@omnicross/core 0.1.10 → 0.2.1

package/dist/types-CbCZqLGg.d.cts

@@ -0,0 +1,127 @@
+import { SearchProviderId } from '@omnicross/contracts/search-types';
+
+/**
+ * Shared vocabulary for the API search slice (plan 阶段4).
+ *
+ * Config shapes, the transport seams, and the failure-stage vocabulary, in one
+ * place so the four adapters, the shared transport, the contributions factory
+ * and the doctor can agree on names without importing each other.
+ *
+ * The config shapes stay CORE-LOCAL rather than moving into
+ * `@omnicross/contracts`: their only consumers are in this package until
+ * 阶段5's daemon assembles real configuration, and promoting them then — with
+ * whatever that assembly actually needs — beats freezing a guess now. Recorded
+ * as an explicit deferral in the change's design.
+ *
+ * @module search/api/types
+ */
+
+/**
+ * The transport identity stamped on every failure this slice throws.
+ *
+ * Same client as the HTTP slice, declared separately rather than imported: the
+ * two subpaths are independent, and a shared constant would couple them for a
+ * five-character string.
+ */
+declare const SEARCH_API_TRANSPORT_ID = "undici";
+/**
+ * Which phase of an API search failed (plan §11.4).
+ *
+ * - `config` — a required key or host is absent; nothing was sent.
+ * - `egress` — the policy refused the target or a redirect hop.
+ * - `connect` — the request never produced a response (DNS, TCP, TLS).
+ * - `fetch` — a response arrived but its status is unusable.
+ * - `redirect` — the redirect chain exceeded its cap.
+ * - `body-cap` — the response body outgrew its byte cap mid-stream.
+ * - `parse` — the body is not the JSON shape this API documents.
+ */
+type SearchApiStage = 'config' | 'egress' | 'connect' | 'fetch' | 'redirect' | 'body-cap' | 'parse';
+/** Tavily: key required, host overridable. */
+interface TavilyProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. */
+    apiKey: string;
+    /** Override for `https://api.tavily.com`. */
+    apiHost?: string;
+}
+/** Jina: key OPTIONAL — the search endpoint works unauthenticated (rate-limited). */
+interface JinaProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. Omit to run keyless. */
+    apiKey?: string;
+    /** Override for `https://s.jina.ai`. */
+    apiHost?: string;
+}
+/** SearXNG: the HOST is the required setting; there is no API key. */
+interface SearxngProviderConfig {
+    /** Base URL of the SearXNG instance. Required — this is its "configured" signal. */
+    apiHost: string;
+    /** Basic-auth user. Sent only when both user and password are present. */
+    basicAuthUsername?: string;
+    /** Basic-auth password. Sent only when both user and password are present. */
+    basicAuthPassword?: string;
+}
+/** Zhipu and Z.AI: one wire contract, two ids, two default hosts. */
+interface ZhipuProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. */
+    apiKey: string;
+    /** Override for the per-id default host; normalized onto `/web_search`. */
+    apiHost?: string;
+}
+/**
+ * Per-provider configuration, keyed by provider id.
+ *
+ * A provider absent from this object is UNCONFIGURED, not broken: it produces
+ * no contribution at all, so capability discovery never advertises something
+ * that cannot run.
+ */
+interface SearchApiProviderConfigs {
+    tavily?: TavilyProviderConfig;
+    jina?: JinaProviderConfig;
+    searxng?: SearxngProviderConfig;
+    zhipu?: ZhipuProviderConfig;
+    'z.ai'?: ZhipuProviderConfig;
+}
+/**
+ * One API request, as the shared transport takes it.
+ *
+ * `secrets` is the redaction input: every value listed is stripped out of any
+ * upstream text before it can reach an error message or a diagnostic. Tavily
+ * transmits its key in the request BODY, so an upstream 4xx that echoes the
+ * request would otherwise put the key straight into a log.
+ */
+interface SearchApiRequest {
+    /** Absolute request URL. Validated against the egress policy before use. */
+    url: string;
+    /** HTTP method. */
+    method: 'GET' | 'POST';
+    /** Request headers. Never logged, never echoed into an error. */
+    headers?: Record<string, string>;
+    /** Body to serialize as JSON. Omit for GET. */
+    jsonBody?: unknown;
+    /** Stamped onto every thrown error. */
+    providerId: SearchProviderId;
+    /** Human-readable provider name for failure messages (never the query). */
+    label: string;
+    /** Hard budget for this request in milliseconds. */
+    timeoutMs?: number;
+    /** Caller cancellation. Aborting surfaces as `cancelled`, never `timeout`. */
+    signal?: AbortSignal;
+    /** Credential values to redact from any upstream text. */
+    secrets?: ReadonlyArray<string | undefined>;
+}
+/**
+ * The seam every adapter calls: a request in, parsed JSON out.
+ *
+ * Deliberately `unknown` rather than generic. The transport cannot know an
+ * API's shape, and a generic here would be a promise it cannot keep — each
+ * adapter validates its own response and raises `parse_failed` itself, which is
+ * where that failure actually belongs.
+ */
+type SearchApiTransport = (request: SearchApiRequest) => Promise<unknown>;
+/**
+ * The low-level fetch primitive the shared transport drives — undici's `fetch`
+ * by default. Separate from {@link SearchApiTransport} so redirect, status and
+ * redaction behavior can be unit-tested without a network.
+ */
+type SearchApiFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export { type JinaProviderConfig as J, type SearchApiProviderConfigs as S, type TavilyProviderConfig as T, type ZhipuProviderConfig as Z, type SearchApiFetch as a, type SearchApiTransport as b, type SearxngProviderConfig as c, SEARCH_API_TRANSPORT_ID as d, type SearchApiRequest as e, type SearchApiStage as f };

package/dist/types-CbCZqLGg.d.ts

@@ -0,0 +1,127 @@
+import { SearchProviderId } from '@omnicross/contracts/search-types';
+
+/**
+ * Shared vocabulary for the API search slice (plan 阶段4).
+ *
+ * Config shapes, the transport seams, and the failure-stage vocabulary, in one
+ * place so the four adapters, the shared transport, the contributions factory
+ * and the doctor can agree on names without importing each other.
+ *
+ * The config shapes stay CORE-LOCAL rather than moving into
+ * `@omnicross/contracts`: their only consumers are in this package until
+ * 阶段5's daemon assembles real configuration, and promoting them then — with
+ * whatever that assembly actually needs — beats freezing a guess now. Recorded
+ * as an explicit deferral in the change's design.
+ *
+ * @module search/api/types
+ */
+
+/**
+ * The transport identity stamped on every failure this slice throws.
+ *
+ * Same client as the HTTP slice, declared separately rather than imported: the
+ * two subpaths are independent, and a shared constant would couple them for a
+ * five-character string.
+ */
+declare const SEARCH_API_TRANSPORT_ID = "undici";
+/**
+ * Which phase of an API search failed (plan §11.4).
+ *
+ * - `config` — a required key or host is absent; nothing was sent.
+ * - `egress` — the policy refused the target or a redirect hop.
+ * - `connect` — the request never produced a response (DNS, TCP, TLS).
+ * - `fetch` — a response arrived but its status is unusable.
+ * - `redirect` — the redirect chain exceeded its cap.
+ * - `body-cap` — the response body outgrew its byte cap mid-stream.
+ * - `parse` — the body is not the JSON shape this API documents.
+ */
+type SearchApiStage = 'config' | 'egress' | 'connect' | 'fetch' | 'redirect' | 'body-cap' | 'parse';
+/** Tavily: key required, host overridable. */
+interface TavilyProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. */
+    apiKey: string;
+    /** Override for `https://api.tavily.com`. */
+    apiHost?: string;
+}
+/** Jina: key OPTIONAL — the search endpoint works unauthenticated (rate-limited). */
+interface JinaProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. Omit to run keyless. */
+    apiKey?: string;
+    /** Override for `https://s.jina.ai`. */
+    apiHost?: string;
+}
+/** SearXNG: the HOST is the required setting; there is no API key. */
+interface SearxngProviderConfig {
+    /** Base URL of the SearXNG instance. Required — this is its "configured" signal. */
+    apiHost: string;
+    /** Basic-auth user. Sent only when both user and password are present. */
+    basicAuthUsername?: string;
+    /** Basic-auth password. Sent only when both user and password are present. */
+    basicAuthPassword?: string;
+}
+/** Zhipu and Z.AI: one wire contract, two ids, two default hosts. */
+interface ZhipuProviderConfig {
+    /** API key. Comma-separated values rotate round-robin. */
+    apiKey: string;
+    /** Override for the per-id default host; normalized onto `/web_search`. */
+    apiHost?: string;
+}
+/**
+ * Per-provider configuration, keyed by provider id.
+ *
+ * A provider absent from this object is UNCONFIGURED, not broken: it produces
+ * no contribution at all, so capability discovery never advertises something
+ * that cannot run.
+ */
+interface SearchApiProviderConfigs {
+    tavily?: TavilyProviderConfig;
+    jina?: JinaProviderConfig;
+    searxng?: SearxngProviderConfig;
+    zhipu?: ZhipuProviderConfig;
+    'z.ai'?: ZhipuProviderConfig;
+}
+/**
+ * One API request, as the shared transport takes it.
+ *
+ * `secrets` is the redaction input: every value listed is stripped out of any
+ * upstream text before it can reach an error message or a diagnostic. Tavily
+ * transmits its key in the request BODY, so an upstream 4xx that echoes the
+ * request would otherwise put the key straight into a log.
+ */
+interface SearchApiRequest {
+    /** Absolute request URL. Validated against the egress policy before use. */
+    url: string;
+    /** HTTP method. */
+    method: 'GET' | 'POST';
+    /** Request headers. Never logged, never echoed into an error. */
+    headers?: Record<string, string>;
+    /** Body to serialize as JSON. Omit for GET. */
+    jsonBody?: unknown;
+    /** Stamped onto every thrown error. */
+    providerId: SearchProviderId;
+    /** Human-readable provider name for failure messages (never the query). */
+    label: string;
+    /** Hard budget for this request in milliseconds. */
+    timeoutMs?: number;
+    /** Caller cancellation. Aborting surfaces as `cancelled`, never `timeout`. */
+    signal?: AbortSignal;
+    /** Credential values to redact from any upstream text. */
+    secrets?: ReadonlyArray<string | undefined>;
+}
+/**
+ * The seam every adapter calls: a request in, parsed JSON out.
+ *
+ * Deliberately `unknown` rather than generic. The transport cannot know an
+ * API's shape, and a generic here would be a promise it cannot keep — each
+ * adapter validates its own response and raises `parse_failed` itself, which is
+ * where that failure actually belongs.
+ */
+type SearchApiTransport = (request: SearchApiRequest) => Promise<unknown>;
+/**
+ * The low-level fetch primitive the shared transport drives — undici's `fetch`
+ * by default. Separate from {@link SearchApiTransport} so redirect, status and
+ * redaction behavior can be unit-tested without a network.
+ */
+type SearchApiFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export { type JinaProviderConfig as J, type SearchApiProviderConfigs as S, type TavilyProviderConfig as T, type ZhipuProviderConfig as Z, type SearchApiFetch as a, type SearchApiTransport as b, type SearxngProviderConfig as c, SEARCH_API_TRANSPORT_ID as d, type SearchApiRequest as e, type SearchApiStage as f };

package/dist/{types-C2MwkLah.d.cts → types-D-oHYusb.d.cts}

@@ -1,3 +1,4 @@
+import { e as ImageApiLimits } from './types-Be-yt_6T.cjs';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
@@ -6,11 +7,52 @@ import { VoucherRecord, VoucherGrant, VoucherInfo, VoucherConfig } from '@omnicr
 import { WebhookConfig } from '@omnicross/contracts/webhook-types';
 import { L as Logger } from './logger-4GvQNzhE.cjs';
 import { ProviderConfigSource } from './ports/provider-config-source.cjs';
-import { P as ProviderProxy } from './ProviderProxy-QdwNV6l1.cjs';
-import { ProviderProxyDeps } from './provider-proxy/types.cjs';
+import { P as ProviderProxy } from './ProviderProxy-Bz_nkOwq.cjs';
+import { W as ProviderProxyDeps } from './types-BSIJdsyl.cjs';
 import { BoundAccountFallbackPolicy } from './pipeline/BoundAccountSelectionError.cjs';
+import { S as SearchApiProviderConfigs } from './types-CbCZqLGg.cjs';
+import { d as SearchFrontendModes } from './frontends-Doz0RaWu.cjs';
+import { S as SearchRuntime } from './runtime-t8AZacFF.cjs';
 import { c as KeySpend } from './keyPolicy-zdWTu3CQ.cjs';
 
+/**
+ * anthropicCountTokens — the `POST /v1/messages/count_tokens` handler
+ * (`claude-api-routing-errors`, R2 passthrough+reject subset).
+ *
+ * Before this module, the substring `/v1/messages` match routed count_tokens
+ * into the FULL generation pipeline — every context-stats call burned a real
+ * upstream inference (BYO money, subscription 5h-window quota) and returned a
+ * Message JSON instead of `{"input_tokens":N}` (audit F-1, P0).
+ *
+ * Strategies (portfolio-locked default: `'auto'`):
+ *  - **passthrough** (Anthropic-wire upstream — `plan.sameFormat`): strip the
+ *    generation-only fields the count_tokens endpoint rejects (`stream`,
+ *    `max_tokens`), rewrite `model` to the resolved upstream model, and POST to
+ *    `<upstream>/v1/messages/count_tokens` via the SAME same-format fetches the
+ *    generation path uses (credential injection, beta merge, claude header
+ *    baseline all inherited). The response — success OR failure — relays
+ *    verbatim with its real status (an Anthropic-wire error body already IS
+ *    the official shape; wrapping it would violate the verbatim moat).
+ *  - **estimate** (Change B; explicit config, or `auto` on a translation
+ *    upstream): a PURE-LOCAL heuristic estimate (`anthropicCountEstimate.ts`)
+ *    answered as `{"input_tokens":N}` with the `x-omnicross-count-estimate:
+ *    true` marker header — zero upstream calls, never recorded as usage.
+ *  - **reject** (explicit config, or `passthrough` degraded on a translation
+ *    upstream): a clean Anthropic 404 `not_found_error` with ZERO upstream
+ *    calls — Claude Code treats it as "endpoint absent" and falls back to its
+ *    local usage estimation.
+ *
+ * A free endpoint: no usage recording, no concurrency gate (the outbound face
+ * bypasses its gate before dispatch), single attempt — no 401 refresh retry,
+ * no subscription health marking (a failed count_tokens must not cool an
+ * account that serves inference; the inference path drives those itself).
+ *
+ * @module provider-proxy/ingress/anthropicCountTokens
+ */
+
+/** The operator-facing strategy config (§10 `anthropic.countTokens.mode`). */
+type CountTokensMode = 'auto' | 'passthrough' | 'estimate' | 'reject';
+
 /**
  * keySpendTracker — a cheap in-memory per-key accumulated-spend cache
  * (`outbound-key-policy`, design D3).
@@ -201,23 +243,104 @@ interface VoucherDb {
     voucherList(): Promise<VoucherRecord[]>;
 }
 
+/** The four endpoints, 1:1 with the four wire-format ingress parsers. */
+type OutboundEndpoint = 'chat' | 'responses' | 'messages' | 'gemini';
+/** Named-key authorization vocabulary. Images is deliberately not a text route. */
+type OutboundPermission = OutboundEndpoint | 'images';
 /**
- * Shared contract types for the outbound API server (`outbound-api-server`).
- *
- * The outbound server is a SEPARATE long-lived HTTP listener (distinct from the
- * resident loopback `ProviderProxy`) that authenticates external callers via
- * named API keys and routes their requests through the EXISTING `provider-proxy`
- * ingress parsers + transformer — there is exactly one conversion stack.
+ * The persisted `search` section (plan §6.3).
  *
- * These types are kept in their own module so the server, router, auth, rate
- * limiter, role detection, and route resolver can share shapes without circular
- * imports.
+ * Deliberately small. It carries the four things assembly cannot invent —
+ * which keyed providers exist, where they may egress, who executes per
+ * frontend, and the runtime's default policy — and nothing else. The
+ * provider-config SHAPES stay core-local (`@omnicross/core/search/api`); the
+ * 阶段4 deferral of promoting them into `@omnicross/contracts` is left standing
+ * because assembly turned out not to need it.
  *
- * @module outbound-api/types
+ * **Secrets are values here, not references.** The
+ * `search-provider:<id>:apiKey` secret-ref scheme Elftia uses is host-side and
+ * belongs to the Phase-2 cutover; this phase reads what the config holds and
+ * never prints it.
  */
-
-/** The four endpoints, 1:1 with the four wire-format ingress parsers. */
-type OutboundEndpoint = 'chat' | 'responses' | 'messages' | 'gemini';
+interface SearchServerConfig {
+    /**
+     * Per-frontend execution modes. Always total after normalization.
+     *
+     * **These do not all apply at the same moment.** `modes.codex` is read from
+     * the live config on every request, so an admin PUT takes effect at once;
+     * `modes.responses` / `modes.anthropic` are captured into the proxy deps at
+     * bootstrap, as are `providers`, `egress` and `policy` (they build the ONE
+     * runtime), so changing those requires a daemon restart. `doctor search`
+     * prints this distinction rather than leaving an operator to discover it.
+     */
+    modes: SearchFrontendModes;
+    /** Configured API providers. A provider absent here is UNCONFIGURED, not broken. */
+    providers: SearchApiProviderConfigs;
+    /** SSRF egress policy knobs. */
+    egress: {
+        /**
+         * Hostnames allowed to resolve into an otherwise-denied address class —
+         * the internal-SearXNG escape hatch. Exact, case-insensitive matching.
+         */
+        allowedPrivateHosts: string[];
+    };
+    /**
+     * The runtime's DEFAULT policy. These are 阶段3's existing knobs surfaced as
+     * configuration; no new orchestration semantics are introduced here.
+     */
+    policy: {
+        preferred?: string;
+        allowed?: string[];
+        fallbackEnabled: boolean;
+        maxAttempts?: number;
+    };
+}
+interface ImagesServerConfig {
+    enabled: boolean;
+    provider: 'codex-subscription';
+    defaultModel: string;
+    modelAliases: Record<string, string>;
+    account: {
+        id?: string;
+        group?: string;
+        fallback: 'strict' | 'pool';
+    };
+    queue: {
+        maxConcurrentJobsPerAccount: number;
+        maxQueuedJobs: number;
+        queueTimeoutMs: number;
+        generationTimeoutMs: number;
+    };
+    temporary: {
+        maxActiveScopes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        staleAfterMs: number;
+        cleanupIntervalMs: number;
+    };
+    limits: ImageApiLimits;
+    references: {
+        ttlMs: number;
+        maxArtifactBytes: number;
+        maxTotalBytes: number;
+        maxTenantBytes: number;
+        maxEntries: number;
+        maxCalls: number;
+        maxResponses: number;
+        maxTombstones: number;
+        tombstoneTtlMs: number;
+        cleanupIntervalMs: number;
+        storageRoot?: string;
+    };
+    remote: {
+        enabled: boolean;
+    };
+    evidenceTtlMs: number;
+}
+/** Non-consuming, account-bound image model discovery injected by the daemon. */
+interface ImageModelCatalogReader {
+    listAvailableModels(apiKeyId: string): Promise<readonly string[]>;
+}
 /** A `"providerId,modelId"` model reference (mirrors `RouterConfig` vocab). */
 type ModelRef = string;
 /** The detected request role; precedence background > default. */
@@ -513,6 +636,69 @@ interface FingerprintConfig {
     /** Operator UA baseline for un-captured accounts (piece 4). Absent ⇒ none. */
     ua?: string;
 }
+/**
+ * count_tokens strategy mode (§10 `anthropic.countTokens.mode`). ONE canonical
+ * union lives with the handler (`provider-proxy/ingress/anthropicCountTokens`);
+ * this alias re-exports it so the config-segment types and the runtime
+ * resolver can never drift apart (review B-M2).
+ */
+type AnthropicCountTokensMode = CountTokensMode;
+/** `GET /v1/models` response shape selector (§10 `anthropic.modelsShape`). */
+type AnthropicModelsShape = 'auto' | 'anthropic' | 'openai';
+/**
+ * Anthropic-protocol tuning segment (`claude-api-protocol-fidelity`, §10
+ * skeleton — count_tokens strategy/budget, /v1/models shape, synthetic-SSE
+ * heartbeat). Persisted + normalized like the other segments; read live per
+ * request (count_tokens/models) or hot-applied via the module setter
+ * (heartbeat). `proxyOauthUsage` / `apiHello` land in the follow-up change.
+ */
+interface AnthropicConfigSegment {
+    /**
+     * `/v1/messages/count_tokens` strategy. `mode` absent ⇒ `'auto'`
+     * (Anthropic-wire upstream → passthrough; translation upstream → local
+     * estimate). `estimateBudgetMs` bounds the local estimator walk (default
+     * 2000; a pathological input degrades to a coarser estimate, never fails).
+     */
+    countTokens?: {
+        mode?: AnthropicCountTokensMode;
+        estimateBudgetMs?: number;
+    };
+    /**
+     * `GET /v1/models` response shape. `'auto'` (default): a key authorized for
+     * the messages endpoint gets the Anthropic list shape, everyone else keeps
+     * the OpenAI shape; `'anthropic'` / `'openai'` force one shape (escape
+     * hatch for dual-protocol consumers).
+     */
+    modelsShape?: AnthropicModelsShape;
+    /**
+     * Synthetic-SSE ping heartbeat interval (ms) for the TRANSLATION path only.
+     * Default 20000; ≤0 disables. Hot-applied at `applyConfig` — in-flight
+     * streams pick the new value at their next timer arm.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * Translate-path PDF text extraction budget (`claude-api-transform-fidelity`,
+     * R7). `budgetMs` default 2000 — bounds the synchronous zero-dependency
+     * text-layer walk; over-budget documents 400 explicitly (never silently
+     * dropped, never unbounded work).
+     */
+    pdfTextExtraction?: {
+        budgetMs?: number;
+    };
+    /**
+     * Serve `GET /api/oauth/usage` on the outbound listener as a PURE-CACHE read
+     * of the shared Claude allowance store (R9). Default FALSE — off, the path
+     * keeps its current generic 404 byte-for-byte. When on, a messages-authorized
+     * key bound to a Claude subscription receives the api.anthropic.com usage
+     * wire shape; NO upstream call or refresh is ever triggered by the query.
+     */
+    proxyOauthUsage?: boolean;
+    /**
+     * Answer `HEAD /api/hello` with a bare 200 at the listener level (R10 —
+     * clients probe "can this endpoint be safely rejected"). Default TRUE.
+     */
+    apiHello?: boolean;
+}
 /**
  * Layered upstream-proxy segment (upstream-proxy). Global + per-provider proxy
  * config for outbound EGRESS to upstreams (NOT the inbound listener). Resolved
@@ -627,6 +813,21 @@ interface OutboundApiServerConfig {
      * byte-identical zero regression, purely additive on the #4 key-policy.
      */
     voucher?: VoucherConfig;
+    /**
+     * Anthropic-protocol tuning segment (claude-api-protocol-fidelity, §10).
+     * Optional in the persisted shape; `normalizeServerConfig` always fills it
+     * with the frozen defaults (auto/auto/20000).
+     */
+    anthropic?: AnthropicConfigSegment;
+    /** Default-off Images serving policy; capability still requires fresh evidence. */
+    images?: ImagesServerConfig;
+    /**
+     * Search assembly (plan 阶段5/§6.3): which API providers exist, where they may
+     * egress, which frontend runs in which mode, and the runtime's default policy.
+     * Absent yields {@link DEFAULT_SEARCH_SERVER_CONFIG} — HTTP-only providers,
+     * modes `off`/`native`/`native`, public-only egress.
+     */
+    search?: SearchServerConfig;
 }
 /** A live status snapshot the Settings tab renders. */
 interface OutboundApiServerStatus {
@@ -641,6 +842,15 @@ interface OutboundApiServerStatus {
     formats: OutboundFormatUrls | null;
     /** The four format endpoint URLs over the LAN (only when network binding on). */
     lanFormats: OutboundFormatUrls | null;
+    /** Additive Images endpoints; absent while Images is disabled. */
+    images?: {
+        generations: string;
+        edits: string;
+    } | null;
+    lanImages?: {
+        generations: string;
+        edits: string;
+    } | null;
 }
 /** The four format endpoint URLs for one base. */
 interface OutboundFormatUrls {
@@ -667,8 +877,10 @@ interface OutboundApiKeyInfo {
     revoked: boolean;
     /** Intended consumer. Existing rows default to a general client key. */
     kind?: 'client' | 'integration';
-    /** Optional endpoint allow-list. Absent means every outbound endpoint. */
-    allowedEndpoints?: OutboundEndpoint[];
+    /** Exact effective permission list; legacy absent rows project to text-only permissions. */
+    allowedEndpoints: OutboundPermission[];
+    /** True when the stored row omitted permissions and compatibility defaults were projected. */
+    legacyPermissions: boolean;
     /** When true the key is rejected unless the TCP peer is loopback. */
     loopbackOnly?: boolean;
     /**
@@ -746,6 +958,8 @@ interface OutboundApiKeyCreated {
     name: string;
     keyPrefix: string;
     createdAt: number;
+    /** Exact effective permission list assigned to the new key. */
+    allowedEndpoints: OutboundPermission[];
     plaintextOnce: string;
 }
 /**
@@ -773,8 +987,8 @@ interface OutboundKeyDbRow {
     revokedAt: number | null;
     /** Intended consumer. Existing rows without this field remain client keys. */
     kind?: 'client' | 'integration';
-    /** Optional endpoint allow-list for least-privilege integration keys. */
-    allowedEndpoints?: OutboundEndpoint[];
+    /** Persisted exact permission list. Absent is a legacy text-only row. */
+    allowedEndpoints?: OutboundPermission[];
     /** Restrict use to requests whose direct socket peer is loopback. */
     loopbackOnly?: boolean;
     /**
@@ -817,7 +1031,7 @@ interface OutboundKeyDb {
         keyPrefix: string;
         createdAt?: number;
         kind?: 'client' | 'integration';
-        allowedEndpoints?: OutboundEndpoint[];
+        allowedEndpoints?: OutboundPermission[];
         loopbackOnly?: boolean;
         /**
          * The generated plaintext secret. When the DB holds a `SecretBox` it
@@ -831,6 +1045,8 @@ interface OutboundKeyDb {
     outboundApiKeysRevoke(id: string): Promise<boolean>;
     outboundApiKeysTouchLastUsed(id: string): Promise<boolean>;
     outboundApiKeysSetEnabled(id: string, enabled: boolean): Promise<boolean>;
+    /** Atomically replace the exact key permission list. */
+    outboundApiKeysSetPermissions(id: string, permissions: OutboundPermission[]): Promise<boolean>;
     /**
      * Set (or clear) a key's per-key concurrency ceiling. `null` clears the field
      * → unlimited (gate bypassed). Mirrors `outboundApiKeysSetEnabled`; returns
@@ -890,6 +1106,8 @@ interface OutboundApiDeps {
     readonly providerProxy: ProviderProxy;
     /** The proxy's app-session deps (reused verbatim for `routeRequest`). */
     readonly proxyDeps: ProviderProxyDeps;
+    /** Optional fail-closed Images catalog; absent means no image model is advertised. */
+    readonly imageModelCatalog?: ImageModelCatalogReader;
     /**
      * OPTIONAL unauthenticated `/health` provider (daemon-health-endpoint, D1
      * secondary mount). When wired (by the daemon bootstrap — core NEVER imports
@@ -915,6 +1133,17 @@ interface OutboundApiDeps {
      * embedders/tests that do not wire it).
      */
     readonly logger?: Logger;
+    /**
+     * OPTIONAL shared search runtime (plan 阶段5). When wired by the daemon
+     * bootstrap, `POST /v1/alpha/search` executes through it in managed mode.
+     * Absent ⇒ the route behaves exactly as mode `off`: a structured
+     * `unsupported_capability`, never a generic 404.
+     *
+     * There is exactly ONE of these per daemon, shared with both managed protocol
+     * frontends and with `doctor search`. A second instance anywhere would be a
+     * second provider order, which is what the whole extraction removes.
+     */
+    readonly searchRuntime?: SearchRuntime | null;
 }
 
-export { type AccountProbeConfig as A, computeVoucherGrant as B, type ChatDispatchMode as C, generateVoucherCode as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, hashVoucherCode as H, newVoucherId as I, startOfLocalDay as J, type KeySpendReader as K, startOfLocalWeek as L, type MessagesModelKind as M, toVoucherInfo as N, type OutboundKeyDb as O, voucherCodePrefix as P, type ModelRef as Q, type RequestRole as R, type AccountHealthConfig as S, type OutboundKeyModelRestrictionMode as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type AllowanceSchedulingConfig as a, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundProxyConfig as x, type ResponsesModelKind as y, type VoucherDb as z };
+export { type ImageModelCatalogReader as $, type AccountProbeConfig as A, type VoucherDb as B, type ChatDispatchMode as C, computeVoucherGrant as D, ENDPOINT_MODEL_KINDS as E, type FingerprintConfig as F, type GatewayBinding as G, generateVoucherCode as H, type ImagesServerConfig as I, hashVoucherCode as J, type KeySpendReader as K, newVoucherId as L, type MessagesModelKind as M, startOfLocalDay as N, type OutboundKeyDb as O, startOfLocalWeek as P, toVoucherInfo as Q, type RequestRole as R, type SearchServerConfig as S, voucherCodePrefix as T, type UserMessageQueueConfig as U, type VoucherCreateInput as V, type ModelRef as W, type AnthropicConfigSegment as X, type AccountHealthConfig as Y, type AnthropicCountTokensMode as Z, type AnthropicModelsShape as _, type AllowanceSchedulingConfig as a, type OutboundKeyModelRestrictionMode as a0, type ConcurrencyQueueConfig as b, type EndpointRoutingConfig as c, type GatewayBindingFallback as d, type GatewayBindingKeyScope as e, type GatewayBindingModelMode as f, type GatewayBindingTarget as g, type GatewayModelMapping as h, type KeySpendSeeder as i, KeySpendTracker as j, type KindMappedEndpoint as k, type ModelKind as l, type ModelPrefixTargets as m, type OutboundApiDeps as n, type OutboundApiKeyCreated as o, type OutboundApiKeyInfo as p, type OutboundApiServerConfig as q, type OutboundApiServerStatus as r, type OutboundEndpoint as s, type OutboundFormatUrls as t, type OutboundKeyActivationMode as u, type OutboundKeyDbRow as v, type OutboundKeyPolicy as w, type OutboundPermission as x, type OutboundProxyConfig as y, type ResponsesModelKind as z };