     */
-    readonly codexAwaitLoopback: CodexLoopbackFn;
-    /**
-     * Migration credential-store handle (app-parity child 6, design D2/D3). The
-     * export gather needs `getFullConfig()` (full DECRYPTED tokens, in-memory only —
-     * the pack is the only thing that leaves) and import needs `appendProviderAccount`
-     * (multi-account append + re-encrypt at-rest). Confined to the migration
-     * handlers (which seal/validate everything); never reached by a GET handler.
-     * Wired from the concrete `credentialStore` in `bootstrap.ts`.
-     */
-    readonly migrationCredentialStore: MigrationCredentialStore;
-    /**
-     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
-     * usage-event store. Aggregates only; carries no key material.
-     */
-    readonly usageRecorder: UsageRecorder;
-    /** Pricing engine (upsert / source refresh / conflict resolution). */
-    readonly pricingEngine: PricingEngine;
+/** Process-local, metadata-only aggregation for HTTP and hosted Images work. */
+declare class ImageObservability {
+    #private;
+    readonly telemetrySink: ImageTelemetrySink;
+    readonly audit: (record: ImageApiAuditRecord) => void;
+    constructor(options?: ImageObservabilityOptions);
+    recordApiAudit(record: ImageApiAuditRecord): void;
+    recordTelemetry(record: ImageTelemetryRecord): void;
+    recordConfigurationAudit(record: ImageConfigurationAuditRecord): void;
+    snapshot(): ImageObservabilitySnapshot;
+    reset(): void;
+}
+
+interface PreparedServerConfigChange {
+    /** Publish the prepared snapshot. Implementations should make this an infallible swap. */
+    publish(): void | Promise<void>;
+    /** Restore the exact runtime snapshot that preceded publish. */
+    rollback(): void | Promise<void>;
+    /** Release an unpublished or rolled-back replacement. */
+    dispose(): void | Promise<void>;
+}
+
+/**
+ * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
+ *
+ * A DB-backed embedder can persist 401/403 auto-disable durably so a UI can
+ * render per-key health. The daemon has no DB, and its only
+ * durable layer is `config.json` — but writing auto-disable back there in v1
+ * would (1) cause write amplification under a 401 storm and (2) collide with
+ * the at-rest encryption schema that owns the `apiKeys[]` on-disk
+ * format. So v1 records auto-disable IN MEMORY only:
+ *  - `markAutoDisabled(keyId, status, at)` records `{ status, at, reason }`,
+ *  - `isDisabled(keyId)` / `get(keyId)` read it back,
+ *  - `loadPoolKeys` reads this store and flips a flagged key's `enabled` to
+ *    `false`, so `getAvailableKeys` skips it within this process lifetime.
+ *
+ * Restart resets the store (the honest v1 boundary — see spec). Persistence
+ * (encrypted write-back) is a child-3 follow-up.
+ *
+ * @module @omnicross/daemon/pool/autoDisableStore
+ */
+/** One in-memory auto-disable record for a pool key. */
+interface AutoDisableRecord {
+    /** The HTTP status that triggered the disable (401/403). */
+    status: number;
+    /** Epoch-ms when the disable was recorded. */
+    at: number;
+    /** Always `'auth_failure'` in v1 (the only auto-disable trigger). */
+    reason: 'auth_failure';
+}
+/**
+ * A process-lifetime in-memory store of auto-disabled pool keys, keyed by the
+ * pool key id. Constructed once in `buildDaemon` and injected as the pool's
+ * `disableKey` / `markAutoDisabled` sinks AND read by `loadPoolKeys`.
+ */
+declare class AutoDisableStore {
+    private readonly records;
+    /** Record (or overwrite) an auth-failure auto-disable for `keyId`. */
+    markAutoDisabled(keyId: string, status: number, at: number): void;
+    /** Whether `keyId` is currently auto-disabled in this process. */
+    isDisabled(keyId: string): boolean;
+    /** Read the auto-disable record for `keyId`, or `undefined` when healthy. */
+    get(keyId: string): AutoDisableRecord | undefined;
+    /** Clear all records (tests / teardown). */
+    clear(): void;
+}
+
+/**
+ * ConfigFileProviderConfigSource — the daemon's file-backed `ProviderConfigSource`
+ * port impl: an embedder of `@omnicross/core`'s provider catalog port.
+ *
+ * The daemon's `config.json` provider rows ARE the catalog. Of the port's ten
+ * methods, FOUR are real (the ones the BYO proxy/outbound path actually hits):
+ *  - `getProvider(id)` — map a `DaemonProviderConfig` row to an `LLMProvider`.
+ *  - `getTransformerService()` — a single `TransformerService` seeded by
+ *    `registerBuiltinTransformers` in the ctor.
+ *  - `getMainTransformer(id)` — the transformer for the provider's target wire
+ *    format (anthropic → AnthropicTransformer, gemini → GeminiTransformer,
+ *    openai → null/identity), mirroring the host `AgentModelsManager` switch.
+ *    `resolveProviderChain` unshifts this FORMAT-FIRST into the provider chain.
+ *  - `resolveTransformerChain(id, model)` — the provider's CUSTOM
+ *    `transformer.use[]` chain (app-parity-2 child 2: ENFORCED). The format
+ *    transformer is NOT included here (getMainTransformer supplies it,
+ *    format-first); no `transformer.use[]` → empty chain.
+ *
+ * The remaining SIX are minimal sensible stubs (never hit on the BYO single-key
+ * path — the boot smoke test is the proof).
+ *
+ * @module @omnicross/daemon/ports/ConfigFileProviderConfigSource
+ */
+
+declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
+    private readonly providers;
+    private readonly transformerService;
     /**
-     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
-     * `PricingStore` port is frozen; delete is a daemon-local extra).
+     * Optional reload-hook (key-pool change, design D4). A no-type-coupling
+     * callback invoked at the END of `reload(...)`. `buildDaemon` injects
+     * `() => pool.invalidateCache()` so the `ApiKeyPoolService.keyCache` is
+     * flushed after a hot-reload swaps the catalog — WITHOUT this port ever
+     * importing/depending on `ApiKeyPoolService`. Absent = no-op (single-key
+     * boots that never construct a pool stay byte-identical).
      */
-    readonly pricingStore: JsonPricingStore;
+    private reloadHook;
+    constructor(config: DaemonConfig);
     /**
-     * External-terminal opener for the Code CLI launch route (dashboard parity).
-     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
-     * no terminal window is actually spawned.
+     * Register a callback fired after every `reload(...)`. Used by `buildDaemon`
+     * to invalidate the pool's keyCache on a hot-reload. The port stays ignorant
+     * of what the callback does (no pool type dependency).
      */
-    readonly cliTerminalOpener?: TerminalOpener;
-    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
-    readonly cliPathProbe?: PathProbe;
+    setReloadHook(fn: () => void): void;
     /**
-     * Injectable shell runner for the Code CLI install route. Optional — defaults
-     * to the real `exec`-based runner; tests inject a stub so no package manager
-     * actually runs.
+     * Read the live (post-reload) provider row for `providerId`, or `undefined`.
+     * Exposed so the pool's `loadKeys` reads the SAME live catalog Map this port
+     * serves (so a hot-reload is observed on the next load after `invalidateCache`).
      */
-    readonly cliCommandRunner?: CommandRunner;
-    /** Factory so each request observes the outbound server's current loopback port. */
-    readonly integrationManagerFactory?: () => IntegrationManager;
+    getProviderRow(providerId: string): DaemonProviderConfig | undefined;
+    /** Await the built-in transformer registration (tests await this before dispatch). */
+    ready(): Promise<void>;
     /**
-     * search-settings-ui D3: the daemon's ONE search runtime plus its
-     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
-     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
-     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     * Replace the live provider catalog in place (additive — does NOT touch the
+     * ten port methods, the seeded `TransformerService`, or `ready()`). Called by
+     * the admin API after a provider POST/PUT/DELETE persists `config.json`, so the
+     * next outbound request sees the new catalog WITHOUT a daemon restart. The Map
+     * swap is synchronous; an in-flight request keeps its already-resolved
+     * provider (no locking needed for a single-operator local daemon).
      */
-    readonly searchStatus?: SearchAdminRuntimeStatus;
+    reload(config: DaemonConfig): void;
+    /** Clear + repopulate the private providers Map from a fresh provider list. */
+    setProviders(providers: readonly DaemonProviderConfig[]): void;
+    getProvider(id: string): Promise<LLMProvider | null>;
+    getTransformerService(): TransformerService | undefined;
+    getMainTransformer(providerId: string): Promise<Transformer | null>;
+    resolveTransformerChain(providerId: string, _model?: string): Promise<ResolvedTransformerChain>;
+    resolveRoutedModel(): Promise<null>;
+    resolveEffectiveModels(): Promise<{
+        background?: string;
+        vision?: string;
+    }>;
+    getAgentDefaultModels(): Promise<AgentDefaultModels>;
+    hasVisionCapability(): Promise<boolean>;
+    getGlobalModelParameters(): Promise<GlobalModelParameters>;
+    getDiscoveredModelMaxTokens(): Promise<number | undefined>;
 }
-/**
- * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
- * (no query). The auth gate has already run in `AdminServer`.
- */
-declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerResponse, path: string, deps: AdminApiDeps): Promise<void>;
 
 /**
- * AdminServer — the daemon's localhost admin/dashboard HTTP listener (RT3,
- * design D1/D2).
- *
- * A SEPARATE `node:http` listener distinct from core's outbound `/v1/*` server
- * (port 8765, untouched). Mirrors `OutboundApiServer`'s proven shape:
- *  - `http.createServer`, default bind `127.0.0.1` (or `0.0.0.0` when
- *    `networkBinding`), `listen` with `EADDRINUSE`→ephemeral(port 0) fallback,
- *  - `getStatus()` (running / bound port / dashboard URL), `start` / `stop`.
- * Default admin port 8766.
+ * JsonApiServerSettingsStore — the daemon's file-backed `ApiServerSettingsStore`
+ * port impl.
  *
- * Auth (design D2):
- *  - Baseline = localhost bind, no token → reachable only from the machine.
- *  - Optional `admin.token` → every `/admin/*` request (incl. `GET /`) must
- *    carry `Authorization: Bearer <token>` or `X-Admin-Token: <token>`; compared
- *    server-side with a constant-time equality → `401` on a miss.
- *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
- *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
+ * The serving core persists the outbound-API server config (`{ enabled,
+ * networkBinding, endpoints, port }`) under a SINGLE settings key
+ * (`OUTBOUND_API_SERVER_CONFIG_KEY === 'outboundApiServer.config'`). Here that
+ * store is the daemon's `config.json` `server`
+ * field. `loadServerConfig(store)` / `saveServerConfig(store, cfg)` (core)
+ * normalize + persist through this 2-method surface.
  *
- * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
- * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
- * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
+ * Only the one outbound-API key is ever read/written — any other key is a no-op
+ * miss (returns `undefined`) so the surface stays honest about what it backs.
  *
- * @module @omnicross/daemon/admin/AdminServer
+ * @module @omnicross/daemon/ports/JsonApiServerSettingsStore
  */
 
-/** The dependencies the admin server + its API need (live daemon handles). */
-interface AdminServerDeps extends AdminApiDeps {
-    /** Read the resolved admin config (enabled/port/networkBinding/token). */
-    getAdminConfig: () => ResolvedAdminConfig;
-    /**
-     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
-     * shared closure over live handles (bootstrap wires the SAME builder into the
-     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
-     */
-    getHealthReport: () => HealthReport;
+interface JsonSettingsDocumentSnapshot {
+    readonly existed: boolean;
+    /** Raw persisted bytes; may contain encrypted secrets and must never enter a DTO or log. */
+    readonly bytes?: Uint8Array;
+}
+type AtomicDocumentReplace = (targetPath: string, contents: Uint8Array) => void;
+declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
+    private readonly configPath;
+    private readonly box;
+    private readonly atomicReplace;
     /**
-     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
-     * lines (bind/refuse/error) route through it so they honor the configured
-     * level / format / file sink.
+     * @param configPath the daemon config.json whose `server` field is backed.
+     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
+     *                    `server.proxy.*` passwords are encrypted-on-`set` /
+     *                    decrypted-on-`get` (the settings-store path is otherwise not
+     *                    secret-aware — every OTHER server field is non-secret). Null
+     *                    ⇒ passthrough (legacy/pure tests unchanged).
      */
-    logger: Logger;
+    constructor(configPath: string, box?: SecretBox | null, atomicReplace?: AtomicDocumentReplace);
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    set<T = unknown>(key: string, value: T): Promise<void>;
+    /** Capture the exact prior document for an admin transaction rollback. */
+    captureDocumentSnapshot(): JsonSettingsDocumentSnapshot;
+    /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
+    restoreDocumentSnapshot(snapshot: JsonSettingsDocumentSnapshot): void;
+    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
+    private encryptSecrets;
+    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
+    private decryptSecrets;
+    /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
+    private readFile;
+}
+
+/**
+ * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
+ *
+ * Durable storage for the model pricing table, backed by a pretty-printed json
+ * file (a sibling of `config.json`, `pricing.json` by convention) holding a
+ * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
+ * every mutation rewrites the full array (the table is at most a few thousand
+ * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
+ * seeding — the first pricing-source refresh (or a manual upsert) populates it.
+ *
+ * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
+ * frozen; the admin DELETE route calls the concrete class and then invalidates
+ * the engine cache).
+ *
+ * @module @omnicross/daemon/ports/JsonPricingStore
+ */
+
+declare class JsonPricingStore implements PricingStore {
+    private readonly pricingPath;
+    constructor(pricingPath: string);
     /**
-     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
-     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
-     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
-     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
-     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
+     * Return whether the durable snapshot can actually serve at least one price.
+     *
+     * This intentionally checks the file itself instead of relying on refresh
+     * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
+     * otherwise unusable pricing table after a crash or manual file edit.
      */
-    probeHistoryReader?: AccountProbeHistoryReader;
+    hasUsableSnapshot(): boolean;
+    getAll(): Promise<PricingEntry[]>;
     /**
-     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
-     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
-     * returns filtered records. Absent ⇒ the route serves an empty list. The
-     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
-     * unauthenticated, NEVER on `/health`.
+     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
+     * user provenance (source 'user', userEdited, editedAt now) so the row is
+     * protected from auto-overwrite during source refreshes; a non-user upsert
+     * stamps source 'litellm' and clears nothing it should not (a plain source
+     * upsert through this method overwrites the row wholesale).
      */
-    auditReader?: AuditQueryReader;
-    /** Metadata-only audit aggregate used by the overview error-rate metric. */
-    auditStatsReader?: AuditStatsReader;
+    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
     /**
-     * Reconstructs one record's bodies from the per-session shard store
-     * (audit-store-sharding). Absent when audit was never enabled.
+     * Apply a batch fetched from a pricing source. Rows whose local copy is
+     * user-edited are NOT applied — they come back as `{ current, incoming }`
+     * conflicts; everything else is upserted with the supplied automatic source.
+     * ONE file write for the whole batch.
      */
-    auditBodyReader?: AuditBodyReader;
-    /** Runs cross-session body compaction on demand (audit-store-sharding D8). */
-    auditCompactor?: AuditCompactor;
+    bulkApplyFromSource(entries: PricingEntryInput[], source?: AutomaticPricingSource): Promise<{
+        applied: PricingEntry[];
+        conflicts: Array<{
+            current: PricingEntry;
+            incoming: PricingEntryInput;
+        }>;
+    }>;
     /**
-     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
-     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
-     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
+     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
+     * the incoming values (clearing the user-edited mark), 'skip' counts only.
      */
-    billingStatusReader?: BillingStatusReader;
-}
-/** A live status snapshot for the admin listener. */
-interface AdminServerStatus {
-    running: boolean;
-    /** Actual bound port (0 when not running). */
-    port: number;
-    /** The dashboard URL (loopback or LAN base), or null when not running. */
-    url: string | null;
-}
-declare class AdminServer {
-    private readonly deps;
-    private server;
-    private boundPort;
-    private boundAddr;
-    /** Control Panel dist dir (resolved once at first request; null = no UI). */
-    private uiDist;
-    constructor(deps: AdminServerDeps);
+    applyResolutions(resolutions: Array<{
+        incoming: PricingEntryInput;
+        action: 'overwrite' | 'skip';
+    }>): Promise<PricingResolution>;
     /**
-     * Start the admin listener honoring the resolved admin config. Returns the
-     * actual bound port, or `0` when it refuses/declines to bind (disabled or the
-     * LAN fail-closed gate). Idempotent: a second call returns the bound port.
+     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
+     * was actually removed. The admin DELETE handler calls this then invalidates
+     * the engine cache.
      */
-    start(): Promise<number>;
-    /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
-    private listen;
-    /** Per-request handler: auth gate (when a token is set) → routing. */
-    private onRequest;
-    private dispatch;
-    /** Constant-time bearer/header check against the configured token. */
-    private isAuthorized;
-    /** Stop the listener and release the port. */
-    stop(): Promise<void>;
-    /** A live status snapshot. */
-    getStatus(): AdminServerStatus;
+    delete(providerId: string, modelId: string): Promise<boolean>;
+    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
+    private applyUpsert;
+    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
+    private readRows;
+    private writeRows;
+    /** Isolated for deterministic failure testing; never removes the target. */
+    private replaceFile;
 }
 
-type DaemonImagePathArea = 'temporary' | 'artifacts' | 'state' | 'evidence' | 'mountManifest';
-interface DaemonImagePaths {
-    readonly applicationDataRoot: string;
-    readonly imagesRoot: string;
-    readonly temporaryRoot: string;
-    readonly durableRoot: string;
-    readonly artifactsRoot: string;
-    readonly stateRoot: string;
-    readonly evidenceRoot: string;
-    readonly mountManifestRoot: string;
-    readonly mountManifestPath: string;
-}
-interface ImageRootValidationOptions {
-    readonly label?: string;
-    readonly processDirectory?: string;
-    readonly userHome?: string;
-    readonly temporaryDirectory?: string;
-}
-interface CreateDaemonImagePathResolverOptions extends ImageRootValidationOptions {
-    readonly configPath: string;
-    readonly storageRoot?: string;
-}
-interface VerifiedDaemonImagePath {
-    readonly area: DaemonImagePathArea;
-    readonly absolutePath: string;
-    readonly kind: 'opaque-file' | 'opaque-directory' | 'mount-manifest';
-}
-/**
- * Owns all daemon Images filesystem names. Callers receive opaque capabilities,
- * never a filename-accepting delete primitive; destructive methods revalidate
- * the root identity, descendant relationship, basename, and symlink state.
- */
-declare class DaemonImagePathResolver {
-    #private;
-    readonly paths: DaemonImagePaths;
-    constructor(options: CreateDaemonImagePathResolverOptions);
-    createOpaqueFile(area: Exclude<DaemonImagePathArea, 'temporary' | 'mountManifest'>, format?: 'bin' | 'json' | 'tmp'): VerifiedDaemonImagePath;
-    createOpaqueDirectory(area?: Exclude<DaemonImagePathArea, 'mountManifest'>): VerifiedDaemonImagePath;
-    mountManifest(): VerifiedDaemonImagePath;
-    /** Revalidate and return one internal root for store-local bounded I/O. */
-    verifiedRoot(area: DaemonImagePathArea): string;
-    /** Revalidate immediately before unlinking a resolver-issued file capability. */
-    removeFile(target: VerifiedDaemonImagePath): void;
-    /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
-    removeEmptyDirectory(target: VerifiedDaemonImagePath): void;
-    private issue;
-    private verifyDestructiveTarget;
+interface CodexAuthHelperConfig {
+    command: string;
+    args: string[];
 }
 
-interface FileCodexImageCapabilityEvidenceManifestOwnerOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly maxEntries?: number;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly hmacSalt?: Uint8Array;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
+type IntegrationClientId = 'codex' | 'claude';
+type IntegrationKeyOwnership = 'managed' | 'selected';
+/** Secret-free pointer to an access key. The plaintext remains in the encrypted key store. */
+interface IntegrationKeyBinding {
+    keyId: string;
+    ownership: IntegrationKeyOwnership;
 }
-type FileCodexImageCapabilityEvidenceSourceOptions = Readonly<(FileCodexImageCapabilityEvidenceManifestOwnerOptions & {
-    readonly ttlMs: number;
-}) | {
-    readonly owner: FileCodexImageCapabilityEvidenceManifestOwner;
-    readonly ttlMs: number;
-}>;
-interface FileCodexImageCapabilityEvidenceStatus {
-    readonly entries: number;
-    readonly freshEntries: number;
-    readonly staleEntries: number;
-    readonly bytes: number;
+/** Redacted access-key state exposed by the integrations admin API. */
+interface IntegrationKeyBindingStatus {
+    id: string;
+    name: string;
+    keyPrefix: string;
+    ownership: IntegrationKeyOwnership;
+    revealable: boolean;
+    enabled: boolean;
+    revoked: boolean;
+    allowedEndpoints: OutboundPermission[];
+    requiredEndpoints: OutboundPermission[];
+    loopbackOnly: boolean;
 }
-/** Revision-aware manifest owner shared by runtime generations, doctor, and cleanup. */
-declare class FileCodexImageCapabilityEvidenceManifestOwner {
-    #private;
-    constructor(options: FileCodexImageCapabilityEvidenceManifestOwnerOptions);
-    createSource(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
-    resolveWithTtl(request: CodexImageCapabilityEvidenceRequest, ttlMs: number): Promise<CodexImageCapabilityEvidence>;
-    recordSuccessfulVerificationWithTtl(observation: CodexImageCapabilityObservation, ttlMs: number): Promise<void>;
-    cleanup(now: number, limit: number): Promise<{
-        readonly entriesRemoved: number;
-        readonly bytesRemoved: number;
-    }>;
-    statusWithTtl(ttlMs: number): FileCodexImageCapabilityEvidenceStatus;
+type IntegrationStatusKind = 'not-installed' | 'enabled' | 'configuration-drift' | 'configuration-missing' | 'key-missing';
+interface IntegrationClientStatus {
+    client: IntegrationClientId;
+    status: IntegrationStatusKind;
+    configPath: string;
+    installedAt?: number;
+    gatewayBaseUrl?: string;
+    message?: string;
+    /** Selected key metadata only; never contains plaintext or the encrypted envelope. */
+    key?: IntegrationKeyBindingStatus;
 }
-/** Immutable TTL view over a revision-aware file-backed evidence manifest owner. */
-declare class FileCodexImageCapabilityEvidenceSource implements CodexImageCapabilityEvidenceSource {
-    #private;
-    constructor(options: FileCodexImageCapabilityEvidenceSourceOptions);
-    createView(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
-    resolve(request: CodexImageCapabilityEvidenceRequest): Promise<CodexImageCapabilityEvidence>;
-    recordSuccessfulVerification(observation: CodexImageCapabilityObservation): Promise<void>;
-    cleanup(now: number, limit: number): Promise<{
-        readonly entriesRemoved: number;
-        readonly bytesRemoved: number;
-    }>;
-    status(): FileCodexImageCapabilityEvidenceStatus;
-    ttlMs(): number;
-    /** Lifecycle-symmetric no-op; physical safety no longer depends on local leases. */
-    dispose(): void;
+interface IntegrationChangePlan {
+    client: IntegrationClientId;
+    configPath: string;
+    action: 'install' | 'none' | 'repair';
+    canApply: boolean;
+    /** Redacted logical fields only; never file contents or credential values. */
+    changes: string[];
+    warnings: string[];
 }
-
-interface FileImageReferenceStoreLimits {
-    readonly ttlMs: number;
-    readonly maxArtifactBytes: number;
-    readonly maxTotalBytes: number;
-    readonly maxTenantBytes: number;
-    readonly maxEntries: number;
-    readonly maxTombstones: number;
-    readonly tombstoneTtlMs: number;
+interface IntegrationInstallRecord {
+    client: IntegrationClientId;
+    configPath: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
+    installedAt: number;
+    gatewayBaseUrl: string;
+    /** Codex auth.json snapshot and installed hash; absent on legacy records. */
+    credentialFile?: IntegrationManagedFileRecord;
 }
-interface FileImageReferenceStoreOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly limits: FileImageReferenceStoreLimits;
-    readonly secretBox?: SecretBox;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
+interface IntegrationManagedFileRecord {
+    path: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
 }
-interface FileImageReferenceReconciliationResult {
-    readonly metadataRemoved: number;
-    readonly metadataDegradedToProviderReference: number;
-    readonly orphanFilesRemoved: number;
-    readonly incompleteFilesRemoved: number;
-    readonly invalidDescendants: number;
+interface IntegrationGatewayKeyRecord {
+    id: string;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    secret: string;
+    createdAt: number;
+}
+interface IntegrationState {
+    version: 1;
+    /** Legacy shared-key layout. New installs use `keyBindings`; retained for safe migration. */
+    gatewayKey?: IntegrationGatewayKeyRecord;
+    keyBindings?: Partial<Record<IntegrationClientId, IntegrationKeyBinding>>;
+    clients: Partial<Record<IntegrationClientId, IntegrationInstallRecord>>;
 }
-declare class FileImageReferenceStore implements ImageReferenceStore {
-    #private;
-    constructor(options: FileImageReferenceStoreOptions);
-    save(input: ImageReferenceSaveInput): Promise<ImageReferenceMetadata>;
-    /** Generation-bound write entry point; reads and maintenance remain shared. */
-    saveWithLimits(input: ImageReferenceSaveInput, limits: FileImageReferenceStoreLimits): Promise<ImageReferenceMetadata>;
-    /** Updates only app-session maintenance policy; pinned writes pass their own limits. */
-    updateMaintenanceLimits(limits: FileImageReferenceStoreLimits): void;
-    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
-    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
-    /** Daemon-internal cleanup path; accepts only the local reference-domain tenant HMAC. */
-    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
-    cleanup(now?: number): Promise<number>;
-    status(): {
-        readonly entries: number;
-        readonly bytes: number;
-        readonly tombstones: number;
-    };
-    hasLiveReferenceByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId, now?: number): Promise<boolean>;
-    reconcileOwnedFiles(maxEntries: number): Promise<FileImageReferenceReconciliationResult>;
-    openArtifact(fileName: string, byteLength: number, signal?: AbortSignal): Promise<ReadableStream<Uint8Array>>;
-    private exclusive;
-    private tenantKey;
-    private newReferenceId;
-    private validateSaveInput;
-    private selectVictims;
-    private nextTombstones;
-    private writeArtifact;
-    private artifactPath;
-    private validArtifact;
-    private removeArtifact;
-    private safeUnlinkArtifactPath;
-    private releaseLease;
-    private manifestPath;
-    private persist;
-    private atomicReplace;
-    private loadManifest;
+
+/** Encrypted, Omnicross-owned state for reversible native CLI configuration. */
+declare class IntegrationStateStore {
+    readonly path: string;
+    private readonly box;
+    constructor(path: string, box: SecretBox);
+    load(): IntegrationState;
+    save(state: IntegrationState): void;
 }
 
-interface FileResponsesImageStateStoreLimits {
-    readonly maxCalls: number;
-    readonly maxResponses: number;
-    readonly maxTombstones: number;
-    readonly tombstoneTtlMs: number;
+interface IntegrationManagerOptions {
+    configPath: string;
+    gatewayBaseUrl: string;
+    keyDb: OutboundKeyDb;
+    stateStore: IntegrationStateStore;
+    codexAuthHelper?: CodexAuthHelperConfig;
+    homeDir?: string;
 }
-interface FileResponsesImageStateStoreOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly limits: FileResponsesImageStateStoreLimits;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
+/** Coordinates per-client least-privilege keys with reversible native CLI config edits. */
+declare class IntegrationManager {
+    private readonly options;
+    private readonly homeDir;
+    private readonly codexAuthHelper;
+    constructor(options: IntegrationManagerOptions);
+    listStatus(): Promise<IntegrationClientStatus[]>;
+    plan(client: IntegrationClientId, configPath?: string): Promise<IntegrationChangePlan>;
+    install(client: IntegrationClientId, configPath?: string): Promise<IntegrationClientStatus>;
+    repair(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    remove(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    /** Bind a user-confirmed access key and grant only this client's required endpoints. */
+    bindIntegrationKey(client: IntegrationClientId, keyId: string): Promise<IntegrationClientStatus>;
+    /** Rotate every Omnicross-managed client binding; user-selected keys remain untouched. */
+    rotateGatewayKey(): Promise<{
+        keyIds: Partial<Record<IntegrationClientId, string>>;
+    }>;
+    /** Resolve the plaintext only for the command-auth helper; callers must not log it. */
+    getIntegrationToken(client: IntegrationClientId): Promise<string>;
+    /** Compatibility alias for callers predating per-client bindings. */
+    getGatewayToken(client?: IntegrationClientId): Promise<string>;
+    private ensureClientKey;
+    private createManagedClientKey;
+    private installedSecret;
+    private rebindInstalledClient;
+    private statusFor;
+    private boundKeyDetails;
+    private retireManagedKeys;
+    private defaultConfigPath;
+    private renderInstalled;
 }
-interface PendingResponsesImageReferenceDelete {
-    readonly referenceTenantKey: string;
-    readonly binding: ResponsesImageCallBinding;
+
+/**
+ * accountsAntigravityOAuth — the daemon admin API's ANTIGRAVITY interactive
+ * OAuth path (`POST /accounts/antigravity/oauth/start` +
+ * `GET /accounts/antigravity/oauth/:sessionId/status`).
+ *
+ * Modeled on the codex loopback flow (`accountsCodexOAuth`): antigravity's
+ * redirect is a FIXED loopback `http://127.0.0.1:51121/oauth-callback`, so the
+ * flow is ASYNC + POLLED — `start` arms the one-shot loopback listener, kicks
+ * the capture→exchange→email→project-handshake→persist chain off ASYNC, and
+ * returns ONLY `{ authUrl, sessionId }` (public — client_id + state). The app
+ * opens `authUrl`; the browser redirects to the loopback; the daemon captures
+ * the `code`, validates `state`, exchanges it, resolves the userinfo email and
+ * the Code Assist project (the antigravity dialect of the shared resolver),
+ * and persists the minted token through the encrypted credential store. The
+ * app POLLS `status` until `done`/`error`.
+ *
+ * SECRET SPINE (same invariant as codex/grok): the minted access/refresh token
+ * NEVER crosses to the client — it lands ONLY in the encrypted store. The
+ * poll `status` body is TOKEN-FREE (`{ state, message? }`). Port 51121 is a
+ * single resource → only ONE antigravity sign-in may be in flight (409).
+ *
+ * REUSES the `@omnicross/subscriptions` antigravity flow + the CLI's
+ * `awaitLoopbackCode` listener (parameterized binding) — it does NOT rebuild
+ * the authorize/exchange/handshake logic.
+ *
+ * @module @omnicross/daemon/admin/accountsAntigravityOAuth
+ */
+
+/** The loopback-listener fn (injected so tests need not bind a real port). */
+type AntigravityLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
+
+/**
+ * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
+ * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
+ *
+ * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
+ * same `@omnicross/cli-launcher` builders (which register one route on the
+ * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
+ * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
+ * NEW terminal window running the CLI with that env injected. The route token —
+ * NOT an upstream credential — is the only secret in the env; it is removed when
+ * the session is stopped (`onSessionEnd`).
+ *
+ * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
+ * never a provider key. On win32 the token rides the spawned process environment
+ * (inherited by the terminal), never the command line / a file on disk.
+ *
+ * @module @omnicross/daemon/admin/cliLaunch
+ */
+
+/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
+type PathProbe = (candidate: string) => string | null;
+/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalCleanup = () => void;
+type TerminalOpener = (input: {
+    cli: string;
+    command: string;
+    extraArgs: string[];
+    env: Record<string, string>;
+    cwd?: string;
+    platform: NodeJS.Platform;
+    onFailure?: () => void;
+}) => void | TerminalCleanup;
+/**
+ * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
+ * default execs the install command with a bounded timeout). Returns the host's
+ * honest install outcome — `error` carries stderr/the failure reason.
+ */
+type CommandRunner = (command: string) => Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+
+/**
+ * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
+ * search-settings-tab D4).
+ *
+ * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
+ * `case 'search'`:
+ *
+ * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
+ *   snapshot: one row per provider the daemon can run (the ONE runtime's
+ *   descriptors, plus `unconfigured` rows for known API providers the persisted
+ *   config does not name — the doctor's classification), the effective frontend
+ *   modes, and the explicit apply semantics (codex immediate, rest restart).
+ * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
+ *   a configured provider, classified by the doctor's pure functions. The
+ *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
+ *   caller-supplied query, and never returns result content (plan §11.3 — its
+ *   contract is the automated doctor's fixed-query discipline).
+ * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
+ *   channel for the settings page's per-provider test panel (owner feedback
+ *   2026-09-02): ONE operator-typed query through ONE provider's contribution
+ *   built from the PERSISTED config, returning the doctor-classified diagnostic
+ *   PLUS the sanitized results. The two disciplines stay separate routes on
+ *   purpose: bending `/test` to accept a query would erase the boundary its
+ *   pinned tests and consumers depend on.
+ *
+ * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
+ * and a failure response carries only the doctor's SANITIZED error shape — raw
+ * upstream error bodies (which may quote the stored key) never serialize. The
+ * query endpoint additionally sanitizes every returned result field BEFORE
+ * serialization (plan §11.1: search results are untrusted input), and the
+ * operator's query is never logged anywhere.
+ *
+ * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
+ * that wire no search runtime get 501 for all routes (the voucher/allowance
+ * optionality precedent) rather than a fabricated snapshot.
+ *
+ * @module @omnicross/daemon/admin/searchAdminApi
+ */
+
+/**
+ * The daemon search state the admin surface needs. Structurally satisfied by
+ * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
+ * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
+ * without any network.
+ */
+interface SearchAdminRuntimeStatus {
+    /** The daemon's ONE assembled search runtime (provider descriptors). */
+    readonly runtime: SearchRuntime;
+    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
+    readonly modes: SearchFrontendModes;
+    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
+    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
 }
-/** Durable production implementation of the existing Responses image-state contract. */
-declare class FileResponsesImageStateStore implements ResponsesImageStateStore {
-    #private;
-    constructor(options: FileResponsesImageStateStoreOptions);
-    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
-    /** Generation-bound write entry point; reads and maintenance remain shared. */
-    commitWithLimits(input: ResponsesImageStateCommitInput, limits: FileResponsesImageStateStoreLimits): Promise<readonly ResponsesImageCallBinding[]>;
-    /** Updates only app-session maintenance policy; pinned commits pass their own limits. */
-    updateMaintenanceLimits(limits: FileResponsesImageStateStoreLimits): void;
-    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
-    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
-    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
-    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
-    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
-    pendingReferenceDeletes(limit?: number): readonly PendingResponsesImageReferenceDelete[];
-    acknowledgeReferenceDeletes(completed: readonly PendingResponsesImageReferenceDelete[]): Promise<number>;
-    reconcileBrokenReferenceLinks(hasLiveReference: (referenceTenantKey: string, referenceId: ResponsesImageCallBinding['referenceId']) => Promise<boolean>, maxEntries: number): Promise<readonly ResponsesImageCallBinding[]>;
-    status(): {
-        readonly calls: number;
-        readonly responses: number;
-        readonly tombstones: number;
-        readonly pendingReferenceDeletes: number;
-    };
-    private exclusive;
-    private failure;
-    private assertCommit;
-    private tenantKey;
-    private rememberTombstone;
-    private enqueuePendingReferenceDelete;
-    private hasTombstone;
-    private prunedTombstones;
-    private pruneTombstonesInPlace;
-    private sameTombstones;
-    private touch;
-    private releaseCall;
-    private releaseResponse;
-    private manifestPath;
-    private persist;
-    private atomicReplace;
-    private loadManifest;
+
+/**
+ * migration.ts — the export gather + import apply logic for the passphrase pack
+ * (app-parity child 6, design D2/D3/D5).
+ *
+ * EXPORT (`gatherExport`): read the FULL local state DECRYPTED in-memory — every
+ * provider row (scalars / modelConfigs / single apiKey / pool apiKeys /
+ * transformer) via `loadConfig` (the at-rest box decrypts on read) AND the
+ * subscription tokens via `credentialStore.getFullConfig()` (also decrypted) —
+ * serialize to ONE bundle JSON, and `sealPack` it under the passphrase-derived
+ * key. The caller returns ONLY the opaque pack; the decrypted bundle + the
+ * passphrase live only in local variables and are never logged.
+ *
+ * IMPORT (`applyImport`): `openPack` decrypts + authenticates (a wrong passphrase
+ * or a tampered pack fails the GCM auth-tag BEFORE any write — atomic). Every
+ * provider is re-validated through `parseProviderInput` and every token block
+ * through `validateTokenBody` (deny-by-default — a malicious blob cannot inject
+ * unknown fields or escape the allowlist). Validation collects ALL rows BEFORE
+ * applying, so a structurally invalid pack does not leave a half-applied state.
+ * Apply merges by provider id (additive default): a new id is added; a colliding
+ * id is skipped (or overwritten with `mode:'overwrite'`). Writes go through the
+ * EXISTING paths (`saveConfig` re-encrypts at-rest under the LOCAL box +
+ * `writeProviderTokens`/`appendProviderAccount`), so imported secrets land
+ * `enc:`-encrypted under the TARGET machine's key — the passphrase key is used
+ * ONLY for transport.
+ *
+ * SECRET SPINE: the export RESPONSE is the opaque pack ONLY; the import RESPONSE
+ * is status-only counts. No decrypted secret + no passphrase ever reaches a
+ * response body or a log here.
+ *
+ * @module @omnicross/daemon/migration/migration
+ */
+
+/**
+ * The credential-store surface the migration paths need: the full DECRYPTED read
+ * (export) + the multi-account append (import re-encrypts at-rest). One shape so
+ * `ExportDeps` + `ImportDeps` can be unified into `MigrationDeps` without a
+ * `credentialStore` type conflict.
+ */
+interface MigrationCredentialStore extends SubscriptionAccountAppender {
+    getFullConfig(): Promise<AccountTokensConfig>;
 }
 
-interface ImageStorageMountBackend {
-    readonly id: string;
-    readonly createdAt: number;
-    readonly resolver: DaemonImagePathResolver;
-    readonly references: FileImageReferenceStore;
-    readonly responsesState: FileResponsesImageStateStore;
+/** Minimal, auth-gated admin API for secret-free account allowance snapshots. */
+
+interface AccountAllowanceAdminReader {
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }): Promise<AccountAllowanceSnapshot[]>;
+    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Codex active `/wham/usage` refresh (absent on older daemons). */
+    refreshCodex?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Kimi `/coding/v1/usages` refresh (absent on older daemons). */
+    refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
+    refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
+    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Copilot user-quota refresh (absent on older daemons). */
+    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Gemini Code-Assist quota refresh (absent on older daemons). */
+    refreshGemini?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Antigravity quotaSummary refresh (absent on older daemons). */
+    refreshAntigravity?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
+    removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
+    getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
 }
-interface ImageStorageMountCatalogOptions {
-    readonly pathOptions: Omit<CreateDaemonImagePathResolverOptions, 'storageRoot'>;
-    readonly activeStorageRoot?: string;
-    readonly referenceLimits: FileImageReferenceStoreLimits;
-    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
-    readonly secretBox?: SecretBox;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceCatalog?: (targetPath: string, contents: Uint8Array) => void;
-    readonly reconcileCorruptManifests?: boolean;
+
+/** Token-free subscription account list entry (passthrough from core's service). */
+interface AdminAccountsLister {
+    listAll(): Promise<unknown[]>;
 }
-interface ImageStorageMountPolicy {
-    readonly referenceLimits: FileImageReferenceStoreLimits;
-    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
+/** One key's live cooldown health (mirrors core `KeyHealthEntry`; read-only). */
+interface PoolKeyHealth {
+    until: number;
+    errors: number;
+    lastStatus: number | null;
 }
-interface PreparedImageStorageMountActivation {
-    readonly backend: ImageStorageMountBackend;
-    publish(): ImageStorageMountBackend;
-    rollback(): void;
-    dispose(): void;
+/**
+ * The READ-ONLY pool-health surface the admin view needs (key-pool design D7).
+ * Structurally satisfied by core's `ApiKeyPoolService.getKeyHealth`; typed as a
+ * minimal reader so `adminApi` carries no class coupling and can never reach a
+ * key value through it (cooldown health only).
+ */
+interface PoolHealthReader {
+    getKeyHealth(providerId: string): Promise<Record<string, PoolKeyHealth>>;
 }
-/** Owns the durable-root set independently from any one runtime generation. */
-declare class ImageStorageMountCatalog {
-    #private;
-    constructor(options: ImageStorageMountCatalogOptions);
-    active(): ImageStorageMountBackend;
-    mountsForRead(): readonly ImageStorageMountBackend[];
-    status(): {
-        readonly mounts: number;
-        readonly retiredMounts: number;
+/**
+ * The BYO provider-key quota surface the keys view needs — structurally
+ * satisfied by `ProviderKeyQuotaService`. Read-only; the DTO is secret-free by
+ * construction (normalized windows + diagnostic codes only).
+ */
+interface ProviderKeyQuotaReader {
+    quotaFor(row: DaemonProviderConfig, keyId: string, options?: {
+        force?: boolean;
+    }): Promise<ProviderKeyQuota | null>;
+}
+interface AdminImagesStatusReader {
+    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
+    status(): ImageRuntimeManagerStatus;
+    resourceStatus(): ImageRuntimeResourceStatus | undefined;
+}
+/** The live daemon handles the management API operates over. */
+interface AdminApiDeps {
+    /** Path to the daemon's `config.json` (provider catalog + `server` field). */
+    readonly configPath: string;
+    /** Live provider catalog (hot-reload target). */
+    readonly llmConfig: ConfigFileProviderConfigSource;
+    /** Named outbound-key store. */
+    readonly keyDb: OutboundKeyDb$1;
+    /**
+     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
+     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
+     * surface returns 501 (feature not available in this build).
+     */
+    readonly voucherDb?: VoucherDb;
+    /**
+     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
+     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
+     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
+     */
+    readonly keySpendReader?: KeySpendReader;
+    /** Outbound server settings store (server config persistence). */
+    readonly settingsStore: JsonApiServerSettingsStore;
+    /** The running outbound server (status + live applyConfig). */
+    readonly outboundApiServer: OutboundApiServer;
+    /** True only when production composed the hardened per-hop remote resolver. */
+    readonly imageRemoteResolverAvailable?: boolean;
+    /** Optional production Images runtime generation participant. */
+    readonly imageRuntimeConfig?: {
+        prepareConfig(config: ImagesServerConfig): Promise<PreparedServerConfigChange>;
     };
-    startupReconciliationStatus(): {
-        readonly corruptManifestsQuarantined: number;
+    /** Narrow metadata-only reader for authenticated Images capability/status. */
+    readonly imageRuntimeStatus?: AdminImagesStatusReader;
+    /**
+     * Explicitly-consuming live image verification (images-settings-tab D3) —
+     * delegates to the doctor service's `verifyLive` (Codex wire only). Absent
+     * on light embedders; the endpoint then responds 501 and consumes nothing.
+     */
+    readonly imageLiveVerifier?: {
+        verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
     };
-    utilization(): {
-        readonly referenceEntries: number;
-        readonly referenceBytes: number;
-        readonly referenceTombstones: number;
-        readonly stateCalls: number;
-        readonly stateResponses: number;
-        readonly stateTombstones: number;
-        readonly pendingReferenceDeletes: number;
+    /** Metadata-only successful Images configuration audit sink. */
+    readonly imageConfigAudit?: (record: ImageConfigurationAuditRecord) => void;
+    /** Process-local machine-managed routing leases (optional for light embedders). */
+    readonly routeLeaseManager?: RouteLeaseManager;
+    /** Subscription accounts (token-free `listAll`). */
+    readonly subscriptionAccounts: AdminAccountsLister;
+    /**
+     * Secret-free upstream allowance facade. Optional for lightweight embedders;
+     * the standalone daemon wires it and the route returns 501 when absent.
+     */
+    readonly accountAllowanceService?: AccountAllowanceAdminReader;
+    /** Live Claude cache worker; hot-reconfigured with allowance scheduling. */
+    readonly allowanceRefreshScheduler?: Pick<ClaudeAllowanceRefreshScheduler, 'configure'>;
+    /** Optional secret-free account connection probe + rolling history surface. */
+    readonly accountProbeService?: AccountProbeHistoryReader & {
+        probeAccount(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+        }>;
+        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+            tier: 'local' | 'upstream' | 'generation';
+            model?: string;
+        }>;
     };
-    /** Pins a backend object until its owning runtime generation drains. */
-    retainBackend(backend: ImageStorageMountBackend): () => void;
-    activate(storageRoot?: string): ImageStorageMountBackend;
-    /** Prepare a validated backend without changing the catalog's active mount. */
-    prepareActivation(storageRoot?: string, policy?: ImageStorageMountPolicy): PreparedImageStorageMountActivation;
-    retireEmptyMount(mountId: string): boolean;
-    private createResolver;
-    private createBackend;
-    private applyMaintenancePolicy;
-    private newMountId;
-    private isManifestError;
-    private quarantineManifest;
-    private isVerifiedEmpty;
-    private catalogPath;
-    private persist;
-    private atomicReplace;
-    private loadCatalog;
-}
-declare class MountedImageReferenceStore implements ImageReferenceStore {
-    private readonly catalog;
-    private readonly writeBackend?;
-    private readonly writeLimits?;
-    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileImageReferenceStoreLimits | undefined);
-    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileImageReferenceStoreLimits): MountedImageReferenceStore;
-    status(): Readonly<{
-        referenceEntries: number;
-        referenceBytes: number;
-        referenceTombstones: number;
-        stateCalls: number;
-        stateResponses: number;
-        stateTombstones: number;
-        pendingReferenceDeletes: number;
-        mounts: number;
-        retiredMounts: number;
-    }>;
-    save(input: ImageReferenceSaveInput): Promise<_omnicross_contracts_image_generation_types.ImageReferenceMetadata>;
-    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
-    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
-    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
-    cleanup(now?: number): Promise<number>;
-}
-declare class MountedResponsesImageStateStore implements ResponsesImageStateStore {
-    private readonly catalog;
-    private readonly writeBackend?;
-    private readonly writeLimits?;
-    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileResponsesImageStateStoreLimits | undefined);
-    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileResponsesImageStateStoreLimits): MountedResponsesImageStateStore;
-    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
-    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
-    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
-    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
-    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
-    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
+    /**
+     * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
+     * methods (`writeProviderTokens` / `clearProvider`), never a token-returning
+     * read. The token-free `subscriptionAccounts` lister stays separate so a GET
+     * handler can never reach a token through this dep.
+     */
+    readonly subscriptionTokenWriter: SubscriptionTokenWriter;
+    /**
+     * Read-only pool-health reader (key-pool design D7) — cooldown health only,
+     * never a key value. Drives `GET /admin/api/providers/:id/keys`.
+     */
+    readonly apiKeyPool: PoolHealthReader;
+    /** In-memory auto-disable store (design D5) — read-only for the health view. */
+    readonly autoDisableStore: AutoDisableStore;
+    /**
+     * OPTIONAL BYO provider-key quota service — same-key usage/quota probes for
+     * provider rows with a known adapter (Z.AI coding plan, MiniMax Token Plan).
+     * Absent ⇒ the keys view carries no `quota` field (light embedders).
+     */
+    readonly providerKeyQuota?: ProviderKeyQuotaReader;
+    /**
+     * Pending interactive-OAuth sessions (app-parity child 4, design D1) — the
+     * in-memory `{ codeVerifier, state }` map keyed by a minted `sessionId`,
+     * NEVER serialized to the client.
+     */
+    readonly oauthSessions: OAuthSessionStore;
+    /**
+     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
+     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
+     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
+     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
+     * injects its exchange fetch.
+     */
+    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
+    /**
+     * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
+     * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
+     * A minimal interface, NOT the full read-capable store, so no token-returning
+     * read is reachable. Wired from the concrete `credentialStore` in `bootstrap.ts`.
+     */
+    readonly subscriptionAccountAppender: SubscriptionAccountAppender;
+    /**
+     * Codex interactive-OAuth flow store (app-parity-2 child 5). Tracks the async
+     * loopback sign-in's polled status (token-free); only ONE codex login may be in
+     * flight (port 1455 is one resource). Wired in `bootstrap.ts`.
+     */
+    readonly codexSessions: CodexOAuthSessionStore;
+    /**
+     * Kimi interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly kimiSessions: CodexOAuthSessionStore;
+    /**
+     * Grok interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly grokSessions: CodexOAuthSessionStore;
+    /**
+     * Copilot interactive-OAuth flow store (device code). Same token-free
+     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly copilotSessions: CodexOAuthSessionStore;
+    /** Antigravity interactive OAuth (loopback 51121) — the async flow store. */
+    readonly antigravitySessions: CodexOAuthSessionStore;
+    /** The one-shot 127.0.0.1:51121 listener (test seam like `codexAwaitLoopback`). */
+    readonly antigravityAwaitLoopback: AntigravityLoopbackFn;
+    /**
+     * Resolve the ACTIVE antigravity account's access token for the dynamic
+     * model-catalog probe (secret used daemon-side only; the route is
+     * secret-free). Optional for older tests; absent → static-only catalog.
+     */
+    readonly resolveAntigravityAccessToken?: () => Promise<string | null>;
+    /**
+     * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
+     * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port
+     * is bound. The captured code crosses to the daemon ONLY (never the client).
+     */
+    readonly codexAwaitLoopback: CodexLoopbackFn;
+    /**
+     * Migration credential-store handle (app-parity child 6, design D2/D3). The
+     * export gather needs `getFullConfig()` (full DECRYPTED tokens, in-memory only —
+     * the pack is the only thing that leaves) and import needs `appendProviderAccount`
+     * (multi-account append + re-encrypt at-rest). Confined to the migration
+     * handlers (which seal/validate everything); never reached by a GET handler.
+     * Wired from the concrete `credentialStore` in `bootstrap.ts`.
+     */
+    readonly migrationCredentialStore: MigrationCredentialStore;
+    /**
+     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
+     * usage-event store. Aggregates only; carries no key material.
+     */
+    readonly usageRecorder: UsageRecorder;
+    /** Pricing engine (upsert / source refresh / conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /**
+     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
+     * `PricingStore` port is frozen; delete is a daemon-local extra).
+     */
+    readonly pricingStore: JsonPricingStore;
+    /**
+     * External-terminal opener for the Code CLI launch route (dashboard parity).
+     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
+     * no terminal window is actually spawned.
+     */
+    readonly cliTerminalOpener?: TerminalOpener;
+    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
+    readonly cliPathProbe?: PathProbe;
+    /**
+     * Injectable shell runner for the Code CLI install route. Optional — defaults
+     * to the real `exec`-based runner; tests inject a stub so no package manager
+     * actually runs.
+     */
+    readonly cliCommandRunner?: CommandRunner;
+    /** Factory so each request observes the outbound server's current loopback port. */
+    readonly integrationManagerFactory?: () => IntegrationManager;
+    /**
+     * search-settings-ui D3: the daemon's ONE search runtime plus its
+     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
+     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
+     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     */
+    readonly searchStatus?: SearchAdminRuntimeStatus;
 }
+/**
+ * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
+ * (no query). The auth gate has already run in `AdminServer`.
+ */
+declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerResponse, path: string, deps: AdminApiDeps): Promise<void>;
 
-interface ImageDoctorLocalSnapshot {
-    readonly config: Readonly<{
-        enabled: boolean;
-        provider: 'codex-subscription';
-        model: string;
-        valid: boolean;
-        errorCount: number;
-    }>;
-    readonly roots: Readonly<{
-        valid: boolean;
-        verifiedAreas: number;
-        expectedAreas: number;
-    }>;
-    readonly stores: Readonly<{
-        valid: boolean;
-        mounts: number;
-        retiredMounts: number;
-        referenceEntries: number;
-        referenceBytes: number;
-        stateCalls: number;
-        stateResponses: number;
-        corruptManifestsQuarantined: number;
-    }>;
-    readonly permissions: Readonly<{
-        valid: boolean;
-        rows: number;
-        legacyRows: number;
-        invalidRows: number;
-        imagesAuthorizedRows: number;
-    }>;
-    readonly account: Readonly<{
-        present: boolean;
-        usable: boolean;
-        reason: 'ready' | 'missing' | 'unavailable';
-    }>;
-    readonly evidence: Readonly<FileCodexImageCapabilityEvidenceStatus & {
-        valid: boolean;
-    }>;
+/**
+ * AdminServer — the daemon's localhost admin/dashboard HTTP listener (RT3,
+ * design D1/D2).
+ *
+ * A SEPARATE `node:http` listener distinct from core's outbound `/v1/*` server
+ * (port 8765, untouched). Mirrors `OutboundApiServer`'s proven shape:
+ *  - `http.createServer`, default bind `127.0.0.1` (or `0.0.0.0` when
+ *    `networkBinding`), `listen` with `EADDRINUSE`→ephemeral(port 0) fallback,
+ *  - `getStatus()` (running / bound port / dashboard URL), `start` / `stop`.
+ * Default admin port 8766.
+ *
+ * Auth (design D2):
+ *  - Baseline = localhost bind, no token → reachable only from the machine.
+ *  - Optional `admin.token` → every `/admin/*` request (incl. `GET /`) must
+ *    carry `Authorization: Bearer <token>` or `X-Admin-Token: <token>`; compared
+ *    server-side with a constant-time equality → `401` on a miss.
+ *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
+ *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
+ *
+ * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
+ * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
+ * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
+ *
+ * @module @omnicross/daemon/admin/AdminServer
+ */
+
+/** The dependencies the admin server + its API need (live daemon handles). */
+interface AdminServerDeps extends AdminApiDeps {
+    /** Read the resolved admin config (enabled/port/networkBinding/token). */
+    getAdminConfig: () => ResolvedAdminConfig;
+    /**
+     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
+     * shared closure over live handles (bootstrap wires the SAME builder into the
+     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
+     */
+    getHealthReport: () => HealthReport;
+    /**
+     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
+     * lines (bind/refuse/error) route through it so they honor the configured
+     * level / format / file sink.
+     */
+    logger: Logger;
+    /**
+     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
+     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
+     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
+     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
+     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
+     */
+    probeHistoryReader?: AccountProbeHistoryReader;
+    /**
+     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
+     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
+     * returns filtered records. Absent ⇒ the route serves an empty list. The
+     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
+     * unauthenticated, NEVER on `/health`.
+     */
+    auditReader?: AuditQueryReader;
+    /** Metadata-only audit aggregate used by the overview error-rate metric. */
+    auditStatsReader?: AuditStatsReader;
+    /**
+     * Reconstructs one record's bodies from the per-session shard store
+     * (audit-store-sharding). Absent when audit was never enabled.
+     */
+    auditBodyReader?: AuditBodyReader;
+    /** Runs cross-session body compaction on demand (audit-store-sharding D8). */
+    auditCompactor?: AuditCompactor;
+    /**
+     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
+     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
+     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
+     */
+    billingStatusReader?: BillingStatusReader;
 }
-type ImageDoctorLiveFailureCode = 'images_disabled' | 'codex_account_unavailable' | 'evidence_store_unavailable' | 'evidence_persist_failed' | ImageGenerationErrorCode;
-type ImageDoctorLiveResult = Readonly<{
-    ok: true;
-    code: 'verified';
-    model: 'gpt-image-2';
-    quality: 'low';
-    outputFormat: 'png';
-    freshEvidenceEntries: number;
-}> | Readonly<{
-    ok: false;
-    code: ImageDoctorLiveFailureCode;
-}>;
-interface ImageDoctorService {
-    inspectLocal(config: ImagesServerConfig): Promise<ImageDoctorLocalSnapshot>;
-    verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
+/** A live status snapshot for the admin listener. */
+interface AdminServerStatus {
+    running: boolean;
+    /** Actual bound port (0 when not running). */
+    port: number;
+    /** The dashboard URL (loopback or LAN base), or null when not running. */
+    url: string | null;
+}
+declare class AdminServer {
+    private readonly deps;
+    private server;
+    private boundPort;
+    private boundAddr;
+    /** Control Panel dist dir (resolved once at first request; null = no UI). */
+    private uiDist;
+    constructor(deps: AdminServerDeps);
+    /**
+     * Start the admin listener honoring the resolved admin config. Returns the
+     * actual bound port, or `0` when it refuses/declines to bind (disabled or the
+     * LAN fail-closed gate). Idempotent: a second call returns the bound port.
+     */
+    start(): Promise<number>;
+    /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
+    private listen;
+    /** Per-request handler: auth gate (when a token is set) → routing. */
+    private onRequest;
+    private dispatch;
+    /** Constant-time bearer/header check against the configured token. */
+    private isAuthorized;
+    /** Stop the listener and release the port. */
+    stop(): Promise<void>;
+    /** A live status snapshot. */
+    getStatus(): AdminServerStatus;
 }
 
 interface ImageTemporaryBudgetStatus {
@@ -4600,6 +4795,11 @@ interface DaemonPaths {
      * so tests need not bind `127.0.0.1:1455`. Absent → the real `awaitLoopbackCode`.
      */
     codexAwaitLoopback?: CodexLoopbackFn;
+    /**
+     * TEST SEAM (optional): override the antigravity loopback listener so tests
+     * need not bind 127.0.0.1:51121. Absent → the real awaitLoopbackCode.
+     */
+    antigravityAwaitLoopback?: AntigravityLoopbackFn;
     /**
      * TEST SEAM (optional): override the OAuth token-exchange fetch so tests need not
      * hit a real token endpoint. Absent → the global `fetch`.
@@ -4624,6 +4824,8 @@ interface DaemonPaths {
     imageRuntimeConfig?: AdminApiDeps['imageRuntimeConfig'];
     /** TEST/COMPOSITION SEAM: metadata-only Images status reader. */
     imageRuntimeStatus?: AdminApiDeps['imageRuntimeStatus'];
+    /** TEST/COMPOSITION SEAM: explicitly-consuming Images live verifier. */
+    imageLiveVerifier?: AdminApiDeps['imageLiveVerifier'];
     /** TEST/COMPOSITION SEAM: metadata-only successful Images config audit sink. */
     imageConfigAudit?: AdminApiDeps['imageConfigAudit'];
     /** TEST ONLY: deterministic Tier-A provider inside the production Images composition. */