@omnicross/daemon 0.2.0 → 0.2.1

package/dist/index.cjs

@@ -65,7 +65,7 @@ var import_billing_types = require("@omnicross/contracts/billing-types");
 var import_core4 = require("@omnicross/core");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
-var import_outbound_api9 = require("@omnicross/core/outbound-api");
+var import_outbound_api10 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
@@ -75,7 +75,7 @@ var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
-var import_outbound_api10 = require("@omnicross/core/outbound-api");
+var import_outbound_api11 = require("@omnicross/core/outbound-api");
 var import_usage2 = require("@omnicross/core/usage");
 var import_subscriptions6 = require("@omnicross/subscriptions");
 
@@ -879,7 +879,7 @@ async function handleRouteLeaseApi(req, res, path2, deps) {
 
 // src/admin/adminApi.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_outbound_api4 = require("@omnicross/core/outbound-api");
+var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
@@ -3739,6 +3739,468 @@ async function handleDashboard(deps) {
   return { status: 200, body: summary };
 }
 
+// src/admin/searchAdminApi.ts
+var import_outbound_api2 = require("@omnicross/core/outbound-api");
+var import_api3 = require("@omnicross/core/search/api");
+var import_http3 = require("@omnicross/core/search/http");
+
+// src/search/searchDoctorProjection.ts
+var import_search_types = require("@omnicross/contracts/search-types");
+var import_api = require("@omnicross/core/search/api");
+var import_http = require("@omnicross/core/search/http");
+var API_DOCTOR_PROVIDERS = [
+  {
+    id: "tavily",
+    capabilities: import_api.TAVILY_CAPABILITIES,
+    configured: (configs) => configs.tavily !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "jina",
+    capabilities: import_api.JINA_CAPABILITIES,
+    configured: (configs) => configs.jina !== void 0,
+    // Honest about the asymmetry: Jina CAN run keyless, but a provider nobody
+    // asked for is still not enabled.
+    missingReason: "not configured (Jina can run without a key, but must be enabled explicitly)"
+  },
+  {
+    id: "searxng",
+    capabilities: import_api.SEARXNG_CAPABILITIES,
+    configured: (configs) => configs.searxng !== void 0,
+    missingReason: "no API host configured"
+  },
+  {
+    id: "zhipu",
+    capabilities: import_api.ZHIPU_CAPABILITIES,
+    configured: (configs) => configs.zhipu !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "z.ai",
+    capabilities: import_api.ZHIPU_CAPABILITIES,
+    configured: (configs) => configs["z.ai"] !== void 0,
+    missingReason: "no API key configured"
+  }
+];
+function buildSearchDoctorSnapshot(contributions = (0, import_http.builtinHttpSearchContributions)(), apiConfigs) {
+  const rows = contributions.map((contribution) => ({
+    providerId: contribution.id,
+    source: contribution.source,
+    kind: contribution.kind,
+    capabilities: contribution.capabilities
+  }));
+  if (apiConfigs === void 0) return rows;
+  for (const provider of API_DOCTOR_PROVIDERS) {
+    if (provider.configured(apiConfigs)) continue;
+    rows.push({
+      providerId: provider.id,
+      source: "builtin",
+      kind: "api",
+      capabilities: provider.capabilities,
+      status: "unconfigured",
+      reason: provider.missingReason
+    });
+  }
+  return rows;
+}
+var SEARCH_DOCTOR_QUERY = "mozilla developer network http headers";
+function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
+  if (outcome.kind === "results") {
+    if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
+    return {
+      providerId,
+      status: "degraded",
+      checkedAt,
+      reason: "reachable, but the engine returned no usable results (possible partial drift)"
+    };
+  }
+  const error = (0, import_search_types.toSearchErrorShape)(outcome.error);
+  const stage = error.details?.stage;
+  const { status, reason } = classifySearchFailure(stage, error.code);
+  return { providerId, status, checkedAt, reason, error };
+}
+function classifySearchFailure(stage, code) {
+  if (stage === "challenge") {
+    return { status: "blocked", reason: "the engine served a bot challenge instead of results" };
+  }
+  if (stage === "trust") {
+    return {
+      status: "blocked",
+      reason: "the engine served a page that failed the anti-decoy trust check"
+    };
+  }
+  if (code === "policy_denied") {
+    return {
+      status: "blocked",
+      reason: "the egress policy refused the request target"
+    };
+  }
+  if (code === "parse_failed") {
+    return {
+      status: "failed",
+      reason: "the response was not recognizable as a search result page (parser drift suspected)"
+    };
+  }
+  if (code === "timeout") {
+    return { status: "failed", reason: "the request exceeded its time budget" };
+  }
+  return { status: "failed", reason: `the request failed (${code})` };
+}
+
+// src/search/SearchAssembly.ts
+var import_search = require("@omnicross/core/search");
+var import_api2 = require("@omnicross/core/search/api");
+var import_http2 = require("@omnicross/core/search/http");
+function searchEgressPolicyFrom(config) {
+  const hosts = config.egress.allowedPrivateHosts;
+  return hosts.length > 0 ? { allowedPrivateHosts: [...hosts] } : {};
+}
+function searchPolicyFrom(config) {
+  const { preferred, allowed, fallbackEnabled, maxAttempts } = config.policy;
+  return {
+    ...preferred !== void 0 ? { preferred } : {},
+    ...allowed !== void 0 ? { allowed: [...allowed] } : {},
+    fallbackEnabled,
+    ...maxAttempts !== void 0 ? { maxAttempts } : {}
+  };
+}
+function searchContributionsFrom(config) {
+  return [
+    ...(0, import_http2.builtinHttpSearchContributions)(),
+    ...(0, import_api2.apiSearchContributions)(config.providers, {
+      egressPolicy: searchEgressPolicyFrom(config)
+    })
+  ];
+}
+function buildSearchRuntime(config, options = {}) {
+  const logger = options.logger ?? null;
+  return (0, import_search.createSearchRuntime)({
+    contributions: options.contributions ?? searchContributionsFrom(config),
+    policy: searchPolicyFrom(config),
+    ...logger ? {
+      onEvent: (event) => {
+        logger.debug(`[search] ${formatSearchEvent(event)}`);
+      }
+    } : {}
+  });
+}
+function formatSearchEvent(event) {
+  const parts = [
+    `type=${event.type}`,
+    `request=${event.requestId}`,
+    `queryHash=${event.queryHash}`,
+    `durationMs=${event.durationMs}`
+  ];
+  if ("providerId" in event && event.providerId !== void 0) {
+    parts.push(`provider=${event.providerId}`);
+  }
+  if ("outcome" in event && event.outcome !== void 0) parts.push(`outcome=${event.outcome}`);
+  if ("errorCode" in event && event.errorCode !== void 0) parts.push(`error=${event.errorCode}`);
+  if ("resultCount" in event && event.resultCount !== void 0) {
+    parts.push(`results=${event.resultCount}`);
+  }
+  if ("fallbackCount" in event && event.fallbackCount !== void 0) {
+    parts.push(`fallbacks=${event.fallbackCount}`);
+  }
+  return parts.join(" ");
+}
+
+// src/admin/searchAdminApi.ts
+var KEYLESS_HTTP_PROVIDER_IDS = /* @__PURE__ */ new Set(["http-bing", "http-duckduckgo"]);
+var API_PROVIDER_IDS = /* @__PURE__ */ new Set([
+  "tavily",
+  "jina",
+  "searxng",
+  "zhipu",
+  "z.ai"
+]);
+var SEARCH_QUERY_MAX_CODE_UNITS = 256;
+var QUERY_CONTROL_CHARS = /[\u0000-\u001f\u007f]/u;
+var SEARCH_RESULT_FIELD_CAPS = { title: 512, url: 2048, content: 1024 };
+var SEARCH_QUERY_MAX_RESULTS = 5;
+function sanitizeResultField(value, cap) {
+  const text = typeof value === "string" ? value : value === null || value === void 0 ? "" : String(value);
+  return text.replace(/[\u0000-\u001f\u007f]/gu, "").slice(0, cap);
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeErr(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+var SEARCH_MAX_BODY_BYTES = 64 * 1024;
+var SearchBodyTooLargeError = class extends Error {
+};
+async function readJsonBody2(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > SEARCH_MAX_BODY_BYTES) throw new SearchBodyTooLargeError("request body is too large");
+    chunks.push(buffer);
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  if (!raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function readBodyOrReject(req, res) {
+  try {
+    return await readJsonBody2(req);
+  } catch (error) {
+    if (error instanceof SearchBodyTooLargeError) {
+      writeErr(res, 400, error.message);
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function handleSearchAdmin(req, res, method, rest, deps) {
+  if (rest.length === 1 && rest[0] === "diagnostics") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "GET") {
+      return writeErr(res, 405, `method ${method} not allowed on search diagnostics`);
+    }
+    return handleSearchDiagnostics(res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "test") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search test`);
+    }
+    return handleSearchTest(req, res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "query") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search query`);
+    }
+    return handleSearchQuery(req, res, deps);
+  }
+  return writeErr(res, 404, `unknown search route '/${rest.join("/")}'`);
+}
+async function handleSearchDiagnostics(res, deps) {
+  const status = deps.searchStatus;
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const rows = buildSearchDoctorSnapshot(
+    status.runtime.listProviders(),
+    search.providers
+  );
+  const snapshot = {
+    rows,
+    modes: {
+      // codex is read from the LIVE config per request — an admin PUT has
+      // already applied. responses/anthropic were captured at bootstrap.
+      codex: search.modes.codex,
+      responses: status.modes.responses,
+      anthropic: status.modes.anthropic
+    },
+    applySemantics: { codex: "immediate", rest: "restart" }
+  };
+  return writeJson(res, 200, { diagnostics: snapshot });
+}
+async function handleSearchTest(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const egressPolicy = searchEgressPolicyFrom(search);
+  const fetchImpl = status.testFetch;
+  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
+  const contributions = [
+    ...(0, import_http3.builtinHttpSearchContributions)(transport),
+    ...(0, import_api3.apiSearchContributions)(search.providers, {
+      egressPolicy,
+      ...fetchImpl ? { fetchImpl } : {}
+    })
+  ];
+  const contribution = contributions.find((c) => c.id === providerId);
+  if (!contribution) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const results = await contribution.provider.search(SEARCH_DOCTOR_QUERY, { maxResults: 5 });
+    const diagnostic = classifyLiveSearchOutcome(
+      contribution.id,
+      { kind: "results", count: results.length },
+      checkedAt
+    );
+    const response = { diagnostic, resultCount: results.length };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+async function handleSearchQuery(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const query2 = body["query"];
+  if (typeof query2 !== "string" || query2.trim().length === 0) {
+    return writeErr(res, 400, "query must be a non-empty string");
+  }
+  if (query2.length > SEARCH_QUERY_MAX_CODE_UNITS) {
+    return writeErr(res, 400, `query must be at most ${SEARCH_QUERY_MAX_CODE_UNITS} characters`);
+  }
+  if (QUERY_CONTROL_CHARS.test(query2)) {
+    return writeErr(res, 400, "query must not contain control characters");
+  }
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const egressPolicy = searchEgressPolicyFrom(search);
+  const fetchImpl = status.testFetch;
+  const transport = fetchImpl ? (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy }) : void 0;
+  const contributions = [
+    ...(0, import_http3.builtinHttpSearchContributions)(transport),
+    ...(0, import_api3.apiSearchContributions)(search.providers, {
+      egressPolicy,
+      ...fetchImpl ? { fetchImpl } : {}
+    })
+  ];
+  const contribution = contributions.find((c) => c.id === providerId);
+  if (!contribution) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const results = await contribution.provider.search(query2, { maxResults: 5 });
+    const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
+      title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
+      url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
+      content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
+    }));
+    const diagnostic = sanitized.length === 0 ? { providerId: contribution.id, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      contribution.id,
+      { kind: "results", count: sanitized.length },
+      checkedAt
+    );
+    const response = {
+      diagnostic,
+      resultCount: sanitized.length,
+      results: sanitized
+    };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+
+// src/admin/searchAdminView.ts
+var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
+var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function redactSearchServerConfig(search) {
+  const providers = {};
+  for (const [id, raw] of Object.entries(search.providers)) {
+    const entry = raw;
+    const view = {};
+    if (entry.apiHost !== void 0) view.apiHost = entry.apiHost;
+    if (entry.basicAuthUsername !== void 0) view.basicAuthUsername = entry.basicAuthUsername;
+    if (API_KEY_PROVIDERS.has(id)) {
+      view.apiKeyConfigured = typeof entry.apiKey === "string" && entry.apiKey.length > 0;
+    }
+    if (BASIC_AUTH_PROVIDERS.has(id)) {
+      view.basicAuthPasswordConfigured = typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0;
+    }
+    providers[id] = view;
+  }
+  return {
+    modes: search.modes,
+    providers,
+    egress: { allowedPrivateHosts: [...search.egress.allowedPrivateHosts] },
+    policy: { ...search.policy, ...search.policy.allowed ? { allowed: [...search.policy.allowed] } : {} }
+  };
+}
+function storedSecrets(current, id) {
+  const entry = current.providers[id];
+  if (!entry) return {};
+  const out = {};
+  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) out.apiKey = entry.apiKey;
+  if (typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0) {
+    out.basicAuthPassword = entry.basicAuthPassword;
+  }
+  return out;
+}
+function resolveSecretField(entry, field, stored) {
+  if (!(field in entry)) {
+    if (stored !== void 0) entry[field] = stored;
+    return;
+  }
+  const value = entry[field];
+  if (value === null) {
+    delete entry[field];
+    return;
+  }
+  if (typeof value === "string" && value.trim().length > 0) return;
+  if (stored !== void 0) entry[field] = stored;
+  else delete entry[field];
+}
+function preserveSearchSecrets(incoming, current) {
+  if (!isRecord(incoming)) return incoming;
+  const section = { ...incoming };
+  const providersValue = section["providers"];
+  if (!isRecord(providersValue)) return section;
+  const providers = {};
+  for (const [id, entryValue] of Object.entries(providersValue)) {
+    if (!isRecord(entryValue)) {
+      providers[id] = entryValue;
+      continue;
+    }
+    const entry = { ...entryValue };
+    delete entry["apiKeyConfigured"];
+    delete entry["basicAuthPasswordConfigured"];
+    const stored = storedSecrets(current, id);
+    resolveSecretField(entry, "apiKey", stored.apiKey);
+    resolveSecretField(entry, "basicAuthPassword", stored.basicAuthPassword);
+    providers[id] = entry;
+  }
+  section["providers"] = providers;
+  return section;
+}
+
 // src/admin/keyPolicyBody.ts
 function parseKeyPolicyBody(body) {
   const policy = {};
@@ -3801,7 +4263,7 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord(value) {
+function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -3821,7 +4283,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord(entry)) {
+    if (!isRecord2(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -3850,12 +4312,12 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord2(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
       }
     }
-    if (!isRecord(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord2(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -3870,7 +4332,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord2(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -3888,15 +4350,15 @@ function validateGatewayBindingsSegment(patch) {
 }
 
 // src/admin/voucherAdmin.ts
-var import_outbound_api2 = require("@omnicross/core/outbound-api");
-function writeJson(res, status, body) {
+var import_outbound_api3 = require("@omnicross/core/outbound-api");
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeErr(res, status, message) {
-  writeJson(res, status, { error: { type: "voucher_error", message } });
+function writeErr2(res, status, message) {
+  writeJson2(res, status, { error: { type: "voucher_error", message } });
 }
-function readJsonBody2(req) {
+function readJsonBody3(req) {
   return new Promise((resolve10, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
@@ -3947,34 +4409,34 @@ function parseVoucherCreateBody(body) {
   return { ok: true, input };
 }
 async function voucherEnabled(deps) {
-  const config = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const config = await (0, import_outbound_api3.loadServerConfig)(deps.settingsStore);
   return config.voucher?.enabled === true;
 }
 async function handleVoucher(req, res, method, rest, deps) {
   const voucherDb = deps.voucherDb;
-  if (!voucherDb) return writeErr(res, 501, "Voucher feature is not available");
+  if (!voucherDb) return writeErr2(res, 501, "Voucher feature is not available");
   if (method === "GET" && rest.length === 0) {
     const rows = await voucherDb.voucherList();
-    return writeJson(res, 200, { vouchers: rows.map(import_outbound_api2.toVoucherInfo) });
+    return writeJson2(res, 200, { vouchers: rows.map(import_outbound_api3.toVoucherInfo) });
   }
   if (method === "POST" && rest.length === 0) {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     let body;
     try {
-      body = await readJsonBody2(req);
+      body = await readJsonBody3(req);
     } catch {
-      return writeErr(res, 400, "Invalid JSON in request body");
+      return writeErr2(res, 400, "Invalid JSON in request body");
     }
     const parsed = parseVoucherCreateBody(body);
-    if (!parsed.ok) return writeErr(res, 400, parsed.message);
-    const code = (0, import_outbound_api2.generateVoucherCode)();
+    if (!parsed.ok) return writeErr2(res, 400, parsed.message);
+    const code = (0, import_outbound_api3.generateVoucherCode)();
     const created = await voucherDb.voucherCreate({
-      id: (0, import_outbound_api2.newVoucherId)(),
-      codeHash: (0, import_outbound_api2.hashVoucherCode)(code),
-      codePrefix: (0, import_outbound_api2.voucherCodePrefix)(code),
+      id: (0, import_outbound_api3.newVoucherId)(),
+      codeHash: (0, import_outbound_api3.hashVoucherCode)(code),
+      codePrefix: (0, import_outbound_api3.voucherCodePrefix)(code),
       ...parsed.input
     });
-    return writeJson(res, 201, {
+    return writeJson2(res, 201, {
       id: created.id,
       codePrefix: created.codePrefix,
       type: created.type,
@@ -3985,11 +4447,11 @@ async function handleVoucher(req, res, method, rest, deps) {
   }
   const id = rest[0];
   if (method === "POST" && id && rest[1] === "revoke") {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     const ok = await voucherDb.voucherRevokeCas(id, Date.now());
-    return writeJson(res, ok ? 200 : 409, { ok });
+    return writeJson2(res, ok ? 200 : 409, { ok });
   }
-  return writeErr(res, 405, `method ${method} not allowed on voucher`);
+  return writeErr2(res, 405, `method ${method} not allowed on voucher`);
 }
 
 // src/admin/webhookConfigBody.ts
@@ -4156,7 +4618,7 @@ function resetBillingRuntimeForTests() {
 }
 
 // src/migration/migration.ts
-var import_outbound_api3 = require("@omnicross/core/outbound-api");
+var import_outbound_api4 = require("@omnicross/core/outbound-api");
 
 // src/ports/account-multi.ts
 var import_node_crypto8 = require("crypto");
@@ -4584,7 +5046,7 @@ async function gatherExport(deps, passphrase) {
     v: BUNDLE_VERSION,
     providers: cfg.providers,
     tokens,
-    server: (0, import_outbound_api3.normalizeServerConfig)(cfg.server)
+    server: (0, import_outbound_api4.normalizeServerConfig)(cfg.server)
   };
   return sealPack(JSON.stringify(bundle), passphrase);
 }
@@ -4633,7 +5095,7 @@ async function applyImport(packString, passphrase, mode, deps, parseProviderInpu
       const imageErrors = validateImagesAdminConfig(rawServer["images"]);
       if (imageErrors.length > 0) throw new Error("migration pack has an invalid Images config");
     }
-    validatedServer = (0, import_outbound_api3.normalizeServerConfig)(bundle.server);
+    validatedServer = (0, import_outbound_api4.normalizeServerConfig)(bundle.server);
   }
   const validatedProviders = [];
   for (const raw of rawProviders) {
@@ -4914,12 +5376,12 @@ async function handlePricingResolveConflicts(body, deps) {
 }
 
 // src/admin/accountAllowanceApi.ts
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeError2(res, status, message) {
-  writeJson2(res, status, { error: { type: "account_allowance_error", message } });
+  writeJson3(res, status, { error: { type: "account_allowance_error", message } });
 }
 function readJson2(req) {
   return new Promise((resolve10, reject) => {
@@ -4952,7 +5414,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (!service.getSchedulingStatus) {
       return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
-    return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
+    return writeJson3(res, 200, { scheduling: service.getSchedulingStatus() });
   }
   if (method === "GET") {
     const params = query(req);
@@ -4961,7 +5423,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
     const body = await readJson2(req);
@@ -4976,7 +5438,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
@@ -4992,7 +5454,7 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
-async function readJsonBody3(req) {
+async function readJsonBody4(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -5002,12 +5464,12 @@ async function readJsonBody3(req) {
     return {};
   }
 }
-function writeJson3(res, status, body) {
+function writeJson4(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson3(res, status, { error: { type: "admin_api_error", message } });
+  writeJson4(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -5028,7 +5490,7 @@ function toKeyInfo(row) {
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
     kind: row.kind,
-    allowedEndpoints: [...(0, import_outbound_api4.effectiveOutboundPermissions)(row.allowedEndpoints)],
+    allowedEndpoints: [...(0, import_outbound_api5.effectiveOutboundPermissions)(row.allowedEndpoints)],
     legacyPermissions: row.allowedEndpoints === void 0,
     loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
@@ -5114,6 +5576,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleServer(req, res, method, deps);
       case "images":
         return await handleImages(res, method, rest, deps);
+      case "search":
+        return await handleSearchAdmin(req, res, method, rest, deps);
       case "accounts":
         return await handleAccounts(req, res, method, rest, deps);
       case "cli":
@@ -5147,7 +5611,7 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson3(res, result.status, result.body);
+  writeJson4(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
@@ -5156,13 +5620,13 @@ async function handleUsage(req, res, method, rest, deps) {
 async function handleDashboardRoute(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody3(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody4(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
@@ -5173,7 +5637,7 @@ async function handlePricing(req, res, method, rest, deps) {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody3(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody4(req), deps));
   }
   return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
@@ -5187,15 +5651,15 @@ function migrationDeps(deps) {
 }
 async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -5226,13 +5690,13 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson3(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson4(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson3(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson4(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const provider = parseProviderInput(body, void 0);
     if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
@@ -5240,25 +5704,25 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson3(res, 201, { provider: toProviderView(provider) });
+    return writeJson4(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { provider: toProviderView(updated) });
+    return writeJson4(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -5267,7 +5731,7 @@ function persistProviders(cfg, deps) {
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
     return writeJsonError(res, 400, "reorder requires { order: string[] }");
@@ -5291,14 +5755,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson3(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
-    return writeJson3(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson4(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -5315,32 +5779,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson3(res, 200, { models });
+    return writeJson4(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson3(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson4(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson3(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson4(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -5379,9 +5843,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson4(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -5389,7 +5853,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -5430,7 +5894,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -5449,7 +5913,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const parsed = parsePoolKeyInput(body);
   if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -5461,7 +5925,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -5471,7 +5935,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -5481,7 +5945,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -5495,7 +5959,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -5505,11 +5969,11 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -5695,13 +6159,13 @@ function handlePresets(res, method) {
     website: p.website,
     modelsEndpoint: p.modelsEndpoint
   }));
-  return writeJson3(res, 200, { presets, excluded });
+  return writeJson4(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson3(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson4(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -5713,13 +6177,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson3(res, 200, { keys });
+    return writeJson4(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
-    const created = await (0, import_outbound_api4.createNamedKey)(deps.keyDb, name);
-    return writeJson3(res, 201, {
+    const created = await (0, import_outbound_api5.createNamedKey)(deps.keyDb, name);
+    return writeJson4(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -5730,7 +6194,7 @@ async function handleKeys(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
     const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
-    if (revealed !== null) return writeJson3(res, 200, { key: revealed });
+    if (revealed !== null) return writeJson4(res, 200, { key: revealed });
     const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
     if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
     return writeJsonError(
@@ -5745,32 +6209,32 @@ async function handleKeys(req, res, method, rest, deps) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "DELETE" && id && !action) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysDelete(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const enabled = body["enabled"] === true;
     if (!enabled) {
       const bound = await integrationKeyRequirement(deps, id);
       if (bound) return writeJsonError(res, 409, bound);
     }
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson3(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson4(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "permissions") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "permissions")) {
       return writeJsonError(res, 400, "body must contain only permissions");
     }
     let permissions;
     try {
-      permissions = (0, import_outbound_api4.validateOutboundPermissions)(body["permissions"]);
+      permissions = (0, import_outbound_api5.validateOutboundPermissions)(body["permissions"]);
     } catch {
       return writeJsonError(
         res,
@@ -5779,19 +6243,19 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const before = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-    if (!before) return writeJson3(res, 404, { ok: false });
-    if (before.revokedAt !== null) return writeJson3(res, 409, { ok: false });
+    if (!before) return writeJson4(res, 404, { ok: false });
+    if (before.revokedAt !== null) return writeJson4(res, 409, { ok: false });
     const required = await integrationKeyRequirement(deps, id, permissions);
     if (required) return writeJsonError(res, 409, required);
     const ok = await deps.keyDb.outboundApiKeysSetPermissions(id, permissions);
     if (!ok) {
       const current = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-      return writeJson3(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
+      return writeJson4(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
     }
-    return writeJson3(res, 200, { ok: true, allowedEndpoints: permissions });
+    return writeJson4(res, 200, { ok: true, allowedEndpoints: permissions });
   }
   if (method === "POST" && id && action === "max-concurrency") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const raw = body["maxConcurrency"];
     let value;
     if (raw === null) {
@@ -5806,14 +6270,14 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson3(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson4(res, ok ? 200 : 404, { ok, maxConcurrency: value });
   }
   if (method === "POST" && id && action === "policy") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = parseKeyPolicyBody(body);
     if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
@@ -5904,7 +6368,8 @@ function outboundServerConfigInput(config) {
     userMessageQueue: config.userMessageQueue,
     concurrencyQueue: config.concurrencyQueue,
     voucher: config.voucher,
-    anthropic: config.anthropic
+    anthropic: config.anthropic,
+    search: config.search
   };
 }
 function projectImagesConfigForAdmin(config) {
@@ -5940,8 +6405,8 @@ function sameConfigValue(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 function imageConfigurationAuditFields(previous, next) {
-  const before = previous ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
-  const after = next ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
+  const before = previous ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
+  const after = next ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
   const fields = [];
   if (before.enabled !== after.enabled) fields.push("enablement");
   if (before.provider !== after.provider) fields.push("provider");
@@ -5967,15 +6432,21 @@ function currentImageGenerationId(deps) {
 }
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
-    const config = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+    const config = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
     let server = config;
     if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
     if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
     if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(server) });
+    if (config.search) {
+      server = {
+        ...server,
+        search: redactSearchServerConfig(config.search)
+      };
+    }
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(server) });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody3(req);
+    const patch = await readJsonBody4(req);
     const queueErrors = validateQueueSegments(patch);
     if (queueErrors.length > 0) {
       return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
@@ -6004,7 +6475,7 @@ async function handleServer(req, res, method, deps) {
     if (billingErrors.length > 0) {
       return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
     }
-    const current = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+    const current = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
     let effectivePatch = patch;
     if (patch.proxy) {
       effectivePatch = { ...effectivePatch, proxy: preserveOutboundProxySecrets(patch.proxy, current.proxy) };
@@ -6025,7 +6496,21 @@ async function handleServer(req, res, method, deps) {
       }
       effectivePatch = { ...effectivePatch, images };
     }
-    const merged = (0, import_outbound_api4.mergeServerConfig)(current, effectivePatch);
+    if (patch.search !== void 0) {
+      const searchPatch = preserveSearchSecrets(
+        patch.search,
+        current.search ?? import_outbound_api5.DEFAULT_SEARCH_SERVER_CONFIG
+      );
+      const searchErrors = (0, import_outbound_api5.validateSearchServerConfig)(searchPatch);
+      if (searchErrors.length > 0) {
+        return writeJsonError(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
+      }
+      effectivePatch = {
+        ...effectivePatch,
+        search: searchPatch
+      };
+    }
+    const merged = (0, import_outbound_api5.mergeServerConfig)(current, effectivePatch);
     const priorImageGenerationId = currentImageGenerationId(deps);
     try {
       await applyServerConfigTransaction(current, merged, {
@@ -6055,7 +6540,7 @@ async function handleServer(req, res, method, deps) {
             throw error;
           }
         },
-        persist: (next) => (0, import_outbound_api4.saveServerConfig)(deps.settingsStore, next),
+        persist: (next) => (0, import_outbound_api5.saveServerConfig)(deps.settingsStore, next),
         restorePersisted: (snapshot) => deps.settingsStore.restoreDocumentSnapshot(snapshot)
       });
     } catch (error) {
@@ -6077,7 +6562,11 @@ async function handleServer(req, res, method, deps) {
       } catch {
       }
     }
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(merged) });
+    const mergedForAdmin = merged.search ? {
+      ...merged,
+      search: redactSearchServerConfig(merged.search)
+    } : merged;
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
@@ -6094,7 +6583,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       sessionKey: query2.get("sessionKey") ?? void 0,
       limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       records,
       capacity: import_AccountRouteActivity.ACCOUNT_ROUTE_ACTIVITY_LIMIT,
@@ -6110,7 +6599,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       entries,
       collectedAt: Date.now()
@@ -6129,10 +6618,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson3(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson4(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = validateAccountBatchBody(body);
     if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
     const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
@@ -6148,15 +6637,15 @@ async function handleAccounts(req, res, method, rest, deps) {
         deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
       }
     }
-    return writeJson3(res, 200, { ok: true, affected: result.affected });
+    return writeJson4(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
     const result = handleCodexOAuthCancel(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6178,7 +6667,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       resumeAt: entry.resumeAt
     })) ?? [];
     const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
-    return writeJson3(res, 200, { diagnostics });
+    return writeJson4(res, 200, { diagnostics });
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "events") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6190,17 +6679,17 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
     const diagnostics = (0, import_SubscriptionAccountHealth.getSharedAccountHealth)().getDiagnostics({ providerId, accountId });
-    return writeJson3(res, 200, { events: snapshot?.records ?? [], diagnostics });
+    return writeJson4(res, 200, { events: snapshot?.records ?? [], diagnostics });
   }
   if (method === "PATCH" && rest.length === 2) {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const patch = validateAccountMetadataPatch(body);
     if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
     const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
     if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6209,15 +6698,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
         return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
@@ -6225,20 +6714,20 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson4(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
         return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: true,
         account: status2 ?? void 0,
         nativeCredentialMode: result.nativeCredentialMode,
@@ -6253,7 +6742,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson4(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest.length === 3 && rest[2] === "test") {
       const accountId = rest[1];
@@ -6263,7 +6752,7 @@ async function handleAccounts(req, res, method, rest, deps) {
         return writeJsonError(res, 404, `account '${accountId}' not found`);
       }
       const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: result.ok,
         marked: result.marked,
         tier: result.tier,
@@ -6272,15 +6761,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const raw = body2["priority"];
       const priority = typeof raw === "number" ? raw : Number(raw);
       if (!Number.isFinite(priority)) {
@@ -6288,76 +6777,76 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const rawProxy = body2["proxy"];
       let proxy;
       if (rawProxy !== null && rawProxy !== void 0) {
-        proxy = (0, import_outbound_api4.normalizeProxyConfig)(rawProxy);
+        proxy = (0, import_outbound_api5.normalizeProxyConfig)(rawProxy);
         if (!proxy) return writeJsonError(res, 400, "invalid proxy config");
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const parsed = validateSupportedModelsBody(body2["supportedModels"]);
       if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
       deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
       deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE") {
       return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
       return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson3(res, 200, status ? { account: status } : { ok: true });
+    return writeJson4(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -6365,14 +6854,14 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
@@ -6381,7 +6870,7 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
@@ -6391,52 +6880,52 @@ async function handleIntegrations(req, res, method, rest, deps) {
   const manager = factory();
   try {
     if (method === "GET" && rest.length === 0) {
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         integrations: await manager.listStatus(),
         gateway: deps.outboundApiServer.getStatus()
       });
     }
     if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
       await manager.rotateGatewayKey();
-      return writeJson3(res, 200, { ok: true, integrations: await manager.listStatus() });
+      return writeJson4(res, 200, { ok: true, integrations: await manager.listStatus() });
     }
     const client = rest[0];
     if (!isIntegrationClient(client)) {
       return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "key") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       if (Object.keys(body).length !== 1 || typeof body.keyId !== "string" || !body.keyId.trim()) {
         return writeJsonError(res, 400, "body must contain a non-empty keyId string");
       }
       const status = await manager.bindIntegrationKey(client, body.keyId.trim());
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "plan") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const plan = await manager.plan(client, configPath);
-      return writeJson3(res, 200, { plan });
+      return writeJson4(res, 200, { plan });
     }
     if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const status = await manager.install(client, configPath);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "repair") {
       const status = await manager.repair(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
       const status = await manager.remove(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
   } catch (error) {
@@ -6579,8 +7068,8 @@ async function handleImages(res, method, rest, deps) {
   }
   const reader = deps.imageRuntimeStatus;
   if (!reader) return writeJsonError(res, 501, "Images runtime status is not available");
-  const serverConfig = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
-  const images = serverConfig.images ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
+  const serverConfig = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
+  const images = serverConfig.images ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
   const lifecycle = reader.status();
   const capability = await reader.inspectCapability(IMAGE_ADMIN_STATUS_TENANT);
   const resources = safeRuntimeResources(reader.resourceStatus());
@@ -6599,7 +7088,7 @@ async function handleImages(res, method, rest, deps) {
     httpLeases: safeStatusCount(generation.httpLeases),
     hostedLeases: safeStatusCount(generation.hostedLeases)
   }));
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     configured: {
       enabled: images.enabled,
       provider: images.provider,
@@ -6627,11 +7116,11 @@ async function handleImages(res, method, rest, deps) {
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
-  const serverConfig = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+  const serverConfig = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
   const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
-    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => (0, import_outbound_api4.gatewayBindingToEndpointConfig)(binding));
+    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => (0, import_outbound_api5.gatewayBindingToEndpointConfig)(binding));
     const useSubscription = routes.some((route) => route.useSubscription);
-    if ((0, import_outbound_api4.isKindMappedEndpoint)(endpoint)) {
+    if ((0, import_outbound_api5.isKindMappedEndpoint)(endpoint)) {
       const kinds = {};
       for (const route of routes) {
         for (const [kind, ref] of Object.entries(route.modelMap ?? {})) {
@@ -6665,14 +7154,14 @@ async function handleStatus(res, method, deps) {
   })() : void 0;
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ...status,
       endpoints,
       queueStatus,
       ...imageRuntime ? { imageRuntime } : {}
     });
   }
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     ...status,
     endpoints,
     ...imageRuntime ? { imageRuntime } : {}
@@ -6696,18 +7185,18 @@ function resolvePlaygroundPath(endpoint, body) {
 }
 async function handlePlayground(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord2(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord3(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord2(v) {
+function isRecord3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
@@ -6843,7 +7332,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.2.1" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -7296,14 +7785,14 @@ function defaultBillingDir(configPath) {
 
 // src/image-generation/ImageDoctorService.ts
 var import_image_generation = require("@omnicross/core/image-generation");
-var import_outbound_api6 = require("@omnicross/core/outbound-api");
+var import_outbound_api7 = require("@omnicross/core/outbound-api");
 var import_subscriptions3 = require("@omnicross/subscriptions");
 
 // src/image-generation/FileCodexImageCapabilityEvidenceSource.ts
 var import_node_crypto13 = require("crypto");
 var import_node_fs10 = require("fs");
 var import_node_path11 = require("path");
-var import_outbound_api5 = require("@omnicross/core/outbound-api");
+var import_outbound_api6 = require("@omnicross/core/outbound-api");
 
 // src/image-generation/imageTenantHmac.ts
 var import_node_crypto12 = require("crypto");
@@ -7376,7 +7865,7 @@ var ACCOUNT_DOMAIN = Buffer.from("omnicross:codex-image-evidence:account:v1\0",
 var ACCOUNT_KEY = /^[a-f0-9]{64}$/u;
 var SIZE = /^(?:auto|[1-9][0-9]{1,4}x[1-9][0-9]{1,4})$/u;
 var MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
-var PHYSICAL_RETENTION_TTL_MS = import_outbound_api5.IMAGE_SERVER_HARD_CEILINGS.evidenceTtlMs;
+var PHYSICAL_RETENTION_TTL_MS = import_outbound_api6.IMAGE_SERVER_HARD_CEILINGS.evidenceTtlMs;
 function exactKeys(value, allowed) {
   const allow = new Set(allowed);
   return Object.keys(value).every((key) => allow.has(key));
@@ -7750,7 +8239,7 @@ function createImageDoctorService(options) {
   const activePaths = () => options.storageCatalog.active().resolver;
   return Object.freeze({
     inspectLocal: async (config) => {
-      const configErrors = (0, import_outbound_api6.validateImagesServerConfig)(config);
+      const configErrors = (0, import_outbound_api7.validateImagesServerConfig)(config);
       let verifiedAreas = 0;
       try {
         const paths = activePaths();
@@ -7792,7 +8281,7 @@ function createImageDoctorService(options) {
           continue;
         }
         try {
-          const permissions = (0, import_outbound_api6.validateOutboundPermissions)(row.allowedEndpoints);
+          const permissions = (0, import_outbound_api7.validateOutboundPermissions)(row.allowedEndpoints);
           if (permissions.includes("images")) imagesAuthorizedRows += 1;
         } catch {
           invalidRows += 1;
@@ -8096,7 +8585,7 @@ var ImageCleanupService = class {
 // src/image-generation/ImageRuntimeGenerationFactory.ts
 var import_node_crypto16 = require("crypto");
 var import_image_generation5 = require("@omnicross/core/image-generation");
-var import_outbound_api7 = require("@omnicross/core/outbound-api");
+var import_outbound_api8 = require("@omnicross/core/outbound-api");
 var import_subscriptions4 = require("@omnicross/subscriptions");
 
 // src/image-generation/ImageApiRuntimeResolver.ts
@@ -8564,7 +9053,7 @@ function createImageRuntimeGeneration(options) {
     throw new TypeError("image runtime generation id is invalid");
   }
   const config = snapshotConfig(options.config);
-  const configErrors = (0, import_outbound_api7.validateImagesServerConfig)(config);
+  const configErrors = (0, import_outbound_api8.validateImagesServerConfig)(config);
   if (configErrors.length > 0) {
     throw new TypeError(`image runtime configuration is invalid: ${configErrors[0]}`);
   }
@@ -12156,7 +12645,7 @@ function safeStringify(value) {
 var import_node_crypto20 = require("crypto");
 var import_node_fs16 = require("fs");
 var import_node_path17 = require("path");
-var import_outbound_api8 = require("@omnicross/core/outbound-api");
+var import_outbound_api9 = require("@omnicross/core/outbound-api");
 function atomicReplaceDocument(targetPath, contents) {
   const tempPath = (0, import_node_path17.join)(
     (0, import_node_path17.dirname)(targetPath),
@@ -12204,13 +12693,13 @@ var JsonApiServerSettingsStore = class {
   box;
   atomicReplace;
   async get(key) {
-    if (key !== import_outbound_api8.OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
+    if (key !== import_outbound_api9.OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
     const file = this.readFile();
     if (file.server === void 0) return void 0;
     return this.decryptSecrets(file.server);
   }
   async set(key, value) {
-    if (key !== import_outbound_api8.OUTBOUND_API_SERVER_CONFIG_KEY) return;
+    if (key !== import_outbound_api9.OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
     this.atomicReplace(
@@ -17102,7 +17591,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
   (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
-    (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+    (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
   const keyDb = new JsonOutboundKeyDb(paths.keysPath, secretBox3);
@@ -17123,7 +17612,7 @@ function buildDaemon(config, paths) {
     logger
   );
   claudeAllowanceRefreshScheduler.configure(
-    (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+    (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const subscriptionAccounts = new import_subscriptions6.SubscriptionAccountService(credentialStore);
   (0, import_subscriptions6.setSubscriptionAccountService)(subscriptionAccounts);
@@ -17168,13 +17657,21 @@ function buildDaemon(config, paths) {
     defaultUsageEventsPath(paths.configPath),
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
   );
-  const keySpendTracker = new import_outbound_api10.KeySpendTracker(usageEventStore);
+  const keySpendTracker = new import_outbound_api11.KeySpendTracker(usageEventStore);
   const usageThroughput = (0, import_usage2.getSharedUsageThroughputTracker)();
   const usageRecorder = new import_usage2.UsageRecorder(usageEventStore, pricingEngine, logger, {
     onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at),
     onEvent: (row, at) => usageThroughput.record(row, at)
   });
-  const initialImagesConfig = (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).images;
+  const initialImagesConfig = (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).images;
+  const initialSearchConfig = (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).search;
+  for (const issue of (0, import_outbound_api10.validateSearchServerConfig)(
+    decryptedConfig.server?.search
+  )) {
+    logger.warn("[search] ignoring invalid config: " + issue);
+  }
+  const searchRuntime = buildSearchRuntime(initialSearchConfig, { logger });
+  const searchFrontendModes = initialSearchConfig.modes;
   const imageObservability = new ImageObservability();
   const imageRuntimeObservability = Object.freeze({
     telemetrySink: imageObservability.telemetrySink,
@@ -17304,7 +17801,9 @@ function buildDaemon(config, paths) {
       apiKeyPool,
       usageRecorder,
       openAIOperationRegistry,
-      responsesHostedImageIngress
+      responsesHostedImageIngress,
+      searchRuntime,
+      searchFrontendModes
     });
     if (providerProxy.getDeps().openAIOperationRegistry !== openAIOperationRegistry) {
       throw new Error(
@@ -17338,7 +17837,7 @@ function buildDaemon(config, paths) {
     credentialStore,
     (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger,
-    import_outbound_api9.DEFAULT_ACCOUNT_PROBE
+    import_outbound_api10.DEFAULT_ACCOUNT_PROBE
   );
   const getHealthReport = () => buildHealthReport({
     version: DAEMON_VERSION,
@@ -17355,7 +17854,7 @@ function buildDaemon(config, paths) {
     // `/health` body stays byte-identical (zero regression).
     subscriptionAccountsHealthy: () => accountHealthProbeScheduler.enabled ? accountHealthProbeScheduler.probedAccountsHealthy() : void 0
   });
-  const outboundApiServer = (0, import_outbound_api9.getOutboundApiServer)({
+  const outboundApiServer = (0, import_outbound_api10.getOutboundApiServer)({
     db: keyDb,
     // voucher-redemption #9: the key-authenticated `POST /redeem` endpoint redeems
     // cards against the presenting key (gated on `voucher.enabled`).
@@ -17369,7 +17868,9 @@ function buildDaemon(config, paths) {
     keySpendTracker,
     // configurable-logging: route the server's OWN lifecycle + relay dispatch-error
     // lines through the injected logger (honors level/format/file sink).
-    logger
+    logger,
+    // plan 阶段5: the same instance the managed frontends hold.
+    searchRuntime
   });
   const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
@@ -17391,6 +17892,10 @@ function buildDaemon(config, paths) {
     }),
     routeLeaseManager,
     subscriptionAccounts,
+    // search-settings-ui D3: the daemon's ONE search runtime + its
+    // bootstrap-captured modes, for `GET /admin/api/search/diagnostics` and
+    // `POST /admin/api/search/test` (501 when a light embedder omits it).
+    searchStatus: { runtime: searchRuntime, modes: searchFrontendModes },
     accountAllowanceService,
     allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
     accountProbeService: accountHealthProbeScheduler,
@@ -17440,7 +17945,7 @@ function buildDaemon(config, paths) {
     cliCommandRunner: paths.cliCommandRunner,
     integrationManagerFactory: () => {
       const live = outboundApiServer.getStatus();
-      const port = live.port || decryptedConfig.server?.port || import_outbound_api9.DEFAULT_OUTBOUND_PORT;
+      const port = live.port || decryptedConfig.server?.port || import_outbound_api10.DEFAULT_OUTBOUND_PORT;
       return new IntegrationManager({
         configPath: paths.configPath,
         gatewayBaseUrl: live.loopbackUrl ?? `http://127.0.0.1:${port}`,
@@ -17527,6 +18032,8 @@ function buildDaemon(config, paths) {
     keyDb,
     settingsStore,
     openAIOperationRegistry,
+    searchRuntime,
+    searchFrontendModes,
     imageRuntimeManager,
     imageObservability,
     imageCleanupService,
@@ -17562,7 +18069,7 @@ function buildDaemon(config, paths) {
 function resetDaemonSingletonsForTests() {
   resetImageRuntimeBootstrapSession();
   (0, import_provider_proxy4.__resetProviderProxyForTests)();
-  (0, import_outbound_api9.__resetOutboundApiServerForTests)();
+  (0, import_outbound_api10.__resetOutboundApiServerForTests)();
   (0, import_subscriptionRegistryPort.setSubscriptionRegistryForOutbound)(null);
   (0, import_subscriptions6.setSubscriptionProviderRegistry)(null);
   (0, import_subscriptions6.setSubscriptionAccountService)(null);