@chimerai/cli 0.2.73

package/dist/templates/provider-routes.js

@@ -0,0 +1,1203 @@
+"use strict";
+/**
+ * Provider Route Templates
+ *
+ * Generates the complete Provider API infrastructure:
+ * - CRUD routes (/api/providers)
+ * - Single provider routes (/api/providers/[id])
+ * - Provider test route (/api/providers/[id]/test)
+ * - Internal API routes (/api/internal/providers/*)
+ * - Notify-provider-change utility
+ *
+ * These are CORE infrastructure — always generated, not feature-conditional.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateProviderCrudRoute = generateProviderCrudRoute;
+exports.generateProviderIdRoute = generateProviderIdRoute;
+exports.generateProviderTestRoute = generateProviderTestRoute;
+exports.generateProviderSyncRoute = generateProviderSyncRoute;
+exports.generateInternalProvidersRoute = generateInternalProvidersRoute;
+exports.generateInternalProviderIdRoute = generateInternalProviderIdRoute;
+exports.generateInternalProviderUsageRoute = generateInternalProviderUsageRoute;
+exports.generateNotifyProviderChangeLib = generateNotifyProviderChangeLib;
+// ─────────────────────────────────────────────────────────
+// Provider CRUD Route — /api/providers/route.ts
+// ─────────────────────────────────────────────────────────
+function generateProviderCrudRoute() {
+    return `// @chimerai component=ProviderCrudRoute version=1.0
+/**
+ * Provider CRUD API Route
+ * GET  /api/providers — List all providers
+ * POST /api/providers — Create new provider
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { prisma } from '@/lib/prisma';
+import { encrypt } from '@/lib/encryption';
+import { notifyProviderChange } from '@/lib/notify-provider-change';
+import { logAuditAction } from '@/lib/audit';
+
+/** SQLite stores Json/String[] as plain String — serialize/deserialize at runtime */
+const _isSqlite = (process.env.DATABASE_URL || '').startsWith('file:');
+function _toDb(v: any): any { return _isSqlite && v != null && typeof v !== 'string' ? JSON.stringify(v) : v; }
+function _fromDb(v: any): any { if (!_isSqlite || typeof v !== 'string') return v; try { return JSON.parse(v); } catch { return v; } }
+
+/** Provider types that work without an API key (e.g. local services) */
+const KEYLESS_PROVIDERS = ['ollama'];
+
+function getDefaultBaseUrl(type: string): string | null {
+  switch (type) {
+    case 'openai':    return 'https://api.openai.com/v1';
+    case 'anthropic': return 'https://api.anthropic.com/v1';
+    case 'ollama':    return 'http://localhost:11434';
+    case 'groq':      return 'https://api.groq.com/openai/v1';
+    case 'google':    return 'https://generativelanguage.googleapis.com/v1beta';
+    default:          return null;
+  }
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const { searchParams } = new URL(request.url);
+    const type = searchParams.get('type');
+    const status = searchParams.get('status');
+
+    const providers = await prisma.provider.findMany({
+      where: {
+        ...(type && { type }),
+        ...(status && { status }),
+      },
+      include: {
+        models: {
+          where: { isAvailable: true, isDeprecated: false },
+          select: {
+            id: true,
+            modelId: true,
+            name: true,
+            capabilities: true,
+            contextWindow: true,
+            inputCost: true,
+            outputCost: true,
+          },
+        },
+        health: true,
+      },
+      orderBy: [{ isDefault: 'desc' }, { priority: 'asc' }, { name: 'asc' }],
+    });
+
+    // Don't expose encrypted API keys in list view
+    // Deserialize JSON-string fields (SQLite stores Json/String[] as plain String)
+    const sanitized = providers.map((p: any) => ({
+      ...p,
+      apiKey: p.apiKey ? '***encrypted***' : null,
+      config: _fromDb(p.config),
+      tags: _fromDb(p.tags),
+      models: p.models?.map((m: any) => ({ ...m, capabilities: _fromDb(m.capabilities) })),
+    }));
+
+    return NextResponse.json(sanitized);
+  } catch (error: any) {
+    console.error('Error fetching providers:', error);
+    return NextResponse.json(
+      { error: 'Failed to fetch providers', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+
+    // Validate API key based on provider type
+    const requiresKey = !KEYLESS_PROVIDERS.includes(body.type);
+    if (requiresKey && !body.config?.apiKey) {
+      return NextResponse.json(
+        { error: 'API key is required for this provider type' },
+        { status: 400 }
+      );
+    }
+
+    // Key verschluesseln wenn vorhanden, sonst null (nicht leerer String!)
+    const encryptedKey = body.config?.apiKey ? encrypt(body.config.apiKey) : null;
+
+    // Resolve baseUrl
+    const resolvedBaseUrl = body.config?.baseUrl || getDefaultBaseUrl(body.type);
+
+    // If setting as default, unset other defaults of same type
+    if (body.isDefault) {
+      await prisma.provider.updateMany({
+        where: { type: body.type, isDefault: true },
+        data: { isDefault: false },
+      });
+    }
+
+    const provider = await prisma.provider.create({
+      data: {
+        name: body.name,
+        type: body.type,
+        description: body.description,
+        baseUrl: resolvedBaseUrl,
+        apiKey: encryptedKey,
+        config: _toDb({ ...body.config, apiKey: undefined }),
+        status: 'active',
+        isDefault: body.isDefault || false,
+        priority: body.priority || 0,
+        tags: _toDb(body.tags || []),
+        createdBy: session.user.id,
+      },
+      include: { models: true, health: true },
+    });
+
+    // Notify AI service to invalidate cache
+    notifyProviderChange().catch(() => {});
+
+    // Audit log
+    await logAuditAction({
+      action: 'provider.create',
+      userId: session.user.id,
+      targetType: 'provider',
+      targetId: provider.id,
+      metadata: { name: provider.name, type: provider.type },
+    });
+
+    return NextResponse.json(
+      { ...provider, apiKey: '***encrypted***' },
+      { status: 201 }
+    );
+  } catch (error: any) {
+    console.error('Error creating provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to create provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Provider [id] Route — /api/providers/[id]/route.ts
+// ─────────────────────────────────────────────────────────
+function generateProviderIdRoute() {
+    return `// @chimerai component=ProviderIdRoute version=1.0
+/**
+ * Single Provider API Route
+ * GET    /api/providers/[id] — Get provider details
+ * PUT    /api/providers/[id] — Full update
+ * PATCH  /api/providers/[id] — Partial update
+ * DELETE /api/providers/[id] — Delete provider
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { prisma } from '@/lib/prisma';
+import { encrypt } from '@/lib/encryption';
+import { notifyProviderChange } from '@/lib/notify-provider-change';
+import { logAuditAction } from '@/lib/audit';
+
+/** SQLite stores Json/String[] as plain String — serialize/deserialize at runtime */
+const _isSqlite = (process.env.DATABASE_URL || '').startsWith('file:');
+function _toDb(v: any): any { return _isSqlite && v != null && typeof v !== 'string' ? JSON.stringify(v) : v; }
+function _fromDb(v: any): any { if (!_isSqlite || typeof v !== 'string') return v; try { return JSON.parse(v); } catch { return v; } }
+
+function getDefaultBaseUrl(type: string): string | null {
+  switch (type) {
+    case 'openai':    return 'https://api.openai.com/v1';
+    case 'anthropic': return 'https://api.anthropic.com/v1';
+    case 'ollama':    return 'http://localhost:11434';
+    case 'groq':      return 'https://api.groq.com/openai/v1';
+    case 'google':    return 'https://generativelanguage.googleapis.com/v1beta';
+    default:          return null;
+  }
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const provider = await prisma.provider.findUnique({
+      where: { id: id },
+      include: {
+        models: { orderBy: { name: 'asc' } },
+        health: true,
+      },
+    });
+
+    if (!provider) {
+      return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({
+      ...provider,
+      apiKey: provider.apiKey ? provider.apiKey.substring(0, 8) + '...' : null,
+      config: _fromDb(provider.config),
+      tags: _fromDb(provider.tags),
+      models: provider.models?.map((m: any) => ({ ...m, capabilities: _fromDb(m.capabilities) })),
+    });
+  } catch (error: any) {
+    console.error('Error fetching provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to fetch provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+
+    // If setting as default, unset other defaults
+    if (body.isDefault) {
+      const existing = await prisma.provider.findUnique({ where: { id: id } });
+      if (existing) {
+        await prisma.provider.updateMany({
+          where: { type: existing.type, isDefault: true, NOT: { id: id } },
+          data: { isDefault: false },
+        });
+      }
+    }
+
+    // Handle API key update
+    const updateData: any = { ...body };
+    if (body.config?.apiKey) {
+      updateData.apiKey = encrypt(body.config.apiKey);
+      updateData.config = _toDb({ ...body.config, apiKey: undefined });
+    } else if (body.config) {
+      updateData.config = _toDb({ ...body.config, apiKey: undefined });
+    }
+    if ('tags' in body) updateData.tags = _toDb(body.tags);
+
+    const provider = await prisma.provider.update({
+      where: { id: id },
+      data: updateData,
+      include: { models: true, health: true },
+    });
+
+    notifyProviderChange().catch(() => {});
+
+    // Audit log
+    await logAuditAction({
+      action: 'provider.update',
+      userId: session.user.id,
+      targetType: 'provider',
+      targetId: id,
+      metadata: { name: provider.name, type: provider.type },
+    });
+
+    return NextResponse.json({ ...provider, apiKey: '***encrypted***' });
+  } catch (error: any) {
+    console.error('Error updating provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to update provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+    const updateData: any = {};
+
+    // Handle simple field updates
+    if ('status' in body) updateData.status = body.status;
+    if ('isDefault' in body) updateData.isDefault = body.isDefault;
+    if ('priority' in body) updateData.priority = body.priority;
+    if ('tags' in body) updateData.tags = _toDb(body.tags);
+    if ('name' in body) updateData.name = body.name;
+    if ('type' in body) updateData.type = body.type;
+    if ('description' in body) updateData.description = body.description;
+
+    // Handle baseUrl
+    if ('baseUrl' in body) {
+      updateData.baseUrl = body.baseUrl;
+    } else if (body.config?.baseUrl !== undefined) {
+      updateData.baseUrl = body.config.baseUrl || getDefaultBaseUrl(body.type || '');
+    }
+
+    // Handle API key update (encrypted)
+    if (body.config?.apiKey) {
+      updateData.apiKey = encrypt(body.config.apiKey);
+    }
+
+    if (body.config) {
+      updateData.config = _toDb({ ...body.config, apiKey: undefined });
+    }
+
+    // If setting as default, unset other defaults
+    if (body.isDefault) {
+      const existing = await prisma.provider.findUnique({ where: { id: id } });
+      if (existing) {
+        await prisma.provider.updateMany({
+          where: { type: existing.type, isDefault: true, NOT: { id: id } },
+          data: { isDefault: false },
+        });
+      }
+    }
+
+    const provider = await prisma.provider.update({
+      where: { id: id },
+      data: updateData,
+      include: { models: true, health: true },
+    });
+
+    notifyProviderChange().catch(() => {});
+
+    // Audit log
+    await logAuditAction({
+      action: 'provider.update',
+      userId: session.user.id,
+      targetType: 'provider',
+      targetId: id,
+      metadata: { name: provider.name, type: provider.type },
+    });
+
+    return NextResponse.json({
+      ...provider,
+      apiKey: provider.apiKey ? '***encrypted***' : null,
+    });
+  } catch (error: any) {
+    console.error('Error patching provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to update provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    await prisma.provider.delete({ where: { id: id } });
+    notifyProviderChange().catch(() => {});
+
+    // Audit log
+    await logAuditAction({
+      action: 'provider.delete',
+      userId: session.user.id,
+      targetType: 'provider',
+      targetId: id,
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error: any) {
+    console.error('Error deleting provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to delete provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Provider Test Route — /api/providers/[id]/test/route.ts
+// ─────────────────────────────────────────────────────────
+function generateProviderTestRoute() {
+    return `// @chimerai component=ProviderTestRoute version=1.0
+/**
+ * Provider Test API Route
+ * POST /api/providers/[id]/test — Test provider connection
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { prisma } from '@/lib/prisma';
+import { decrypt } from '@/lib/encryption';
+
+/** Provider types that work without an API key (e.g. local services) */
+const KEYLESS_PROVIDERS = ['ollama'];
+
+function getDefaultBaseUrl(type: string): string {
+  switch (type) {
+    case 'openai':    return 'https://api.openai.com/v1';
+    case 'anthropic': return 'https://api.anthropic.com/v1';
+    case 'ollama':    return 'http://localhost:11434';
+    case 'groq':      return 'https://api.groq.com/openai/v1';
+    case 'google':    return 'https://generativelanguage.googleapis.com/v1beta';
+    default:          return 'https://api.openai.com/v1';
+  }
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const provider = await prisma.provider.findUnique({
+      where: { id: id },
+    });
+
+    if (!provider) {
+      return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
+    }
+
+    const baseUrl = provider.baseUrl || getDefaultBaseUrl(provider.type);
+    const startTime = Date.now();
+    let result: any = { success: false, responseTime: 0, details: {} };
+
+    // Decrypt API key — keyless providers (e.g. Ollama) skip this
+    const requiresKey = !KEYLESS_PROVIDERS.includes(provider.type);
+    let apiKey: string | null = null;
+
+    if (provider.apiKey) {
+      try {
+        apiKey = decrypt(provider.apiKey);
+      } catch (decryptError: any) {
+        return NextResponse.json({
+          success: false,
+          responseTime: 0,
+          errorMessage: 'Failed to decrypt API key. Please re-enter the API key for this provider.',
+          details: {},
+        }, { status: 500 });
+      }
+    }
+
+    if (requiresKey && !apiKey) {
+      return NextResponse.json({
+        success: false,
+        responseTime: 0,
+        errorMessage: 'No API key configured. Please edit the provider and add an API key.',
+        details: {},
+      }, { status: 400 });
+    }
+
+    // At this point apiKey is either a valid string or null (for keyless providers)
+    const resolvedKey = apiKey ?? '';
+
+    try {
+
+      switch (provider.type) {
+        case 'openai': {
+          const resp = await fetch(\`\${baseUrl}/models\`, {
+            headers: { Authorization: \`Bearer \${resolvedKey}\` },
+            signal: AbortSignal.timeout(10000),
+          });
+          const responseTime = Date.now() - startTime;
+          if (resp.ok) {
+            const data = await resp.json();
+            result = { success: true, responseTime, details: { chatTest: true, modelsFound: data.data?.length || 0 } };
+          } else {
+            throw new Error(\`API returned \${resp.status}: \${resp.statusText}\`);
+          }
+          break;
+        }
+
+        case 'anthropic': {
+          const resp = await fetch(\`\${baseUrl}/messages\`, {
+            method: 'POST',
+            headers: {
+              'x-api-key': resolvedKey,
+              'anthropic-version': '2023-06-01',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              model: 'claude-3-haiku-20240307',
+              max_tokens: 10,
+              messages: [{ role: 'user', content: 'Hi' }],
+            }),
+            signal: AbortSignal.timeout(10000),
+          });
+          const responseTime = Date.now() - startTime;
+          if (resp.ok) {
+            result = { success: true, responseTime, details: { chatTest: true } };
+          } else {
+            throw new Error(\`API returned \${resp.status}: \${resp.statusText}\`);
+          }
+          break;
+        }
+
+        case 'ollama': {
+          const resp = await fetch(\`\${baseUrl}/api/tags\`, {
+            signal: AbortSignal.timeout(10000),
+          });
+          const responseTime = Date.now() - startTime;
+          if (resp.ok) {
+            const data = await resp.json();
+            result = { success: true, responseTime, details: { chatTest: true, modelsFound: data.models?.length || 0 } };
+          } else {
+            throw new Error(\`API returned \${resp.status}: \${resp.statusText}\`);
+          }
+          break;
+        }
+
+        default: {
+          const resp = await fetch(\`\${baseUrl}/models\`, {
+            headers: { Authorization: \`Bearer \${resolvedKey}\` },
+            signal: AbortSignal.timeout(10000),
+          });
+          const responseTime = Date.now() - startTime;
+          result = { success: resp.ok, responseTime, details: { chatTest: resp.ok } };
+          if (!resp.ok) throw new Error(\`API returned \${resp.status}: \${resp.statusText}\`);
+        }
+      }
+
+      // Update status + health
+      await prisma.provider.update({
+        where: { id: id },
+        data: { status: 'active' },
+      });
+
+      await prisma.providerHealth.upsert({
+        where: { providerId: id },
+        create: {
+          providerId: id, status: 'healthy',
+          responseTime: result.responseTime, lastCheck: new Date(),
+          modelsAvailable: result.details.modelsFound || 0,
+          chatAvailable: result.details.chatTest || false,
+          apiKeyValid: true,
+        },
+        update: {
+          status: 'healthy', responseTime: result.responseTime,
+          lastCheck: new Date(), modelsAvailable: result.details.modelsFound || 0,
+          chatAvailable: result.details.chatTest || false,
+          apiKeyValid: true, errorMessage: null,
+        },
+      });
+
+      return NextResponse.json(result);
+    } catch (error: any) {
+      const responseTime = Date.now() - startTime;
+      result = { success: false, responseTime, errorMessage: error.message, details: {} };
+
+      await prisma.provider.update({
+        where: { id: id },
+        data: { status: 'error' },
+      });
+
+      await prisma.providerHealth.upsert({
+        where: { providerId: id },
+        create: {
+          providerId: id, status: 'unhealthy', responseTime,
+          lastCheck: new Date(), errorMessage: error.message,
+          modelsAvailable: 0, chatAvailable: false, apiKeyValid: false,
+        },
+        update: {
+          status: 'unhealthy', responseTime, lastCheck: new Date(),
+          errorMessage: error.message, chatAvailable: false, apiKeyValid: false,
+        },
+      });
+
+      return NextResponse.json(result, { status: 500 });
+    }
+  } catch (error: any) {
+    console.error('Error testing provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to test provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Provider Sync Route — /api/providers/[id]/sync/route.ts
+// Fetches models from the provider API and upserts them into the DB
+// ─────────────────────────────────────────────────────────
+function generateProviderSyncRoute() {
+    return `// @chimerai component=ProviderSyncRoute version=1.0
+/**
+ * Provider Sync API Route
+ * POST /api/providers/[id]/sync — Fetch models from provider API and save to DB
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { prisma } from '@/lib/prisma';
+import { decrypt } from '@/lib/encryption';
+
+/** SQLite stores Json/String[] as plain String — serialize at runtime */
+const _isSqlite = (process.env.DATABASE_URL || '').startsWith('file:');
+function _toDb(v: any): any { return _isSqlite && v != null && typeof v !== 'string' ? JSON.stringify(v) : v; }
+
+const KEYLESS_PROVIDERS = ['ollama'];
+
+function getDefaultBaseUrl(type: string): string {
+  switch (type) {
+    case 'openai':    return 'https://api.openai.com/v1';
+    case 'anthropic': return 'https://api.anthropic.com/v1';
+    case 'ollama':    return 'http://localhost:11434';
+    case 'groq':      return 'https://api.groq.com/openai/v1';
+    case 'google':    return 'https://generativelanguage.googleapis.com/v1beta';
+    default:          return 'https://api.openai.com/v1';
+  }
+}
+
+/** Well-known model metadata for cost/context enrichment */
+const MODEL_METADATA: Record<string, { contextWindow?: number; inputCost?: number; outputCost?: number; capabilities?: string[] }> = {
+  'gpt-4o':                    { contextWindow: 128000, inputCost: 2.5, outputCost: 10, capabilities: ['chat', 'vision'] },
+  'gpt-4o-mini':               { contextWindow: 128000, inputCost: 0.15, outputCost: 0.6, capabilities: ['chat'] },
+  'gpt-4-turbo':               { contextWindow: 128000, inputCost: 10, outputCost: 30, capabilities: ['chat', 'vision'] },
+  'gpt-4':                     { contextWindow: 8192, inputCost: 30, outputCost: 60, capabilities: ['chat'] },
+  'gpt-3.5-turbo':             { contextWindow: 16385, inputCost: 0.5, outputCost: 1.5, capabilities: ['chat'] },
+  'o1':                        { contextWindow: 200000, inputCost: 15, outputCost: 60, capabilities: ['chat'] },
+  'o1-mini':                   { contextWindow: 128000, inputCost: 3, outputCost: 12, capabilities: ['chat'] },
+  'o3-mini':                   { contextWindow: 200000, inputCost: 1.1, outputCost: 4.4, capabilities: ['chat'] },
+  'text-embedding-3-small':    { contextWindow: 8191, inputCost: 0.02, outputCost: 0, capabilities: ['embedding'] },
+  'text-embedding-3-large':    { contextWindow: 8191, inputCost: 0.13, outputCost: 0, capabilities: ['embedding'] },
+  'claude-sonnet-4-20250514':  { contextWindow: 200000, inputCost: 3, outputCost: 15, capabilities: ['chat', 'vision'] },
+  'claude-3-5-sonnet-20241022':{ contextWindow: 200000, inputCost: 3, outputCost: 15, capabilities: ['chat', 'vision'] },
+  'claude-3-haiku-20240307':   { contextWindow: 200000, inputCost: 0.25, outputCost: 1.25, capabilities: ['chat'] },
+  'claude-3-opus-20240229':    { contextWindow: 200000, inputCost: 15, outputCost: 75, capabilities: ['chat', 'vision'] },
+};
+
+/** Filter: only keep models useful for chat/embedding */
+function isUsefulModel(modelId: string, providerType: string): boolean {
+  if (providerType === 'ollama') return true;
+  if (providerType === 'anthropic') return true;
+  if (providerType === 'openai' || providerType === 'groq') {
+    if (modelId.startsWith('ft:')) return false;
+    if (/^(whisper|tts|dall-e|babbage|davinci|canary)/.test(modelId)) return false;
+    return /^(gpt-|o1|o3|o4|text-embedding|chatgpt)/.test(modelId);
+  }
+  return true;
+}
+
+function humanName(modelId: string): string {
+  return modelId
+    .replace(/-/g, ' ')
+    .replace(/\\b\\w/g, (c: string) => c.toUpperCase())
+    .replace(/Gpt /g, 'GPT ')
+    .replace(/^O1/g, 'O1')
+    .replace(/^O3/g, 'O3');
+}
+
+async function fetchOpenAIModels(baseUrl: string, apiKey: string) {
+  const resp = await fetch(baseUrl + '/models', {
+    headers: { Authorization: 'Bearer ' + apiKey },
+    signal: AbortSignal.timeout(15000),
+  });
+  if (!resp.ok) throw new Error('OpenAI API returned ' + resp.status);
+  const data = await resp.json();
+  return (data.data || []).map((m: any) => ({ modelId: m.id, name: humanName(m.id) }));
+}
+
+async function fetchAnthropicModels() {
+  // Anthropic has no /models endpoint — return well-known models
+  return [
+    { modelId: 'claude-sonnet-4-20250514', name: 'Claude Sonnet 4' },
+    { modelId: 'claude-3-5-sonnet-20241022', name: 'Claude 3.5 Sonnet' },
+    { modelId: 'claude-3-haiku-20240307', name: 'Claude 3 Haiku' },
+    { modelId: 'claude-3-opus-20240229', name: 'Claude 3 Opus' },
+  ];
+}
+
+async function fetchOllamaModels(baseUrl: string) {
+  const resp = await fetch(baseUrl + '/api/tags', { signal: AbortSignal.timeout(10000) });
+  if (!resp.ok) throw new Error('Ollama API returned ' + resp.status);
+  const data = await resp.json();
+  return (data.models || []).map((m: any) => ({
+    modelId: m.name || m.model,
+    name: (m.name || m.model).replace(/:latest$/, ''),
+  }));
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  try {
+    const session = await getServerSession(authOptions);
+    if (!session?.user) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const provider = await prisma.provider.findUnique({ where: { id: id } });
+    if (!provider) {
+      return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
+    }
+
+    const baseUrl = provider.baseUrl || getDefaultBaseUrl(provider.type);
+    const requiresKey = !KEYLESS_PROVIDERS.includes(provider.type);
+
+    let apiKey: string | null = null;
+    if (provider.apiKey) {
+      try { apiKey = decrypt(provider.apiKey); } catch {
+        return NextResponse.json({ error: 'Failed to decrypt API key' }, { status: 500 });
+      }
+    }
+    if (requiresKey && !apiKey) {
+      return NextResponse.json({ error: 'No API key configured' }, { status: 400 });
+    }
+
+    // Fetch models from provider API
+    let rawModels: { modelId: string; name: string }[] = [];
+    switch (provider.type) {
+      case 'openai':
+      case 'groq':
+        rawModels = await fetchOpenAIModels(baseUrl, apiKey || '');
+        break;
+      case 'anthropic':
+        rawModels = await fetchAnthropicModels();
+        break;
+      case 'ollama':
+        rawModels = await fetchOllamaModels(baseUrl);
+        break;
+      default:
+        try { rawModels = await fetchOpenAIModels(baseUrl, apiKey || ''); } catch { rawModels = []; }
+    }
+
+    // Filter useful models
+    const models = rawModels.filter(m => isUsefulModel(m.modelId, provider.type));
+
+    // Upsert models into DB
+    let created = 0;
+    let updated = 0;
+    for (const m of models) {
+      const meta = MODEL_METADATA[m.modelId] || {};
+      const capabilities = meta.capabilities || ['chat'];
+      const existing = await (prisma as any).model.findFirst({
+        where: { providerId: provider.id, modelId: m.modelId },
+      });
+      if (existing) {
+        await (prisma as any).model.update({
+          where: { id: existing.id },
+          data: { name: m.name, isAvailable: true, isDeprecated: false },
+        });
+        updated++;
+      } else {
+        await (prisma as any).model.create({
+          data: {
+            providerId: provider.id,
+            modelId: m.modelId,
+            name: m.name,
+            capabilities: _toDb(capabilities),
+            contextWindow: meta.contextWindow || 4096,
+            inputCost: meta.inputCost || 0,
+            outputCost: meta.outputCost || 0,
+            isAvailable: true,
+          },
+        });
+        created++;
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      synced: models.length,
+      created,
+      updated,
+      models: models.map(m => m.modelId),
+    });
+  } catch (error: any) {
+    console.error('Error syncing models:', error);
+    return NextResponse.json(
+      { error: 'Failed to sync models', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Internal Providers Route — /api/internal/providers/route.ts
+// ─────────────────────────────────────────────────────────
+function generateInternalProvidersRoute() {
+    return `// @chimerai component=InternalProvidersRoute version=1.0
+/**
+ * Internal Provider API — List all active providers
+ * GET /api/internal/providers
+ *
+ * Used by the Python AI Service to fetch provider configs + decrypted API keys.
+ * Protected by INTERNAL_API_TOKEN (Bearer token).
+ *
+ * WARNING: Returns DECRYPTED API keys — never expose externally!
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { prisma } from '@/lib/prisma';
+import { decrypt } from '@/lib/encryption';
+
+/** SQLite stores Json/String[] as plain String — deserialize at runtime */
+const _isSqlite = (process.env.DATABASE_URL || '').startsWith('file:');
+function _fromDb(v: any): any { if (!_isSqlite || typeof v !== 'string') return v; try { return JSON.parse(v); } catch { return v; } }
+
+function validateInternalToken(request: NextRequest): boolean {
+  const authHeader = request.headers.get('authorization') || '';
+  const token = authHeader.replace(/^Bearer\\s+/i, '');
+  const expected = process.env.INTERNAL_API_TOKEN;
+
+  if (!expected || expected.length < 32) {
+    console.error('INTERNAL_API_TOKEN is not configured or too short');
+    return false;
+  }
+
+  return token === expected;
+}
+
+export async function GET(request: NextRequest) {
+  if (!validateInternalToken(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const type = searchParams.get('type');
+    const status = searchParams.get('status') || 'active';
+
+    const providers = await prisma.provider.findMany({
+      where: {
+        ...(status && { status }),
+        ...(type && { type }),
+      },
+      include: {
+        models: {
+          where: { isAvailable: true, isDeprecated: false },
+          select: {
+            id: true, modelId: true, name: true,
+            capabilities: true, contextWindow: true,
+            inputCost: true, outputCost: true,
+          },
+        },
+      },
+      orderBy: [{ isDefault: 'desc' }, { priority: 'asc' }],
+    });
+
+    const result = providers.map((p: any) => {
+      let apiKey: string | null = null;
+      try {
+        if (p.apiKey) apiKey = decrypt(p.apiKey);
+      } catch {
+        console.warn(\`Failed to decrypt API key for provider \${p.id}\`);
+      }
+
+      return {
+        id: p.id,
+        name: p.name,
+        type: p.type,
+        base_url: p.baseUrl,
+        api_key: apiKey,
+        config: _fromDb(p.config),
+        status: p.status,
+        is_default: p.isDefault,
+        priority: p.priority,
+        models: p.models.map((m: any) => ({
+          id: m.id,
+          model_id: m.modelId,
+          name: m.name,
+          capabilities: _fromDb(m.capabilities),
+          context_window: m.contextWindow,
+          input_cost: m.inputCost,
+          output_cost: m.outputCost,
+        })),
+      };
+    });
+
+    return NextResponse.json({ providers: result });
+  } catch (error: any) {
+    console.error('Error fetching internal providers:', error);
+    return NextResponse.json(
+      { error: 'Failed to fetch providers', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Internal Provider [id] Route — /api/internal/providers/[id]/route.ts
+// ─────────────────────────────────────────────────────────
+function generateInternalProviderIdRoute() {
+    return `// @chimerai component=InternalProviderIdRoute version=1.0
+/**
+ * Internal Provider API — Get single provider by ID
+ * GET /api/internal/providers/[id]
+ *
+ * Returns full provider details with DECRYPTED API key.
+ * Protected by INTERNAL_API_TOKEN (Bearer token).
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { prisma } from '@/lib/prisma';
+import { decrypt } from '@/lib/encryption';
+
+/** SQLite stores Json/String[] as plain String — deserialize at runtime */
+const _isSqlite = (process.env.DATABASE_URL || '').startsWith('file:');
+function _fromDb(v: any): any { if (!_isSqlite || typeof v !== 'string') return v; try { return JSON.parse(v); } catch { return v; } }
+
+function validateInternalToken(request: NextRequest): boolean {
+  const authHeader = request.headers.get('authorization') || '';
+  const token = authHeader.replace(/^Bearer\\s+/i, '');
+  const expected = process.env.INTERNAL_API_TOKEN;
+  if (!expected || expected.length < 32) return false;
+  return token === expected;
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  if (!validateInternalToken(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const provider = await prisma.provider.findUnique({
+      where: { id: id },
+      include: {
+        models: {
+          where: { isAvailable: true, isDeprecated: false },
+          select: {
+            id: true, modelId: true, name: true,
+            capabilities: true, contextWindow: true,
+            inputCost: true, outputCost: true,
+          },
+        },
+      },
+    });
+
+    if (!provider) {
+      return NextResponse.json({ error: 'Provider not found' }, { status: 404 });
+    }
+
+    let apiKey: string | null = null;
+    try {
+      if (provider.apiKey) apiKey = decrypt(provider.apiKey);
+    } catch {
+      console.warn(\`Failed to decrypt API key for provider \${provider.id}\`);
+    }
+
+    return NextResponse.json({
+      id: provider.id,
+      name: provider.name,
+      type: provider.type,
+      base_url: provider.baseUrl,
+      api_key: apiKey,
+      config: _fromDb(provider.config),
+      status: provider.status,
+      is_default: provider.isDefault,
+      priority: provider.priority,
+      models: provider.models.map((m: any) => ({
+        id: m.id,
+        model_id: m.modelId,
+        name: m.name,
+        capabilities: _fromDb(m.capabilities),
+        context_window: m.contextWindow,
+        input_cost: m.inputCost,
+        output_cost: m.outputCost,
+      })),
+    });
+  } catch (error: any) {
+    console.error('Error fetching internal provider:', error);
+    return NextResponse.json(
+      { error: 'Failed to fetch provider', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Internal Usage Route — /api/internal/providers/[id]/usage/route.ts
+// ─────────────────────────────────────────────────────────
+function generateInternalProviderUsageRoute() {
+    return `// @chimerai component=InternalProviderUsageRoute version=1.0
+/**
+ * Internal Provider API — Report usage / token consumption
+ * POST /api/internal/providers/[id]/usage
+ *
+ * Called by the Python AI Service after each AI call to track
+ * token usage, costs, and credits in the central ApiUsage table.
+ * Protected by INTERNAL_API_TOKEN (Bearer token).
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { prisma } from '@/lib/prisma';
+
+function validateInternalToken(request: NextRequest): boolean {
+  const authHeader = request.headers.get('authorization') || '';
+  const token = authHeader.replace(/^Bearer\\s+/i, '');
+  const expected = process.env.INTERNAL_API_TOKEN;
+  if (!expected || expected.length < 32) return false;
+  return token === expected;
+}
+
+interface UsagePayload {
+  user_id: string;
+  model: string;
+  endpoint: string;
+  prompt_tokens: number;
+  completion_tokens: number;
+  total_tokens?: number;
+  cost?: number;
+  success?: boolean;
+  error_message?: string;
+  response_time?: number;
+}
+
+const TOKENS_PER_CREDIT = 1000;
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { id } = await params;
+  if (!validateInternalToken(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const body: UsagePayload = await request.json();
+
+    if (!body.user_id || !body.model || !body.endpoint) {
+      return NextResponse.json(
+        { error: 'Missing required fields: user_id, model, endpoint' },
+        { status: 400 }
+      );
+    }
+
+    const providerId = id;
+    const totalTokens = body.total_tokens ?? (body.prompt_tokens + body.completion_tokens);
+    const creditsUsed = Math.ceil(totalTokens / TOKENS_PER_CREDIT);
+
+    // If cost not provided, try to compute from model pricing
+    let cost = body.cost ?? 0;
+    if (!body.cost && totalTokens > 0) {
+      try {
+        const model = await prisma.model.findFirst({
+          where: { providerId, modelId: body.model },
+        });
+        if (model) {
+          cost =
+            (body.prompt_tokens * model.inputCost) / 1_000_000 +
+            (body.completion_tokens * model.outputCost) / 1_000_000;
+        }
+      } catch {
+        // Pricing lookup failed — use 0
+      }
+    }
+
+    const usage = await prisma.apiUsage.create({
+      data: {
+        userId: body.user_id,
+        providerId,
+        model: body.model,
+        endpoint: body.endpoint,
+        promptTokens: body.prompt_tokens,
+        completionTokens: body.completion_tokens,
+        totalTokens,
+        tokensUsed: totalTokens,
+        creditsUsed,
+        cost,
+        success: body.success ?? true,
+        errorMessage: body.error_message || null,
+        responseTime: body.response_time || 0,
+      },
+    });
+
+    return NextResponse.json({
+      success: true,
+      usage_id: usage.id,
+      credits_used: creditsUsed,
+      cost,
+    });
+  } catch (error: any) {
+    console.error('Error reporting usage:', error);
+    return NextResponse.json(
+      { error: 'Failed to report usage', details: error.message },
+      { status: 500 }
+    );
+  }
+}
+`;
+}
+// ─────────────────────────────────────────────────────────
+// Notify Provider Change Utility — lib/notify-provider-change.ts
+// ─────────────────────────────────────────────────────────
+function generateNotifyProviderChangeLib() {
+    return `// @chimerai component=NotifyProviderChangeLib version=1.0
+/**
+ * Notify the AI Service that provider configuration has changed.
+ * Triggers cache invalidation so the service fetches fresh provider data.
+ *
+ * Non-critical: failures are logged but don't throw.
+ */
+
+export async function notifyProviderChange(): Promise<void> {
+  const aiServiceUrl = process.env.AI_SERVICE_URL || 'http://localhost:8002';
+  const internalToken = process.env.INTERNAL_API_TOKEN;
+
+  if (!internalToken) {
+    console.warn('Cannot notify AI service: INTERNAL_API_TOKEN not configured');
+    return;
+  }
+
+  try {
+    const resp = await fetch(\`\${aiServiceUrl}/api/internal/invalidate-cache\`, {
+      method: 'POST',
+      headers: {
+        Authorization: \`Bearer \${internalToken}\`,
+        'Content-Type': 'application/json',
+      },
+      signal: AbortSignal.timeout(5000),
+    });
+
+    if (resp.ok) {
+      console.log('AI service provider cache invalidated');
+    } else {
+      console.warn(\`Failed to invalidate AI service cache: \${resp.status}\`);
+    }
+  } catch (error: any) {
+    // Non-critical: AI service might not be running
+    console.debug(\`Could not reach AI service: \${error.message}\`);
+  }
+}
+`;
+}