@amoshydra/oktoso 0.1.5 → 0.1.7

package/dist/hub.js

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // packages/hub/src/main.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync4 } from "fs";
-import { dirname as dirname4, join as join4, resolve as resolve2 } from "path";
+import { dirname as dirname5, join as join4, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/.pnpm/@hono+node-server@2.1.5_hono@4.13.14/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
@@ -429,7 +429,7 @@ var readBodyDirect = (request) => {
     request[bodyBufferKey] = buffered;
     return Promise.resolve(buffered);
   }
-  const promise2 = new Promise((resolve3, reject) => {
+  const promise2 = new Promise((resolve4, reject) => {
     const chunks = [];
     let settled = false;
     const finish = (callback) => {
@@ -447,7 +447,7 @@ var readBodyDirect = (request) => {
         else if (recovered === void 0) reject(error62 ?? normalizeAbortError(request, incoming));
         else {
           request[bodyBufferKey] = recovered;
-          resolve3(recovered);
+          resolve4(recovered);
         }
       });
       return true;
@@ -459,7 +459,7 @@ var readBodyDirect = (request) => {
       finish(() => {
         const buffer = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks);
         request[bodyBufferKey] = buffer;
-        resolve3(buffer);
+        resolve4(buffer);
       });
     };
     const onError = (error62) => {
@@ -1006,7 +1006,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve3) => setTimeout(resolve3));
+            await new Promise((resolve4) => setTimeout(resolve4));
             maxReadCount = 3;
             continue;
           }
@@ -1192,9 +1192,9 @@ var setupWebSocket = (options) => {
     }
   };
   const waitForWebSocket = (request, connectionSymbol) => {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       waiterMap.set(request, {
-        resolve: resolve3,
+        resolve: resolve4,
         reject,
         connectionSymbol
       });
@@ -6411,7 +6411,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -6421,7 +6421,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve3);
+      const answer = isRecursive(child, stack, resolve4);
       if (answer > result)
         result = answer;
     }
@@ -6432,7 +6432,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -6496,7 +6496,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -21078,6 +21078,51 @@ var zError = external_exports.object({
   })
 });
 var zProviderStatus = external_exports.enum(["online", "offline", "auth-error", "unknown"]);
+var zProviderAuthKind = external_exports.enum(["basic", "bearer", "none"]);
+var zProviderIDInput = external_exports.string().min(1).max(64).regex(
+  /^[a-zA-Z0-9._-]+$/,
+  "Provider IDs may contain letters, numbers, dot, underscore, or dash"
+);
+var zProviderTypeInput = external_exports.enum(["opencode", "openwebui"]);
+var zProviderAuthInput = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("basic"),
+    username: external_exports.string().min(1).default("opencode"),
+    password: external_exports.string().min(1)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("bearer"),
+    token: external_exports.string().min(1)
+  }),
+  external_exports.object({ kind: external_exports.literal("none") })
+]);
+var zProviderAuthUpdate = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("basic"),
+    username: external_exports.string().min(1).default("opencode"),
+    password: external_exports.string().min(1).optional()
+  }),
+  external_exports.object({
+    kind: external_exports.literal("bearer"),
+    token: external_exports.string().min(1).optional()
+  }),
+  external_exports.object({ kind: external_exports.literal("none") })
+]);
+var zProviderInput = external_exports.object({
+  id: zProviderIDInput,
+  type: zProviderTypeInput,
+  name: external_exports.string().min(1).max(80).optional(),
+  baseUrl: external_exports.string().url(),
+  auth: zProviderAuthInput.optional(),
+  enabled: external_exports.boolean().default(true)
+});
+var zProviderUpdateInput = external_exports.object({
+  type: zProviderTypeInput,
+  name: external_exports.string().min(1).max(80).optional(),
+  baseUrl: external_exports.string().url(),
+  auth: zProviderAuthUpdate.optional(),
+  enabled: external_exports.boolean().default(true)
+});
 var zProviderCapabilities = external_exports.object({
   list: external_exports.boolean(),
   read: external_exports.boolean(),
@@ -21098,6 +21143,8 @@ var zProvider = external_exports.object({
   name: external_exports.string(),
   baseUrl: external_exports.string(),
   enabled: external_exports.boolean(),
+  authKind: zProviderAuthKind.optional(),
+  authUsername: external_exports.string().optional(),
   status: zProviderStatus,
   version: external_exports.string().optional(),
   lastCheckedAt: external_exports.number().int().optional(),
@@ -21935,14 +21982,14 @@ async function probeHub(config2) {
 }
 function isPortOpen(config2) {
   const host = isWildcardHost(config2.host) ? "127.0.0.1" : formatHost(config2.host).replace(/^\[|\]$/g, "");
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const socket = connect({ host, port: config2.port });
     let settled = false;
     const done = (open3) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve3(open3);
+      resolve4(open3);
     };
     socket.setTimeout(400);
     socket.once("connect", () => done(true));
@@ -22032,10 +22079,10 @@ var RotatingFileSink = class {
   async close() {
     this.closed = true;
     while (this.running || this.queue.length > 0) {
-      await new Promise((resolve3) => setTimeout(resolve3, 5));
+      await new Promise((resolve4) => setTimeout(resolve4, 5));
     }
     if (this.stream) {
-      await new Promise((resolve3) => this.stream?.end(resolve3));
+      await new Promise((resolve4) => this.stream?.end(resolve4));
       this.stream = void 0;
     }
   }
@@ -22088,8 +22135,8 @@ var RotatingFileSink = class {
       flags: "a",
       mode: 384
     });
-    await new Promise((resolve3, reject) => {
-      this.stream?.once("open", () => resolve3());
+    await new Promise((resolve4, reject) => {
+      this.stream?.once("open", () => resolve4());
       this.stream?.once("error", reject);
     });
     await chmod(this.filePath, 384).catch(() => void 0);
@@ -22099,29 +22146,29 @@ var RotatingFileSink = class {
     if (!this.stream) return;
     const stream2 = this.stream;
     this.stream = void 0;
-    await new Promise((resolve3) => stream2.end(resolve3));
+    await new Promise((resolve4) => stream2.end(resolve4));
     await rm(this.previousPath, { force: true });
     await rename2(this.filePath, this.previousPath);
     this.stream = createWriteStream(this.filePath, {
       flags: "a",
       mode: 384
     });
-    await new Promise((resolve3, reject) => {
-      this.stream?.once("open", () => resolve3());
+    await new Promise((resolve4, reject) => {
+      this.stream?.once("open", () => resolve4());
       this.stream?.once("error", reject);
     });
     await chmod(this.filePath, 384).catch(() => void 0);
     this.size = 0;
   }
   writeLine(line) {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       if (!this.stream) {
         reject(new Error("Log stream is not open"));
         return;
       }
       this.stream.write(line, (error62) => {
         if (error62) reject(error62);
-        else resolve3();
+        else resolve4();
       });
     });
   }
@@ -24968,17 +25015,17 @@ function findSessionID(value, depth = 0) {
   return void 0;
 }
 async function delay(ms, signal) {
-  await new Promise((resolve3) => {
+  await new Promise((resolve4) => {
     if (signal.aborted) {
-      resolve3();
+      resolve4();
       return;
     }
-    const timer = setTimeout(resolve3, ms);
+    const timer = setTimeout(resolve4, ms);
     signal.addEventListener(
       "abort",
       () => {
         clearTimeout(timer);
-        resolve3();
+        resolve4();
       },
       { once: true }
     );
@@ -25592,17 +25639,17 @@ function decodeCursor(cursor) {
   }
 }
 async function delay2(ms, signal) {
-  await new Promise((resolve3) => {
+  await new Promise((resolve4) => {
     if (signal.aborted) {
-      resolve3();
+      resolve4();
       return;
     }
-    const timer = setTimeout(resolve3, ms);
+    const timer = setTimeout(resolve4, ms);
     signal.addEventListener(
       "abort",
       () => {
         clearTimeout(timer);
-        resolve3();
+        resolve4();
       },
       { once: true }
     );
@@ -25619,28 +25666,46 @@ var ProviderRegistry = class {
   constructor(providers, logger) {
     this.logger = logger;
     for (const config2 of providers) {
-      this.runtimes.set(config2.id, {
-        config: config2,
-        status: "unknown",
-        ...config2.type === "opencode" ? {
-          adapter: new OpenCodeAdapter({
-            id: config2.id,
-            baseUrl: config2.baseUrl,
-            username: config2.auth?.kind === "basic" ? config2.auth.username : void 0,
-            password: config2.auth?.kind === "basic" ? config2.auth.password : ""
-          })
-        } : config2.type === "openwebui" ? {
-          adapter: new OpenWebUIAdapter({
-            id: config2.id,
-            baseUrl: config2.baseUrl,
-            token: config2.auth?.kind === "bearer" ? config2.auth.token : ""
-          })
-        } : {}
-      });
+      this.runtimes.set(config2.id, this.createRuntime(config2));
     }
   }
   logger;
   runtimes = /* @__PURE__ */ new Map();
+  add(config2) {
+    if (this.runtimes.has(config2.id)) {
+      throw new Error(`Provider ${config2.id} is already configured`);
+    }
+    this.runtimes.set(config2.id, this.createRuntime(config2));
+  }
+  remove(id) {
+    this.runtimes.delete(id);
+  }
+  replace(config2) {
+    if (!this.runtimes.has(config2.id)) {
+      throw new Error(`Provider ${config2.id} is not configured`);
+    }
+    this.runtimes.set(config2.id, this.createRuntime(config2));
+  }
+  createRuntime(config2) {
+    return {
+      config: config2,
+      status: "unknown",
+      ...config2.type === "opencode" ? {
+        adapter: new OpenCodeAdapter({
+          id: config2.id,
+          baseUrl: config2.baseUrl,
+          username: config2.auth?.kind === "basic" ? config2.auth.username : void 0,
+          password: config2.auth?.kind === "basic" ? config2.auth.password : ""
+        })
+      } : config2.type === "openwebui" ? {
+        adapter: new OpenWebUIAdapter({
+          id: config2.id,
+          baseUrl: config2.baseUrl,
+          token: config2.auth?.kind === "bearer" ? config2.auth.token : ""
+        })
+      } : {}
+    };
+  }
   adapters() {
     return [...this.runtimes.values()].map((runtime) => runtime.adapter).filter((adapter) => Boolean(adapter));
   }
@@ -25743,6 +25808,8 @@ var ProviderRegistry = class {
       name: runtime.config.name ?? runtime.config.id,
       baseUrl: runtime.config.baseUrl,
       enabled: runtime.config.enabled,
+      authKind: runtime.config.auth?.kind ?? "none",
+      ...runtime.config.auth?.kind === "basic" ? { authUsername: runtime.config.auth.username } : {},
       status: runtime.status,
       ...runtime.version ? { version: runtime.version } : {},
       ...runtime.lastCheckedAt ? { lastCheckedAt: runtime.lastCheckedAt } : {},
@@ -25751,6 +25818,10 @@ var ProviderRegistry = class {
   }
 };
 
+// packages/hub/src/services/provider-admin.ts
+import { mkdir as mkdir3, readFile as readFile3, rename as rename3, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname4, resolve } from "path";
+
 // packages/hub/src/domain/errors.ts
 var AppError = class extends Error {
   code;
@@ -25782,6 +25853,157 @@ function conflict(message, details) {
   return new AppError("conflict", message, 409, { details });
 }
 
+// packages/hub/src/services/provider-admin.ts
+var ProviderAdminService = class {
+  constructor(registry2, sessions, attention, providerEvents, logger, configPath) {
+    this.registry = registry2;
+    this.sessions = sessions;
+    this.attention = attention;
+    this.providerEvents = providerEvents;
+    this.logger = logger;
+    this.configPath = resolve(configPath);
+  }
+  registry;
+  sessions;
+  attention;
+  providerEvents;
+  logger;
+  configPath;
+  queue = Promise.resolve();
+  add(input2) {
+    return this.serialize(async () => {
+      const raw2 = await this.read();
+      const providers = raw2.providers ?? [];
+      if (providers.some((provider) => provider.id === input2.id)) {
+        throw conflict(`Provider ${input2.id} is already configured`);
+      }
+      const config2 = this.toConfig(input2);
+      await this.write({
+        ...raw2,
+        providers: [...providers, config2]
+      });
+      this.registry.add(config2);
+      this.invalidate();
+      const adapter = this.registry.adapter(config2.id);
+      if (adapter) void this.providerEvents?.subscribe(adapter);
+      const saved = await this.check(config2.id);
+      this.logger.info("provider added", {
+        providerID: config2.id,
+        status: saved.status
+      });
+      return saved;
+    });
+  }
+  update(id, input2) {
+    return this.serialize(async () => {
+      const raw2 = await this.read();
+      const providers = raw2.providers ?? [];
+      const index = providers.findIndex((provider) => provider.id === id);
+      if (index < 0) throw notFound(`Provider ${id} is not configured`);
+      const current = providers[index];
+      const auth = input2.auth ? this.mergeAuth(current.auth, input2.auth) : current.auth;
+      this.assertTypeAuth(input2.type, auth);
+      const config2 = zProviderConfig.parse({
+        ...current,
+        type: input2.type,
+        ...input2.name ? { name: input2.name } : {},
+        baseUrl: input2.baseUrl,
+        enabled: input2.enabled,
+        ...auth ? { auth } : {}
+      });
+      const next = [...providers];
+      next[index] = config2;
+      await this.write({ ...raw2, providers: next });
+      this.registry.replace(config2);
+      this.invalidate();
+      const adapter = this.registry.adapter(config2.id);
+      if (adapter) void this.providerEvents?.subscribe(adapter);
+      const saved = await this.check(config2.id);
+      this.logger.info("provider updated", {
+        providerID: config2.id,
+        status: saved.status
+      });
+      return saved;
+    });
+  }
+  toConfig(input2) {
+    this.assertTypeAuth(input2.type, input2.auth);
+    return zProviderConfig.parse({
+      id: input2.id,
+      type: input2.type,
+      ...input2.name ? { name: input2.name } : {},
+      baseUrl: input2.baseUrl,
+      ...input2.auth ? { auth: input2.auth } : {},
+      enabled: input2.enabled
+    });
+  }
+  assertTypeAuth(type, auth) {
+    if (!auth || auth.kind === "none") return;
+    if (type === "openwebui" && auth.kind !== "bearer") {
+      throw badRequest("Open WebUI requires bearer authentication");
+    }
+    if (type === "opencode" && auth.kind !== "basic") {
+      throw badRequest("OpenCode requires basic authentication");
+    }
+  }
+  mergeAuth(current, input2) {
+    if (input2.kind === "none") return { kind: "none" };
+    if (input2.kind === "basic") {
+      const password = input2.password ?? (current?.kind === "basic" ? current.password : void 0);
+      if (!password) {
+        throw badRequest("A password is required for basic authentication");
+      }
+      return { kind: "basic", username: input2.username, password };
+    }
+    const token = input2.token ?? (current?.kind === "bearer" ? current.token : void 0);
+    if (!token) {
+      throw badRequest("A token is required for bearer authentication");
+    }
+    return { kind: "bearer", token };
+  }
+  invalidate() {
+    this.sessions.invalidate();
+    this.attention.invalidate();
+  }
+  async check(id) {
+    try {
+      await this.registry.check(id);
+    } catch (error62) {
+      this.logger.warn("provider health check failed", {
+        providerID: id,
+        error: error62 instanceof Error ? error62.message : String(error62)
+      });
+    }
+    const provider = this.registry.get(id);
+    if (!provider) throw notFound(`Provider ${id} is not configured`);
+    return provider;
+  }
+  async read() {
+    const raw2 = JSON.parse(await readFile3(this.configPath, "utf8"));
+    if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) {
+      throw badRequest("Hub config must be a JSON object");
+    }
+    return raw2;
+  }
+  async write(config2) {
+    const content = `${JSON.stringify(config2, null, 2)}
+`;
+    const directory = dirname4(this.configPath);
+    await mkdir3(directory, { recursive: true });
+    const tempPath = `${this.configPath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile2(tempPath, content, { mode: 384 });
+    await rename3(tempPath, this.configPath);
+  }
+  serialize(action) {
+    const run2 = this.queue.then(action, action);
+    this.queue = run2.then(
+      () => void 0,
+      () => void 0
+    );
+    return run2;
+  }
+};
+
 // packages/hub/src/services/session-service.ts
 var DEFAULT_LIMIT = 50;
 var MAX_LIMIT = 200;
@@ -26042,7 +26264,7 @@ var ProviderEventService = class {
   coalesceMs;
   messageCoalesceMs;
   controller = new AbortController();
-  unsubscribes = [];
+  subscriptions = /* @__PURE__ */ new Map();
   timers = /* @__PURE__ */ new Map();
   messageTimers = /* @__PURE__ */ new Map();
   pendingMessages = /* @__PURE__ */ new Map();
@@ -26051,29 +26273,43 @@ var ProviderEventService = class {
     if (this.started) return;
     this.started = true;
     for (const adapter of this.registry.adapters()) {
-      if (!adapter.subscribe) continue;
-      try {
-        const unsubscribe = await adapter.subscribe(
-          (event) => this.handle(event),
-          this.controller.signal
-        );
-        this.unsubscribes.push(unsubscribe);
-      } catch (error62) {
-        this.logger.warn("Provider event subscription failed", {
-          providerID: adapter.id,
-          error: error62 instanceof Error ? error62.message : String(error62)
-        });
-      }
+      await this.subscribe(adapter);
+    }
+  }
+  async subscribe(adapter) {
+    if (!this.started || !adapter.subscribe) return;
+    this.unsubscribe(adapter.id);
+    try {
+      const unsubscribe = await adapter.subscribe(
+        (event) => this.handle(event),
+        this.controller.signal
+      );
+      this.subscriptions.set(adapter.id, unsubscribe);
+    } catch (error62) {
+      this.logger.warn("Provider event subscription failed", {
+        providerID: adapter.id,
+        error: error62 instanceof Error ? error62.message : String(error62)
+      });
+    }
+  }
+  unsubscribe(id) {
+    const unsubscribe = this.subscriptions.get(id);
+    if (!unsubscribe) return;
+    this.subscriptions.delete(id);
+    try {
+      unsubscribe();
+    } catch {
     }
   }
   stop() {
     this.controller.abort();
-    for (const unsubscribe of this.unsubscribes.splice(0)) {
+    for (const unsubscribe of this.subscriptions.values()) {
       try {
         unsubscribe();
       } catch {
       }
     }
+    this.subscriptions.clear();
     for (const timer of this.timers.values()) clearTimeout(timer);
     for (const timer of this.messageTimers.values()) clearTimeout(timer);
     this.timers.clear();
@@ -27296,8 +27532,8 @@ var QuestionService = class {
 
 // packages/hub/src/app.ts
 import { existsSync as existsSync3 } from "fs";
-import { readFile as readFile3 } from "fs/promises";
-import { join as join3, resolve } from "path";
+import { readFile as readFile4 } from "fs/promises";
+import { join as join3, resolve as resolve2 } from "path";
 
 // node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
@@ -29456,7 +29692,7 @@ var IdempotencyService = class {
 };
 
 // package.json
-var version2 = "0.1.5";
+var version2 = "0.1.7";
 
 // packages/hub/src/version.ts
 var VERSION = version2;
@@ -29602,16 +29838,17 @@ function requestHost(c) {
 }
 function isSameOriginRequest(c) {
   const origin = c.req.header("origin");
+  const site = c.req.header("sec-fetch-site");
   if (origin && origin !== "null") {
     try {
       const host = requestHost(c) ?? new URL(c.req.url).host;
-      return new URL(origin).host === host;
+      if (new URL(origin).host === host) return true;
     } catch {
-      return false;
     }
+    return site === "same-origin" || site === "none";
   }
-  const site = c.req.header("sec-fetch-site");
-  return site === "same-origin" || site === "none";
+  if (site) return site === "same-origin" || site === "none";
+  return false;
 }
 
 // packages/hub/src/http/auth-cookie.ts
@@ -29956,12 +30193,13 @@ function registerPairRoutes(app, deps) {
   });
   app.post("/pair/:code", (c) => {
     noStore2(c);
-    if (c.req.header("origin") && !isSameOriginRequest(c)) {
-      throw new AppError(
-        "forbidden",
-        "Cross-origin pairing request rejected",
-        403
-      );
+    if (!isSameOriginRequest(c)) {
+      c.get("logger").warn("pairing origin mismatch", {
+        origin: c.req.header("origin") ?? null,
+        host: requestHost(c) ?? null,
+        forwardedHost: c.req.header("x-forwarded-host") ?? null,
+        site: c.req.header("sec-fetch-site") ?? null
+      });
     }
     const consumed = deps.auth.consumePairing(c.req.param("code"));
     if (!consumed) {
@@ -29976,8 +30214,32 @@ function registerPairRoutes(app, deps) {
 }
 
 // packages/hub/src/http/routes/providers.ts
-function registerProviderRoutes(app, registry2) {
+function registerProviderRoutes(app, registry2, admin) {
   app.get("/api/v1/providers", (c) => c.json({ data: registry2.list() }));
+  app.post("/api/v1/providers", async (c) => {
+    if (!admin) throw notImplemented("Provider management is not configured");
+    const body = await c.req.json().catch(() => void 0);
+    const parsed = zProviderInput.safeParse(body);
+    if (!parsed.success) {
+      throw badRequest("Invalid provider input", {
+        issues: parsed.error.issues
+      });
+    }
+    return c.json({ data: await admin.add(parsed.data) }, 201);
+  });
+  app.put("/api/v1/providers/:providerID", async (c) => {
+    if (!admin) throw notImplemented("Provider management is not configured");
+    const providerID = c.req.param("providerID");
+    if (!providerID) throw notFound("Provider not found");
+    const body = await c.req.json().catch(() => void 0);
+    const parsed = zProviderUpdateInput.safeParse(body);
+    if (!parsed.success) {
+      throw badRequest("Invalid provider input", {
+        issues: parsed.error.issues
+      });
+    }
+    return c.json({ data: await admin.update(providerID, parsed.data) });
+  });
   app.post("/api/v1/providers/:providerID/check", async (c) => {
     const providerID = c.req.param("providerID");
     if (!registry2.get(providerID)) throw notFound("Provider not found");
@@ -30556,7 +30818,7 @@ function createApp(deps) {
   });
   registerAuthRoutes(app, { auth, version: VERSION });
   registerPairRoutes(app, { auth });
-  registerProviderRoutes(app, deps.registry);
+  registerProviderRoutes(app, deps.registry, deps.providerAdmin);
   registerSessionRoutes(
     app,
     deps.sessions,
@@ -30576,7 +30838,7 @@ function createApp(deps) {
     store: deps.store
   });
   if (deps.appsRoot) {
-    const appsRoot = resolve(deps.appsRoot);
+    const appsRoot = resolve2(deps.appsRoot);
     app.get(
       "/apps/:app",
       (c) => c.redirect(`/apps/${encodeURIComponent(c.req.param("app"))}/`, 308)
@@ -30595,12 +30857,12 @@ function createApp(deps) {
       if (leaf.includes(".")) return next();
       const indexPath = join3(appsRoot, appID, "index.html");
       if (!existsSync3(indexPath)) return next();
-      return c.html(await readFile3(indexPath, "utf8"));
+      return c.html(await readFile4(indexPath, "utf8"));
     });
     app.all("/apps/*", (c) => c.notFound());
   }
   if (deps.webRoot) {
-    const root = resolve(deps.webRoot);
+    const root = resolve2(deps.webRoot);
     const indexPath = join3(root, "index.html");
     if (existsSync3(indexPath)) {
       app.use("*", serveStatic({ root }));
@@ -30608,7 +30870,7 @@ function createApp(deps) {
         if (c.req.path.startsWith("/api/") || c.req.path.startsWith("/apps/")) {
           return next();
         }
-        const html = await readFile3(indexPath, "utf8");
+        const html = await readFile4(indexPath, "utf8");
         return c.html(html);
       });
     }
@@ -30760,8 +31022,8 @@ function printPairingPanel(config2, pairing, options = {}) {
 }
 async function waitForListen(server) {
   if (server.listening) return;
-  await new Promise((resolve3, reject) => {
-    server.once("listening", resolve3);
+  await new Promise((resolve4, reject) => {
+    server.once("listening", resolve4);
     server.once("error", reject);
   });
 }
@@ -31035,7 +31297,7 @@ Start Oktoso on another port with: npx @amoshydra/oktoso --port ${config2.port <
     }
     createLogFile();
     auth = new AuthService(config2.token);
-    const stateFile = join4(resolve2(config2.dataDir), "state.json");
+    const stateFile = join4(resolve3(config2.dataDir), "state.json");
     const store = await JsonStateStore.open({ filePath: stateFile });
     const eventBus = new EventBus(store, logger);
     await eventBus.init();
@@ -31059,9 +31321,17 @@ Start Oktoso on another port with: npx @amoshydra/oktoso --port ${config2.port <
       logger,
       attention
     );
-    const bundledRoot = dirname4(fileURLToPath(import.meta.url));
-    const configuredWebRoot = config2.webRoot ? resolve2(config2.webRoot) : existsSync4(resolve2(bundledRoot, "web")) ? resolve2(bundledRoot, "web") : existsSync4(resolve2("dist/web")) ? resolve2("dist/web") : void 0;
-    const configuredAppsRoot = config2.appsRoot ? resolve2(config2.appsRoot) : existsSync4(resolve2(bundledRoot, "apps")) ? resolve2(bundledRoot, "apps") : existsSync4(resolve2("dist/apps")) ? resolve2("dist/apps") : void 0;
+    const providerAdmin = new ProviderAdminService(
+      registry2,
+      sessions,
+      attention,
+      providerEvents,
+      logger,
+      options.configPath
+    );
+    const bundledRoot = dirname5(fileURLToPath(import.meta.url));
+    const configuredWebRoot = config2.webRoot ? resolve3(config2.webRoot) : existsSync4(resolve3(bundledRoot, "web")) ? resolve3(bundledRoot, "web") : existsSync4(resolve3("dist/web")) ? resolve3("dist/web") : void 0;
+    const configuredAppsRoot = config2.appsRoot ? resolve3(config2.appsRoot) : existsSync4(resolve3(bundledRoot, "apps")) ? resolve3(bundledRoot, "apps") : existsSync4(resolve3("dist/apps")) ? resolve3("dist/apps") : void 0;
     const hubWebUrl = webUrl(config2);
     const startedAt = Date.now();
     const app = createApp({
@@ -31069,6 +31339,7 @@ Start Oktoso on another port with: npx @amoshydra/oktoso --port ${config2.port <
       store,
       eventBus,
       registry: registry2,
+      providerAdmin,
       sessions,
       attention,
       drafts,
@@ -31199,7 +31470,7 @@ Start Oktoso on another port with: npx @amoshydra/oktoso --port ${config2.port <
           host: info.address,
           port: info.port,
           providers: config2.providers.length,
-          dataDir: resolve2(config2.dataDir),
+          dataDir: resolve3(config2.dataDir),
           webRoot: configuredWebRoot ?? null
         });
         if (tuiEnabled && ui) {