@omnicross/daemon 0.2.0 → 0.3.0

package/dist/cli.cjs

@@ -1160,7 +1160,10 @@ ${turn.responseBody}`);
 
 // src/commands/doctor.ts
 var import_node_util2 = require("util");
-var import_outbound_api11 = require("@omnicross/core/outbound-api");
+var import_outbound_api12 = require("@omnicross/core/outbound-api");
+var import_api4 = require("@omnicross/core/search/api");
+var import_http4 = require("@omnicross/core/search/http");
+var import_search3 = require("@omnicross/core/search");
 
 // src/bootstrap.ts
 var import_node_fs35 = require("fs");
@@ -1170,17 +1173,17 @@ var import_billing_types = require("@omnicross/contracts/billing-types");
 var import_core4 = require("@omnicross/core");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
-var import_outbound_api9 = require("@omnicross/core/outbound-api");
+var import_outbound_api10 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
-var import_outbound_api10 = require("@omnicross/core/outbound-api");
+var import_outbound_api11 = require("@omnicross/core/outbound-api");
 var import_usage2 = require("@omnicross/core/usage");
 var import_subscriptions6 = require("@omnicross/subscriptions");
 
@@ -1977,11 +1980,11 @@ async function handleRouteLeaseApi(req, res, path2, deps) {
 
 // src/admin/adminApi.ts
 var import_node_http = __toESM(require("http"), 1);
-var import_outbound_api4 = require("@omnicross/core/outbound-api");
+var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/image-generation/imagesConfigValidation.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
@@ -4502,6 +4505,502 @@ async function handleDashboard(deps) {
   return { status: 200, body: summary };
 }
 
+// src/admin/searchAdminApi.ts
+var import_outbound_api2 = require("@omnicross/core/outbound-api");
+var import_api3 = require("@omnicross/core/search/api");
+var import_http3 = require("@omnicross/core/search/http");
+var import_search2 = require("@omnicross/core/search");
+
+// src/search/searchDoctorProjection.ts
+var import_search_types = require("@omnicross/contracts/search-types");
+var import_api = require("@omnicross/core/search/api");
+var import_http = require("@omnicross/core/search/http");
+var API_DOCTOR_PROVIDERS = [
+  {
+    id: "tavily",
+    capabilities: import_api.TAVILY_CAPABILITIES,
+    configured: (configs) => configs.tavily !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "jina",
+    capabilities: import_api.JINA_CAPABILITIES,
+    configured: (configs) => configs.jina !== void 0,
+    // Honest about the asymmetry: Jina CAN run keyless, but a provider nobody
+    // asked for is still not enabled.
+    missingReason: "not configured (Jina can run without a key, but must be enabled explicitly)"
+  },
+  {
+    id: "searxng",
+    capabilities: import_api.SEARXNG_CAPABILITIES,
+    configured: (configs) => configs.searxng !== void 0,
+    missingReason: "no API host configured"
+  },
+  {
+    id: "zhipu",
+    capabilities: import_api.ZHIPU_CAPABILITIES,
+    configured: (configs) => configs.zhipu !== void 0,
+    missingReason: "no API key configured"
+  },
+  {
+    id: "z.ai",
+    capabilities: import_api.ZHIPU_CAPABILITIES,
+    configured: (configs) => configs["z.ai"] !== void 0,
+    missingReason: "no API key configured"
+  }
+];
+function buildSearchDoctorSnapshot(contributions = (0, import_http.builtinHttpSearchContributions)(), apiConfigs) {
+  const rows = contributions.map((contribution) => ({
+    providerId: contribution.id,
+    source: contribution.source,
+    kind: contribution.kind,
+    capabilities: contribution.capabilities
+  }));
+  if (apiConfigs === void 0) return rows;
+  for (const provider of API_DOCTOR_PROVIDERS) {
+    if (provider.configured(apiConfigs)) continue;
+    rows.push({
+      providerId: provider.id,
+      source: "builtin",
+      kind: "api",
+      capabilities: provider.capabilities,
+      status: "unconfigured",
+      reason: provider.missingReason
+    });
+  }
+  return rows;
+}
+var SEARCH_DOCTOR_QUERY = "MDN HTTP headers documentation";
+function classifyLiveSearchOutcome(providerId, outcome, checkedAt) {
+  if (outcome.kind === "results") {
+    if (outcome.count > 0) return { providerId, status: "healthy", checkedAt };
+    return {
+      providerId,
+      status: "degraded",
+      checkedAt,
+      reason: "reachable, but the engine returned no usable results (possible partial drift)"
+    };
+  }
+  const error = (0, import_search_types.toSearchErrorShape)(outcome.error);
+  const stage = error.details?.stage;
+  const { status, reason } = classifySearchFailure(stage, error.code);
+  return { providerId, status, checkedAt, reason, error };
+}
+function classifySearchFailure(stage, code) {
+  if (stage === "challenge") {
+    return { status: "blocked", reason: "the engine served a bot challenge instead of results" };
+  }
+  if (stage === "trust") {
+    return {
+      status: "blocked",
+      reason: "the engine served a page that failed the anti-decoy trust check"
+    };
+  }
+  if (code === "policy_denied") {
+    return {
+      status: "blocked",
+      reason: "the egress policy refused the request target"
+    };
+  }
+  if (code === "parse_failed") {
+    return {
+      status: "failed",
+      reason: "the response was not recognizable as a search result page (parser drift suspected)"
+    };
+  }
+  if (code === "timeout") {
+    return { status: "failed", reason: "the request exceeded its time budget" };
+  }
+  return { status: "failed", reason: `the request failed (${code})` };
+}
+async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  const diagnostics = [];
+  for (const contribution of contributions) {
+    try {
+      const results = await contribution.provider.search(SEARCH_DOCTOR_QUERY, { maxResults: 5 });
+      diagnostics.push(
+        classifyLiveSearchOutcome(contribution.id, { kind: "results", count: results.length }, now())
+      );
+    } catch (error) {
+      diagnostics.push(classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, now()));
+    }
+  }
+  return diagnostics;
+}
+
+// src/search/SearchAssembly.ts
+var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_search = require("@omnicross/core/search");
+var import_api2 = require("@omnicross/core/search/api");
+var import_http2 = require("@omnicross/core/search/http");
+function searchEgressPolicyFrom(config) {
+  const hosts = config.egress.allowedPrivateHosts;
+  return hosts.length > 0 ? { allowedPrivateHosts: [...hosts] } : {};
+}
+function searchPolicyFrom(config) {
+  const { preferred, allowed, fallbackEnabled, maxAttempts } = config.policy;
+  return {
+    ...preferred !== void 0 ? { preferred } : {},
+    ...allowed !== void 0 ? { allowed: [...allowed] } : {},
+    fallbackEnabled,
+    ...maxAttempts !== void 0 ? { maxAttempts } : {}
+  };
+}
+function resolveSearchUpstreamDispatcher(url) {
+  return (0, import_upstreamFetch3.resolveUpstreamDispatcher)({ url });
+}
+var searchUpstreamProxyConfig = createUpstreamProxyResolver();
+function resolveSearchUpstreamProxyConfig(url) {
+  return searchUpstreamProxyConfig({ url });
+}
+function searchContributionsFrom(config) {
+  return [
+    ...(0, import_http2.builtinHttpSearchContributions)(
+      (0, import_http2.createSearchHttpTransport)({
+        resolveProxyDispatcher: resolveSearchUpstreamDispatcher,
+        resolveProxyConfig: resolveSearchUpstreamProxyConfig
+      })
+    ),
+    ...(0, import_api2.apiSearchContributions)(config.providers, {
+      egressPolicy: searchEgressPolicyFrom(config),
+      resolveProxyDispatcher: resolveSearchUpstreamDispatcher
+    })
+  ];
+}
+function buildSearchRuntime(config, options = {}) {
+  const logger = options.logger ?? null;
+  return (0, import_search.createSearchRuntime)({
+    contributions: options.contributions ?? searchContributionsFrom(config),
+    policy: searchPolicyFrom(config),
+    ...logger ? {
+      onEvent: (event) => {
+        logger.debug(`[search] ${formatSearchEvent(event)}`);
+      }
+    } : {}
+  });
+}
+function formatSearchEvent(event) {
+  const parts = [
+    `type=${event.type}`,
+    `request=${event.requestId}`,
+    `queryHash=${event.queryHash}`,
+    `durationMs=${event.durationMs}`
+  ];
+  if ("providerId" in event && event.providerId !== void 0) {
+    parts.push(`provider=${event.providerId}`);
+  }
+  if ("outcome" in event && event.outcome !== void 0) parts.push(`outcome=${event.outcome}`);
+  if ("errorCode" in event && event.errorCode !== void 0) parts.push(`error=${event.errorCode}`);
+  if ("resultCount" in event && event.resultCount !== void 0) {
+    parts.push(`results=${event.resultCount}`);
+  }
+  if ("fallbackCount" in event && event.fallbackCount !== void 0) {
+    parts.push(`fallbacks=${event.fallbackCount}`);
+  }
+  return parts.join(" ");
+}
+
+// src/admin/searchAdminApi.ts
+var KEYLESS_HTTP_PROVIDER_IDS = /* @__PURE__ */ new Set(["http-bing", "http-duckduckgo"]);
+var API_PROVIDER_IDS = /* @__PURE__ */ new Set([
+  "tavily",
+  "jina",
+  "searxng",
+  "zhipu",
+  "z.ai"
+]);
+var SEARCH_QUERY_MAX_CODE_UNITS = 256;
+var QUERY_CONTROL_CHARS = /[\u0000-\u001f\u007f]/u;
+var SEARCH_RESULT_FIELD_CAPS = { title: 512, url: 2048, content: 1024 };
+var SEARCH_QUERY_MAX_RESULTS = 5;
+function sanitizeResultField(value, cap) {
+  const text = typeof value === "string" ? value : value === null || value === void 0 ? "" : String(value);
+  return text.replace(/[\u0000-\u001f\u007f]/gu, "").slice(0, cap);
+}
+function writeJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeErr(res, status, message) {
+  writeJson(res, status, { error: { type: "admin_api_error", message } });
+}
+var SEARCH_MAX_BODY_BYTES = 64 * 1024;
+var SearchBodyTooLargeError = class extends Error {
+};
+async function readJsonBody2(req) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > SEARCH_MAX_BODY_BYTES) throw new SearchBodyTooLargeError("request body is too large");
+    chunks.push(buffer);
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  if (!raw.trim()) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function readBodyOrReject(req, res) {
+  try {
+    return await readJsonBody2(req);
+  } catch (error) {
+    if (error instanceof SearchBodyTooLargeError) {
+      writeErr(res, 400, error.message);
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function handleSearchAdmin(req, res, method, rest, deps) {
+  if (rest.length === 1 && rest[0] === "diagnostics") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "GET") {
+      return writeErr(res, 405, `method ${method} not allowed on search diagnostics`);
+    }
+    return handleSearchDiagnostics(res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "test") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search test`);
+    }
+    return handleSearchTest(req, res, deps);
+  }
+  if (rest.length === 1 && rest[0] === "query") {
+    if (!deps.searchStatus) {
+      return writeErr(res, 501, "Search status is not available in this build");
+    }
+    if (method !== "POST") {
+      return writeErr(res, 405, `method ${method} not allowed on search query`);
+    }
+    return handleSearchQuery(req, res, deps);
+  }
+  return writeErr(res, 404, `unknown search route '/${rest.join("/")}'`);
+}
+async function handleSearchDiagnostics(res, deps) {
+  const status = deps.searchStatus;
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const rows = buildSearchDoctorSnapshot(
+    status.runtime.listProviders(),
+    search.providers
+  );
+  const snapshot = {
+    rows,
+    modes: {
+      // codex is read from the LIVE config per request — an admin PUT has
+      // already applied. responses/anthropic were captured at bootstrap.
+      codex: search.modes.codex,
+      responses: status.modes.responses,
+      anthropic: status.modes.anthropic
+    },
+    applySemantics: { codex: "immediate", rest: "restart" }
+  };
+  return writeJson(res, 200, { diagnostics: snapshot });
+}
+function persistedSearchContributions(search, fetchImpl) {
+  if (fetchImpl) {
+    const egressPolicy = searchEgressPolicyFrom(search);
+    return [
+      ...(0, import_http3.builtinHttpSearchContributions)(
+        (0, import_http3.createSearchHttpTransport)({ fetch: fetchImpl, egressPolicy })
+      ),
+      ...(0, import_api3.apiSearchContributions)(search.providers, { egressPolicy, fetchImpl })
+    ];
+  }
+  return searchContributionsFrom(search);
+}
+async function handleSearchTest(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const fetchImpl = status.testFetch;
+  const contributions = persistedSearchContributions(search, fetchImpl);
+  const contribution = contributions.find((c) => c.id === providerId);
+  if (!contribution) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const results = await contribution.provider.search(SEARCH_DOCTOR_QUERY, { maxResults: 5 });
+    const diagnostic = classifyLiveSearchOutcome(
+      contribution.id,
+      { kind: "results", count: results.length },
+      checkedAt
+    );
+    const response = { diagnostic, resultCount: results.length };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(contribution.id, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+async function handleSearchQuery(req, res, deps) {
+  const status = deps.searchStatus;
+  const body = await readBodyOrReject(req, res);
+  if (body === void 0) return;
+  const providerId = body["providerId"];
+  if (typeof providerId !== "string" || providerId.length === 0) {
+    return writeErr(res, 400, "providerId must be a non-empty string");
+  }
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && !API_PROVIDER_IDS.has(providerId)) {
+    return writeErr(res, 404, `unknown search provider '${providerId}'`);
+  }
+  const query2 = body["query"];
+  if (typeof query2 !== "string" || query2.trim().length === 0) {
+    return writeErr(res, 400, "query must be a non-empty string");
+  }
+  if (query2.length > SEARCH_QUERY_MAX_CODE_UNITS) {
+    return writeErr(res, 400, `query must be at most ${SEARCH_QUERY_MAX_CODE_UNITS} characters`);
+  }
+  if (QUERY_CONTROL_CHARS.test(query2)) {
+    return writeErr(res, 400, "query must not contain control characters");
+  }
+  const persisted = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const search = persisted.search ?? import_outbound_api2.DEFAULT_SEARCH_SERVER_CONFIG;
+  const providers = search.providers;
+  if (!KEYLESS_HTTP_PROVIDER_IDS.has(providerId) && providers[providerId] === void 0) {
+    return writeErr(res, 400, `search provider '${providerId}' is not configured`);
+  }
+  const fetchImpl = status.testFetch;
+  const runtime = (0, import_search2.createSearchRuntime)({
+    contributions: persistedSearchContributions(search, fetchImpl),
+    policy: {
+      ...searchPolicyFrom(search),
+      // The panel always walks: it answers "does a search WORK for this
+      // operator", not "does this one provider behave" — that is `/test`'s
+      // job. The persisted policy's allowlist still bounds the walk.
+      fallbackEnabled: true,
+      preferred: providerId
+    }
+  });
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    const orchestrated = await runtime.search({ query: query2, options: { maxResults: 5 } });
+    const results = orchestrated.results;
+    const sanitized = results.slice(0, SEARCH_QUERY_MAX_RESULTS).map((result) => ({
+      title: sanitizeResultField(result.title, SEARCH_RESULT_FIELD_CAPS.title),
+      url: sanitizeResultField(result.url, SEARCH_RESULT_FIELD_CAPS.url),
+      content: sanitizeResultField(result.content, SEARCH_RESULT_FIELD_CAPS.content)
+    }));
+    const diagnostic = sanitized.length === 0 ? { providerId: orchestrated.providerId, status: "healthy", checkedAt } : classifyLiveSearchOutcome(
+      orchestrated.providerId,
+      { kind: "results", count: sanitized.length },
+      checkedAt
+    );
+    const response = {
+      diagnostic,
+      providerUsed: orchestrated.providerId,
+      fallbackCount: orchestrated.fallbackCount,
+      resultCount: sanitized.length,
+      results: sanitized
+    };
+    return writeJson(res, 200, { result: response });
+  } catch (error) {
+    const diagnostic = classifyLiveSearchOutcome(providerId, { kind: "failure", error }, checkedAt);
+    const response = { diagnostic };
+    return writeJson(res, 200, { result: response });
+  }
+}
+
+// src/admin/searchAdminView.ts
+var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
+var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function redactSearchServerConfig(search) {
+  const providers = {};
+  for (const [id, raw] of Object.entries(search.providers)) {
+    const entry = raw;
+    const view = {};
+    if (entry.apiHost !== void 0) view.apiHost = entry.apiHost;
+    if (entry.basicAuthUsername !== void 0) view.basicAuthUsername = entry.basicAuthUsername;
+    if (API_KEY_PROVIDERS.has(id)) {
+      view.apiKeyConfigured = typeof entry.apiKey === "string" && entry.apiKey.length > 0;
+    }
+    if (BASIC_AUTH_PROVIDERS.has(id)) {
+      view.basicAuthPasswordConfigured = typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0;
+    }
+    providers[id] = view;
+  }
+  return {
+    modes: search.modes,
+    providers,
+    egress: { allowedPrivateHosts: [...search.egress.allowedPrivateHosts] },
+    policy: { ...search.policy, ...search.policy.allowed ? { allowed: [...search.policy.allowed] } : {} }
+  };
+}
+function storedSecrets(current, id) {
+  const entry = current.providers[id];
+  if (!entry) return {};
+  const out = {};
+  if (typeof entry.apiKey === "string" && entry.apiKey.length > 0) out.apiKey = entry.apiKey;
+  if (typeof entry.basicAuthPassword === "string" && entry.basicAuthPassword.length > 0) {
+    out.basicAuthPassword = entry.basicAuthPassword;
+  }
+  return out;
+}
+function resolveSecretField(entry, field, stored) {
+  if (!(field in entry)) {
+    if (stored !== void 0) entry[field] = stored;
+    return;
+  }
+  const value = entry[field];
+  if (value === null) {
+    delete entry[field];
+    return;
+  }
+  if (typeof value === "string" && value.trim().length > 0) return;
+  if (stored !== void 0) entry[field] = stored;
+  else delete entry[field];
+}
+function preserveSearchSecrets(incoming, current) {
+  if (!isRecord(incoming)) return incoming;
+  const section = { ...incoming };
+  const providersValue = section["providers"];
+  if (!isRecord(providersValue)) return section;
+  const providers = {};
+  for (const [id, entryValue] of Object.entries(providersValue)) {
+    if (!isRecord(entryValue)) {
+      providers[id] = entryValue;
+      continue;
+    }
+    const entry = { ...entryValue };
+    delete entry["apiKeyConfigured"];
+    delete entry["basicAuthPasswordConfigured"];
+    const stored = storedSecrets(current, id);
+    resolveSecretField(entry, "apiKey", stored.apiKey);
+    resolveSecretField(entry, "basicAuthPassword", stored.basicAuthPassword);
+    providers[id] = entry;
+  }
+  section["providers"] = providers;
+  return section;
+}
+
 // src/admin/keyPolicyBody.ts
 function parseKeyPolicyBody(body) {
   const policy = {};
@@ -4564,7 +5063,7 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord(value) {
+function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -4584,7 +5083,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord(entry)) {
+    if (!isRecord2(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -4613,12 +5112,12 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord2(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
       }
     }
-    if (!isRecord(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord2(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -4633,7 +5132,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord2(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -4651,15 +5150,15 @@ function validateGatewayBindingsSegment(patch) {
 }
 
 // src/admin/voucherAdmin.ts
-var import_outbound_api2 = require("@omnicross/core/outbound-api");
-function writeJson(res, status, body) {
+var import_outbound_api3 = require("@omnicross/core/outbound-api");
+function writeJson2(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
-function writeErr(res, status, message) {
-  writeJson(res, status, { error: { type: "voucher_error", message } });
+function writeErr2(res, status, message) {
+  writeJson2(res, status, { error: { type: "voucher_error", message } });
 }
-function readJsonBody2(req) {
+function readJsonBody3(req) {
   return new Promise((resolve11, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
@@ -4710,34 +5209,34 @@ function parseVoucherCreateBody(body) {
   return { ok: true, input };
 }
 async function voucherEnabled(deps) {
-  const config = await (0, import_outbound_api2.loadServerConfig)(deps.settingsStore);
+  const config = await (0, import_outbound_api3.loadServerConfig)(deps.settingsStore);
   return config.voucher?.enabled === true;
 }
 async function handleVoucher(req, res, method, rest, deps) {
   const voucherDb = deps.voucherDb;
-  if (!voucherDb) return writeErr(res, 501, "Voucher feature is not available");
+  if (!voucherDb) return writeErr2(res, 501, "Voucher feature is not available");
   if (method === "GET" && rest.length === 0) {
     const rows = await voucherDb.voucherList();
-    return writeJson(res, 200, { vouchers: rows.map(import_outbound_api2.toVoucherInfo) });
+    return writeJson2(res, 200, { vouchers: rows.map(import_outbound_api3.toVoucherInfo) });
   }
   if (method === "POST" && rest.length === 0) {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     let body;
     try {
-      body = await readJsonBody2(req);
+      body = await readJsonBody3(req);
     } catch {
-      return writeErr(res, 400, "Invalid JSON in request body");
+      return writeErr2(res, 400, "Invalid JSON in request body");
     }
     const parsed = parseVoucherCreateBody(body);
-    if (!parsed.ok) return writeErr(res, 400, parsed.message);
-    const code = (0, import_outbound_api2.generateVoucherCode)();
+    if (!parsed.ok) return writeErr2(res, 400, parsed.message);
+    const code = (0, import_outbound_api3.generateVoucherCode)();
     const created = await voucherDb.voucherCreate({
-      id: (0, import_outbound_api2.newVoucherId)(),
-      codeHash: (0, import_outbound_api2.hashVoucherCode)(code),
-      codePrefix: (0, import_outbound_api2.voucherCodePrefix)(code),
+      id: (0, import_outbound_api3.newVoucherId)(),
+      codeHash: (0, import_outbound_api3.hashVoucherCode)(code),
+      codePrefix: (0, import_outbound_api3.voucherCodePrefix)(code),
       ...parsed.input
     });
-    return writeJson(res, 201, {
+    return writeJson2(res, 201, {
       id: created.id,
       codePrefix: created.codePrefix,
       type: created.type,
@@ -4748,11 +5247,11 @@ async function handleVoucher(req, res, method, rest, deps) {
   }
   const id = rest[0];
   if (method === "POST" && id && rest[1] === "revoke") {
-    if (!await voucherEnabled(deps)) return writeErr(res, 403, "Voucher feature is disabled");
+    if (!await voucherEnabled(deps)) return writeErr2(res, 403, "Voucher feature is disabled");
     const ok = await voucherDb.voucherRevokeCas(id, Date.now());
-    return writeJson(res, ok ? 200 : 409, { ok });
+    return writeJson2(res, ok ? 200 : 409, { ok });
   }
-  return writeErr(res, 405, `method ${method} not allowed on voucher`);
+  return writeErr2(res, 405, `method ${method} not allowed on voucher`);
 }
 
 // src/admin/webhookConfigBody.ts
@@ -4903,7 +5402,7 @@ function applyBillingConfig(config) {
 }
 
 // src/migration/migration.ts
-var import_outbound_api3 = require("@omnicross/core/outbound-api");
+var import_outbound_api4 = require("@omnicross/core/outbound-api");
 
 // src/ports/account-multi.ts
 var import_node_crypto8 = require("crypto");
@@ -5331,7 +5830,7 @@ async function gatherExport(deps, passphrase) {
     v: BUNDLE_VERSION,
     providers: cfg.providers,
     tokens,
-    server: (0, import_outbound_api3.normalizeServerConfig)(cfg.server)
+    server: (0, import_outbound_api4.normalizeServerConfig)(cfg.server)
   };
   return sealPack(JSON.stringify(bundle), passphrase);
 }
@@ -5380,7 +5879,7 @@ async function applyImport(packString, passphrase, mode, deps, parseProviderInpu
       const imageErrors = validateImagesAdminConfig(rawServer["images"]);
       if (imageErrors.length > 0) throw new Error("migration pack has an invalid Images config");
     }
-    validatedServer = (0, import_outbound_api3.normalizeServerConfig)(bundle.server);
+    validatedServer = (0, import_outbound_api4.normalizeServerConfig)(bundle.server);
   }
   const validatedProviders = [];
   for (const raw of rawProviders) {
@@ -5661,12 +6160,12 @@ async function handlePricingResolveConflicts(body, deps) {
 }
 
 // src/admin/accountAllowanceApi.ts
-function writeJson2(res, status, body) {
+function writeJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeError2(res, status, message) {
-  writeJson2(res, status, { error: { type: "account_allowance_error", message } });
+  writeJson3(res, status, { error: { type: "account_allowance_error", message } });
 }
 function readJson2(req) {
   return new Promise((resolve11, reject) => {
@@ -5699,7 +6198,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (!service.getSchedulingStatus) {
       return writeError2(res, 501, "allowance scheduling diagnostics are not available");
     }
-    return writeJson2(res, 200, { scheduling: service.getSchedulingStatus() });
+    return writeJson3(res, 200, { scheduling: service.getSchedulingStatus() });
   }
   if (method === "GET") {
     const params = query(req);
@@ -5708,7 +6207,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (providerId === null) return writeError2(res, 400, "providerId must be claude or codex");
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   if (method === "POST" && rest[0] === "refresh") {
     const body = await readJson2(req);
@@ -5723,7 +6222,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
     }
-    return writeJson2(res, 200, { allowances });
+    return writeJson3(res, 200, { allowances });
   }
   return writeError2(res, 405, `method ${method} not allowed on account allowances`);
 }
@@ -5739,7 +6238,7 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
-async function readJsonBody3(req) {
+async function readJsonBody4(req) {
   const raw = await readBody(req);
   if (!raw.trim()) return {};
   try {
@@ -5749,12 +6248,12 @@ async function readJsonBody3(req) {
     return {};
   }
 }
-function writeJson3(res, status, body) {
+function writeJson4(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function writeJsonError(res, status, message) {
-  writeJson3(res, status, { error: { type: "admin_api_error", message } });
+  writeJson4(res, status, { error: { type: "admin_api_error", message } });
 }
 function maskProviderApiKey(apiKey) {
   if (!apiKey) return "";
@@ -5775,7 +6274,7 @@ function toKeyInfo(row) {
     lastUsedAt: row.lastUsedAt,
     revoked: row.revokedAt !== null,
     kind: row.kind,
-    allowedEndpoints: [...(0, import_outbound_api4.effectiveOutboundPermissions)(row.allowedEndpoints)],
+    allowedEndpoints: [...(0, import_outbound_api5.effectiveOutboundPermissions)(row.allowedEndpoints)],
     legacyPermissions: row.allowedEndpoints === void 0,
     loopbackOnly: row.loopbackOnly,
     maxConcurrency: row.maxConcurrency,
@@ -5861,6 +6360,8 @@ async function handleAdminApi(req, res, path2, deps) {
         return await handleServer(req, res, method, deps);
       case "images":
         return await handleImages(res, method, rest, deps);
+      case "search":
+        return await handleSearchAdmin(req, res, method, rest, deps);
       case "accounts":
         return await handleAccounts(req, res, method, rest, deps);
       case "cli":
@@ -5894,7 +6395,7 @@ function requestQuery(req) {
   return new URLSearchParams(qIdx >= 0 ? raw.slice(qIdx + 1) : "");
 }
 function writeResult(res, result) {
-  writeJson3(res, result.status, result.body);
+  writeJson4(res, result.status, result.body);
 }
 async function handleUsage(req, res, method, rest, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on usage`);
@@ -5903,13 +6404,13 @@ async function handleUsage(req, res, method, rest, deps) {
 async function handleDashboardRoute(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on dashboard`);
   const result = await handleDashboard(deps);
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handlePricing(req, res, method, rest, deps) {
   if (rest.length === 0) {
     if (method === "GET") return writeResult(res, await handlePricingList(deps));
     if (method === "PUT") {
-      return writeResult(res, await handlePricingUpsert(await readJsonBody3(req), deps));
+      return writeResult(res, await handlePricingUpsert(await readJsonBody4(req), deps));
     }
     if (method === "DELETE") {
       return writeResult(res, await handlePricingDelete(requestQuery(req), deps));
@@ -5920,7 +6421,7 @@ async function handlePricing(req, res, method, rest, deps) {
     return writeResult(res, await handlePricingFetchLatest(deps));
   }
   if (method === "POST" && rest.length === 1 && rest[0] === "resolve-conflicts") {
-    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody3(req), deps));
+    return writeResult(res, await handlePricingResolveConflicts(await readJsonBody4(req), deps));
   }
   return writeJsonError(res, 404, `unknown pricing route '${rest.join("/")}'`);
 }
@@ -5934,15 +6435,15 @@ function migrationDeps(deps) {
 }
 async function handleMigrationExport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on export`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleExport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleMigrationImport(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on import`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const result = await handleImport(body, migrationDeps(deps));
-  return writeJson3(res, result.status, result.body);
+  return writeJson4(res, result.status, result.body);
 }
 async function handleProviders(req, res, method, rest, deps) {
   const cfg = loadConfig(deps.configPath);
@@ -5973,13 +6474,13 @@ async function handleProviders(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal-key") {
     const row = cfg.providers.find((p) => p.id === rest[0]);
     if (!row) return writeJsonError(res, 404, `provider '${rest[0]}' not found`);
-    return writeJson3(res, 200, { apiKey: row.apiKey ?? "" });
+    return writeJson4(res, 200, { apiKey: row.apiKey ?? "" });
   }
   if (method === "GET") {
-    return writeJson3(res, 200, { providers: cfg.providers.map(toProviderView) });
+    return writeJson4(res, 200, { providers: cfg.providers.map(toProviderView) });
   }
   if (method === "POST") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const provider = parseProviderInput(body, void 0);
     if (!provider) return writeJsonError(res, 400, "invalid provider (id, apiFormat, baseUrl required)");
     if (cfg.providers.some((p) => p.id === provider.id)) {
@@ -5987,25 +6488,25 @@ async function handleProviders(req, res, method, rest, deps) {
     }
     cfg.providers.push(provider);
     persistProviders(cfg, deps);
-    return writeJson3(res, 201, { provider: toProviderView(provider) });
+    return writeJson4(res, 201, { provider: toProviderView(provider) });
   }
   const id = rest[0];
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (method === "PUT") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const existing = cfg.providers[idx];
     const updated = parseProviderInput(body, existing);
     if (!updated) return writeJsonError(res, 400, "invalid provider (apiFormat, baseUrl required)");
     cfg.providers[idx] = updated;
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { provider: toProviderView(updated) });
+    return writeJson4(res, 200, { provider: toProviderView(updated) });
   }
   if (method === "DELETE") {
     cfg.providers.splice(idx, 1);
     persistProviders(cfg, deps);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on providers`);
 }
@@ -6014,7 +6515,7 @@ function persistProviders(cfg, deps) {
   deps.llmConfig.reload(cfg);
 }
 async function handleProviderReorder(req, res, cfg, deps) {
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const rawOrder = body["order"];
   if (!Array.isArray(rawOrder)) {
     return writeJsonError(res, 400, "reorder requires { order: string[] }");
@@ -6038,14 +6539,14 @@ async function handleProviderReorder(req, res, cfg, deps) {
   }
   cfg.providers = reordered;
   persistProviders(cfg, deps);
-  return writeJson3(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
+  return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   if (row.apiFormat !== "openai" && row.apiFormat !== "openai-response") {
-    return writeJson3(res, 200, { models: [], unsupportedFormat: true });
+    return writeJson4(res, 200, { models: [], unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   const base = row.baseUrl.replace(/\/+$/, "");
@@ -6053,7 +6554,7 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -6062,32 +6563,32 @@ async function handleDiscoverModels(res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         models: [],
         error: `discovery failed (${response.status})${message ? `: ${message}` : ""}`
       });
     }
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
-    return writeJson3(res, 200, { models });
+    return writeJson4(res, 200, { models });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { models: [], error: `discovery failed: ${message}` });
+    return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
 async function handleTestModel(req, res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const model = typeof body["model"] === "string" ? body["model"].trim() : "";
   if (!model) return writeJsonError(res, 400, "test requires a { model } string");
   if (row.apiFormat === "gemini") {
-    return writeJson3(res, 200, { ok: false, unsupportedFormat: true });
+    return writeJson4(res, 200, { ok: false, unsupportedFormat: true });
   }
   const resolvedKey = resolveEnvKey(row.apiKey);
   if (!resolvedKey) {
-    return writeJson3(res, 200, { ok: false, message: "no API key configured for this provider" });
+    return writeJson4(res, 200, { ok: false, message: "no API key configured for this provider" });
   }
   let url = row.baseUrl.replace(/\/+$/, "");
   const prompt = "Reply with the single word: OK.";
@@ -6112,7 +6613,7 @@ async function handleTestModel(req, res, id, cfg) {
   }
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch3.fetchUpstream)(
+    const response = await (0, import_upstreamFetch4.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -6126,9 +6627,9 @@ async function handleTestModel(req, res, id, cfg) {
         message = parsed?.error?.message || parsed?.message || message;
       } catch {
       }
-      return writeJson3(res, 200, { ok: false, status: response.status, latencyMs, message });
+      return writeJson4(res, 200, { ok: false, status: response.status, latencyMs, message });
     }
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ok: true,
       status: response.status,
       latencyMs,
@@ -6136,7 +6637,7 @@ async function handleTestModel(req, res, id, cfg) {
     });
   } catch (err5) {
     const message = err5 instanceof Error ? err5.message : String(err5);
-    return writeJson3(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
+    return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
 function extractSampleText(text, apiFormat) {
@@ -6177,7 +6678,7 @@ async function handleProviderKeys(res, id, cfg, deps) {
   const row = cfg.providers.find((p) => p.id === id);
   if (!row) return writeJsonError(res, 404, `provider '${id}' not found`);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parsePoolKeyInput(body, existing) {
   const out = {};
@@ -6196,7 +6697,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const idx = cfg.providers.findIndex((p) => p.id === id);
   if (idx < 0) return writeJsonError(res, 404, `provider '${id}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const parsed = parsePoolKeyInput(body);
   if (!parsed.apiKey) return writeJsonError(res, 400, "add requires a non-empty apiKey");
   const keyId = `key-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -6208,7 +6709,7 @@ async function handleAddProviderKey(req, res, id, cfg, deps) {
   row.apiKeys = [...row.apiKeys ?? [], entry];
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 201, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6218,7 +6719,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const existing = row.apiKeys[keyIdx];
   const parsed = parsePoolKeyInput(body, existing);
   const entry = { id: keyId, apiKey: parsed.apiKey || existing.apiKey };
@@ -6228,7 +6729,7 @@ async function handleUpdateProviderKey(req, res, id, keyId, cfg, deps) {
   row.apiKeys[keyIdx] = entry;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6242,7 +6743,7 @@ async function handleDeleteProviderKey(res, id, keyId, cfg, deps) {
   if (row.apiKeys.length === 0) row.apiKeys = void 0;
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
@@ -6252,11 +6753,11 @@ async function handleToggleProviderKey(req, res, id, keyId, cfg, deps) {
   const row = cfg.providers[idx];
   const keyIdx = (row.apiKeys ?? []).findIndex((k) => k.id === keyId);
   if (keyIdx < 0) return writeJsonError(res, 404, `pool key '${keyId}' not found`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   row.apiKeys[keyIdx].enabled = Boolean(body["enabled"]);
   persistProviders(cfg, deps);
   const cooldown = await deps.apiKeyPool.getKeyHealth(id);
-  return writeJson3(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
+  return writeJson4(res, 200, { keys: toPoolKeyView(row, cooldown, deps) });
 }
 function parseApiKeysInput(raw, existing) {
   if (!Array.isArray(raw)) return existing;
@@ -6442,13 +6943,13 @@ function handlePresets(res, method) {
     website: p.website,
     modelsEndpoint: p.modelsEndpoint
   }));
-  return writeJson3(res, 200, { presets, excluded });
+  return writeJson4(res, 200, { presets, excluded });
 }
 async function handleKeys(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const rows = await deps.keyDb.outboundApiKeysList();
     const reader = deps.keySpendReader;
-    if (!reader) return writeJson3(res, 200, { keys: rows.map(toKeyInfo) });
+    if (!reader) return writeJson4(res, 200, { keys: rows.map(toKeyInfo) });
     const now = Date.now();
     const keys = await Promise.all(
       rows.map(async (row) => {
@@ -6460,13 +6961,13 @@ async function handleKeys(req, res, method, rest, deps) {
         return info;
       })
     );
-    return writeJson3(res, 200, { keys });
+    return writeJson4(res, 200, { keys });
   }
   if (method === "POST" && rest.length === 0) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const name = typeof body["name"] === "string" && body["name"].trim() ? body["name"].trim() : "key";
-    const created = await (0, import_outbound_api4.createNamedKey)(deps.keyDb, name);
-    return writeJson3(res, 201, {
+    const created = await (0, import_outbound_api5.createNamedKey)(deps.keyDb, name);
+    return writeJson4(res, 201, {
       id: created.id,
       name: created.name,
       keyPrefix: created.keyPrefix,
@@ -6477,7 +6978,7 @@ async function handleKeys(req, res, method, rest, deps) {
   }
   if (method === "GET" && rest.length === 2 && rest[1] === "reveal") {
     const revealed = await deps.keyDb.outboundApiKeysReveal(rest[0]);
-    if (revealed !== null) return writeJson3(res, 200, { key: revealed });
+    if (revealed !== null) return writeJson4(res, 200, { key: revealed });
     const exists = (await deps.keyDb.outboundApiKeysList()).some((r) => r.id === rest[0]);
     if (!exists) return writeJsonError(res, 404, `key '${rest[0]}' not found`);
     return writeJsonError(
@@ -6492,32 +6993,32 @@ async function handleKeys(req, res, method, rest, deps) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysRevoke(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "DELETE" && id && !action) {
     const bound = await integrationKeyRequirement(deps, id);
     if (bound) return writeJsonError(res, 409, bound);
     const ok = await deps.keyDb.outboundApiKeysDelete(id);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   if (method === "POST" && id && action === "enabled") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const enabled = body["enabled"] === true;
     if (!enabled) {
       const bound = await integrationKeyRequirement(deps, id);
       if (bound) return writeJsonError(res, 409, bound);
     }
     const ok = await deps.keyDb.outboundApiKeysSetEnabled(id, enabled);
-    return writeJson3(res, ok ? 200 : 404, { ok, enabled });
+    return writeJson4(res, ok ? 200 : 404, { ok, enabled });
   }
   if (method === "POST" && id && action === "permissions") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "permissions")) {
       return writeJsonError(res, 400, "body must contain only permissions");
     }
     let permissions;
     try {
-      permissions = (0, import_outbound_api4.validateOutboundPermissions)(body["permissions"]);
+      permissions = (0, import_outbound_api5.validateOutboundPermissions)(body["permissions"]);
     } catch {
       return writeJsonError(
         res,
@@ -6526,19 +7027,19 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const before = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-    if (!before) return writeJson3(res, 404, { ok: false });
-    if (before.revokedAt !== null) return writeJson3(res, 409, { ok: false });
+    if (!before) return writeJson4(res, 404, { ok: false });
+    if (before.revokedAt !== null) return writeJson4(res, 409, { ok: false });
     const required = await integrationKeyRequirement(deps, id, permissions);
     if (required) return writeJsonError(res, 409, required);
     const ok = await deps.keyDb.outboundApiKeysSetPermissions(id, permissions);
     if (!ok) {
       const current = (await deps.keyDb.outboundApiKeysList()).find((row) => row.id === id);
-      return writeJson3(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
+      return writeJson4(res, current?.revokedAt !== null ? 409 : 404, { ok: false });
     }
-    return writeJson3(res, 200, { ok: true, allowedEndpoints: permissions });
+    return writeJson4(res, 200, { ok: true, allowedEndpoints: permissions });
   }
   if (method === "POST" && id && action === "max-concurrency") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const raw = body["maxConcurrency"];
     let value;
     if (raw === null) {
@@ -6553,14 +7054,14 @@ async function handleKeys(req, res, method, rest, deps) {
       );
     }
     const ok = await deps.keyDb.outboundApiKeysSetMaxConcurrency(id, value);
-    return writeJson3(res, ok ? 200 : 404, { ok, maxConcurrency: value });
+    return writeJson4(res, ok ? 200 : 404, { ok, maxConcurrency: value });
   }
   if (method === "POST" && id && action === "policy") {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = parseKeyPolicyBody(body);
     if (!parsed.ok) return writeJsonError(res, 400, parsed.message);
     const ok = await deps.keyDb.outboundApiKeysSetPolicy(id, parsed.policy);
-    return writeJson3(res, ok ? 200 : 404, { ok });
+    return writeJson4(res, ok ? 200 : 404, { ok });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on keys`);
 }
@@ -6651,7 +7152,8 @@ function outboundServerConfigInput(config) {
     userMessageQueue: config.userMessageQueue,
     concurrencyQueue: config.concurrencyQueue,
     voucher: config.voucher,
-    anthropic: config.anthropic
+    anthropic: config.anthropic,
+    search: config.search
   };
 }
 function projectImagesConfigForAdmin(config) {
@@ -6687,8 +7189,8 @@ function sameConfigValue(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 function imageConfigurationAuditFields(previous, next) {
-  const before = previous ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
-  const after = next ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
+  const before = previous ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
+  const after = next ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
   const fields = [];
   if (before.enabled !== after.enabled) fields.push("enablement");
   if (before.provider !== after.provider) fields.push("provider");
@@ -6714,15 +7216,21 @@ function currentImageGenerationId(deps) {
 }
 async function handleServer(req, res, method, deps) {
   if (method === "GET") {
-    const config = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+    const config = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
     let server = config;
     if (config.proxy) server = { ...server, proxy: redactOutboundProxy(config.proxy) };
     if (config.webhook) server = { ...server, webhook: redactWebhookConfig(config.webhook) };
     if (config.billing) server = { ...server, billing: redactBillingConfig(config.billing) };
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(server) });
+    if (config.search) {
+      server = {
+        ...server,
+        search: redactSearchServerConfig(config.search)
+      };
+    }
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(server) });
   }
   if (method === "PUT") {
-    const patch = await readJsonBody3(req);
+    const patch = await readJsonBody4(req);
     const queueErrors = validateQueueSegments(patch);
     if (queueErrors.length > 0) {
       return writeJsonError(res, 400, `invalid queue config: ${queueErrors.join("; ")}`);
@@ -6751,7 +7259,7 @@ async function handleServer(req, res, method, deps) {
     if (billingErrors.length > 0) {
       return writeJsonError(res, 400, `invalid billing config: ${billingErrors.join("; ")}`);
     }
-    const current = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+    const current = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
     let effectivePatch = patch;
     if (patch.proxy) {
       effectivePatch = { ...effectivePatch, proxy: preserveOutboundProxySecrets(patch.proxy, current.proxy) };
@@ -6772,7 +7280,21 @@ async function handleServer(req, res, method, deps) {
       }
       effectivePatch = { ...effectivePatch, images };
     }
-    const merged = (0, import_outbound_api4.mergeServerConfig)(current, effectivePatch);
+    if (patch.search !== void 0) {
+      const searchPatch = preserveSearchSecrets(
+        patch.search,
+        current.search ?? import_outbound_api5.DEFAULT_SEARCH_SERVER_CONFIG
+      );
+      const searchErrors = (0, import_outbound_api5.validateSearchServerConfig)(searchPatch);
+      if (searchErrors.length > 0) {
+        return writeJsonError(res, 400, `invalid search config: ${searchErrors.join("; ")}`);
+      }
+      effectivePatch = {
+        ...effectivePatch,
+        search: searchPatch
+      };
+    }
+    const merged = (0, import_outbound_api5.mergeServerConfig)(current, effectivePatch);
     const priorImageGenerationId = currentImageGenerationId(deps);
     try {
       await applyServerConfigTransaction(current, merged, {
@@ -6802,7 +7324,7 @@ async function handleServer(req, res, method, deps) {
             throw error;
           }
         },
-        persist: (next) => (0, import_outbound_api4.saveServerConfig)(deps.settingsStore, next),
+        persist: (next) => (0, import_outbound_api5.saveServerConfig)(deps.settingsStore, next),
         restorePersisted: (snapshot) => deps.settingsStore.restoreDocumentSnapshot(snapshot)
       });
     } catch (error) {
@@ -6824,7 +7346,11 @@ async function handleServer(req, res, method, deps) {
       } catch {
       }
     }
-    return writeJson3(res, 200, { server: projectImagesConfigForAdmin(merged) });
+    const mergedForAdmin = merged.search ? {
+      ...merged,
+      search: redactSearchServerConfig(merged.search)
+    } : merged;
+    return writeJson4(res, 200, { server: projectImagesConfigForAdmin(mergedForAdmin) });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on server`);
 }
@@ -6841,7 +7367,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       sessionKey: query2.get("sessionKey") ?? void 0,
       limit: Number.isFinite(parsedLimit) ? parsedLimit : 100
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       records,
       capacity: import_AccountRouteActivity.ACCOUNT_ROUTE_ACTIVITY_LIMIT,
@@ -6857,7 +7383,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       providerId: query2.get("providerId") ?? void 0,
       accountId: query2.get("accountId") ?? void 0
     });
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       available: true,
       entries,
       collectedAt: Date.now()
@@ -6876,10 +7402,10 @@ async function handleAccounts(req, res, method, rest, deps) {
     const accounts = await deps.subscriptionAccounts.listAll();
     const providerAccounts = await deps.subscriptionTokenWriter.listSanitizedAccounts();
     const externalCli = await deps.subscriptionTokenWriter.listExternalCliAvailability();
-    return writeJson3(res, 200, { accounts, providerAccounts, externalCli });
+    return writeJson4(res, 200, { accounts, providerAccounts, externalCli });
   }
   if (method === "POST" && rest[0] === "batch" && rest.length === 1) {
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const parsed = validateAccountBatchBody(body);
     if (!parsed) return writeJsonError(res, 400, "invalid account batch request");
     const result = await deps.subscriptionTokenWriter.batchManageAccounts(parsed.refs, parsed.mutation);
@@ -6895,15 +7421,15 @@ async function handleAccounts(req, res, method, rest, deps) {
         deps.accountAllowanceService?.removeAccountSnapshot?.(ref.providerId, ref.accountId);
       }
     }
-    return writeJson3(res, 200, { ok: true, affected: result.affected });
+    return writeJson4(res, 200, { ok: true, affected: result.affected });
   }
   if (method === "GET" && rest[0] === "codex" && rest[1] === "oauth" && rest[3] === "status") {
     const result = handleCodexOAuthStatus(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "codex" && rest[1] === "oauth" && rest[2]) {
     const result = handleCodexOAuthCancel(rest[2], deps);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6925,7 +7451,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       resumeAt: entry.resumeAt
     })) ?? [];
     const diagnostics = [...health2, ...allowance].sort((left, right) => right.at - left.at).slice(0, 200);
-    return writeJson3(res, 200, { diagnostics });
+    return writeJson4(res, 200, { diagnostics });
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "events") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6937,17 +7463,17 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     const snapshot = deps.accountProbeService?.getAllHistory().find((entry) => entry.providerId === providerId && entry.accountId === accountId);
     const diagnostics = (0, import_SubscriptionAccountHealth.getSharedAccountHealth)().getDiagnostics({ providerId, accountId });
-    return writeJson3(res, 200, { events: snapshot?.records ?? [], diagnostics });
+    return writeJson4(res, 200, { events: snapshot?.records ?? [], diagnostics });
   }
   if (method === "PATCH" && rest.length === 2) {
     const providerId = asSubscriptionProviderId(rest[0]);
     if (!providerId) return writeJsonError(res, 400, `unknown subscription provider '${rest[0] ?? ""}'`);
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const patch = validateAccountMetadataPatch(body);
     if (!patch) return writeJsonError(res, 400, "invalid account metadata patch");
     const result = await deps.subscriptionTokenWriter.patchAccountMetadata(providerId, rest[1], patch);
     if (!result.ok) return writeJsonError(res, 404, `account '${rest[1]}' not found`);
-    return writeJson3(res, 200, { ok: true });
+    return writeJson4(res, 200, { ok: true });
   }
   if (method === "PUT" || method === "POST" || method === "DELETE") {
     const providerId = asSubscriptionProviderId(rest[0]);
@@ -6956,15 +7482,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "start") {
       const result = providerId === "codex" ? handleCodexOAuthStart(deps) : handleOAuthStart(providerId, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "oauth" && rest[2] === "complete") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const result = await handleOAuthComplete(providerId, body2, deps);
-      return writeJson3(res, result.status, result.body);
+      return writeJson4(res, result.status, result.body);
     }
     if (method === "POST" && rest[1] === "accounts") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const block = validateTokenBody(providerId, body2);
       if (!block) {
         return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
@@ -6972,20 +7498,20 @@ async function handleAccounts(req, res, method, rest, deps) {
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       await deps.subscriptionAccountAppender.appendProviderAccount(providerId, block, label);
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, status2 ? { account: status2 } : { ok: true });
+      return writeJson4(res, 200, status2 ? { account: status2 } : { ok: true });
     }
     if (method === "POST" && rest[1] === "import-external") {
       if (providerId !== "claude" && providerId !== "codex") {
         return writeJsonError(res, 400, `provider '${providerId}' has no external CLI store`);
       }
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" && body2["label"].trim() ? body2["label"].trim() : void 0;
       const result = await deps.subscriptionTokenWriter.importExternalCliAccount(providerId, label);
       if (!result.ok) {
         return writeJsonError(res, 409, `no usable external ${providerId} CLI credential found`);
       }
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: true,
         account: status2 ?? void 0,
         nativeCredentialMode: result.nativeCredentialMode,
@@ -7000,7 +7526,7 @@ async function handleAccounts(req, res, method, rest, deps) {
       const writer2 = deps.subscriptionTokenWriter;
       const ok = providerId === "claude" ? await writer2.refreshClaudeToken() : providerId === "codex" ? await writer2.refreshCodexToken() : await writer2.refreshGeminiToken();
       const status2 = await statusEntryFor(deps.subscriptionAccounts, providerId);
-      return writeJson3(res, 200, { ok, account: status2 ?? void 0 });
+      return writeJson4(res, 200, { ok, account: status2 ?? void 0 });
     }
     if (method === "POST" && rest.length === 3 && rest[2] === "test") {
       const accountId = rest[1];
@@ -7010,7 +7536,7 @@ async function handleAccounts(req, res, method, rest, deps) {
         return writeJsonError(res, 404, `account '${accountId}' not found`);
       }
       const result = await deps.accountProbeService.testAccountConnection(providerId, accountId);
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         ok: result.ok,
         marked: result.marked,
         tier: result.tier,
@@ -7019,15 +7545,15 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     if (method === "POST" && rest[2] === "label") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const label = typeof body2["label"] === "string" ? body2["label"].trim() : "";
       const result = await deps.subscriptionTokenWriter.renameAccount(providerId, accountId, label);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "priority") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const raw = body2["priority"];
       const priority = typeof raw === "number" ? raw : Number(raw);
       if (!Number.isFinite(priority)) {
@@ -7035,76 +7561,76 @@ async function handleAccounts(req, res, method, rest, deps) {
       }
       const result = await deps.subscriptionTokenWriter.setAccountPriority(providerId, accountId, priority);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "proxy") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const rawProxy = body2["proxy"];
       let proxy;
       if (rawProxy !== null && rawProxy !== void 0) {
-        proxy = (0, import_outbound_api4.normalizeProxyConfig)(rawProxy);
+        proxy = (0, import_outbound_api5.normalizeProxyConfig)(rawProxy);
         if (!proxy) return writeJsonError(res, 400, "invalid proxy config");
       }
       const result = await deps.subscriptionTokenWriter.setAccountProxy(providerId, accountId, proxy);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "POST" && rest[2] === "supported-models") {
       const accountId = rest[1];
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const parsed = validateSupportedModelsBody(body2["supportedModels"]);
       if (!parsed.ok) return writeJsonError(res, 400, "invalid supportedModels");
       const result = await deps.subscriptionTokenWriter.setAccountSupportedModels(providerId, accountId, parsed.value);
       if (!result.ok) return writeJsonError(res, 404, `account '${accountId}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "PUT" && rest[1] === "active") {
-      const body2 = await readJsonBody3(req);
+      const body2 = await readJsonBody4(req);
       const id = typeof body2["id"] === "string" ? body2["id"] : "";
       if (!id) return writeJsonError(res, 400, "active switch requires { id }");
       const result = await deps.subscriptionTokenWriter.setActiveAccount(providerId, id);
       if (!result.ok) return writeJsonError(res, 404, `account '${id}' not found`);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 2) {
       const accountId = rest[1];
       const result = await deps.subscriptionTokenWriter.removeAccount(providerId, accountId);
       if (!result.removed) return writeJsonError(res, 404, `account '${accountId}' not found`);
       deps.accountAllowanceService?.removeAccountSnapshot?.(providerId, accountId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE" && rest.length === 1) {
       await deps.subscriptionTokenWriter.clearProvider(providerId);
       deps.accountAllowanceService?.removeProviderSnapshots?.(providerId);
-      return writeJson3(res, 200, { ok: true });
+      return writeJson4(res, 200, { ok: true });
     }
     if (method === "DELETE") {
       return writeJsonError(res, 405, "method DELETE not allowed on this accounts path");
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const config = validateTokenBody(providerId, body);
     if (!config) {
       return writeJsonError(res, 400, `malformed token body for provider '${providerId}'`);
     }
     await deps.subscriptionTokenWriter.writeProviderTokens(providerId, config);
     const status = await statusEntryFor(deps.subscriptionAccounts, providerId);
-    return writeJson3(res, 200, status ? { account: status } : { ok: true });
+    return writeJson4(res, 200, status ? { account: status } : { ok: true });
   }
   return writeJsonError(res, 405, `method ${method} not allowed on accounts`);
 }
 async function handleCli(req, res, method, rest, deps) {
   if (method === "GET" && rest.length === 0) {
     const result = handleCliList(process.platform, deps.cliPathProbe);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest[0] === "sessions") {
     const result = handleCliSessions();
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "DELETE" && rest[0] === "sessions" && rest[1]) {
     const result = handleCliStop(rest[1]);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "install") {
     const cli = rest[0];
@@ -7112,14 +7638,14 @@ async function handleCli(req, res, method, rest, deps) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
     const result = await handleCliInstall(cli, deps.cliCommandRunner);
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   if (method === "POST" && rest[1] === "launch") {
     const cli = rest[0];
     if (!isLaunchCliId(cli)) {
       return writeJsonError(res, 400, `unknown cli '${cli ?? ""}'`);
     }
-    const body = await readJsonBody3(req);
+    const body = await readJsonBody4(req);
     const providers = loadConfig(deps.configPath).providers ?? [];
     const result = await handleCliLaunch(cli, body, {
       llmConfig: deps.llmConfig,
@@ -7128,7 +7654,7 @@ async function handleCli(req, res, method, rest, deps) {
       opener: deps.cliTerminalOpener,
       probe: deps.cliPathProbe
     });
-    return writeJson3(res, result.status, result.body);
+    return writeJson4(res, result.status, result.body);
   }
   return writeJsonError(res, 405, `method ${method} not allowed on cli`);
 }
@@ -7138,52 +7664,52 @@ async function handleIntegrations(req, res, method, rest, deps) {
   const manager = factory();
   try {
     if (method === "GET" && rest.length === 0) {
-      return writeJson3(res, 200, {
+      return writeJson4(res, 200, {
         integrations: await manager.listStatus(),
         gateway: deps.outboundApiServer.getStatus()
       });
     }
     if (method === "POST" && rest.length === 1 && rest[0] === "rotate") {
       await manager.rotateGatewayKey();
-      return writeJson3(res, 200, { ok: true, integrations: await manager.listStatus() });
+      return writeJson4(res, 200, { ok: true, integrations: await manager.listStatus() });
     }
     const client = rest[0];
     if (!isIntegrationClient(client)) {
       return writeJsonError(res, 400, `unknown integration client '${client ?? ""}'`);
     }
     if (method === "POST" && rest[1] === "key") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       if (Object.keys(body).length !== 1 || typeof body.keyId !== "string" || !body.keyId.trim()) {
         return writeJsonError(res, 400, "body must contain a non-empty keyId string");
       }
       const status = await manager.bindIntegrationKey(client, body.keyId.trim());
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "plan") {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const plan = await manager.plan(client, configPath);
-      return writeJson3(res, 200, { plan });
+      return writeJson4(res, 200, { plan });
     }
     if (method === "POST" && (rest[1] === "install" || rest[1] === "apply")) {
-      const body = await readJsonBody3(req);
+      const body = await readJsonBody4(req);
       const configPath = body.configPath;
       if (configPath !== void 0 && typeof configPath !== "string") {
         return writeJsonError(res, 400, "configPath must be a string");
       }
       const status = await manager.install(client, configPath);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "POST" && rest[1] === "repair") {
       const status = await manager.repair(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     if (method === "DELETE" && rest.length === 1 || method === "POST" && rest[1] === "remove") {
       const status = await manager.remove(client);
-      return writeJson3(res, 200, { integration: status });
+      return writeJson4(res, 200, { integration: status });
     }
     return writeJsonError(res, 405, `method ${method} not allowed on integrations`);
   } catch (error) {
@@ -7326,8 +7852,8 @@ async function handleImages(res, method, rest, deps) {
   }
   const reader = deps.imageRuntimeStatus;
   if (!reader) return writeJsonError(res, 501, "Images runtime status is not available");
-  const serverConfig = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
-  const images = serverConfig.images ?? import_outbound_api4.DEFAULT_IMAGES_SERVER_CONFIG;
+  const serverConfig = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
+  const images = serverConfig.images ?? import_outbound_api5.DEFAULT_IMAGES_SERVER_CONFIG;
   const lifecycle = reader.status();
   const capability = await reader.inspectCapability(IMAGE_ADMIN_STATUS_TENANT);
   const resources = safeRuntimeResources(reader.resourceStatus());
@@ -7346,7 +7872,7 @@ async function handleImages(res, method, rest, deps) {
     httpLeases: safeStatusCount(generation.httpLeases),
     hostedLeases: safeStatusCount(generation.hostedLeases)
   }));
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     configured: {
       enabled: images.enabled,
       provider: images.provider,
@@ -7374,11 +7900,11 @@ async function handleImages(res, method, rest, deps) {
 async function handleStatus(res, method, deps) {
   if (method !== "GET") return writeJsonError(res, 405, `method ${method} not allowed on status`);
   const status = deps.outboundApiServer.getStatus();
-  const serverConfig = await (0, import_outbound_api4.loadServerConfig)(deps.settingsStore);
+  const serverConfig = await (0, import_outbound_api5.loadServerConfig)(deps.settingsStore);
   const endpoints = ["chat", "responses", "messages", "gemini"].map((endpoint) => {
-    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => (0, import_outbound_api4.gatewayBindingToEndpointConfig)(binding));
+    const routes = (serverConfig.bindings ?? []).filter((binding) => binding.enabled && binding.endpoint === endpoint).map((binding) => (0, import_outbound_api5.gatewayBindingToEndpointConfig)(binding));
     const useSubscription = routes.some((route) => route.useSubscription);
-    if ((0, import_outbound_api4.isKindMappedEndpoint)(endpoint)) {
+    if ((0, import_outbound_api5.isKindMappedEndpoint)(endpoint)) {
       const kinds = {};
       for (const route of routes) {
         for (const [kind, ref] of Object.entries(route.modelMap ?? {})) {
@@ -7412,14 +7938,14 @@ async function handleStatus(res, method, deps) {
   })() : void 0;
   if (status.running) {
     const queueStatus = deps.outboundApiServer.getQueueStatus();
-    return writeJson3(res, 200, {
+    return writeJson4(res, 200, {
       ...status,
       endpoints,
       queueStatus,
       ...imageRuntime ? { imageRuntime } : {}
     });
   }
-  return writeJson3(res, 200, {
+  return writeJson4(res, 200, {
     ...status,
     endpoints,
     ...imageRuntime ? { imageRuntime } : {}
@@ -7443,18 +7969,18 @@ function resolvePlaygroundPath(endpoint, body) {
 }
 async function handlePlayground(req, res, method, deps) {
   if (method !== "POST") return writeJsonError(res, 405, `method ${method} not allowed on playground`);
-  const body = await readJsonBody3(req);
+  const body = await readJsonBody4(req);
   const endpoint = typeof body["endpoint"] === "string" ? body["endpoint"] : "";
   const key = typeof body["key"] === "string" ? body["key"] : "";
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord2(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord3(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord2(v) {
+function isRecord3(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
@@ -7590,7 +8116,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -8010,14 +8536,14 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 
 // src/image-generation/ImageDoctorService.ts
 var import_image_generation = require("@omnicross/core/image-generation");
-var import_outbound_api6 = require("@omnicross/core/outbound-api");
+var import_outbound_api7 = require("@omnicross/core/outbound-api");
 var import_subscriptions3 = require("@omnicross/subscriptions");
 
 // src/image-generation/FileCodexImageCapabilityEvidenceSource.ts
 var import_node_crypto13 = require("crypto");
 var import_node_fs14 = require("fs");
 var import_node_path14 = require("path");
-var import_outbound_api5 = require("@omnicross/core/outbound-api");
+var import_outbound_api6 = require("@omnicross/core/outbound-api");
 
 // src/image-generation/imageTenantHmac.ts
 var import_node_crypto12 = require("crypto");
@@ -8090,7 +8616,7 @@ var ACCOUNT_DOMAIN = Buffer.from("omnicross:codex-image-evidence:account:v1\0",
 var ACCOUNT_KEY = /^[a-f0-9]{64}$/u;
 var SIZE = /^(?:auto|[1-9][0-9]{1,4}x[1-9][0-9]{1,4})$/u;
 var MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
-var PHYSICAL_RETENTION_TTL_MS = import_outbound_api5.IMAGE_SERVER_HARD_CEILINGS.evidenceTtlMs;
+var PHYSICAL_RETENTION_TTL_MS = import_outbound_api6.IMAGE_SERVER_HARD_CEILINGS.evidenceTtlMs;
 function exactKeys(value, allowed) {
   const allow = new Set(allowed);
   return Object.keys(value).every((key) => allow.has(key));
@@ -8464,7 +8990,7 @@ function createImageDoctorService(options) {
   const activePaths = () => options.storageCatalog.active().resolver;
   return Object.freeze({
     inspectLocal: async (config) => {
-      const configErrors = (0, import_outbound_api6.validateImagesServerConfig)(config);
+      const configErrors = (0, import_outbound_api7.validateImagesServerConfig)(config);
       let verifiedAreas = 0;
       try {
         const paths = activePaths();
@@ -8506,7 +9032,7 @@ function createImageDoctorService(options) {
           continue;
         }
         try {
-          const permissions = (0, import_outbound_api6.validateOutboundPermissions)(row.allowedEndpoints);
+          const permissions = (0, import_outbound_api7.validateOutboundPermissions)(row.allowedEndpoints);
           if (permissions.includes("images")) imagesAuthorizedRows += 1;
         } catch {
           invalidRows += 1;
@@ -8810,7 +9336,7 @@ var ImageCleanupService = class {
 // src/image-generation/ImageRuntimeGenerationFactory.ts
 var import_node_crypto16 = require("crypto");
 var import_image_generation5 = require("@omnicross/core/image-generation");
-var import_outbound_api7 = require("@omnicross/core/outbound-api");
+var import_outbound_api8 = require("@omnicross/core/outbound-api");
 var import_subscriptions4 = require("@omnicross/subscriptions");
 
 // src/image-generation/ImageApiRuntimeResolver.ts
@@ -9278,7 +9804,7 @@ function createImageRuntimeGeneration(options) {
     throw new TypeError("image runtime generation id is invalid");
   }
   const config = snapshotConfig(options.config);
-  const configErrors = (0, import_outbound_api7.validateImagesServerConfig)(config);
+  const configErrors = (0, import_outbound_api8.validateImagesServerConfig)(config);
   if (configErrors.length > 0) {
     throw new TypeError(`image runtime configuration is invalid: ${configErrors[0]}`);
   }
@@ -12870,7 +13396,7 @@ function safeStringify(value) {
 var import_node_crypto20 = require("crypto");
 var import_node_fs20 = require("fs");
 var import_node_path20 = require("path");
-var import_outbound_api8 = require("@omnicross/core/outbound-api");
+var import_outbound_api9 = require("@omnicross/core/outbound-api");
 function atomicReplaceDocument(targetPath, contents) {
   const tempPath = (0, import_node_path20.join)(
     (0, import_node_path20.dirname)(targetPath),
@@ -12918,13 +13444,13 @@ var JsonApiServerSettingsStore = class {
   box;
   atomicReplace;
   async get(key) {
-    if (key !== import_outbound_api8.OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
+    if (key !== import_outbound_api9.OUTBOUND_API_SERVER_CONFIG_KEY) return void 0;
     const file = this.readFile();
     if (file.server === void 0) return void 0;
     return this.decryptSecrets(file.server);
   }
   async set(key, value) {
-    if (key !== import_outbound_api8.OUTBOUND_API_SERVER_CONFIG_KEY) return;
+    if (key !== import_outbound_api9.OUTBOUND_API_SERVER_CONFIG_KEY) return;
     const file = this.readFile();
     file.server = this.encryptSecrets(value);
     this.atomicReplace(
@@ -14563,7 +15089,7 @@ var import_node_fs27 = require("fs");
 var import_node_path27 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_subscriptions5 = require("@omnicross/subscriptions");
 
@@ -14711,7 +15237,7 @@ var JsonSubscriptionCredentialStore = class {
    * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch5.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -15269,7 +15795,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/CodexGenerationProbe.ts
 var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
@@ -15430,7 +15956,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch5.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch6.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -16586,7 +17112,7 @@ var AuditWriter = class {
 var import_node_fs33 = require("fs");
 var import_node_crypto24 = require("crypto");
 var import_node_path34 = require("path");
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -16609,7 +17135,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch6.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -17018,7 +17544,7 @@ function createRouteLeaseSubscriptionPreflight(credentials) {
 
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto25 = require("crypto");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -17038,7 +17564,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch7.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -17269,7 +17795,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_AccountAllowanceStore4.setSharedAccountAllowanceStore)(accountAllowanceStore);
   (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
-    (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+    (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const llmConfig = new ConfigFileProviderConfigSource(decryptedConfig);
   const keyDb = new JsonOutboundKeyDb(paths.keysPath, secretBox3);
@@ -17290,7 +17816,7 @@ function buildDaemon(config, paths) {
     logger
   );
   claudeAllowanceRefreshScheduler.configure(
-    (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
+    (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
   const subscriptionAccounts = new import_subscriptions6.SubscriptionAccountService(credentialStore);
   (0, import_subscriptions6.setSubscriptionAccountService)(subscriptionAccounts);
@@ -17300,7 +17826,7 @@ function buildDaemon(config, paths) {
   );
   (0, import_subscriptions6.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch8.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch9.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
@@ -17323,7 +17849,7 @@ function buildDaemon(config, paths) {
   const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
-    fetchImpl: ((input, init) => (0, import_upstreamFetch8.fetchUpstream)(String(input), init ?? {}))
+    fetchImpl: ((input, init) => (0, import_upstreamFetch9.fetchUpstream)(String(input), init ?? {}))
   });
   const pricingRefreshScheduler = new PricingRefreshScheduler(
     pricingEngine,
@@ -17335,13 +17861,21 @@ function buildDaemon(config, paths) {
     defaultUsageEventsPath(paths.configPath),
     async (providerId, model) => await pricingEngine.getEntry(providerId, model) !== null
   );
-  const keySpendTracker = new import_outbound_api10.KeySpendTracker(usageEventStore);
+  const keySpendTracker = new import_outbound_api11.KeySpendTracker(usageEventStore);
   const usageThroughput = (0, import_usage2.getSharedUsageThroughputTracker)();
   const usageRecorder = new import_usage2.UsageRecorder(usageEventStore, pricingEngine, logger, {
     onRecord: (apiKeyId, costUsd, at) => keySpendTracker.add(apiKeyId, costUsd, at),
     onEvent: (row, at) => usageThroughput.record(row, at)
   });
-  const initialImagesConfig = (0, import_outbound_api9.normalizeServerConfig)(decryptedConfig.server).images;
+  const initialImagesConfig = (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).images;
+  const initialSearchConfig = (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).search;
+  for (const issue of (0, import_outbound_api10.validateSearchServerConfig)(
+    decryptedConfig.server?.search
+  )) {
+    logger.warn("[search] ignoring invalid config: " + issue);
+  }
+  const searchRuntime = buildSearchRuntime(initialSearchConfig, { logger });
+  const searchFrontendModes = initialSearchConfig.modes;
   const imageObservability = new ImageObservability();
   const imageRuntimeObservability = Object.freeze({
     telemetrySink: imageObservability.telemetrySink,
@@ -17471,7 +18005,9 @@ function buildDaemon(config, paths) {
       apiKeyPool,
       usageRecorder,
       openAIOperationRegistry,
-      responsesHostedImageIngress
+      responsesHostedImageIngress,
+      searchRuntime,
+      searchFrontendModes
     });
     if (providerProxy.getDeps().openAIOperationRegistry !== openAIOperationRegistry) {
       throw new Error(
@@ -17505,7 +18041,7 @@ function buildDaemon(config, paths) {
     credentialStore,
     (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)(),
     logger,
-    import_outbound_api9.DEFAULT_ACCOUNT_PROBE
+    import_outbound_api10.DEFAULT_ACCOUNT_PROBE
   );
   const getHealthReport = () => buildHealthReport({
     version: DAEMON_VERSION,
@@ -17522,7 +18058,7 @@ function buildDaemon(config, paths) {
     // `/health` body stays byte-identical (zero regression).
     subscriptionAccountsHealthy: () => accountHealthProbeScheduler.enabled ? accountHealthProbeScheduler.probedAccountsHealthy() : void 0
   });
-  const outboundApiServer = (0, import_outbound_api9.getOutboundApiServer)({
+  const outboundApiServer = (0, import_outbound_api10.getOutboundApiServer)({
     db: keyDb,
     // voucher-redemption #9: the key-authenticated `POST /redeem` endpoint redeems
     // cards against the presenting key (gated on `voucher.enabled`).
@@ -17536,7 +18072,9 @@ function buildDaemon(config, paths) {
     keySpendTracker,
     // configurable-logging: route the server's OWN lifecycle + relay dispatch-error
     // lines through the injected logger (honors level/format/file sink).
-    logger
+    logger,
+    // plan 阶段5: the same instance the managed frontends hold.
+    searchRuntime
   });
   const auditDir = defaultAuditDir(paths.configPath);
   const billingDir = defaultBillingDir(paths.configPath);
@@ -17558,6 +18096,10 @@ function buildDaemon(config, paths) {
     }),
     routeLeaseManager,
     subscriptionAccounts,
+    // search-settings-ui D3: the daemon's ONE search runtime + its
+    // bootstrap-captured modes, for `GET /admin/api/search/diagnostics` and
+    // `POST /admin/api/search/test` (501 when a light embedder omits it).
+    searchStatus: { runtime: searchRuntime, modes: searchFrontendModes },
     accountAllowanceService,
     allowanceRefreshScheduler: claudeAllowanceRefreshScheduler,
     accountProbeService: accountHealthProbeScheduler,
@@ -17587,7 +18129,7 @@ function buildDaemon(config, paths) {
     // — `server.proxy.byProvider[...]` was silently skipped — and the call was
     // excluded from the upstream trace, so a failing login left no evidence.
     // `redactBodies` keeps the code/verifier + minted token out of that trace.
-    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { providerId, redactBodies: true }),
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -17607,7 +18149,7 @@ function buildDaemon(config, paths) {
     cliCommandRunner: paths.cliCommandRunner,
     integrationManagerFactory: () => {
       const live = outboundApiServer.getStatus();
-      const port = live.port || decryptedConfig.server?.port || import_outbound_api9.DEFAULT_OUTBOUND_PORT;
+      const port = live.port || decryptedConfig.server?.port || import_outbound_api10.DEFAULT_OUTBOUND_PORT;
       return new IntegrationManager({
         configPath: paths.configPath,
         gatewayBaseUrl: live.loopbackUrl ?? `http://127.0.0.1:${port}`,
@@ -17653,7 +18195,7 @@ function buildDaemon(config, paths) {
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
@@ -17694,6 +18236,8 @@ function buildDaemon(config, paths) {
     keyDb,
     settingsStore,
     openAIOperationRegistry,
+    searchRuntime,
+    searchFrontendModes,
     imageRuntimeManager,
     imageObservability,
     imageCleanupService,
@@ -17830,7 +18374,7 @@ async function runImagesLiveDoctor(config, doctor, signal = new AbortController(
   console.info(
     "  [\u26A0] live Images verification may consume subscription quota; one minimal low-quality PNG request will be sent"
   );
-  const result = await doctor.verifyLive(config.images ?? import_outbound_api11.DEFAULT_IMAGES_SERVER_CONFIG, signal);
+  const result = await doctor.verifyLive(config.images ?? import_outbound_api12.DEFAULT_IMAGES_SERVER_CONFIG, signal);
   if (!result.ok) {
     console.info(`  [\u2717] live Images verification: ${result.code}`);
     return false;
@@ -17840,6 +18384,116 @@ async function runImagesLiveDoctor(config, doctor, signal = new AbortController(
   );
   return true;
 }
+function readSearchApiConfigFromEnv(env = process.env) {
+  const configs = {};
+  const read = (name) => {
+    const value = env[`OMNICROSS_SEARCH_${name}`]?.trim();
+    return value ? value : void 0;
+  };
+  const tavilyKey = read("TAVILY_API_KEY");
+  if (tavilyKey) {
+    configs.tavily = { apiKey: tavilyKey, ...optionalHost(read("TAVILY_API_HOST")) };
+  }
+  const jinaKey = read("JINA_API_KEY");
+  const jinaHost = read("JINA_API_HOST");
+  if (jinaKey || jinaHost) {
+    configs.jina = { ...jinaKey ? { apiKey: jinaKey } : {}, ...optionalHost(jinaHost) };
+  }
+  const searxngHost = read("SEARXNG_API_HOST");
+  if (searxngHost) {
+    const username = read("SEARXNG_BASIC_AUTH_USERNAME");
+    const password = read("SEARXNG_BASIC_AUTH_PASSWORD");
+    configs.searxng = {
+      apiHost: searxngHost,
+      ...username ? { basicAuthUsername: username } : {},
+      ...password ? { basicAuthPassword: password } : {}
+    };
+  }
+  const zhipuKey = read("ZHIPU_API_KEY");
+  if (zhipuKey) {
+    configs.zhipu = { apiKey: zhipuKey, ...optionalHost(read("ZHIPU_API_HOST")) };
+  }
+  const zaiKey = read("Z_AI_API_KEY");
+  if (zaiKey) {
+    configs["z.ai"] = { apiKey: zaiKey, ...optionalHost(read("Z_AI_API_HOST")) };
+  }
+  return configs;
+}
+function optionalHost(apiHost) {
+  return apiHost ? { apiHost } : {};
+}
+function resolveSearchApiConfigs(configured, env = process.env) {
+  const fromEnv = readSearchApiConfigFromEnv(env);
+  const resolved = {};
+  const tavily = configured?.tavily ?? fromEnv.tavily;
+  if (tavily) resolved.tavily = tavily;
+  const jina = configured?.jina ?? fromEnv.jina;
+  if (jina) resolved.jina = jina;
+  const searxng = configured?.searxng ?? fromEnv.searxng;
+  if (searxng) resolved.searxng = searxng;
+  const zhipu = configured?.zhipu ?? fromEnv.zhipu;
+  if (zhipu) resolved.zhipu = zhipu;
+  const zai = configured?.["z.ai"] ?? fromEnv["z.ai"];
+  if (zai) resolved["z.ai"] = zai;
+  return resolved;
+}
+function formatCapabilities(capabilities) {
+  return [
+    `apiKey=${capabilities.requiresApiKey}`,
+    `cancellation=${capabilities.supportsCancellation}`,
+    `urlRead=${capabilities.supportsUrlRead}`,
+    `region=${capabilities.supportsRegion}`,
+    `language=${capabilities.supportsLanguage}`,
+    `timeRange=${capabilities.supportsTimeRange}`,
+    `maxResults=${capabilities.maxResults ?? "unbounded"}`
+  ].join(", ");
+}
+function formatDiagnostic(diagnostic) {
+  const parts = [diagnostic.status];
+  if (diagnostic.reason) parts.push(diagnostic.reason);
+  if (diagnostic.error) {
+    const { code, details } = diagnostic.error;
+    parts.push(
+      `code=${code}, transport=${details?.transport ?? "unknown"}, stage=${details?.stage ?? "unknown"}`
+    );
+  }
+  return parts.join(" \u2014 ");
+}
+async function runSearchDoctor(live, env = process.env, source = {}) {
+  const apiConfigs = resolveSearchApiConfigs(source.config?.providers, env);
+  const egressPolicy = source.config && source.config.egress.allowedPrivateHosts.length > 0 ? { allowedPrivateHosts: [...source.config.egress.allowedPrivateHosts] } : void 0;
+  const contributions = [
+    ...(0, import_http4.builtinHttpSearchContributions)(),
+    ...(0, import_api4.apiSearchContributions)(apiConfigs, { ...egressPolicy ? { egressPolicy } : {} })
+  ];
+  const declarations = source.runtime?.listProviders() ?? contributions;
+  console.info("omnicross doctor search \u2014 builtin search contributions (offline, no network)");
+  const modes = source.config?.modes ?? import_search3.DEFAULT_SEARCH_FRONTEND_MODES;
+  console.info(
+    `  [i] frontend modes: ${import_search3.SEARCH_FRONTEND_NAMES.map((name) => `${name}=${modes[name]}`).join(", ")}`
+  );
+  console.info(
+    "  [i] codex mode applies immediately; responses/anthropic modes, provider config, egress allowlist and policy apply on daemon restart"
+  );
+  for (const row of buildSearchDoctorSnapshot(declarations, apiConfigs)) {
+    const mark = row.status === "unconfigured" ? "\u2013" : "\u2713";
+    const suffix = row.status ? ` \u2014 ${row.status}: ${row.reason ?? ""}` : "";
+    console.info(
+      `  [${mark}] ${row.providerId}: source=${row.source}, kind=${row.kind}, ${formatCapabilities(row.capabilities)}${suffix}`
+    );
+  }
+  if (!live) return 0;
+  console.info(
+    `  [\u26A0] live search sends ONE fixed public query per provider ("${SEARCH_DOCTOR_QUERY}") to the engine itself`
+  );
+  let hardFailure = false;
+  for (const diagnostic of await runSearchLiveChecks(contributions)) {
+    const mark = diagnostic.status === "healthy" ? "\u2713" : diagnostic.status === "failed" ? "\u2717" : "\u26A0";
+    if (diagnostic.status === "failed") hardFailure = true;
+    console.info(`  [${mark}] ${diagnostic.providerId}: ${formatDiagnostic(diagnostic)}`);
+  }
+  return hardFailure ? 1 : 0;
+}
 async function runLiveProbe(url, key, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/messages/count_tokens`, {
@@ -17876,11 +18530,12 @@ async function runDoctor(argv, fetchImpl = fetch) {
     allowPositionals: true
   });
   const subject = positionals[0] ?? "claude";
-  if (subject !== "claude" && subject !== "images") {
-    throw new Error(`doctor: unknown subject '${subject}' (supported: 'claude', 'images')`);
+  if (subject !== "claude" && subject !== "images" && subject !== "search") {
+    throw new Error(`doctor: unknown subject '${subject}' (supported: 'claude', 'images', 'search')`);
   }
   const configPath = values.config;
   if (!configPath) {
+    if (subject === "search") return runSearchDoctor(values.live === true);
     throw new Error("doctor: --config <path> is required (the same config `omnicross start` uses)");
   }
   const config = loadConfig(configPath);
@@ -17892,9 +18547,15 @@ async function runDoctor(argv, fetchImpl = fetch) {
   };
   const daemon = await buildDaemon(config, paths);
   try {
-    const serverConfig = await (0, import_outbound_api11.loadServerConfig)(daemon.settingsStore);
+    const serverConfig = await (0, import_outbound_api12.loadServerConfig)(daemon.settingsStore);
+    if (subject === "search") {
+      return await runSearchDoctor(values.live === true, process.env, {
+        ...serverConfig.search ? { config: serverConfig.search } : {},
+        runtime: daemon.searchRuntime
+      });
+    }
     const checks = subject === "images" ? buildImagesDoctorChecks(await daemon.imageDoctor.inspectLocal(
-      serverConfig.images ?? import_outbound_api11.DEFAULT_IMAGES_SERVER_CONFIG
+      serverConfig.images ?? import_outbound_api12.DEFAULT_IMAGES_SERVER_CONFIG
     )) : buildClaudeDoctorChecks(serverConfig);
     let hardFailure = false;
     console.info(subject === "images" ? "omnicross doctor images \u2014 local metadata only" : `omnicross doctor ${subject} \u2014 config: ${configPath}`);
@@ -18117,7 +18778,7 @@ function isClient(value) {
 
 // src/commands/keys.ts
 var import_node_util5 = require("util");
-var import_outbound_api12 = require("@omnicross/core/outbound-api");
+var import_outbound_api13 = require("@omnicross/core/outbound-api");
 async function runKeys(argv) {
   const { values, positionals } = (0, import_node_util5.parseArgs)({
     args: argv,
@@ -18143,7 +18804,7 @@ async function runKeys(argv) {
 }
 async function keysAdd(db, name) {
   if (!name) throw new Error("keys add: a <name> is required");
-  const created = await (0, import_outbound_api12.createNamedKey)(db, name);
+  const created = await (0, import_outbound_api13.createNamedKey)(db, name);
   console.info(`Created key '${created.name}' (id: ${created.id}).`);
   console.info("");
   console.info(`  ${created.plaintextOnce}`);
@@ -18399,7 +19060,7 @@ function spawnCliInherit(plan) {
 var import_node_child_process3 = require("child_process");
 var import_node_readline2 = require("readline");
 var import_node_util7 = require("util");
-var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch10 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_subscriptions7 = require("@omnicross/subscriptions");
 var PROVIDERS2 = ["claude", "codex", "gemini"];
 async function runLogin(argv, deps) {
@@ -18431,10 +19092,10 @@ async function runLogin(argv, deps) {
   };
   const box = resolveSecretBox(values["master-key-file"]);
   setSecretBox(box);
-  (0, import_upstreamFetch9.setUpstreamProxyResolver)(createUpstreamProxyResolver());
+  (0, import_upstreamFetch10.setUpstreamProxyResolver)(createUpstreamProxyResolver());
   try {
     const tokensPath = defaultTokensPath(values.config);
-    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch10.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
     const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
     const expiresAt = await runProviderLogin(
       provider,
@@ -18447,7 +19108,7 @@ async function runLogin(argv, deps) {
     console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
   } finally {
     setSecretBox(null);
-    (0, import_upstreamFetch9.setUpstreamProxyResolver)(null);
+    (0, import_upstreamFetch10.setUpstreamProxyResolver)(null);
   }
 }
 async function runProviderLogin(provider, store, deps, exchangeFetch, label) {
@@ -18966,7 +19627,7 @@ function tokensSuffix(configPath) {
 
 // src/commands/start.ts
 var import_node_util10 = require("util");
-var import_outbound_api13 = require("@omnicross/core/outbound-api");
+var import_outbound_api14 = require("@omnicross/core/outbound-api");
 var import_SubscriptionAccountHealth5 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling6 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 
@@ -19028,7 +19689,7 @@ async function runStart(argv) {
   await daemon.llmConfig.ready();
   await daemon.migrateUsageStore();
   await daemon.providerProxy.start();
-  const serverConfig = await (0, import_outbound_api13.loadServerConfig)(daemon.settingsStore);
+  const serverConfig = await (0, import_outbound_api14.loadServerConfig)(daemon.settingsStore);
   await daemon.imageCleanupService.runOnce();
   daemon.imageCleanupService.start();
   (0, import_SubscriptionAccountHealth5.getSharedAccountHealth)().configure({
@@ -19051,7 +19712,9 @@ async function runStart(argv) {
     voucher: serverConfig.voucher,
     // claude-api-protocol-fidelity (§10): count_tokens strategy/budget,
     // /v1/models shape, synthetic-ping heartbeat (hot-applied inside applyConfig).
-    anthropic: serverConfig.anthropic
+    anthropic: serverConfig.anthropic,
+    // plan 阶段5: the Codex frontend mode is read live per request from here.
+    search: serverConfig.search
   });
   let dashboardUrl = null;
   if (!values["no-dashboard"]) {
@@ -19166,6 +19829,16 @@ Usage:
                                            Check local Images config, roots, stores, permissions,
                                            account and cached evidence. --live warns, then consumes
                                            at most one minimal subscription image request.
+  omnicross doctor search [--live]          List the builtin search providers and their declared
+                                           capabilities (offline, no config needed). --live sends ONE
+                                           fixed public query per provider and reports healthy /
+                                           degraded / blocked / failed.
+                                           Keyed API providers show as unconfigured unless enabled
+                                           through the DIAGNOSTIC-ONLY environment variables
+                                           OMNICROSS_SEARCH_{TAVILY,JINA,SEARXNG,ZHIPU,Z_AI}_API_KEY
+                                           / _API_HOST (plus SEARXNG_BASIC_AUTH_USERNAME/_PASSWORD).
+                                           These are read only by this command and are not the
+                                           configuration system.
 `;
 async function main() {
   const [, , subcommand, ...rest] = process.argv;