@omnicross/daemon 0.2.0 → 0.3.0

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
+import { SearchRuntime, SearchFrontendModes } from '@omnicross/core/search';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
 import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
 import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
@@ -2406,6 +2407,60 @@ type CommandRunner = (command: string) => Promise<{
     error?: string;
 }>;
 
+/**
+ * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
+ * search-settings-tab D4).
+ *
+ * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
+ * `case 'search'`:
+ *
+ * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
+ *   snapshot: one row per provider the daemon can run (the ONE runtime's
+ *   descriptors, plus `unconfigured` rows for known API providers the persisted
+ *   config does not name — the doctor's classification), the effective frontend
+ *   modes, and the explicit apply semantics (codex immediate, rest restart).
+ * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
+ *   a configured provider, classified by the doctor's pure functions. The
+ *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
+ *   caller-supplied query, and never returns result content (plan §11.3 — its
+ *   contract is the automated doctor's fixed-query discipline).
+ * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
+ *   channel for the settings page's per-provider test panel (owner feedback
+ *   2026-09-02): ONE operator-typed query through ONE provider's contribution
+ *   built from the PERSISTED config, returning the doctor-classified diagnostic
+ *   PLUS the sanitized results. The two disciplines stay separate routes on
+ *   purpose: bending `/test` to accept a query would erase the boundary its
+ *   pinned tests and consumers depend on.
+ *
+ * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
+ * and a failure response carries only the doctor's SANITIZED error shape — raw
+ * upstream error bodies (which may quote the stored key) never serialize. The
+ * query endpoint additionally sanitizes every returned result field BEFORE
+ * serialization (plan §11.1: search results are untrusted input), and the
+ * operator's query is never logged anywhere.
+ *
+ * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
+ * that wire no search runtime get 501 for all routes (the voucher/allowance
+ * optionality precedent) rather than a fabricated snapshot.
+ *
+ * @module @omnicross/daemon/admin/searchAdminApi
+ */
+
+/**
+ * The daemon search state the admin surface needs. Structurally satisfied by
+ * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
+ * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
+ * without any network.
+ */
+interface SearchAdminRuntimeStatus {
+    /** The daemon's ONE assembled search runtime (provider descriptors). */
+    readonly runtime: SearchRuntime;
+    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
+    readonly modes: SearchFrontendModes;
+    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
+    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
+}
+
 /**
  * migration.ts — the export gather + import apply logic for the passphrase pack
  * (app-parity child 6, design D2/D3/D5).
@@ -2627,6 +2682,13 @@ interface AdminApiDeps {
     readonly cliCommandRunner?: CommandRunner;
     /** Factory so each request observes the outbound server's current loopback port. */
     readonly integrationManagerFactory?: () => IntegrationManager;
+    /**
+     * search-settings-ui D3: the daemon's ONE search runtime plus its
+     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
+     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
+     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     */
+    readonly searchStatus?: SearchAdminRuntimeStatus;
 }
 /**
  * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
@@ -4065,6 +4127,13 @@ interface Daemon {
     readonly settingsStore: JsonApiServerSettingsStore;
     /** App-session extension-operation registry shared with the resident proxy. */
     readonly openAIOperationRegistry: OpenAIOperationRegistry;
+    /**
+     * The ONE search runtime for this daemon (plan 阶段5 §6.3). The same object
+     * the Codex route, both managed frontends and the search doctor hold.
+     */
+    readonly searchRuntime: SearchRuntime;
+    /** Per-frontend search modes as loaded at bootstrap. */
+    readonly searchFrontendModes: SearchFrontendModes;
     /** Stable Images forwarders and generation lifecycle owner for this app session. */
     readonly imageRuntimeManager: ImageRuntimeManager;
     /** Bounded process-local metadata aggregation shared by every runtime generation. */

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
+import { SearchRuntime, SearchFrontendModes } from '@omnicross/core/search';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
 import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
 import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
@@ -2406,6 +2407,60 @@ type CommandRunner = (command: string) => Promise<{
     error?: string;
 }>;
 
+/**
+ * searchAdminApi — the admin API's search surface (search-settings-ui D3 +
+ * search-settings-tab D4).
+ *
+ * Three routes over the daemon's search state, dispatched from `adminApi.ts`'s
+ * `case 'search'`:
+ *
+ * - `GET /admin/api/search/diagnostics` — a READ-ONLY, secret-free, network-free
+ *   snapshot: one row per provider the daemon can run (the ONE runtime's
+ *   descriptors, plus `unconfigured` rows for known API providers the persisted
+ *   config does not name — the doctor's classification), the effective frontend
+ *   modes, and the explicit apply semantics (codex immediate, rest restart).
+ * - `POST /admin/api/search/test { providerId }` — ONE live fixed-query check on
+ *   a configured provider, classified by the doctor's pure functions. The
+ *   machine-facing health probe: it sends exactly `SEARCH_DOCTOR_QUERY`, never a
+ *   caller-supplied query, and never returns result content (plan §11.3 — its
+ *   contract is the automated doctor's fixed-query discipline).
+ * - `POST /admin/api/search/query { providerId, query }` — the INTERACTIVE
+ *   channel for the settings page's per-provider test panel (owner feedback
+ *   2026-09-02): ONE operator-typed query through ONE provider's contribution
+ *   built from the PERSISTED config, returning the doctor-classified diagnostic
+ *   PLUS the sanitized results. The two disciplines stay separate routes on
+ *   purpose: bending `/test` to accept a query would erase the boundary its
+ *   pinned tests and consumers depend on.
+ *
+ * SECRET SPINE (all three routes): no response ever carries a configured VALUE,
+ * and a failure response carries only the doctor's SANITIZED error shape — raw
+ * upstream error bodies (which may quote the stored key) never serialize. The
+ * query endpoint additionally sanitizes every returned result field BEFORE
+ * serialization (plan §11.1: search results are untrusted input), and the
+ * operator's query is never logged anywhere.
+ *
+ * The diagnostics dep is OPTIONAL (`AdminApiDeps.searchStatus`): light embedders
+ * that wire no search runtime get 501 for all routes (the voucher/allowance
+ * optionality precedent) rather than a fabricated snapshot.
+ *
+ * @module @omnicross/daemon/admin/searchAdminApi
+ */
+
+/**
+ * The daemon search state the admin surface needs. Structurally satisfied by
+ * what `bootstrap.ts` already holds (the ONE runtime + its captured modes);
+ * `testFetch` is a TEST SEAM so route tests can intercept the one live probe
+ * without any network.
+ */
+interface SearchAdminRuntimeStatus {
+    /** The daemon's ONE assembled search runtime (provider descriptors). */
+    readonly runtime: SearchRuntime;
+    /** Modes as captured at bootstrap (responses/anthropic are these, live). */
+    readonly modes: SearchFrontendModes;
+    /** TEST SEAM: fetch primitive for the live-test probe. Absent ⇒ real transport. */
+    readonly testFetch?: (url: string, init: RequestInit) => Promise<Response>;
+}
+
 /**
  * migration.ts — the export gather + import apply logic for the passphrase pack
  * (app-parity child 6, design D2/D3/D5).
@@ -2627,6 +2682,13 @@ interface AdminApiDeps {
     readonly cliCommandRunner?: CommandRunner;
     /** Factory so each request observes the outbound server's current loopback port. */
     readonly integrationManagerFactory?: () => IntegrationManager;
+    /**
+     * search-settings-ui D3: the daemon's ONE search runtime plus its
+     * bootstrap-captured frontend modes. Optional for lightweight embedders; the
+     * standalone daemon wires it and the `/admin/api/search` diagnostics/test
+     * routes return 501 when absent (the voucher/allowance optionality precedent).
+     */
+    readonly searchStatus?: SearchAdminRuntimeStatus;
 }
 /**
  * Dispatch one `/admin/api/*` request. `path` is the already-extracted pathname
@@ -4065,6 +4127,13 @@ interface Daemon {
     readonly settingsStore: JsonApiServerSettingsStore;
     /** App-session extension-operation registry shared with the resident proxy. */
     readonly openAIOperationRegistry: OpenAIOperationRegistry;
+    /**
+     * The ONE search runtime for this daemon (plan 阶段5 §6.3). The same object
+     * the Codex route, both managed frontends and the search doctor hold.
+     */
+    readonly searchRuntime: SearchRuntime;
+    /** Per-frontend search modes as loaded at bootstrap. */
+    readonly searchFrontendModes: SearchFrontendModes;
     /** Stable Images forwarders and generation lifecycle owner for this app session. */
     readonly imageRuntimeManager: ImageRuntimeManager;
     /** Bounded process-local metadata aggregation shared by every runtime generation. */