@nijaru/pi-search 0.0.8 → 0.0.9

package/README.md

@@ -56,11 +56,50 @@ location, live-access, and content-type controls when requested.
 
 ## Configuration
 
-The extension reads credentials only at construction or through Pi's model
-registry; it never logs keys. Keys can live in a shell-local secret injector
-(e.g. `fnox`) rather than global environment files — because providers are
-registered only when their key is present at construction, an unset
-variable simply leaves that provider disabled.
+Direct-provider keys can come from environment variables or from shell
+commands in the optional user-only file
+`~/.pi/agent/pi-search/credentials.json` (under `getAgentDir()` when
+`PI_CODING_AGENT_DIR` is set). For example, with Fnox installed:
+
+```json
+{
+  "EXA_API_KEY": "!fnox --config \"$HOME/.config/fnox/config.toml\" --profile pi --no-defaults --if-missing error --non-interactive get EXA_API_KEY",
+  "BRAVE_API_KEY": "!fnox --config \"$HOME/.config/fnox/config.toml\" --profile pi --no-defaults --if-missing error --non-interactive get BRAVE_API_KEY"
+}
+```
+
+Any shell command that prints a key can be used; Fnox is not a dependency.
+The file must be a flat object whose only supported names are `BRAVE_API_KEY`,
+`EXA_API_KEY`, `DEEPSEEK_API_KEY`, `PARALLEL_API_KEY`, `X_API_BEARER_TOKEN`, and
+`CLOUDFLARE_API_TOKEN`. Values must be nonempty `!<shell command>` references,
+not plaintext keys. Do not embed secrets in the commands either.
+`CLOUDFLARE_ACCOUNT_ID` and all billing/enable settings remain environment
+variables; credentials alone do not enable spending or opt-in providers.
+
+**Treat this file as executable code.** Keep it writable only by your user and
+review its commands. No project credentials file is loaded. Commands run with
+Pi's permissions and inherited environment, from the agent directory, using
+`/bin/sh` on macOS/Linux or `cmd.exe` on Windows—not your interactive Fish
+configuration. Use installed executables on Pi's `PATH` or absolute paths;
+commands must not require terminal input.
+
+Commands run once per extension load, concurrently, before tools are registered,
+including loads outside a session. Each has a 10-second timeout and a 16 KiB
+stdout limit. Trimmed stdout becomes the private adapter credential; stderr is
+discarded. Keys are not written to `process.env` or logged. Ordinary subprocess
+cleanup uses a dedicated process group on macOS/Linux and `taskkill /t` on
+Windows; commands must not launch detached daemons. Windows tree cleanup after
+a shell has already exited is best-effort.
+
+A configured command overrides the corresponding inherited variable. Invalid
+JSON, unsupported names, literal/nonstring values, command failure, empty
+stdout, timeout, or excessive output fails extension loading with a sanitized
+error—never an env fallback. A missing file or omitted entry preserves env
+support, including its existing whitespace handling. Restart Pi or run `/reload`
+to pick up changes or refreshed keys; there is no per-request refresh. Native
+provider auth still resolves through Pi's model registry at request time.
+
+Alternatively, configure direct keys and routing settings in the environment:
 
 ```bash
 # Optional metered search for non-native/local models
@@ -170,9 +209,9 @@ are then enforced locally on results that report a date. Results with a known
 publication date are filtered to the requested inclusive range; undated
 results remain visible with an explicit warning.
 
-The adapter reads `DEEPSEEK_API_KEY` from the environment, like the other
-direct providers. A DeepSeek login stored only in Pi's model registry does not
-register it.
+The adapter receives `DEEPSEEK_API_KEY` from the environment or the user
+credentials command file, like the other direct providers. A DeepSeek login
+stored only in Pi's model registry does not register it.
 
 ### Local and virtual models
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nijaru/pi-search",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Provider-neutral web search and fetching tools for Pi",
   "type": "module",
   "license": "MIT",
@@ -41,9 +41,9 @@
     "live:smoke": "bun scripts/live-smoke.ts"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.4.0",
-    "@earendil-works/pi-coding-agent": "1.4.0",
-    "@earendil-works/pi-tui": "1.4.0",
+    "@earendil-works/pi-ai": "1.5.0",
+    "@earendil-works/pi-coding-agent": "1.5.0",
+    "@earendil-works/pi-tui": "1.5.0",
     "@types/bun": "1.3.14",
     "@types/turndown": "^5.0.6",
     "typebox": "1.3.10",

package/src/brave-answers.ts

@@ -53,7 +53,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "usage-based",
 };
 

package/src/brave.ts

@@ -164,7 +164,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "per-request",
 };
 

package/src/cloudflare.ts

@@ -37,7 +37,7 @@ export interface CloudflareAdapterOptions {
 
 const capabilities: ProviderCapabilities = { semantic: true, excerpts: true };
 // BYOK agreements and gateway credits do not establish actual billed costs.
-const profile: ProviderProfile = { auth: "environment", costModel: "unknown" };
+const profile: ProviderProfile = { auth: "direct", costModel: "unknown" };
 const unsupportedOptions = [
 	"domains", "dateRange", "social", "executionModel", "searchContextSize",
 	"returnTokenBudget", "externalWebAccess", "userLocation", "searchContentTypes", "imageSettings",

package/src/contracts.ts

@@ -95,7 +95,8 @@ export interface ProviderProfile {
 	readonly typicalLatencyMs?: number;
 	readonly estimatedCostUsd?: number;
 	readonly costModel: "free" | "per-request" | "usage-based" | "unknown";
-	readonly auth: "none" | "environment" | "modelRegistry";
+	/** Direct credentials are supplied at construction, from env or a user command. */
+	readonly auth: "none" | "direct" | "modelRegistry";
 }
 
 /** A single provider-reported quota or rate-limit window. */

package/src/credentials.ts

@@ -0,0 +1,134 @@
+import { spawn, execFile, type ChildProcess } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+const SECRET_NAMES = [
+	"BRAVE_API_KEY",
+	"EXA_API_KEY",
+	"DEEPSEEK_API_KEY",
+	"PARALLEL_API_KEY",
+	"X_API_BEARER_TOKEN",
+	"CLOUDFLARE_API_TOKEN",
+] as const;
+type SecretName = (typeof SECRET_NAMES)[number];
+export type DirectCredentials = Readonly<Partial<Record<SecretName, string>>>;
+const TIMEOUT_MS = 10_000;
+const MAX_STDOUT_BYTES = 16_384;
+
+function configError(message: string): Error {
+	// Never attach original errors: JSON parsers and subprocess errors can include secrets.
+	return new Error(`pi-search credentials.json: ${message}`);
+}
+
+async function killProcessTree(child: ChildProcess): Promise<void> {
+	if (child.pid === undefined) return;
+	if (process.platform === "win32") {
+		await new Promise<void>((resolve) => {
+			execFile("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+				timeout: 1_000, windowsHide: true, maxBuffer: 1_024,
+			}, () => resolve());
+		});
+	} else {
+		// The shell and its ordinary descendants share a dedicated process group.
+		try { process.kill(-child.pid, "SIGKILL"); } catch { /* group already gone */ }
+	}
+	try { child.kill("SIGKILL"); } catch { /* process already gone */ }
+}
+
+function resolveCommand(name: SecretName, command: string, agentDir: string, env: NodeJS.ProcessEnv): Promise<string> {
+	return new Promise((resolve, reject) => {
+		let child: ChildProcess;
+		try {
+			child = spawn(command, {
+				shell: true,
+				cwd: agentDir,
+				env,
+				stdio: ["ignore", "pipe", "ignore"],
+				detached: process.platform !== "win32",
+				windowsHide: true,
+			});
+		} catch {
+			reject(configError(`${name} command could not start`));
+			return;
+		}
+		const chunks: Buffer[] = [];
+		let bytes = 0;
+		let failure: Error | undefined;
+		let cleanup: Promise<void> | undefined;
+		let settled = false;
+		let cleanupTimer: ReturnType<typeof setTimeout> | undefined;
+		const stop = (): Promise<void> => cleanup ??= killProcessTree(child);
+		const finish = async (code: number | null): Promise<void> => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			if (cleanupTimer !== undefined) clearTimeout(cleanupTimer);
+			await stop();
+			child.stdout?.destroy();
+			if (failure !== undefined) return reject(failure);
+			if (code !== 0) return reject(configError(`${name} command failed`));
+			const value = Buffer.concat(chunks, bytes).toString("utf8").trim();
+			if (value.length === 0) return reject(configError(`${name} command returned empty output`));
+			resolve(value);
+		};
+		const fail = (reason: string): void => {
+			if (settled || failure !== undefined) return;
+			failure = configError(`${name} command ${reason}`);
+			void stop();
+			child.stdout?.destroy();
+			// A detached descendant can retain a pipe after the shell has exited.
+			cleanupTimer = setTimeout(() => { void finish(null); }, 1_500);
+		};
+		const timer = setTimeout(() => fail("timed out (10s limit)"), TIMEOUT_MS);
+		child.stdout?.on("data", (chunk: Buffer) => {
+			if (failure !== undefined || settled) return;
+			bytes += chunk.length;
+			if (bytes > MAX_STDOUT_BYTES) return fail("exceeded the stdout limit (16 KiB)");
+			chunks.push(chunk);
+		});
+		child.stdout?.once("error", () => fail("output could not be read"));
+		child.once("error", () => fail("could not start"));
+		// Clean up background children even when the shell exits successfully.
+		child.once("exit", () => { void stop(); });
+		child.once("close", (code) => { void finish(code); });
+	});
+}
+
+/** Load only the user agent directory; never consult project config or mutate the environment. */
+export async function loadDirectCredentials(agentDir: string, env: NodeJS.ProcessEnv = process.env): Promise<DirectCredentials> {
+	const inherited = { ...env };
+	const credentials: Partial<Record<SecretName, string>> = {};
+	for (const name of SECRET_NAMES) {
+		// Keep existing env semantics: whitespace-only values are unavailable, but
+		// nonempty values are passed to adapters unchanged.
+		if (inherited[name] !== undefined) credentials[name] = inherited[name];
+	}
+	let text: string;
+	try {
+		text = await readFile(join(agentDir, "pi-search", "credentials.json"), "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return credentials;
+		throw configError("could not read configuration");
+	}
+	let config: unknown;
+	try { config = JSON.parse(text); } catch { throw configError("invalid JSON"); }
+	if (config === null || typeof config !== "object" || Array.isArray(config)) {
+		throw configError("expected a flat object of credential commands");
+	}
+	const commands: [SecretName, string][] = [];
+	for (const [name, value] of Object.entries(config)) {
+		if (!SECRET_NAMES.includes(name as SecretName)) throw configError("unsupported credential name");
+		if (typeof value !== "string" || !value.startsWith("!") || value.slice(1).trim().length === 0 || value.includes("\0")) {
+			throw configError(`${name} must be a nonempty !<shell command> reference, not a literal secret`);
+		}
+		commands.push([name as SecretName, value.slice(1)]);
+	}
+	// Validate everything first, then wait for every bounded command to clean up,
+	// including when another command fails. At most six commands run concurrently.
+	const results = await Promise.allSettled(commands.map(([name, command]) => resolveCommand(name, command, agentDir, inherited)));
+	for (const [index, result] of results.entries()) {
+		if (result.status === "rejected") throw result.reason;
+		credentials[commands[index]![0]] = result.value;
+	}
+	return credentials;
+}

package/src/deepseek.ts

@@ -41,7 +41,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "per-request",
 	estimatedCostUsd: DEEPSEEK_ESTIMATED_SEARCH_COST_USD,
 };

package/src/exa.ts

@@ -36,7 +36,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "usage-based",
 	estimatedCostUsd: EXA_ESTIMATED_SEARCH_COST_USD,
 };

package/src/fetch-tool.ts

@@ -1,7 +1,6 @@
-import { StringEnum } from "@earendil-works/pi-ai";
 import { defineTool, type ExtensionAPI, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
-import { Type, type Static, type TUnsafe } from "typebox";
+import { Type, type Static } from "typebox";
 import type { FetchRequest, FetchedContent } from "./contracts";
 import { toFetchToolError } from "./fetch-errors";
 import {
@@ -15,7 +14,7 @@ import {
 import { renderModelUrl, renderSafeUrl } from "./url-rendering";
 import { compactText } from "./render-text";
 
-const FetchFormatSchema = StringEnum(["markdown", "text", "html"] as const) as TUnsafe<"markdown" | "text" | "html">;
+const FetchFormatSchema = Type.Enum(["markdown", "text", "html"] as const, { type: "string" });
 
 export const WebFetchParameters = Type.Object({
 	url: Type.String({ minLength: 1, maxLength: 8_192, description: "HTTP(S) URL to fetch" }),
@@ -24,7 +23,7 @@ export const WebFetchParameters = Type.Object({
 	),
 	offset: Type.Optional(Type.Integer({ minimum: 0, maximum: MAX_FETCH_OFFSET, description: `Character offset for bounded paging (0-${MAX_FETCH_OFFSET})` })),
 	format: Type.Optional(FetchFormatSchema),
-	xMode: Type.Optional(StringEnum(["auto", "public", "browser", "direct"] as const, { description: "X URLs: auto prefers your authorized browser, otherwise free FxTwitter (sends the post ID). public uses FxTwitter; browser requires /search-x connect; direct bypasses both. No paid fallback." }) as TUnsafe<"auto" | "public" | "browser" | "direct">),
+	xMode: Type.Optional(Type.Enum(["auto", "public", "browser", "direct"] as const, { type: "string", description: "X URLs: auto prefers your authorized browser, otherwise free FxTwitter (sends the post ID). public uses FxTwitter; browser requires /search-x connect; direct bypasses both. No paid fallback." })),
 	maxPages: Type.Optional(Type.Integer({ minimum: 1, maximum: 500, description: "Maximum PDF pages to parse with the bounded page-limited PDF path" })),
 	captionLanguage: Type.Optional(Type.String({ minLength: 1, maxLength: 32, description: "YouTube caption language (default en)" })),
 	readable: Type.Optional(Type.Boolean({ description: "Extract the main readable article content (default true)" })),

package/src/index.ts

@@ -21,6 +21,7 @@ import { createXAIProvider } from "./xai";
 import { availableProviderHints } from "./provider-availability";
 import { registerWebResearch } from "./research-tool";
 import { registerWebSearch } from "./search-tool";
+import { loadDirectCredentials } from "./credentials";
 
 /**
  * Native grounding is selected for supported active models. Exa is the
@@ -28,8 +29,10 @@ import { registerWebSearch } from "./search-tool";
  * cheaper second metered path, and Brave is the paced last-resort keyword
  * path. Automatic availability failures may use one visible fallback.
  */
-export default function (pi: ExtensionAPI): void {
-	const braveKey = process.env.BRAVE_API_KEY;
+export default async function (pi: ExtensionAPI): Promise<void> {
+	const agentDir = getAgentDir();
+	const credentials = await loadDirectCredentials(agentDir);
+	const braveKey = credentials.BRAVE_API_KEY;
 	// Brave is a conservative last-resort path: pace starts at 1 RPS and never claims
 	// to know the account's billing balance. Set `=0` only with explicit metered
 	// opt-in when that pacing is intentionally not wanted.
@@ -43,15 +46,15 @@ export default function (pi: ExtensionAPI): void {
 	const xaiX = createXAIProvider({ tool: "x_search" });
 	const anthropic = createAnthropicProvider();
 	const meta = createMetaProvider();
-	const exaKey = process.env.EXA_API_KEY;
-	const deepseekKey = process.env.DEEPSEEK_API_KEY;
-	const parallelKey = process.env.PARALLEL_API_KEY;
-	const xToken = process.env.X_API_BEARER_TOKEN;
+	const exaKey = credentials.EXA_API_KEY;
+	const deepseekKey = credentials.DEEPSEEK_API_KEY;
+	const parallelKey = credentials.PARALLEL_API_KEY;
+	const xToken = credentials.X_API_BEARER_TOKEN;
 	const exa = createExaProvider({ apiKey: exaKey });
 	const deepseek = createDeepSeekProvider({ apiKey: deepseekKey });
 	const cloudflareUpstream = process.env.PI_SEARCH_CLOUDFLARE_PROVIDER;
 	const cloudflareAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
-	const cloudflareToken = process.env.CLOUDFLARE_API_TOKEN;
+	const cloudflareToken = credentials.CLOUDFLARE_API_TOKEN;
 	// Credentials alone do not enable gateway spending or select Ceramic.
 	const cloudflareConfigured = ["ceramic", "exa", "linkup"].includes(cloudflareUpstream ?? "")
 		&& Boolean(cloudflareAccount?.trim()) && Boolean(cloudflareToken?.trim());
@@ -116,7 +119,7 @@ export default function (pi: ExtensionAPI): void {
 		parallelResponses: parallelResponsesEnabled,
 		x: xToken !== undefined && xToken.trim().length > 0,
 	});
-	const xBrowser = new XBrowserAccess(join(getAgentDir(), "pi-search", "x"));
+	const xBrowser = new XBrowserAccess(join(agentDir, "pi-search", "x"));
 	registerWebSearch(pi, route, { availableProviderHints: availableHints, fetcherOptions: { xBrowser } });
 	registerWebFetch(pi, { xBrowser });
 	registerWebResearch(pi, route, { availableProviderHints: availableHints, xBrowser });

package/src/parallel-responses.ts

@@ -50,7 +50,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "usage-based",
 };
 

package/src/parallel.ts

@@ -34,7 +34,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "usage-based",
 };
 

package/src/research-tool.ts

@@ -1,4 +1,3 @@
-import { StringEnum } from "@earendil-works/pi-ai";
 import {
 	defineTool,
 	type ExtensionAPI,
@@ -6,7 +5,7 @@ import {
 	type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
-import { Type, type Static, type TUnsafe } from "typebox";
+import { Type, type Static } from "typebox";
 import type { FetchedContent, Provider, ProviderUsage, ResearchRequest, ResearchResponse, SearchProviderSelection, SearchRequest, SearchResult, SearchWarning } from "./contracts";
 import { validateResearchBudget } from "./contracts";
 import { toolUsage } from "./grounding";
@@ -20,12 +19,12 @@ import { renderModelUrl, renderSafeUrl } from "./url-rendering";
 import { compactText, sanitizeBlock } from "./render-text";
 import { SEARCH_PROVIDER_HINT_IDS, type SearchProviderHintId } from "./contracts";
 
-const ResearchProviderSchema = StringEnum(["native", ...SEARCH_PROVIDER_HINT_IDS] as const, { description: "Provider hint; omit for automatic routing" }) as TUnsafe<"native" | SearchProviderHintId>;
+const ResearchProviderSchema = Type.Enum(["native", ...SEARCH_PROVIDER_HINT_IDS] as const, { type: "string", description: "Provider hint; omit for automatic routing" });
 
 /** Full tool schema for a given set of dispatchable provider hints. */
 function webResearchParametersFor(hints: readonly SearchProviderHintId[]) {
 	const ids = ["native", ...hints] as const;
-	const schema = StringEnum(ids as unknown as readonly string[], { description: "Provider hint; omit for automatic routing" }) as TUnsafe<"native" | SearchProviderHintId>;
+	const schema = Type.Enum(ids, { type: "string", description: "Provider hint; omit for automatic routing" });
 	return Type.Object({
 		...WebResearchParameters.properties,
 		provider: Type.Optional(schema),
@@ -457,7 +456,7 @@ export async function executeResearch(
 			} catch (error) {
 				if (error instanceof SearchToolError && error.usage !== undefined) recordUsage(error.usage, estimatedCost);
 				else if (estimatedCost > 0) warnings.push(warning("Research retained the failed call's estimated cost reservation; actual billing is unconfirmed"));
-				if (deadlineController.signal.aborted || signal?.aborted) {
+				if (deadlineController.signal.aborted || signal?.aborted || remaining(deadline) <= 1) {
 					stopReason = signal?.aborted ? "canceled" : "deadline";
 					warnings.push(warning(`Research search failed for query ${JSON.stringify(query)}: ${error instanceof Error ? error.message : String(error)}`));
 					break;
@@ -511,7 +510,7 @@ export async function executeResearch(
 						break;
 					}
 				} catch (error) {
-					if (deadlineController.signal.aborted || signal?.aborted) {
+					if (deadlineController.signal.aborted || signal?.aborted || remaining(deadline) <= 1) {
 						stopReason = signal?.aborted ? "canceled" : "deadline";
 						break;
 					}
@@ -520,7 +519,7 @@ export async function executeResearch(
 				}
 			}
 		}
-		if (deadlineController.signal.aborted && stopReason === "completed") stopReason = signal?.aborted ? "canceled" : "deadline";
+		if ((deadlineController.signal.aborted || remaining(deadline) <= 1) && stopReason === "completed") stopReason = signal?.aborted ? "canceled" : "deadline";
 		if (stopReason === "completed" && hadFailedFetch) stopReason = "partial";
 		return boundedResponse(currentResponse(), normalized.budget.maxOutputChars);
 	} finally {

package/src/search-tool.ts

@@ -1,4 +1,3 @@
-import { StringEnum } from "@earendil-works/pi-ai";
 import {
 	defineTool,
 	type ExtensionAPI,
@@ -6,7 +5,7 @@ import {
 	type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
-import { Type, type Static, type TUnsafe } from "typebox";
+import { Type, type Static } from "typebox";
 import { SEARCH_PROVIDER_HINT_IDS, type FetchedContent, type Provider, type ProviderContext, type ProviderModel, type SearchProviderHintId, type SearchProviderSelection, type SearchRequest, type SearchResponse } from "./contracts";
 import { toFetchToolError } from "./fetch-errors";
 import { boundUtf8, fetchContent, type FetcherOptions } from "./fetcher";
@@ -36,13 +35,13 @@ import {
 } from "./search";
 import { MAX_SEARCH_DOMAIN_LENGTH } from "./search-cleanup";
 
-const SearchModeSchema = StringEnum(["auto", "keyword", "fresh"] as const, { description: "Search mode; auto selects the provider path" }) as TUnsafe<"auto" | "keyword" | "fresh">;
-const SearchProviderSchema = StringEnum(["native", ...SEARCH_PROVIDER_HINT_IDS] as const, { description: "Provider hint; omit for automatic routing" }) as TUnsafe<"native" | SearchProviderHintId>;
+const SearchModeSchema = Type.Enum(["auto", "keyword", "fresh"] as const, { type: "string", description: "Search mode; auto selects the provider path" });
+const SearchProviderSchema = Type.Enum(["native", ...SEARCH_PROVIDER_HINT_IDS] as const, { type: "string", description: "Provider hint; omit for automatic routing" });
 
 /** Build the provider-enum schema from hints this installation can dispatch. */
-function providerSchemaFor(hints: readonly SearchProviderHintId[]): TUnsafe<"native" | SearchProviderHintId> {
+function providerSchemaFor(hints: readonly SearchProviderHintId[]) {
 	const ids = ["native", ...hints] as const;
-	return StringEnum(ids as unknown as readonly string[], { description: "Provider hint; omit for automatic routing" }) as TUnsafe<"native" | SearchProviderHintId>;
+	return Type.Enum(ids, { type: "string", description: "Provider hint; omit for automatic routing" });
 }
 export const SearchDomainsSchema = Type.Object(
 	{
@@ -58,11 +57,11 @@ export const SearchDateRangeSchema = Type.Object(
 	},
 	{ description: "Optional publication date range" },
 );
-const SearchContextSizeSchema = StringEnum(["low", "medium", "high"] as const, { description: "Provider-native search context size" }) as TUnsafe<"low" | "medium" | "high">;
-const ReturnTokenBudgetSchema = StringEnum(["default", "unlimited"] as const, { description: "Provider-native returned-token budget" }) as TUnsafe<"default" | "unlimited">;
+const SearchContextSizeSchema = Type.Enum(["low", "medium", "high"] as const, { type: "string", description: "Provider-native search context size" });
+const ReturnTokenBudgetSchema = Type.Enum(["default", "unlimited"] as const, { type: "string", description: "Provider-native returned-token budget" });
 const SearchUserLocationSchema = Type.Object(
 	{
-		type: StringEnum(["approximate"] as const) as TUnsafe<"approximate">,
+		type: Type.Enum(["approximate"] as const, { type: "string" }),
 		country: Type.Optional(Type.String({ minLength: 2, maxLength: 2, description: "Two-letter ISO country code" })),
 		region: Type.Optional(Type.String({ minLength: 1, maxLength: MAX_SEARCH_LOCATION_FIELD_LENGTH })),
 		city: Type.Optional(Type.String({ minLength: 1, maxLength: MAX_SEARCH_LOCATION_FIELD_LENGTH })),
@@ -98,12 +97,12 @@ export const WebSearchParameters = Type.Object({
 	social: Type.Optional(SocialSearchSchema),
 	executionModel: Type.Optional(Type.String({ minLength: 1, maxLength: MAX_EXECUTION_MODEL_LENGTH, description: "Model id when deliberately selecting a model-mediated provider" })),
 	provider: Type.Optional(SearchProviderSchema),
-	answerMode: Type.Optional(StringEnum(["auto", "evidence"] as const, { description: "Return a provider answer when available or evidence only" }) as TUnsafe<"auto" | "evidence">),
+	answerMode: Type.Optional(Type.Enum(["auto", "evidence"] as const, { type: "string", description: "Return a provider answer when available or evidence only" })),
 	searchContextSize: Type.Optional(SearchContextSizeSchema),
 	returnTokenBudget: Type.Optional(ReturnTokenBudgetSchema),
 	externalWebAccess: Type.Optional(Type.Boolean({ description: "Allow live internet access when supported" })),
 	userLocation: Type.Optional(SearchUserLocationSchema),
-	searchContentTypes: Type.Optional(Type.Array(StringEnum(["text", "image"] as const) as TUnsafe<"text" | "image">, { minItems: 1, maxItems: MAX_SEARCH_CONTENT_TYPES })),
+	searchContentTypes: Type.Optional(Type.Array(Type.Enum(["text", "image"] as const, { type: "string" }), { minItems: 1, maxItems: MAX_SEARCH_CONTENT_TYPES })),
 	imageSettings: Type.Optional(SearchImageSettingsSchema),
 	includeContent: Type.Optional(Type.Boolean({ default: false, description: "Fetch selected result pages for source context" })),
 	contentResults: Type.Optional(Type.Integer({ minimum: 1, maximum: MAX_CONTENT_RESULTS, default: DEFAULT_CONTENT_RESULTS, description: `Number of result pages to fetch when includeContent is enabled (1-${MAX_CONTENT_RESULTS})` })),

package/src/x.ts

@@ -36,7 +36,7 @@ const capabilities: ProviderCapabilities = {
 };
 
 const profile: ProviderProfile = {
-	auth: "environment",
+	auth: "direct",
 	costModel: "usage-based",
 };