@omnicross/daemon 0.4.3 → 0.4.5

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
+import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, GatewayBindingTarget, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
 import { SearchRuntime, SearchFrontendModes } from '@omnicross/core/search';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { AllowanceSchedulingConfig, AccountProbeConfig, ImageProviderId, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
+import { AllowanceSchedulingConfig, AccountProbeConfig, ImagesServerConfig, ImageProviderId, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer } from '@omnicross/core/outbound-api';
 import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, CodexImageCapabilityEvidenceSource, CodexImageCapabilityEvidenceRequest, CodexImageCapabilityEvidence, CodexImageCapabilityObservation, ImageExecutionScheduler, ImageExecutionAccountKey, ImageExecutionSchedulerRequest, ImageExecutionSchedulerGrant, SubscriptionAccountService, SubscriptionProviderRegistry } from '@omnicross/subscriptions';
@@ -21,8 +21,8 @@ import { AuditRecord, AuditStats, AuditBodyResult, AuditConfig } from '@omnicros
 import { BillingDeliveryStatus, BillingConfig, BillingEvent } from '@omnicross/contracts/billing-types';
 import http from 'node:http';
 import * as _omnicross_contracts_image_generation_types from '@omnicross/contracts/image-generation-types';
-import { ImageCapabilityUnavailableReason, ImageCapabilities, ImageGenerationErrorCode, ImageReferenceMetadata, ImageReferenceId } from '@omnicross/contracts/image-generation-types';
-import { ImageApiContributions, ResponsesImageGenerationContribution, ResponsesImageInspectionInput, ResponsesImageAdmission, ResponsesHostedToolSelection, ResponsesImageRequestScope, ImageTelemetrySink, ImageApiAuditRecord, ImageTelemetryRecord, ImageReferenceStore, ImageReferenceSaveInput, ImageReferenceResolution, ImageTemporaryResourceBudget, ImageTemporaryResourceBudgetLease, ImageApiLimits, ImageRequestResourceScope, ImageApiRuntimeResolver, RemoteImageAssetResolver, ImageProvider, ImageProviderRegistry, ImageOrchestrator } from '@omnicross/core/image-generation';
+import { ImageReferenceMetadata, ImageReferenceId, ImageGenerationErrorCode, ImageCapabilityUnavailableReason, ImageCapabilities } from '@omnicross/contracts/image-generation-types';
+import { ImageReferenceStore, ImageReferenceSaveInput, ImageReferenceResolution, ImageApiContributions, ResponsesImageGenerationContribution, ResponsesImageInspectionInput, ResponsesImageAdmission, ResponsesHostedToolSelection, ResponsesImageRequestScope, ImageTelemetrySink, ImageApiAuditRecord, ImageTelemetryRecord, ImageTemporaryResourceBudget, ImageTemporaryResourceBudgetLease, ImageApiLimits, ImageRequestResourceScope, ImageApiRuntimeResolver, RemoteImageAssetResolver, ImageProvider, ImageProviderRegistry, ImageOrchestrator } from '@omnicross/core/image-generation';
 import { LLMProvider, AgentDefaultModels, GlobalModelParameters } from '@omnicross/contracts/llm-config';
 import { PricingEntry, PricingEntryInput, PricingResolution, PricingSourceRefreshResult } from '@omnicross/contracts/pricing-types';
 import { ResponsesImageStateStore, ResponsesImageStateCommitInput, ResponsesImageCallBinding, ResponsesImageCallId, ResponsesImageCallResolution, ResponsesImageResponseResolution } from '@omnicross/core/image-generation/responses';
@@ -2263,6 +2263,119 @@ type AuditCompactor = () => {
 /** The read surface the AdminServer consumes (bootstrap binds it to the ledger dir). */
 type BillingStatusReader = () => BillingDeliveryStatus;
 
+/**
+ * Codex session discovery and provider migration.
+ *
+ * Codex stores the human-readable rollout in JSONL files and keeps the index
+ * used by `codex resume` in state_5.sqlite.  These two stores must move
+ * together: changing only one of them makes a session either appear under the
+ * wrong provider or disappear from resume entirely.
+ *
+ * This module deliberately exposes metadata only.  It never returns a JSONL
+ * line, prompt, tool output, or response body to the admin API.
+ */
+interface CodexSessionManagerOptions {
+    /** Defaults to CODEX_HOME or the current user's `.codex` directory. */
+    codexHome?: string;
+    /** Defaults to `<codexHome>/state_5.sqlite`. */
+    stateDatabasePath?: string;
+}
+interface CodexStateDatabaseStatus {
+    path: string;
+    available: boolean;
+    reason?: string;
+}
+type CodexSessionStatus = 'ready' | 'missing_rollout' | 'unreadable_rollout';
+interface CodexSessionSummary {
+    id: string;
+    cwd: string;
+    rolloutPath: string;
+    provider: string | null;
+    /** Provider from the JSONL session_meta record, when available. */
+    jsonlProvider: string | null;
+    model: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    fileSize: number | null;
+    fileModifiedAt: string | null;
+    status: CodexSessionStatus;
+    /** True when the session has a row in state_5.sqlite. */
+    inStateDatabase: boolean;
+}
+interface CodexSessionListResult {
+    projectPath: string;
+    codexHome: string;
+    stateDatabase: CodexStateDatabaseStatus;
+    sessions: CodexSessionSummary[];
+    warnings: string[];
+}
+interface CodexSessionProviderPlan {
+    id: string;
+    provider: string | null;
+    model: string | null;
+    rolloutPath: string;
+    status: CodexSessionStatus | 'blocked';
+    /** All provider values found in structured JSON properties. */
+    providers: string[];
+    /** Number of structured provider properties matching fromProvider. */
+    matchingFields: number;
+    /** Number of structured provider properties that would change. */
+    changedFields: number;
+    sqliteWillUpdate: boolean;
+    action: 'update' | 'no_change' | 'blocked';
+    reason?: string;
+}
+interface CodexSessionProviderPreview {
+    projectPath: string;
+    fromProvider: string | null;
+    toProvider: string;
+    stateDatabase: CodexStateDatabaseStatus;
+    sessions: CodexSessionProviderPlan[];
+    warnings: string[];
+}
+interface ApplyCodexSessionProviderInput {
+    projectPath: string;
+    sessionIds: string[];
+    toProvider: string;
+    fromProvider?: string;
+}
+interface CodexSessionProviderApplyResult {
+    ok: true;
+    projectPath: string;
+    fromProvider: string | null;
+    toProvider: string;
+    updatedSessions: number;
+    jsonlFiles: number;
+    jsonlFields: number;
+    sqliteRows: number;
+    backups: string[];
+}
+declare class CodexSessionManagerError extends Error {
+    constructor(message: string);
+}
+/**
+ * The manager serializes mutations in one daemon process.  This does not try
+ * to lock Codex itself; the file snapshot check below still refuses to replace
+ * a rollout that changed while it was being prepared.
+ */
+declare class CodexSessionManager {
+    readonly codexHome: string;
+    readonly stateDatabasePath: string;
+    private mutationTail;
+    constructor(options?: CodexSessionManagerOptions);
+    list(projectPath: string): Promise<CodexSessionListResult>;
+    preview(input: Omit<ApplyCodexSessionProviderInput, 'toProvider'> & {
+        toProvider: string;
+    }): Promise<CodexSessionProviderPreview>;
+    apply(input: ApplyCodexSessionProviderInput): Promise<CodexSessionProviderApplyResult>;
+    private applyLocked;
+    private withMutationLock;
+}
+declare function replaceStructuredProviderFields(value: unknown, fromProvider: string | undefined, toProvider: string, providers?: Set<string>): {
+    matchingFields: number;
+    changedFields: number;
+};
+
 /**
  * ProviderKeyQuota — BYO provider-row key quota parsing (pure functions).
  *
@@ -2325,1551 +2438,1600 @@ interface ProviderKeyQuota {
     errorCode?: string;
 }
 
-type PreparedImageRuntimeGeneration = {
-    readonly id: string;
-    readonly enabled: true;
-    readonly imageApi: ImageApiContributions;
-    readonly hosted: ResponsesImageGenerationContribution;
-    readonly hostedRuntime: HostedImageRuntimePolicy;
-    readonly inspectCapability?: (apiKeyId: string) => Promise<Omit<ImageRuntimeCapabilityInspection, 'generationId'>>;
-    readonly readRuntimeStatus?: () => ImageRuntimeResourceStatus;
-    dispose(): void | Promise<void>;
-} | {
-    readonly id: string;
-    readonly enabled: false;
-    dispose(): void | Promise<void>;
-};
-interface HostedImageRuntimeGenerationLease {
-    readonly generationId: string;
-    /** Compatibility/debug view; callers should prefer the deep methods below. */
-    readonly contribution: ResponsesImageGenerationContribution;
-    inspectRequest(input: ResponsesImageInspectionInput): ResponsesImageAdmission;
-    validateSelection(admission: ResponsesImageAdmission, selection: ResponsesHostedToolSelection): void;
-    openRequest(input: HostedImageOpenRequestInput): Promise<ResponsesImageRequestScope>;
-    release(): Promise<void>;
-}
-interface HostedImageRuntimePolicy {
-    readonly providerId: string;
-    readonly imageModel: string;
-    readonly referenceTtlMs: number;
-    readonly maxOutputBytes: number;
-    readonly maxTotalOutputBytes: number;
-    readonly preferredAccountId?: string;
-    readonly preferredAccountGroup?: string;
-    readonly boundAccountFallbackPolicy?: 'strict' | 'pool';
+type DaemonImagePathArea = 'temporary' | 'artifacts' | 'state' | 'evidence' | 'mountManifest';
+interface DaemonImagePaths {
+    readonly applicationDataRoot: string;
+    readonly imagesRoot: string;
+    readonly temporaryRoot: string;
+    readonly durableRoot: string;
+    readonly artifactsRoot: string;
+    readonly stateRoot: string;
+    readonly evidenceRoot: string;
+    readonly mountManifestRoot: string;
+    readonly mountManifestPath: string;
 }
-interface HostedImageOpenRequestInput {
-    readonly admission: ResponsesImageAdmission;
-    readonly tenantId: string;
-    readonly requestId: string;
-    readonly sessionKey: string;
-    readonly signal: AbortSignal;
-    readonly authorizedPreviousResponseId?: string;
-    /** Trusted affinity fact forwarded unchanged into the contribution scope. */
-    readonly authorizedPreviousResponseKnownEmpty?: boolean;
-    readonly mainProviderId: string;
-    readonly selectedMainAccountId?: string;
+interface ImageRootValidationOptions {
+    readonly label?: string;
+    readonly processDirectory?: string;
+    readonly userHome?: string;
+    readonly temporaryDirectory?: string;
 }
-/** Dormant integration seam for a later Native Responses owner. */
-interface HostedImageContributionFactory {
-    acquire(): Promise<HostedImageRuntimeGenerationLease>;
+interface CreateDaemonImagePathResolverOptions extends ImageRootValidationOptions {
+    readonly configPath: string;
+    readonly storageRoot?: string;
 }
-/** Bind a stable factory to one app-session runtime manager without acquiring. */
-declare function createHostedImageContributionFactory(manager: ImageRuntimeManager): HostedImageContributionFactory;
-interface ImageRuntimeGenerationStatus {
-    readonly generationId: string;
-    readonly enabled: boolean;
-    readonly httpLeases: number;
-    readonly hostedLeases: number;
+interface VerifiedDaemonImagePath {
+    readonly area: DaemonImagePathArea;
+    readonly absolutePath: string;
+    readonly kind: 'opaque-file' | 'opaque-directory' | 'mount-manifest';
 }
-interface ImageRuntimeManagerStatus {
-    readonly disposed: boolean;
-    readonly current: ImageRuntimeGenerationStatus;
-    readonly draining: readonly ImageRuntimeGenerationStatus[];
+/**
+ * Owns all daemon Images filesystem names. Callers receive opaque capabilities,
+ * never a filename-accepting delete primitive; destructive methods revalidate
+ * the root identity, descendant relationship, basename, and symlink state.
+ */
+declare class DaemonImagePathResolver {
+    #private;
+    readonly paths: DaemonImagePaths;
+    constructor(options: CreateDaemonImagePathResolverOptions);
+    createOpaqueFile(area: Exclude<DaemonImagePathArea, 'temporary' | 'mountManifest'>, format?: 'bin' | 'json' | 'tmp'): VerifiedDaemonImagePath;
+    createOpaqueDirectory(area?: Exclude<DaemonImagePathArea, 'mountManifest'>): VerifiedDaemonImagePath;
+    mountManifest(): VerifiedDaemonImagePath;
+    /** Revalidate and return one internal root for store-local bounded I/O. */
+    verifiedRoot(area: DaemonImagePathArea): string;
+    /** Revalidate immediately before unlinking a resolver-issued file capability. */
+    removeFile(target: VerifiedDaemonImagePath): void;
+    /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
+    removeEmptyDirectory(target: VerifiedDaemonImagePath): void;
+    private issue;
+    private verifyDestructiveTarget;
 }
-type ImageRuntimeSafeUnavailableReason = ImageCapabilityUnavailableReason | 'disabled' | 'runtime_unavailable';
 
-interface ImageRuntimeCapabilityInspection {
-    readonly generationId: string;
-    readonly enabled: boolean;
-    readonly available: boolean;
-    readonly providerId?: ImageProviderId;
-    readonly model?: string;
-    readonly reason?: ImageRuntimeSafeUnavailableReason;
-    readonly capabilities?: ImageCapabilities;
-    /**
-     * Route-table keys whose ROUTED provider's fresh capability intersection
-     * affirms them (multi-provider-image-generation 6.1: /v1/models lists
-     * routed-model × fresh-evidence). Absent on synthetic/legacy generations —
-     * `listAvailableModels` then falls back to the single-model shape.
-     */
-    readonly routedModels?: readonly string[];
+interface FileCodexImageCapabilityEvidenceManifestOwnerOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly maxEntries?: number;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly hmacSalt?: Uint8Array;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-interface ImageRuntimeResourceStatus {
-    readonly queue: Readonly<{
-        activeJobs: number;
-        waitingJobs: number;
-        activeAccounts: number;
-        waitingAccounts: number;
-        waitingTenants: number;
-        maxConcurrentJobsPerAccount: number;
-        maxQueuedJobs: number;
-        accepting: boolean;
-        shuttingDown: boolean;
-    }>;
-    readonly temporary: Readonly<{
-        activeScopes: number;
-        totalBytes: number;
-        tenantCount: number;
-        maxActiveScopes: number;
-        maxTotalBytes: number;
-        maxTenantBytes: number;
-    }>;
-    readonly storage: Readonly<{
-        mounts: number;
-        retiredMounts: number;
-        referenceEntries: number;
-        referenceBytes: number;
-        referenceTombstones: number;
-        stateCalls: number;
-        stateResponses: number;
-        stateTombstones: number;
-        pendingReferenceDeletes: number;
-        maxReferenceEntries: number;
-        maxReferenceBytes: number;
-        maxTenantReferenceBytes: number;
-        maxStateCalls: number;
-        maxStateResponses: number;
-    }>;
+type FileCodexImageCapabilityEvidenceSourceOptions = Readonly<(FileCodexImageCapabilityEvidenceManifestOwnerOptions & {
+    readonly ttlMs: number;
+}) | {
+    readonly owner: FileCodexImageCapabilityEvidenceManifestOwner;
+    readonly ttlMs: number;
+}>;
+interface FileCodexImageCapabilityEvidenceStatus {
+    readonly entries: number;
+    readonly freshEntries: number;
+    readonly staleEntries: number;
+    readonly bytes: number;
 }
-interface PreparedImageRuntimeChange {
-    readonly generationId: string;
-    publish(): void;
-    rollback(): void;
-    dispose(): Promise<void>;
+/** Revision-aware manifest owner shared by runtime generations, doctor, and cleanup. */
+declare class FileCodexImageCapabilityEvidenceManifestOwner {
+    #private;
+    constructor(options: FileCodexImageCapabilityEvidenceManifestOwnerOptions);
+    createSource(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
+    resolveWithTtl(request: CodexImageCapabilityEvidenceRequest, ttlMs: number): Promise<CodexImageCapabilityEvidence>;
+    recordSuccessfulVerificationWithTtl(observation: CodexImageCapabilityObservation, ttlMs: number): Promise<void>;
+    cleanup(now: number, limit: number): Promise<{
+        readonly entriesRemoved: number;
+        readonly bytesRemoved: number;
+    }>;
+    statusWithTtl(ttlMs: number): FileCodexImageCapabilityEvidenceStatus;
 }
-/** App-session owner for stable forwarders and generation-pinned work. */
-declare class ImageRuntimeManager {
+/** Immutable TTL view over a revision-aware file-backed evidence manifest owner. */
+declare class FileCodexImageCapabilityEvidenceSource implements CodexImageCapabilityEvidenceSource {
     #private;
-    readonly contributions: ImageApiContributions;
-    constructor(initial?: PreparedImageRuntimeGeneration);
-    prepare(generation: PreparedImageRuntimeGeneration): PreparedImageRuntimeChange;
-    acquireHosted(): Promise<HostedImageRuntimeGenerationLease>;
-    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
-    listAvailableModels(apiKeyId: string): Promise<readonly string[]>;
-    resourceStatus(): ImageRuntimeResourceStatus | undefined;
-    status(): ImageRuntimeManagerStatus;
-    dispose(): Promise<void>;
+    constructor(options: FileCodexImageCapabilityEvidenceSourceOptions);
+    createView(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
+    resolve(request: CodexImageCapabilityEvidenceRequest): Promise<CodexImageCapabilityEvidence>;
+    recordSuccessfulVerification(observation: CodexImageCapabilityObservation): Promise<void>;
+    cleanup(now: number, limit: number): Promise<{
+        readonly entriesRemoved: number;
+        readonly bytesRemoved: number;
+    }>;
+    status(): FileCodexImageCapabilityEvidenceStatus;
+    ttlMs(): number;
+    /** Lifecycle-symmetric no-op; physical safety no longer depends on local leases. */
+    dispose(): void;
 }
 
-type SafeProvider = 'codex-subscription' | 'unknown' | 'other';
-type SafeModel = 'gpt-image-2' | 'unknown' | 'other';
-type SafeErrorCode = ImageGenerationErrorCode | 'none' | 'other';
-type SafeCountOption = 'unknown' | '0' | '1' | '2-4' | '5+';
-type SafeBooleanOption = boolean | 'unknown';
-type SafeQuality = 'auto' | 'low' | 'medium' | 'high' | 'unknown' | 'other';
-type SafeBackground = 'auto' | 'opaque' | 'transparent' | 'unknown' | 'other';
-type SafeOutputFormat = 'png' | 'jpeg' | 'webp' | 'unknown' | 'other';
-declare const IMAGE_CONFIGURATION_AUDIT_FIELDS: readonly ["enablement", "provider", "model", "account", "queue", "temporary", "limits", "retention", "storage", "remote", "evidence"];
-type ImageConfigurationAuditField = typeof IMAGE_CONFIGURATION_AUDIT_FIELDS[number];
-/** Values are deliberately limited to safe categories and internal generation ids. */
-interface ImageConfigurationAuditRecord {
-    readonly outcome: 'applied';
-    readonly fields: readonly ImageConfigurationAuditField[];
-    readonly previousGenerationId?: string;
-    readonly generationId?: string;
-}
-interface ImageHistogramSnapshot {
-    readonly count: number;
-    readonly sum: number;
-    /** Non-cumulative fixed buckets; `upperBound:null` is the overflow bucket. */
-    readonly buckets: readonly {
-        readonly upperBound: number | null;
-        readonly count: number;
-    }[];
+interface FileImageReferenceStoreLimits {
+    readonly ttlMs: number;
+    readonly maxArtifactBytes: number;
+    readonly maxTotalBytes: number;
+    readonly maxTenantBytes: number;
+    readonly maxEntries: number;
+    readonly maxTombstones: number;
+    readonly tombstoneTtlMs: number;
 }
-interface ImageApiMetricDimensions {
-    readonly endpoint: 'images.generate' | 'images.edit';
-    readonly provider: SafeProvider;
-    readonly model: SafeModel;
-    readonly action: 'generate' | 'edit';
-    readonly quality: SafeQuality;
-    readonly background: SafeBackground;
-    readonly outputFormat: SafeOutputFormat;
-    readonly streaming: SafeBooleanOption;
-    readonly requestedOutputs: SafeCountOption;
-    readonly partialImages: SafeCountOption;
-    readonly terminal: 'completed' | 'failed' | 'cancelled';
-    readonly errorCode: SafeErrorCode;
+interface FileImageReferenceStoreOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly limits: FileImageReferenceStoreLimits;
+    readonly secretBox?: SecretBox;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-interface ImageExecutionMetricDimensions {
-    readonly provider: SafeProvider;
-    readonly model: SafeModel;
-    readonly action: 'generate' | 'edit' | 'other';
-    readonly quality: SafeQuality;
-    readonly background: SafeBackground;
-    readonly outputFormat: SafeOutputFormat;
-    readonly streaming: SafeBooleanOption;
-    readonly requestedOutputs: SafeCountOption;
-    readonly terminal: 'completed' | 'failed' | 'cancelled' | 'other';
-    readonly errorCode: SafeErrorCode;
+interface FileImageReferenceReconciliationResult {
+    readonly metadataRemoved: number;
+    readonly metadataDegradedToProviderReference: number;
+    readonly orphanFilesRemoved: number;
+    readonly incompleteFilesRemoved: number;
+    readonly invalidDescendants: number;
 }
-interface ImageApiMetricSnapshot {
-    readonly dimensions: ImageApiMetricDimensions;
-    readonly requests: number;
-    readonly inputCount?: ImageHistogramSnapshot;
-    readonly inputBytes?: ImageHistogramSnapshot;
-    readonly referenceOutcomes: Readonly<{
-        hits: number;
-        notFound: number;
-        expired: number;
-        failed: number;
-    }>;
-    readonly cleanupOutcomes: Readonly<{
-        completed: number;
-        failed: number;
-    }>;
+declare class FileImageReferenceStore implements ImageReferenceStore {
+    #private;
+    constructor(options: FileImageReferenceStoreOptions);
+    save(input: ImageReferenceSaveInput): Promise<ImageReferenceMetadata>;
+    /** Generation-bound write entry point; reads and maintenance remain shared. */
+    saveWithLimits(input: ImageReferenceSaveInput, limits: FileImageReferenceStoreLimits): Promise<ImageReferenceMetadata>;
+    /** Updates only app-session maintenance policy; pinned writes pass their own limits. */
+    updateMaintenanceLimits(limits: FileImageReferenceStoreLimits): void;
+    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
+    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
+    /** Daemon-internal cleanup path; accepts only the local reference-domain tenant HMAC. */
+    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
+    cleanup(now?: number): Promise<number>;
+    status(): {
+        readonly entries: number;
+        readonly bytes: number;
+        readonly tombstones: number;
+    };
+    hasLiveReferenceByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId, now?: number): Promise<boolean>;
+    reconcileOwnedFiles(maxEntries: number): Promise<FileImageReferenceReconciliationResult>;
+    openArtifact(fileName: string, byteLength: number, signal?: AbortSignal): Promise<ReadableStream<Uint8Array>>;
+    private exclusive;
+    private tenantKey;
+    private newReferenceId;
+    private validateSaveInput;
+    private selectVictims;
+    private nextTombstones;
+    private writeArtifact;
+    private artifactPath;
+    private validArtifact;
+    private removeArtifact;
+    private safeUnlinkArtifactPath;
+    private releaseLease;
+    private manifestPath;
+    private persist;
+    private atomicReplace;
+    private loadManifest;
 }
-interface ImageExecutionMetricSnapshot {
-    readonly dimensions: ImageExecutionMetricDimensions;
-    readonly executions: number;
-    readonly finalLatencyMs: ImageHistogramSnapshot;
-    readonly queueWaitMs?: ImageHistogramSnapshot;
-    readonly generationDurationMs?: ImageHistogramSnapshot;
-    readonly firstPartialLatencyMs?: ImageHistogramSnapshot;
-    readonly inputCount: ImageHistogramSnapshot;
-    readonly inputBytes: ImageHistogramSnapshot;
-    readonly outputCount: ImageHistogramSnapshot;
-    readonly outputBytes: ImageHistogramSnapshot;
-    readonly retryCount?: ImageHistogramSnapshot;
-    readonly authRefreshCount?: ImageHistogramSnapshot;
-    readonly referenceSaveCount?: ImageHistogramSnapshot;
-    readonly retentionRollbackFailures?: ImageHistogramSnapshot;
+
+interface FileResponsesImageStateStoreLimits {
+    readonly maxCalls: number;
+    readonly maxResponses: number;
+    readonly maxTombstones: number;
+    readonly tombstoneTtlMs: number;
 }
-interface ImageObservabilitySnapshot {
-    readonly apiRequests: readonly ImageApiMetricSnapshot[];
-    readonly executions: readonly ImageExecutionMetricSnapshot[];
-    readonly configurationChanges: readonly ImageConfigurationAuditRecord[];
-    readonly overflow: Readonly<{
-        apiRecords: number;
-        telemetryRecords: number;
-    }>;
+interface FileResponsesImageStateStoreOptions {
+    readonly paths: DaemonImagePathResolver;
+    readonly limits: FileResponsesImageStateStoreLimits;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
 }
-interface ImageObservabilityOptions {
-    /** Hard cap applied independently to API and execution dimension maps. */
-    readonly maxDimensionSets?: number;
+interface PendingResponsesImageReferenceDelete {
+    readonly referenceTenantKey: string;
+    readonly binding: ResponsesImageCallBinding;
 }
-/** Process-local, metadata-only aggregation for HTTP and hosted Images work. */
-declare class ImageObservability {
+/** Durable production implementation of the existing Responses image-state contract. */
+declare class FileResponsesImageStateStore implements ResponsesImageStateStore {
     #private;
-    readonly telemetrySink: ImageTelemetrySink;
-    readonly audit: (record: ImageApiAuditRecord) => void;
-    constructor(options?: ImageObservabilityOptions);
-    recordApiAudit(record: ImageApiAuditRecord): void;
-    recordTelemetry(record: ImageTelemetryRecord): void;
-    recordConfigurationAudit(record: ImageConfigurationAuditRecord): void;
-    snapshot(): ImageObservabilitySnapshot;
-    reset(): void;
+    constructor(options: FileResponsesImageStateStoreOptions);
+    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
+    /** Generation-bound write entry point; reads and maintenance remain shared. */
+    commitWithLimits(input: ResponsesImageStateCommitInput, limits: FileResponsesImageStateStoreLimits): Promise<readonly ResponsesImageCallBinding[]>;
+    /** Updates only app-session maintenance policy; pinned commits pass their own limits. */
+    updateMaintenanceLimits(limits: FileResponsesImageStateStoreLimits): void;
+    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
+    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
+    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
+    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
+    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
+    pendingReferenceDeletes(limit?: number): readonly PendingResponsesImageReferenceDelete[];
+    acknowledgeReferenceDeletes(completed: readonly PendingResponsesImageReferenceDelete[]): Promise<number>;
+    reconcileBrokenReferenceLinks(hasLiveReference: (referenceTenantKey: string, referenceId: ResponsesImageCallBinding['referenceId']) => Promise<boolean>, maxEntries: number): Promise<readonly ResponsesImageCallBinding[]>;
+    status(): {
+        readonly calls: number;
+        readonly responses: number;
+        readonly tombstones: number;
+        readonly pendingReferenceDeletes: number;
+    };
+    private exclusive;
+    private failure;
+    private assertCommit;
+    private tenantKey;
+    private rememberTombstone;
+    private enqueuePendingReferenceDelete;
+    private hasTombstone;
+    private prunedTombstones;
+    private pruneTombstonesInPlace;
+    private sameTombstones;
+    private touch;
+    private releaseCall;
+    private releaseResponse;
+    private manifestPath;
+    private persist;
+    private atomicReplace;
+    private loadManifest;
 }
 
-interface PreparedServerConfigChange {
-    /** Publish the prepared snapshot. Implementations should make this an infallible swap. */
-    publish(): void | Promise<void>;
-    /** Restore the exact runtime snapshot that preceded publish. */
-    rollback(): void | Promise<void>;
-    /** Release an unpublished or rolled-back replacement. */
-    dispose(): void | Promise<void>;
+interface ImageStorageMountBackend {
+    readonly id: string;
+    readonly createdAt: number;
+    readonly resolver: DaemonImagePathResolver;
+    readonly references: FileImageReferenceStore;
+    readonly responsesState: FileResponsesImageStateStore;
 }
-
-/**
- * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
- *
- * A DB-backed embedder can persist 401/403 auto-disable durably so a UI can
- * render per-key health. The daemon has no DB, and its only
- * durable layer is `config.json` — but writing auto-disable back there in v1
- * would (1) cause write amplification under a 401 storm and (2) collide with
- * the at-rest encryption schema that owns the `apiKeys[]` on-disk
- * format. So v1 records auto-disable IN MEMORY only:
- *  - `markAutoDisabled(keyId, status, at)` records `{ status, at, reason }`,
- *  - `isDisabled(keyId)` / `get(keyId)` read it back,
- *  - `loadPoolKeys` reads this store and flips a flagged key's `enabled` to
- *    `false`, so `getAvailableKeys` skips it within this process lifetime.
- *
- * Restart resets the store (the honest v1 boundary — see spec). Persistence
- * (encrypted write-back) is a child-3 follow-up.
- *
- * @module @omnicross/daemon/pool/autoDisableStore
- */
-/** One in-memory auto-disable record for a pool key. */
-interface AutoDisableRecord {
-    /** The HTTP status that triggered the disable (401/403). */
-    status: number;
-    /** Epoch-ms when the disable was recorded. */
-    at: number;
-    /** Always `'auth_failure'` in v1 (the only auto-disable trigger). */
-    reason: 'auth_failure';
+interface ImageStorageMountCatalogOptions {
+    readonly pathOptions: Omit<CreateDaemonImagePathResolverOptions, 'storageRoot'>;
+    readonly activeStorageRoot?: string;
+    readonly referenceLimits: FileImageReferenceStoreLimits;
+    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
+    readonly secretBox?: SecretBox;
+    readonly now?: () => number;
+    readonly random?: (bytes: number) => Buffer;
+    readonly replaceCatalog?: (targetPath: string, contents: Uint8Array) => void;
+    readonly reconcileCorruptManifests?: boolean;
 }
-/**
- * A process-lifetime in-memory store of auto-disabled pool keys, keyed by the
- * pool key id. Constructed once in `buildDaemon` and injected as the pool's
- * `disableKey` / `markAutoDisabled` sinks AND read by `loadPoolKeys`.
- */
-declare class AutoDisableStore {
-    private readonly records;
-    /** Record (or overwrite) an auth-failure auto-disable for `keyId`. */
-    markAutoDisabled(keyId: string, status: number, at: number): void;
-    /** Whether `keyId` is currently auto-disabled in this process. */
-    isDisabled(keyId: string): boolean;
-    /** Read the auto-disable record for `keyId`, or `undefined` when healthy. */
-    get(keyId: string): AutoDisableRecord | undefined;
-    /** Clear all records (tests / teardown). */
-    clear(): void;
+interface ImageStorageMountPolicy {
+    readonly referenceLimits: FileImageReferenceStoreLimits;
+    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
 }
-
-/**
- * ConfigFileProviderConfigSource — the daemon's file-backed `ProviderConfigSource`
- * port impl: an embedder of `@omnicross/core`'s provider catalog port.
- *
- * The daemon's `config.json` provider rows ARE the catalog. Of the port's ten
- * methods, FOUR are real (the ones the BYO proxy/outbound path actually hits):
- *  - `getProvider(id)` — map a `DaemonProviderConfig` row to an `LLMProvider`.
- *  - `getTransformerService()` — a single `TransformerService` seeded by
- *    `registerBuiltinTransformers` in the ctor.
- *  - `getMainTransformer(id)` — the transformer for the provider's target wire
- *    format (anthropic → AnthropicTransformer, gemini → GeminiTransformer,
- *    openai → null/identity), mirroring the host `AgentModelsManager` switch.
- *    `resolveProviderChain` unshifts this FORMAT-FIRST into the provider chain.
- *  - `resolveTransformerChain(id, model)` — the provider's CUSTOM
- *    `transformer.use[]` chain (app-parity-2 child 2: ENFORCED). The format
- *    transformer is NOT included here (getMainTransformer supplies it,
- *    format-first); no `transformer.use[]` → empty chain.
- *
- * The remaining SIX are minimal sensible stubs (never hit on the BYO single-key
- * path — the boot smoke test is the proof).
- *
- * @module @omnicross/daemon/ports/ConfigFileProviderConfigSource
- */
-
-declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
-    private readonly providers;
-    private readonly transformerService;
-    /**
-     * Optional reload-hook (key-pool change, design D4). A no-type-coupling
-     * callback invoked at the END of `reload(...)`. `buildDaemon` injects
-     * `() => pool.invalidateCache()` so the `ApiKeyPoolService.keyCache` is
-     * flushed after a hot-reload swaps the catalog — WITHOUT this port ever
-     * importing/depending on `ApiKeyPoolService`. Absent = no-op (single-key
-     * boots that never construct a pool stay byte-identical).
-     */
-    private reloadHook;
-    constructor(config: DaemonConfig);
-    /**
-     * Register a callback fired after every `reload(...)`. Used by `buildDaemon`
-     * to invalidate the pool's keyCache on a hot-reload. The port stays ignorant
-     * of what the callback does (no pool type dependency).
-     */
-    setReloadHook(fn: () => void): void;
-    /**
-     * Read the live (post-reload) provider row for `providerId`, or `undefined`.
-     * Exposed so the pool's `loadKeys` reads the SAME live catalog Map this port
-     * serves (so a hot-reload is observed on the next load after `invalidateCache`).
-     */
-    getProviderRow(providerId: string): DaemonProviderConfig | undefined;
-    /** Await the built-in transformer registration (tests await this before dispatch). */
-    ready(): Promise<void>;
-    /**
-     * Replace the live provider catalog in place (additive — does NOT touch the
-     * ten port methods, the seeded `TransformerService`, or `ready()`). Called by
-     * the admin API after a provider POST/PUT/DELETE persists `config.json`, so the
-     * next outbound request sees the new catalog WITHOUT a daemon restart. The Map
-     * swap is synchronous; an in-flight request keeps its already-resolved
-     * provider (no locking needed for a single-operator local daemon).
-     */
-    reload(config: DaemonConfig): void;
-    /** Clear + repopulate the private providers Map from a fresh provider list. */
-    setProviders(providers: readonly DaemonProviderConfig[]): void;
-    getProvider(id: string): Promise<LLMProvider | null>;
-    getTransformerService(): TransformerService | undefined;
-    getMainTransformer(providerId: string): Promise<Transformer | null>;
-    resolveTransformerChain(providerId: string, _model?: string): Promise<ResolvedTransformerChain>;
-    resolveRoutedModel(): Promise<null>;
-    resolveEffectiveModels(): Promise<{
-        background?: string;
-        vision?: string;
-    }>;
-    getAgentDefaultModels(): Promise<AgentDefaultModels>;
-    hasVisionCapability(): Promise<boolean>;
-    getGlobalModelParameters(): Promise<GlobalModelParameters>;
-    getDiscoveredModelMaxTokens(): Promise<number | undefined>;
+interface PreparedImageStorageMountActivation {
+    readonly backend: ImageStorageMountBackend;
+    publish(): ImageStorageMountBackend;
+    rollback(): void;
+    dispose(): void;
 }
-
-/**
- * JsonApiServerSettingsStore — the daemon's file-backed `ApiServerSettingsStore`
- * port impl.
- *
- * The serving core persists the outbound-API server config (`{ enabled,
- * networkBinding, endpoints, port }`) under a SINGLE settings key
- * (`OUTBOUND_API_SERVER_CONFIG_KEY === 'outboundApiServer.config'`). Here that
- * store is the daemon's `config.json` `server`
- * field. `loadServerConfig(store)` / `saveServerConfig(store, cfg)` (core)
- * normalize + persist through this 2-method surface.
- *
- * Only the one outbound-API key is ever read/written — any other key is a no-op
- * miss (returns `undefined`) so the surface stays honest about what it backs.
- *
- * @module @omnicross/daemon/ports/JsonApiServerSettingsStore
- */
-
-interface JsonSettingsDocumentSnapshot {
-    readonly existed: boolean;
-    /** Raw persisted bytes; may contain encrypted secrets and must never enter a DTO or log. */
-    readonly bytes?: Uint8Array;
+/** Owns the durable-root set independently from any one runtime generation. */
+declare class ImageStorageMountCatalog {
+    #private;
+    constructor(options: ImageStorageMountCatalogOptions);
+    active(): ImageStorageMountBackend;
+    mountsForRead(): readonly ImageStorageMountBackend[];
+    status(): {
+        readonly mounts: number;
+        readonly retiredMounts: number;
+    };
+    startupReconciliationStatus(): {
+        readonly corruptManifestsQuarantined: number;
+    };
+    utilization(): {
+        readonly referenceEntries: number;
+        readonly referenceBytes: number;
+        readonly referenceTombstones: number;
+        readonly stateCalls: number;
+        readonly stateResponses: number;
+        readonly stateTombstones: number;
+        readonly pendingReferenceDeletes: number;
+    };
+    /** Pins a backend object until its owning runtime generation drains. */
+    retainBackend(backend: ImageStorageMountBackend): () => void;
+    activate(storageRoot?: string): ImageStorageMountBackend;
+    /** Prepare a validated backend without changing the catalog's active mount. */
+    prepareActivation(storageRoot?: string, policy?: ImageStorageMountPolicy): PreparedImageStorageMountActivation;
+    retireEmptyMount(mountId: string): boolean;
+    private createResolver;
+    private createBackend;
+    private applyMaintenancePolicy;
+    private newMountId;
+    private isManifestError;
+    private quarantineManifest;
+    private isVerifiedEmpty;
+    private catalogPath;
+    private persist;
+    private atomicReplace;
+    private loadCatalog;
 }
-type AtomicDocumentReplace = (targetPath: string, contents: Uint8Array) => void;
-declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
-    private readonly configPath;
-    private readonly box;
-    private readonly atomicReplace;
-    /**
-     * @param configPath the daemon config.json whose `server` field is backed.
-     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
-     *                    `server.proxy.*` passwords are encrypted-on-`set` /
-     *                    decrypted-on-`get` (the settings-store path is otherwise not
-     *                    secret-aware — every OTHER server field is non-secret). Null
-     *                    ⇒ passthrough (legacy/pure tests unchanged).
-     */
-    constructor(configPath: string, box?: SecretBox | null, atomicReplace?: AtomicDocumentReplace);
-    get<T = unknown>(key: string): Promise<T | undefined>;
-    set<T = unknown>(key: string, value: T): Promise<void>;
-    /** Capture the exact prior document for an admin transaction rollback. */
-    captureDocumentSnapshot(): JsonSettingsDocumentSnapshot;
-    /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
-    restoreDocumentSnapshot(snapshot: JsonSettingsDocumentSnapshot): void;
-    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
-    private encryptSecrets;
-    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
-    private decryptSecrets;
-    /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
-    private readFile;
+declare class MountedImageReferenceStore implements ImageReferenceStore {
+    private readonly catalog;
+    private readonly writeBackend?;
+    private readonly writeLimits?;
+    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileImageReferenceStoreLimits | undefined);
+    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileImageReferenceStoreLimits): MountedImageReferenceStore;
+    status(): Readonly<{
+        referenceEntries: number;
+        referenceBytes: number;
+        referenceTombstones: number;
+        stateCalls: number;
+        stateResponses: number;
+        stateTombstones: number;
+        pendingReferenceDeletes: number;
+        mounts: number;
+        retiredMounts: number;
+    }>;
+    save(input: ImageReferenceSaveInput): Promise<_omnicross_contracts_image_generation_types.ImageReferenceMetadata>;
+    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
+    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
+    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
+    cleanup(now?: number): Promise<number>;
+}
+declare class MountedResponsesImageStateStore implements ResponsesImageStateStore {
+    private readonly catalog;
+    private readonly writeBackend?;
+    private readonly writeLimits?;
+    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileResponsesImageStateStoreLimits | undefined);
+    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileResponsesImageStateStoreLimits): MountedResponsesImageStateStore;
+    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
+    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
+    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
+    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
+    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
+    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
 }
 
-/**
- * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
- *
- * Durable storage for the model pricing table, backed by a pretty-printed json
- * file (a sibling of `config.json`, `pricing.json` by convention) holding a
- * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
- * every mutation rewrites the full array (the table is at most a few thousand
- * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
- * seeding — the first pricing-source refresh (or a manual upsert) populates it.
- *
- * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
- * frozen; the admin DELETE route calls the concrete class and then invalidates
- * the engine cache).
- *
- * @module @omnicross/daemon/ports/JsonPricingStore
- */
-
-declare class JsonPricingStore implements PricingStore {
-    private readonly pricingPath;
-    constructor(pricingPath: string);
-    /**
-     * Return whether the durable snapshot can actually serve at least one price.
-     *
-     * This intentionally checks the file itself instead of relying on refresh
-     * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
-     * otherwise unusable pricing table after a crash or manual file edit.
-     */
-    hasUsableSnapshot(): boolean;
-    getAll(): Promise<PricingEntry[]>;
-    /**
-     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
-     * user provenance (source 'user', userEdited, editedAt now) so the row is
-     * protected from auto-overwrite during source refreshes; a non-user upsert
-     * stamps source 'litellm' and clears nothing it should not (a plain source
-     * upsert through this method overwrites the row wholesale).
-     */
-    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
-    /**
-     * Apply a batch fetched from a pricing source. Rows whose local copy is
-     * user-edited are NOT applied — they come back as `{ current, incoming }`
-     * conflicts; everything else is upserted with the supplied automatic source.
-     * ONE file write for the whole batch.
-     */
-    bulkApplyFromSource(entries: PricingEntryInput[], source?: AutomaticPricingSource): Promise<{
-        applied: PricingEntry[];
-        conflicts: Array<{
-            current: PricingEntry;
-            incoming: PricingEntryInput;
-        }>;
+interface ImageDoctorLocalSnapshot {
+    readonly config: Readonly<{
+        enabled: boolean;
+        provider: ImageProviderId;
+        model: string;
+        valid: boolean;
+        errorCount: number;
+        /** Distinct providers the routing table names (doctor per-provider rows). */
+        routedProviders: readonly ImageProviderId[];
+    }>;
+    readonly roots: Readonly<{
+        valid: boolean;
+        verifiedAreas: number;
+        expectedAreas: number;
+    }>;
+    readonly stores: Readonly<{
+        valid: boolean;
+        mounts: number;
+        retiredMounts: number;
+        referenceEntries: number;
+        referenceBytes: number;
+        stateCalls: number;
+        stateResponses: number;
+        corruptManifestsQuarantined: number;
+    }>;
+    readonly permissions: Readonly<{
+        valid: boolean;
+        rows: number;
+        legacyRows: number;
+        invalidRows: number;
+        imagesAuthorizedRows: number;
+    }>;
+    /** The Codex-subscription account backing codex-routed image models. */
+    readonly account: Readonly<{
+        present: boolean;
+        usable: boolean;
+        reason: 'ready' | 'missing' | 'unavailable';
+    }>;
+    /** The Antigravity-subscription account backing NanoBanana image models. */
+    readonly antigravityAccount: Readonly<{
+        present: boolean;
+        usable: boolean;
+        reason: 'ready' | 'missing' | 'unavailable';
+    }>;
+    readonly evidence: Readonly<FileCodexImageCapabilityEvidenceStatus & {
+        valid: boolean;
     }>;
-    /**
-     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
-     * the incoming values (clearing the user-edited mark), 'skip' counts only.
-     */
-    applyResolutions(resolutions: Array<{
-        incoming: PricingEntryInput;
-        action: 'overwrite' | 'skip';
-    }>): Promise<PricingResolution>;
-    /**
-     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
-     * was actually removed. The admin DELETE handler calls this then invalidates
-     * the engine cache.
-     */
-    delete(providerId: string, modelId: string): Promise<boolean>;
-    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
-    private applyUpsert;
-    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
-    private readRows;
-    private writeRows;
-    /** Isolated for deterministic failure testing; never removes the target. */
-    private replaceFile;
 }
-
-interface CodexAuthHelperConfig {
-    command: string;
-    args: string[];
+type ImageDoctorLiveFailureCode = 'images_disabled' | 'codex_account_unavailable' | 'evidence_store_unavailable' | 'evidence_persist_failed' | ImageGenerationErrorCode;
+type ImageDoctorLiveResult = Readonly<{
+    ok: true;
+    code: 'verified';
+    model: 'gpt-image-2';
+    quality: 'low';
+    outputFormat: 'png';
+    freshEvidenceEntries: number;
+}> | Readonly<{
+    ok: false;
+    code: ImageDoctorLiveFailureCode;
+}>;
+interface ImageDoctorService {
+    inspectLocal(config: ImagesServerConfig): Promise<ImageDoctorLocalSnapshot>;
+    verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
 }
 
-type IntegrationClientId = 'codex' | 'claude';
-type IntegrationKeyOwnership = 'managed' | 'selected';
-/** Secret-free pointer to an access key. The plaintext remains in the encrypted key store. */
-interface IntegrationKeyBinding {
-    keyId: string;
-    ownership: IntegrationKeyOwnership;
-}
-/** Redacted access-key state exposed by the integrations admin API. */
-interface IntegrationKeyBindingStatus {
-    id: string;
-    name: string;
-    keyPrefix: string;
-    ownership: IntegrationKeyOwnership;
-    revealable: boolean;
-    enabled: boolean;
-    revoked: boolean;
-    allowedEndpoints: OutboundPermission[];
-    requiredEndpoints: OutboundPermission[];
-    loopbackOnly: boolean;
-}
-type IntegrationStatusKind = 'not-installed' | 'enabled' | 'configuration-drift' | 'configuration-missing' | 'key-missing';
-interface IntegrationClientStatus {
-    client: IntegrationClientId;
-    status: IntegrationStatusKind;
-    configPath: string;
-    installedAt?: number;
-    gatewayBaseUrl?: string;
-    message?: string;
-    /** Selected key metadata only; never contains plaintext or the encrypted envelope. */
-    key?: IntegrationKeyBindingStatus;
+type PreparedImageRuntimeGeneration = {
+    readonly id: string;
+    readonly enabled: true;
+    readonly imageApi: ImageApiContributions;
+    readonly hosted: ResponsesImageGenerationContribution;
+    readonly hostedRuntime: HostedImageRuntimePolicy;
+    readonly inspectCapability?: (apiKeyId: string) => Promise<Omit<ImageRuntimeCapabilityInspection, 'generationId'>>;
+    readonly readRuntimeStatus?: () => ImageRuntimeResourceStatus;
+    dispose(): void | Promise<void>;
+} | {
+    readonly id: string;
+    readonly enabled: false;
+    dispose(): void | Promise<void>;
+};
+interface HostedImageRuntimeGenerationLease {
+    readonly generationId: string;
+    /** Compatibility/debug view; callers should prefer the deep methods below. */
+    readonly contribution: ResponsesImageGenerationContribution;
+    inspectRequest(input: ResponsesImageInspectionInput): ResponsesImageAdmission;
+    validateSelection(admission: ResponsesImageAdmission, selection: ResponsesHostedToolSelection): void;
+    openRequest(input: HostedImageOpenRequestInput): Promise<ResponsesImageRequestScope>;
+    release(): Promise<void>;
 }
-interface IntegrationChangePlan {
-    client: IntegrationClientId;
-    configPath: string;
-    action: 'install' | 'none' | 'repair';
-    canApply: boolean;
-    /** Redacted logical fields only; never file contents or credential values. */
-    changes: string[];
-    warnings: string[];
+interface HostedImageRuntimePolicy {
+    readonly providerId: string;
+    readonly imageModel: string;
+    readonly referenceTtlMs: number;
+    readonly maxOutputBytes: number;
+    readonly maxTotalOutputBytes: number;
+    readonly preferredAccountId?: string;
+    readonly preferredAccountGroup?: string;
+    readonly boundAccountFallbackPolicy?: 'strict' | 'pool';
 }
-interface IntegrationInstallRecord {
-    client: IntegrationClientId;
-    configPath: string;
-    originalExisted: boolean;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    originalContent: string;
-    originalHash: string;
-    installedHash: string;
-    installedAt: number;
-    gatewayBaseUrl: string;
-    /** Codex auth.json snapshot and installed hash; absent on legacy records. */
-    credentialFile?: IntegrationManagedFileRecord;
+interface HostedImageOpenRequestInput {
+    readonly admission: ResponsesImageAdmission;
+    readonly tenantId: string;
+    readonly requestId: string;
+    readonly sessionKey: string;
+    readonly signal: AbortSignal;
+    readonly authorizedPreviousResponseId?: string;
+    /** Trusted affinity fact forwarded unchanged into the contribution scope. */
+    readonly authorizedPreviousResponseKnownEmpty?: boolean;
+    readonly mainProviderId: string;
+    readonly selectedMainAccountId?: string;
 }
-interface IntegrationManagedFileRecord {
-    path: string;
-    originalExisted: boolean;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    originalContent: string;
-    originalHash: string;
-    installedHash: string;
+/** Dormant integration seam for a later Native Responses owner. */
+interface HostedImageContributionFactory {
+    acquire(): Promise<HostedImageRuntimeGenerationLease>;
 }
-interface IntegrationGatewayKeyRecord {
-    id: string;
-    /** Encrypted by IntegrationStateStore before it reaches disk. */
-    secret: string;
-    createdAt: number;
+/** Bind a stable factory to one app-session runtime manager without acquiring. */
+declare function createHostedImageContributionFactory(manager: ImageRuntimeManager): HostedImageContributionFactory;
+interface ImageRuntimeGenerationStatus {
+    readonly generationId: string;
+    readonly enabled: boolean;
+    readonly httpLeases: number;
+    readonly hostedLeases: number;
 }
-interface IntegrationState {
-    version: 1;
-    /** Legacy shared-key layout. New installs use `keyBindings`; retained for safe migration. */
-    gatewayKey?: IntegrationGatewayKeyRecord;
-    keyBindings?: Partial<Record<IntegrationClientId, IntegrationKeyBinding>>;
-    clients: Partial<Record<IntegrationClientId, IntegrationInstallRecord>>;
+interface ImageRuntimeManagerStatus {
+    readonly disposed: boolean;
+    readonly current: ImageRuntimeGenerationStatus;
+    readonly draining: readonly ImageRuntimeGenerationStatus[];
 }
+type ImageRuntimeSafeUnavailableReason = ImageCapabilityUnavailableReason | 'disabled' | 'runtime_unavailable';
 
-/** Encrypted, Omnicross-owned state for reversible native CLI configuration. */
-declare class IntegrationStateStore {
-    readonly path: string;
-    private readonly box;
-    constructor(path: string, box: SecretBox);
-    load(): IntegrationState;
-    save(state: IntegrationState): void;
+interface ImageRuntimeCapabilityInspection {
+    readonly generationId: string;
+    readonly enabled: boolean;
+    readonly available: boolean;
+    readonly providerId?: ImageProviderId;
+    readonly model?: string;
+    readonly reason?: ImageRuntimeSafeUnavailableReason;
+    readonly capabilities?: ImageCapabilities;
+    /**
+     * Route-table keys whose ROUTED provider's fresh capability intersection
+     * affirms them (multi-provider-image-generation 6.1: /v1/models lists
+     * routed-model × fresh-evidence). Absent on synthetic/legacy generations —
+     * `listAvailableModels` then falls back to the single-model shape.
+     */
+    readonly routedModels?: readonly string[];
+    /**
+     * One row per provider named by the routing table (images-settings-tab D2):
+     * availability with a safe reason, the models its own fresh evidence
+     * affirms, and the capability values for evidence-age projection. Absent on
+     * synthetic/legacy generations.
+     */
+    readonly providers?: readonly ImageRuntimeProviderInspection[];
 }
-
-interface IntegrationManagerOptions {
-    configPath: string;
-    gatewayBaseUrl: string;
-    keyDb: OutboundKeyDb;
-    stateStore: IntegrationStateStore;
-    codexAuthHelper?: CodexAuthHelperConfig;
-    homeDir?: string;
+/** Per-provider capability inspection row (images-settings-tab D2). */
+interface ImageRuntimeProviderInspection {
+    readonly providerId: ImageProviderId;
+    readonly available: boolean;
+    readonly reason?: ImageRuntimeSafeUnavailableReason;
+    /** This provider's route keys affirmed by its fresh evidence intersection. */
+    readonly models: readonly string[];
+    readonly capabilities?: ImageCapabilities;
 }
-/** Coordinates per-client least-privilege keys with reversible native CLI config edits. */
-declare class IntegrationManager {
-    private readonly options;
-    private readonly homeDir;
-    private readonly codexAuthHelper;
-    constructor(options: IntegrationManagerOptions);
-    listStatus(): Promise<IntegrationClientStatus[]>;
-    plan(client: IntegrationClientId, configPath?: string): Promise<IntegrationChangePlan>;
-    install(client: IntegrationClientId, configPath?: string): Promise<IntegrationClientStatus>;
-    repair(client: IntegrationClientId): Promise<IntegrationClientStatus>;
-    remove(client: IntegrationClientId): Promise<IntegrationClientStatus>;
-    /** Bind a user-confirmed access key and grant only this client's required endpoints. */
-    bindIntegrationKey(client: IntegrationClientId, keyId: string): Promise<IntegrationClientStatus>;
-    /** Rotate every Omnicross-managed client binding; user-selected keys remain untouched. */
-    rotateGatewayKey(): Promise<{
-        keyIds: Partial<Record<IntegrationClientId, string>>;
+interface ImageRuntimeResourceStatus {
+    readonly queue: Readonly<{
+        activeJobs: number;
+        waitingJobs: number;
+        activeAccounts: number;
+        waitingAccounts: number;
+        waitingTenants: number;
+        maxConcurrentJobsPerAccount: number;
+        maxQueuedJobs: number;
+        accepting: boolean;
+        shuttingDown: boolean;
     }>;
-    /** Resolve the plaintext only for the command-auth helper; callers must not log it. */
-    getIntegrationToken(client: IntegrationClientId): Promise<string>;
-    /** Compatibility alias for callers predating per-client bindings. */
-    getGatewayToken(client?: IntegrationClientId): Promise<string>;
-    private ensureClientKey;
-    private createManagedClientKey;
-    private installedSecret;
-    private rebindInstalledClient;
-    private statusFor;
-    private boundKeyDetails;
-    private retireManagedKeys;
-    private defaultConfigPath;
-    private renderInstalled;
+    readonly temporary: Readonly<{
+        activeScopes: number;
+        totalBytes: number;
+        tenantCount: number;
+        maxActiveScopes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+    }>;
+    readonly storage: Readonly<{
+        mounts: number;
+        retiredMounts: number;
+        referenceEntries: number;
+        referenceBytes: number;
+        referenceTombstones: number;
+        stateCalls: number;
+        stateResponses: number;
+        stateTombstones: number;
+        pendingReferenceDeletes: number;
+        maxReferenceEntries: number;
+        maxReferenceBytes: number;
+        maxTenantReferenceBytes: number;
+        maxStateCalls: number;
+        maxStateResponses: number;
+    }>;
+}
+interface PreparedImageRuntimeChange {
+    readonly generationId: string;
+    publish(): void;
+    rollback(): void;
+    dispose(): Promise<void>;
+}
+/** App-session owner for stable forwarders and generation-pinned work. */
+declare class ImageRuntimeManager {
+    #private;
+    readonly contributions: ImageApiContributions;
+    constructor(initial?: PreparedImageRuntimeGeneration);
+    prepare(generation: PreparedImageRuntimeGeneration): PreparedImageRuntimeChange;
+    acquireHosted(): Promise<HostedImageRuntimeGenerationLease>;
+    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
+    listAvailableModels(apiKeyId: string): Promise<readonly string[]>;
+    resourceStatus(): ImageRuntimeResourceStatus | undefined;
+    status(): ImageRuntimeManagerStatus;
+    dispose(): Promise<void>;
 }
 
-/**
- * accountsAntigravityOAuth — the daemon admin API's ANTIGRAVITY interactive
- * OAuth path (`POST /accounts/antigravity/oauth/start` +
- * `GET /accounts/antigravity/oauth/:sessionId/status`).
- *
- * Modeled on the codex loopback flow (`accountsCodexOAuth`): antigravity's
- * redirect is a FIXED loopback `http://127.0.0.1:51121/oauth-callback`, so the
- * flow is ASYNC + POLLED — `start` arms the one-shot loopback listener, kicks
- * the capture→exchange→email→project-handshake→persist chain off ASYNC, and
- * returns ONLY `{ authUrl, sessionId }` (public — client_id + state). The app
- * opens `authUrl`; the browser redirects to the loopback; the daemon captures
- * the `code`, validates `state`, exchanges it, resolves the userinfo email and
- * the Code Assist project (the antigravity dialect of the shared resolver),
- * and persists the minted token through the encrypted credential store. The
- * app POLLS `status` until `done`/`error`.
- *
- * SECRET SPINE (same invariant as codex/grok): the minted access/refresh token
- * NEVER crosses to the client — it lands ONLY in the encrypted store. The
- * poll `status` body is TOKEN-FREE (`{ state, message? }`). Port 51121 is a
- * single resource → only ONE antigravity sign-in may be in flight (409).
- *
- * REUSES the `@omnicross/subscriptions` antigravity flow + the CLI's
- * `awaitLoopbackCode` listener (parameterized binding) — it does NOT rebuild
- * the authorize/exchange/handshake logic.
- *
- * @module @omnicross/daemon/admin/accountsAntigravityOAuth
- */
+type SafeProvider = 'codex-subscription' | 'unknown' | 'other';
+type SafeModel = 'gpt-image-2' | 'unknown' | 'other';
+type SafeErrorCode = ImageGenerationErrorCode | 'none' | 'other';
+type SafeCountOption = 'unknown' | '0' | '1' | '2-4' | '5+';
+type SafeBooleanOption = boolean | 'unknown';
+type SafeQuality = 'auto' | 'low' | 'medium' | 'high' | 'unknown' | 'other';
+type SafeBackground = 'auto' | 'opaque' | 'transparent' | 'unknown' | 'other';
+type SafeOutputFormat = 'png' | 'jpeg' | 'webp' | 'unknown' | 'other';
+declare const IMAGE_CONFIGURATION_AUDIT_FIELDS: readonly ["enablement", "provider", "model", "account", "queue", "temporary", "limits", "retention", "storage", "remote", "evidence"];
+type ImageConfigurationAuditField = typeof IMAGE_CONFIGURATION_AUDIT_FIELDS[number];
+/** Values are deliberately limited to safe categories and internal generation ids. */
+interface ImageConfigurationAuditRecord {
+    readonly outcome: 'applied';
+    readonly fields: readonly ImageConfigurationAuditField[];
+    readonly previousGenerationId?: string;
+    readonly generationId?: string;
+}
+interface ImageHistogramSnapshot {
+    readonly count: number;
+    readonly sum: number;
+    /** Non-cumulative fixed buckets; `upperBound:null` is the overflow bucket. */
+    readonly buckets: readonly {
+        readonly upperBound: number | null;
+        readonly count: number;
+    }[];
+}
+interface ImageApiMetricDimensions {
+    readonly endpoint: 'images.generate' | 'images.edit';
+    readonly provider: SafeProvider;
+    readonly model: SafeModel;
+    readonly action: 'generate' | 'edit';
+    readonly quality: SafeQuality;
+    readonly background: SafeBackground;
+    readonly outputFormat: SafeOutputFormat;
+    readonly streaming: SafeBooleanOption;
+    readonly requestedOutputs: SafeCountOption;
+    readonly partialImages: SafeCountOption;
+    readonly terminal: 'completed' | 'failed' | 'cancelled';
+    readonly errorCode: SafeErrorCode;
+}
+interface ImageExecutionMetricDimensions {
+    readonly provider: SafeProvider;
+    readonly model: SafeModel;
+    readonly action: 'generate' | 'edit' | 'other';
+    readonly quality: SafeQuality;
+    readonly background: SafeBackground;
+    readonly outputFormat: SafeOutputFormat;
+    readonly streaming: SafeBooleanOption;
+    readonly requestedOutputs: SafeCountOption;
+    readonly terminal: 'completed' | 'failed' | 'cancelled' | 'other';
+    readonly errorCode: SafeErrorCode;
+}
+interface ImageApiMetricSnapshot {
+    readonly dimensions: ImageApiMetricDimensions;
+    readonly requests: number;
+    readonly inputCount?: ImageHistogramSnapshot;
+    readonly inputBytes?: ImageHistogramSnapshot;
+    readonly referenceOutcomes: Readonly<{
+        hits: number;
+        notFound: number;
+        expired: number;
+        failed: number;
+    }>;
+    readonly cleanupOutcomes: Readonly<{
+        completed: number;
+        failed: number;
+    }>;
+}
+interface ImageExecutionMetricSnapshot {
+    readonly dimensions: ImageExecutionMetricDimensions;
+    readonly executions: number;
+    readonly finalLatencyMs: ImageHistogramSnapshot;
+    readonly queueWaitMs?: ImageHistogramSnapshot;
+    readonly generationDurationMs?: ImageHistogramSnapshot;
+    readonly firstPartialLatencyMs?: ImageHistogramSnapshot;
+    readonly inputCount: ImageHistogramSnapshot;
+    readonly inputBytes: ImageHistogramSnapshot;
+    readonly outputCount: ImageHistogramSnapshot;
+    readonly outputBytes: ImageHistogramSnapshot;
+    readonly retryCount?: ImageHistogramSnapshot;
+    readonly authRefreshCount?: ImageHistogramSnapshot;
+    readonly referenceSaveCount?: ImageHistogramSnapshot;
+    readonly retentionRollbackFailures?: ImageHistogramSnapshot;
+}
+interface ImageObservabilitySnapshot {
+    readonly apiRequests: readonly ImageApiMetricSnapshot[];
+    readonly executions: readonly ImageExecutionMetricSnapshot[];
+    readonly configurationChanges: readonly ImageConfigurationAuditRecord[];
+    readonly overflow: Readonly<{
+        apiRecords: number;
+        telemetryRecords: number;
+    }>;
+}
+interface ImageObservabilityOptions {
+    /** Hard cap applied independently to API and execution dimension maps. */
+    readonly maxDimensionSets?: number;
+}
+/** Process-local, metadata-only aggregation for HTTP and hosted Images work. */
+declare class ImageObservability {
+    #private;
+    readonly telemetrySink: ImageTelemetrySink;
+    readonly audit: (record: ImageApiAuditRecord) => void;
+    constructor(options?: ImageObservabilityOptions);
+    recordApiAudit(record: ImageApiAuditRecord): void;
+    recordTelemetry(record: ImageTelemetryRecord): void;
+    recordConfigurationAudit(record: ImageConfigurationAuditRecord): void;
+    snapshot(): ImageObservabilitySnapshot;
+    reset(): void;
+}
 
-/** The loopback-listener fn (injected so tests need not bind a real port). */
-type AntigravityLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
+interface PreparedServerConfigChange {
+    /** Publish the prepared snapshot. Implementations should make this an infallible swap. */
+    publish(): void | Promise<void>;
+    /** Restore the exact runtime snapshot that preceded publish. */
+    rollback(): void | Promise<void>;
+    /** Release an unpublished or rolled-back replacement. */
+    dispose(): void | Promise<void>;
+}
 
 /**
- * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
- * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
+ * autoDisableStore.ts — the daemon's PROCESS-IN-MEMORY auto-disable store.
  *
- * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
- * same `@omnicross/cli-launcher` builders (which register one route on the
- * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
- * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
- * NEW terminal window running the CLI with that env injected. The route token —
- * NOT an upstream credential — is the only secret in the env; it is removed when
- * the session is stopped (`onSessionEnd`).
+ * A DB-backed embedder can persist 401/403 auto-disable durably so a UI can
+ * render per-key health. The daemon has no DB, and its only
+ * durable layer is `config.json` — but writing auto-disable back there in v1
+ * would (1) cause write amplification under a 401 storm and (2) collide with
+ * the at-rest encryption schema that owns the `apiKeys[]` on-disk
+ * format. So v1 records auto-disable IN MEMORY only:
+ *  - `markAutoDisabled(keyId, status, at)` records `{ status, at, reason }`,
+ *  - `isDisabled(keyId)` / `get(keyId)` read it back,
+ *  - `loadPoolKeys` reads this store and flips a flagged key's `enabled` to
+ *    `false`, so `getAvailableKeys` skips it within this process lifetime.
  *
- * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
- * never a provider key. On win32 the token rides the spawned process environment
- * (inherited by the terminal), never the command line / a file on disk.
+ * Restart resets the store (the honest v1 boundary — see spec). Persistence
+ * (encrypted write-back) is a child-3 follow-up.
  *
- * @module @omnicross/daemon/admin/cliLaunch
+ * @module @omnicross/daemon/pool/autoDisableStore
  */
-
-/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
-type PathProbe = (candidate: string) => string | null;
-/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
-type TerminalCleanup = () => void;
-type TerminalOpener = (input: {
-    cli: string;
-    command: string;
-    extraArgs: string[];
-    env: Record<string, string>;
-    cwd?: string;
-    platform: NodeJS.Platform;
-    onFailure?: () => void;
-}) => void | TerminalCleanup;
+/** One in-memory auto-disable record for a pool key. */
+interface AutoDisableRecord {
+    /** The HTTP status that triggered the disable (401/403). */
+    status: number;
+    /** Epoch-ms when the disable was recorded. */
+    at: number;
+    /** Always `'auth_failure'` in v1 (the only auto-disable trigger). */
+    reason: 'auth_failure';
+}
 /**
- * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
- * default execs the install command with a bounded timeout). Returns the host's
- * honest install outcome — `error` carries stderr/the failure reason.
+ * A process-lifetime in-memory store of auto-disabled pool keys, keyed by the
+ * pool key id. Constructed once in `buildDaemon` and injected as the pool's
+ * `disableKey` / `markAutoDisabled` sinks AND read by `loadPoolKeys`.
  */
-type CommandRunner = (command: string) => Promise<{
-    ok: boolean;
-    error?: string;
-}>;
+declare class AutoDisableStore {
+    private readonly records;
+    /** Record (or overwrite) an auth-failure auto-disable for `keyId`. */
+    markAutoDisabled(keyId: string, status: number, at: number): void;
+    /** Whether `keyId` is currently auto-disabled in this process. */
+    isDisabled(keyId: string): boolean;
+    /** Read the auto-disable record for `keyId`, or `undefined` when healthy. */
+    get(keyId: string): AutoDisableRecord | undefined;
+    /** Clear all records (tests / teardown). */
+    clear(): void;
+}
 
 /**
- * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
- * search-settings-tab D4).
- *
- * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
- * `case 'search'`:
- *
- * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
- *   snapshot: one row per provider the daemon can run (the ONE runtime's
- *   descriptors, plus `unconfigured` rows for known API providers the persisted
- *   config does not name — the doctor's classification), the effective frontend
- *   modes, and the explicit apply semantics (codex immediate, rest restart).
- * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
- *   a configured provider, classified by the doctor's pure functions. The
- *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
- *   caller-supplied query, and never returns result content (plan §11.3 — its
- *   contract is the automated doctor's fixed-query discipline).
- * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
- *   channel for the settings page's per-provider test panel (owner feedback
- *   2026-09-02): ONE operator-typed query through ONE provider's contribution
- *   built from the PERSISTED config, returning the doctor-classified diagnostic
- *   PLUS the sanitized results. The two disciplines stay separate routes on
- *   purpose: bending `/test` to accept a query would erase the boundary its
- *   pinned tests and consumers depend on.
+ * ConfigFileProviderConfigSource — the daemon's file-backed `ProviderConfigSource`
+ * port impl: an embedder of `@omnicross/core`'s provider catalog port.
  *
- * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
- * and a failure response carries only the doctor's SANITIZED error shape — raw
- * upstream error bodies (which may quote the stored key) never serialize. The
- * query endpoint additionally sanitizes every returned result field BEFORE
- * serialization (plan §11.1: search results are untrusted input), and the
- * operator's query is never logged anywhere.
+ * The daemon's `config.json` provider rows ARE the catalog. Of the port's ten
+ * methods, FOUR are real (the ones the BYO proxy/outbound path actually hits):
+ *  - `getProvider(id)` — map a `DaemonProviderConfig` row to an `LLMProvider`.
+ *  - `getTransformerService()` — a single `TransformerService` seeded by
+ *    `registerBuiltinTransformers` in the ctor.
+ *  - `getMainTransformer(id)` — the transformer for the provider's target wire
+ *    format (anthropic → AnthropicTransformer, gemini → GeminiTransformer,
+ *    openai → null/identity), mirroring the host `AgentModelsManager` switch.
+ *    `resolveProviderChain` unshifts this FORMAT-FIRST into the provider chain.
+ *  - `resolveTransformerChain(id, model)` — the provider's CUSTOM
+ *    `transformer.use[]` chain (app-parity-2 child 2: ENFORCED). The format
+ *    transformer is NOT included here (getMainTransformer supplies it,
+ *    format-first); no `transformer.use[]` → empty chain.
  *
- * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
- * that wire no search runtime get 501 for all routes (the voucher/allowance
- * optionality precedent) rather than a fabricated snapshot.
+ * The remaining SIX are minimal sensible stubs (never hit on the BYO single-key
+ * path — the boot smoke test is the proof).
  *
- * @module @omnicross/daemon/admin/searchAdminApi
+ * @module @omnicross/daemon/ports/ConfigFileProviderConfigSource
  */
 
-/**
- * The daemon search state the admin surface needs. Structurally satisfied by
- * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
- * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
- * without any network.
- */
-interface SearchAdminRuntimeStatus {
-    /** The daemon's ONE assembled search runtime (provider descriptors). */
-    readonly runtime: SearchRuntime;
-    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
-    readonly modes: SearchFrontendModes;
-    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
-    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
+declare class ConfigFileProviderConfigSource implements ProviderConfigSource {
+    private readonly providers;
+    private readonly transformerService;
+    /**
+     * Optional reload-hook (key-pool change, design D4). A no-type-coupling
+     * callback invoked at the END of `reload(...)`. `buildDaemon` injects
+     * `() => pool.invalidateCache()` so the `ApiKeyPoolService.keyCache` is
+     * flushed after a hot-reload swaps the catalog — WITHOUT this port ever
+     * importing/depending on `ApiKeyPoolService`. Absent = no-op (single-key
+     * boots that never construct a pool stay byte-identical).
+     */
+    private reloadHook;
+    constructor(config: DaemonConfig);
+    /**
+     * Register a callback fired after every `reload(...)`. Used by `buildDaemon`
+     * to invalidate the pool's keyCache on a hot-reload. The port stays ignorant
+     * of what the callback does (no pool type dependency).
+     */
+    setReloadHook(fn: () => void): void;
+    /**
+     * Read the live (post-reload) provider row for `providerId`, or `undefined`.
+     * Exposed so the pool's `loadKeys` reads the SAME live catalog Map this port
+     * serves (so a hot-reload is observed on the next load after `invalidateCache`).
+     */
+    getProviderRow(providerId: string): DaemonProviderConfig | undefined;
+    /** Await the built-in transformer registration (tests await this before dispatch). */
+    ready(): Promise<void>;
+    /**
+     * Replace the live provider catalog in place (additive — does NOT touch the
+     * ten port methods, the seeded `TransformerService`, or `ready()`). Called by
+     * the admin API after a provider POST/PUT/DELETE persists `config.json`, so the
+     * next outbound request sees the new catalog WITHOUT a daemon restart. The Map
+     * swap is synchronous; an in-flight request keeps its already-resolved
+     * provider (no locking needed for a single-operator local daemon).
+     */
+    reload(config: DaemonConfig): void;
+    /** Clear + repopulate the private providers Map from a fresh provider list. */
+    setProviders(providers: readonly DaemonProviderConfig[]): void;
+    getProvider(id: string): Promise<LLMProvider | null>;
+    getTransformerService(): TransformerService | undefined;
+    getMainTransformer(providerId: string): Promise<Transformer | null>;
+    resolveTransformerChain(providerId: string, _model?: string): Promise<ResolvedTransformerChain>;
+    resolveRoutedModel(): Promise<null>;
+    resolveEffectiveModels(): Promise<{
+        background?: string;
+        vision?: string;
+    }>;
+    getAgentDefaultModels(): Promise<AgentDefaultModels>;
+    hasVisionCapability(): Promise<boolean>;
+    getGlobalModelParameters(): Promise<GlobalModelParameters>;
+    getDiscoveredModelMaxTokens(): Promise<number | undefined>;
 }
 
 /**
- * migration.ts — the export gather + import apply logic for the passphrase pack
- * (app-parity child 6, design D2/D3/D5).
- *
- * EXPORT (`gatherExport`): read the FULL local state DECRYPTED in-memory — every
- * provider row (scalars / modelConfigs / single apiKey / pool apiKeys /
- * transformer) via `loadConfig` (the at-rest box decrypts on read) AND the
- * subscription tokens via `credentialStore.getFullConfig()` (also decrypted) —
- * serialize to ONE bundle JSON, and `sealPack` it under the passphrase-derived
- * key. The caller returns ONLY the opaque pack; the decrypted bundle + the
- * passphrase live only in local variables and are never logged.
+ * JsonApiServerSettingsStore — the daemon's file-backed `ApiServerSettingsStore`
+ * port impl.
  *
- * IMPORT (`applyImport`): `openPack` decrypts + authenticates (a wrong passphrase
- * or a tampered pack fails the GCM auth-tag BEFORE any write — atomic). Every
- * provider is re-validated through `parseProviderInput` and every token block
- * through `validateTokenBody` (deny-by-default — a malicious blob cannot inject
- * unknown fields or escape the allowlist). Validation collects ALL rows BEFORE
- * applying, so a structurally invalid pack does not leave a half-applied state.
- * Apply merges by provider id (additive default): a new id is added; a colliding
- * id is skipped (or overwritten with `mode:'overwrite'`). Writes go through the
- * EXISTING paths (`saveConfig` re-encrypts at-rest under the LOCAL box +
- * `writeProviderTokens`/`appendProviderAccount`), so imported secrets land
- * `enc:`-encrypted under the TARGET machine's key — the passphrase key is used
- * ONLY for transport.
+ * The serving core persists the outbound-API server config (`{ enabled,
+ * networkBinding, endpoints, port }`) under a SINGLE settings key
+ * (`OUTBOUND_API_SERVER_CONFIG_KEY === 'outboundApiServer.config'`). Here that
+ * store is the daemon's `config.json` `server`
+ * field. `loadServerConfig(store)` / `saveServerConfig(store, cfg)` (core)
+ * normalize + persist through this 2-method surface.
  *
- * SECRET SPINE: the export RESPONSE is the opaque pack ONLY; the import RESPONSE
- * is status-only counts. No decrypted secret + no passphrase ever reaches a
- * response body or a log here.
+ * Only the one outbound-API key is ever read/written — any other key is a no-op
+ * miss (returns `undefined`) so the surface stays honest about what it backs.
  *
- * @module @omnicross/daemon/migration/migration
+ * @module @omnicross/daemon/ports/JsonApiServerSettingsStore
  */
 
-/**
- * The credential-store surface the migration paths need: the full DECRYPTED read
- * (export) + the multi-account append (import re-encrypts at-rest). One shape so
- * `ExportDeps` + `ImportDeps` can be unified into `MigrationDeps` without a
- * `credentialStore` type conflict.
- */
-interface MigrationCredentialStore extends SubscriptionAccountAppender {
-    getFullConfig(): Promise<AccountTokensConfig>;
+interface JsonSettingsDocumentSnapshot {
+    readonly existed: boolean;
+    /** Raw persisted bytes; may contain encrypted secrets and must never enter a DTO or log. */
+    readonly bytes?: Uint8Array;
 }
-
-/** Minimal, auth-gated admin API for secret-free account allowance snapshots. */
-
-interface AccountAllowanceAdminReader {
-    list(filter?: {
-        providerId?: SubscriptionProviderId;
-        accountId?: string;
-    }): Promise<AccountAllowanceSnapshot[]>;
-    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Codex active `/wham/usage` refresh (absent on older daemons). */
-    refreshCodex?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Kimi `/coding/v1/usages` refresh (absent on older daemons). */
-    refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
-    refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
-    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Copilot user-quota refresh (absent on older daemons). */
-    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Gemini Code-Assist quota refresh (absent on older daemons). */
-    refreshGemini?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    /** Optional: Antigravity quotaSummary refresh (absent on older daemons). */
-    refreshAntigravity?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
-    removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
-    removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
-    getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
+type AtomicDocumentReplace = (targetPath: string, contents: Uint8Array) => void;
+declare class JsonApiServerSettingsStore implements ApiServerSettingsStore {
+    private readonly configPath;
+    private readonly box;
+    private readonly atomicReplace;
+    /**
+     * @param configPath the daemon config.json whose `server` field is backed.
+     * @param box         OPTIONAL at-rest `SecretBox` (upstream-proxy). When set, the
+     *                    `server.proxy.*` passwords are encrypted-on-`set` /
+     *                    decrypted-on-`get` (the settings-store path is otherwise not
+     *                    secret-aware — every OTHER server field is non-secret). Null
+     *                    ⇒ passthrough (legacy/pure tests unchanged).
+     */
+    constructor(configPath: string, box?: SecretBox | null, atomicReplace?: AtomicDocumentReplace);
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    set<T = unknown>(key: string, value: T): Promise<void>;
+    /** Capture the exact prior document for an admin transaction rollback. */
+    captureDocumentSnapshot(): JsonSettingsDocumentSnapshot;
+    /** Restore exact prior bytes (including unrelated fields and encrypted secrets). */
+    restoreDocumentSnapshot(snapshot: JsonSettingsDocumentSnapshot): void;
+    /** Encrypt the proxy passwords + webhook + billing secrets before persisting (no-op without a box). */
+    private encryptSecrets;
+    /** Decrypt the proxy passwords + webhook + billing secrets on read (no-op without a box). */
+    private decryptSecrets;
+    /** Read the config.json, tolerating a missing/corrupt file (→ empty shape). */
+    private readFile;
 }
 
-/** Token-free subscription account list entry (passthrough from core's service). */
-interface AdminAccountsLister {
-    listAll(): Promise<unknown[]>;
-}
-/** One key's live cooldown health (mirrors core `KeyHealthEntry`; read-only). */
-interface PoolKeyHealth {
-    until: number;
-    errors: number;
-    lastStatus: number | null;
-}
-/**
- * The READ-ONLY pool-health surface the admin view needs (key-pool design D7).
- * Structurally satisfied by core's `ApiKeyPoolService.getKeyHealth`; typed as a
- * minimal reader so `adminApi` carries no class coupling and can never reach a
- * key value through it (cooldown health only).
- */
-interface PoolHealthReader {
-    getKeyHealth(providerId: string): Promise<Record<string, PoolKeyHealth>>;
-}
 /**
- * The BYO provider-key quota surface the keys view needs — structurally
- * satisfied by `ProviderKeyQuotaService`. Read-only; the DTO is secret-free by
- * construction (normalized windows + diagnostic codes only).
+ * JsonPricingStore — the daemon's file-backed `PricingStore` port impl.
+ *
+ * Durable storage for the model pricing table, backed by a pretty-printed json
+ * file (a sibling of `config.json`, `pricing.json` by convention) holding a
+ * `PricingEntry[]`. Reads tolerate a missing/corrupt file (→ empty table);
+ * every mutation rewrites the full array (the table is at most a few thousand
+ * rows — same trade-off as `JsonOutboundKeyDb`). The table starts EMPTY: no
+ * seeding — the first pricing-source refresh (or a manual upsert) populates it.
+ *
+ * Beyond the core port, the store exposes a STORE-LOCAL `delete` (the port is
+ * frozen; the admin DELETE route calls the concrete class and then invalidates
+ * the engine cache).
+ *
+ * @module @omnicross/daemon/ports/JsonPricingStore
  */
-interface ProviderKeyQuotaReader {
-    quotaFor(row: DaemonProviderConfig, keyId: string, options?: {
-        force?: boolean;
-    }): Promise<ProviderKeyQuota | null>;
-}
-interface AdminImagesStatusReader {
-    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
-    status(): ImageRuntimeManagerStatus;
-    resourceStatus(): ImageRuntimeResourceStatus | undefined;
-}
-/** The live daemon handles the management API operates over. */
-interface AdminApiDeps {
-    /** Path to the daemon's `config.json` (provider catalog + `server` field). */
-    readonly configPath: string;
-    /** Live provider catalog (hot-reload target). */
-    readonly llmConfig: ConfigFileProviderConfigSource;
-    /** Named outbound-key store. */
-    readonly keyDb: OutboundKeyDb$1;
+
+declare class JsonPricingStore implements PricingStore {
+    private readonly pricingPath;
+    constructor(pricingPath: string);
     /**
-     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
-     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
-     * surface returns 501 (feature not available in this build).
+     * Return whether the durable snapshot can actually serve at least one price.
+     *
+     * This intentionally checks the file itself instead of relying on refresh
+     * metadata: a recent `lastSuccessAt` must not hide a deleted, truncated, or
+     * otherwise unusable pricing table after a crash or manual file edit.
      */
-    readonly voucherDb?: VoucherDb;
+    hasUsableSnapshot(): boolean;
+    getAll(): Promise<PricingEntry[]>;
     /**
-     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
-     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
-     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
+     * Insert or update one row keyed (providerId, modelId). `asUserEdit` stamps
+     * user provenance (source 'user', userEdited, editedAt now) so the row is
+     * protected from auto-overwrite during source refreshes; a non-user upsert
+     * stamps source 'litellm' and clears nothing it should not (a plain source
+     * upsert through this method overwrites the row wholesale).
      */
-    readonly keySpendReader?: KeySpendReader;
-    /** Outbound server settings store (server config persistence). */
-    readonly settingsStore: JsonApiServerSettingsStore;
-    /** The running outbound server (status + live applyConfig). */
-    readonly outboundApiServer: OutboundApiServer;
-    /** True only when production composed the hardened per-hop remote resolver. */
-    readonly imageRemoteResolverAvailable?: boolean;
-    /** Optional production Images runtime generation participant. */
-    readonly imageRuntimeConfig?: {
-        prepareConfig(config: ImagesServerConfig): Promise<PreparedServerConfigChange>;
-    };
-    /** Narrow metadata-only reader for authenticated Images capability/status. */
-    readonly imageRuntimeStatus?: AdminImagesStatusReader;
-    /** Metadata-only successful Images configuration audit sink. */
-    readonly imageConfigAudit?: (record: ImageConfigurationAuditRecord) => void;
-    /** Process-local machine-managed routing leases (optional for light embedders). */
-    readonly routeLeaseManager?: RouteLeaseManager;
-    /** Subscription accounts (token-free `listAll`). */
-    readonly subscriptionAccounts: AdminAccountsLister;
+    upsert(input: PricingEntryInput, asUserEdit: boolean): Promise<PricingEntry>;
     /**
-     * Secret-free upstream allowance facade. Optional for lightweight embedders;
-     * the standalone daemon wires it and the route returns 501 when absent.
+     * Apply a batch fetched from a pricing source. Rows whose local copy is
+     * user-edited are NOT applied — they come back as `{ current, incoming }`
+     * conflicts; everything else is upserted with the supplied automatic source.
+     * ONE file write for the whole batch.
      */
-    readonly accountAllowanceService?: AccountAllowanceAdminReader;
-    /** Live Claude cache worker; hot-reconfigured with allowance scheduling. */
-    readonly allowanceRefreshScheduler?: Pick<ClaudeAllowanceRefreshScheduler, 'configure'>;
-    /** Optional secret-free account connection probe + rolling history surface. */
-    readonly accountProbeService?: AccountProbeHistoryReader & {
-        probeAccount(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
-            ok: boolean;
-            marked: boolean;
-        }>;
-        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
-            ok: boolean;
-            marked: boolean;
-            tier: 'local' | 'upstream' | 'generation';
-            model?: string;
+    bulkApplyFromSource(entries: PricingEntryInput[], source?: AutomaticPricingSource): Promise<{
+        applied: PricingEntry[];
+        conflicts: Array<{
+            current: PricingEntry;
+            incoming: PricingEntryInput;
         }>;
-    };
-    /**
-     * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
-     * methods (`writeProviderTokens` / `clearProvider`), never a token-returning
-     * read. The token-free `subscriptionAccounts` lister stays separate so a GET
-     * handler can never reach a token through this dep.
-     */
-    readonly subscriptionTokenWriter: SubscriptionTokenWriter;
-    /**
-     * Read-only pool-health reader (key-pool design D7) — cooldown health only,
-     * never a key value. Drives `GET /admin/api/providers/:id/keys`.
-     */
-    readonly apiKeyPool: PoolHealthReader;
-    /** In-memory auto-disable store (design D5) — read-only for the health view. */
-    readonly autoDisableStore: AutoDisableStore;
-    /**
-     * OPTIONAL BYO provider-key quota service — same-key usage/quota probes for
-     * provider rows with a known adapter (Z.AI coding plan, MiniMax Token Plan).
-     * Absent ⇒ the keys view carries no `quota` field (light embedders).
-     */
-    readonly providerKeyQuota?: ProviderKeyQuotaReader;
-    /**
-     * Pending interactive-OAuth sessions (app-parity child 4, design D1) — the
-     * in-memory `{ codeVerifier, state }` map keyed by a minted `sessionId`,
-     * NEVER serialized to the client.
-     */
-    readonly oauthSessions: OAuthSessionStore;
-    /**
-     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
-     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
-     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
-     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
-     * injects its exchange fetch.
-     */
-    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
-    /**
-     * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
-     * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
-     * A minimal interface, NOT the full read-capable store, so no token-returning
-     * read is reachable. Wired from the concrete `credentialStore` in `bootstrap.ts`.
-     */
-    readonly subscriptionAccountAppender: SubscriptionAccountAppender;
-    /**
-     * Codex interactive-OAuth flow store (app-parity-2 child 5). Tracks the async
-     * loopback sign-in's polled status (token-free); only ONE codex login may be in
-     * flight (port 1455 is one resource). Wired in `bootstrap.ts`.
-     */
-    readonly codexSessions: CodexOAuthSessionStore;
-    /**
-     * Kimi interactive-OAuth flow store (device code). Same token-free polled
-     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly kimiSessions: CodexOAuthSessionStore;
-    /**
-     * Grok interactive-OAuth flow store (device code). Same token-free polled
-     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly grokSessions: CodexOAuthSessionStore;
-    /**
-     * Copilot interactive-OAuth flow store (device code). Same token-free
-     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
-     */
-    readonly copilotSessions: CodexOAuthSessionStore;
-    /** Antigravity interactive OAuth (loopback 51121) — the async flow store. */
-    readonly antigravitySessions: CodexOAuthSessionStore;
-    /** The one-shot 127.0.0.1:51121 listener (test seam like `codexAwaitLoopback`). */
-    readonly antigravityAwaitLoopback: AntigravityLoopbackFn;
-    /**
-     * Resolve the ACTIVE antigravity account's access token for the dynamic
-     * model-catalog probe (secret used daemon-side only; the route is
-     * secret-free). Optional for older tests; absent → static-only catalog.
-     */
-    readonly resolveAntigravityAccessToken?: () => Promise<string | null>;
-    /**
-     * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
-     * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port
-     * is bound. The captured code crosses to the daemon ONLY (never the client).
-     */
-    readonly codexAwaitLoopback: CodexLoopbackFn;
-    /**
-     * Migration credential-store handle (app-parity child 6, design D2/D3). The
-     * export gather needs `getFullConfig()` (full DECRYPTED tokens, in-memory only —
-     * the pack is the only thing that leaves) and import needs `appendProviderAccount`
-     * (multi-account append + re-encrypt at-rest). Confined to the migration
-     * handlers (which seal/validate everything); never reached by a GET handler.
-     * Wired from the concrete `credentialStore` in `bootstrap.ts`.
-     */
-    readonly migrationCredentialStore: MigrationCredentialStore;
-    /**
-     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
-     * usage-event store. Aggregates only; carries no key material.
-     */
-    readonly usageRecorder: UsageRecorder;
-    /** Pricing engine (upsert / source refresh / conflict resolution). */
-    readonly pricingEngine: PricingEngine;
-    /**
-     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
-     * `PricingStore` port is frozen; delete is a daemon-local extra).
-     */
-    readonly pricingStore: JsonPricingStore;
-    /**
-     * External-terminal opener for the Code CLI launch route (dashboard parity).
-     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
-     * no terminal window is actually spawned.
-     */
-    readonly cliTerminalOpener?: TerminalOpener;
-    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
-    readonly cliPathProbe?: PathProbe;
+    }>;
     /**
-     * Injectable shell runner for the Code CLI install route. Optional — defaults
-     * to the real `exec`-based runner; tests inject a stub so no package manager
-     * actually runs.
+     * Apply per-row conflict decisions: 'overwrite' replaces the local row with
+     * the incoming values (clearing the user-edited mark), 'skip' counts only.
      */
-    readonly cliCommandRunner?: CommandRunner;
-    /** Factory so each request observes the outbound server's current loopback port. */
-    readonly integrationManagerFactory?: () => IntegrationManager;
+    applyResolutions(resolutions: Array<{
+        incoming: PricingEntryInput;
+        action: 'overwrite' | 'skip';
+    }>): Promise<PricingResolution>;
     /**
-     * search-settings-ui D3: the daemon's ONE search runtime plus its
-     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
-     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
-     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     * STORE-LOCAL (not on the core port): remove one row. Returns whether a row
+     * was actually removed. The admin DELETE handler calls this then invalidates
+     * the engine cache.
      */
-    readonly searchStatus?: SearchAdminRuntimeStatus;
+    delete(providerId: string, modelId: string): Promise<boolean>;
+    /** Upsert into `rows` IN PLACE (no write) and return the resulting entry. */
+    private applyUpsert;
+    /** Read the pricing rows, tolerating a missing/corrupt file (→ empty list). */
+    private readRows;
+    private writeRows;
+    /** Isolated for deterministic failure testing; never removes the target. */
+    private replaceFile;
 }
-/**
- * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
- * (no query). The auth gate has already run in `AdminServer`.
- */
-declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerResponse, path: string, deps: AdminApiDeps): Promise<void>;
 
-/**
- * AdminServer — the daemon's localhost admin/dashboard HTTP listener (RT3,
- * design D1/D2).
- *
- * A SEPARATE `node:http` listener distinct from core's outbound `/v1/*` server
- * (port 8765, untouched). Mirrors `OutboundApiServer`'s proven shape:
- *  - `http.createServer`, default bind `127.0.0.1` (or `0.0.0.0` when
- *    `networkBinding`), `listen` with `EADDRINUSE`→ephemeral(port 0) fallback,
- *  - `getStatus()` (running / bound port / dashboard URL), `start` / `stop`.
- * Default admin port 8766.
- *
- * Auth (design D2):
- *  - Baseline = localhost bind, no token → reachable only from the machine.
- *  - Optional `admin.token` → every `/admin/*` request (incl. `GET /`) must
- *    carry `Authorization: Bearer <token>` or `X-Admin-Token: <token>`; compared
- *    server-side with a constant-time equality → `401` on a miss.
- *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
- *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
- *
- * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
- * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
- * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
- *
- * @module @omnicross/daemon/admin/AdminServer
- */
+interface CodexAuthHelperConfig {
+    command: string;
+    args: string[];
+}
 
-/** The dependencies the admin server + its API need (live daemon handles). */
-interface AdminServerDeps extends AdminApiDeps {
-    /** Read the resolved admin config (enabled/port/networkBinding/token). */
-    getAdminConfig: () => ResolvedAdminConfig;
-    /**
-     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
-     * shared closure over live handles (bootstrap wires the SAME builder into the
-     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
-     */
-    getHealthReport: () => HealthReport;
-    /**
-     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
-     * lines (bind/refuse/error) route through it so they honor the configured
-     * level / format / file sink.
-     */
-    logger: Logger;
-    /**
-     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
-     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
-     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
-     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
-     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
-     */
-    probeHistoryReader?: AccountProbeHistoryReader;
-    /**
-     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
-     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
-     * returns filtered records. Absent ⇒ the route serves an empty list. The
-     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
-     * unauthenticated, NEVER on `/health`.
-     */
-    auditReader?: AuditQueryReader;
-    /** Metadata-only audit aggregate used by the overview error-rate metric. */
-    auditStatsReader?: AuditStatsReader;
-    /**
-     * Reconstructs one record's bodies from the per-session shard store
-     * (audit-store-sharding). Absent when audit was never enabled.
-     */
-    auditBodyReader?: AuditBodyReader;
-    /** Runs cross-session body compaction on demand (audit-store-sharding D8). */
-    auditCompactor?: AuditCompactor;
-    /**
-     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
-     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
-     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
-     */
-    billingStatusReader?: BillingStatusReader;
+type IntegrationClientId = 'codex' | 'claude';
+type IntegrationKeyOwnership = 'managed' | 'selected';
+/** Secret-free pointer to an access key. The plaintext remains in the encrypted key store. */
+interface IntegrationKeyBinding {
+    keyId: string;
+    ownership: IntegrationKeyOwnership;
 }
-/** A live status snapshot for the admin listener. */
-interface AdminServerStatus {
-    running: boolean;
-    /** Actual bound port (0 when not running). */
-    port: number;
-    /** The dashboard URL (loopback or LAN base), or null when not running. */
-    url: string | null;
+/** Redacted access-key state exposed by the integrations admin API. */
+interface IntegrationKeyBindingStatus {
+    id: string;
+    name: string;
+    keyPrefix: string;
+    ownership: IntegrationKeyOwnership;
+    revealable: boolean;
+    enabled: boolean;
+    revoked: boolean;
+    allowedEndpoints: OutboundPermission[];
+    requiredEndpoints: OutboundPermission[];
+    loopbackOnly: boolean;
 }
-declare class AdminServer {
-    private readonly deps;
-    private server;
-    private boundPort;
-    private boundAddr;
-    /** Control Panel dist dir (resolved once at first request; null = no UI). */
-    private uiDist;
-    constructor(deps: AdminServerDeps);
-    /**
-     * Start the admin listener honoring the resolved admin config. Returns the
-     * actual bound port, or `0` when it refuses/declines to bind (disabled or the
-     * LAN fail-closed gate). Idempotent: a second call returns the bound port.
-     */
-    start(): Promise<number>;
-    /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
-    private listen;
-    /** Per-request handler: auth gate (when a token is set) → routing. */
-    private onRequest;
-    private dispatch;
-    /** Constant-time bearer/header check against the configured token. */
-    private isAuthorized;
-    /** Stop the listener and release the port. */
-    stop(): Promise<void>;
-    /** A live status snapshot. */
-    getStatus(): AdminServerStatus;
+type IntegrationStatusKind = 'not-installed' | 'enabled' | 'configuration-drift' | 'configuration-missing' | 'key-missing';
+interface IntegrationClientStatus {
+    client: IntegrationClientId;
+    status: IntegrationStatusKind;
+    configPath: string;
+    installedAt?: number;
+    gatewayBaseUrl?: string;
+    message?: string;
+    /** Selected key metadata only; never contains plaintext or the encrypted envelope. */
+    key?: IntegrationKeyBindingStatus;
 }
-
-type DaemonImagePathArea = 'temporary' | 'artifacts' | 'state' | 'evidence' | 'mountManifest';
-interface DaemonImagePaths {
-    readonly applicationDataRoot: string;
-    readonly imagesRoot: string;
-    readonly temporaryRoot: string;
-    readonly durableRoot: string;
-    readonly artifactsRoot: string;
-    readonly stateRoot: string;
-    readonly evidenceRoot: string;
-    readonly mountManifestRoot: string;
-    readonly mountManifestPath: string;
+interface IntegrationChangePlan {
+    client: IntegrationClientId;
+    configPath: string;
+    action: 'install' | 'none' | 'repair';
+    canApply: boolean;
+    /** Redacted logical fields only; never file contents or credential values. */
+    changes: string[];
+    warnings: string[];
 }
-interface ImageRootValidationOptions {
-    readonly label?: string;
-    readonly processDirectory?: string;
-    readonly userHome?: string;
-    readonly temporaryDirectory?: string;
+interface IntegrationInstallRecord {
+    client: IntegrationClientId;
+    configPath: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
+    installedAt: number;
+    gatewayBaseUrl: string;
+    /** Codex auth.json snapshot and installed hash; absent on legacy records. */
+    credentialFile?: IntegrationManagedFileRecord;
 }
-interface CreateDaemonImagePathResolverOptions extends ImageRootValidationOptions {
-    readonly configPath: string;
-    readonly storageRoot?: string;
+interface IntegrationManagedFileRecord {
+    path: string;
+    originalExisted: boolean;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    originalContent: string;
+    originalHash: string;
+    installedHash: string;
 }
-interface VerifiedDaemonImagePath {
-    readonly area: DaemonImagePathArea;
-    readonly absolutePath: string;
-    readonly kind: 'opaque-file' | 'opaque-directory' | 'mount-manifest';
+interface IntegrationGatewayKeyRecord {
+    id: string;
+    /** Encrypted by IntegrationStateStore before it reaches disk. */
+    secret: string;
+    createdAt: number;
 }
-/**
- * Owns all daemon Images filesystem names. Callers receive opaque capabilities,
- * never a filename-accepting delete primitive; destructive methods revalidate
- * the root identity, descendant relationship, basename, and symlink state.
- */
-declare class DaemonImagePathResolver {
-    #private;
-    readonly paths: DaemonImagePaths;
-    constructor(options: CreateDaemonImagePathResolverOptions);
-    createOpaqueFile(area: Exclude<DaemonImagePathArea, 'temporary' | 'mountManifest'>, format?: 'bin' | 'json' | 'tmp'): VerifiedDaemonImagePath;
-    createOpaqueDirectory(area?: Exclude<DaemonImagePathArea, 'mountManifest'>): VerifiedDaemonImagePath;
-    mountManifest(): VerifiedDaemonImagePath;
-    /** Revalidate and return one internal root for store-local bounded I/O. */
-    verifiedRoot(area: DaemonImagePathArea): string;
-    /** Revalidate immediately before unlinking a resolver-issued file capability. */
-    removeFile(target: VerifiedDaemonImagePath): void;
-    /** Only empty opaque directories may be removed until the owned-marker layer is composed. */
-    removeEmptyDirectory(target: VerifiedDaemonImagePath): void;
-    private issue;
-    private verifyDestructiveTarget;
+interface IntegrationState {
+    version: 1;
+    /** Legacy shared-key layout. New installs use `keyBindings`; retained for safe migration. */
+    gatewayKey?: IntegrationGatewayKeyRecord;
+    keyBindings?: Partial<Record<IntegrationClientId, IntegrationKeyBinding>>;
+    clients: Partial<Record<IntegrationClientId, IntegrationInstallRecord>>;
 }
 
-interface FileCodexImageCapabilityEvidenceManifestOwnerOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly maxEntries?: number;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly hmacSalt?: Uint8Array;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
+/** Encrypted, Omnicross-owned state for reversible native CLI configuration. */
+declare class IntegrationStateStore {
+    readonly path: string;
+    private readonly box;
+    constructor(path: string, box: SecretBox);
+    load(): IntegrationState;
+    save(state: IntegrationState): void;
 }
-type FileCodexImageCapabilityEvidenceSourceOptions = Readonly<(FileCodexImageCapabilityEvidenceManifestOwnerOptions & {
-    readonly ttlMs: number;
-}) | {
-    readonly owner: FileCodexImageCapabilityEvidenceManifestOwner;
-    readonly ttlMs: number;
-}>;
-interface FileCodexImageCapabilityEvidenceStatus {
-    readonly entries: number;
-    readonly freshEntries: number;
-    readonly staleEntries: number;
-    readonly bytes: number;
+
+interface IntegrationManagerOptions {
+    configPath: string;
+    gatewayBaseUrl: string;
+    keyDb: OutboundKeyDb;
+    stateStore: IntegrationStateStore;
+    codexAuthHelper?: CodexAuthHelperConfig;
+    homeDir?: string;
 }
-/** Revision-aware manifest owner shared by runtime generations, doctor, and cleanup. */
-declare class FileCodexImageCapabilityEvidenceManifestOwner {
-    #private;
-    constructor(options: FileCodexImageCapabilityEvidenceManifestOwnerOptions);
-    createSource(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
-    resolveWithTtl(request: CodexImageCapabilityEvidenceRequest, ttlMs: number): Promise<CodexImageCapabilityEvidence>;
-    recordSuccessfulVerificationWithTtl(observation: CodexImageCapabilityObservation, ttlMs: number): Promise<void>;
-    cleanup(now: number, limit: number): Promise<{
-        readonly entriesRemoved: number;
-        readonly bytesRemoved: number;
-    }>;
-    statusWithTtl(ttlMs: number): FileCodexImageCapabilityEvidenceStatus;
-}
-/** Immutable TTL view over a revision-aware file-backed evidence manifest owner. */
-declare class FileCodexImageCapabilityEvidenceSource implements CodexImageCapabilityEvidenceSource {
-    #private;
-    constructor(options: FileCodexImageCapabilityEvidenceSourceOptions);
-    createView(ttlMs: number): FileCodexImageCapabilityEvidenceSource;
-    resolve(request: CodexImageCapabilityEvidenceRequest): Promise<CodexImageCapabilityEvidence>;
-    recordSuccessfulVerification(observation: CodexImageCapabilityObservation): Promise<void>;
-    cleanup(now: number, limit: number): Promise<{
-        readonly entriesRemoved: number;
-        readonly bytesRemoved: number;
+/** Coordinates per-client least-privilege keys with reversible native CLI config edits. */
+declare class IntegrationManager {
+    private readonly options;
+    private readonly homeDir;
+    private readonly codexAuthHelper;
+    constructor(options: IntegrationManagerOptions);
+    listStatus(): Promise<IntegrationClientStatus[]>;
+    plan(client: IntegrationClientId, configPath?: string): Promise<IntegrationChangePlan>;
+    install(client: IntegrationClientId, configPath?: string): Promise<IntegrationClientStatus>;
+    repair(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    remove(client: IntegrationClientId): Promise<IntegrationClientStatus>;
+    /** Bind a user-confirmed access key and grant only this client's required endpoints. */
+    bindIntegrationKey(client: IntegrationClientId, keyId: string): Promise<IntegrationClientStatus>;
+    /** Rotate every Omnicross-managed client binding; user-selected keys remain untouched. */
+    rotateGatewayKey(): Promise<{
+        keyIds: Partial<Record<IntegrationClientId, string>>;
     }>;
-    status(): FileCodexImageCapabilityEvidenceStatus;
-    ttlMs(): number;
-    /** Lifecycle-symmetric no-op; physical safety no longer depends on local leases. */
-    dispose(): void;
+    /** Resolve the plaintext only for the command-auth helper; callers must not log it. */
+    getIntegrationToken(client: IntegrationClientId): Promise<string>;
+    /**
+     * Resolve ONE access key's plaintext by id — the `--key-id` variant the
+     * command-auth helper serves for key-scoped Codex launches (each terminal
+     * picks its own gateway key, so concurrent sessions can route to different
+     * upstreams through their keys' bindings). Enforces the SAME usability
+     * contract as the client-bound path: existing, enabled, not revoked,
+     * revealable, and holding the codex-required endpoint permissions.
+     */
+    getKeyToken(keyId: string): Promise<string>;
+    /** Compatibility alias for callers predating per-client bindings. */
+    getGatewayToken(client?: IntegrationClientId): Promise<string>;
+    private ensureClientKey;
+    private createManagedClientKey;
+    private installedSecret;
+    private rebindInstalledClient;
+    private statusFor;
+    private boundKeyDetails;
+    private retireManagedKeys;
+    private defaultConfigPath;
+    private renderInstalled;
 }
 
-interface FileImageReferenceStoreLimits {
-    readonly ttlMs: number;
-    readonly maxArtifactBytes: number;
-    readonly maxTotalBytes: number;
-    readonly maxTenantBytes: number;
-    readonly maxEntries: number;
-    readonly maxTombstones: number;
-    readonly tombstoneTtlMs: number;
-}
-interface FileImageReferenceStoreOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly limits: FileImageReferenceStoreLimits;
-    readonly secretBox?: SecretBox;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
-}
-interface FileImageReferenceReconciliationResult {
-    readonly metadataRemoved: number;
-    readonly metadataDegradedToProviderReference: number;
-    readonly orphanFilesRemoved: number;
-    readonly incompleteFilesRemoved: number;
-    readonly invalidDescendants: number;
-}
-declare class FileImageReferenceStore implements ImageReferenceStore {
-    #private;
-    constructor(options: FileImageReferenceStoreOptions);
-    save(input: ImageReferenceSaveInput): Promise<ImageReferenceMetadata>;
-    /** Generation-bound write entry point; reads and maintenance remain shared. */
-    saveWithLimits(input: ImageReferenceSaveInput, limits: FileImageReferenceStoreLimits): Promise<ImageReferenceMetadata>;
-    /** Updates only app-session maintenance policy; pinned writes pass their own limits. */
-    updateMaintenanceLimits(limits: FileImageReferenceStoreLimits): void;
-    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
-    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
-    /** Daemon-internal cleanup path; accepts only the local reference-domain tenant HMAC. */
-    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
-    cleanup(now?: number): Promise<number>;
-    status(): {
-        readonly entries: number;
-        readonly bytes: number;
-        readonly tombstones: number;
-    };
-    hasLiveReferenceByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId, now?: number): Promise<boolean>;
-    reconcileOwnedFiles(maxEntries: number): Promise<FileImageReferenceReconciliationResult>;
-    openArtifact(fileName: string, byteLength: number, signal?: AbortSignal): Promise<ReadableStream<Uint8Array>>;
-    private exclusive;
-    private tenantKey;
-    private newReferenceId;
-    private validateSaveInput;
-    private selectVictims;
-    private nextTombstones;
-    private writeArtifact;
-    private artifactPath;
-    private validArtifact;
-    private removeArtifact;
-    private safeUnlinkArtifactPath;
-    private releaseLease;
-    private manifestPath;
-    private persist;
-    private atomicReplace;
-    private loadManifest;
-}
+/**
+ * accountsAntigravityOAuth — the daemon admin API's ANTIGRAVITY interactive
+ * OAuth path (`POST /accounts/antigravity/oauth/start` +
+ * `GET /accounts/antigravity/oauth/:sessionId/status`).
+ *
+ * Modeled on the codex loopback flow (`accountsCodexOAuth`): antigravity's
+ * redirect is a FIXED loopback `http://127.0.0.1:51121/oauth-callback`, so the
+ * flow is ASYNC + POLLED — `start` arms the one-shot loopback listener, kicks
+ * the capture→exchange→email→project-handshake→persist chain off ASYNC, and
+ * returns ONLY `{ authUrl, sessionId }` (public — client_id + state). The app
+ * opens `authUrl`; the browser redirects to the loopback; the daemon captures
+ * the `code`, validates `state`, exchanges it, resolves the userinfo email and
+ * the Code Assist project (the antigravity dialect of the shared resolver),
+ * and persists the minted token through the encrypted credential store. The
+ * app POLLS `status` until `done`/`error`.
+ *
+ * SECRET SPINE (same invariant as codex/grok): the minted access/refresh token
+ * NEVER crosses to the client — it lands ONLY in the encrypted store. The
+ * poll `status` body is TOKEN-FREE (`{ state, message? }`). Port 51121 is a
+ * single resource → only ONE antigravity sign-in may be in flight (409).
+ *
+ * REUSES the `@omnicross/subscriptions` antigravity flow + the CLI's
+ * `awaitLoopbackCode` listener (parameterized binding) — it does NOT rebuild
+ * the authorize/exchange/handshake logic.
+ *
+ * @module @omnicross/daemon/admin/accountsAntigravityOAuth
+ */
 
-interface FileResponsesImageStateStoreLimits {
-    readonly maxCalls: number;
-    readonly maxResponses: number;
-    readonly maxTombstones: number;
-    readonly tombstoneTtlMs: number;
-}
-interface FileResponsesImageStateStoreOptions {
-    readonly paths: DaemonImagePathResolver;
-    readonly limits: FileResponsesImageStateStoreLimits;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceManifest?: (targetPath: string, contents: Uint8Array) => void;
-}
-interface PendingResponsesImageReferenceDelete {
-    readonly referenceTenantKey: string;
-    readonly binding: ResponsesImageCallBinding;
-}
-/** Durable production implementation of the existing Responses image-state contract. */
-declare class FileResponsesImageStateStore implements ResponsesImageStateStore {
-    #private;
-    constructor(options: FileResponsesImageStateStoreOptions);
-    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
-    /** Generation-bound write entry point; reads and maintenance remain shared. */
-    commitWithLimits(input: ResponsesImageStateCommitInput, limits: FileResponsesImageStateStoreLimits): Promise<readonly ResponsesImageCallBinding[]>;
-    /** Updates only app-session maintenance policy; pinned commits pass their own limits. */
-    updateMaintenanceLimits(limits: FileResponsesImageStateStoreLimits): void;
-    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
-    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
-    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
-    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
-    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
-    pendingReferenceDeletes(limit?: number): readonly PendingResponsesImageReferenceDelete[];
-    acknowledgeReferenceDeletes(completed: readonly PendingResponsesImageReferenceDelete[]): Promise<number>;
-    reconcileBrokenReferenceLinks(hasLiveReference: (referenceTenantKey: string, referenceId: ResponsesImageCallBinding['referenceId']) => Promise<boolean>, maxEntries: number): Promise<readonly ResponsesImageCallBinding[]>;
-    status(): {
-        readonly calls: number;
-        readonly responses: number;
-        readonly tombstones: number;
-        readonly pendingReferenceDeletes: number;
-    };
-    private exclusive;
-    private failure;
-    private assertCommit;
-    private tenantKey;
-    private rememberTombstone;
-    private enqueuePendingReferenceDelete;
-    private hasTombstone;
-    private prunedTombstones;
-    private pruneTombstonesInPlace;
-    private sameTombstones;
-    private touch;
-    private releaseCall;
-    private releaseResponse;
-    private manifestPath;
-    private persist;
-    private atomicReplace;
-    private loadManifest;
-}
+/** The loopback-listener fn (injected so tests need not bind a real port). */
+type AntigravityLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
 
-interface ImageStorageMountBackend {
-    readonly id: string;
-    readonly createdAt: number;
-    readonly resolver: DaemonImagePathResolver;
-    readonly references: FileImageReferenceStore;
-    readonly responsesState: FileResponsesImageStateStore;
-}
-interface ImageStorageMountCatalogOptions {
-    readonly pathOptions: Omit<CreateDaemonImagePathResolverOptions, 'storageRoot'>;
-    readonly activeStorageRoot?: string;
-    readonly referenceLimits: FileImageReferenceStoreLimits;
-    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
-    readonly secretBox?: SecretBox;
-    readonly now?: () => number;
-    readonly random?: (bytes: number) => Buffer;
-    readonly replaceCatalog?: (targetPath: string, contents: Uint8Array) => void;
-    readonly reconcileCorruptManifests?: boolean;
-}
-interface ImageStorageMountPolicy {
-    readonly referenceLimits: FileImageReferenceStoreLimits;
-    readonly responsesStateLimits: FileResponsesImageStateStoreLimits;
-}
-interface PreparedImageStorageMountActivation {
-    readonly backend: ImageStorageMountBackend;
-    publish(): ImageStorageMountBackend;
-    rollback(): void;
-    dispose(): void;
-}
-/** Owns the durable-root set independently from any one runtime generation. */
-declare class ImageStorageMountCatalog {
-    #private;
-    constructor(options: ImageStorageMountCatalogOptions);
-    active(): ImageStorageMountBackend;
-    mountsForRead(): readonly ImageStorageMountBackend[];
-    status(): {
-        readonly mounts: number;
-        readonly retiredMounts: number;
-    };
-    startupReconciliationStatus(): {
-        readonly corruptManifestsQuarantined: number;
-    };
-    utilization(): {
-        readonly referenceEntries: number;
-        readonly referenceBytes: number;
-        readonly referenceTombstones: number;
-        readonly stateCalls: number;
-        readonly stateResponses: number;
-        readonly stateTombstones: number;
-        readonly pendingReferenceDeletes: number;
-    };
-    /** Pins a backend object until its owning runtime generation drains. */
-    retainBackend(backend: ImageStorageMountBackend): () => void;
-    activate(storageRoot?: string): ImageStorageMountBackend;
-    /** Prepare a validated backend without changing the catalog's active mount. */
-    prepareActivation(storageRoot?: string, policy?: ImageStorageMountPolicy): PreparedImageStorageMountActivation;
-    retireEmptyMount(mountId: string): boolean;
-    private createResolver;
-    private createBackend;
-    private applyMaintenancePolicy;
-    private newMountId;
-    private isManifestError;
-    private quarantineManifest;
-    private isVerifiedEmpty;
-    private catalogPath;
-    private persist;
-    private atomicReplace;
-    private loadCatalog;
+/**
+ * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
+ * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
+ *
+ * This is the EXTERNAL-terminal analogue of `commands/launch.ts`: it reuses the
+ * same `@omnicross/cli-launcher` builders (which register one route on the
+ * RESIDENT `ProviderProxy` and return the redirect env — `ANTHROPIC_BASE_URL` +
+ * a one-shot ROUTE token, codex's `-c base_url=…` overrides, etc.), then opens a
+ * NEW terminal window running the CLI with that env injected. The route token —
+ * NOT an upstream credential — is the only secret in the env; it is removed when
+ * the session is stopped (`onSessionEnd`).
+ *
+ * SECRET DISCIPLINE: the env carries a route token (proxy-scoped, revocable),
+ * never a provider key. On win32 the token rides the spawned process environment
+ * (inherited by the terminal), never the command line / a file on disk.
+ *
+ * KEY-SCOPED LAUNCH (`{ keyId }` body, codex only): instead of a route lease, the
+ * terminal's Codex authenticates to the RESIDENT outbound gateway as ONE chosen
+ * access key, so routing follows that key's gateway bindings. Concurrent
+ * terminals can then use different keys (hence different upstreams) at once.
+ * The redirect rides `-c` overrides reusing the INSTALLED provider name
+ * (`omnicross`) plus a `--key-id`-scoped auth command; no secret ever enters the
+ * spawned env (Codex invokes the helper itself).
+ *
+ * @module @omnicross/daemon/admin/cliLaunch
+ */
+
+/** Injectable PATH probe (tests stub this; default scans `process.env.PATH`). */
+type PathProbe = (candidate: string) => string | null;
+/** Open a NEW terminal window running `command [extraArgs…]` with `env` injected. */
+type TerminalCleanup = () => void;
+type TerminalOpener = (input: {
+    cli: string;
+    command: string;
+    extraArgs: string[];
+    env: Record<string, string>;
+    cwd?: string;
+    platform: NodeJS.Platform;
+    onFailure?: () => void;
+}) => void | TerminalCleanup;
+/**
+ * Injectable shell runner for `POST /cli/:cli/install` (tests stub this; the
+ * default execs the install command with a bounded timeout). Returns the host's
+ * honest install outcome — `error` carries stderr/the failure reason.
+ */
+type CommandRunner = (command: string) => Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+
+/**
+ * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
+ * search-settings-tab D4).
+ *
+ * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
+ * `case 'search'`:
+ *
+ * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
+ *   snapshot: one row per provider the daemon can run (the ONE runtime's
+ *   descriptors, plus `unconfigured` rows for known API providers the persisted
+ *   config does not name — the doctor's classification), the effective frontend
+ *   modes, and the explicit apply semantics (codex immediate, rest restart).
+ * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
+ *   a configured provider, classified by the doctor's pure functions. The
+ *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
+ *   caller-supplied query, and never returns result content (plan §11.3 — its
+ *   contract is the automated doctor's fixed-query discipline).
+ * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
+ *   channel for the settings page's per-provider test panel (owner feedback
+ *   2026-09-02): ONE operator-typed query through ONE provider's contribution
+ *   built from the PERSISTED config, returning the doctor-classified diagnostic
+ *   PLUS the sanitized results. The two disciplines stay separate routes on
+ *   purpose: bending `/test` to accept a query would erase the boundary its
+ *   pinned tests and consumers depend on.
+ *
+ * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
+ * and a failure response carries only the doctor's SANITIZED error shape — raw
+ * upstream error bodies (which may quote the stored key) never serialize. The
+ * query endpoint additionally sanitizes every returned result field BEFORE
+ * serialization (plan §11.1: search results are untrusted input), and the
+ * operator's query is never logged anywhere.
+ *
+ * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
+ * that wire no search runtime get 501 for all routes (the voucher/allowance
+ * optionality precedent) rather than a fabricated snapshot.
+ *
+ * @module @omnicross/daemon/admin/searchAdminApi
+ */
+
+/**
+ * The daemon search state the admin surface needs. Structurally satisfied by
+ * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
+ * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
+ * without any network.
+ */
+interface SearchAdminRuntimeStatus {
+    /** The daemon's ONE assembled search runtime (provider descriptors). */
+    readonly runtime: SearchRuntime;
+    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
+    readonly modes: SearchFrontendModes;
+    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
+    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
 }
-declare class MountedImageReferenceStore implements ImageReferenceStore {
-    private readonly catalog;
-    private readonly writeBackend?;
-    private readonly writeLimits?;
-    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileImageReferenceStoreLimits | undefined);
-    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileImageReferenceStoreLimits): MountedImageReferenceStore;
-    status(): Readonly<{
-        referenceEntries: number;
-        referenceBytes: number;
-        referenceTombstones: number;
-        stateCalls: number;
-        stateResponses: number;
-        stateTombstones: number;
-        pendingReferenceDeletes: number;
-        mounts: number;
-        retiredMounts: number;
-    }>;
-    save(input: ImageReferenceSaveInput): Promise<_omnicross_contracts_image_generation_types.ImageReferenceMetadata>;
-    resolve(tenantId: string, referenceId: ImageReferenceId): Promise<ImageReferenceResolution>;
-    delete(tenantId: string, referenceId: ImageReferenceId): Promise<boolean>;
-    deleteByHashedTenantKey(tenantKey: string, referenceId: ImageReferenceId): Promise<boolean>;
-    cleanup(now?: number): Promise<number>;
+
+/**
+ * migration.ts — the export gather + import apply logic for the passphrase pack
+ * (app-parity child 6, design D2/D3/D5).
+ *
+ * EXPORT (`gatherExport`): read the FULL local state DECRYPTED in-memory — every
+ * provider row (scalars / modelConfigs / single apiKey / pool apiKeys /
+ * transformer) via `loadConfig` (the at-rest box decrypts on read) AND the
+ * subscription tokens via `credentialStore.getFullConfig()` (also decrypted) —
+ * serialize to ONE bundle JSON, and `sealPack` it under the passphrase-derived
+ * key. The caller returns ONLY the opaque pack; the decrypted bundle + the
+ * passphrase live only in local variables and are never logged.
+ *
+ * IMPORT (`applyImport`): `openPack` decrypts + authenticates (a wrong passphrase
+ * or a tampered pack fails the GCM auth-tag BEFORE any write — atomic). Every
+ * provider is re-validated through `parseProviderInput` and every token block
+ * through `validateTokenBody` (deny-by-default — a malicious blob cannot inject
+ * unknown fields or escape the allowlist). Validation collects ALL rows BEFORE
+ * applying, so a structurally invalid pack does not leave a half-applied state.
+ * Apply merges by provider id (additive default): a new id is added; a colliding
+ * id is skipped (or overwritten with `mode:'overwrite'`). Writes go through the
+ * EXISTING paths (`saveConfig` re-encrypts at-rest under the LOCAL box +
+ * `writeProviderTokens`/`appendProviderAccount`), so imported secrets land
+ * `enc:`-encrypted under the TARGET machine's key — the passphrase key is used
+ * ONLY for transport.
+ *
+ * SECRET SPINE: the export RESPONSE is the opaque pack ONLY; the import RESPONSE
+ * is status-only counts. No decrypted secret + no passphrase ever reaches a
+ * response body or a log here.
+ *
+ * @module @omnicross/daemon/migration/migration
+ */
+
+/**
+ * The credential-store surface the migration paths need: the full DECRYPTED read
+ * (export) + the multi-account append (import re-encrypts at-rest). One shape so
+ * `ExportDeps` + `ImportDeps` can be unified into `MigrationDeps` without a
+ * `credentialStore` type conflict.
+ */
+interface MigrationCredentialStore extends SubscriptionAccountAppender {
+    getFullConfig(): Promise<AccountTokensConfig>;
 }
-declare class MountedResponsesImageStateStore implements ResponsesImageStateStore {
-    private readonly catalog;
-    private readonly writeBackend?;
-    private readonly writeLimits?;
-    constructor(catalog: ImageStorageMountCatalog, writeBackend?: ImageStorageMountBackend | undefined, writeLimits?: FileResponsesImageStateStoreLimits | undefined);
-    bindWriteBackend(backend: ImageStorageMountBackend, limits: FileResponsesImageStateStoreLimits): MountedResponsesImageStateStore;
-    commit(input: ResponsesImageStateCommitInput): Promise<readonly ResponsesImageCallBinding[]>;
-    resolveCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallResolution>;
-    resolveResponse(tenantId: string, responseId: string): Promise<ResponsesImageResponseResolution>;
-    deleteCall(tenantId: string, callId: ResponsesImageCallId): Promise<ResponsesImageCallBinding | undefined>;
-    deleteResponse(tenantId: string, responseId: string): Promise<boolean>;
-    cleanup(now?: number): Promise<readonly ResponsesImageCallBinding[]>;
+
+/** Minimal, auth-gated admin API for secret-free account allowance snapshots. */
+
+interface AccountAllowanceAdminReader {
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }): Promise<AccountAllowanceSnapshot[]>;
+    refreshClaude(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Codex active `/wham/usage` refresh (absent on older daemons). */
+    refreshCodex?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Kimi `/coding/v1/usages` refresh (absent on older daemons). */
+    refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
+    refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
+    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Copilot user-quota refresh (absent on older daemons). */
+    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Gemini Code-Assist quota refresh (absent on older daemons). */
+    refreshGemini?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Antigravity quotaSummary refresh (absent on older daemons). */
+    refreshAntigravity?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
+    removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
+    getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
 }
 
-interface ImageDoctorLocalSnapshot {
-    readonly config: Readonly<{
-        enabled: boolean;
-        provider: ImageProviderId;
-        model: string;
-        valid: boolean;
-        errorCount: number;
-        /** Distinct providers the routing table names (doctor per-provider rows). */
-        routedProviders: readonly ImageProviderId[];
-    }>;
-    readonly roots: Readonly<{
-        valid: boolean;
-        verifiedAreas: number;
-        expectedAreas: number;
-    }>;
-    readonly stores: Readonly<{
-        valid: boolean;
-        mounts: number;
-        retiredMounts: number;
-        referenceEntries: number;
-        referenceBytes: number;
-        stateCalls: number;
-        stateResponses: number;
-        corruptManifestsQuarantined: number;
-    }>;
-    readonly permissions: Readonly<{
-        valid: boolean;
-        rows: number;
-        legacyRows: number;
-        invalidRows: number;
-        imagesAuthorizedRows: number;
-    }>;
-    /** The Codex-subscription account backing codex-routed image models. */
-    readonly account: Readonly<{
-        present: boolean;
-        usable: boolean;
-        reason: 'ready' | 'missing' | 'unavailable';
-    }>;
-    /** The Antigravity-subscription account backing NanoBanana image models. */
-    readonly antigravityAccount: Readonly<{
-        present: boolean;
-        usable: boolean;
-        reason: 'ready' | 'missing' | 'unavailable';
-    }>;
-    readonly evidence: Readonly<FileCodexImageCapabilityEvidenceStatus & {
-        valid: boolean;
-    }>;
+/** Token-free subscription account list entry (passthrough from core's service). */
+interface AdminAccountsLister {
+    listAll(): Promise<unknown[]>;
 }
-type ImageDoctorLiveFailureCode = 'images_disabled' | 'codex_account_unavailable' | 'evidence_store_unavailable' | 'evidence_persist_failed' | ImageGenerationErrorCode;
-type ImageDoctorLiveResult = Readonly<{
-    ok: true;
-    code: 'verified';
-    model: 'gpt-image-2';
-    quality: 'low';
-    outputFormat: 'png';
-    freshEvidenceEntries: number;
-}> | Readonly<{
-    ok: false;
-    code: ImageDoctorLiveFailureCode;
-}>;
-interface ImageDoctorService {
-    inspectLocal(config: ImagesServerConfig): Promise<ImageDoctorLocalSnapshot>;
-    verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
+/** One key's live cooldown health (mirrors core `KeyHealthEntry`; read-only). */
+interface PoolKeyHealth {
+    until: number;
+    errors: number;
+    lastStatus: number | null;
+}
+/**
+ * The READ-ONLY pool-health surface the admin view needs (key-pool design D7).
+ * Structurally satisfied by core's `ApiKeyPoolService.getKeyHealth`; typed as a
+ * minimal reader so `adminApi` carries no class coupling and can never reach a
+ * key value through it (cooldown health only).
+ */
+interface PoolHealthReader {
+    getKeyHealth(providerId: string): Promise<Record<string, PoolKeyHealth>>;
+}
+/**
+ * The BYO provider-key quota surface the keys view needs — structurally
+ * satisfied by `ProviderKeyQuotaService`. Read-only; the DTO is secret-free by
+ * construction (normalized windows + diagnostic codes only).
+ */
+interface ProviderKeyQuotaReader {
+    quotaFor(row: DaemonProviderConfig, keyId: string, options?: {
+        force?: boolean;
+    }): Promise<ProviderKeyQuota | null>;
+}
+interface AdminImagesStatusReader {
+    inspectCapability(apiKeyId: string): Promise<ImageRuntimeCapabilityInspection>;
+    status(): ImageRuntimeManagerStatus;
+    resourceStatus(): ImageRuntimeResourceStatus | undefined;
+}
+/** The live daemon handles the management API operates over. */
+interface AdminApiDeps {
+    /** Path to the daemon's `config.json` (provider catalog + `server` field). */
+    readonly configPath: string;
+    /** Live provider catalog (hot-reload target). */
+    readonly llmConfig: ConfigFileProviderConfigSource;
+    /** Named outbound-key store. */
+    readonly keyDb: OutboundKeyDb$1;
+    /**
+     * OPTIONAL voucher (redemption-card) store (voucher-redemption #9). When wired,
+     * the `/admin/api/voucher` surface can generate/list/revoke cards. Absent ⇒ the
+     * surface returns 501 (feature not available in this build).
+     */
+    readonly voucherDb?: VoucherDb;
+    /**
+     * OPTIONAL per-key spend reader (outbound-key-policy). When wired, the key list
+     * surfaces each key's OWN accumulated spend (daily/weekly/total) so the admin
+     * can see spend-vs-limit. Leak-safe: only the key's own numbers are exposed.
+     */
+    readonly keySpendReader?: KeySpendReader;
+    /** Outbound server settings store (server config persistence). */
+    readonly settingsStore: JsonApiServerSettingsStore;
+    /** The running outbound server (status + live applyConfig). */
+    readonly outboundApiServer: OutboundApiServer;
+    /** True only when production composed the hardened per-hop remote resolver. */
+    readonly imageRemoteResolverAvailable?: boolean;
+    /** Optional production Images runtime generation participant. */
+    readonly imageRuntimeConfig?: {
+        prepareConfig(config: ImagesServerConfig): Promise<PreparedServerConfigChange>;
+    };
+    /** Narrow metadata-only reader for authenticated Images capability/status. */
+    readonly imageRuntimeStatus?: AdminImagesStatusReader;
+    /**
+     * Explicitly-consuming live image verification (images-settings-tab D3) —
+     * delegates to the doctor service's `verifyLive` (Codex wire only). Absent
+     * on light embedders; the endpoint then responds 501 and consumes nothing.
+     */
+    readonly imageLiveVerifier?: {
+        verifyLive(config: ImagesServerConfig, signal: AbortSignal): Promise<ImageDoctorLiveResult>;
+    };
+    /** Metadata-only successful Images configuration audit sink. */
+    readonly imageConfigAudit?: (record: ImageConfigurationAuditRecord) => void;
+    /** Process-local machine-managed routing leases (optional for light embedders). */
+    readonly routeLeaseManager?: RouteLeaseManager;
+    /** Subscription accounts (token-free `listAll`). */
+    readonly subscriptionAccounts: AdminAccountsLister;
+    /**
+     * Secret-free upstream allowance facade. Optional for lightweight embedders;
+     * the standalone daemon wires it and the route returns 501 when absent.
+     */
+    readonly accountAllowanceService?: AccountAllowanceAdminReader;
+    /** Live Claude cache worker; hot-reconfigured with allowance scheduling. */
+    readonly allowanceRefreshScheduler?: Pick<ClaudeAllowanceRefreshScheduler, 'configure'>;
+    /** Optional secret-free account connection probe + rolling history surface. */
+    readonly accountProbeService?: AccountProbeHistoryReader & {
+        probeAccount(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+        }>;
+        testAccountConnection(providerId: _omnicross_contracts_subscription_types.SubscriptionProviderId, accountId: string): Promise<{
+            ok: boolean;
+            marked: boolean;
+            tier: 'local' | 'upstream' | 'generation';
+            model?: string;
+        }>;
+    };
+    /**
+     * Least-authority subscription-token WRITER (design D4) — ONLY the mutation
+     * methods (`writeProviderTokens` / `clearProvider`), never a token-returning
+     * read. The token-free `subscriptionAccounts` lister stays separate so a GET
+     * handler can never reach a token through this dep.
+     */
+    readonly subscriptionTokenWriter: SubscriptionTokenWriter;
+    /**
+     * Read-only pool-health reader (key-pool design D7) — cooldown health only,
+     * never a key value. Drives `GET /admin/api/providers/:id/keys`.
+     */
+    readonly apiKeyPool: PoolHealthReader;
+    /** In-memory auto-disable store (design D5) — read-only for the health view. */
+    readonly autoDisableStore: AutoDisableStore;
+    /**
+     * OPTIONAL BYO provider-key quota service — same-key usage/quota probes for
+     * provider rows with a known adapter (Z.AI coding plan, MiniMax Token Plan).
+     * Absent ⇒ the keys view carries no `quota` field (light embedders).
+     */
+    readonly providerKeyQuota?: ProviderKeyQuotaReader;
+    /**
+     * Pending interactive-OAuth sessions (app-parity child 4, design D1) — the
+     * in-memory `{ codeVerifier, state }` map keyed by a minted `sessionId`,
+     * NEVER serialized to the client.
+     */
+    readonly oauthSessions: OAuthSessionStore;
+    /**
+     * Injected token-exchange `FetchLike` FACTORY (oauth design D2-a) — built per
+     * provider in `bootstrap.ts` so the exchange carries a `{ providerId }` egress
+     * ctx (per-provider proxy layer + upstream trace, bodies redacted); tests
+     * inject a mock so no real token endpoint is hit. Mirrors how `login.ts`
+     * injects its exchange fetch.
+     */
+    readonly oauthExchangeFetch: (providerId: SubscriptionProviderId) => FetchLike;
+    /**
+     * NARROW append handle (oauth design D2-a) — the OAuth complete handler needs
+     * `appendProviderAccount` (NOT on the least-authority `SubscriptionTokenWriter`).
+     * A minimal interface, NOT the full read-capable store, so no token-returning
+     * read is reachable. Wired from the concrete `credentialStore` in `bootstrap.ts`.
+     */
+    readonly subscriptionAccountAppender: SubscriptionAccountAppender;
+    /**
+     * Codex interactive-OAuth flow store (app-parity-2 child 5). Tracks the async
+     * loopback sign-in's polled status (token-free); only ONE codex login may be in
+     * flight (port 1455 is one resource). Wired in `bootstrap.ts`.
+     */
+    readonly codexSessions: CodexOAuthSessionStore;
+    /**
+     * Kimi interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly kimiSessions: CodexOAuthSessionStore;
+    /**
+     * Grok interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly grokSessions: CodexOAuthSessionStore;
+    /**
+     * Copilot interactive-OAuth flow store (device code). Same token-free
+     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly copilotSessions: CodexOAuthSessionStore;
+    /** Antigravity interactive OAuth (loopback 51121) — the async flow store. */
+    readonly antigravitySessions: CodexOAuthSessionStore;
+    /** The one-shot 127.0.0.1:51121 listener (test seam like `codexAwaitLoopback`). */
+    readonly antigravityAwaitLoopback: AntigravityLoopbackFn;
+    /**
+     * Resolve the ACTIVE antigravity account's access token for the dynamic
+     * model-catalog probe (secret used daemon-side only; the route is
+     * secret-free). Optional for older tests; absent → static-only catalog.
+     */
+    readonly resolveAntigravityAccessToken?: () => Promise<string | null>;
+    /**
+     * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
+     * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port
+     * is bound. The captured code crosses to the daemon ONLY (never the client).
+     */
+    readonly codexAwaitLoopback: CodexLoopbackFn;
+    /**
+     * Migration credential-store handle (app-parity child 6, design D2/D3). The
+     * export gather needs `getFullConfig()` (full DECRYPTED tokens, in-memory only —
+     * the pack is the only thing that leaves) and import needs `appendProviderAccount`
+     * (multi-account append + re-encrypt at-rest). Confined to the migration
+     * handlers (which seal/validate everything); never reached by a GET handler.
+     * Wired from the concrete `credentialStore` in `bootstrap.ts`.
+     */
+    readonly migrationCredentialStore: MigrationCredentialStore;
+    /**
+     * Usage-stats query facade (usage-pricing child) — delegates to the JSONL
+     * usage-event store. Aggregates only; carries no key material.
+     */
+    readonly usageRecorder: UsageRecorder;
+    /** Pricing engine (upsert / source refresh / conflict resolution). */
+    readonly pricingEngine: PricingEngine;
+    /**
+     * CONCRETE pricing store — ONLY for the store-local row `delete` (the core
+     * `PricingStore` port is frozen; delete is a daemon-local extra).
+     */
+    readonly pricingStore: JsonPricingStore;
+    /**
+     * External-terminal opener for the Code CLI launch route (dashboard parity).
+     * Optional — defaults to the real `defaultTerminalOpener`; tests inject a spy so
+     * no terminal window is actually spawned.
+     */
+    readonly cliTerminalOpener?: TerminalOpener;
+    /** Injectable PATH probe for CLI detection (tests fake "installed"). */
+    readonly cliPathProbe?: PathProbe;
+    /**
+     * Injectable shell runner for the Code CLI install route. Optional — defaults
+     * to the real `exec`-based runner; tests inject a stub so no package manager
+     * actually runs.
+     */
+    readonly cliCommandRunner?: CommandRunner;
+    /**
+     * Codex command-auth helper invocation for KEY-SCOPED launches (the `--key-id`
+     * variant). Wired by bootstrap from the same inputs as the integration
+     * install's helper; absent ⇒ `keyId` launches answer 501 (light embedders).
+     */
+    readonly codexAuthHelper?: CodexAuthHelperConfig;
+    /** Factory so each request observes the outbound server's current loopback port. */
+    readonly integrationManagerFactory?: () => IntegrationManager;
+    /**
+     * search-settings-ui D3: the daemon's ONE search runtime plus its
+     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
+     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
+     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     */
+    readonly searchStatus?: SearchAdminRuntimeStatus;
+}
+/**
+ * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
+ * (no query). The auth gate has already run in `AdminServer`.
+ */
+declare function handleAdminApi(req: http.IncomingMessage, res: http.ServerResponse, path: string, deps: AdminApiDeps): Promise<void>;
+
+/**
+ * AdminServer — the daemon's localhost admin/dashboard HTTP listener (RT3,
+ * design D1/D2).
+ *
+ * A SEPARATE `node:http` listener distinct from core's outbound `/v1/*` server
+ * (port 8765, untouched). Mirrors `OutboundApiServer`'s proven shape:
+ *  - `http.createServer`, default bind `127.0.0.1` (or `0.0.0.0` when
+ *    `networkBinding`), `listen` with `EADDRINUSE`→ephemeral(port 0) fallback,
+ *  - `getStatus()` (running / bound port / dashboard URL), `start` / `stop`.
+ * Default admin port 8766.
+ *
+ * Auth (design D2):
+ *  - Baseline = localhost bind, no token → reachable only from the machine.
+ *  - Optional `admin.token` → every `/admin/*` request (incl. `GET /`) must
+ *    carry `Authorization: Bearer <token>` or `X-Admin-Token: <token>`; compared
+ *    server-side with a constant-time equality → `401` on a miss.
+ *  - HARD SAFETY GATE: `networkBinding` (LAN/`0.0.0.0`) without a non-empty
+ *    `admin.token` → `start` REFUSES to bind (logs + stays down, fail closed).
+ *
+ * Routing: `GET /` (and `GET /admin`) → `302 /ui/`; `* /admin/api/*` → the
+ * management API (`handleAdminApi`); `GET /ui[/...]` → the Control Panel static
+ * UI (`handleUiStatic`, from `@omnicross/ui`); everything else → `404`.
+ *
+ * @module @omnicross/daemon/admin/AdminServer
+ */
+
+/** The dependencies the admin server + its API need (live daemon handles). */
+interface AdminServerDeps extends AdminApiDeps {
+    /** Authenticated Codex rollout/state database manager. */
+    codexSessionManager?: CodexSessionManager;
+    /** Read the resolved admin config (enabled/port/networkBinding/token). */
+    getAdminConfig: () => ResolvedAdminConfig;
+    /**
+     * Build the coarse, secret-free `/health` report (daemon-health-endpoint). A
+     * shared closure over live handles (bootstrap wires the SAME builder into the
+     * outbound server), served UNAUTHENTICATED — before the admin auth gate.
+     */
+    getHealthReport: () => HealthReport;
+    /**
+     * Injected logger (configurable-logging) — the admin listener's OWN lifecycle
+     * lines (bind/refuse/error) route through it so they honor the configured
+     * level / format / file sink.
+     */
+    logger: Logger;
+    /**
+     * OPTIONAL per-account probe-history reader (subscription-account-probe #8,
+     * design D5). When wired (bootstrap → the `AccountHealthProbeScheduler`), the
+     * AUTHED `GET /admin/api/account-probes` returns per-account probe history.
+     * Absent ⇒ the route serves an empty list (byte-safe for embedders/tests that
+     * do not wire it). Read-only + secret-free (ids + status labels, no tokens).
+     */
+    probeHistoryReader?: AccountProbeHistoryReader;
+    /**
+     * OPTIONAL audit query reader (request-audit-log, design D6). When wired
+     * (bootstrap → the date-rotated store), the AUTHED `GET /admin/api/audit`
+     * returns filtered records. Absent ⇒ the route serves an empty list. The
+     * records carry IP/UA/bodies → this route is behind the auth gate ONLY, NEVER
+     * unauthenticated, NEVER on `/health`.
+     */
+    auditReader?: AuditQueryReader;
+    /** Metadata-only audit aggregate used by the overview error-rate metric. */
+    auditStatsReader?: AuditStatsReader;
+    /**
+     * Reconstructs one record's bodies from the per-session shard store
+     * (audit-store-sharding). Absent when audit was never enabled.
+     */
+    auditBodyReader?: AuditBodyReader;
+    /** Runs cross-session body compaction on demand (audit-store-sharding D8). */
+    auditCompactor?: AuditCompactor;
+    /**
+     * OPTIONAL billing delivery-status reader (billing-event-stream, design D5).
+     * When wired (bootstrap → the ledger dir), the AUTHED `GET /admin/api/billing-status`
+     * returns secret-free total/delivered/pending counts. Absent ⇒ zeroed counts.
+     */
+    billingStatusReader?: BillingStatusReader;
+}
+/** A live status snapshot for the admin listener. */
+interface AdminServerStatus {
+    running: boolean;
+    /** Actual bound port (0 when not running). */
+    port: number;
+    /** The dashboard URL (loopback or LAN base), or null when not running. */
+    url: string | null;
+}
+declare class AdminServer {
+    private readonly deps;
+    private server;
+    private boundPort;
+    private boundAddr;
+    /** Control Panel dist dir (resolved once at first request; null = no UI). */
+    private uiDist;
+    constructor(deps: AdminServerDeps);
+    /**
+     * Start the admin listener honoring the resolved admin config. Returns the
+     * actual bound port, or `0` when it refuses/declines to bind (disabled or the
+     * LAN fail-closed gate). Idempotent: a second call returns the bound port.
+     */
+    start(): Promise<number>;
+    /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
+    private listen;
+    /** Per-request handler: auth gate (when a token is set) → routing. */
+    private onRequest;
+    private dispatch;
+    /** Constant-time bearer/header check against the configured token. */
+    private isAuthorized;
+    /** Stop the listener and release the port. */
+    stop(): Promise<void>;
+    /** A live status snapshot. */
+    getStatus(): AdminServerStatus;
 }
 
 interface ImageTemporaryBudgetStatus {
@@ -4185,6 +4347,7 @@ declare class JsonOutboundKeyDb implements OutboundKeyDb {
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
     outboundApiKeysSetPermissions(id: string, permissions: OutboundPermission[]): Promise<boolean>;
     outboundApiKeysSetMaxConcurrency(id: string, maxConcurrency: number | null): Promise<boolean>;
+    outboundApiKeysSetUpstream(id: string, target: GatewayBindingTarget | null): Promise<boolean>;
     outboundApiKeysSetPolicy(id: string, policy: OutboundKeyPolicy): Promise<boolean>;
     outboundApiKeysMarkActivated(id: string, activatedAt: number): Promise<boolean>;
     /** Apply `fn` to the row with `id`, persisting when it returns true. */
@@ -4800,6 +4963,8 @@ interface DaemonPaths {
     imageRuntimeConfig?: AdminApiDeps['imageRuntimeConfig'];
     /** TEST/COMPOSITION SEAM: metadata-only Images status reader. */
     imageRuntimeStatus?: AdminApiDeps['imageRuntimeStatus'];
+    /** TEST/COMPOSITION SEAM: explicitly-consuming Images live verifier. */
+    imageLiveVerifier?: AdminApiDeps['imageLiveVerifier'];
     /** TEST/COMPOSITION SEAM: metadata-only successful Images config audit sink. */
     imageConfigAudit?: AdminApiDeps['imageConfigAudit'];
     /** TEST ONLY: deterministic Tier-A provider inside the production Images composition. */
@@ -4870,6 +5035,8 @@ interface Daemon {
     readonly usageRecorder: UsageRecorder;
     /** The localhost admin/dashboard HTTP listener (RT3). Started by `start.ts`. */
     readonly adminServer: AdminServer;
+    /** Codex JSONL + state_5.sqlite session provider manager. */
+    readonly codexSessionManager: CodexSessionManager;
     /**
      * Proactive background OAuth refresh sweep (external-cli-sync). NOT started
      * here — `start.ts` arms it for the resident daemon; the short-lived `launch`
@@ -5186,4 +5353,4 @@ declare function mapCcrToOmnicross(ccr: CcrConfig): {
     notes: string[];
 };
 
-export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type CcrConfig, type CcrProvider, type CcrRouter, ConfigFileProviderConfigSource, ConfigurableLogger, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, type HealthReportDeps, type HostedImageContributionFactory, type HostedImageRuntimeGenerationLease, type ImageApiMetricDimensions, type ImageApiMetricSnapshot, type ImageExecutionMetricDimensions, type ImageExecutionMetricSnapshot, type ImageHistogramSnapshot, ImageObservability, type ImageObservabilityOptions, type ImageObservabilitySnapshot, type ImageRuntimeCapabilityInspection, type ImageRuntimeGenerationFactoryOptions, type ImageRuntimeGenerationSharedStorage, ImageRuntimeManager, type ImageRuntimeManagerStatus, type ImageRuntimeMetadataObservability, type ImageRuntimeResourceStatus, type ImageRuntimeSafeUnavailableReason, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type PreparedImageRuntimeChange, type PreparedImageRuntimeGeneration, type ProductionImageRuntimeComponents, type ProductionImageRuntimeGeneration, type ResolvedAdminConfig, type TrustedImageApiRuntimeResolver, type TrustedImageApiRuntimeResolverOptions, buildDaemon, buildHealthReport, createHostedImageContributionFactory, createImageRuntimeGeneration, createTrustedImageApiRuntimeResolver, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };
+export { type AdminApiDeps, AdminServer, type AdminServerDeps, type AdminServerStatus, type ApplyCodexSessionProviderInput, type CcrConfig, type CcrProvider, type CcrRouter, type CodexSessionListResult, CodexSessionManager, CodexSessionManagerError, type CodexSessionManagerOptions, type CodexSessionProviderApplyResult, type CodexSessionProviderPlan, type CodexSessionProviderPreview, type CodexSessionSummary, type CodexStateDatabaseStatus, ConfigFileProviderConfigSource, ConfigurableLogger, ConsoleLogger, DEFAULT_ADMIN_PORT, type Daemon, type DaemonAdminConfig, type DaemonApiFormat, type DaemonConfig, type DaemonPaths, type DaemonProviderConfig, type HealthReportDeps, type HostedImageContributionFactory, type HostedImageRuntimeGenerationLease, type ImageApiMetricDimensions, type ImageApiMetricSnapshot, type ImageExecutionMetricDimensions, type ImageExecutionMetricSnapshot, type ImageHistogramSnapshot, ImageObservability, type ImageObservabilityOptions, type ImageObservabilitySnapshot, type ImageRuntimeCapabilityInspection, type ImageRuntimeGenerationFactoryOptions, type ImageRuntimeGenerationSharedStorage, ImageRuntimeManager, type ImageRuntimeManagerStatus, type ImageRuntimeMetadataObservability, type ImageRuntimeResourceStatus, type ImageRuntimeSafeUnavailableReason, JsonApiServerSettingsStore, JsonOutboundKeyDb, JsonSubscriptionCredentialStore, type PreparedImageRuntimeChange, type PreparedImageRuntimeGeneration, type ProductionImageRuntimeComponents, type ProductionImageRuntimeGeneration, type ResolvedAdminConfig, type TrustedImageApiRuntimeResolver, type TrustedImageApiRuntimeResolverOptions, buildDaemon, buildHealthReport, createHostedImageContributionFactory, createImageRuntimeGeneration, createTrustedImageApiRuntimeResolver, handleAdminApi, inferApiFormat, loadConfig, mapCcrToOmnicross, parseCcrConfig, replaceStructuredProviderFields, resetDaemonSingletonsForTests, resolveAdminConfig, saveConfig, validateConfig };